From be9fb74cc1567b46907a5d371192282de9de7ff7 Mon Sep 17 00:00:00 2001 From: "J. Scott Elblein" Date: Mon, 8 May 2023 05:21:21 -0500 Subject: [PATCH 01/12] Create it-tools.subdomain.conf.sample For the container: https://github.com/CorentinTh/it-tools --- it-tools.subdomain.conf.sample | 45 ++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 it-tools.subdomain.conf.sample diff --git a/it-tools.subdomain.conf.sample b/it-tools.subdomain.conf.sample new file mode 100644 index 0000000..db01ae8 --- /dev/null +++ b/it-tools.subdomain.conf.sample @@ -0,0 +1,45 @@ +## Version 2023/05/08 +# make sure that your it-tools container is named it-tools +# make sure that your dns has a cname set for it-tools + +server { + listen 443 ssl; + listen [::]:443 ssl; + + server_name it-tools.*; + + include /config/nginx/ssl.conf; + + client_max_body_size 0; + + # enable for ldap auth (requires ldap-location.conf in the location block) + #include /config/nginx/ldap-server.conf; + + # enable for Authelia (requires authelia-location.conf in the location block) + #include /config/nginx/authelia-server.conf; + + # enable for Authentik (requires authentik-location.conf in the location block) + #include /config/nginx/authentik-server.conf; + + location / { + # enable the next two lines for http auth + #auth_basic "Restricted"; + #auth_basic_user_file /config/nginx/.htpasswd; + + # enable for ldap auth (requires ldap-server.conf in the server block) + #include /config/nginx/ldap-location.conf; + + # enable for Authelia (requires authelia-server.conf in the server block) + #include /config/nginx/authelia-location.conf; + + # enable for Authentik (requires authentik-server.conf in the server block) + #include /config/nginx/authentik-location.conf; + + include /config/nginx/proxy.conf; + include /config/nginx/resolver.conf; + set $upstream_app it-tools; + set $upstream_port 80; + set $upstream_proto http; + proxy_pass $upstream_proto://$upstream_app:$upstream_port; + } +} From 3121216d1cd21ea989ef92d30c5e9214f7262e71 Mon Sep 17 00:00:00 2001 From: Jack D Date: Mon, 8 May 2023 22:16:13 +0100 Subject: [PATCH 02/12] added pterodactyl config --- pterodactylnode.subdomain.conf.sample | 60 ++++++++++++++++++++++++++ pterodactylpanel.subdomain.conf.sample | 48 +++++++++++++++++++++ 2 files changed, 108 insertions(+) create mode 100644 pterodactylnode.subdomain.conf.sample create mode 100644 pterodactylpanel.subdomain.conf.sample diff --git a/pterodactylnode.subdomain.conf.sample b/pterodactylnode.subdomain.conf.sample new file mode 100644 index 0000000..a0f047b --- /dev/null +++ b/pterodactylnode.subdomain.conf.sample @@ -0,0 +1,60 @@ +## Version 2023/05/08 +# this is for nodes, not your actual panel +# make sure you set your node to use 443 as its API port +# make sure that your pterodactylnode container is named pterodactylnode +# make sure that your dns has a cname set for pterodactylnode + +server { + listen 443 ssl; + listen [::]:443 ssl; + + server_name pterodactylnode.*; + + include /config/nginx/ssl.conf; + + client_max_body_size 0; + + # enable for ldap auth (requires ldap-location.conf in the location block) + #include /config/nginx/ldap-server.conf; + + # enable for Authelia (requires authelia-location.conf in the location block) + #include /config/nginx/authelia-server.conf; + + # enable for Authentik (requires authentik-location.conf in the location block) + #include /config/nginx/authentik-server.conf; + + location ~ ^\/api\/servers\/(?.*)?\/ws$ { + + include /config/nginx/proxy.conf; + include /config/nginx/resolver.conf; + set $upstream_app pterodactylnode; + set $upstream_port 443; + set $upstream_proto http; + proxy_pass $upstream_proto://$upstream_app:$upstream_port/api/servers/$serverid/ws; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + } + + location / { + # enable the next two lines for http auth + #auth_basic "Restricted"; + #auth_basic_user_file /config/nginx/.htpasswd; + + # enable for ldap auth (requires ldap-server.conf in the server block) + #include /config/nginx/ldap-location.conf; + + # enable for Authelia (requires authelia-server.conf in the server block) + #include /config/nginx/authelia-location.conf; + + # enable