summaryrefslogtreecommitdiff
path: root/roles/elevate/liquidtruth/templates/nginx.conf.j2
diff options
context:
space:
mode:
authorChristian Pointner <equinox@spreadspace.org>2019-06-09 22:15:10 +0200
committerChristian Pointner <equinox@spreadspace.org>2019-06-09 22:15:10 +0200
commite8631202bb490dde9e245bc668ee4ec8fcc35362 (patch)
treeb3223626c9f3338402a43d04a61b172265aa20ca /roles/elevate/liquidtruth/templates/nginx.conf.j2
parentliquid truth: mongodb + nginx (diff)
liquid-truth vs liquidtruth
Diffstat (limited to 'roles/elevate/liquidtruth/templates/nginx.conf.j2')
-rw-r--r--roles/elevate/liquidtruth/templates/nginx.conf.j248
1 files changed, 48 insertions, 0 deletions
diff --git a/roles/elevate/liquidtruth/templates/nginx.conf.j2 b/roles/elevate/liquidtruth/templates/nginx.conf.j2
new file mode 100644
index 00000000..ef690b1c
--- /dev/null
+++ b/roles/elevate/liquidtruth/templates/nginx.conf.j2
@@ -0,0 +1,48 @@
+# used for websockets
+# set http_connection to either upgrade or close (as normal)
+map $http_upgrade $connection_upgrade {
+ default upgrade;
+ '' close;
+}
+
+server {
+ listen 80;
+ listen [::]:80;
+ server_name {{ liquidtruth_hostnames | join(' ') }};
+
+ include snippets/acmetool.conf;
+
+ location / {
+ return 301 https://$host$request_uri;
+ }
+}
+
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+ server_name {{ liquidtruth_hostnames | join(' ') }};
+
+ include snippets/acmetool.conf;
+ include snippets/ssl.conf;
+ ssl_certificate /var/lib/acme/live/{{ liquidtruth_hostnames[0] }}/fullchain;
+ ssl_certificate_key /var/lib/acme/live/{{ liquidtruth_hostnames[0] }}/privkey;
+ include snippets/hsts.conf;
+
+ location / {
+ proxy_buffering off;
+ proxy_ignore_headers "X-Accel-Buffering";
+ proxy_request_buffering off;
+ proxy_http_version 1.1;
+
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header X-Forwarded-Proto $scheme;
+
+ # for websockets
+ proxy_set_header Upgrade $http_upgrade;
+ proxy_set_header Connection $connection_upgrade;
+
+ proxy_pass http://127.0.0.1:8080;
+ }
+}