danwin1210/mail-hosting
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Added clearnet proxy configuration files

Browse Source
This commit is contained in:
Daniel Winzen
2022-05-22 15:10:47 +02:00
parent 79f9764871
commit 0bb5d4ff18
7 changed files with 1241 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

258
etc_clearnet_proxy/nginx/nginx.conf Normal file
View File

@ -0,0 +1,258 @@
user www-data;
worker_processes 1;
pid /run/nginx.pid;
pcre_jit on;
worker_rlimit_nofile 30000;
worker_shutdown_timeout 1m;
events {
worker_connections 20000;
multi_accept on;
}
http {
##
# Basic Settings
##
sendfile on;
aio threads;
aio_write on;
directio 512;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
server_tokens off;
client_max_body_size 10G;
client_body_timeout 10s;
client_header_timeout 10s;
server_names_hash_bucket_size 128;
server_names_hash_max_size 1024;
server_name_in_redirect off;
port_in_redirect off;
charset UTF-8;
index index.html index.htm index.php;
include /etc/nginx/mime.types;
default_type application/octet-stream;
##
# SSL Settings
##
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ecdh_curve X448:X25519:secp521r1:secp384r1;
ssl_ciphers HIGH:!PSK:!RSA:!aNULL:!MD5:!SHA:!CAMELLIA:!AES+SHA256:!AES+SHA384;
ssl_session_cache shared:SSL:10m;
ssl_early_data off;
ssl_stapling on;
ssl_stapling_verify on;
ssl_certificate /etc/acme.sh/danwin1210.de_ecc/fullchain.cer;
ssl_certificate_key /etc/acme.sh/danwin1210.de_ecc/danwin1210.de.key;
ssl_dhparam /etc/nginx/dh4096.pem;
##
# Logging Settings
##
log_format custom '0.0.0.0 - $remote_user [$time_local] "$request" $status $bytes_sent "$http_referer" "$http_user_agent"';
access_log /var/log/nginx/access.log custom buffer=32k flush=1m;
error_log /var/log/nginx/error.log notice;
log_not_found off;
resolver 127.0.0.1 [::1];
resolver_timeout 2s;
root /var/www/html;
proxy_cache_path /var/lib/nginx/cache levels=2 keys_zone=cache:10m inactive=30d max_size=1g;
proxy_cache_revalidate on;
proxy_cache_use_stale http_503 timeout updating error;
proxy_no_cache $http_pragma $http_authorization;
proxy_cache_bypass $cookie_nocache $arg_nocache;
map $http_upgrade $connection_upgrade {
default upgrade;
'' '';
}
proxy_cache_lock_timeout 2m;
proxy_cache_lock_age 2m;
proxy_cache cache;
proxy_http_version 1.1;
proxy_buffer_size 8k;
proxy_buffering on;
proxy_set_header Host $host;
proxy_set_header Proxy "";
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Port "";
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_ignore_client_abort on;
proxy_cache_key $server_name$request_method$host$request_uri;
proxy_read_timeout 3600; #wait up to 60 minutes for e.g. database import
##
# Gzip Settings
##
gzip on;
gzip_vary off;
gzip_proxied off;
gzip_comp_level 6;
# gzip_buffers 16 8k;
# gzip_http_version 1.1;
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml;
brotli on;
brotli_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml;
##
# Virtual Host Configs
##
include /etc/nginx/sites-enabled/*;
}
stream {
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ecdh_curve X448:X25519:secp521r1:secp384r1:secp256k1;
ssl_ciphers HIGH:!PSK:!RSA:!aNULL:!MD5:!SHA:!CAMELLIA:!AES+SHA256:!AES+SHA384;
ssl_session_cache shared:SSLSTREAM:10m;
ssl_certificate /etc/acme.sh/danwin1210.de_ecc/fullchain.cer;
