nginx.conf
checks.x86_64-linux.nixos-cask
· build #327
· raw
1structuredAttrs is enabled2[context] INFO Can't find variable 'user'3[context] INFO Can't find variable 'email'45==================== Results ===================67>> Problem: [add_header_redefinition] Nested "add_header" drops parent headers.8Description: "add_header" replaces ALL parent headers. See documentation: http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header9Additional info: https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md10Reason: Parent headers "x-frame-options", "x-content-type-options" was dropped in current level11Pseudo config:1213server {14 server_name rad.mulatta.io;1516 location / {17 add_header Cache-Control public, max-age=3600;18 }19 add_header X-Frame-Options DENY always;20 add_header X-Content-Type-Options nosniff always;21 add_header Referrer-Policy strict-origin-when-cross-origin always;22}2324==================== Summary ===================25Total issues:26 Unspecified: 027 Low: 028 Medium: 129 High: 03031\n\nThis can be caused by combining multiple incompatible services on the same hostname.\n\nFull merged config:\n\n32pid /run/nginx/nginx.pid;33error_log stderr;34daemon off;35events {36}37http {38 # Load mime types and configure maximum size of the types hash tables.39 include /nix/store/bqb4ja5w47g587b5j2hkl4993sw5mykd-mailcap-2.1.54/etc/nginx/mime.types;40 types_hash_max_size 2688;41 include /nix/store/ixc951srcxa7p68hpbnzzdimqi4ivlvk-nginx-1.30.4/conf/fastcgi.conf;42 include /nix/store/ixc951srcxa7p68hpbnzzdimqi4ivlvk-nginx-1.30.4/conf/uwsgi_params;43 default_type application/octet-stream;44 resolver [fd28:387a:8e:7600::1] 1.1.1.1 8.8.8.8;45 # optimisation46 sendfile on;47 tcp_nopush on;48 tcp_nodelay on;49 keepalive_timeout 65;50 ssl_protocols TLSv1.2 TLSv1.3;51 ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;52 # Consider https://ssl-config.mozilla.org/#server=nginx&config=intermediate as the lower bound53 ssl_conf_command Groups "X25519MLKEM768:X25519:P-256:P-384";54 ssl_session_timeout 1d;55 ssl_session_cache shared:SSL:10m;56 # Breaks forward secrecy: https://github.com/mozilla/server-side-tls/issues/13557 ssl_session_tickets off;58 # We don't enable insecure ciphers by default, so this allows59 # clients to pick the most performant, per https://github.com/mozilla/server-side-tls/issues/26060 ssl_prefer_server_ciphers off;61 brotli on;62 brotli_static on;63 brotli_comp_level 5;64 brotli_window 512k;65 brotli_min_length 256;66 brotli_types application/atom+xml application/geo+json application/javascript application/json application/ld+json application/manifest+json application/rdf+xml application/vnd.ms-fontobject application/wasm application/x-rss+xml application/x-web-app-manifest+json application/xhtml+xml application/xliff+xml application/xml font/collection font/otf font/ttf image/bmp image/svg+xml image/vnd.microsoft.icon text/cache-manifest text/calendar text/css text/csv text/javascript text/markdown text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/xml;67 gzip on;68 gzip_static on;69 gzip_vary on;70 gzip_comp_level 5;71 gzip_min_length 256;72 gzip_proxied expired no-cache no-store private auth;73 gzip_types application/atom+xml application/geo+json application/javascript application/json application/ld+json application/manifest+json application/rdf+xml application/vnd.ms-fontobject application/wasm application/x-rss+xml application/x-web-app-manifest+json application/xhtml+xml application/xliff+xml application/xml font/collection font/otf font/ttf image/bmp image/svg+xml image/vnd.microsoft.icon text/cache-manifest text/calendar text/css text/csv text/javascript text/markdown text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/xml;74 proxy_redirect off;75 proxy_connect_timeout 3600s;76 proxy_send_timeout 3600s;77 proxy_read_timeout 3600s;78 proxy_http_version 1.1;79 # don't let clients close the keep-alive connection to upstream. See the nginx blog for details:80 # https://www.nginx.com/blog/avoiding-top-10-nginx-configuration-mistakes/#no-keepalives81 proxy_set_header "Connection" "";82 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;83 # $connection_upgrade is used for websocket proxying84 map $http_upgrade $connection_upgrade {85 default upgrade;86 '' close;87 }88 client_max_body_size 10m;89 server_tokens off;90 add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload' always;91 access_log syslog:server=unix:/dev/log;92 server {93 listen [::1]:443 quic default_server;94 listen [::1]:443 ssl default_server;95 listen 10.208.0.9:80 default_server;96 listen 10.208.0.9:443 quic default_server;97 listen 10.208.0.9:443 ssl default_server;98 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80 default_server;99 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic default_server;100 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl default_server;101 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80 default_server;102 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic default_server;103 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl default_server;104 listen 0.0.0.0:80 default_server;105 listen 0.0.0.0:443 quic default_server;106 listen 0.0.0.0:443 ssl default_server;107 server_name _;108 ssl_reject_handshake on;109 location / {110 return 444;111 }112 }113 server {114 listen 10.208.0.9:80;115 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;116 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;117 listen 0.0.0.0:80;118 server_name atuin.mulatta.io;119 location / {120 return 301 https://$host$request_uri;121 }122 location ^~ /.well-known/acme-challenge/ {123 root /var/lib/acme/acme-challenge;124 auth_basic off;125 auth_request off;126 }127 }128 server {129 listen [::1]:443 quic;130 listen [::1]:443 ssl;131 listen 10.208.0.9:443 quic;132 listen 10.208.0.9:443 ssl;133 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;134 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;135 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;136 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;137 listen 0.0.0.0:443 quic;138 listen 0.0.0.0:443 ssl;139 server_name atuin.mulatta.io;140 http2 on;141 http3 on;142 http3_hq off;143 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;144 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;145 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;146 location ^~ /.well-known/acme-challenge/ {147 root /var/lib/acme/acme-challenge;148 auth_basic off;149 auth_request off;150 }151 location / {152 proxy_pass http://127.0.0.1:8888;153 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;154 }155 }156 server {157 listen 10.208.0.9:80;158 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;159 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;160 listen 0.0.0.0:80;161 server_name blossom.mulatta.io;162 location / {163 return 301 https://$host$request_uri;164 }165 location ^~ /.well-known/acme-challenge/ {166 root /var/lib/acme/acme-challenge;167 auth_basic off;168 auth_request off;169 }170 }171 server {172 listen [::1]:443 quic;173 listen [::1]:443 ssl;174 listen 10.208.0.9:443 quic;175 listen 10.208.0.9:443 ssl;176 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;177 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;178 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;179 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;180 listen 0.0.0.0:443 quic;181 listen 0.0.0.0:443 ssl;182 server_name blossom.mulatta.io;183 http2 on;184 http3 on;185 http3_hq off;186 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;187 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;188 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;189 location ^~ /.well-known/acme-challenge/ {190 root /var/lib/acme/acme-challenge;191 auth_basic off;192 auth_request off;193 }194 location / {195 proxy_pass http://127.0.0.1:8396;196 client_max_body_size 100m;197 proxy_request_buffering on;198 proxy_read_timeout 300s;199 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;200 }201 location ~ ^/(upload|media|nip96|api/upload) {202 proxy_pass http://127.0.0.1:8396;203 limit_req zone=blossom_upload burst=4 nodelay;204 limit_conn blossom_conn 2;205 client_max_body_size 100m;206 proxy_request_buffering on;207 proxy_read_timeout 