nginx.conf editor

nginx443front: running

user nginx;
worker_processes auto;
worker_cpu_affinity auto;
worker_rlimit_nofile 65536;

error_log /var/log/nginx/error.log notice;
pid /var/run/nginx.pid;

events {
    worker_connections 8192;
    use epoll;
    multi_accept on;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

sendfile on;
    tcp_nopush on;
    tcp_nodelay on;

client_max_body_size 20m;
    client_body_timeout 12;
    client_header_timeout 12;

#log_format main '[$time_local] $remote_addr "$request" $status "$http_referer" "$http_user_agent"';
    #access_log /var/log/nginx/access-http.log main;
	
	map $http_upgrade $connection_upgrade {
		default upgrade;
		""      close;
	}

server {
        listen      80 default_server;
        listen      [::]:80 default_server;
        return 301 https://$host$request_uri;
    }

server {
        listen                127.0.0.1:8443 ssl default_server proxy_protocol;
        ssl_reject_handshake  on;
        ssl_protocols         TLSv1.2 TLSv1.3;
        ssl_session_timeout   1h;
        ssl_session_cache     shared:SSL_reject:10m;
    }

server {
        listen                     127.0.0.1:8443 ssl proxy_protocol;
        http2                      on;
        server_name                nginx.riss21.shop;

set_real_ip_from 127.0.0.1;
        real_ip_header proxy_protocol;

ssl_certificate            /certs/live/nginx.riss21.shop/fullchain.pem;
        ssl_certificate_key        /certs/live/nginx.riss21.shop/privkey.pem;
        ssl_protocols              TLSv1.2 TLSv1.3;
        ssl_ciphers                TLS13_AES_128_GCM_SHA256:TLS13_AES_256_GCM_SHA384:TLS13_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305;
        ssl_prefer_server_ciphers  on;

ssl_session_cache shared:SSL:50m;
        ssl_session_timeout 1d;
        ssl_session_tickets on;

#ssl_stapling               on;
        #ssl_stapling_verify        on;
        resolver                   1.1.1.1 valid=60s;
        resolver_timeout           2s;

location / {
            proxy_pass               http://nginx-conf-ui;
            auth_request /tinyauth;
            auth_request_set $redirection_url $upstream_http_x_tinyauth_location;
            error_page 401 403 =302 $redirection_url;
            proxy_http_version       1.1;
            proxy_set_header         Upgrade $http_upgrade;
            proxy_set_header         Connection $connection_upgrade;
            proxy_set_header         Host $host;
            proxy_set_header         X-Real-IP $remote_addr;
            proxy_set_header         X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header         X-Forwarded-Proto $scheme;
            proxy_read_timeout 1h;
            proxy_send_timeout 1h;
            proxy_buffering off;
        }
		
	location /tinyauth {
	    internal;
	    proxy_pass http://tinyauth:3000;
	    proxy_pass_request_body off;
	    proxy_set_header Content-Length "";
            proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
	    proxy_set_header x-forwarded-for $remote_addr;
	    proxy_set_header x-real-ip $remote_addr;
	    proxy_set_header x-forwarded-proto $scheme;
	    proxy_set_header x-forwarded-host $http_host;
	    proxy_set_header x-forwarded-uri $request_uri;
	}
    }

server {
        listen                     127.0.0.1:8443 ssl proxy_protocol;
        http2                      on;
        server_name                dockhand.riss21.shop;

set_real_ip_from 127.0.0.1;
        real_ip_header proxy_protocol;

ssl_certificate            /certs/live/dockhand.riss21.shop/fullchain.pem;
        ssl_certificate_key        /certs/live/dockhand.riss21.shop/privkey.pem;
        ssl_protocols              TLSv1.2 TLSv1.3;
        ssl_ciphers                TLS13_AES_128_GCM_SHA256:TLS13_AES_256_GCM_SHA384:TLS13_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305;
        ssl_prefer_server_ciphers  on;

ssl_session_cache shared:SSL:50m;
        ssl_session_timeout 1d;
        ssl_session_tickets on;

#ssl_stapling               on;
        #ssl_stapling_verify        on;
        resolver                   1.1.1.1 valid=60s;
        resolver_timeout           2s;

location / {
            proxy_pass               http://dockhand:3000;
            auth_request /tinyauth;
            auth_request_set $redirection_url $upstream_http_x_tinyauth_location;
            error_page 401 403 =302 $redirection_url;
            proxy_http_version       1.1;
            proxy_set_header         Upgrade $http_upgrade;
            proxy_set_header         Connection $connection_upgrade;
            proxy_set_header         Host $host;
            proxy_set_header         X-Real-IP $remote_addr;
            proxy_set_header         X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header         X-Forwarded-Proto $scheme;
            proxy_read_timeout 1h;
            proxy_send_timeout 1h;
            proxy_buffering off;
        }
		
	location /tinyauth {
	    internal;
	    proxy_pass http://tinyauth:3000;
	    proxy_pass_request_body off;
	    proxy_set_header Content-Length "";
            proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
	    proxy_set_header x-forwarded-for $remote_addr;
	    proxy_set_header x-real-ip $remote_addr;
	    proxy_set_header x-forwarded-proto $scheme;
	    proxy_set_header x-forwarded-host $http_host;
	    proxy_set_header x-forwarded-uri $request_uri;
	}
    }

server {
        listen                     127.0.0.1:8443 ssl proxy_protocol;
        http2                      on;
        server_name                auth.riss21.shop;

set_real_ip_from 127.0.0.1;
        real_ip_header proxy_protocol;

ssl_certificate            /certs/live/auth.riss21.shop/fullchain.pem;
        ssl_certificate_key        /certs/live/auth.riss21.shop/privkey.pem;
        ssl_protocols              TLSv1.2 TLSv1.3;
        ssl_ciphers                TLS13_AES_128_GCM_SHA256:TLS13_AES_256_GCM_SHA384:TLS13_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305;
        ssl_prefer_server_ciphers  on;

ssl_session_cache shared:SSL:50m;
        ssl_session_timeout 1d;
        ssl_session_tickets on;