ssl_certificate_key /etc/acme.sh/danwin1210.de_ecc/danwin1210.de.key;
ssl_dhparam /etc/nginx/dh4096.pem;
#smtp
server {
listen [::]:25 fastopen=100 ipv6only=off;
proxy_pass smtp_backend_servers;
deny 51.254.78.246;
}
server {
listen [::]:587 fastopen=100 ipv6only=off;
proxy_pass smtp_auth_backend_servers;
deny 49.70.67.204;
deny 87.246.7.212;
deny 37.49.225.155;
deny 103.151.123.103;
}
server {
listen [::]:465 fastopen=100 ipv6only=off;
proxy_pass smtps_backend_servers;
}
#mysql
server {
listen 127.0.0.1:3306 fastopen=100;
proxy_pass mysql_backend_servers;
}
#imap
server {
listen [::]:143 fastopen=100 ipv6only=off;
proxy_pass imap_backend_servers;
}
server {
listen [::]:993 fastopen=100 ipv6only=off;
proxy_pass imaps_backend_servers;
}
#pop3
server {
listen [::]:110 fastopen=100 ipv6only=off;
proxy_pass pop3_backend_servers;
}
server {
listen [::]:995 fastopen=100 ipv6only=off;
proxy_pass pop3s_backend_servers;
}
#xmpp
server {
listen [::]:5269 fastopen=100 ipv6only=off;
proxy_pass 10.9.0.3:5269;
}
server {
listen [::]:5000 fastopen=100 ipv6only=off;
proxy_pass 10.9.0.3:5000;
}
server {
listen [::]:5222 fastopen=100 ipv6only=off;
proxy_pass 10.9.0.3:5222;
}
server {
listen [::]:5223 fastopen=100 ipv6only=off;
proxy_pass 10.9.0.3:5223;
}
server {
listen [::]:5280 fastopen=100 ipv6only=off;
proxy_pass 10.9.0.3:5280;
}
server {
listen [::]:5281 fastopen=100 ipv6only=off;
proxy_pass 10.9.0.3:5281;
}
#https
server {
listen [::]:443 fastopen=100 ipv6only=off;
# limit_conn addr 2;
# proxy_upload_rate 4k;
proxy_protocol on;
proxy_pass https_backend_servers;
}
#upstream servers
upstream https_backend_servers {
server 10.9.0.2:443;
server 10.9.0.3:443;
server 10.9.0.4:443;
server 10.9.0.5:443;
}
upstream imaps_backend_servers {
server 10.9.0.2:993;
server 10.9.0.3:993;
server 10.9.0.4:993;
server 10.9.0.5:993;
}
upstream imap_backend_servers {
server 10.9.0.2:143;
server 10.9.0.3:143;
server 10.9.0.4:143;
server 10.9.0.5:143;
}
upstream pop3s_backend_servers {
server 10.9.0.2:995;
server 10.9.0.3:995;
server 10.9.0.4:995;
server 10.9.0.5:995;
}
upstream pop3_backend_servers {
server 10.9.0.2:110;
server 10.9.0.3:110;
server 10.9.0.4:110;
server 10.9.0.5:110;
}
upstream dns_backend_server {
server [::1]:53;
server 127.0.0.1:53;
}
upstream smtp_backend_servers {
server 10.9.0.2:25;
server 10.9.0.3:25;
server 10.9.0.4:25;
server 10.9.0.5:25;
}
upstream smtp_auth_backend_servers {
server 10.9.0.2:587;
server 10.9.0.3:587;
server 10.9.0.4:587;
server 10.9.0.5:587;
}
upstream smtps_backend_servers {
server 10.9.0.2:465;
server 10.9.0.3:465;
server 10.9.0.4:465;
server 10.9.0.5:465;
}
upstream mysql_backend_servers {
server 10.9.0.2:3306;
server 10.9.0.3:3306;
server 10.9.0.4:3306;
server 10.9.0.5:3306;
}
}

19
etc_clearnet_proxy/nginx/sites-enabled/clearnet Normal file
View File

@ -0,0 +1,19 @@
server {
listen [::]:80;
server_name 116.202.17.147 www.danwin1210.de [2a01:4f8:c010:d56::1];
location / {
rewrite / https://danwin1210.de$request_uri? permanent;
}
location /.well-known/ {
proxy_pass https://localhost;
}
}
server {
listen [::]:80 fastopen=100 backlog=2048 ipv6only=off default_server;
location / {
rewrite / https://$host$request_uri? permanent;
}
location /.well-known/ {
proxy_pass https://localhost;
}
}