102 lines
3.8 KiB
Plaintext
102 lines
3.8 KiB
Plaintext
# The HEOS panel at https://domain.com/heos
|
|
#
|
|
# sudo cp /var/www/html/heos/deploy/heos.nginx.conf /etc/nginx/sites-available/heos
|
|
# sudo ln -s /etc/nginx/sites-available/heos /etc/nginx/sites-enabled/heos
|
|
# sudo nginx -t && sudo systemctl reload nginx
|
|
#
|
|
# server_name and the certificate paths have to agree: the paths are the
|
|
# directory certbot made for that name.
|
|
#
|
|
# nginx reaches the panel on port 5443 (WEB_PORT in config.py). To make
|
|
# nginx the only way in, add --host 127.0.0.1 to ExecStart in
|
|
# deploy/heos-panel.service; by default the panel also answers directly on
|
|
# the LAN at <server-ip>:5443.
|
|
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
|
|
server_name domain.com;
|
|
|
|
# Nothing is served in the clear. certbot's nginx plugin works through
|
|
# this block when it renews, so the redirect does not get in its way.
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
# http2 on; # nginx 1.25.1+. Older builds: listen 443 ssl http2;
|
|
|
|
server_name domain.com;
|
|
|
|
ssl_certificate /etc/letsencrypt/live/domain.com/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/domain.com/privkey.pem;
|
|
|
|
# certbot's own settings, kept current by it -- the same thing the maui
|
|
# Apache vhost does with options-ssl-apache.conf. Both files appear when
|
|
# certbot configures a host; if this cert came another way (DNS
|
|
# challenge, standalone, copied from elsewhere) they may not exist and
|
|
# nginx -t will say so. Then drop these two lines for:
|
|
# ssl_protocols TLSv1.2 TLSv1.3;
|
|
# ssl_session_cache shared:SSL:10m;
|
|
# ssl_session_timeout 1d;
|
|
include /etc/letsencrypt/options-ssl-nginx.conf;
|
|
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
|
|
|
# This host is the panel and nothing else, so refuse the rest rather
|
|
# than falling back on nginx's default root and serving whatever
|
|
# happens to sit there. Drop this block if the machine serves more.
|
|
location / {
|
|
return 404;
|
|
}
|
|
|
|
# A bare /heos misses the location below -- it would fall through to
|
|
# the 404 above -- so send it to the slashed form first.
|
|
location = /heos {
|
|
return 301 /heos/;
|
|
}
|
|
|
|
location /heos/ {
|
|
# The panel controls the speakers, and this hostname may well
|
|
# resolve from outside. Keep it to the house unless you mean
|
|
# otherwise: drop these four lines to let it answer from anywhere.
|
|
allow 192.168.0.0/24;
|
|
allow 127.0.0.1;
|
|
allow ::1;
|
|
deny all;
|
|
|
|
# The trailing slash is what strips /heos/ back off before the
|
|
# request reaches the app.
|
|
proxy_pass http://127.0.0.1:5443/;
|
|
|
|
# Tells the app it is mounted on a sub-path, so every link, icon and
|
|
# fetch it generates is /heos/... rather than /... Without this the
|
|
# page loads and nothing on it works.
|
|
proxy_set_header X-Forwarded-Prefix /heos;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Connection "";
|
|
}
|
|
}
|
|
|
|
# Want the panel at the root of this host instead of under /heos? Replace
|
|
# the three location blocks in the 443 server with the one below, and leave
|
|
# X-Forwarded-Prefix out of it -- the app is not on a sub-path then, and
|
|
# generates /static/... and /api/... just as it does on port 5443.
|
|
#
|
|
# location / {
|
|
# proxy_pass http://127.0.0.1:5443;
|
|
# proxy_set_header Host $host;
|
|
# proxy_set_header X-Real-IP $remote_addr;
|
|
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
# proxy_set_header X-Forwarded-Proto $scheme;
|
|
# proxy_http_version 1.1;
|
|
# proxy_set_header Connection "";
|
|
# }
|