nginx cleanup

Nginx/Server Blocks/bin.libraryofcode.org.conf

@@ -7,6 +7,7 @@ server {
     ssl_certificate_key /etc/nginx/ssl/org.key.pem;
 
     root /var/binary;
+    
     location / {
         autoindex on;
     }

Nginx/Server Blocks/board.ins.conf

@@ -7,42 +7,10 @@ server {
     ssl_certificate_key /etc/nginx/ssl/board-ins.key.pem;
 
     location / {
-
-        proxy_set_header Host $host;
-
-        proxy_set_header X-Real-IP $remote_addr;
-
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-        proxy_set_header X-Forwarded-Proto $scheme;
-
-        proxy_set_header X-Frame-Options SAMEORIGIN;
-
         proxy_pass http://localhost:3121;
-
-        proxy_read_timeout 90;
-
-        proxy_redirect http://localhost:3121 https://board.ins;
-
     }
 
     location /api {
-
-        proxy_set_header Host $host;
-
-        proxy_set_header X-Real-IP $remote_addr;
-
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-        proxy_set_header X-Forwarded-Proto $scheme;
-
-        proxy_set_header X-Frame-Options SAMEORIGIN;
-
         proxy_pass http://localhost:3892;
-
-        proxy_read_timeout 90;
-
-        proxy_redirect http://localhost:3892 https://board.ins/api;
-
     }
 }

Nginx/Server Blocks/certapi.libraryofcode.org.conf

@@ -7,22 +7,6 @@ server {
     ssl_certificate_key /etc/nginx/ssl/org.key.pem;
 
     location / {
-
-        proxy_set_header Host $host;
-
-        proxy_set_header X-Real-IP $remote_addr;
-
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-        proxy_set_header X-Forwarded-Proto $scheme;
-
-        proxy_set_header X-Frame-Options SAMEORIGIN;
-
         proxy_pass http://localhost:3030;
-
-        proxy_read_timeout 90;
-
-        proxy_redirect http://localhost:3030 https://certapi.libraryofcode.org;
-
     }
 }

Nginx/Server Blocks/cloud.libraryofcode.org.conf

@@ -9,6 +9,7 @@ server {
     location / {
         return 307 $scheme://www.libraryofcode.org/;
     }
+    
     location ~ /(.*)$ {
         rewrite https://$1.cloud.libraryofcode.org temporary;
     }

Nginx/Server Blocks/comm.libraryofcode.org.conf

@@ -7,22 +7,6 @@ server {
     ssl_certificate_key /etc/nginx/ssl/org.key.pem;
 
     location / {
-
-        proxy_set_header Host $host;
-
-        proxy_set_header X-Real-IP $remote_addr;
-
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-        proxy_set_header X-Forwarded-Proto $scheme;
-
-        proxy_set_header X-Frame-Options SAMEORIGIN;
-
         proxy_pass http://localhost:3895;
-
-        proxy_read_timeout 90;
-
-        proxy_redirect http://localhost:3895 https://comm.libraryofcode.org;
-
     }
 }

Nginx/Server Blocks/confluence.libraryofcode.org.conf

@@ -9,6 +9,7 @@ server {
     location / {
         return 307 https://wiki.libraryofcode.org/;
     }
+    
     location /synchrony {
         proxy_set_header X-Forwarded-Host $host;
         proxy_set_header X-Forwarded-Server $host;

Nginx/Server Blocks/content.libraryofcode.org.conf

@@ -11,6 +11,7 @@ server {
     location / {
         autoindex on;
     }
+    
     location /sec {
         autoindex on;
         auth_basic "Secure Area";

Nginx/Server Blocks/cr.ins.conf

@@ -7,20 +7,6 @@ server {
     ssl_certificate_key /etc/nginx/ssl/cr-ins.key.pem;
 
     location / {
-
-        proxy_set_header Host $host;
-
-        proxy_set_header X-Real-IP $remote_addr;
-
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-        proxy_set_header X-Forwarded-Proto $scheme;
-
         proxy_pass http://10.8.0.1:3891;
-
-        proxy_read_timeout 90;
-
-        proxy_redirect http://10.8.0.1:3891 https://cr.ins;
-
     }
 }

