stuff
This commit is contained in:
parent
b8cba066c9
commit
0365252728
4 changed files with 474 additions and 43 deletions
|
|
@ -185,14 +185,14 @@ jobs:
|
||||||
ln -sf /etc/nginx/sites-available/vscode.mnemo-cards.online.conf /etc/nginx/sites-enabled/
|
ln -sf /etc/nginx/sites-available/vscode.mnemo-cards.online.conf /etc/nginx/sites-enabled/
|
||||||
|
|
||||||
echo "📊 Testing nginx configuration..."
|
echo "📊 Testing nginx configuration..."
|
||||||
if nginx -t; then
|
if /usr/sbin/nginx -t; then
|
||||||
echo "✅ Configuration is valid"
|
echo "✅ Configuration is valid"
|
||||||
echo "🔄 Reloading nginx..."
|
echo "🔄 Reloading nginx..."
|
||||||
systemctl reload nginx
|
systemctl reload nginx
|
||||||
echo "✅ nginx reloaded successfully"
|
echo "✅ nginx reloaded successfully"
|
||||||
else
|
else
|
||||||
echo "❌ Configuration test failed!"
|
echo "❌ Configuration test failed!"
|
||||||
nginx -t || true
|
/usr/sbin/nginx -t || true
|
||||||
exit 1
|
exit 1
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
|
|
||||||
207
tools/deploy/generate-nginx-configs-new.sh
Normal file
207
tools/deploy/generate-nginx-configs-new.sh
Normal file
|
|
@ -0,0 +1,207 @@
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Script to generate all nginx configurations for the project
|
||||||
|
# This ensures consistent configuration across all deployments
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||||
|
OUTPUT_DIR="$SCRIPT_DIR/generated_configs"
|
||||||
|
|
||||||
|
echo "🔧 Generating nginx configurations..."
|
||||||
|
echo "Output directory: $OUTPUT_DIR"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Create output directory
|
||||||
|
mkdir -p "$OUTPUT_DIR"
|
||||||
|
|
||||||
|
# Function to generate nginx configuration for a service
|
||||||
|
generate_nginx_config() {
|
||||||
|
local domain=$1
|
||||||
|
local upstream_port=$2
|
||||||
|
local service_name=$3
|
||||||
|
local output_file="$OUTPUT_DIR/$domain.conf"
|
||||||
|
|
||||||
|
echo "📝 Generating config for $domain (port $upstream_port)..."
|
||||||
|
|
||||||
|
cat > "$output_file" << EOF
|
||||||
|
# Nginx configuration for $domain
|
||||||
|
# Generated by generate-nginx-configs.sh on $(date)
|
||||||
|
# Service: $service_name
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 80;
|
||||||
|
server_name $domain;
|
||||||
|
return 301 https://\$server_name\$request_uri;
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 443 ssl http2;
|
||||||
|
server_name $domain;
|
||||||
|
|
||||||
|
# SSL configuration
|
||||||
|
ssl_certificate /etc/letsencrypt/live/mnemo-cards.online/fullchain.pem;
|
||||||
|
ssl_certificate_key /etc/letsencrypt/live/mnemo-cards.online/privkey.pem;
|
||||||
|
ssl_protocols TLSv1.2 TLSv1.3;
|
||||||
|
ssl_ciphers HIGH:!aNULL:!MD5;
|
||||||
|
|
||||||
|
# Security headers
|
||||||
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||||
|
add_header X-XSS-Protection "1; mode=block" always;
|
||||||
|
add_header X-Content-Type-Options "nosniff" always;
|
||||||
|
add_header Referrer-Policy "no-referrer-when-downgrade" always;
|
||||||
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||||
|
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# Add service-specific settings
|
||||||
|
case $service_name in
|
||||||
|
vscode)
|
||||||
|
cat >> "$output_file" << EOF
|
||||||
|
# VSCode Server specific settings
|
||||||
|
client_max_body_size 100M;
|
||||||
|
|
||||||
|
# Static files - no rate limiting
|
||||||
|
location ~ ^/(static|out|node_modules)/ {
|
||||||
|
proxy_pass http://127.0.0.1:$upstream_port;
|
||||||
|
proxy_set_header Host \$host;
|
||||||
|
proxy_set_header X-Real-IP \$remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto \$scheme;
|
||||||
|
|
||||||
|
proxy_cache_valid 200 1h;
|
||||||
|