#ssl_stapling               on;
        #ssl_stapling_verify        on;
        resolver                   1.1.1.1 valid=60s;
        resolver_timeout           2s;

location / {
            proxy_pass               http://tinyauth:3000;
            proxy_http_version       1.1;
            proxy_set_header         Upgrade $http_upgrade;
            proxy_set_header         Connection $connection_upgrade;
            proxy_set_header         Host $host;
            proxy_set_header         X-Real-IP $remote_addr;
            proxy_set_header         X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header         X-Forwarded-Proto $scheme;
            proxy_read_timeout 1h;
            proxy_send_timeout 1h;
            proxy_buffering off;
        }
    }

server {
        listen                     127.0.0.1:8443 ssl proxy_protocol;
        http2                      on;
        server_name                panel.riss21.shop;

set_real_ip_from 127.0.0.1;
        real_ip_header proxy_protocol;

ssl_certificate            /certs/live/panel.riss21.shop/fullchain.pem;
        ssl_certificate_key        /certs/live/panel.riss21.shop/privkey.pem;
        ssl_protocols              TLSv1.2 TLSv1.3;
        ssl_ciphers                TLS13_AES_128_GCM_SHA256:TLS13_AES_256_GCM_SHA384:TLS13_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305;
        ssl_prefer_server_ciphers  on;

ssl_session_cache shared:SSL:50m;
        ssl_session_timeout 1d;
        ssl_session_tickets on;

#ssl_stapling               on;
        #ssl_stapling_verify        on;
        resolver                   1.1.1.1 valid=60s;
        resolver_timeout           2s;

location / {
            proxy_pass               http://3xui:3463;
            auth_request /tinyauth;
            auth_request_set $redirection_url $upstream_http_x_tinyauth_location;
            error_page 401 403 =302 $redirection_url;
            proxy_http_version       1.1;
            proxy_set_header         Upgrade $http_upgrade;
            proxy_set_header         Connection $connection_upgrade;
            proxy_set_header         Host $host;
            proxy_set_header         X-Real-IP $remote_addr;
            proxy_set_header         X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header         X-Forwarded-Proto $scheme;
            proxy_read_timeout 1h;
            proxy_send_timeout 1h;
            proxy_buffering off;
        }
		
	location /tinyauth {
	    internal;
	    proxy_pass http://tinyauth:3000;
	    proxy_pass_request_body off;
	    proxy_set_header Content-Length "";
            proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
	    proxy_set_header x-forwarded-for $remote_addr;
	    proxy_set_header x-real-ip $remote_addr;
	    proxy_set_header x-forwarded-proto $scheme;
	    proxy_set_header x-forwarded-host $http_host;
	    proxy_set_header x-forwarded-uri $request_uri;
	}
    }

server {
        listen                     127.0.0.1:8443 ssl proxy_protocol;
        http2                      on;
        server_name                connector.riss21.shop;

set_real_ip_from 127.0.0.1;
        real_ip_header proxy_protocol;

ssl_certificate            /certs/live/connector.riss21.shop/fullchain.pem;
        ssl_certificate_key        /certs/live/connector.riss21.shop/privkey.pem;
        ssl_protocols              TLSv1.2 TLSv1.3;
        ssl_ciphers                TLS13_AES_128_GCM_SHA256:TLS13_AES_256_GCM_SHA384:TLS13_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305;
        ssl_prefer_server_ciphers  on;

ssl_session_cache shared:SSL:50m;
        ssl_session_timeout 1d;
        ssl_session_tickets on;

#ssl_stapling               on;
        #ssl_stapling_verify        on;
        resolver                   1.1.1.1 valid=60s;
        resolver_timeout           2s;

location / {
            proxy_pass               http://3xui:5673;
            proxy_http_version       1.1;
            proxy_set_header         Upgrade $http_upgrade;
            proxy_set_header         Connection $connection_upgrade;
            proxy_set_header         Host $host;
            proxy_set_header         X-Real-IP $remote_addr;
            proxy_set_header         X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header         X-Forwarded-Proto $scheme;
            proxy_read_timeout 1h;
            proxy_send_timeout 1h;
            proxy_buffering off;
        }
    }

}

stream {
    #log_format stream_main '[$time_local] $remote_addr $proxy_protocol_addr -> $upstream_addr';
    #access_log /var/log/nginx/access-stream.log stream_main;

map $ssl_preread_server_name $backend_443 {
        nginx.riss21.shop     internal_https;
        dockhand.riss21.shop  internal_https;
        auth.riss21.shop      internal_https;
        panel.riss21.shop     internal_https;
        connector.riss21.shop internal_https;
        riss21.shop           xray_reality;
        default               internal_https;
    }

upstream xray_reality {
        server 3xui:443;
    }

upstream internal_https {
        server 127.0.0.1:8443;
    }

server {
        listen                443 reuseport;
        listen                [::]:443 reuseport;
        proxy_pass             $backend_443;
        ssl_preread            on;
        proxy_connect_timeout   3s;
        proxy_timeout           1h;
        proxy_protocol on;
    }

}