Skip to content

Commit 53da147

Browse files
trimstraytrimstray
committed
added reverse proxy example config
- signed-off-by: trimstray <[email protected]>
1 parent 0ff0946 commit 53da147

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

56 files changed

+873
-0
lines changed

‎lib/nginx/dhparam_4096-with-ds.pem

Whitespace-only changes.

‎lib/nginx/dhparam_4096.pem

Whitespace-only changes.

‎lib/nginx/master/_acls/external.geo.acl

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
geo $globals_external_geo_acl {
2+
3+
# Status code:
4+
# - 0 = false
5+
# - 1 = true
6+
default 0;
7+
8+
### EXTERNAL ###
9+
216.129.67.216/32 1;
10+
11+
### GUEST IP ###
12+
65.64.29.68/32 1;
13+
88.151.87.220/32 1;
14+
15+
}

‎lib/nginx/master/_acls/external.map.acl

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
map $remote_addr $globals_external_map_acl {
2+
3+
# Status code:
4+
# - 0 = false
5+
# - 1 = true
6+
default 0;
7+
8+
### EXTERNAL ###
9+
216.129.67.216/32 1;
10+
11+
### GUEST IP ###
12+
65.64.29.68/32 1;
13+
88.151.87.220/32 1;
14+
15+
}

‎lib/nginx/master/_acls/internal.geo.acl

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
geo $globals_internal_geo_acl {
2+
3+
# Status code:
4+
# - 0 = false
5+
# - 1 = true
6+
default 0;
7+
8+
### INTERNAL ###
9+
10.255.10.0/24 1;
10+
10.255.20.0/24 1;
11+
10.255.30.0/24 1;
12+
172.31.254.0/24 1;
13+
192.168.0.0/16 1;
14+
15+
}

‎lib/nginx/master/_acls/internal.map.acl

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
map $remote_addr $globals_internal_map_acl {
2+
3+
# Status code:
4+
# - 0 = false
5+
# - 1 = true
6+
default 0;
7+
8+
### INTERNAL ###
9+
10.255.10.0/24 1;
10+
10.255.20.0/24 1;
11+
10.255.30.0/24 1;
12+
172.31.254.0/24 1;
13+
192.168.0.0/16 1;
14+
15+
}

‎lib/nginx/master/_basic/main.conf

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
default_type application/octet-stream;
2+
3+
log_format main '$remote_addr - $remote_user [$time_local] '
4+
'"$request_method $scheme://$host$request_uri '
5+
'$server_protocol" $status $body_bytes_sent '
6+
'"$http_referer" "$http_user_agent" '
7+
'$request_time';
8+
9+
server_tokens off;
10+
11+
ignore_invalid_headers on;
12+
13+
if_modified_since before;
14+
server_names_hash_max_size 1024;
15+
16+
tcp_nodelay off;
17+
tcp_nopush on;
18+
19+
sendfile on;
20+
21+
client_body_buffer_size 64k;
22+
client_header_buffer_size 1k;
23+
client_max_body_size 64k;
24+
large_client_header_buffers 2 1k;
25+
26+
# Enabling in the case of problems with large traffic.
27+
# client_body_timeout 5s;
28+
# client_header_timeout 5s
29+
client_body_timeout 10s;
30+
client_header_timeout 10s;
31+
32+
keepalive_requests 100;
33+
keepalive_timeout 5s 5s;
34+
send_timeout 20s;
35+
36+
gzip off;

‎lib/nginx/master/_basic/proxy-params.conf

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
proxy_set_header Host $host;
2+
3+
proxy_set_header X-Real-IP $remote_addr;
4+
5+
# alternative: X-Forwarded-Proto $scheme;
6+
proxy_set_header X-Forwarded-Proto "https";
7+
8+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
9+
10+
proxy_hide_header X-Powered-By;
11+
proxy_hide_header X-AspNetMvc-Version;
12+
proxy_hide_header X-AspNet-Version;
13+
proxy_hide_header X-Drupal-Cache;
14+
15+
more_set_headers "Server: phaing7K";
16+
17+
# proxy_buffering off;
18+
proxy_buffers 4 256k;
19+
proxy_buffer_size 128k;
20+
proxy_busy_buffers_size 256k;
21+
22+
proxy_intercept_errors on;

‎lib/nginx/master/_basic/rate-limiting.conf

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# requests limiting
2+
limit_req_zone $binary_remote_addr zone=per_ip_10r_s:20m rate=10r/s;
3+
limit_req_zone $binary_remote_addr zone=per_ip_60r_s:200m rate=60r/s;
4+
limit_req_zone $binary_remote_addr zone=per_ip_600r_s:200m rate=600r/s;
5+
limit_req_zone $binary_remote_addr zone=per_ip_3000r_m:200m rate=3000r/m;
6+
7+
# connections limititng
8+
limit_conn_zone $binary_remote_addr zone=per_ip_connections:200m;
9+
10+
# ratelimiting POST method
11+
map $request_method $limit_post_map {
12+
default "";
13+
POST $binary_remote_addr;
14+
}
15+
16+
map $request_method $limit_post_per_vhost_map {
17+
default "";
18+
POST $server_name;
19+
}
20+
21+
limit_req_zone $limit_post_map zone=per_ip_post_limit_50r_s:20m rate=50r/s;
22+
limit_req_zone $limit_post_per_vhost_map zone=per_server_post_limit_30r_s:20m rate=30r/s;
23+
limit_req_status 420;

‎lib/nginx/master/_helpers/limits.conf

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
add_header Allow "GET, POST, HEAD" always;
2+
3+
if ($request_method !~ ^(GET|POST|HEAD)$) {
4+
5+
return 405;
6+
7+
}
8+
9+
if ($request_uri ~ "/\.") {
10+
11+
return 403;
12+
13+
}

‎lib/nginx/master/_helpers/static.conf

Whitespace-only changes.

