fakz9/Crm-Monorepo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update Nginx configuration to set up SSL with Traefik routing and adjust port mappings

Browse Source
This commit is contained in:
admin
2025-08-06 01:38:45 +03:00
parent c89810a730
commit 6921374d9f
3 changed files with 129 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
config/nginx/nginx.conf
View File

@ -15,9 +15,8 @@ upstream frontend
server
{
listen 443 ssl http2; # managed by Certbot
listen 80; # managed by Certbot
server_tokens off;
server_name crm.logidex.ru www.crm.logidex.ru;
gzip on;
gzip_proxied any;
@ -25,40 +24,6 @@ server
gzip_types text/css application/javascript image/svg+xml application/json text/plain text/xml;
ssl_certificate /var/www/certbot/live/crm.logidex.ru/fullchain.pem; # managed by Certbot
ssl_certificate_key /var/www/certbot/live/crm.logidex.ru/privkey.pem; # managed by Certbot
# Temp disable for testing
# add_header Strict-Transport-Security "max-age=0" always;
# intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ecdh_curve X25519:prime256v1:secp384r1;
ssl_session_cache shared:le_nginx_SSL:10m;
ssl_session_timeout 1440m;
ssl_session_tickets off;
ssl_prefer_server_ciphers on;
ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
ssl_dhparam /var/www/certbot/live/crm.logidex.ru/dhparam.pem; # managed by Certbot
# OCSP stapling
ssl_stapling on;
ssl_stapling_verify on;
# verify chain of trust of OCSP response using Root CA and Intermediate certs
ssl_trusted_certificate /var/www/certbot/live/crm.logidex.ru/fullchain.pem;
# replace with the IP address of your resolver;
# async 'resolver' is important for proper operation of OCSP stapling
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;
# Общие proxy_set_header, унаследованные всеми location
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@ -102,20 +67,5 @@ server
proxy_cache_valid 60m;
proxy_pass http://frontend;
}
location /.well-known/acme-challenge/ {
root /var/www/certbot;
}
}
server {
if ($host = crm.logidex.ru) {
return 301 https://$host$request_uri;
}
server_name git.logidex.ru;
listen 80;
return 404; # managed by Certbot
}