configurations/Nginx/Server Blocks/libraryofcode.org.conf

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name certificates.libraryofcode.org;
    ssl_certificate /etc/nginx/ssl/org.chain.crt;

ssl_certificate_key /etc/nginx/ssl/org.key.pem;

#ssl_session_cache builtin:1000 shared:SSL:10m;

#ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

#ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;

#ssl_prefer_server_ciphers on;
ssl_protocols TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
        ssl_prefer_server_ciphers on;ssl_session_cache shared:SSL:10m;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
        ssl_dhparam /etc/nginx/dhparam.pem;ssl_ecdh_curve secp384r1;
        location / {

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Proto $scheme;

proxy_pass https://localhost:8080/;

proxy_read_timeout 90;

proxy_redirect https://localhost:8080 https://certificates.libraryofcode.org;

  }
}

#server {
#    listen 443 ssl;
#    listen [::]:443 ssl;

#    server_name staff.libraryofcode.org;

#    ssl_certificate /etc/nginx/ssl/staff.chain.crt;

#ssl_certificate_key /etc/nginx/ssl/staff.key.pem;
#ssl_session_cache builtin:1000 shared:SSL:10m;
#ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
#ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
#ssl_prefer_server_ciphers on;
#ssl_session_cache builtin:1000 shared:SSL:10m;

#ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

#ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;

#ssl_prefer_server_ciphers on;

#ssl_protocols TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
#       ssl_prefer_server_ciphers on;ssl_session_cache shared:SSL:10m;
#       ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
#        ssl_dhparam /etc/nginx/dhparam.pem;ssl_ecdh_curve secp384r1;
#        location / {

#proxy_set_header Host $host;

#proxy_set_header X-Real-IP $remote_addr;

#proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

#proxy_set_header X-Forwarded-Proto $scheme;

#proxy_pass https://localhost:8082/;

#proxy_read_timeout 90;

#proxy_redirect https://localhost:8082 https://staff.libraryofcode.org;

#  }
#}

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name status.libraryofcode.org;
    ssl_certificate /etc/nginx/ssl/org.chain.crt;

ssl_certificate_key /etc/nginx/ssl/org.key.pem;

#ssl_session_cache builtin:1000 shared:SSL:10m;

#ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

#ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;

#ssl_prefer_server_ciphers on;

ssl_protocols TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
        ssl_prefer_server_ciphers on;ssl_session_cache shared:SSL:10m;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
        ssl_dhparam /etc/nginx/dhparam.pem;ssl_ecdh_curve secp384r1;
        location / {

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Proto $scheme;

proxy_pass http://localhost:8787;

proxy_read_timeout 90;

proxy_redirect http://localhost:8787 https://status.libraryofcode.org;

  }
}


#server {
   # listen 443 ssl;
  #  listen [::]:443 ssl;

  #  server_name modmail.libraryofcode.org;
 #   ssl_certificate /etc/nginx/ssl/org.chain.crt;

#ssl_certificate_key /etc/nginx/ssl/org.key.pem;

#ssl_session_cache builtin:1000 shared:SSL:10m;

#ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

#ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;

#ssl_prefer_server_ciphers on;

#ssl_protocols TLSv1.2; # Dropping SSLv3, ref: POODLE
#        ssl_prefer_server_ciphers on;ssl_session_cache shared:SSL:10m;
        #ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
#ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
#        ssl_dhparam /etc/nginx/dhparam.pem;ssl_ecdh_curve secp384r1;
#        location / {

#proxy_set_header Host $host;

#proxy_set_header X-Real-IP $remote_addr;

#proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

#proxy_set_header X-Forwarded-Proto $scheme;

#proxy_pass http://localhost:8001;

#proxy_read_timeout 90;

#proxy_redirect http://localhost:8001 https://modmail.libraryofcode.org;

#  }
#}

#upstream zammad-railsserver {
#    server 127.0.0.1:3001;
#}

#upstream zammad-websocket {
#    server 127.0.0.1:6042;
#}

#server {
#    listen 443 ssl http2;
#    listen [::]:443 ssl http2;
#
 #   # replace 'localhost' with your fqdn if you want to use zammad from remote
  #  server_name support.libraryofcode.org;
#
 #   root /opt/zammad/public;

  #  access_log /var/log/nginx/zammad.access.log;
   # error_log  /var/log/nginx/zammad.error.log;

    #client_max_body_size 50M;
#ssl_certificate /etc/nginx/ssl/org.chain.crt;

