Update with caddy instead nginx

Signed-off-by: Bensuperpc <bensuperpc@gmail.com>

old_enginx/nginx/conf.d-cert/jellyfin.conf

@@ -0,0 +1,29 @@
+server {
+        listen 80;
+        listen [::]:80;
+
+        server_name jellyfin.bensuperpc.org www.jellyfin.bensuperpc.org;
+
+        root /var/www/jellyfin;
+
+        location ~ /.well-known/acme-challenge {
+                allow all;
+                root /var/www/jellyfin;
+        }
+
+        location / {
+                # Proxy main Jellyfin traffic
+                proxy_pass http://jellyfin:8096;
+                proxy_set_header Host $host;
+                proxy_set_header X-Real-IP $remote_addr;
+                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                proxy_set_header X-Forwarded-Proto $scheme;
+                proxy_set_header X-Forwarded-Protocol $scheme;
+                proxy_set_header X-Forwarded-Host $http_host;
+
+                # Disable buffering when the nginx proxy gets very resource heavy upon streaming
+                proxy_buffering off;
+        }
+
+        resolver 8.8.8.8;
+}

old_enginx/nginx/conf.d-cert/wordpress.conf

@@ -0,0 +1,50 @@
+server {
+        listen 80;
+        listen [::]:80;
+
+        server_name bensuperpc.org www.bensuperpc.org;
+
+        index index.php index.html index.htm;
+
+        root /var/www/wordpress;
+
+        location ~ /.well-known/acme-challenge {
+                allow all;
+                root /var/www/wordpress;
+        }
+
+        location / {
+                try_files $uri $uri/ /index.php$is_args$args;
+        }
+
+        location ~ \.php$ {
+                try_files $uri =404;
+                fastcgi_split_path_info ^(.+\.php)(/.+)$;
+                fastcgi_pass wordpress:9000;
+                fastcgi_index index.php;
+                include fastcgi_params;
+
+                # Necessary to avoid 404 error when changing the wordpress path
+                #fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+                fastcgi_param SCRIPT_FILENAME /var/www/html$fastcgi_script_name;
+
+                fastcgi_param PATH_INFO $fastcgi_path_info;
+        }
+
+        location ~ /\.ht {
+                deny all;
+        }
+        
+        location = /favicon.ico { 
+                log_not_found off; access_log off; 
+        }
+        location = /robots.txt { 
+                log_not_found off; access_log off; allow all; 
+        }
+        location ~* \.(css|gif|ico|jpeg|jpg|js|png)$ {
+                expires max;
+                log_not_found off;
+        }
+
+        resolver 8.8.8.8;
+}