for Authentik (requires authentik-server.conf in the server block) + #include /config/nginx/authentik-location.conf; + + include /config/nginx/proxy.conf; + include /config/nginx/resolver.conf; + set $upstream_app pterodactylnode; + set $upstream_port 443; + set $upstream_proto http; + proxy_pass $upstream_proto://$upstream_app:$upstream_port; + + } +} \ No newline at end of file diff --git a/pterodactylpanel.subdomain.conf.sample b/pterodactylpanel.subdomain.conf.sample new file mode 100644 index 0000000..767301c --- /dev/null +++ b/pterodactylpanel.subdomain.conf.sample @@ -0,0 +1,48 @@ +## Version 2023/05/08 +# this is for your actual panel, not nodes +# make sure you set your pterodactyl servers "remote" and "api" addresses to the domains you specify here +# ensure you have enabled "ssl encryption" and (if necessary) "behind proxy" in your pterodactyl server +# make sure that your pterodactyl container is named pterodactyl +# make sure that your dns has a cname set for pterodactyl + +server { + listen 443 ssl; + listen [::]:443 ssl; + + server_name pterodactyl.*; + + include /config/nginx/ssl.conf; + + client_max_body_size 0; + + # enable for ldap auth (requires ldap-location.conf in the location block) + #include /config/nginx/ldap-server.conf; + + # enable for Authelia (requires authelia-location.conf in the location block) + #include /config/nginx/authelia-server.conf; + + # enable for Authentik (requires authentik-location.conf in the location block) + #include /config/nginx/authentik-server.conf; + + location / { + # enable the next two lines for http auth + #auth_basic "Restricted"; + #auth_basic_user_file /config/nginx/.htpasswd; + + # enable for ldap auth (requires ldap-server.conf in the server block) + #include /config/nginx/ldap-location.conf; + + # enable for Authelia (requires authelia-server.conf in the server block) + #include /config/nginx/authelia-location.conf; + + # enable for Authentik (requires authentik-server.conf in the server block) + #include /config/nginx/authentik-location.conf; + include /config/nginx/proxy.conf; + include /config/nginx/resolver.conf; + set $upstream_app pterodactyl; + set $upstream_port 80; + set $upstream_proto http; + proxy_pass $upstream_proto://$upstream_app:$upstream_port; + + } +} \ No newline at end of file From 9d4e3fc59cdb2e2cf4a704f69d960e1bda4cee81 Mon Sep 17 00:00:00 2001 From: BlockListed <44610569+BlockListed@users.noreply.github.com> Date: Wed, 10 May 2023 21:33:29 +0200 Subject: [PATCH 03/12] improve documentation for nextcloud security The default configuration does not pass security checks. A change to ssl.conf is required for secure operation. This behaviour can be very confusing to new users. Documenting this should help make it easier for new nextcloud users to have a secure experience. --- nextcloud.subdomain.conf.sample | 1 + nextcloud.subfolder.conf.sample | 1 + 2 files changed, 2 insertions(+) diff --git a/nextcloud.subdomain.conf.sample b/nextcloud.subdomain.conf.sample index e63d077..c3e2ee1 100644 --- a/nextcloud.subdomain.conf.sample +++ b/nextcloud.subdomain.conf.sample @@ -32,6 +32,7 @@ server { set $upstream_proto https; proxy_pass $upstream_proto://$upstream_app:$upstream_port; + # Uncomment X-Frame-Options directive in ssl.conf to pass security checks. proxy_hide_header X-Frame-Options; proxy_max_temp_file_size 2048m; } diff --git a/nextcloud.subfolder.conf.sample b/nextcloud.subfolder.conf.sample index 11bbb75..8708b4e 100644 --- a/nextcloud.subfolder.conf.sample +++ b/nextcloud.subfolder.conf.sample @@ -34,6 +34,7 @@ location ^~ /nextcloud/ { proxy_pass $upstream_proto://$upstream_app:$upstream_port; rewrite /nextcloud(.