300s;208 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;209 }210 }211 server {212 listen [::1]:443 quic;213 listen [::1]:443 ssl;214 listen 10.208.0.9:80;215 listen 10.208.0.9:443 quic;216 listen 10.208.0.9:443 ssl;217 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;218 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;219 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;220 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;221 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;222 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;223 listen 0.0.0.0:80;224 listen 0.0.0.0:443 quic;225 listen 0.0.0.0:443 ssl;226 server_name ca.x;227 http2 on;228 http3 on;229 http3_hq off;230 ssl_certificate /var/lib/acme/ca.x/fullchain.pem;231 ssl_certificate_key /var/lib/acme/ca.x/key.pem;232 ssl_trusted_certificate /var/lib/acme/ca.x/chain.pem;233 location ^~ /.well-known/acme-challenge/ {234 root /var/lib/acme/acme-challenge;235 auth_basic off;236 auth_request off;237 }238 location / {239 proxy_pass https://localhost:1443;240 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;241 }242 location = /ca.crt {243 alias /nix/store/3jr13xmgmflr1vbv4fyv8cpln8hbrbmf-per-machine-cask-step-intermediate-cert_intermediate.crt;244 }245 }246 server {247 listen 10.208.0.9:80;248 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;249 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;250 listen 0.0.0.0:80;251 server_name cache.mulatta.io;252 location / {253 return 301 https://$host$request_uri;254 }255 location ^~ /.well-known/acme-challenge/ {256 root /var/lib/acme/acme-challenge;257 auth_basic off;258 auth_request off;259 }260 }261 server {262 listen [::1]:443 quic;263 listen [::1]:443 ssl;264 listen 10.208.0.9:443 quic;265 listen 10.208.0.9:443 ssl;266 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;267 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;268 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;269 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;270 listen 0.0.0.0:443 quic;271 listen 0.0.0.0:443 ssl;272 server_name cache.mulatta.io;273 http2 on;274 http3 on;275 http3_hq off;276 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;277 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;278 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;279 location ^~ /.well-known/acme-challenge/ {280 root /var/lib/acme/acme-challenge;281 auth_basic off;282 auth_request off;283 }284 location / {285 proxy_pass http://127.0.0.1:5751;286 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;287 }288 }289 server {290 listen 10.208.0.9:80;291 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;292 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;293 listen 0.0.0.0:80;294 server_name chat.mulatta.io;295 location / {296 return 301 https://$host$request_uri;297 }298 location ^~ /.well-known/acme-challenge/ {299 root /var/lib/acme/acme-challenge;300 auth_basic off;301 auth_request off;302 }303 }304 server {305 listen [::1]:443 quic;306 listen [::1]:443 ssl;307 listen 10.208.0.9:443 quic;308 listen 10.208.0.9:443 ssl;309 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;310 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;311 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;312 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;313 listen 0.0.0.0:443 quic;314 listen 0.0.0.0:443 ssl;315 server_name chat.mulatta.io;316 http2 on;317 http3 on;318 http3_hq off;319 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;320 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;321 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;322 location ^~ /.well-known/acme-challenge/ {323 root /var/lib/acme/acme-challenge;324 auth_basic off;325 auth_request off;326 }327 location / {328 root /nix/store/29y1klykqx42lfny0ixxhzj01b3iprl0-glowing-bear-0.9.0;329 }330 location /oauth2/ {331 proxy_pass http://127.0.0.1:4183;332 auth_request off;333 proxy_set_header X-Scheme $scheme;334 proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;335 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;336 }337 location = /oauth2/auth {338 proxy_pass http://127.0.0.1:4183/oauth2/auth;339 auth_request off;340 proxy_set_header X-Scheme $scheme;341 proxy_set_header Content-Length "";342 proxy_pass_request_body off;343 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;344 }345 location @redirectToOauth2ProxyLogin {346 return 307 https://chat.mulatta.io/oauth2/start?rd=$scheme://$host$request_uri;347 auth_request off;348 }349 location ^~ /weechat {350 proxy_pass http://malt.n:4242;351 proxy_http_version 1.1;352 proxy_set_header Upgrade $http_upgrade;353 proxy_set_header Connection $connection_upgrade;354 proxy_set_header X-User $user;355 proxy_set_header X-Email $email;356 proxy_read_timeout 3600s;357 proxy_send_timeout 3600s;358 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;359 }360 add_header X-Frame-Options "DENY" always;361 add_header X-Content-Type-Options "nosniff" always;362 add_header Referrer-Policy "strict-origin-when-cross-origin" always;363 auth_request /oauth2/auth;364 error_page 401 = @redirectToOauth2ProxyLogin;365 auth_request_set $user $upstream_http_x_auth_request_user;366 auth_request_set $email $upstream_http_x_auth_request_email;367 auth_request_set $auth_cookie $upstream_http_set_cookie;368 add_header Set-Cookie $auth_cookie;369 }370 server {371 listen 10.208.0.9:80;372 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;373 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;374 listen 0.0.0.0:80;375 server_name cloud.mulatta.io;376 location / {377 return 301 https://$host$request_uri;378 }379 location ^~ /.well-known/acme-challenge/ {380 root /var/lib/acme/acme-challenge;381 auth_basic off;382 auth_request off;383 }384 }385 server {386 listen [::1]:443 quic;387 listen [::1]:443 ssl;388 listen 10.208.0.9:443 quic;389 listen 10.208.0.9:443 ssl;390 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;391 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;392 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;393 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;394 listen 0.0.0.0:443 quic;395 listen 0.0.0.0:443 ssl;396 server_name cloud.mulatta.io;397 http2 on;398 http3 on;399 http3_hq off;400 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;401 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;402 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;403 location ^~ /.well-known/acme-challenge/ {404 root /var/lib/acme/acme-challenge;405 auth_basic off;406 auth_request off;407 }408 location / {409 proxy_pass http://malt.n:80;410 proxy_http_version 1.1;411 proxy_set_header Upgrade $http_upgrade;412 proxy_set_header Connection $connection_upgrade;413 proxy_buffering off;414 proxy_request_buffering off;415 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;416 }417 location = /.well-known/caldav {418 return 301 $scheme://$host/remote.php/dav;419 }420 location = /.well-known/carddav {421 return 301 $scheme://$host/remote.php/dav;422 }423 location = /.well-known/nodeinfo {424 return 301 $scheme://$host/index.php/.well-known/nodeinfo;425 }426 location = /.well-known/webfinger {427 return 301 $scheme://$host/index.php/.well-known/webfinger;428 }429 client_max_body_size 16G;430 client_body_timeout 3600s;431 proxy_connect_timeout 3600s;432 proxy_send_timeout 3600s;433 proxy_read_timeout 3600s;434 }435 server {436 listen 10.208.0.9:80;437 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;438 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;439 listen 0.0.0.0:80;440 server_name headscale.mulatta.io;441 location / {442 return 301 https://$host$request_uri;443 }444 location ^~ /.well-known/acme-challenge/ {445 root /var/lib/acme/acme-challenge;446 auth_basic off;447 auth_request off;448 }449 }450 server {451 listen [::1]:443 quic;452 listen [::1]:443 ssl;453 listen 10.208.0.9:443 quic;454 listen 10.208.0.9:443 ssl;455 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;456 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;457 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;458 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;459 listen 0.0.0.0:443 quic;460 listen 0.0.0.0:443 ssl;461 server_name headscale.mulatta.io;462 http2 on;463 http3 