From ed78c6c3e35c964af9b92fdd7af4cd25a9a452c4 Mon Sep 17 00:00:00 2001 From: zino Date: Tue, 5 Dec 2023 18:46:06 +0100 Subject: [PATCH] m --- volumes/conf.d/code.zinomedia.de.conf | 32 +++++++++++++-------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/volumes/conf.d/code.zinomedia.de.conf b/volumes/conf.d/code.zinomedia.de.conf index c8dffb8..d4efb4d 100644 --- a/volumes/conf.d/code.zinomedia.de.conf +++ b/volumes/conf.d/code.zinomedia.de.conf @@ -14,12 +14,12 @@ server { ssl_certificate_key /etc/letsencrypt/live/code.zinomedia.de/privkey.pem; # SSL Optimizations - #ssl_protocols TLSv1.2 TLSv1.3; - #ssl_session_cache shared:SSL:10m; - #ssl_session_timeout 10m; - #ssl_prefer_server_ciphers on; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 10m; + ssl_prefer_server_ciphers on; - #add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; font-src 'self' data:;" always; # Vouch @@ -27,31 +27,31 @@ server { auth_request /validate; location = /validate { - #proxy_pass https://validate.vouch.armos.zinomedia.de; + proxy_pass https://validate.vouch.armos.zinomedia.de; # forward the /validate request to Vouch Proxy #proxy_pass http://127.0.0.1:9090/validate; # forward the /validate request to Vouch Proxy #proxy_pass http://vouch:9090/validate; - resolver 127.0.0.11; - set $upstream "http://vouch:9090"; - proxy_pass $upstream; + #resolver 127.0.0.11; + #set $upstream "http://vouch:9090"; + #proxy_pass $upstream; # be sure to pass the original host header - proxy_set_header Host $http_host; + #proxy_set_header Host $http_host; # Vouch Proxy only acts on the request headers - proxy_pass_request_body off; - proxy_set_header Content-Length ""; + #proxy_pass_request_body off; + #proxy_set_header Content-Length ""; # optionally add X-Vouch-User as returned by Vouch Proxy along with the request - auth_request_set $auth_resp_x_vouch_user $upstream_http_x_vouch_user; + #auth_request_set $auth_resp_x_vouch_user $upstream_http_x_vouch_user; # these return values are used by the @error401 call - auth_request_set $auth_resp_jwt $upstream_http_x_vouch_jwt; - auth_request_set $auth_resp_err $upstream_http_x_vouch_err; - auth_request_set $auth_resp_failcount $upstream_http_x_vouch_failcount; + #auth_request_set $auth_resp_jwt $upstream_http_x_vouch_jwt; + #auth_request_set $auth_resp_err $upstream_http_x_vouch_err; + #auth_request_set $auth_resp_failcount $upstream_http_x_vouch_failcount; } # if validate returns `401 not authorized` then forward the request to the error401block