*) $1 break; + # Uncomment X-Frame-Options directive in ssl.conf to pass security checks. proxy_hide_header X-Frame-Options; proxy_max_temp_file_size 2048m; proxy_set_header Range $http_range; From 28f85dc19d5eaf0b5abd59fba834813343a2472c Mon Sep 17 00:00:00 2001 From: BlockListed <44610569+BlockListed@users.noreply.github.com> Date: Wed, 10 May 2023 21:37:56 +0200 Subject: [PATCH 04/12] update date for nextcloud confs --- nextcloud.subdomain.conf.sample | 2 +- nextcloud.subfolder.conf.sample | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/nextcloud.subdomain.conf.sample b/nextcloud.subdomain.conf.sample index c3e2ee1..550b32c 100644 --- a/nextcloud.subdomain.conf.sample +++ b/nextcloud.subdomain.conf.sample @@ -1,4 +1,4 @@ -## Version 2023/02/05 +## Version 2023/05/10 # make sure that your nextcloud container is named nextcloud # make sure that your dns has a cname set for nextcloud # assuming this container is called "swag", edit your nextcloud container's config diff --git a/nextcloud.subfolder.conf.sample b/nextcloud.subfolder.conf.sample index 8708b4e..42d2265 100644 --- a/nextcloud.subfolder.conf.sample +++ b/nextcloud.subfolder.conf.sample @@ -1,4 +1,4 @@ -## Version 2023/02/05 +## Version 2023/05/10 # make sure that your nextcloud container is named nextcloud # make sure that nextcloud is set to work with the base url /nextcloud/ # Assuming this container is called "swag", edit your nextcloud container's config From 187ba0c93177b67b650becdbe369287d9c3acc54 Mon Sep 17 00:00:00 2001 From: Jack D <77021733+GetLifty@users.noreply.github.com> Date: Sat, 20 May 2023 00:50:04 +0100 Subject: [PATCH 05/12] Rename pterodactylpanel.subdomain.conf.sample to pterodactyl.subdomain.conf.sample --- ...l.subdomain.conf.sample => pterodactyl.subdomain.conf.sample | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename pterodactylpanel.subdomain.conf.sample => pterodactyl.subdomain.conf.sample (99%) diff --git a/pterodactylpanel.subdomain.conf.sample b/pterodactyl.subdomain.conf.sample similarity index 99% rename from pterodactylpanel.subdomain.conf.sample rename to pterodactyl.subdomain.conf.sample index 767301c..2d2b80a 100644 --- a/pterodactylpanel.subdomain.conf.sample +++ b/pterodactyl.subdomain.conf.sample @@ -45,4 +45,4 @@ server { proxy_pass $upstream_proto://$upstream_app:$upstream_port; } -} \ No newline at end of file +} From 6098392eb97736c132631ff7b326fa62811e4c15 Mon Sep 17 00:00:00 2001 From: Jack D <77021733+GetLifty@users.noreply.github.com> Date: Sat, 20 May 2023 00:52:10 +0100 Subject: [PATCH 06/12] Update pterodactylnode.subdomain.conf.sample Co-authored-by: Eric Nemchik --- pterodactylnode.subdomain.conf.sample | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/pterodactylnode.subdomain.conf.sample b/pterodactylnode.subdomain.conf.sample index a0f047b..c73a9a7 100644 --- a/pterodactylnode.subdomain.conf.sample +++ b/pterodactylnode.subdomain.conf.sample @@ -23,17 +23,6 @@ server { # enable for Authentik (requires authentik-location.conf in the location block) #include /config/nginx/authentik-server.conf; - location ~ ^\/api\/servers\/(?.*)?\/ws$ { - - include /config/nginx/proxy.conf; - include /config/nginx/resolver.conf; - set $upstream_app pterodactylnode; - set $upstream_port 443; - set $upstream_proto http; - proxy_pass $upstream_proto://$upstream_app:$upstream_port/api/servers/$serverid/ws; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - } location / { # enable the next two lines for http auth From b3b500a8eb702d9a84da463b4a46eaf16b74a19b Mon Sep 17 00:00:00 2001 From: Jack D <77021733+GetLifty@users.noreply.github.com> Date: Sat, 20 May 2023 00:52:15 +0100 Subject: [PATCH 07/12] Update pterodactylnode.subdomain.conf.sample Co-authored-by: Eric Nemchik --- pterodactylnode.subdomain.conf.sample | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/pterodactylnode.subdomain.conf.sample b/pterodactylnode.subdomain.conf.sample index c73a9a7..02803f2 100644 --- a/pterodactylnode.subdomain.conf.sample +++ b/pterodactylnode.subdomain.conf.sample @@ -46,4 +46,14 @@ server { proxy_pass $upstream_proto://$upstream_app:$upstream_port; } + + location ~ (/pterodactylnode)?