old_enginx/nginx/conf.d/jellyfin.conf

@@ -0,0 +1,141 @@
+proxy_cache_path /var/cache/nginx/jellyfin levels=1:2 keys_zone=jellyfin:100m max_size=3g inactive=30d use_temp_path=off;
+proxy_cache_path /var/cache/nginx/jellyfin-videos levels=1:2 keys_zone=jellyfin-videos:100m inactive=90d max_size=3g;
+map $request_uri $h264Level { ~(h264-level=)(.+?)& $2; }
+map $request_uri $h264Profile { ~(h264-profile=)(.+?)& $2; }
+
+upstream jellyfin_server {
+        # ip_hash;
+        server jellyfin:8096;
+        # server jellyfin:8096 weight=1 max_fails=3 fail_timeout=30s;
+}
+
+# Redirect all http requests to the main server wordpress_server
+server {
+        listen 80;
+        listen [::]:80;
+
+        server_name jellyfin.bensuperpc.org www.jellyfin.bensuperpc.org;
+
+        location ~ /.well-known/acme-challenge {
+                allow all;
+                root /var/www/jellyfin;
+        }
+
+        location / {
+                return 301 https://$host$request_uri;
+        }
+}
+
+server {
+        listen 443 ssl http2;
+        listen [::]:443 ssl http2;
+        server_name jellyfin.bensuperpc.org www.jellyfin.bensuperpc.org;
+
+        #client_max_body_size 20M;
+        set $jellyfin jellyfin;
+        resolver 8.8.8.8 valid=30;
+
+        # All things related to SSL
+        ssl_certificate /etc/letsencrypt/live/bensuperpc.org/fullchain.pem;
+        ssl_certificate_key /etc/letsencrypt/live/bensuperpc.org/privkey.pem;
+        ssl_trusted_certificate /etc/letsencrypt/live/bensuperpc.org/chain.pem;
+        #ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+        #add_header Strict-Transport-Security "max-age=31536000" always;
+
+        include /etc/nginx/conf.d/sub/options-ssl-nginx.conf;
+
+        # Security / XSS Mitigation Headers
+        # NOTE: X-Frame-Options may cause issues with the webOS app
+        add_header X-Frame-Options "SAMEORIGIN";
+        add_header X-XSS-Protection "1; mode=block";
+        add_header X-Content-Type-Options "nosniff";
+        #add_header Content-Security-Policy "default-src https: data: blob: http://image.tmdb.org; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com/cv/js/sender/v1/cast_sender.js https://www.gstatic.com/eureka/clank/95/cast_sender.js https://www.gstatic.com/eureka/clank/96/cast_sender.js https://www.gstatic.com/eureka/clank/97/cast_sender.js https://www.youtube.com blob:; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'";
+
+        location = / {
+                return 302 http://$host/web/;
+                #return 302 https://$host/web/;
+        }
+
+        location / {
+                # Proxy main Jellyfin traffic
+                proxy_pass http://jellyfin_server;
+                proxy_set_header Host $host;
+                proxy_set_header X-Real-IP $remote_addr;
+                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                proxy_set_header X-Forwarded-Proto $scheme;
+                proxy_set_header X-Forwarded-Protocol $scheme;
+                proxy_set_header X-Forwarded-Host $http_host;
+
+                # Disable buffering when the nginx proxy gets very resource heavy upon streaming
+                proxy_buffering off;
+        }
+
+        location = /web/ {
+                # Proxy main Jellyfin traffic
+                proxy_pass http://jellyfin_server/web/index.html;
+                proxy_set_header Host $host;
+                proxy_set_header X-Real-IP $remote_addr;
+                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                proxy_set_header X-Forwarded-Proto $scheme;
+                proxy_set_header X-Forwarded-Protocol $scheme;
+                proxy_set_header X-Forwarded-Host $http_host;
+        }
+
+        location /socket {
+                # Proxy Jellyfin Websockets traffic
+                proxy_pass http://jellyfin_server;
+                proxy_http_version 1.1;
+                proxy_set_header Upgrade $http_upgrade;
+                proxy_set_header Connection "upgrade";
+                proxy_set_header Host $host;
+                proxy_set_header X-Real-IP $remote_addr;
+                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                proxy_set_header X-Forwarded-Proto $scheme;
+                proxy_set_header X-Forwarded-Protocol $scheme;
+                proxy_set_header X-Forwarded-Host $http_host;
+        }
+
+        # Cache images
+        location ~ /Items/(.*)/Images {
+                #proxy_pass http://127.0.0.1:8096;
+                proxy_pass http://jellyfin_server;
+                proxy_set_header Host $host;
+                proxy_set_header X-Real-IP $remote_addr;
+                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                proxy_set_header X-Forwarded-Proto $scheme;
+                proxy_set_header X-Forwarded-Protocol $scheme;
+                proxy_set_header X-Forwarded-Host $http_host;
+
+                proxy_cache jellyfin;
+                proxy_cache_revalidate on;
+                proxy_cache_lock on;
+                add_header X-Cache-Status $upstream_cache_status; # This is only to check if cache is working
+        }
+
+        # Cache videos
+        location ~* ^/Videos/(.*)/(?!live)
+        {
+                slice 2m;
+
+                proxy_cache jellyfin-videos;
+                proxy_cache_valid 200 206 301 302 30d;
+                proxy_ignore_headers Expires Cache-Control Set-Cookie X-Accel-Expires;
+                proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504;
+                proxy_connect_timeout 15s;
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                # Transmit slice range to the backend
+                proxy_set_header Range $slice_range;
+
+                proxy_cache_lock on;
+                proxy_cache_lock_age 60s;
+
+                #proxy_pass http://$jellyfin:8096;
+                proxy_pass http://jellyfin_server;
+                proxy_cache_key "jellyvideo$uri?MediaSourceId=$arg_MediaSourceId&VideoCodec=$arg_VideoCodec&AudioCodec=$arg_AudioCodec&AudioStreamIndex=$arg_AudioStreamIndex&VideoBitrate=$arg_VideoBitrate&AudioBitrate=$arg_AudioBitrate&SubtitleMethod=$arg_SubtitleMethod&TranscodingMaxAudioChannels=$arg_TranscodingMaxAudioChannels&RequireAvc=$arg_RequireAvc&SegmentContainer=$arg_SegmentContainer&MinSegments=$arg_MinSegments&BreakOnNonKeyFrames=$arg_BreakOnNonKeyFrames&h264-profile=$h264Profile&h264-level=$h264Level&slicerange=$slice_range";
+
+                add_header X-Cache-Status $upstream_cache_status; # This is only for debugging cache
+        }
+}
+
+# All configuration options are documented at https://jellyfin.org/docs/general/networking/nginx/