on;464 http3_hq off;465 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;466 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;467 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;468 location ^~ /.well-known/acme-challenge/ {469 root /var/lib/acme/acme-challenge;470 auth_basic off;471 auth_request off;472 }473 location / {474 proxy_pass http://127.0.0.1:8089;475 proxy_http_version 1.1;476 proxy_set_header Upgrade $http_upgrade;477 proxy_set_header Connection $connection_upgrade;478 proxy_buffering off;479 proxy_request_buffering off;480 proxy_read_timeout 3600s;481 proxy_send_timeout 3600s;482 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;483 }484 }485 server {486 listen 10.208.0.9:80;487 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;488 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;489 listen 0.0.0.0:80;490 server_name home.mulatta.io;491 location / {492 return 301 https://$host$request_uri;493 }494 location ^~ /.well-known/acme-challenge/ {495 root /var/lib/acme/acme-challenge;496 auth_basic off;497 auth_request off;498 }499 }500 server {501 listen [::1]:443 quic;502 listen [::1]:443 ssl;503 listen 10.208.0.9:443 quic;504 listen 10.208.0.9:443 ssl;505 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;506 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;507 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;508 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;509 listen 0.0.0.0:443 quic;510 listen 0.0.0.0:443 ssl;511 server_name home.mulatta.io;512 http2 on;513 http3 on;514 http3_hq off;515 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;516 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;517 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;518 location ^~ /.well-known/acme-challenge/ {519 root /var/lib/acme/acme-challenge;520 auth_basic off;521 auth_request off;522 }523 location / {524 proxy_pass http://malt.n:8123;525 proxy_http_version 1.1;526 proxy_set_header Upgrade $http_upgrade;527 proxy_set_header Connection $connection_upgrade;528 proxy_buffering off;529 proxy_read_timeout 3600s;530 proxy_send_timeout 3600s;531 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;532 }533 location = /.well-known/security.txt {534 return 308 https://mulatta.io/.well-known/security.txt;535 }536 location ~ ^/.well-known/ {537 return 404;538 }539 add_header X-Frame-Options "DENY" always;540 add_header X-Content-Type-Options "nosniff" always;541 add_header Referrer-Policy "strict-origin-when-cross-origin" always;542 if ($block_dotted) {543 return 404;544 }545 }546 server {547 listen 10.208.0.9:80;548 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;549 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;550 listen 0.0.0.0:80;551 server_name idm.mulatta.io;552 location / {553 return 301 https://$host$request_uri;554 }555 location ^~ /.well-known/acme-challenge/ {556 root /var/lib/acme/acme-challenge;557 auth_basic off;558 auth_request off;559 }560 }561 server {562 listen [::1]:443 quic;563 listen [::1]:443 ssl;564 listen 10.208.0.9:443 quic;565 listen 10.208.0.9:443 ssl;566 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;567 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;568 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;569 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;570 listen 0.0.0.0:443 quic;571 listen 0.0.0.0:443 ssl;572 server_name idm.mulatta.io;573 http2 on;574 http3 on;575 http3_hq off;576 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;577 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;578 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;579 location ^~ /.well-known/acme-challenge/ {580 root /var/lib/acme/acme-challenge;581 auth_basic off;582 auth_request off;583 }584 location / {585 proxy_pass https://127.0.0.1:8443;586 proxy_http_version 1.1;587 proxy_set_header Upgrade $http_upgrade;588 proxy_set_header Connection $connection_upgrade;589 proxy_ssl_verify off;590 proxy_set_header Host $host;591 proxy_set_header X-Real-IP $remote_addr;592 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;593 proxy_set_header X-Forwarded-Proto $scheme;594 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;595 }596 }597 server {598 listen 10.208.0.9:80;599 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;600 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;601 listen 0.0.0.0:80;602 server_name links.mulatta.io;603 location / {604 return 301 https://$host$request_uri;605 }606 location ^~ /.well-known/acme-challenge/ {607 root /var/lib/acme/acme-challenge;608 auth_basic off;609 auth_request off;610 }611 }612 server {613 listen [::1]:443 quic;614 listen [::1]:443 ssl;615 listen 10.208.0.9:443 quic;616 listen 10.208.0.9:443 ssl;617 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;618 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;619 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;620 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;621 listen 0.0.0.0:443 quic;622 listen 0.0.0.0:443 ssl;623 server_name links.mulatta.io;624 http2 on;625 http3 on;626 http3_hq off;627 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;628 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;629 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;630 location ^~ /.well-known/acme-challenge/ {631 root /var/lib/acme/acme-challenge;632 auth_basic off;633 auth_request off;634 }635 location / {636 proxy_pass http://malt.n:3000;637 proxy_http_version 1.1;638 proxy_set_header Upgrade $http_upgrade;639 proxy_set_header Connection $connection_upgrade;640 proxy_read_timeout 300s;641 proxy_send_timeout 300s;642 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;643 }644 add_header X-Frame-Options "DENY" always;645 add_header X-Content-Type-Options "nosniff" always;646 add_header Referrer-Policy "strict-origin-when-cross-origin" always;647 if ($block_dotted) {648 return 404;649 }650 client_max_body_size 100M;651 }652 server {653 listen [::1]:443 quic;654 listen [::1]:443 ssl;655 listen 10.208.0.9:80;656 listen 10.208.0.9:443 quic;657 listen 10.208.0.9:443 ssl;658 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;659 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;660 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;661 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;662 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;663 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;664 listen 0.0.0.0:80;665 listen 0.0.0.0:443 quic;666 listen 0.0.0.0:443 ssl;667 server_name localhost 127.0.0.1 [::1];668 location /nginx_status {669 stub_status on;670 access_log off;671 allow 127.0.0.1;672 allow ::1;673 deny all;674 }675 }676 server {677 listen 10.208.0.9:80;678 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;679 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;680 listen 0.0.0.0:80;681 server_name mail.mulatta.io;682 location / {683 return 301 https://$host$request_uri;684 }685 location ^~ /.well-known/acme-challenge/ {686 root /var/lib/acme/acme-challenge;687 auth_basic off;688 auth_request off;689 }690 }691 server {692 listen [::1]:443 quic;693 listen [::1]:443 ssl;694 listen 10.208.0.9:443 quic;695 listen 10.208.0.9:443 ssl;696 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;697 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;698 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;699 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;700 listen 0.0.0.0:443 quic;701 listen 0.0.0.0:443 ssl;702 server_name mail.mulatta.io;703 http2 on;704 http3 on;705 http3_hq off;706 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;707 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;708 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;709 location ^~ /.well-known/acme-challenge/ {710 root /var/lib/acme/acme-challenge;711 auth_basic off;712 auth_request off;713 }714 location / {715 proxy_pass http://127.0.0.1:3000;716 proxy_http_version 1.1;717 proxy_set_header Upgrade $http_upgrade;718 proxy_set_header Connection $connection_upgrade;719 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;720 }721 location /dav/ {722 proxy_pass http://127.0.0.1:8080;723 proxy_set_header Host stalwart.mulatta.io;724 proxy_set_header X-Real-IP $remote_addr;725 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;726 