/api { + include /config/nginx/proxy.conf; + include /config/nginx/resolver.conf; + set $upstream_app pterodactylnode; + set $upstream_port 443; + set $upstream_proto http; + proxy_pass $upstream_proto://$upstream_app:$upstream_port/api/servers/$serverid/ws; + + } } \ No newline at end of file From 8355cdc795ef6cf74b9ba5f7d67e65928e001a47 Mon Sep 17 00:00:00 2001 From: Jack D <77021733+GetLifty@users.noreply.github.com> Date: Sat, 20 May 2023 01:02:00 +0100 Subject: [PATCH 08/12] Update pterodactyl.subdomain.conf.sample - attempt to fix whitespace --- pterodactyl.subdomain.conf.sample | 56 +++++++++++++++---------------- 1 file changed, 28 insertions(+), 28 deletions(-) diff --git a/pterodactyl.subdomain.conf.sample b/pterodactyl.subdomain.conf.sample index 2d2b80a..a37168a 100644 --- a/pterodactyl.subdomain.conf.sample +++ b/pterodactyl.subdomain.conf.sample @@ -6,43 +6,43 @@ # make sure that your dns has a cname set for pterodactyl server { - listen 443 ssl; - listen [::]:443 ssl; + listen 443 ssl; + listen [::]:443 ssl; - server_name pterodactyl.*; + server_name pterodactyl.*; - include /config/nginx/ssl.conf; + include /config/nginx/ssl.conf; - client_max_body_size 0; + client_max_body_size 0; # enable for ldap auth (requires ldap-location.conf in the location block) - #include /config/nginx/ldap-server.conf; + #include /config/nginx/ldap-server.conf; - # enable for Authelia (requires authelia-location.conf in the location block) - #include /config/nginx/authelia-server.conf; + # enable for Authelia (requires authelia-location.conf in the location block) + #include /config/nginx/authelia-server.conf; - # enable for Authentik (requires authentik-location.conf in the location block) - #include /config/nginx/authentik-server.conf; + # enable for Authentik (requires authentik-location.conf in the location block) + #include /config/nginx/authentik-server.conf; - location / { - # enable the next two lines for http auth - #auth_basic "Restricted"; - #auth_basic_user_file /config/nginx/.htpasswd; + location / { + # enable the next two lines for http auth + #auth_basic "Restricted"; + #auth_basic_user_file /config/nginx/.htpasswd; - # enable for ldap auth (requires ldap-server.conf in the server block) - #include /config/nginx/ldap-location.conf; + # enable for ldap auth (requires ldap-server.conf in the server block) + #include /config/nginx/ldap-location.conf; - # enable for Authelia (requires authelia-server.conf in the server block) - #include /config/nginx/authelia-location.conf; + # enable for Authelia (requires authelia-server.conf in the server block) + #include /config/nginx/authelia-location.conf; - # enable for Authentik (requires authentik-server.conf in the server block) - #include /config/nginx/authentik-location.conf; - include /config/nginx/proxy.conf; - include /config/nginx/resolver.conf; - set $upstream_app pterodactyl; - set $upstream_port 80; - set $upstream_proto http; - proxy_pass $upstream_proto://$upstream_app:$upstream_port; - - } + # enable for Authentik (requires authentik-server.conf in the server block) + #include /config/nginx/authentik-location.conf; + include /config/nginx/proxy.conf; + include /config/nginx/resolver.conf; + set $upstream_app pterodactyl; + set $upstream_port 80; + set $upstream_proto http; + proxy_pass $upstream_proto://$upstream_app:$upstream_port; + + } } From 08ae51886b8c7943a5fabc9c1f91aa7f5d24f177 Mon Sep 17 00:00:00 2001 From: Jack D Date: Sat, 20 May 2023 01:28:20 +0100 Subject: [PATCH 09/12] Revert "Update pterodactyl.subdomain.conf.sample - attempt to fix whitespace" This reverts commit 8355cdc795ef6cf74b9ba5f7d67e65928e001a47. --- pterodactyl.subdomain.conf.sample | 56 +++++++++++++++---------------- 1 file changed, 28 insertions(+), 28 deletions(-) diff --git a/pterodactyl.subdomain.conf.sample b/pterodactyl.subdomain.conf.sample index a37168a..2d2b80a 100644 --- a/pterodactyl.subdomain.conf.sample +++ b/pterodactyl.subdomain.conf.sample @@ -6,43 +6,43 @@ # make sure that your dns has a cname set for pterodactyl server { - listen 443 ssl; - listen [::]:443 ssl; + listen 443 ssl; + listen [::]:443 ssl; - server_name pterodactyl.*; + server_name pterodactyl.