add_header Cache-Control "public, max-age=3600";
|
||||||
|
|
||||||
|
proxy_connect_timeout 60s;
|
||||||
|
proxy_send_timeout 60s;
|
||||||
|
proxy_read_timeout 60s;
|
||||||
|
}
|
||||||
|
|
||||||
|
# Static file extensions - no rate limiting
|
||||||
|
location ~ \.(js|css|woff|woff2|ttf|eot|png|jpg|jpeg|gif|svg|ico|webp|map|json)$ {
|
||||||
|
proxy_pass http://127.0.0.1:$upstream_port;
|
||||||
|
proxy_set_header Host \$host;
|
||||||
|
proxy_set_header X-Real-IP \$remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto \$scheme;
|
||||||
|
|
||||||
|
proxy_cache_valid 200 1h;
|
||||||
|
add_header Cache-Control "public, max-age=3600";
|
||||||
|
|
||||||
|
proxy_connect_timeout 60s;
|
||||||
|
proxy_send_timeout 60s;
|
||||||
|
proxy_read_timeout 60s;
|
||||||
|
}
|
||||||
|
|
||||||
|
# Main proxy location
|
||||||
|
location / {
|
||||||
|
proxy_pass http://127.0.0.1:$upstream_port;
|
||||||
|
proxy_set_header Host \$host;
|
||||||
|
proxy_set_header X-Real-IP \$remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto \$scheme;
|
||||||
|
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
proxy_set_header Upgrade \$http_upgrade;
|
||||||
|
proxy_set_header Connection "upgrade";
|
||||||
|
|
||||||
|
proxy_connect_timeout 60s;
|
||||||
|
proxy_send_timeout 60s;
|
||||||
|
proxy_read_timeout 60s;
|
||||||
|
|
||||||
|
proxy_buffering off;
|
||||||
|
proxy_request_buffering off;
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
;;
|
||||||
|
forgejo)
|
||||||
|
cat >> "$output_file" << EOF
|
||||||
|
# Forgejo (Git) specific settings
|
||||||
|
client_max_body_size 100M;
|
||||||
|
|
||||||
|
# Main proxy location
|
||||||
|
location / {
|
||||||
|
proxy_pass http://127.0.0.1:$upstream_port;
|
||||||
|
proxy_set_header Host \$host;
|
||||||
|
proxy_set_header X-Real-IP \$remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto \$scheme;
|
||||||
|
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
proxy_set_header Upgrade \$http_upgrade;
|
||||||
|
proxy_set_header Connection "upgrade";
|
||||||
|
|
||||||
|
proxy_connect_timeout 60s;
|
||||||
|
proxy_send_timeout 60s;
|
||||||
|
proxy_read_timeout 60s;
|
||||||
|
|
||||||
|
proxy_buffering off;
|
||||||
|
proxy_request_buffering off;
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
;;
|
||||||
|
webapp)
|
||||||
|
cat >> "$output_file" << EOF
|
||||||
|
# Web app specific settings
|
||||||
|
client_max_body_size 1000M;
|
||||||
|
|
||||||
|
root /var/www/mnemo_cards;
|
||||||
|
index index.html;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
try_files \$uri \$uri/ /index.html;
|
||||||
|
}
|
||||||
|
|
||||||
|
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
|
||||||
|
expires 1y;
|
||||||
|
add_header Cache-Control "public, immutable";
|
||||||
|
}
|
||||||
|
|
||||||
|
# ACME challenge for certificate renewal
|
||||||
|
location /.well-known/acme-challenge/ {
|
||||||
|
root /var/www/html;
|
||||||
|
try_files \$uri =404;
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
# Close server block
|
||||||
|
cat >> "$output_file" << EOF
|
||||||
|
|
||||||
|
# Security - deny access to hidden files
|
||||||
|
location ~ /\. {
|
||||||
|
deny all;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
|
||||||
|
echo "✅ Generated $output_file"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Generate configurations for all services
|
||||||
|
|
||||||
|
# Main web application
|
||||||
|
generate_nginx_config "mnemo-cards.online" "" "webapp"
|
||||||
|
|
||||||
|
# VSCode Server
|
||||||
|
generate_nginx_config "vscode.mnemo-cards.online" "8443" "vscode"
|
||||||
|
|
||||||
|
# Forgejo (Git server)
|
||||||
|
generate_nginx_config "code.mnemo-cards.online" "3000" "forgejo"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "📊 Validating generated configurations..."