proxy_set_header X-Forwarded-Proto $scheme;727 }728 location /jmap/ {729 proxy_pass http://127.0.0.1:8080;730 proxy_http_version 1.1;731 proxy_set_header Upgrade $http_upgrade;732 proxy_set_header Connection $connection_upgrade;733 proxy_set_header Host stalwart.mulatta.io;734 proxy_set_header X-Real-IP $remote_addr;735 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;736 proxy_set_header X-Forwarded-Proto $scheme;737 client_max_body_size 50M;738 proxy_read_timeout 3600s;739 proxy_send_timeout 3600s;740 }741 location = /.well-known/caldav {742 proxy_pass http://127.0.0.1:8080;743 proxy_set_header Host stalwart.mulatta.io;744 proxy_set_header X-Real-IP $remote_addr;745 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;746 proxy_set_header X-Forwarded-Proto $scheme;747 }748 location = /.well-known/carddav {749 proxy_pass http://127.0.0.1:8080;750 proxy_set_header Host stalwart.mulatta.io;751 proxy_set_header X-Real-IP $remote_addr;752 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;753 proxy_set_header X-Forwarded-Proto $scheme;754 }755 location = /.well-known/jmap {756 proxy_pass http://127.0.0.1:8080/jmap/session;757 proxy_set_header Host stalwart.mulatta.io;758 proxy_set_header X-Real-IP $remote_addr;759 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;760 proxy_set_header X-Forwarded-Proto $scheme;761 proxy_set_header Accept-Encoding "";762 sub_filter "https://stalwart.mulatta.io/" "https://mail.mulatta.io/";763 sub_filter_once off;764 sub_filter_types application/json;765 }766 location = /.well-known/oauth-authorization-server {767 proxy_pass http://127.0.0.1:8080;768 proxy_set_header Host stalwart.mulatta.io;769 proxy_set_header X-Real-IP $remote_addr;770 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;771 proxy_set_header X-Forwarded-Proto $scheme;772 }773 location = /.well-known/openid-configuration {774 proxy_pass http://127.0.0.1:8080;775 proxy_set_header Host stalwart.mulatta.io;776 proxy_set_header X-Real-IP $remote_addr;777 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;778 proxy_set_header X-Forwarded-Proto $scheme;779 }780 }781 server {782 listen 10.208.0.9:80;783 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;784 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;785 listen 0.0.0.0:80;786 server_name mq.mulatta.io;787 location / {788 return 301 https://$host$request_uri;789 }790 location ^~ /.well-known/acme-challenge/ {791 root /var/lib/acme/acme-challenge;792 auth_basic off;793 auth_request off;794 }795 }796 server {797 listen [::1]:443 quic;798 listen [::1]:443 ssl;799 listen 10.208.0.9:443 quic;800 listen 10.208.0.9:443 ssl;801 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;802 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;803 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;804 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;805 listen 0.0.0.0:443 quic;806 listen 0.0.0.0:443 ssl;807 server_name mq.mulatta.io;808 http2 on;809 http3 on;810 http3_hq off;811 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;812 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;813 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;814 location ^~ /.well-known/acme-challenge/ {815 root /var/lib/acme/acme-challenge;816 auth_basic off;817 auth_request off;818 }819 location / {820 proxy_pass http://127.0.0.1:18980;821 proxy_set_header Host $host;822 proxy_set_header X-Real-IP $remote_addr;823 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;824 proxy_set_header X-Forwarded-Proto $scheme;825 }826 }827 server {828 listen 10.208.0.9:80;829 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;830 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;831 listen 0.0.0.0:80;832 server_name mta-sts.mulatta.io;833 location / {834 return 301 https://$host$request_uri;835 }836 location ^~ /.well-known/acme-challenge/ {837 root /var/lib/acme/acme-challenge;838 auth_basic off;839 auth_request off;840 }841 }842 server {843 listen [::1]:443 quic;844 listen [::1]:443 ssl;845 listen 10.208.0.9:443 quic;846 listen 10.208.0.9:443 ssl;847 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;848 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;849 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;850 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;851 listen 0.0.0.0:443 quic;852 listen 0.0.0.0:443 ssl;853 server_name mta-sts.mulatta.io;854 http2 on;855 http3 on;856 http3_hq off;857 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;858 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;859 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;860 location ^~ /.well-known/acme-challenge/ {861 root /var/lib/acme/acme-challenge;862 auth_basic off;863 auth_request off;864 }865 location =/.well-known/mta-sts.txt {866 alias /nix/store/l3967zi6vf1mx48qldwfyzaklmycj6l0-mta-sts.txt;867 }868 }869 server {870 listen 10.208.0.9:80;871 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;872 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;873 listen 0.0.0.0:80;874 server_name mulatta.io;875 location / {876 return 301 https://$host$request_uri;877 }878 location ^~ /.well-known/acme-challenge/ {879 root /var/lib/acme/acme-challenge;880 auth_basic off;881 auth_request off;882 }883 }884 server {885 listen [::1]:443 quic;886 listen [::1]:443 ssl;887 listen 10.208.0.9:443 quic;888 listen 10.208.0.9:443 ssl;889 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;890 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;891 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;892 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;893 listen 0.0.0.0:443 quic;894 listen 0.0.0.0:443 ssl;895 server_name mulatta.io;896 http2 on;897 http3 on;898 http3_hq off;899 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;900 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;901 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;902 location ^~ /.well-known/acme-challenge/ {903 root /var/lib/acme/acme-challenge;904 auth_basic off;905 auth_request off;906 }907 location / {908 return 404;909 }910 location = /.well-known/nostr.json {911 alias /nix/store/hcp5r1cjnxif7afz86wb2xkd17jp9pd4-nostr.json;912 add_header Access-Control-Allow-Origin "*" always;913 add_header Cache-Control "public, max-age=3600";914 default_type application/json;915 }916 location = /.well-known/security.txt {917 alias /nix/store/si5gb1xwag27pbfagpw946nnbc7fwgfy-security.txt;918 default_type "text/plain; charset=utf-8";919 }920 location ^~ /.well-known/openpgpkey/ {921 alias /nix/store/dn4aksj980bfb15b1jaxsijqzzzg36vp-openpgpkey/;922 default_type "application/octet-stream";923 }924 }925 server {926 listen 10.208.0.9:80;927 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;928 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;929 listen 0.0.0.0:80;930 server_name n8n-api.mulatta.io;931 location / {932 return 301 https://$host$request_uri;933 }934 location ^~ /.well-known/acme-challenge/ {935 root /var/lib/acme/acme-challenge;936 auth_basic off;937 auth_request off;938 }939 }940 server {941 listen [::1]:443 quic;942 listen [::1]:443 ssl;943 listen 10.208.0.9:443 quic;944 listen 10.208.0.9:443 ssl;945 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;946 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;947 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;948 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;949 listen 0.0.0.0:443 quic;950 listen 0.0.0.0:443 ssl;951 server_name n8n-api.mulatta.io;952 http2 on;953 http3 on;954 http3_hq off;955 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;956 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;957 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;958 location ^~ /.well-known/acme-challenge/ {959 root /var/lib/acme/acme-challenge;960 auth_basic off;961 auth_request off;962 }963 location / {964 return 404;965 }966 location ~ ^/(webhook(-test)?