cinnabarflower/mnemo_cards
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

stuff

Browse source
This commit is contained in:
Dmitry 2025-11-23 03:23:22 +03:00
parent b8cba066c9
commit 0365252728
4 changed files with 474 additions and 43 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
.forgejo/workflows/deploy.yaml
View file

@ -185,14 +185,14 @@ jobs:
ln -sf /etc/nginx/sites-available/vscode.mnemo-cards.online.conf /etc/nginx/sites-enabled/
echo "📊 Testing nginx configuration..."
if nginx -t; then
if /usr/sbin/nginx -t; then
echo "✅ Configuration is valid"
echo "🔄 Reloading nginx..."
systemctl reload nginx
echo "✅ nginx reloaded successfully"
else
echo "❌ Configuration test failed!"
nginx -t || true
/usr/sbin/nginx -t || true
exit 1
fi

207
tools/deploy/generate-nginx-configs-new.sh Normal file
View file

@ -0,0 +1,207 @@
#!/bin/bash
# Script to generate all nginx configurations for the project
# This ensures consistent configuration across all deployments
set -e
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
OUTPUT_DIR="$SCRIPT_DIR/generated_configs"
echo "🔧 Generating nginx configurations..."
echo "Output directory: $OUTPUT_DIR"
echo ""
# Create output directory
mkdir -p "$OUTPUT_DIR"
# Function to generate nginx configuration for a service
generate_nginx_config() {
local domain=$1
local upstream_port=$2
local service_name=$3
local output_file="$OUTPUT_DIR/$domain.conf"
echo "📝 Generating config for $domain (port $upstream_port)..."
cat > "$output_file" << EOF
# Nginx configuration for $domain
# Generated by generate-nginx-configs.sh on $(date)
# Service: $service_name
server {
listen 80;
server_name $domain;
return 301 https://\$server_name\$request_uri;
}
server {
listen 443 ssl http2;
server_name $domain;
# SSL configuration
ssl_certificate /etc/letsencrypt/live/mnemo-cards.online/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mnemo-cards.online/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
# Security headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
EOF
# Add service-specific settings
case $service_name in
vscode)
cat >> "$output_file" << EOF
# VSCode Server specific settings
client_max_body_size 100M;
# Static files - no rate limiting
location ~ ^/(static|out|node_modules)/ {
proxy_pass http://127.0.0.1:$upstream_port;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
proxy_cache_valid 200 1h;
add_header Cache-Control "public, max-age=3600";
proxy_connect_timeout 60s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;
}
# Static file extensions - no rate limiting
location ~ \.(js|css|woff|woff2|ttf|eot|png|jpg|jpeg|gif|svg|ico|webp|map|json)$ {
proxy_pass http://127.0.0.1:$upstream_port;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
proxy_cache_valid 200 1h;
add_header Cache-Control "public, max-age=3600";
proxy_connect_timeout 60s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;
}
# Main proxy location
location / {
proxy_pass http://127.0.0.1:$upstream_port;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
proxy_http_version 1.1;
proxy_set_header Upgrade \$http_upgrade;
proxy_set_header Connection "upgrade";
proxy_connect_timeout 60s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;
proxy_buffering off;
proxy_request_buffering off;
}
EOF
;;
forgejo)
cat >> "$output_file" << EOF
# Forgejo (Git) specific settings
client_max_body_size 100M;
# Main proxy location
location / {
proxy_pass http://127.0.0.1:$upstream_port;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
proxy_http_version 1.1;
proxy_set_header Upgrade \$http_upgrade;
proxy_set_header Connection "upgrade";
proxy_connect_timeout 60s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;
proxy_buffering off;
proxy_request_buffering off;
}
EOF
;;
webapp)
cat >> "$output_file" << EOF
# Web app specific settings
client_max_body_size 1000M;
root /var/www/mnemo_cards;
index index.html;
location / {
try_files \$uri \$uri/ /index.html;
}
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
expires 1y;
add_header Cache-Control "public, immutable";
}
# ACME challenge for certificate renewal
location /.well-known/acme-challenge/ {
root /var/www/html;
try_files \$uri =404;
}
EOF
;;
esac
# Close server block
cat >> "$output_file" << EOF
# Security - deny access to hidden files
location ~ /\. {
deny all;
}
}
EOF
echo "✅ Generated $output_file"
}
# Generate configurations for all services
# Main web application
generate_nginx_config "mnemo-cards.online" "" "webapp"
# VSCode Server
generate_nginx_config "vscode.mnemo-cards.online" "8443" "vscode"
# Forgejo (Git server)
generate_nginx_config "code.mnemo-cards.online" "3000" "forgejo"
echo ""
echo "📊 Validating generated configurations..."
# Test each configuration
for config in "$OUTPUT_DIR"/*.conf; do
echo "Testing $(basename "$config")..."
/usr/sbin/nginx -t -c /etc/nginx/nginx.conf -g "include $config;" 2>/dev/null && echo "✅ Valid" || echo "❌ Invalid"
done
echo ""
echo "✅ All configurations generated successfully!"
echo ""
echo "📁 Generated files in: $OUTPUT_DIR"
echo ""
echo "🚀 Use deploy-nginx-configs.sh to deploy these configurations to the server"