‎lib/nginx/master/_listen/192.168.250.2/http.conf

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
listen 192.168.250.2:80;

‎lib/nginx/master/_listen/192.168.250.2/https.conf

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
listen 192.168.250.2:443 ssl http2;
2+
3+
ssl_session_cache shared:SSL:10m;
4+
ssl_session_timeout 24h;
5+
ssl_session_tickets off;
6+
ssl_buffer_size 1400;
7+
8+
ssl_protocols TLSv1.2;
9+
ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384";
10+
11+
ssl_prefer_server_ciphers on;
12+
13+
ssl_ecdh_curve secp521r1:secp384r1;
14+
15+
# ssl_dhparam /etc/nginx/dhparam_4096-with-ds.pem;

‎lib/nginx/master/_listen/localhost/http.conf

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
listen 127.0.0.1:80;

‎lib/nginx/master/_listen/localhost/https.conf

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
listen 127.0.0.1:443 ssl http2;
2+
3+
ssl_session_cache shared:SSL:10m;
4+
ssl_session_timeout 24h;
5+
ssl_session_tickets off;
6+
ssl_buffer_size 1400;
7+
8+
ssl_protocols TLSv1.2;
9+
ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384";
10+
11+
ssl_prefer_server_ciphers on;
12+
13+
ssl_ecdh_curve secp521r1:secp384r1;
14+
15+
# ssl_dhparam /etc/nginx/dhparam_4096-with-ds.pem;

‎lib/nginx/master/_server/blkcipher.info/acls/demo.conf

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
allow 195.156.18.216;

‎lib/nginx/master/_server/blkcipher.info/backends.conf

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
upstream blkcipher_info_prod_backend {
2+
server 10.217.10.10:4000 max_fails=3 fail_timeout=15s;
3+
server 10.217.10.11:4000 max_fails=3 fail_timeout=15s;
4+
}
5+
6+
upstream blkcipher_info_test_backend {
7+
server 10.217.11.20:4000 max_fails=3 fail_timeout=30s;
8+
}

‎lib/nginx/master/_server/blkcipher.info/certs/blkcipher.info.conf

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
ssl_certificate /etc/nginx/master/_server/blkcipher.info/certs/nginx_blkcipher.info_bundle.crt;
2+
ssl_certificate_key /etc/nginx/master/_server/blkcipher.info/certs/blkcipher.info.key;

‎lib/nginx/master/_server/blkcipher.info/certs/blkcipher.info.key

Whitespace-only changes.

‎lib/nginx/master/_server/blkcipher.info/certs/nginx_blkcipher.info_bundle.crt

Whitespace-only changes.

‎lib/nginx/master/_server/blkcipher.info/credentials/demo.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
user:$apr1$WWUPPs0j$MajkasP5Wqp23.3EsBaRl/

‎lib/nginx/master/_server/blkcipher.info/servers.conf

+79
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
# server {
2+
#
3+
# include /etc/nginx/master/_listen/192.168.250.2/http.conf;
4+
#
5+
# include /etc/nginx/master/_static/errors.conf;
6+
#
7+
# root /usr/share/www/http-error-pages/sites/other;
8+
#
9+
# server_name blkcipher.info www.blkcipher.info;
10+
#
11+
# location / {
12+
#
13+
# return 301 https://$host$request_uri;
14+
#
15+
# }
16+
#
17+
# location ~ /\.well-known/acme-challenge {
18+
#
19+
# root /var/www;
20+
#
21+
# }
22+
#
23+
# access_log /var/log/nginx/domains/blkcipher.info/blkcipher.info-access.log main;
24+
# error_log /var/log/nginx/domains/blkcipher.info/blkcipher.info-error.log crit;
25+
#
26+
# }
27+
28+
server {
29+
30+
include /etc/nginx/master/_listen/192.168.250.2/https.conf;
31+
32+
include /etc/nginx/master/_server/blkcipher.info/certs/blkcipher.info.conf;
33+
34+
include /etc/nginx/master/_static/errors.conf;
35+
36+
include /etc/nginx/master/_helpers/limits.conf;
37+
38+
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains" always;
39+
add_header X-XSS-Protection "1; mode=block" always;
40+
add_header X-Frame-Options "SAMEORIGIN" always;
41+
add_header Referrer-Policy "no-referrer";
42+
add_header X-Content-Type-Options "nosniff" always;
43+
add_header Content-Security-Policy "default-src 'none'; script-src 'none'; img-src 'self'; style-src 'self' https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com; font-src 'self' https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com; object-src 'none'; frame-ancestors 'self'; base-uri 'self'; form-action 'self';";
44+
add_header Feature-Policy "geolocation none; midi none; notifications none; push none; sync-xhr none; microphone none; camera none; magnetometer none; gyroscope none; speaker none; vibrate none; fullscreen self; payment none; usb none;";
45+
46+
root /usr/share/www/http-error-pages/sites/other;
47+
48+
server_name blkcipher.info www.blkcipher.info;
49+
50+
if ($host = www.blkcipher.info) {
51+
52+
return 301 https://blkcipher.info$request_uri;
53+
54+
}
55+
56+
location / {
57+
58+
# proxy_pass http://blkcipher_info_prod_backend;
59+
proxy_pass http://localhost:80;
60+
client_max_body_size 2m;
61+
62+
}
63+
64+
location ~ ^/(blog) {
65+
66+
return 301 https://blkcipher.info;
67+
68+
}
69+
70+
location ~ /\.well-known/acme-challenge {
71+
72+
root /var/www;
73+
74+
}
75+
76+
access_log /var/log/nginx/domains/blkcipher.info/blkcipher.info-access.log main;
77+
error_log /var/log/nginx/domains/blkcipher.info/blkcipher.info-error.log crit;
78+
79+
}

