diff --git a/ansible/roles/authelia-and-nginx/templates/conf.j2 b/ansible/roles/authelia-and-nginx/templates/conf.j2 index 8202046..67fcd50 100644 --- a/ansible/roles/authelia-and-nginx/templates/conf.j2 +++ b/ansible/roles/authelia-and-nginx/templates/conf.j2 @@ -1,26 +1,62 @@ server { + server_name {{var_authelia_and_nginx_domain}}; + + listen [::]:80; listen 80; - server_name auth.*; return 301 https://$server_name$request_uri; } server { - listen 443 ssl http2; server_name {{var_authelia_and_nginx_domain}}; - # include /config/nginx/snippets/ssl.conf; + listen [::]:443 ssl http2; + listen 443 ssl http2; + ssl_certificate /etc/ssl/certs/{{var_authelia_and_nginx_domain}}.pem; ssl_certificate_key /etc/ssl/private/{{var_authelia_and_nginx_domain}}.pem; - set $upstream http://localhost:9091; - location / { - # include /config/nginx/snippets/proxy.conf; - proxy_pass $upstream; + ## Headers + proxy_set_header Host $host; + proxy_set_header X-Original-URL $scheme://$http_host$request_uri; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Host $http_host; + proxy_set_header X-Forwarded-Uri $request_uri; + proxy_set_header X-Forwarded-Ssl on; + proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header Connection ""; + + ## Basic Proxy Configuration + client_body_buffer_size 128k; + proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; ## Timeout if the real server is dead. + proxy_redirect http:// $scheme://; + proxy_http_version 1.1; + proxy_cache_bypass $cookie_session; + proxy_no_cache $cookie_session; + proxy_buffers 64 256k; + + ## Trusted Proxies Configuration + ## Please read the following documentation before configuring this: + ## https://www.authelia.com/integration/proxies/nginx/#trusted-proxies + # set_real_ip_from 10.0.0.0/8; + # set_real_ip_from 172.16.0.0/12; + # set_real_ip_from 192.168.0.0/16; + # set_real_ip_from fc00::/7; + real_ip_header X-Forwarded-For; + real_ip_recursive on; + + ## Advanced Proxy Configuration + send_timeout 5m; + proxy_read_timeout 360; + proxy_send_timeout 360; + proxy_connect_timeout 360; + + proxy_pass http://localhost:9091; } location /api/verify { - proxy_pass $upstream; + proxy_pass http://localhost:9091; } }