*; - include /config/nginx/ssl.conf; + include /config/nginx/ssl.conf; - client_max_body_size 0; + client_max_body_size 0; # enable for ldap auth (requires ldap-location.conf in the location block) - #include /config/nginx/ldap-server.conf; + #include /config/nginx/ldap-server.conf; - # enable for Authelia (requires authelia-location.conf in the location block) - #include /config/nginx/authelia-server.conf; + # enable for Authelia (requires authelia-location.conf in the location block) + #include /config/nginx/authelia-server.conf; - # enable for Authentik (requires authentik-location.conf in the location block) - #include /config/nginx/authentik-server.conf; + # enable for Authentik (requires authentik-location.conf in the location block) + #include /config/nginx/authentik-server.conf; - location / { - # enable the next two lines for http auth - #auth_basic "Restricted"; - #auth_basic_user_file /config/nginx/.htpasswd; + location / { + # enable the next two lines for http auth + #auth_basic "Restricted"; + #auth_basic_user_file /config/nginx/.htpasswd; - # enable for ldap auth (requires ldap-server.conf in the server block) - #include /config/nginx/ldap-location.conf; + # enable for ldap auth (requires ldap-server.conf in the server block) + #include /config/nginx/ldap-location.conf; - # enable for Authelia (requires authelia-server.conf in the server block) - #include /config/nginx/authelia-location.conf; + # enable for Authelia (requires authelia-server.conf in the server block) + #include /config/nginx/authelia-location.conf; - # enable for Authentik (requires authentik-server.conf in the server block) - #include /config/nginx/authentik-location.conf; - include /config/nginx/proxy.conf; - include /config/nginx/resolver.conf; - set $upstream_app pterodactyl; - set $upstream_port 80; - set $upstream_proto http; - proxy_pass $upstream_proto://$upstream_app:$upstream_port; - - } + # enable for Authentik (requires authentik-server.conf in the server block) + #include /config/nginx/authentik-location.conf; + include /config/nginx/proxy.conf; + include /config/nginx/resolver.conf; + set $upstream_app pterodactyl; + set $upstream_port 80; + set $upstream_proto http; + proxy_pass $upstream_proto://$upstream_app:$upstream_port; + + } } From 96e0323d825ebc7e0e818118bcef1da52328c518 Mon Sep 17 00:00:00 2001 From: Jack D <77021733+GetLifty@users.noreply.github.com> Date: Sat, 20 May 2023 01:35:42 +0100 Subject: [PATCH 10/12] Update pterodactylnode.subdomain.conf.sample - fix failing action check Co-authored-by: Eric Nemchik --- pterodactylnode.subdomain.conf.sample | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pterodactylnode.subdomain.conf.sample b/pterodactylnode.subdomain.conf.sample index 02803f2..e75e7dc 100644 --- a/pterodactylnode.subdomain.conf.sample +++ b/pterodactylnode.subdomain.conf.sample @@ -53,7 +53,7 @@ server { set $upstream_app pterodactylnode; set $upstream_port 443; set $upstream_proto http; - proxy_pass $upstream_proto://$upstream_app:$upstream_port/api/servers/$serverid/ws; + proxy_pass $upstream_proto://$upstream_app:$upstream_port; } } \ No newline at end of file From f13f39410e9f004c0abc22f6a65c3d1d4c4ef824 Mon Sep 17 00:00:00 2001 From: William Brockhus Date: Sat, 27 May 2023 11:25:01 +1000 Subject: [PATCH 11/12] fix: bypass auth for kavita api --- kavita.subdomain.conf.sample | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/kavita.subdomain.conf.sample b/kavita.subdomain.conf.sample index 207b82d..1620c6f 100644 --- a/kavita.subdomain.conf.sample +++ b/kavita.subdomain.conf.sample @@ -43,4 +43,15 @@ server { proxy_pass $upstream_proto://$upstream_app:$upstream_port; } + + # Needed for OPDS access while using Authelia/ldap + location ~ /api { + include /config/nginx/proxy.conf; + include /config/nginx/resolver.conf; + set $upstream_app kavita; + set $upstream_port 5000; + set $upstream_proto http; + proxy_pass $upstream_proto://$upstream_app:$upstream_port; + + } } From 849dadf27b3748e574025c7e12331e6e283c1ace Mon Sep 17 00:00:00 2001 From: William Brockhus Date: Mon, 29 May 2023 09:57:27 +1000 Subject: [PATCH 12/12] Update kavita.subdomain.conf.sample Co-authored-by: Eric Nemchik --- kavita.subdomain.conf.sample | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kavita.subdomain.conf.sample b/kavita.subdomain.conf.sample index 1620c6f..9ce5c4a 100644 --- a/kavita.subdomain.conf.sample +++ b/kavita.subdomain.conf.sample @@ -45,7 +45,7 @@ server { } # Needed for OPDS access while using Authelia/ldap - location ~ /api { + location ~ (/kavita)?/api { include /config/nginx/proxy.conf; include /config/nginx/resolver.conf; set $upstream_app kavita;