infrastructure/ansible/roles/headscale/files/nginx.conf

33 lines
874 B
Nginx Configuration File
Raw Normal View History

2024-01-27 14:18:37 +00:00
# {{ ansible_managed }}
limit_req_zone $binary_remote_addr zone=headscale:10m rate=1r/m;
2024-01-27 14:18:37 +00:00
server {
listen 8888 ssl proxy_protocol;
http2 on;
server_name headscale.jakehoward.tech;
ssl_certificate /etc/letsencrypt/live/headscale.jakehoward.tech/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/headscale.jakehoward.tech/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/headscale.jakehoward.tech/chain.pem;
include includes/ssl.conf;
location / {
proxy_pass http://localhost:8416;
}
location /oidc {
# 3 should be enough for the redirect, callback plus 1 error
limit_req zone=headscale burst=3 nodelay;
limit_req_status 429;
proxy_pass http://localhost:8416;
}
# Block access to the API entirely - I'm not using it
location /api {
return 403;
}
2024-01-27 14:18:37 +00:00
}