mirror of
https://github.com/NginxProxyManager/nginx-proxy-manager.git
synced 2026-11-10 12:28:28 +00:00
Jamie Curnow
fff2b0d097
($http_host) forwards the raw client Host header, including the port and any absolute-form URI mismatch, to every upstream and into the asset cache key
128 lines
4.0 KiB
Nginx Configuration File
128 lines
4.0 KiB
Nginx Configuration File
# run nginx in foreground
|
|
daemon off;
|
|
pid /run/nginx/nginx.pid;
|
|
user npm;
|
|
|
|
# Set number of worker processes automatically based on number of CPU cores.
|
|
worker_processes auto;
|
|
|
|
# Enables the use of JIT for regular expressions to speed-up their processing.
|
|
pcre_jit on;
|
|
|
|
error_log /data/logs/fallback_error.log warn;
|
|
|
|
# Includes files with directives to load dynamic modules.
|
|
include /etc/nginx/modules/*.conf;
|
|
|
|
# Custom
|
|
include /data/nginx/custom/root_top[.]conf;
|
|
|
|
events {
|
|
include /data/nginx/custom/events[.]conf;
|
|
}
|
|
|
|
http {
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
sendfile on;
|
|
server_tokens off;
|
|
tcp_nopush on;
|
|
tcp_nodelay on;
|
|
client_body_temp_path /tmp/nginx/body 1 2;
|
|
keepalive_timeout 90s;
|
|
proxy_connect_timeout 90s;
|
|
proxy_send_timeout 90s;
|
|
proxy_read_timeout 90s;
|
|
ssl_prefer_server_ciphers on;
|
|
gzip on;
|
|
proxy_ignore_client_abort off;
|
|
client_max_body_size 2000m;
|
|
server_names_hash_bucket_size 1024;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header X-Forwarded-Scheme $scheme;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header Accept-Encoding "";
|
|
proxy_cache off;
|
|
proxy_cache_path /var/lib/nginx/cache/public levels=1:2 keys_zone=public-cache:30m max_size=192m;
|
|
proxy_cache_path /var/lib/nginx/cache/private levels=1:2 keys_zone=private-cache:5m max_size=1024m;
|
|
|
|
# Log format and fallback log file
|
|
include /etc/nginx/conf.d/include/log-proxy[.]conf;
|
|
|
|
# Dynamically generated resolvers file
|
|
include /etc/nginx/conf.d/include/resolvers[.]conf;
|
|
|
|
# Forwarded Host: nginx's normalised $host (lowercased, taken from the request line for
|
|
# absolute-form requests) plus the client's port, so upstreams that compare Host with
|
|
# Origin/Referer on non-standard ports keep working. The port is only carried over when
|
|
# the Host header names the same host nginx routed on; otherwise (no Host, absolute-form
|
|
# URI naming a different host) it falls back to bare $host. Using $host rather than the
|
|
# raw header keeps case variants and mismatched Host values out of upstream requests and
|
|
# the asset cache key.
|
|
map "$host|$http_host" $forward_host {
|
|
"~*^(?<fwd_name>[^|]+)\|\k<fwd_name>(?<fwd_port>:[0-9]+)$" "$host$fwd_port";
|
|
default $host;
|
|
}
|
|
|
|
# Default upstream scheme
|
|
map $host $forward_scheme {
|
|
default http;
|
|
}
|
|
|
|
# Handle upstream X-Forwarded-Proto and X-Forwarded-Scheme header
|
|
map $http_x_forwarded_proto $x_forwarded_proto {
|
|
"http" "http";
|
|
"https" "https";
|
|
default $scheme;
|
|
}
|
|
map $http_x_forwarded_scheme $x_forwarded_scheme {
|
|
"http" "http";
|
|
"https" "https";
|
|
default $scheme;
|
|
}
|
|
|
|
# Real IP Determination
|
|
|
|
# Loopback: lets an NPM proxy host forwarding to 127.0.0.1 (e.g. the admin UI on :81)
|
|
# pass the real client IP through instead of every request appearing as 127.0.0.1
|
|
set_real_ip_from 127.0.0.1;
|
|
set_real_ip_from ::1;
|
|
# Local subnets:
|
|
set_real_ip_from 10.0.0.0/8;
|
|
set_real_ip_from 172.16.0.0/12; # Includes Docker subnet
|
|
set_real_ip_from 192.168.0.0/16;
|
|
# NPM generated CDN ip ranges:
|
|
include conf.d/include/ip_ranges[.]conf;
|
|
# always put the following 2 lines after ip subnets:
|
|
real_ip_header X-Real-IP;
|
|
real_ip_recursive on;
|
|
|
|
# Custom
|
|
include /data/nginx/custom/http_top[.]conf;
|
|
|
|
# Files generated by NPM
|
|
include /etc/nginx/conf.d/*.conf;
|
|
include /data/nginx/default_host/*.conf;
|
|
include /data/nginx/proxy_host/*.conf;
|
|
include /data/nginx/redirection_host/*.conf;
|
|
include /data/nginx/dead_host/*.conf;
|
|
include /data/nginx/temp/*.conf;
|
|
|
|
# Custom
|
|
include /data/nginx/custom/http[.]conf;
|
|
}
|
|
|
|
stream {
|
|
# Log format and fallback log file
|
|
include /etc/nginx/conf.d/include/log-stream[.]conf;
|
|
|
|
# Files generated by NPM
|
|
include /data/nginx/stream/*.conf;
|
|
|
|
# Custom
|
|
include /data/nginx/custom/stream[.]conf;
|
|
}
|
|
|
|
# Custom
|
|
include /data/nginx/custom/root[.]conf;
|