Nginx/Server Blocks/cshd.ins.conf

@@ -7,22 +7,6 @@ server {
     ssl_certificate_key /etc/nginx/ssl/cshd-ins.key.pem;
 
     location / {
-
-        proxy_set_header Host $host;
-
-        proxy_set_header X-Real-IP $remote_addr;
-
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-        proxy_set_header X-Forwarded-Proto $scheme;
-
-        proxy_set_header X-Frame-Options SAMEORIGIN;
-
         proxy_pass http://10.8.0.1:5479;
-
-        proxy_read_timeout 90;
-
-        proxy_redirect http://10.8.0.1:5479 https://modmail.ins;
-
     }
 }

Nginx/Server Blocks/data.ins.conf

@@ -7,22 +7,6 @@ server {
     ssl_certificate_key /etc/nginx/ssl/data-ins.key.pem;
 
     location / {
-
-        proxy_set_header Host $host;
-
-        proxy_set_header X-Real-IP $remote_addr;
-
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-        proxy_set_header X-Forwarded-Proto $scheme;
-
-        proxy_set_header X-Frame-Options SAMEORIGIN;
-
         proxy_pass http://10.8.0.1:19999;
-
-        proxy_read_timeout 90;
-
-        proxy_redirect http://10.8.0.1:19999 https://data.ins;
-
     }
 }

Nginx/Server Blocks/dns.ins.conf

@@ -8,22 +8,10 @@ server {
 
     index index.html index.htm index.php;
     root /opt/powerdns-admin;
+    
     access_log /var/log/nginx/powerdns-admin.local.access.log combined;
     error_log /var/log/nginx/powerdns-admin.local.error.log;
 
-    client_max_body_size 10m;
-    client_body_buffer_size 128k;
-    proxy_redirect off;
-    proxy_connect_timeout 90;
-    proxy_send_timeout 90;
-    proxy_read_timeout 90;
-    proxy_buffers 32 4k;
-    proxy_buffer_size 8k;
-    proxy_set_header Host $host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_headers_hash_bucket_size 64;
-
     location ~ ^/static/ {
         include /etc/nginx/mime.types;
         root /opt/powerdns-admin/powerdnsadmin;

Nginx/Server Blocks/docker.libraryofcode.org.conf

@@ -9,22 +9,6 @@ server {
     client_max_body_size 1G;
 
     location / {
-
-        proxy_set_header Host $host;
-
-        proxy_set_header X-Real-IP $remote_addr;
-
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-        proxy_set_header X-Forwarded-Proto $scheme;
-
-        proxy_set_header X-Frame-Options SAMEORIGIN;
-
         proxy_pass http://localhost:5000;
-
-        proxy_read_timeout 90;
-
-        proxy_redirect http://localhost:5000 https://docker.libraryofcode.org;
-
     }
 }

Nginx/Server Blocks/drive.libraryofcode.org.conf

@@ -9,22 +9,6 @@ server {
     client_max_body_size 1G;
 
     location / {
-
-        proxy_set_header Host $host;
-
-        proxy_set_header X-Real-IP $remote_addr;
-
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-        proxy_set_header X-Forwarded-Proto $scheme;
-
-        proxy_set_header X-Frame-Options SAMEORIGIN;
-
         proxy_pass http://localhost:5608;
-
-        proxy_read_timeout 90;
-
-        proxy_redirect http://localhost:5608 https://drive.libraryofcode.org;
-
     }
 }