old_enginx/nginx/conf.d/minecraft.conf

@@ -0,0 +1,12 @@
+#upstream minecraft {
+#    server minecraft:25565;
+#}
+#
+#server {
+#    listen 25566;
+#    server_name minecraft.bensuperpc.org www.minecraft.bensuperpc.org;
+#    location / {
+#        proxy_pass minecraft;
+#    }
+#}
+

old_enginx/nginx/conf.d/phpmyadmin.conf

@@ -0,0 +1,28 @@
+#include /etc/nginx/conf.d/sub/cache-proxy.conf;
+
+upstream phpmyadmin_server {
+        # ip_hash;
+        server phpmyadmin:80;
+        # server phpmyadmin:80 weight=1 max_fails=3 fail_timeout=30s;
+}
+
+# PHPmyadmin
+server {
+        listen 80;
+        listen [::]:80;
+        #listen 443;
+        #listen [::]:443;
+
+        server_name phpmyadmin.bensuperpc.org www.phpmyadmin.bensuperpc.org;
+
+        include /etc/nginx/conf.d/sub/gzip.conf;
+
+        location / {
+                proxy_pass http://phpmyadmin_server;
+                proxy_redirect off;
+                proxy_set_header X-Forwarded-Host $http_host;
+                proxy_set_header X-Forwarded-For  $remote_addr;
+        }
+
+        # resolver 8.8.8.8;
+}

old_enginx/nginx/conf.d/qbittorrent.conf

@@ -0,0 +1,26 @@
+upstream qbittorrent_server {
+        # ip_hash;
+        server qbittorrent:8080;
+        # server qbittorrent:8080 weight=1 max_fails=3 fail_timeout=30s;
+}
+
+# PHPmyadmin
+server {
+        listen 80;
+        listen [::]:80;
+        #listen 443;
+        #listen [::]:443;
+
+        server_name qbittorrent.bensuperpc.org www.qbittorrent.bensuperpc.org;
+
+        include /etc/nginx/conf.d/sub/gzip.conf;
+
+        location / {
+                proxy_pass http://qbittorrent_server;
+                proxy_redirect off;
+                proxy_set_header X-Forwarded-Host $http_host;
+                proxy_set_header X-Forwarded-For  $remote_addr;
+        }
+
+        # resolver 8.8.8.8;
+}

old_enginx/nginx/conf.d/sub/cache-fastcgi.conf

@@ -0,0 +1,23 @@
+# The path to store the cache files, limit the folder to 100MB
+fastcgi_cache_path /var/run/nginx-cache-fastcgi levels=1:2 keys_zone=WORDPRESS:100m inactive=120m max_size=1g use_temp_path=off;
+
+# A unique request is defined by this cache key
+fastcgi_cache_key "$scheme$request_method$host$request_uri";
+
+# Show the cached version if upstream gives a timeout or a HTTP 500 error
+fastcgi_cache_use_stale error timeout invalid_header http_500;
+
+# Revalidate items in the cache if they are update 
+fastcgi_cache_revalidate on;
+
+# Minimum time to store an item in the cache
+fastcgi_cache_min_uses 3;
+
+# Cache everything for 1 day
+fastcgi_cache_valid 1d;
+
+# Don't use the following headers to define the cache variables
+fastcgi_ignore_headers Cache-Control Expires Set-Cookie;
+
+# Some parts of this file are from
+# https://gist.github.com/TrafeX/6d582b6d040702088722