|healthz) {967 proxy_pass http://malt.n:5678;968 proxy_http_version 1.1;969 proxy_set_header Upgrade $http_upgrade;970 proxy_set_header Connection $connection_upgrade;971 # SECURITY: Prevent header injection - clear all auth headers972 proxy_set_header X-Email "";973 proxy_set_header X-Auth-Request-Email "";974 proxy_set_header X-Auth-Request-User "";975 proxy_set_header X-Access-Token "";976 client_max_body_size 50M;977 proxy_read_timeout 3600s;978 proxy_send_timeout 3600s;979 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;980 }981 add_header X-Frame-Options "DENY" always;982 add_header X-Content-Type-Options "nosniff" always;983 add_header Referrer-Policy "strict-origin-when-cross-origin" always;984 }985 server {986 listen 10.208.0.9:80;987 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;988 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;989 listen 0.0.0.0:80;990 server_name n8n.mulatta.io;991 location / {992 return 301 https://$host$request_uri;993 }994 location ^~ /.well-known/acme-challenge/ {995 root /var/lib/acme/acme-challenge;996 auth_basic off;997 auth_request off;998 }999 }1000 server {1001 listen [::1]:443 quic;1002 listen [::1]:443 ssl;1003 listen 10.208.0.9:443 quic;1004 listen 10.208.0.9:443 ssl;1005 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;1006 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;1007 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;1008 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;1009 listen 0.0.0.0:443 quic;1010 listen 0.0.0.0:443 ssl;1011 server_name n8n.mulatta.io;1012 http2 on;1013 http3 on;1014 http3_hq off;1015 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;1016 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;1017 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;1018 location ^~ /.well-known/acme-challenge/ {1019 root /var/lib/acme/acme-challenge;1020 auth_basic off;1021 auth_request off;1022 }1023 location / {1024 proxy_pass http://127.0.0.1:4180;1025 proxy_http_version 1.1;1026 proxy_set_header Upgrade $http_upgrade;1027 proxy_set_header Connection $connection_upgrade;1028 client_max_body_size 50M;1029 proxy_read_timeout 3600s;1030 proxy_send_timeout 3600s;1031 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;1032 }1033 add_header X-Frame-Options "DENY" always;1034 add_header X-Content-Type-Options "nosniff" always;1035 add_header Referrer-Policy "strict-origin-when-cross-origin" always;1036 }1037 server {1038 listen 10.208.0.9:80;1039 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;1040 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;1041 listen 0.0.0.0:80;1042 server_name niks3.mulatta.io;1043 location / {1044 return 301 https://$host$request_uri;1045 }1046 location ^~ /.well-known/acme-challenge/ {1047 root /var/lib/acme/acme-challenge;1048 auth_basic off;1049 auth_request off;1050 }1051 }1052 server {1053 listen [::1]:443 quic;1054 listen [::1]:443 ssl;1055 listen 10.208.0.9:443 quic;1056 listen 10.208.0.9:443 ssl;1057 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;1058 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;1059 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;1060 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;1061 listen 0.0.0.0:443 quic;1062 listen 0.0.0.0:443 ssl;1063 server_name niks3.mulatta.io;1064 http2 on;1065 http3 on;1066 http3_hq off;1067 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;1068 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;1069 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;1070 location ^~ /.well-known/acme-challenge/ {1071 root /var/lib/acme/acme-challenge;1072 auth_basic off;1073 auth_request off;1074 }1075 location / {1076 proxy_pass http://127.0.0.1:5751;1077 proxy_connect_timeout 300s;1078 proxy_send_timeout 300s;1079 proxy_read_timeout 300s;1080 proxy_buffering off;1081 proxy_request_buffering off;1082 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;1083 }1084 }1085 server {1086 listen 10.208.0.9:80;1087 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;1088 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;1089 listen 0.0.0.0:80;1090 server_name ntfy.mulatta.io;1091 location / {1092 return 301 https://$host$request_uri;1093 }1094 location ^~ /.well-known/acme-challenge/ {1095 root /var/lib/acme/acme-challenge;1096 auth_basic off;1097 auth_request off;1098 }1099 }1100 server {1101 listen [::1]:443 quic;1102 listen [::1]:443 ssl;1103 listen 10.208.0.9:443 quic;1104 listen 10.208.0.9:443 ssl;1105 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;1106 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;1107 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;1108 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;1109 listen 0.0.0.0:443 quic;1110 listen 0.0.0.0:443 ssl;1111 server_name ntfy.mulatta.io;1112 http2 on;1113 http3 on;1114 http3_hq off;1115 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;1116 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;1117 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;1118 location ^~ /.well-known/acme-challenge/ {1119 root /var/lib/acme/acme-challenge;1120 auth_basic off;1121 auth_request off;1122 }1123 location / {1124 proxy_pass http://127.0.0.1:2586;1125 proxy_http_version 1.1;1126 proxy_set_header Upgrade $http_upgrade;1127 proxy_set_header Connection $connection_upgrade;1128 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;1129 }1130 add_header X-Frame-Options "DENY" always;1131 add_header X-Content-Type-Options "nosniff" always;1132 add_header Referrer-Policy "strict-origin-when-cross-origin" always;1133 }1134 server {1135 listen 10.208.0.9:80;1136 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;1137 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;1138 listen 0.0.0.0:80;1139 server_name paperless-api.mulatta.io;1140 location / {1141 return 301 https://$host$request_uri;1142 }1143 location ^~ /.well-known/acme-challenge/ {1144 root /var/lib/acme/acme-challenge;1145 auth_basic off;1146 auth_request off;1147 }1148 }1149 server {1150 listen [::1]:443 quic;1151 listen [::1]:443 ssl;1152 listen 10.208.0.9:443 quic;1153 listen 10.208.0.9:443 ssl;1154 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;1155 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;1156 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;1157 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;1158 listen 0.0.0.0:443 quic;1159 listen 0.0.0.0:443 ssl;1160 server_name paperless-api.mulatta.io;1161 http2 on;1162 http3 on;1163 http3_hq off;1164 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;1165 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;1166 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;1167 location ^~ /.well-known/acme-challenge/ {1168 root /var/lib/acme/acme-challenge;1169 auth_basic off;1170 auth_request off;1171 }1172 location / {1173 return 404;1174 }1175 location ~ ^/api/ {1176 proxy_pass http://malt.n:28981;1177 proxy_http_version 1.1;1178 proxy_set_header Upgrade $http_upgrade;1179 proxy_set_header Connection $connection_upgrade;1180 # SECURITY: prevent auth header injection from sibling SSO setups.1181 proxy_set_header X-Email "";1182 proxy_set_header X-Auth-Request-Email "";1183 proxy_set_header X-Auth-Request-User "";1184 proxy_set_header X-Access-Token "";1185 proxy_set_header Remote-User "";1186 proxy_set_header Remote-Email "";1187 proxy_read_timeout 3600s;1188 proxy_send_timeout 3600s;1189 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;1190 }1191 add_header X-Frame-Options "DENY" always;1192 add_header X-Content-Type-Options "nosniff" always;1193 add_header Referrer-Policy "strict-origin-when-cross-origin" always;1194 if ($block_dotted) {1195 return 404;1196 }1197 client_max_body_size 256M;1198 }1199 server {1200 listen 10.208.0.9:80;1201 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;1202 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;1203 listen 0.0.0.0:80;1204 server_name paperless.mulatta.io;1205 location / {1206 return 301 https://$host$request_uri;1207 }1208 location ^~ /.well-known/acme-challenge/ {1209 root /var/lib/acme/acme-challenge;1210 auth_basic off;1211 auth_request off;1212 }1213 }1214 server {1215 listen [::1]:443 quic;1216 listen [::1]:443 ssl;1217 listen 10.208.0.9:443 quic;1218 listen 10.208.0.9:443 ssl;1219 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;1220 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;1221 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;1222 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;1223 listen 0.0.0.0:443 quic;1224 listen 0.0.0.0:443 ssl;1225 server_name paperless.mulatta.io;1226 