|
||||||
|
|
||||||
|
# Test each configuration
|
||||||
|
for config in "$OUTPUT_DIR"/*.conf; do
|
||||||
|
echo "Testing $(basename "$config")..."
|
||||||
|
/usr/sbin/nginx -t -c /etc/nginx/nginx.conf -g "include $config;" 2>/dev/null && echo "✅ Valid" || echo "❌ Invalid"
|
||||||
|
done
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "✅ All configurations generated successfully!"
|
||||||
|
echo ""
|
||||||
|
echo "📁 Generated files in: $OUTPUT_DIR"
|
||||||
|
echo ""
|
||||||
|
echo "🚀 Use deploy-nginx-configs.sh to deploy these configurations to the server"
|
||||||
262
tools/deploy/generate-nginx-configs-old.sh
Executable file
262
tools/deploy/generate-nginx-configs-old.sh
Executable file
|
|
@ -0,0 +1,262 @@
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Script to generate all nginx configurations for the project
|
||||||
|
# This ensures consistent configuration across all deployments
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||||
|
OUTPUT_DIR="$SCRIPT_DIR/generated_configs"
|
||||||
|
|
||||||
|
echo "🔧 Generating nginx configurations..."
|
||||||
|
echo "Output directory: $OUTPUT_DIR"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Create output directory
|
||||||
|
mkdir -p "$OUTPUT_DIR"
|
||||||
|
|
||||||
|
# Function to generate nginx configuration for a service
|
||||||
|
generate_nginx_config() {
|
||||||
|
local domain=$1
|
||||||
|
local upstream_port=$2
|
||||||
|
local service_name=$3
|
||||||
|
local rate_limit_zone=$4
|
||||||
|
local rate_limit_burst=$5
|
||||||
|
local output_file="$OUTPUT_DIR/$domain.conf"
|
||||||
|
|
||||||
|
echo "📝 Generating config for $domain (port $upstream_port)..."
|
||||||
|
|
||||||
|
cat > "$output_file" << EOF
|
||||||
|
# Nginx configuration for $domain
|
||||||
|
# Generated by generate-nginx-configs.sh on $(date)
|
||||||
|
# Service: $service_name
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 80;
|
||||||
|
server_name $domain;
|
||||||
|
return 301 https://\$server_name\$request_uri;
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 443 ssl http2;
|
||||||
|
server_name $domain;
|
||||||
|
|
||||||
|
# SSL configuration
|
||||||
|
ssl_certificate /etc/letsencrypt/live/mnemo-cards.online/fullchain.pem;
|
||||||
|
ssl_certificate_key /etc/letsencrypt/live/mnemo-cards.online/privkey.pem;
|
||||||
|
ssl_protocols TLSv1.2 TLSv1.3;
|
||||||
|
ssl_ciphers HIGH:!aNULL:!MD5;
|
||||||
|
|
||||||
|
# Security headers
|
||||||
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||||
|
add_header X-XSS-Protection "1; mode=block" always;
|
||||||
|
add_header X-Content-Type-Options "nosniff" always;
|
||||||
|
add_header Referrer-Policy "no-referrer-when-downgrade" always;
|
||||||
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||||
|
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# Add service-specific settings
|
||||||
|
case $service_name in
|
||||||
|
vscode)
|
||||||
|
cat >> "$output_file" << EOF
|
||||||
|
# VSCode Server specific settings
|
||||||
|
client_max_body_size 100M;
|
||||||
|
|
||||||
|
# Rate limiting for VSCode
|
||||||
|
limit_req_zone \$binary_remote_addr zone=vscode_general:10m rate=100r/m;
|
||||||
|
limit_req_zone \$binary_remote_addr zone=vscode_login:10m rate=5r/m;
|
||||||
|
|
||||||
|
# Static files - no rate limiting
|
||||||
|
location ~ ^/(static|out|node_modules)/ {
|
||||||
|
proxy_pass http://127.0.0.1:$upstream_port;