old_enginx/nginx/conf.d/sub/cache-proxy.conf

@@ -0,0 +1,20 @@
+# The path to store the cache files, limit the folder to 100MB
+proxy_cache_path /var/run/nginx-cache-proxy levels=1:2 keys_zone=PROXY:100m inactive=120m max_size=1g use_temp_path=off;
+
+# A unique request is defined by this cache key
+proxy_cache_key "$scheme$request_method$host$request_uri";
+
+# Show the cached version if upstream gives a timeout or a HTTP 500 error
+proxy_cache_use_stale error timeout invalid_header http_500;
+
+# Revalidate items in the cache if they are update 
+proxy_cache_revalidate on;
+
+# Minimum time to store an item in the cache
+proxy_cache_min_uses 3;
+
+# Cache everything for 1 day
+proxy_cache_valid 1d;
+
+# Don't use the following headers to define the cache variables
+proxy_ignore_headers Cache-Control Expires Set-Cookie;

old_enginx/nginx/conf.d/sub/cache-uwsgi.conf

@@ -0,0 +1,20 @@
+# The path to store the cache files, limit the folder to 100MB
+uwsgi_cache_path /var/run/nginx-cache-uwsgi levels=1:2 keys_zone=UWSGI:100m inactive=120m max_size=1g use_temp_path=off;
+
+# A unique request is defined by this cache key
+uwsgi_cache_key "$scheme$request_method$host$request_uri";
+
+# Show the cached version if upstream gives a timeout or a HTTP 500 error
+uwsgi_cache_use_stale error timeout invalid_header http_500;
+
+# Revalidate items in the cache if they are update 
+uwsgi_cache_revalidate on;
+
+# Minimum time to store an item in the cache
+uwsgi_cache_min_uses 3;
+
+# Cache everything for 1 day
+uwsgi_cache_valid 1d;
+
+# Don't use the following headers to define the cache variables
+uwsgi_ignore_headers Cache-Control Expires Set-Cookie;

old_enginx/nginx/conf.d/sub/gzip.conf

@@ -0,0 +1,13 @@
+# Compression config
+gzip on;
+gunzip on;
+
+gzip_static on;
+gzip_min_length 1000;
+gzip_buffers 4 32k;
+# gzip_http_version 1.1;
+gzip_proxied any;
+gzip_types text/plain application/javascript application/x-javascript text/javascript text/xml text/css;
+gzip_vary on;
+gzip_comp_level 6;
+gzip_disable "MSIE [1-6]\.(?!.*SV1)";

old_enginx/nginx/conf.d/sub/options-ssl-nginx.conf

@@ -0,0 +1,13 @@
+# generated 2022-11-23, Mozilla Guideline v5.6, nginx 1.23, OpenSSL 1.1.1k, modern configuration
+# https://ssl-config.mozilla.org/#server=nginx&version=1.23&config=modern&openssl=1.1.1k&guideline=5.6
+
+ssl_session_cache shared:le_nginx_SSL:10m;
+ssl_session_timeout 1440m;
+ssl_session_tickets off;
+
+ssl_protocols TLSv1.3;
+ssl_prefer_server_ciphers off;
+
+# OCSP stapling
+ssl_stapling on;
+ssl_stapling_verify on;