http2 on;1227 http3 on;1228 http3_hq off;1229 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;1230 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;1231 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;1232 location ^~ /.well-known/acme-challenge/ {1233 root /var/lib/acme/acme-challenge;1234 auth_basic off;1235 auth_request off;1236 }1237 location / {1238 proxy_pass http://malt.n:28981;1239 proxy_http_version 1.1;1240 proxy_set_header Upgrade $http_upgrade;1241 proxy_set_header Connection $connection_upgrade;1242 proxy_read_timeout 3600s;1243 proxy_send_timeout 3600s;1244 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;1245 }1246 add_header X-Frame-Options "DENY" always;1247 add_header X-Content-Type-Options "nosniff" always;1248 add_header Referrer-Policy "strict-origin-when-cross-origin" always;1249 if ($block_dotted) {1250 return 404;1251 }1252 client_max_body_size 256M;1253 }1254 server {1255 listen 10.208.0.9:80;1256 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;1257 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;1258 listen 0.0.0.0:80;1259 server_name rad.mulatta.io;1260 location / {1261 return 301 https://$host$request_uri;1262 }1263 location ^~ /.well-known/acme-challenge/ {1264 root /var/lib/acme/acme-challenge;1265 auth_basic off;1266 auth_request off;1267 }1268 }1269 server {1270 listen [::1]:443 quic;1271 listen [::1]:443 ssl;1272 listen 10.208.0.9:443 quic;1273 listen 10.208.0.9:443 ssl;1274 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;1275 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;1276 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;1277 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;1278 listen 0.0.0.0:443 quic;1279 listen 0.0.0.0:443 ssl;1280 server_name rad.mulatta.io;1281 http2 on;1282 http3 on;1283 http3_hq off;1284 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;1285 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;1286 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;1287 root /nix/store/cfzffj5cyx581g4c8jrpkd5jyhns9xjs-radicle-explorer-0-unstable-2026-07-21;1288 location ^~ /.well-known/acme-challenge/ {1289 root /var/lib/acme/acme-challenge;1290 auth_basic off;1291 auth_request off;1292 }1293 location / {1294 try_files $uri $uri/ /index.html;1295 add_header Cache-Control "public, max-age=3600";1296 }1297 location /api/ {1298 proxy_pass http://127.0.0.1:8889;1299 proxy_http_version 1.1;1300 proxy_set_header Upgrade $http_upgrade;1301 proxy_set_header Connection $connection_upgrade;1302 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;1303 }1304 add_header X-Frame-Options "DENY" always;1305 add_header X-Content-Type-Options "nosniff" always;1306 add_header Referrer-Policy "strict-origin-when-cross-origin" always;1307 }1308 server {1309 listen 10.208.0.9:80;1310 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;1311 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;1312 listen 0.0.0.0:80;1313 server_name radicle-mirror.mulatta.io;1314 location / {1315 return 301 https://$host$request_uri;1316 }1317 location ^~ /.well-known/acme-challenge/ {1318 root /var/lib/acme/acme-challenge;1319 auth_basic off;1320 auth_request off;1321 }1322 }1323 server {1324 listen [::1]:443 quic;1325 listen [::1]:443 ssl;1326 listen 10.208.0.9:443 quic;1327 listen 10.208.0.9:443 ssl;1328 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;1329 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;1330 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;1331 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;1332 listen 0.0.0.0:443 quic;1333 listen 0.0.0.0:443 ssl;1334 server_name radicle-mirror.mulatta.io;1335 http2 on;1336 http3 on;1337 http3_hq off;1338 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;1339 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;1340 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;1341 location ^~ /.well-known/acme-challenge/ {1342 root /var/lib/acme/acme-challenge;1343 auth_basic off;1344 auth_request off;1345 }1346 location / {1347 return 404;1348 }1349 location = /github {1350 proxy_pass http://127.0.0.1:4128;1351 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;1352 }1353 }1354 server {1355 listen 10.208.0.9:80;1356 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;1357 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;1358 listen 0.0.0.0:80;1359 server_name relay.mulatta.io;1360 location / {1361 return 301 https://$host$request_uri;1362 }1363 location ^~ /.well-known/acme-challenge/ {1364 root /var/lib/acme/acme-challenge;1365 auth_basic off;1366 auth_request off;1367 }1368 }1369 server {1370 listen [::1]:443 quic;1371 listen [::1]:443 ssl;1372 listen 10.208.0.9:443 quic;1373 listen 10.208.0.9:443 ssl;1374 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;1375 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;1376 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;1377 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;1378 listen 0.0.0.0:443 quic;1379 listen 0.0.0.0:443 ssl;1380 server_name relay.mulatta.io;1381 http2 on;1382 http3 on;1383 http3_hq off;1384 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;1385 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;1386 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;1387 location ^~ /.well-known/acme-challenge/ {1388 root /var/lib/acme/acme-challenge;1389 auth_basic off;1390 auth_request off;1391 }1392 location / {1393 proxy_pass http://127.0.0.1:7777;1394 proxy_http_version 1.1;1395 proxy_set_header Upgrade $http_upgrade;1396 proxy_set_header Connection $connection_upgrade;1397 proxy_set_header Host $host;1398 proxy_set_header X-Real-IP $remote_addr;1399 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;1400 proxy_set_header X-Forwarded-Proto $scheme;1401 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;1402 }1403 location = /.well-known/security.txt {1404 return 308 https://mulatta.io/.well-known/security.txt;1405 }1406 location ~ ^/.well-known/ {1407 return 404;1408 }1409 }1410 server {1411 listen 10.208.0.9:80;1412 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;1413 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;1414 listen 0.0.0.0:80;1415 server_name restate-api.mulatta.io;1416 location / {1417 return 301 https://$host$request_uri;1418 }1419 location ^~ /.well-known/acme-challenge/ {1420 root /var/lib/acme/acme-challenge;1421 auth_basic off;1422 auth_request off;1423 }1424 }1425 server {1426 listen [::1]:443 quic;1427 listen [::1]:443 ssl;1428 listen 10.208.0.9:443 quic;1429 listen 10.208.0.9:443 ssl;1430 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;1431 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;1432 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;1433 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;1434 listen 0.0.0.0:443 quic;1435 listen 0.0.0.0:443 ssl;1436 server_name restate-api.mulatta.io;1437 http2 on;1438 http3 on;1439 http3_hq off;1440 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;1441 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;1442 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;1443 location ^~ /.well-known/acme-challenge/ {1444 root /var/lib/acme/acme-challenge;1445 auth_basic off;1446 auth_request off;1447 }1448 location / {1449 return 404;1450 }1451 add_header X-Frame-Options "DENY" always;1452 add_header X-Content-Type-Options "nosniff" always;1453 add_header Referrer-Policy "strict-origin-when-cross-origin" always;1454 }1455 server {1456 listen 10.208.0.9:80;1457 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;1458 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;1459 listen 0.0.0.0:80;1460 server_name restate.mulatta.io;1461 location / {1462 return 301 https://$host$request_uri;1463 }1464 location ^~ /.well-known/acme-challenge/ {1465 root /var/lib/acme/acme-challenge;1466 auth_basic off;1467 auth_request off;1468 }1469 }1470 server {1471 listen [::1]:443 quic;1472 listen [::1]:443 ssl;1473 listen 10.208.0.9:443 quic;1474 listen 10.208.0.9:443 ssl;1475 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;1476 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;1477 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;1478 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;1479 