Instance at property path "$.accountLinkingRequest.scopes" is expected to be present when instance at property path "$.manifest.apis.smartHome" is present.
[12/Jan/2021:06:45:57 +0100] 5.11.0.100 forwarded for - - Request: "GET /smartvisu/pages/Glock/visu.js HTTP/2.0" - Status: 403 - Bytes sent: 181 Referrer: "https://glock.ddnss.de/smartvisu/index.php?" -$ [12/Jan/2021:06:45:57 +0100] 5.11.0.100 forwarded for - - Request: "GET /smartvisu/icons/ws/temp_outside.svg HTTP/2.0" - Status: 403 - Bytes sent: 181 Referrer: "https://glock.ddnss.de/smartvisu/index.php$ [12/Jan/2021:06:45:57 +0100] 5.11.0.100 forwarded for - - Request: "GET /smartvisu/widgets/animation.js HTTP/2.0" - Status: 403 - Bytes sent: 181 Referrer: "https://glock.ddnss.de/smartvisu/index.php?" - $ [12/Jan/2021:06:45:57 +0100] 5.11.0.100 forwarded for - - Request: "GET /smartvisu/icons/ws/edit_numeric_0.svg HTTP/2.0" - Status: 403 - Bytes sent: 181 Referrer: "https://glock.ddnss.de/smartvisu/index.p$ [12/Jan/2021:06:45:57 +0100] 5.11.0.100 forwarded for - - Request: "GET /smartvisu/icons/ws/edit_numeric_1.svg HTTP/2.0" - Status: 403 - Bytes sent: 181 Referrer: "https://glock.ddnss.de/smartvisu/index.p$ [12/Jan/2021:06:45:57 +0100] 5.11.0.100 forwarded for - - Request: "GET /smartvisu/widgets/basic.js HTTP/2.0" - Status: 403 - Bytes sent: 181 Referrer: "https://glock.ddnss.de/smartvisu/index.php?" - User$
server {
set $nw_port 8888;
set $backend_port 8383;
set $red_port 1880;
server_tokens off;
## Blocken, wenn Zugriff aus einem nicht erlaubten Land erfolgt ##
if ($allowed_country = no) {
return 403;
}
# https://www.cyberciti.biz/tips/linux-unix-bsd-nginx-webserver-security.html
## Block download agents ##
if ($http_user_agent ~* LWP::Simple|BBBike|wget) {
return 403;
}
## Block some robots ##
if ($http_user_agent ~* msnbot|scrapbot) {
return 403;
}
## Deny certain Referers ##
if ( $http_referer ~* (babes|forsale|girl|jewelry|love|nudit|organic|pok er|porn|sex|teen) )
{
return 403;
}
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name glock.ddnss.de;
##
# SSL
##
## Activate SSL, setze SERVER Zertifikat Informationen ##
# Generiert via Let's Encrypt!
ssl_certificate /etc/letsencrypt/live/glock.ddnss.de/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/glock.ddnss.de/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/glock.ddnss.de/fullchain.pem;
ssl_session_cache builtin:1000 shared:SSL:60m;
ssl_prefer_server_ciphers on;