|
||||||
|
proxy_set_header Host \$host;
|
||||||
|
proxy_set_header X-Real-IP \$remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto \$scheme;
|
||||||
|
|
||||||
|
proxy_cache_valid 200 1h;
|
||||||
|
add_header Cache-Control "public, max-age=3600";
|
||||||
|
|
||||||
|
proxy_connect_timeout 60s;
|
||||||
|
proxy_send_timeout 60s;
|
||||||
|
proxy_read_timeout 60s;
|
||||||
|
}
|
||||||
|
|
||||||
|
# Static file extensions - no rate limiting
|
||||||
|
location ~ \.(js|css|woff|woff2|ttf|eot|png|jpg|jpeg|gif|svg|ico|webp|map|json)$ {
|
||||||
|
proxy_pass http://127.0.0.1:$upstream_port;
|
||||||
|
proxy_set_header Host \$host;
|
||||||
|
proxy_set_header X-Real-IP \$remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto \$scheme;
|
||||||
|
|
||||||
|
proxy_cache_valid 200 1h;
|
||||||
|
add_header Cache-Control "public, max-age=3600";
|
||||||
|
|
||||||
|
proxy_connect_timeout 60s;
|
||||||
|
proxy_send_timeout 60s;
|
||||||
|
proxy_read_timeout 60s;
|
||||||
|
}
|
||||||
|
|
||||||
|
# Special rate limiting for login attempts
|
||||||
|
location /login {
|
||||||
|
limit_req zone=vscode_login burst=2 nodelay;
|
||||||
|
|
||||||
|
proxy_pass http://127.0.0.1:$upstream_port;
|
||||||
|
proxy_set_header Host \$host;
|
||||||
|
proxy_set_header X-Real-IP \$remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto \$scheme;
|
||||||
|
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
proxy_set_header Upgrade \$http_upgrade;
|
||||||
|
proxy_set_header Connection "upgrade";
|
||||||
|
|
||||||
|
proxy_connect_timeout 60s;
|
||||||
|
proxy_send_timeout 60s;
|
||||||
|
proxy_read_timeout 60s;
|
||||||
|
|
||||||
|
proxy_buffering off;
|
||||||
|
proxy_request_buffering off;
|
||||||
|
}
|
||||||
|
|
||||||
|
# Main proxy location with rate limiting
|
||||||
|
location / {
|
||||||
|
limit_req zone=vscode_general burst=50 nodelay;
|
||||||
|
proxy_pass http://127.0.0.1:$upstream_port;
|
||||||
|
proxy_set_header Host \$host;
|
||||||
|
proxy_set_header X-Real-IP \$remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto \$scheme;
|
||||||
|
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
proxy_set_header Upgrade \$http_upgrade;
|
||||||
|
proxy_set_header Connection "upgrade";
|
||||||
|
|
||||||
|
proxy_connect_timeout 60s;
|
||||||
|
proxy_send_timeout 60s;
|
||||||
|
proxy_read_timeout 60s;
|
||||||
|
|
||||||
|
proxy_buffering off;
|
||||||
|
proxy_request_buffering off;
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
;;
|
||||||
|
forgejo)
|
||||||
|
cat >> "$output_file" << EOF
|
||||||
|
# Forgejo (Git) specific settings
|
||||||
|
client_max_body_size 100M;
|
||||||
|
|
||||||
|
# Main proxy location
|
||||||
|
location / {
|
||||||
|
proxy_pass http://127.0.0.1:$upstream_port;
|
||||||
|
proxy_set_header Host \$host;
|
||||||
|
proxy_set_header X-Real-IP \$remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto \$scheme;
|
||||||
|
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
proxy_set_header Upgrade \$http_upgrade;
|
||||||
|
proxy_set_header Connection "upgrade";
|
||||||
|
|
||||||
|
proxy_connect_timeout 60s;
|
||||||
|
proxy_send_timeout 60s;
|
||||||
|
proxy_read_timeout 60s;
|
||||||
|
|
||||||
|
proxy_buffering off;
|
||||||
|
proxy_request_buffering off;
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
;;
|
||||||
|
webapp)
|
||||||
|
cat >> "$output_file" << EOF
|