Nginx/Server Blocks/eds.libraryofcode.org.conf

@@ -12,20 +12,6 @@ server {
     ssl_certificate_key /etc/nginx/ssl/org.key.pem;
 
     location / {
-
-        proxy_set_header Host $host;
-
-        proxy_set_header X-Real-IP $remote_addr;
-
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-        proxy_set_header X-Forwarded-Proto $scheme;
-
-        proxy_set_header X-Frame-Options SAMEORIGIN;
-
         proxy_pass http://eds-backend;
-
-        proxy_read_timeout 90;
-
     }
 }

Nginx/Server Blocks/firewall.ins.conf

@@ -7,22 +7,6 @@ server {
     ssl_certificate_key /etc/nginx/ssl/firewall-ins.key.pem;
 
     location / {
-
-        proxy_set_header Host $host;
-
-        proxy_set_header X-Real-IP $remote_addr;
-
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-        proxy_set_header X-Forwarded-Proto $scheme;
-
-        proxy_set_header X-Frame-Options SAMEORIGIN;
-
         proxy_pass http://192.168.56.1:80;
-
-        proxy_read_timeout 90;
-
-        proxy_redirect http://192.168.56.1:80 https://firewall.ins;
-
     }
 }

Nginx/Server Blocks/forms.libraryofcode.org.conf

@@ -7,6 +7,7 @@ server {
     ssl_certificate_key /etc/nginx/ssl/org.key.pem;
 
     root /var/www/forms;
+    
     rewrite ^(/.*)\.html(\?.*)?$ $1$2 permanent;
     try_files $uri.html $uri/ $uri =404;
 }

Nginx/Server Blocks/gitlab.libraryofcode.org.conf

@@ -42,12 +42,6 @@ server {
     # resolver 208.67.222.222 208.67.222.220 valid=300s; # Can change to your DNS resolver if desired
     # resolver_timeout 5s;
 
-    ## [Optional] Generate a stronger DHE parameter:
-    ##   sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 4096
-    ##
-    ssl_dhparam /etc/nginx/dhparam.pem;
-    ssl_ecdh_curve secp384r1;
-
     ## Individual nginx logs for this GitLab vhost
     access_log /var/log/nginx/gitlab_access.log;
     error_log /var/log/nginx/gitlab_error.log;

Nginx/Server Blocks/gocrypt.libraryofcode.org.conf

@@ -8,6 +8,7 @@ server {
 
     root /var/www/gocryptdoc;
     index index.html;
+    
     location / {
         try_files $uri $uri/index.html =404;
 

Nginx/Server Blocks/http-redirect.conf

@@ -1,5 +1,4 @@
 server {
-
     listen 80;
     listen [::]:80;
 

Nginx/Server Blocks/keys.libraryofcode.org.conf

@@ -1,12 +1,12 @@
 server {
     listen 443 ssl http2;
-    listen [::]:443 ssl http2;
+    listen [::]:443 ssl http2;server_name keys.libraryofcode.org;
-
+    
-    server_name keys.libraryofcode.org;
     ssl_certificate /etc/nginx/ssl/org.chain.crt;
     ssl_certificate_key /etc/nginx/ssl/org.key.pem;
 
     root /var/www/html/sks;
+    
     error_page 404 /404.html;
 
     location ~ (.git|LICENSE|readme.md) {
@@ -15,7 +15,7 @@ server {
     }
 
     location /pks {
-        proxy_pass http://127.0.0.1:11371;
+        proxy_pass http://localhost:11371;
         proxy_pass_header Server;
     }
 

Nginx/Server Blocks/lists.libraryofcode.org.conf

@@ -11,6 +11,7 @@ server {
     location / {
         return 307 $scheme://lists.libraryofcode.org/cgi-bin/mailman/listinfo;
     }
+    
     location /cgi-bin/mailman {
         root /usr/lib/;
         fastcgi_split_path_info (^/cgi-bin/mailman/[^/]*)(.*)$;
@@ -21,9 +22,11 @@ server {
         fastcgi_intercept_errors on;
         fastcgi_pass unix:/var/run/fcgiwrap.socket;
     }
+    
     location /images/mailman {
         alias /usr/share/images/mailman;
     }
+    
     location /pipermail {
         alias /var/lib/mailman/archives/public;
         autoindex on;

