5a3a51e1be
This is a workaround for running an application behind two layers of reverse proxies with the outer one terminating ssl. In this case the inner proxy receives requests with plain http and sets X-Forwarded-Proto, X-Forwarded-Ssl and X-Url-Scheme to "http", although the original requests used https. This breaks some applications. Ideally we would use a mechanism similar to real_ip_from and just forward the proto/ssl/scheme headers if the request came from a trusted proxy, but this workaround is much simpler.
80 lines
1.4 KiB
YAML
80 lines
1.4 KiB
YAML
nginx:
|
|
add_headers: []
|
|
real_ip_header: "X-Forwarded-For"
|
|
real_ip_from:
|
|
"127.0.0.1": {}
|
|
"::1": {}
|
|
monitoring: true
|
|
php: false
|
|
force_ssl: true
|
|
snakeoil_default: false
|
|
upstreams: {}
|
|
vhosts: {}
|
|
streams: {}
|
|
maps: {}
|
|
resolver:
|
|
- 8.8.8.8
|
|
- 8.8.4.4
|
|
|
|
nginx_vhosts_defaults:
|
|
listen:
|
|
nossl: False
|
|
nossl_port: 80
|
|
ssl: True
|
|
ssl_port: 443
|
|
v4: True
|
|
v4_ip:
|
|
- '0.0.0.0'
|
|
v6: True
|
|
v6_ip:
|
|
- '[::]'
|
|
custom: []
|
|
servername: []
|
|
default_server: False
|
|
locations: []
|
|
includes: []
|
|
add_headers: []
|
|
letsencrypt: False
|
|
crt: ~
|
|
key: ~
|
|
auth:
|
|
enable: False
|
|
path: ~
|
|
satisfy: 'all'
|
|
host: '$host'
|
|
add_proxy_headers: {}
|
|
hide_proxy_headers: {}
|
|
backend: ~
|
|
disallow_dotfiles: True
|
|
force_forwarded_ssl_header: False
|
|
|
|
nginx_streams_defaults:
|
|
listen:
|
|
custom: []
|
|
includes: []
|
|
proxy_pass: ~
|
|
proxy_protocol: "off"
|
|
proxy_connect_timeout: "2s"
|
|
proxy_next_upstream_tries: 2
|
|
|
|
nginx_forcessl_vhost:
|
|
"https-redirect":
|
|
listen:
|
|
nossl: True
|
|
ssl: False
|
|
locations:
|
|
- match: '/.well-known/acme-challenge/'
|
|
alias: '/var/www/letsencrypt/'
|
|
- match: '/'
|
|
custom:
|
|
- return 301 https://$host$request_uri
|
|
|
|
nginx_proxy_location:
|
|
match: /
|
|
backend: ~
|
|
|
|
phpinidefault:
|
|
post_max_size: 64M
|
|
upload_max_filesize: 64M
|
|
memory_limit: 128M
|
|
date_timezone: UTC
|