infrastructure/ansible/roles/headscale/files/nginx.conf
Jake Howard 0dcc3f7c30
All checks were successful
/ terraform (push) Successful in 30s
/ ansible (push) Successful in 1m30s
Use regular version of nginx on Arch
`nginx-mainline` requires modules be recompiled each time, and isn't handled automatically. It's still a very new and maintained release.
2024-02-29 19:46:32 +00:00

35 lines
935 B
Nginx Configuration File

# {{ ansible_managed }}
limit_req_zone $binary_remote_addr zone=headscale:10m rate=1r/m;
server {
listen 8888 ssl http2 proxy_protocol;
server_name headscale.jakehoward.tech;
ssl_certificate /etc/letsencrypt/live/headscale.jakehoward.tech/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/headscale.jakehoward.tech/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/headscale.jakehoward.tech/chain.pem;
include includes/ssl.conf;
real_ip_header proxy_protocol;
set_real_ip_from 127.0.0.1;
location / {
proxy_pass http://localhost:8416;
}
location /oidc {
# 3 should be enough for the redirect, callback plus 1 error
limit_req zone=headscale burst=3 nodelay;
limit_req_status 429;
proxy_pass http://localhost:8416;
}
# Block access to the API entirely - I'm not using it
location /api {
return 403;
}
}