Nginx/Server Blocks/loc.sh.conf

@@ -7,21 +7,7 @@ server {
     ssl_certificate_key /etc/letsencrypt/live/loc.sh-0001/privkey.pem; # managed by Certbot
 
     location / {
-
-        proxy_set_header Host $host;
-
-        proxy_set_header X-Real-IP $remote_addr;
-
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-        proxy_set_header X-Forwarded-Proto $scheme;
-
         proxy_pass http://localhost:3890;
-
-        proxy_read_timeout 90;
-
-        proxy_redirect http://localhost:3890 https://loc.sh;
-
     }
 
 }

Nginx/Server Blocks/modmail.ins.conf

@@ -7,22 +7,6 @@ server {
     ssl_certificate_key /etc/nginx/ssl/modmail-ins.key.pem;
 
     location / {
-
-        proxy_set_header Host $host;
-
-        proxy_set_header X-Real-IP $remote_addr;
-
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-        proxy_set_header X-Forwarded-Proto $scheme;
-
-        proxy_set_header X-Frame-Options SAMEORIGIN;
-
         proxy_pass http://10.8.0.1:5478;
-
-        proxy_read_timeout 90;
-
-        proxy_redirect http://10.8.0.1:5478 https://modmail.ins;
-
     }
 }

Nginx/Server Blocks/pbx.ins.conf

@@ -8,8 +8,8 @@ server {
 
     client_max_body_size 230M;
     client_body_timeout 1h;
+    
     root /var/www/html;
-
     index index.html index.htm index.php;
 
     location / {

Nginx/Server Blocks/report.libraryofcode.org.conf

@@ -11,8 +11,6 @@ server {
 
     location /assets {
         alias /var/www/report/assets/;
-        #root /var/www/report/assets;
-        #try_files /var/www/report/assets/$uri /var/www/report/assets/$uri/ =404;
         try_files $uri $uri/ =404;
     }
 }

Nginx/Server Blocks/s3.libraryofcode.org.conf

@@ -7,13 +7,6 @@ server {
     ssl_certificate_key /etc/nginx/ssl/org.key.pem;
 
     location / {
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Frame-Options SAMEORIGIN;
         proxy_pass http://localhost:9000;
-        proxy_read_timeout 90;
-        proxy_redirect http://localhost:9000 https://s3.libraryofcode.org;
     }
 }

Nginx/Server Blocks/sis.libraryofcode.org.conf

@@ -7,22 +7,7 @@ server {
     ssl_certificate_key /etc/nginx/ssl/org.key.pem;
 
     location / {
-
+        #proxy_pass http://localhost:6969;
-        proxy_set_header Host $host;
+        return 307 https://edu.libraryofcode.org/;
-
-        proxy_set_header X-Real-IP $remote_addr;
-
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-        proxy_set_header X-Forwarded-Proto $scheme;
-
-        proxy_set_header X-Frame-Options SAMEORIGIN;
-
-        proxy_pass http://localhost:6969;
-
-        proxy_read_timeout 90;
-
-        proxy_redirect http://localhost:6969 https://sis.libraryofcode.org;
-
     }
 }

Nginx/Server Blocks/skb.libraryofcode.org.conf

@@ -7,23 +7,8 @@ server {
     ssl_certificate_key /etc/nginx/ssl/org.key.pem;
 
     client_max_body_size 1G;
+    
     location / {
-
-        proxy_set_header Host $host;
-
-        proxy_set_header X-Real-IP $remote_addr;
-
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-        proxy_set_header X-Forwarded-Proto $scheme;
-
-        proxy_set_header X-Frame-Options SAMEORIGIN;
-
         proxy_pass http://localhost:3001;
-
-        proxy_read_timeout 90;
-
-        proxy_redirect http://localhost:3001 https://skb.libraryofcode.org;
-
     }
 }