listen 0.0.0.0:443 quic;1480 listen 0.0.0.0:443 ssl;1481 server_name restate.mulatta.io;1482 http2 on;1483 http3 on;1484 http3_hq off;1485 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;1486 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;1487 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;1488 location ^~ /.well-known/acme-challenge/ {1489 root /var/lib/acme/acme-challenge;1490 auth_basic off;1491 auth_request off;1492 }1493 location / {1494 proxy_pass http://127.0.0.1:4181;1495 proxy_http_version 1.1;1496 proxy_set_header Upgrade $http_upgrade;1497 proxy_set_header Connection $connection_upgrade;1498 client_max_body_size 50M;1499 proxy_read_timeout 3600s;1500 proxy_send_timeout 3600s;1501 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;1502 }1503 add_header X-Frame-Options "DENY" always;1504 add_header X-Content-Type-Options "nosniff" always;1505 add_header Referrer-Policy "strict-origin-when-cross-origin" always;1506 }1507 server {1508 listen 10.208.0.9:80;1509 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;1510 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;1511 listen 0.0.0.0:80;1512 server_name rss.mulatta.io;1513 location / {1514 return 301 https://$host$request_uri;1515 }1516 location ^~ /.well-known/acme-challenge/ {1517 root /var/lib/acme/acme-challenge;1518 auth_basic off;1519 auth_request off;1520 }1521 }1522 server {1523 listen [::1]:443 quic;1524 listen [::1]:443 ssl;1525 listen 10.208.0.9:443 quic;1526 listen 10.208.0.9:443 ssl;1527 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;1528 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;1529 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;1530 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;1531 listen 0.0.0.0:443 quic;1532 listen 0.0.0.0:443 ssl;1533 server_name rss.mulatta.io;1534 http2 on;1535 http3 on;1536 http3_hq off;1537 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;1538 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;1539 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;1540 location ^~ /.well-known/acme-challenge/ {1541 root /var/lib/acme/acme-challenge;1542 auth_basic off;1543 auth_request off;1544 }1545 location / {1546 proxy_pass http://malt.n:8080;1547 proxy_http_version 1.1;1548 proxy_set_header Upgrade $http_upgrade;1549 proxy_set_header Connection $connection_upgrade;1550 proxy_hide_header Strict-Transport-Security;1551 proxy_read_timeout 300s;1552 proxy_send_timeout 300s;1553 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;1554 }1555 if ($block_dotted) {1556 return 404;1557 }1558 }1559 server {1560 listen 10.208.0.9:80;1561 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;1562 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;1563 listen 0.0.0.0:80;1564 server_name stalwart.mulatta.io;1565 location / {1566 return 301 https://$host$request_uri;1567 }1568 location ^~ /.well-known/acme-challenge/ {1569 root /var/lib/acme/acme-challenge;1570 auth_basic off;1571 auth_request off;1572 }1573 }1574 server {1575 listen [::1]:443 quic;1576 listen [::1]:443 ssl;1577 listen 10.208.0.9:443 quic;1578 listen 10.208.0.9:443 ssl;1579 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;1580 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;1581 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;1582 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;1583 listen 0.0.0.0:443 quic;1584 listen 0.0.0.0:443 ssl;1585 server_name stalwart.mulatta.io;1586 http2 on;1587 http3 on;1588 http3_hq off;1589 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;1590 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;1591 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;1592 location ^~ /.well-known/acme-challenge/ {1593 root /var/lib/acme/acme-challenge;1594 auth_basic off;1595 auth_request off;1596 }1597 location / {1598 proxy_pass http://127.0.0.1:8080;1599 proxy_http_version 1.1;1600 proxy_set_header Upgrade $http_upgrade;1601 proxy_set_header Connection $connection_upgrade;1602 proxy_set_header Host $host;1603 proxy_set_header X-Real-IP $remote_addr;1604 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;1605 proxy_set_header X-Forwarded-Proto $scheme;1606 client_max_body_size 50M;1607 proxy_read_timeout 3600s;1608 proxy_send_timeout 3600s;1609 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;1610 }1611 add_header X-Frame-Options "DENY" always;1612 add_header X-Content-Type-Options "nosniff" always;1613 add_header Referrer-Policy "strict-origin-when-cross-origin" always;1614 }1615 server {1616 listen 10.208.0.9:80;1617 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;1618 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;1619 listen 0.0.0.0:80;1620 server_name tasks.mulatta.io;1621 location / {1622 return 301 https://$host$request_uri;1623 }1624 location ^~ /.well-known/acme-challenge/ {1625 root /var/lib/acme/acme-challenge;1626 auth_basic off;1627 auth_request off;1628 }1629 }1630 server {1631 listen [::1]:443 quic;1632 listen [::1]:443 ssl;1633 listen 10.208.0.9:443 quic;1634 listen 10.208.0.9:443 ssl;1635 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;1636 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;1637 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;1638 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;1639 listen 0.0.0.0:443 quic;1640 listen 0.0.0.0:443 ssl;1641 server_name tasks.mulatta.io;1642 http2 on;1643 http3 on;1644 http3_hq off;1645 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;1646 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;1647 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;1648 location ^~ /.well-known/acme-challenge/ {1649 root /var/lib/acme/acme-challenge;1650 auth_basic off;1651 auth_request off;1652 }1653 location / {1654 proxy_pass http://malt.n:3456;1655 proxy_http_version 1.1;1656 proxy_set_header Upgrade $http_upgrade;1657 proxy_set_header Connection $connection_upgrade;1658 client_max_body_size 50M;1659 proxy_read_timeout 120s;1660 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;1661 }1662 location = /.well-known/caldav {1663 return 301 $scheme://$host/dav;1664 }1665 location = /.well-known/security.txt {1666 return 308 https://mulatta.io/.well-known/security.txt;1667 }1668 location ~ ^/.well-known/ {1669 return 404;1670 }1671 add_header X-Frame-Options "DENY" always;1672 add_header X-Content-Type-Options "nosniff" always;1673 add_header Referrer-Policy "strict-origin-when-cross-origin" always;1674 if ($block_dotted) {1675 return 404;1676 }1677 }1678 server {1679 listen 10.208.0.9:80;1680 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;1681 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;1682 listen 0.0.0.0:80;1683 server_name upterm.mulatta.io;1684 location / {1685 return 301 https://$host$request_uri;1686 }1687 location ^~ /.well-known/acme-challenge/ {1688 root /var/lib/acme/acme-challenge;1689 auth_basic off;1690 auth_request off;1691 }1692 }1693 server {1694 listen [::1]:443 quic;1695 listen [::1]:443 ssl;1696 listen 10.208.0.9:443 quic;1697 listen 10.208.0.9:443 ssl;1698 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;1699 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;1700 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;1701 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;1702 listen 0.0.0.0:443 quic;1703 listen 0.0.0.0:443 ssl;1704 server_name upterm.mulatta.io;1705 http2 on;1706 http3 on;1707 http3_hq off;1708 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;1709 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;1710 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;1711 location ^~ /.well-known/acme-challenge/ {1712 root /var/lib/acme/acme-challenge;1713 auth_basic off;1714 auth_request off;1715 }1716 location / {1717 root /nix/store/abmi6mhjzj206kcby0a4z4sqbw2s2vs2-uptermd;1718 }1719 add_header X-Frame-Options "DENY" always;1720 add_header X-Content-Type-Options "nosniff" always;1721 add_header Referrer-Policy "strict-origin-when-cross-origin" always;1722 }1723 server {1724 listen 10.208.0.9:80;1725 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;1726 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;1727 listen 0.0.0.0:80;1728 server_name vaultwarden.mulatta.io;1729 location / {1730 return 301 