# unsichere SSL Ciphers deaktivieren!
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:D[IMG2=JSON]{"data-align":"none","data-size":"full","src":"https:\/\/knx-user-forum.de\/core\/image\/gif;base64,R0lGODlhAQABAPABAP\/\/\/wAAACH5BAEKAAAALAAAAAABAAEAAAICRAEAOw=="}[/IMG2]HE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:D[IMG2=JSON]{"data-align":"none","data-size":"full","src":"https:\/\/knx-user-forum.de\/core\/image\/gif;base64,R0lGODlhAQABAPABAP\/\/\/wAAACH5BAEKAAAALAAAAAABAAEAAAICRAEAOw=="}[/IMG2]HE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
ssl_ecdh_curve secp384r1;
ssl_protocols TLSv1.2;
ssl_session_timeout 60m;
ssl_session_tickets on;
ssl_session_ticket_key /etc/nginx/nginx_ticketkey;
#ssl_buffer_size 16k; #for throughput, video applications
ssl_buffer_size 4k; #for quick first byte delivery
# Client Zertifikat spezifisch
ssl_client_certificate /etc/ssl/ca/certs/ca.crt;
ssl_crl /etc/ssl/ca/private/ca.crl;
ssl_verify_client optional;
ssl_dhparam /etc/ssl/ca/dh.pem;
# OCSP Stapling ---
# fetch OCSP records from URL in ssl_certificate and cache them
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;
client_body_buffer_size 8K;
client_max_body_size 20m;
client_body_timeout 10s;
client_header_buffer_size 1k;
large_client_header_buffers 2 16k;
client_header_timeout 5s;
##
# global
##
root /var/www/html;
# Add index.php to the list if you are using PHP
index index.html index.htm index.php;
# Proxy Caching
# Skip^1 caching variable init
set $nocache 0;
# Bypass^2 caching variable init
set $purgecache 0;
# Bypass^2 cache on no-cache (et al.) browser request
if ($http_cache_control ~ "max-age=0")
{ set $purgecache 1; }
if ($http_cache_control ~ "no-cache")
{ set $purgecache 1; }
# Bypass^2 cache with custom header set on request
if ($http_x_cache_purge ~* "true")
{ set $purgecache 1; }
location ~* favicon|apple-touch-icon|android-chrome-|mstile-|safari-pinned-tab.svg|browserconfig.xml|manifest.json|apple-icon|ms-icon|android-icon|mstile {
try_files $uri @favicons;
}
location @favicons {
rewrite ^/(.+)$ /favicons/$1 last;
}
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|xml)$ {
include /etc/nginx/headers.conf;
expires 7d;
add_header Cache-Control "public, no-transform";
# This script tests the SSL certificate and enables Websocket access with Apple devices.
# If you want to limit your access to devices with certificates (recommended!), don't remove this line!
access_by_lua_file /etc/nginx/scripts/hass_access.lua;
}
# Weiterleitung zu SmartHomeNG (Websocket Schnittstelle) mit Basic Auth
location = / {
include /etc/nginx/headers.conf;
satisfy any;
auth_basic "Restricted Area";
auth_basic_user_file /etc/nginx/.smartvisu;
allow 127.0.0.1;
allow 192.168.0.0/16;
allow 10.0.0.0/16;
allow ::1;
deny all;
# This script tests the SSL certificate and enables Websocket access with Apple devices.
# If you want to limit your access to devices with certificates (recommended!), don't remove this line!
access_by_lua_file /etc/nginx/scripts/hass_access.lua;
# Nur Websocket Verbindungen gegen "/" durchlassen!
if ($http_upgrade = websocket) {
proxy_pass http://192.168.178.10:2424;
}
}
# Zugriff auf die smartVISU mit Basic Auth
location /smartvisu {
include /etc/nginx/headers.conf;
satisfy any;
auth_basic "Restricted Area: smartVISU2.9";
auth_basic_user_file /etc/nginx/.smartvisu;
allow 127.0.0.1;
allow 192.168.0.0/16;
allow 10.0.0.0/16;
allow ::1;
deny all;
# This script tests the SSL certificate and enables Websocket access with Apple devices.
# If you want to limit your access to devices with certificates (recommended!), don't remove this line!
access_by_lua_file /etc/nginx/scripts/hass_access.lua;
#This is alternative to the lua script but doesn't work with Apple devices.
#if ($ssl_client_verify != SUCCESS) {
# return 403;
#}
# proxy_pass http://sv/smartvisu;
proxy_pass http://192.168.178.10/smartvisu;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# Zugriff auf die smartVISU 2.8 mit Basic Auth
location /smartvisu2.8 {
include /etc/nginx/headers.conf;
satisfy any;
auth_basic "Restricted Area: smartVISU2.8";
auth_basic_user_file /etc/nginx/.smartvisu;
allow 127.0.0.1;
allow 192.168.0.0/16;
allow 10.0.0.0/16;
allow ::1;
deny all;
# This script tests the SSL certificate and enables Websocket access with Apple devices.
# If you want to limit your access to devices with certificates (recommended!), don't remove this line!
access_by_lua_file /etc/nginx/scripts/hass_access.lua;
proxy_pass http://sv/smartvisu2.8;
}
# Zugriff auf nodered
location /red/ {
include /etc/nginx/headers.conf;
satisfy any;
auth_basic "Restricted Area: smartVISU2.9";
auth_basic_user_file /etc/nginx/.smartvisu;
allow 127.0.0.1;
allow 192.168.0.0/16;
allow 10.0.0.0/16;
allow ::1;
deny all;
# This script tests the SSL certificate and enables Websocket access with Apple devices.
# If you want to limit your access to devices with certificates (recommended!), don't remove this line!
access_by_lua_file /etc/nginx/scripts/hass_access.lua;
proxy_pass http://$server_addr:$red_port;
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
include /etc/nginx/headers.conf;
expires 7d;
add_header Cache-Control "public, no-transform";
proxy_pass http://$server_addr:$red_port;
access_by_lua_file /etc/nginx/scripts/hass_access.lua;
}
}
# Alexa Plugin Weiterleitung
location /alexa/ {
include /etc/nginx/headers.conf;
satisfy any;
auth_basic "Restricted Area: Alexa";
auth_basic_user_file /etc/nginx/.alexa;
allow 127.0.0.1;
allow 192.168.0.0/16;
allow 10.0.0.0/16;
allow ::1;
deny all;
# This script tests the SSL certificate and enables Websocket access with Apple devices.
# If you want to limit your access to devices with certificates (recommended!), don't remove this line!
access_by_lua_file /etc/nginx/scripts/hass_access.lua;
# proxy_pass http://alexa;
proxy_pass http://192.168.178.10:9000/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# Backend Plugin Weiterleitung
location /gstatic/ {
include /etc/nginx/headers.conf;
satisfy any;
auth_basic "Restricted Area: Smarthome NG Backend";
auth_basic_user_file /etc/nginx/.shng;
proxy_set_header Authorization "Basic c21hcnRob21lCg==";
# Create your base64 Passwort on the commandline: openssl enc -base64 <<< '<PASSWORD>'
allow 127.0.0.1;
allow 192.168.0.0/16;
allow 10.0.0.0/16;
allow ::1;
deny all;
# This script tests the SSL certificate and enables Websocket access with Apple devices.
# If you want to limit your access to devices with certificates (recommended!), don't remove this line!
access_by_lua_file /etc/nginx/scripts/hass_access.lua;
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
include /etc/nginx/headers.conf;
expires 7d;
add_header Cache-Control "public, no-transform";
proxy_pass http://$server_addr:$backend_port;
access_by_lua_file /etc/nginx/scripts/hass_access.lua;
}
proxy_pass http://$server_addr:$backend_port;
}
location /visu_websocket/ {
include /etc/nginx/headers.conf;
satisfy any;
auth_basic "Restricted Area: Smarthome NG Backend";
auth_basic_user_file /etc/nginx/.shng;
proxy_set_header Authorization "Basic c21hcnRob21lCg==";
# Create your base64 Passwort on the commandline: openssl enc -base64 <<< '<PASSWORD>'
allow 127.0.0.1;
allow 192.168.0.0/16;
allow 10.0.0.0/16;
allow ::1;
deny all;
# This script tests the SSL certificate and enables Websocket access with Apple devices.
# If you want to limit your access to devices with certificates (recommended!), don't remove this line!
access_by_lua_file /etc/nginx/scripts/hass_access.lua;
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
include /etc/nginx/headers.conf;
expires 7d;
add_header Cache-Control "public, no-transform";
proxy_pass http://$server_addr:$backend_port;
access_by_lua_file /etc/nginx/scripts/hass_access.lua;
}
proxy_pass http://$server_addr:$backend_port;
}
location /api/ {
include /etc/nginx/headers.conf;
satisfy any;
auth_basic "Restricted Area: Smarthome NG Backend";
auth_basic_user_file /etc/nginx/.shng;
proxy_set_header Authorization "Basic c21hcnRob21lCg==";
# Create your base64 Passwort on the commandline: openssl enc -base64 <<< '<PASSWORD>'
allow 127.0.0.1;
allow 192.168.0.0/16;
allow 10.0.0.0/16;
allow ::1;
deny all;
