server {
server_tokens off;
if ($allowed_country = no) {
return 403;
}
if ($http_user_agent ~* LWP::Simple|BBBike) {
return 403;
}
if ( $http_referer ~* (babes|forsale|girl|jewelry|love|nudit|organic|poker|porn|sex) ) {
return 403;
}
listen 443 ssl default_server;
server_name xxx.dyndns.de;
##
# SSL
##
ssl on;
ssl_certificate /etc/letsencrypt/live/xxx.dyndns.de/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/xxx.dyndns.de/privkey.pem;
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_ciphers HIGH:!aNULL:!eNULL:!LOW:!3DES:!MD5:!RC4;
ssl_client_certificate /etc/ssl/ca/certs/ca.crt;
ssl_crl /etc/ssl/ca/private/ca.crl;
ssl_verify_client optional;
# client certifcate creation: https://arcweb.co/securing-websites-nginx-and-client-side-certificate-authentication-linux/
ssl_session_timeout 5m;
##
# HSTS
##
add_header Strict-Transport-Security "max-age 31536000; includeSubDomains";
##
# global
##
root /var/www/xxx.dyndns.de;
index index.php index.htm index.html;
location / {
if ($ssl_client_verify != SUCCESS) {
return 403;
break;
}
if ($http_upgrade = websocket) {
proxy_pass http://192.168.178.100:2424;
}
if ($http_upgrade != websocket) {
return 403;
}
}
location = /privacy.htm { }
location /smartVISU {
if ($ssl_client_verify != SUCCESS) {
return 403;
break;
}
#auth_basic "Restricted Area: smartVISU";
#auth_basic_user_file /etc/nginx/.htpasswd;
if ($allowed_country = no) {
return 403;
}
proxy_pass https://192.168.178.100/smartVISU;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location /video {
if ($ssl_client_verify != SUCCESS) {
return 403;
break;
}
#auth_basic "Restricted Area: FlurCam";
#auth_basic_user_file /etc/nginx/.flurcam;
if ($allowed_country = no) {
return 403;
}
proxy_pass http://192.168.178.40/video;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Authorization "Basic xxxxxxxxxxxxxxxxxxxxxxx";
}
location /alexa {
auth_basic "Restricted Area: Alexa";
auth_basic_user_file /etc/nginx/.alexa;
if ($allowed_country = no) {
return 403;
}
proxy_pass http://192.168.178.100:9000/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location /shng {
auth_basic "Restricted Area: SmartHomeNG";
auth_basic_user_file /etc/nginx/.shng;
if ($allowed_country = no) {
return 403;
}
proxy_pass http://192.168.178.100:8888/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
upstream php {
server localhost:9090;
}
server {
listen 80 default_server;
server_name xyz.spdns.eu;
satisfy any;
allow 192.168.1.0/24;
deny all;
auth_basic "SmartVisu Anmeldung";
auth_basic_user_file /etc/nginx/htpasswd.smartvisu;
root /var/www/html;
index index.php index.html index.htm;
location / {
root /var/www/html;
index index.html index.php;
autoindex on;
if ($http_upgrade = websocket) {
proxy_pass http://localhost:2424;
}
}
location ~ \.php$ {
include /etc/nginx/fastcgi_params;
fastcgi_pass 127.0.0.1:9090;
fastcgi_read_timeout 300;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
}
location /.well-known {
allow all;
}
}
# Alexa
server {
listen 443 ssl default_server;
server_name xyz.spdns.eu;
access_log /var/log/nginx/alexa.log combined;
auth_basic "Alexa";
auth_basic_user_file /etc/nginx/htpasswd.alexa;
include /etc/nginx/include.d/common;
location / {
proxy_pass http://192.168.1.13:9000/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
Kommentar