||||||
|
# Web app specific settings
|
||||||
|
client_max_body_size 1000M;
|
||||||
|
|
||||||
|
root /var/www/mnemo_cards;
|
||||||
|
index index.html;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
try_files \$uri \$uri/ /index.html;
|
||||||
|
}
|
||||||
|
|
||||||
|
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
|
||||||
|
expires 1y;
|
||||||
|
add_header Cache-Control "public, immutable";
|
||||||
|
}
|
||||||
|
|
||||||
|
# ACME challenge for certificate renewal
|
||||||
|
location /.well-known/acme-challenge/ {
|
||||||
|
root /var/www/html;
|
||||||
|
try_files \$uri =404;
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
# Common proxy settings for services that don't have custom proxy blocks
|
||||||
|
if [ "$service_name" = "vscode" ]; then
|
||||||
|
cat >> "$output_file" << EOF
|
||||||
|
proxy_pass http://127.0.0.1:$upstream_port;
|
||||||
|
proxy_set_header Host \$host;
|
||||||
|
proxy_set_header X-Real-IP \$remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto \$scheme;
|
||||||
|
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
proxy_set_header Upgrade \$http_upgrade;
|
||||||
|
proxy_set_header Connection "upgrade";
|
||||||
|
|
||||||
|
proxy_connect_timeout 60s;
|
||||||
|
proxy_send_timeout 60s;
|
||||||
|
proxy_read_timeout 60s;
|
||||||
|
|
||||||
|
proxy_buffering off;
|
||||||
|
proxy_request_buffering off;
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Gzip compression for all services
|
||||||
|
cat >> "$output_file" << EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
# Gzip compression (configured globally in nginx.conf)
|
||||||
|
|
||||||
|
# Security - deny access to hidden files
|
||||||
|
location ~ /\. {
|
||||||
|
deny all;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
|
||||||
|
echo "✅ Generated $output_file"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Generate configurations for all services
|
||||||
|
|
||||||
|
# Main web application
|
||||||
|
generate_nginx_config "mnemo-cards.online" "" "webapp"
|
||||||
|
|
||||||
|
# VSCode Server
|
||||||
|
generate_nginx_config "vscode.mnemo-cards.online" "8443" "vscode"
|
||||||
|
|
||||||
|
# Forgejo (Git server)
|
||||||
|
generate_nginx_config "code.mnemo-cards.online" "3000" "forgejo"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "📊 Validating generated configurations..."
|
||||||
|
|
||||||
|
# Test each configuration
|
||||||
|
for config in "$OUTPUT_DIR"/*.conf; do
|
||||||
|
echo "Testing $(basename "$config")..."
|
||||||
|
/usr/sbin/nginx -t -c /etc/nginx/nginx.conf -g "include $config;" 2>/dev/null && echo "✅ Valid" || echo "❌ Invalid"
|
||||||
|
done
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "✅ All configurations generated successfully!"
|
||||||
|
echo ""
|
||||||
|
echo "📁 Generated files in: $OUTPUT_DIR"
|
||||||
|
echo ""
|
||||||
|
echo "🚀 Use deploy-nginx-configs.sh to deploy these configurations to the server"
|
||||||
|
|
@ -20,8 +20,6 @@ generate_nginx_config() {
|
||||||
local domain=$1
|
local domain=$1
|
||||||
local upstream_port=$2
|
local upstream_port=$2
|
||||||
local service_name=$3
|
local service_name=$3
|
||||||
local rate_limit_zone=$4
|
|
||||||
local rate_limit_burst=$5
|
|
||||||
local output_file="$OUTPUT_DIR/$domain.conf"
|
local output_file="$OUTPUT_DIR/$domain.conf"
|
||||||
|
|
||||||
echo "📝 Generating config for $domain (port $upstream_port)..."