‎lib/nginx/master/_server/defaults/backends.conf

Whitespace-only changes.

‎lib/nginx/master/_server/defaults/certs/defaults.conf

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
ssl_certificate /etc/nginx/master/_server/defaults/certs/nginx_defaults_bundle.crt;
2+
ssl_certificate_key /etc/nginx/master/_server/defaults/certs/defaults.key;

‎lib/nginx/master/_server/defaults/certs/defaults.key

Whitespace-only changes.

‎lib/nginx/master/_server/defaults/certs/nginx_defaults_bundle.crt

Whitespace-only changes.

‎lib/nginx/master/_server/defaults/servers.conf

+54
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# server {
2+
#
3+
# include /etc/nginx/master/_listen/192.168.250.2/http.conf;
4+
#
5+
# include /etc/nginx/master/_static/errors.conf;
6+
#
7+
# root /usr/share/www/http-error-pages/sites/other;
8+
#
9+
# server_name default_server;
10+
#
11+
# location / {
12+
#
13+
# root /etc/nginx/master/_static/error-pages/sites/other;
14+
#
15+
# }
16+
#
17+
# access_log /var/log/nginx/defaults/defaults-access.log main;
18+
# error_log /var/log/nginx/defaults/defaults-error.log crit;
19+
#
20+
# }
21+
22+
server {
23+
24+
include /etc/nginx/master/_listen/192.168.250.2/https.conf;
25+
26+
include /etc/nginx/master/_server/defaults/certs/defaults.conf;
27+
28+
include /etc/nginx/master/_static/errors.conf;
29+
30+
include /etc/nginx/master/_helpers/limits.conf;
31+
32+
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains" always;
33+
add_header X-XSS-Protection "1; mode=block" always;
34+
add_header X-Frame-Options "SAMEORIGIN" always;
35+
add_header Referrer-Policy "no-referrer";
36+
add_header X-Content-Type-Options "nosniff" always;
37+
add_header Content-Security-Policy "default-src 'none'; script-src 'none'; img-src 'self'; style-src 'self' https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com; font-src 'self' https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com; object-src 'none'; frame-ancestors 'self'; base-uri 'self'; form-action 'self';";
38+
add_header Feature-Policy "geolocation none; midi none; notifications none; push none; sync-xhr none; microphone none; camera none; magnetometer none; gyroscope none; speaker none; vibrate none; fullscreen self; payment none; usb none;";
39+
40+
root /usr/share/www/http-error-pages/sites/other;
41+
42+
server_name default_server;
43+
44+
location / {
45+
46+
# root /usr/share/www/http-error-pages/sites/other;
47+
return 301 https://badssl.com;
48+
49+
}
50+
51+
access_log /var/log/nginx/defaults/defaults-access.log main;
52+
error_log /var/log/nginx/defaults/defaults-error.log crit;
53+
54+
}

‎lib/nginx/master/_server/localhost/backends.conf

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
upstream localhost_backend {
2+
server 127.0.0.1:80 max_fails=3 fail_timeout=30s;
3+
}
4+
5+
upstream static_localhost_backend {
6+
server 127.0.0.1:8000 max_fails=3 fail_timeout=30s;
7+
}

‎lib/nginx/master/_server/localhost/certs/localhost.conf

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
ssl_certificate /etc/nginx/master/_server/localhost/certs/nginx_localhost_bundle.crt;
2+
ssl_certificate_key /etc/nginx/master/_server/localhost/certs/localhost.key;

‎lib/nginx/master/_server/localhost/certs/localhost.key

Whitespace-only changes.

‎lib/nginx/master/_server/localhost/certs/nginx_localhost_bundle.crt

Whitespace-only changes.

0 commit comments

Comments
 (0)