https://$host$request_uri;1731 }1732 location ^~ /.well-known/acme-challenge/ {1733 root /var/lib/acme/acme-challenge;1734 auth_basic off;1735 auth_request off;1736 }1737 }1738 server {1739 listen [::1]:443 quic;1740 listen [::1]:443 ssl;1741 listen 10.208.0.9:443 quic;1742 listen 10.208.0.9:443 ssl;1743 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;1744 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;1745 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;1746 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;1747 listen 0.0.0.0:443 quic;1748 listen 0.0.0.0:443 ssl;1749 server_name vaultwarden.mulatta.io;1750 http2 on;1751 http3 on;1752 http3_hq off;1753 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;1754 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;1755 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;1756 location ^~ /.well-known/acme-challenge/ {1757 root /var/lib/acme/acme-challenge;1758 auth_basic off;1759 auth_request off;1760 }1761 location / {1762 proxy_pass http://127.0.0.1:8222;1763 proxy_http_version 1.1;1764 proxy_set_header Upgrade $http_upgrade;1765 proxy_set_header Connection $connection_upgrade;1766 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;1767 }1768 client_max_body_size 128M;1769 }1770 server {1771 listen 10.208.0.9:80;1772 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;1773 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;1774 listen 0.0.0.0:80;1775 server_name video.mulatta.io;1776 location / {1777 return 301 https://$host$request_uri;1778 }1779 location ^~ /.well-known/acme-challenge/ {1780 root /var/lib/acme/acme-challenge;1781 auth_basic off;1782 auth_request off;1783 }1784 }1785 server {1786 listen [::1]:443 quic;1787 listen [::1]:443 ssl;1788 listen 10.208.0.9:443 quic;1789 listen 10.208.0.9:443 ssl;1790 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;1791 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;1792 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;1793 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;1794 listen 0.0.0.0:443 quic;1795 listen 0.0.0.0:443 ssl;1796 server_name video.mulatta.io;1797 http2 on;1798 http3 on;1799 http3_hq off;1800 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;1801 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;1802 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;1803 location ^~ /.well-known/acme-challenge/ {1804 root /var/lib/acme/acme-challenge;1805 auth_basic off;1806 auth_request off;1807 }1808 location / {1809 proxy_pass http://malt.n:8096;1810 proxy_http_version 1.1;1811 proxy_set_header Upgrade $http_upgrade;1812 proxy_set_header Connection $connection_upgrade;1813 proxy_buffering off;1814 proxy_request_buffering off;1815 proxy_read_timeout 3600s;1816 proxy_send_timeout 3600s;1817 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;1818 }1819 add_header X-Frame-Options "SAMEORIGIN" always;1820 add_header X-Content-Type-Options "nosniff" always;1821 add_header Referrer-Policy "strict-origin-when-cross-origin" always;1822 if ($block_dotted) {1823 return 404;1824 }1825 client_max_body_size 20G;1826 }1827 server {1828 listen 10.208.0.9:80;1829 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;1830 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;1831 listen 0.0.0.0:80;1832 server_name webmail.mulatta.io;1833 location / {1834 return 301 https://$host$request_uri;1835 }1836 location ^~ /.well-known/acme-challenge/ {1837 root /var/lib/acme/acme-challenge;1838 auth_basic off;1839 auth_request off;1840 }1841 }1842 server {1843 listen [::1]:443 quic;1844 listen [::1]:443 ssl;1845 listen 10.208.0.9:443 quic;1846 listen 10.208.0.9:443 ssl;1847 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;1848 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;1849 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;1850 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;1851 listen 0.0.0.0:443 quic;1852 listen 0.0.0.0:443 ssl;1853 server_name webmail.mulatta.io;1854 http2 on;1855 http3 on;1856 http3_hq off;1857 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;1858 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;1859 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;1860 location / {1861 return 301 https://mail.mulatta.io$request_uri;1862 }1863 location ^~ /.well-known/acme-challenge/ {1864 root /var/lib/acme/acme-challenge;1865 auth_basic off;1866 auth_request off;1867 }1868 }1869 server {1870 listen 10.208.0.9:80;1871 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;1872 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;1873 listen 0.0.0.0:80;1874 server_name www.mulatta.io;1875 location / {1876 return 301 https://$host$request_uri;1877 }1878 location ^~ /.well-known/acme-challenge/ {1879 root /var/lib/acme/acme-challenge;1880 auth_basic off;1881 auth_request off;1882 }1883 }1884 server {1885 listen [::1]:443 quic;1886 listen [::1]:443 ssl;1887 listen 10.208.0.9:443 quic;1888 listen 10.208.0.9:443 ssl;1889 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;1890 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;1891 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;1892 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;1893 listen 0.0.0.0:443 quic;1894 listen 0.0.0.0:443 ssl;1895 server_name www.mulatta.io;1896 http2 on;1897 http3 on;1898 http3_hq off;1899 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;1900 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;1901 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;1902 location / {1903 return 301 https://mulatta.io$request_uri;1904 }1905 location ^~ /.well-known/acme-challenge/ {1906 root /var/lib/acme/acme-challenge;1907 auth_basic off;1908 auth_request off;1909 }1910 }1911 server {1912 listen 10.208.0.9:80;1913 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:80;1914 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:80;1915 listen 0.0.0.0:80;1916 server_name zotero.mulatta.io;1917 location / {1918 return 301 https://$host$request_uri;1919 }1920 location ^~ /.well-known/acme-challenge/ {1921 root /var/lib/acme/acme-challenge;1922 auth_basic off;1923 auth_request off;1924 }1925 }1926 server {1927 listen [::1]:443 quic;1928 listen [::1]:443 ssl;1929 listen 10.208.0.9:443 quic;1930 listen 10.208.0.9:443 ssl;1931 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 quic;1932 listen [fdec:ca5f:90ad:6fdd:8e76:62fc:c0f7:297d]:443 ssl;1933 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 quic;1934 listen [2401:c080:1c01:382:5400:6ff:fe9c:ad9d]:443 ssl;1935 listen 0.0.0.0:443 quic;1936 listen 0.0.0.0:443 ssl;1937 server_name zotero.mulatta.io;1938 http2 on;1939 http3 on;1940 http3_hq off;1941 ssl_certificate /var/lib/acme/mulatta.io/fullchain.pem;1942 ssl_certificate_key /var/lib/acme/mulatta.io/key.pem;1943 ssl_trusted_certificate /var/lib/acme/mulatta.io/chain.pem;1944 location ^~ /.well-known/acme-challenge/ {1945 root /var/lib/acme/acme-challenge;1946 auth_basic off;1947 auth_request off;1948 }1949 location / {1950 proxy_pass http://127.0.0.1:8189;1951 proxy_http_version 1.1;1952 proxy_set_header Upgrade $http_upgrade;1953 proxy_set_header Connection $connection_upgrade;1954 client_max_body_size 512M;1955 proxy_request_buffering off;1956 proxy_read_timeout 3600s;1957 proxy_send_timeout 3600s;1958 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;1959 }1960 location /login {1961 proxy_pass http://127.0.0.1:4182;1962 proxy_http_version 1.1;1963 proxy_set_header Upgrade $http_upgrade;1964 proxy_set_header Connection $connection_upgrade;1965 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;1966 }1967 location /oauth2/ {1968 proxy_pass http://127.0.0.1:4182;1969 include /nix/store/dc8b1rp3ckwly51jgjyj3hx3avvmzy2k-nginx-recommended-proxy_set_header-headers.conf;1970 }1971 add_header X-Frame-Options "DENY" always;1972 add_header X-Content-Type-Options "nosniff" always;1973 add_header Referrer-Policy "strict-origin-when-cross-origin" always;1974 }1975 proxy_headers_hash_max_size 1024;1976 proxy_headers_hash_bucket_size 128;1977 map $request_uri $block_dotted {1978 default 0;1979 "~^/\.well-known/" 0;1980 "~^/\." 1;1981 }1982 limit_req_zone $binary_remote_addr zone=blossom_upload:10m rate=2r/m;1983 limit_conn_zone $binary_remote_addr zone=blossom_conn:10m;1984}