|
echo "📝 Generating config for $domain (port $upstream_port)..."
|
||||||
|
|
@ -63,10 +61,6 @@ EOF
|
||||||
# VSCode Server specific settings
|
# VSCode Server specific settings
|
||||||
client_max_body_size 100M;
|
client_max_body_size 100M;
|
||||||
|
|
||||||
# Rate limiting for VSCode
|
|
||||||
limit_req_zone \$binary_remote_addr zone=vscode_general:10m rate=100r/m;
|
|
||||||
limit_req_zone \$binary_remote_addr zone=vscode_login:10m rate=5r/m;
|
|
||||||
|
|
||||||
# Static files - no rate limiting
|
# Static files - no rate limiting
|
||||||
location ~ ^/(static|out|node_modules)/ {
|
location ~ ^/(static|out|node_modules)/ {
|
||||||
proxy_pass http://127.0.0.1:$upstream_port;
|
proxy_pass http://127.0.0.1:$upstream_port;
|
||||||
|
|
@ -99,10 +93,8 @@ EOF
|
||||||
proxy_read_timeout 60s;
|
proxy_read_timeout 60s;
|
||||||
}
|
}
|
||||||
|
|
||||||
# Special rate limiting for login attempts
|
# Main proxy location
|
||||||
location /login {
|
location / {
|
||||||
limit_req zone=vscode_login burst=2 nodelay;
|
|
||||||
|
|
||||||
proxy_pass http://127.0.0.1:$upstream_port;
|
proxy_pass http://127.0.0.1:$upstream_port;
|
||||||
proxy_set_header Host \$host;
|
proxy_set_header Host \$host;
|
||||||
proxy_set_header X-Real-IP \$remote_addr;
|
proxy_set_header X-Real-IP \$remote_addr;
|
||||||
|
|
@ -120,10 +112,6 @@ EOF
|
||||||
proxy_buffering off;
|
proxy_buffering off;
|
||||||
proxy_request_buffering off;
|
proxy_request_buffering off;
|
||||||
}
|
}
|
||||||
|
|
||||||
# Main proxy location with rate limiting
|
|
||||||
location / {
|
|
||||||
limit_req zone=vscode_general burst=50 nodelay;
|
|
||||||
EOF
|
EOF
|
||||||
;;
|
;;
|
||||||
forgejo)
|
forgejo)
|
||||||
|
|
@ -178,34 +166,8 @@ EOF
|
||||||
;;
|
;;
|
||||||
esac
|
esac
|
||||||
|
|
||||||
# Common proxy settings for services that don't have custom proxy blocks
|
# Close server block
|
||||||
if [ "$service_name" = "vscode" ]; then
|
|
||||||
cat >> "$output_file" << EOF
|
|
||||||
proxy_pass http://127.0.0.1:$upstream_port;
|
|
||||||
proxy_set_header Host \$host;
|
|
||||||
proxy_set_header X-Real-IP \$remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
|
||||||
proxy_set_header X-Forwarded-Proto \$scheme;
|
|
||||||
|
|
||||||
proxy_http_version 1.1;
|
|
||||||
proxy_set_header Upgrade \$http_upgrade;
|
|
||||||
proxy_set_header Connection "upgrade";
|
|
||||||
|
|
||||||
proxy_connect_timeout 60s;
|
|
||||||
proxy_send_timeout 60s;
|
|
||||||
proxy_read_timeout 60s;
|
|
||||||
|
|
||||||
proxy_buffering off;
|
|
||||||
proxy_request_buffering off;
|
|
||||||
}
|
|
||||||
EOF
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Gzip compression for all services
|
|
||||||
cat >> "$output_file" << EOF
|
cat >> "$output_file" << EOF
|
||||||
}
|
|
||||||
|
|
||||||
# Gzip compression (configured globally in nginx.conf)
|
|
||||||
|
|
||||||
# Security - deny access to hidden files
|
# Security - deny access to hidden files
|
||||||
location ~ /\. {
|
location ~ /\. {
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue