110 lines
3.7 KiB
Plaintext
110 lines
3.7 KiB
Plaintext
# Edge reverse proxy — single entry point (replaces Caddy).
|
|
# Optional upstreams use Docker DNS resolver so nginx starts even if a module is disabled.
|
|
|
|
map $http_upgrade $connection_upgrade {
|
|
default upgrade;
|
|
'' close;
|
|
}
|
|
|
|
# Reflect browser Origin for cross-origin API calls (web app on :3000, API on :80).
|
|
map $http_origin $cors_allow_origin {
|
|
default $http_origin;
|
|
'' '*';
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
server_name ${DOMAIN};
|
|
|
|
client_max_body_size 10G;
|
|
|
|
location /api/ {
|
|
resolver 127.0.0.11 valid=10s ipv6=off;
|
|
set $ultid_upstream ultid:8080;
|
|
|
|
proxy_hide_header Access-Control-Allow-Origin;
|
|
proxy_hide_header Access-Control-Allow-Methods;
|
|
proxy_hide_header Access-Control-Allow-Headers;
|
|
proxy_hide_header Access-Control-Expose-Headers;
|
|
proxy_hide_header Access-Control-Max-Age;
|
|
proxy_hide_header Access-Control-Allow-Credentials;
|
|
proxy_hide_header Vary;
|
|
|
|
add_header Access-Control-Allow-Origin $cors_allow_origin always;
|
|
add_header Access-Control-Allow-Methods "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS" always;
|
|
add_header Access-Control-Allow-Headers "Accept, Authorization, Content-Type, Idempotency-Key, Origin, X-Requested-With, X-Trace-Id" always;
|
|
add_header Access-Control-Expose-Headers "X-Trace-Id" always;
|
|
add_header Access-Control-Max-Age 300 always;
|
|
add_header Vary Origin always;
|
|
|
|
proxy_pass http://$ultid_upstream;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
location /ws {
|
|
resolver 127.0.0.11 valid=10s ipv6=off;
|
|
set $ultid_ws_upstream ultid:8080;
|
|
|
|
proxy_hide_header Access-Control-Allow-Origin;
|
|
|
|
add_header Access-Control-Allow-Origin $cors_allow_origin always;
|
|
add_header Vary Origin always;
|
|
|
|
proxy_pass http://$ultid_ws_upstream;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
location /auth/ {
|
|
proxy_pass http://authentik-server:9000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_read_timeout 86400;
|
|
}
|
|
|
|
location /meet/ {
|
|
resolver 127.0.0.11 valid=10s ipv6=off;
|
|
set $jitsi_upstream jitsi-web;
|
|
proxy_pass http://$jitsi_upstream;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
location /cloud/ {
|
|
resolver 127.0.0.11 valid=10s ipv6=off;
|
|
set $nc_upstream nextcloud;
|
|
proxy_pass http://$nc_upstream/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
location = /cloud {
|
|
return 301 /cloud/;
|
|
}
|
|
|
|
location / {
|
|
default_type text/plain;
|
|
return 200 "Ulti Suite\n";
|
|
}
|
|
}
|