#ssl_certificate_key /etc/nginx/ssl/org.key.pem;
#ssl_session_cache builtin:1000 shared:SSL:10m;
#ssl_protocols TLSv1.2;
#ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
#ssl_prefer_server_ciphers on;
#ssl_session_cache builtin:1000 shared:SSL:10m;

#ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

#ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;

#ssl_prefer_server_ciphers on;

#ssl_protocols TLSv1.2; # Dropping SSLv3, ref: POODLE
#       ssl_prefer_server_ciphers on;ssl_session_cache shared:SSL:10m;
#       ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
#        ssl_dhparam /etc/nginx/dhparam.pem;ssl_ecdh_curve secp384r1;

 #   location ~ ^/(assets/|robots.txt|humans.txt|favicon.ico) {
  #      expires max;
   # }

    #location /ws {
     #   proxy_http_version 1.1;
      #  proxy_set_header Upgrade $http_upgrade;
       # proxy_set_header Connection "Upgrade";
       # proxy_set_header CLIENT_IP $remote_addr;
        #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        #proxy_set_header X-Forwarded-Proto $scheme;
        #proxy_read_timeout 86400;
        #proxy_pass http://zammad-websocket;
    #}

    #location / {
     #   proxy_set_header Host $http_host;
      #  proxy_set_header CLIENT_IP $remote_addr;
       # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        #proxy_set_header X-Forwarded-Proto $scheme;
        #proxy_read_timeout 300;
        #proxy_pass http://zammad-railsserver;

        #gzip on;
        #gzip_types text/plain text/xml text/css image/svg+xml application/javascript application/x-javascript application/json application/xml;
        #gzip_proxied any;
    #}
#}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name vault.staff.libraryofcode.org;
    ssl_certificate /etc/nginx/ssl/vault.chain.crt;

ssl_certificate_key /etc/nginx/ssl/vault.key.pem;

ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_protocols TLSv1.2;

ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

ssl_prefer_server_ciphers on;

        location / {

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Proto $scheme;

proxy_pass http://localhost:8200;

proxy_read_timeout 90;

proxy_redirect http://localhost:8200 https://vault.staff.libraryofcode.org;

  }
}

#upstream gitlab-workhorse {
#  server unix:/var/opt/gitlab/gitlab-workhorse/socket fail_timeout=0;
#}


## HTTPS host
server {
  listen 0.0.0.0:443 ssl http2;
  server_name gitlab.libraryofcode.us; ## Replace this with something like gitlab.example.com
  root /opt/gitlab/embedded/service/gitlab-rails/public;

  ## Strong SSL Security
  ## https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html & https://cipherli.st/
  ssl on;
  ssl_certificate /etc/nginx/ssl/globalsign.chain.crt;
  ssl_certificate_key /etc/nginx/ssl/globalsign.key.pem;

  # GitLab needs backwards compatible ciphers to retain compatibility with Java IDEs
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
  ssl_protocols TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_session_cache shared:SSL:10m;
  ssl_session_timeout 5m;

  ## See app/controllers/application_controller.rb for headers set

  ## [Optional] Enable HTTP Strict Transport Security
  ## HSTS is a feature improving protection against MITM attacks
  ## For more information see: https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/
  add_header Strict-Transport-Security "max-age=31536000; preload";

  ## [Optional] If your certficate has OCSP, enable OCSP stapling to reduce the overhead and latency of running SSL.
  ## Replace with your ssl_trusted_certificate. For more info see:
  ## - https://medium.com/devops-programming/4445f4862461
  ## - https://www.ruby-forum.com/topic/4419319
  ## - https://www.digitalocean.com/community/tutorials/how-to-configure-ocsp-stapling-on-apache-and-nginx
  # ssl_stapling on;
  # ssl_stapling_verify on;
  # ssl_trusted_certificate /etc/nginx/ssl/stapling.trusted.crt;
  # resolver 208.67.222.222 208.67.222.220 valid=300s; # Can change to your DNS resolver if desired
  # resolver_timeout 5s;

  ## [Optional] Generate a stronger DHE parameter:
  ##   sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 4096
  ##
  ssl_dhparam /etc/nginx/dhparam.pem;
  ssl_ecdh_curve secp384r1;

  ## Individual nginx logs for this GitLab vhost
  access_log  /var/log/nginx/gitlab_access.log;
  error_log   /var/log/nginx/gitlab_error.log;

  location / {
    client_max_body_size 0;
    gzip off;

