nginx config

production/nginx/nginx/conf.d/http3.conf

@@ -0,0 +1 @@
+add_header Alt-Svc 'h3-25=":443"; ma=3600, h2=":443"; ma=3600';

production/nginx/nginx/conf.d/security.conf

@@ -0,0 +1,7 @@
+add_header X-XSS-Protection "1; mode=block";
+add_header X-Permitted-Cross-Domain-Policies none;
+add_header X-Frame-Options SAMEORIGIN;
+add_header X-Content-Type-Options nosniff;
+add_header Referrer-Policy same-origin;
+add_header X-Download-Options noopen;
+add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

production/nginx/nginx/nginx.conf.backup

@@ -0,0 +1,113 @@
+#user www-data;
+worker_processes 4;
+pid /run/nginx.pid;
+#include /etc/nginx/modules-enabled/*.conf;
+
+events {
+	worker_connections 256;
+	# multi_accept on;
+}
+
+http {
+
+	##
+	# Basic Settings
+	##
+        client_max_body_size 10M;
+
+	sendfile on;
+	tcp_nopush on;
+	tcp_nodelay on;
+	keepalive_timeout 65;
+	types_hash_max_size 2048;
+	# server_tokens off;
+
+	# server_names_hash_bucket_size 64;
+	# server_name_in_redirect off;
+
+	include /etc/nginx/mime.types;
+	default_type application/octet-stream;
+
+	##
+	# SSL Settings
+	##
+
+	ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
+	ssl_prefer_server_ciphers on;
+
+	##
+	# Logging Settings
+	##
+
+#	access_log /var/log/nginx/access.log;
+#	error_log /var/log/nginx/error.log;
+#        log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+#                      '$status $body_bytes_sent "$http_referer" '
+#                      '"$http_user_agent" "$http_x_forwarded_for"';
+#	access_log /usr/local/nginx/logs/access.log main;
+#	error_log /usr/local/nginx/logs/error.log;
+	##
+	# Gzip Settings
+	##
+
+	gzip on;
+
+	# gzip_vary on;
+	# gzip_proxied any;
+	# gzip_comp_level 6;
+	# gzip_buffers 16 8k;
+	# gzip_http_version 1.1;
+	# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+
+	##
+	# Virtual Host Configs
+	##
+
+	include /etc/nginx/conf.d/*.conf;
+	include /etc/nginx/sites-enabled/*;
+
+        server_tokens off;
+
+        root /usr/local/nginx/html;
+}
+
+
+#mail {
+#	# See sample authentication script at:
+#	# http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
+# 
+#	# auth_http localhost/auth.php;
+#	# pop3_capabilities "TOP" "USER";
+#	# imap_capabilities "IMAP4rev1" "UIDPLUS";
+# 
+#	server {
+#		listen     localhost:110;
+#		protocol   pop3;
+#		proxy      on;
+#	}
+# 
+#	server {
+#		listen     localhost:143;
+#		protocol   imap;
+#		proxy      on;
+#	}
+#}
+
+rtmp {
+    server {
+        listen 1936;
+#        chunk_size 4000;
+        application hls {
+            live on;
+            hls on;
+            hls_path /etc/nginx/hls;
+            hls_fragment 30s;
+            hls_playlist_length 3m;
+            allow publish 172.51.0.1;
+            deny publish all;
+            allow play all;
+#            exec_static /bin/bash /etc/nginx/emitir-live.sh;
+            exec_static ffmpeg -loglevel quiet -re -i async:cache:rtmp://172.10.0.101:1936/hls/streaming -threads 1 -async 1 -c:v libx264 -preset superfast -tune zerolatency -c:a aac -ar 44100 -f flv rtmp://a.rtmp.youtube.com/live2/4qye-a4f7-9zfy-eq2u-30yz;
+        }
+    }
+}

production/nginx/nginx/sites-available/covid19map

@@ -0,0 +1,17 @@
+server {
+  listen 443 ssl http2;
+  listen [::]:443 ssl http2;
+  server_name covid19.hatthieves.es covid19map.hatthieves.es covidmap.hatthieves.es;
+  location / {
+     proxy_pass http://172.25.0.101:3000;
+     proxy_set_header X-Real-IP $remote_addr;
+     proxy_set_header Host $host;
+     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+     proxy_set_header X-Forwarded-Proto $scheme;
+     proxy_set_header Upgrade $http_upgrade;
+     proxy_set_header Connection "Upgrade";
+     proxy_buffering off;
+#     add_header Alt-Svc 'h3-25=":443"; ma=3600, h2=":443"; ma=3600';
+  }
+}
+

production/nginx/nginx/sites-available/hatboy

@@ -0,0 +1,19 @@
+server {
+  listen 443 ssl http2;
+  listen [::]:443 ssl http2;
+  server_name hatboy.hatthieves.es;
+  client_max_body_size 2G;
+  location / {
+     proxy_pass http://172.159.0.101:8080;
+     proxy_set_header X-Real-IP $remote_addr;
+     proxy_set_header Host $host;
+     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+     proxy_set_header X-Forwarded-Proto $scheme;
+     proxy_set_header Upgrade $http_upgrade;
+     proxy_set_header Connection "Upgrade";
+     proxy_buffering off;
+     proxy_http_version 1.1;
+#     add_header Alt-Svc 'h3-25=":443"; ma=3600, h2=":443"; ma=3600';
+  }
+}
+

production/nginx/nginx/sites-enabled/covid19map

@@ -0,0 +1 @@
+../sites-available/covid19map

production/nginx/nginx/sites-enabled/hatboy

@@ -0,0 +1 @@
+../sites-available/hatboy