# This script tests the SSL certificate and enables Websocket access with Apple devices.
# If you want to limit your access to devices with certificates (recommended!), don't remove this line!
access_by_lua_file /etc/nginx/scripts/hass_access.lua;
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
include /etc/nginx/headers.conf;
expires 7d;
add_header Cache-Control "public, no-transform";
proxy_pass http://$server_addr:$backend_port;
access_by_lua_file /etc/nginx/scripts/hass_access.lua;
}
proxy_pass http://$server_addr:$backend_port;
}
location /admin/ {
include /etc/nginx/headers.conf;
satisfy any;
auth_basic "Restricted Area: Smarthome NG Backend";
auth_basic_user_file /etc/nginx/.shng;
proxy_set_header Authorization "Basic c21hcnRob21lCg==";
# Create your base64 Passwort on the commandline: openssl enc -base64 <<< '<PASSWORD>'
allow 127.0.0.1;
allow 192.168.0.0/16;
allow 10.0.0.0/16;
allow ::1;
deny all;
# This script tests the SSL certificate and enables Websocket access with Apple devices.
# If you want to limit your access to devices with certificates (recommended!), don't remove this line!
access_by_lua_file /etc/nginx/scripts/hass_access.lua;
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
include /etc/nginx/headers.conf;
expires 7d;
add_header Cache-Control "public, no-transform";
proxy_pass http://$server_addr:$backend_port;
access_by_lua_file /etc/nginx/scripts/hass_access.lua;
}
proxy_pass http://$server_addr:$backend_port;
}
location /backend/ {
include /etc/nginx/headers.conf;
satisfy any;
auth_basic "Restricted Area: Smarthome NG Backend";
auth_basic_user_file /etc/nginx/.shng;
proxy_set_header Authorization "Basic c21hcnRob21lCg==";
# Create your base64 Passwort on the commandline: openssl enc -base64 <<< '<PASSWORD>'
allow 127.0.0.1;
allow 192.168.0.0/16;
allow 10.0.0.0/16;
allow ::1;
deny all;
# This script tests the SSL certificate and enables Websocket access with Apple devices.
# If you want to limit your access to devices with certificates (recommended!), don't remove this line!
access_by_lua_file /etc/nginx/scripts/hass_access.lua;
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
include /etc/nginx/headers.conf;
expires 7d;
add_header Cache-Control "public, no-transform";
proxy_pass http://$server_addr:$backend_port;
access_by_lua_file /etc/nginx/scripts/hass_access.lua;
}
proxy_pass http://$server_addr:$backend_port;
}
# Network Plugin Weiterleitung
location /shnet/ {
include /etc/nginx/headers.conf;
satisfy any;
# auth_basic "Restricted Area: Smarthome NG Network";
# auth_basic_user_file /etc/nginx/.shng;
proxy_set_header Authorization "Basic c21hcnRob21lCg==";
# Create your base64 Passwort on the commandline: openssl enc -base64 <<< '<PASSWORD>'
allow 127.0.0.1;
allow 192.168.0.0/16;
allow 10.0.0.0/16;
allow ::1;
deny all;
# This script tests the SSL certificate and enables Websocket access with Apple devices.
# If you want to limit your access to devices with certificates (recommended!), don't remove this line!
access_by_lua_file /etc/nginx/scripts/hass_access.lua;
rewrite ^/shnet/(.*) /$1 break;
proxy_pass http://$server_addr:$nw_port;
}
# Weiterleitung zu Grafana
location /grafana/ {
satisfy any;
allow 127.0.0.1;
allow 10.0.0.0/8;
allow 192.168.0.0/16;
# auth_basic "Restricted Area: Monit";
# auth_basic_user_file /etc/nginx/.monit;
allow ::1;
deny all;
# This script tests the SSL certificate and enables Websocket access with Apple devices.
# If you want to limit your access to devices with certificates (recommended!), don't remove this line!
access_by_lua_file /etc/nginx/scripts/hass_access.lua;
proxy_pass http://grafanahost/;
include /etc/nginx/headers.conf;
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
rewrite ^/grafana/(.*) /$1 break;
include /etc/nginx/headers.conf;
expires 7d;
add_header Cache-Control "public, no-transform";
proxy_pass http://grafanahost;
access_by_lua_file /etc/nginx/scripts/hass_access.lua;
}
}
Kommentar