48 lines
1.8 KiB
Nginx Configuration File
48 lines
1.8 KiB
Nginx Configuration File
# Example nginx site for ParentCalendar: the app stays on your LAN/VPN, only the calendar feeds are public.
|
|
# Copy to /etc/nginx/sites-available/parentcalendar, change the server_name, certificate paths and allowed
|
|
# networks, then link it into sites-enabled and run `nginx -t && systemctl reload nginx`.
|
|
# Assumes the app listens on 127.0.0.1:8000 (compose.example.yml) and PUBLIC_URL=https://calendar.example.com.
|
|
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name calendar.example.com;
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
http2 on;
|
|
server_name calendar.example.com;
|
|
|
|
ssl_certificate /etc/letsencrypt/live/calendar.example.com/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/calendar.example.com/privkey.pem;
|
|
|
|
# Public: subscription feeds, so family phones refresh from anywhere.
|
|
# The token in the URL is the only secret, so nginx doesn't log these requests either.
|
|
location /feed/ {
|
|
access_log off;
|
|
limit_except GET { deny all; } # GET also allows HEAD
|
|
proxy_pass http://127.0.0.1:8000;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
# Everything else (the app and its API) is private: home network and VPN only.
|
|
location / {
|
|
allow 192.168.0.0/16; # home LAN
|
|
allow 10.0.0.0/8; # VPN, e.g. WireGuard
|
|
allow 127.0.0.1;
|
|
allow ::1;
|
|
deny all;
|
|
|
|
client_max_body_size 260m; # a scan is up to 10 files of 25 MB
|
|
proxy_pass http://127.0.0.1:8000;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
}
|