262
tools/deploy/generate-nginx-configs-old.sh Executable file
View file

@ -0,0 +1,262 @@
#!/bin/bash
# Script to generate all nginx configurations for the project
# This ensures consistent configuration across all deployments
set -e
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
OUTPUT_DIR="$SCRIPT_DIR/generated_configs"
echo "🔧 Generating nginx configurations..."
echo "Output directory: $OUTPUT_DIR"
echo ""
# Create output directory
mkdir -p "$OUTPUT_DIR"
# Function to generate nginx configuration for a service
generate_nginx_config() {
local domain=$1
local upstream_port=$2
local service_name=$3
local rate_limit_zone=$4
local rate_limit_burst=$5
local output_file="$OUTPUT_DIR/$domain.conf"
echo "📝 Generating config for $domain (port $upstream_port)..."
cat > "$output_file" << EOF
# Nginx configuration for $domain
# Generated by generate-nginx-configs.sh on $(date)
# Service: $service_name
server {
listen 80;
server_name $domain;
return 301 https://\$server_name\$request_uri;
}
server {
listen 443 ssl http2;
server_name $domain;
# SSL configuration
ssl_certificate /etc/letsencrypt/live/mnemo-cards.online/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mnemo-cards.online/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
# Security headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
EOF
# Add service-specific settings
case $service_name in
vscode)
cat >> "$output_file" << EOF
# VSCode Server specific settings
client_max_body_size 100M;
# Rate limiting for VSCode
limit_req_zone \$binary_remote_addr zone=vscode_general:10m rate=100r/m;
limit_req_zone \$binary_remote_addr zone=vscode_login:10m rate=5r/m;
# Static files - no rate limiting
location ~ ^/(static|out|node_modules)/ {
proxy_pass http://127.0.0.1:$upstream_port;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
proxy_cache_valid 200 1h;
add_header Cache-Control "public, max-age=3600";
proxy_connect_timeout 60s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;
}
# Static file extensions - no rate limiting
location ~ \.(js|css|woff|woff2|ttf|eot|png|jpg|jpeg|gif|svg|ico|webp|map|json)$ {
proxy_pass http://127.0.0.1:$upstream_port;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
proxy_cache_valid 200 1h;
add_header Cache-Control "public, max-age=3600";
proxy_connect_timeout 60s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;
}
# Special rate limiting for login attempts
location /login {
limit_req zone=vscode_login burst=2 nodelay;
proxy_pass http://127.0.0.1:$upstream_port;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
proxy_http_version 1.1;
proxy_set_header Upgrade \$http_upgrade;
proxy_set_header Connection "upgrade";
proxy_connect_timeout 60s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;
proxy_buffering off;
proxy_request_buffering off;
}
# Main proxy location with rate limiting
location / {
limit_req zone=vscode_general burst=50 nodelay;
proxy_pass http://127.0.0.1:$upstream_port;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
proxy_http_version 1.1;
proxy_set_header Upgrade \$http_upgrade;
proxy_set_header Connection "upgrade";
proxy_connect_timeout 60s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;
proxy_buffering off;
proxy_request_buffering off;
}
EOF
;;
forgejo)
cat >> "$output_file" << EOF
# Forgejo (Git) specific settings
client_max_body_size 100M;
# Main proxy location
location / {
proxy_pass http://127.0.0.1:$upstream_port;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
proxy_http_version 1.1;
proxy_set_header Upgrade \$http_upgrade;
proxy_set_header Connection "upgrade";
proxy_connect_timeout 60s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;
proxy_buffering off;
proxy_request_buffering off;
}
EOF
;;
webapp)
cat >> "$output_file" << EOF
# Web app specific settings
client_max_body_size 1000M;
root /var/www/mnemo_cards;
index index.html;
location / {
try_files \$uri \$uri/ /index.html;
}
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
expires 1y;
add_header Cache-Control "public, immutable";
}
# ACME challenge for certificate renewal
location /.well-known/acme-challenge/ {
root /var/www/html;
try_files \$uri =404;
}
EOF
;;
esac
# Common proxy settings for services that don't have custom proxy blocks
if [ "$service_name" = "vscode" ]; then
cat >> "$output_file" << EOF
proxy_pass http://127.0.0.1:$upstream_port;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
proxy_http_version 1.1;
proxy_set_header Upgrade \$http_upgrade;
proxy_set_header Connection "upgrade";
proxy_connect_timeout 60s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;
proxy_buffering off;
proxy_request_buffering off;
}
EOF
fi
# Gzip compression for all services
cat >> "$output_file" << EOF
}
# Gzip compression (configured globally in nginx.conf)
# Security - deny access to hidden files
location ~ /\. {
deny all;
}
}
EOF
echo "✅ Generated $output_file"
}
# Generate configurations for all services
# Main web application
generate_nginx_config "mnemo-cards.online" "" "webapp"
# VSCode Server
generate_nginx_config "vscode.mnemo-cards.online" "8443" "vscode"
# Forgejo (Git server)
generate_nginx_config "code.mnemo-cards.online" "3000" "forgejo"
echo ""
echo "📊 Validating generated configurations..."
# Test each configuration
for config in "$OUTPUT_DIR"/*.conf; do
echo "Testing $(basename "$config")..."
/usr/sbin/nginx -t -c /etc/nginx/nginx.conf -g "include $config;" 2>/dev/null && echo "✅ Valid" || echo "❌ Invalid"
done
echo ""
echo "✅ All configurations generated successfully!"
echo ""
echo "📁 Generated files in: $OUTPUT_DIR"
echo ""
echo "🚀 Use deploy-nginx-configs.sh to deploy these configurations to the server"

44
tools/deploy/generate-nginx-configs.sh
View file

@ -20,8 +20,6 @@ generate_nginx_config() {
local domain=$1
local upstream_port=$2
local service_name=$3
local rate_limit_zone=$4
local rate_limit_burst=$5
local output_file="$OUTPUT_DIR/$domain.conf"
echo "📝 Generating config for $domain (port $upstream_port)..."
@ -63,10 +61,6 @@ EOF
# VSCode Server specific settings
client_max_body_size 100M;
# Rate limiting for VSCode
limit_req_zone \$binary_remote_addr zone=vscode_general:10m rate=100r/m;
limit_req_zone \$binary_remote_addr zone=vscode_login:10m rate=5r/m;
# Static files - no rate limiting
location ~ ^/(static|out|node_modules)/ {
proxy_pass http://127.0.0.1:$upstream_port;
@ -99,10 +93,8 @@ EOF
proxy_read_timeout 60s;
}
# Special rate limiting for login attempts
location /login {
limit_req zone=vscode_login burst=2 nodelay;
# Main proxy location
location / {
proxy_pass http://127.0.0.1:$upstream_port;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
@ -120,10 +112,6 @@ EOF
proxy_buffering off;
proxy_request_buffering off;
}
# Main proxy location with rate limiting
location / {
limit_req zone=vscode_general burst=50 nodelay;
EOF
;;
forgejo)
@ -178,34 +166,8 @@ EOF
;;
esac
# Common proxy settings for services that don't have custom proxy blocks
if [ "$service_name" = "vscode" ]; then
cat >> "$output_file" << EOF
proxy_pass http://127.0.0.1:$upstream_port;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
proxy_http_version 1.1;
proxy_set_header Upgrade \$http_upgrade;
proxy_set_header Connection "upgrade";
proxy_connect_timeout 60s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;
proxy_buffering off;
proxy_request_buffering off;
}
EOF
fi
# Gzip compression for all services
# Close server block
cat >> "$output_file" << EOF
}
# Gzip compression (configured globally in nginx.conf)
# Security - deny access to hidden files
location ~ /\. {