From d537487b86ccc3a1598203d85587bc93d63a5561 Mon Sep 17 00:00:00 2001 From: Hane Date: Wed, 27 May 2026 20:09:35 +0200 Subject: [PATCH] fix: pluton upstream & fix mount setups --- compose/nginx/compose.yaml | 12 ++++---- config/nginx/nginx.conf | 63 +++++++++++++++++++++++++++++--------- 2 files changed, 55 insertions(+), 20 deletions(-) diff --git a/compose/nginx/compose.yaml b/compose/nginx/compose.yaml index 1da025b..7286e4d 100644 --- a/compose/nginx/compose.yaml +++ b/compose/nginx/compose.yaml @@ -10,12 +10,12 @@ services: # Configs folder, excluding modules subfolder. Since this is basically a linux mount, I can't # seem to find a way to prevent modules from creating on the host, so for now I'm just # mapping each file and the conf.d directory individually (T＿T) - - /home/hane/pihanepi/config/nginx/conf.d:/etc/nginx/conf.d:ro,Z - - /home/hane/pihanepi/config/nginx/uwsgi_params:/etc/nginx/uwsgi_params:ro,Z - - /home/hane/pihanepi/config/nginx/scgi_params:/etc/nginx/scgi_params:ro,Z - - /home/hane/pihanepi/config/nginx/nginx.conf:/etc/nginx/nginx.conf:ro,Z - - /home/hane/pihanepi/config/nginx/fastcgi_params:/etc/nginx/fastcgi_params:ro,Z - - /home/hane/pihanepi/config/nginx/fastcgi.conf:/etc/nginx/fastcgi.conf:ro,Z + - /home/hane/pihanepi/config/nginx/conf.d:/etc/nginx/conf.d:ro,z + - /home/hane/pihanepi/config/nginx/uwsgi_params:/etc/nginx/uwsgi_params:z + - /home/hane/pihanepi/config/nginx/scgi_params:/etc/nginx/scgi_params:z + - /home/hane/pihanepi/config/nginx/nginx.conf:/etc/nginx/nginx.conf:z + - /home/hane/pihanepi/config/nginx/fastcgi_params:/etc/nginx/fastcgi_params:z + - /home/hane/pihanepi/config/nginx/fastcgi.conf:/etc/nginx/fastcgi.conf:z # We also create and map a certs folder for TLS - /home/hane/pihanepi/config/nginx/certs:/etc/nginx/certs/ diff --git a/config/nginx/nginx.conf b/config/nginx/nginx.conf index c82de2c..560df7f 100644 --- a/config/nginx/nginx.conf +++ b/config/nginx/nginx.conf @@ -35,6 +35,12 @@ http { server 192.168.1.45:8000; keepalive 2; } + + upstream plutonio { + zone plutonio 64k; + server 192.168.1.45:8001; + keepalive 2; + } # Needed to support websocket connections # See: https://nginx.org/en/docs/http/websocket.html @@ -45,6 +51,21 @@ http { '' ""; } + ssl_certificate /etc/nginx/certs/CERTS.pem; + ssl_certificate_key /etc/nginx/certs/KEY.pem; + #cert.key + + server { + server_name _; + listen [::]:80 default_server; + listen [::]:443 ssl default_server; + + ssl_certificate /etc/nginx/certs/CERTS.pem; + ssl_certificate_key /etc/nginx/certs/KEY.pem; + + return 404; + } + server { listen 80; server_name localhost; @@ -107,31 +128,45 @@ http { # HTTPS server # + server { listen 443 ssl; - server_name localhost 192.168.1.45 internal.test; - - ssl_certificate /etc/nginx/certs/CERTS.pem; - ssl_certificate_key /etc/nginx/certs/KEY.pem; - #cert.key + server_name pluton.internal.test; ssl_session_cache shared:SSL:1m; ssl_session_timeout 5m; ssl_ciphers HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers on; - rewrite ^/test(.*)$ / break; - - - #location /test { - # rewrite ^/test(.*)$ / break; - # root /var/www; - # index index.html index.htm; - #} location / { - proxy_pass http://vaultwarden-default; + proxy_pass http://plutonio; } + } + server { + listen 443 ssl; + server_name vault.internal.test; + + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 5m; + + ssl_ciphers HIGH:!aNULL:!MD5; + ssl_prefer_server_ciphers on; + rewrite ^/test(.*)$ / break; #TODO: actually delete from URI too + + + #location /test { + #rewrite ^/test(.*)$ / break; + # root /var/www; + # index index.html index.htm; + #} + + location / { + proxy_pass http://vaultwarden-default; + } + + } + }