old_enginx/nginx/conf.d/wordpress.conf

@@ -0,0 +1,161 @@
+include /etc/nginx/conf.d/sub/cache-fastcgi.conf;
+
+# All upstream serveur
+upstream wordpress_server {
+        # ip_hash;
+        server wordpress:9000;
+        # server wordpress:9000 weight=1 max_fails=3 fail_timeout=30s;
+}
+
+# Redirect all http requests to the main server wordpress_server
+server {
+        listen 80;
+        listen [::]:80;
+
+        server_name wordpress.bensuperpc.org www.wordpress.bensuperpc.org bensuperpc.org www.bensuperpc.org;
+
+        location ~ /.well-known/acme-challenge {
+                allow all;
+                root /var/www/wordpress;
+        }
+
+        location / {
+                return 301 https://$host$request_uri;
+        }
+}
+
+# Main server wordpress_server
+server {
+        listen 443 ssl http2;
+        listen [::]:443 ssl http2;
+        server_name wordpress.bensuperpc.org www.wordpress.bensuperpc.org bensuperpc.org www.bensuperpc.org;
+
+        root /var/www/wordpress;
+        index index.php index.html index.htm;
+
+        # Keepalive for 70 seconds
+        keepalive_timeout 70;
+
+        # Number of requests per connection
+        keepalive_requests 100;
+
+        reset_timedout_connection on;
+
+        # Increase proxy buffers for large requests
+        proxy_buffer_size 128k;
+        proxy_buffers 4 256k;
+        proxy_busy_buffers_size 256k;
+
+        fastcgi_buffer_size 128k;
+        fastcgi_buffers 256 16k;
+        fastcgi_busy_buffers_size 256k;
+        fastcgi_temp_file_write_size 256k;
+
+        # Upload limit
+        client_max_body_size 50m;
+        client_body_buffer_size 128k;
+
+        # Initialize the variable that specified to skip the cache
+        set $skip_cache 0;
+
+        # POST requests and url's with a query string should always skip cache
+        if ($request_method = POST) {
+                set $skip_cache 1;
+        }
+        if ($query_string != "") {
+                set $skip_cache 1;
+        }
+
+        # Don't cache url's containing the following segments
+        if ($request_uri ~* "/wp-admin/|/xmlrpc.php|wp-.*.php|/feed/|index.php|sitemap(_index)?.xml") {
+                set $skip_cache 1;
+        }
+
+        # Don't use the cache for logged in users or recent commenters
+        if ($http_cookie ~* "comment_author|wordpress_[a-f0-9]+|wp-postpass|wordpress_no_cache|wordpress_logged_in") {
+                set $skip_cache 1;
+        }
+
+        server_tokens off;
+
+        include /etc/nginx/conf.d/sub/gzip.conf;
+        
+        # All things related to SSL
+        ssl_certificate /etc/letsencrypt/live/bensuperpc.org/fullchain.pem;
+        ssl_certificate_key /etc/letsencrypt/live/bensuperpc.org/privkey.pem;
+        ssl_trusted_certificate /etc/letsencrypt/live/bensuperpc.org/chain.pem;
+
+        include /etc/nginx/conf.d/sub/options-ssl-nginx.conf;
+
+        # Logging
+        access_log /var/log/nginx/wordpress.access.log;
+        error_log  /var/log/nginx/wordpress.error.log;
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-referrer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+
+        location / {
+                try_files $uri $uri/ /index.php$is_args$args;
+                #  try_files $uri $uri/ /index.php?$args;
+        }
+
+        location ~ \.php$ {
+                try_files $uri =404;
+                fastcgi_split_path_info ^(.+\.php)(/.+)$;
+                fastcgi_pass wordpress_server;
+                fastcgi_index index.php;
+                include fastcgi_params;
+
+                # Necessary to avoid 404 error when changing the wordpress path
+                #fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+                fastcgi_param SCRIPT_FILENAME /var/www/html$fastcgi_script_name;
+
+                fastcgi_param PATH_INFO $fastcgi_path_info;
+                
+                fastcgi_intercept_errors on;
+
+                # Don't cache when $skip_cache is true
+                fastcgi_cache_bypass $skip_cache;
+                fastcgi_no_cache $skip_cache;
+
+                # Use the WORDPRESS zone
+                fastcgi_cache WORDPRESS;
+        }
+
+        # Don't write to accesslog for these files
+        location = /favicon.ico {
+                log_not_found off;
+                access_log off;
+        }
+        location = /robots.txt {
+                allow all;
+                log_not_found off;
+                access_log off;
+        }
+
+        # Media files with one of these extensions should be cached by the browser
+        location ~* \.(xml|ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|css|rss|atom|js|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$ {
+                expires max;
+                log_not_found off;
+        }
+
+        # Deny access to .* files
+        location ~ /\. {
+                deny all;
+                access_log off;
+                log_not_found off;
+        }
+        
+        # Add cache status header for easy debugging
+        add_header X-cache $upstream_cache_status;
+
+        # From cat /etc/resolv.conf
+        resolver 8.8.8.8;
+
+        # Some parts of this file are from
+        # https://gist.github.com/TrafeX/6d582b6d040702088722
+}

old_enginx/nginx/nginx.conf

@@ -0,0 +1,32 @@
+
+user  nginx;
+worker_processes  auto;
+
+error_log  /var/log/nginx/error.log notice;
+pid        /var/run/nginx.pid;
+
+
+events {
+    worker_connections  1024;
+}
+
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log  /var/log/nginx/access.log  main;
+
+    sendfile        on;
+    #tcp_nopush     on;
+
+    keepalive_timeout  65;
+
+    #gzip  on;
+
+    include /etc/nginx/conf.d/*.conf;
+}