    ## https://github.com/gitlabhq/gitlabhq/issues/694
    ## Some requests take more than 30 seconds.
    proxy_read_timeout      300;
    proxy_connect_timeout   300;
    proxy_redirect          off;

    proxy_http_version 1.1;

    proxy_set_header    Host                $http_host;
    proxy_set_header    X-Real-IP           $remote_addr;
    proxy_set_header    X-Forwarded-Ssl     on;
    proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
    proxy_set_header    X-Forwarded-Proto   $scheme;
    proxy_pass http://gitlab-workhorse;
  }
}

server {
    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;

    server_name www.libraryofcode.org;
    ssl_certificate /etc/nginx/ssl/org.chain.crt;
#if ($request_filename ~ /*){
#        rewrite ^/$ https://loc.sh/discord redirect;
#}
ssl_certificate_key /etc/nginx/ssl/org.key.pem;

#ssl_session_cache builtin:1000 shared:SSL:10m;

#ssl_protocols TLSv1.1 TLSv1.2;

#ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;

#ssl_prefer_server_ciphers on;
ssl_protocols TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
        ssl_prefer_server_ciphers on;ssl_session_cache shared:SSL:10m;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
        ssl_dhparam /etc/nginx/dhparam.pem;
        ssl_ecdh_curve secp384r1;
#        location / {

#proxy_set_header Host $host;

#proxy_set_header X-Real-IP $remote_addr;

#proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

#proxy_set_header X-Forwarded-Proto $scheme;

#proxy_pass http://localhost:4567;

#proxy_read_timeout 90;

#proxy_redirect http://localhost:4567 https://www.libraryofcode.org;

#  }
root /var/www/wordpress;
index index.php;

location ~ \.php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/run/php/php7.2-fpm.sock;
}
location / {
try_files $uri $uri/ /index.php?$args;
}
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name ecm.libraryofcode.org;
    ssl_certificate /etc/nginx/ssl/org.chain.crt;

ssl_certificate_key /etc/nginx/ssl/org.key.pem;

#ssl_session_cache builtin:1000 shared:SSL:10m;

#ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

#ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;

#ssl_prefer_server_ciphers on;
ssl_protocols TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
        ssl_prefer_server_ciphers on;ssl_session_cache shared:SSL:10m;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
        ssl_dhparam /etc/nginx/dhparam.pem;
        ssl_ecdh_curve secp384r1;
        location / {

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";

proxy_pass https://localhost:7150;

proxy_read_timeout 90;

proxy_redirect https://localhost:7150 https://ecm.libraryofcode.org;

  }
}


#server {
#    listen 443 ssl http2;
#    listen [::]:443 ssl http2;

#    server_name ldap.libraryofcode.org;
#    ssl_certificate /etc/nginx/ssl/org.chain.crt;

#ssl_certificate_key /etc/nginx/ssl/org.key.pem;

#ssl_session_cache builtin:1000 shared:SSL:10m;

#ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

#ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;

#ssl_prefer_server_ciphers on;
#ssl_protocols TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
#        ssl_prefer_server_ciphers on;ssl_session_cache shared:SSL:10m;
#ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
#        ssl_dhparam /etc/nginx/dhparam.pem;
#        ssl_ecdh_curve secp384r1;
#include /etc/ldap-account-manager/nginx.conf;
       # location / {

#proxy_set_header Host $host;

#proxy_set_header X-Real-IP $remote_addr;

#proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

#proxy_set_header X-Forwarded-Proto $scheme;
#proxy_set_header Upgrade $http_upgrade;
#proxy_set_header Connection "upgrade";

#proxy_pass https://localhost:7150;

#proxy_read_timeout 90;

#proxy_redirect https://localhost:7150 https://ecm.libraryofcode.org;

  #}
#}


server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name keys.libraryofcode.org;
    ssl_certificate /etc/nginx/ssl/org.chain.crt;
    root /var/www/html/sks;
    error_page 404 /404.html;

    ssl_certificate_key /etc/nginx/ssl/org.key.pem;
    ssl_protocols TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;ssl_session_cache shared:SSL:10m;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_dhparam /etc/nginx/dhparam.pem;
    ssl_ecdh_curve secp384r1;
    location ~ (.git|LICENSE|readme.md) {
        deny all;
        return 404;
    }

    location /pks {
        proxy_pass         http://127.0.0.1:11371;
        proxy_pass_header  Server;
    }

}