Nginx/Server Blocks/staff.libraryofcode.org.conf

@@ -6,25 +6,8 @@ server {
     ssl_certificate /etc/nginx/ssl/org.chain.crt;
     ssl_certificate_key /etc/nginx/ssl/org.key.pem;
 
-    ssl_session_cache builtin:1000 shared:SSL:10m;
-    #include /etc/nginx/error/502;
-    #include /etc/nginx/error/504;
-    #include /etc/nginx/error/500;
-    #include /etc/nginx/error/404;
-    #include /etc/nginx/error/429;
-    ssl_protocols TLSv1.2;
-
-    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
-
-    ssl_prefer_server_ciphers on;
-
-    ssl_stapling on;
-    ssl_stapling_verify on;
-
     #limit_req zone=one burst=15;
     location / {
-
         return 307 https://wiki.libraryofcode.org/en/cs-support;
-
     }
 }

Nginx/Server Blocks/static.libraryofcode.org.conf

@@ -6,16 +6,6 @@ server {
     ssl_certificate /etc/nginx/ssl/org.chain.crt;
     ssl_certificate_key /etc/nginx/ssl/org.key.pem;
 
-    ssl_session_cache builtin:1000 shared:SSL:10m;
-    ssl_protocols TLSv1.2;
-
-    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
-
-    ssl_prefer_server_ciphers on;
-
-    ssl_stapling on;
-    ssl_stapling_verify on;
-
     root /var/www/static;
     location / {
         autoindex on;

Nginx/Server Blocks/wiki.libraryofcode.org.conf

@@ -7,23 +7,8 @@ server {
     ssl_certificate_key /etc/nginx/ssl/org.key.pem;
 
     client_max_body_size 1G;
+
     location / {
-
-        proxy_set_header Host $host;
-
-        proxy_set_header X-Real-IP $remote_addr;
-
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-        proxy_set_header X-Forwarded-Proto $scheme;
-
-        proxy_set_header X-Frame-Options SAMEORIGIN;
-
         proxy_pass http://localhost:3000;
-
-        proxy_read_timeout 90;
-
-        proxy_redirect http://localhost:3000 https://wiki.libraryofcode.org;
-
     }
 }

Nginx/nginx.conf

@@ -24,6 +24,7 @@ http {
         server_tokens off;
         more_set_headers 'Server: LIBRARY OF CODE SP-US INTERNAL SVCS (nginx) [https://loc.sh/]';
         add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+        resolver 1.1.1.1 63.141.252.133;
 
         # server_names_hash_bucket_size 64;
         # server_name_in_redirect off;
@@ -38,12 +39,14 @@ http {
         ssl_protocols TLSv1.2;
         ssl_prefer_server_ciphers on;
         ssl_stapling on;
-        ssl_stapling_verify on;
+        #ssl_stapling_verify on;
         ssl_session_cache shared:SSL:10m;
         ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
         ssl_dhparam /etc/nginx/dhparam.pem;
         ssl_ecdh_curve X25519:prime256v1:secp384r1;
 
+
+
         ##
         # Logging Settings
         ##
@@ -83,6 +86,7 @@ http {
         include /etc/nginx/conf.d/*.conf;
         include /etc/nginx/sites-enabled/*;
         include /etc/nginx/sites-custom/*;
+        include /etc/nginx/proxy.conf/;
 }
 
 

Nginx/proxy.conf

@@ -0,0 +1,11 @@
+proxy_redirect          default;
+proxy_set_header        Host              $host;
+proxy_set_header        X-Real-IP         $remote_addr;
+proxy_set_header        X-Forwarded-For   $proxy_add_x_forwarded_for;
+proxy_set_header        X-Forwarded-Proto $scheme;
+proxy_set_header        X-Frame-Options   SAMEORIGIN;
+client_max_body_size    200M;
+proxy_connect_timeout   90;
+proxy_send_timeout      90;
+proxy_read_timeout      90;
+proxy_buffers           32 4k;