nginx: the configuration file /etc/nginx/nginx.conf syntax is ok nginx: configuration file /etc/nginx/nginx.conf test is successful # configuration file /etc/nginx/nginx.conf: # run nginx in foreground daemon off; pid /run/nginx/nginx.pid; user npm; # Set number of worker processes automatically based on number of CPU cores. worker_processes auto; # Enables the use of JIT for regular expressions to speed-up their pr ocessing. pcre_jit on; error_log /data/logs/fallback_error.log warn; # Includes files with directives to load dynamic modules. include /etc/nginx/modules/*.conf; events { include /data/nginx/custom/events[.]conf; } http { include /etc/nginx/mime.types; default_type application/octet-stream; sendfile on; server_tokens off; tcp_nopush on; tcp_nodelay on; client_body_temp_path /tmp/nginx/body 1 2; keepalive_timeout 90s; proxy_connect_timeout 90s; proxy_send_timeout 90s; proxy_read_timeout 90s; ssl_prefer_server_ciphers on; gzip on; proxy_ignore_client_abort off; client_max_body_size 2000m; server_names_hash_bucket_size 1024; proxy_http_version 1.1; proxy_set_header X-Forwarded-Scheme $scheme; proxy_set_header X-Forwarded-For $proxy_add_x_fo rwarded_for; proxy_set_header Accept-Encoding ""; proxy_cache off; proxy_cache_path /var/lib/nginx/cache/public le vels=1:2 keys_zone=public-cache:30m max_size=192m; proxy_cache_path /var/lib/nginx/cache/private le vels=1:2 keys_zone=private-cache:5m max_size=1024m; log_format proxy '[$time_local] $upstream_cache_status $upstr eam_status $status - $request_method $scheme $host "$request_uri" [Cl ient $remote_addr] [Length $body_bytes_sent] [Gzip $gzip_ratio] [Sent -to $server] "$http_user_agent" "$http_referer"'; log_format standard '[$time_local] $status - $request_method $scheme $host "$request_uri" [Client $remote_addr] [Length $body_byte s_sent] [Gzip $gzip_ratio] "$http_user_agent" "$http_referer"'; access_log /data/logs/fallback_access.log proxy; # Dynamically generated resolvers file include /etc/nginx/conf.d/include/resolvers.conf; # Default upstream scheme map $host $forward_scheme { default http; } # Real IP Determination # Local subnets: set_real_ip_from 10.0.0.0/8; set_real_ip_from 172.16.0.0/12; # Includes Docker subnet set_real_ip_from 192.168.0.0/16; # NPM generated CDN ip ranges: include conf.d/include/ip_ranges.conf; # always put the following 2 lines after ip subnets: real_ip_header X-Real-IP; real_ip_recursive on; # Custom include /data/nginx/custom/http_top[.]conf; # Files generated by NPM include /etc/nginx/conf.d/*.conf; include /data/nginx/default_host/*.conf; include /data/nginx/proxy_host/*.conf; include /data/nginx/redirection_host/*.conf; include /data/nginx/dead_host/*.conf; include /data/nginx/temp/*.conf; # Custom include /data/nginx/custom/http[.]conf; } stream { # Files generated by NPM include /data/nginx/stream/*.conf; # Custom include /data/nginx/custom/stream[.]conf; } # Custom include /data/nginx/custom/root[.]conf; # configuration file /etc/nginx/mime.types: types { text/html html htm shtml; text/css css; text/xml xml; image/gif gif; image/jpeg jpeg jpg; application/javascript js; application/atom+xml atom; application/rss+xml rss; text/mathml mml; text/plain txt; text/vnd.sun.j2me.app-descriptor jad; text/vnd.wap.wml wml; text/x-component htc; image/png png; image/svg+xml svg svgz; image/tiff tif tiff; image/vnd.wap.wbmp wbmp; image/webp webp; image/x-icon ico; image/x-jng jng; image/x-ms-bmp bmp; font/woff woff; font/woff2 woff2; application/java-archive jar war ear; application/json json; application/mac-binhex40 hqx; application/msword doc; application/pdf pdf; application/postscript ps eps ai; application/rtf rtf; application/vnd.apple.mpegurl m3u8; application/vnd.google-earth.kml+xml kml; application/vnd.google-earth.kmz kmz; application/vnd.ms-excel xls; application/vnd.ms-fontobject eot; application/vnd.ms-powerpoint ppt; application/vnd.oasis.opendocument.graphics odg; application/vnd.oasis.opendocument.presentation odp; application/vnd.oasis.opendocument.spreadsheet ods; application/vnd.oasis.opendocument.text odt; application/vnd.openxmlformats-officedocument.presentationml.pres entation pptx; application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx; application/vnd.openxmlformats-officedocument.wordprocessingml.do cument docx; application/vnd.wap.wmlc wmlc; application/x-7z-compressed 7z; application/x-cocoa cco; application/x-java-archive-diff jardiff; application/x-java-jnlp-file jnlp; application/x-makeself run; application/x-perl pl pm; application/x-pilot prc pdb; application/x-rar-compressed rar; application/x-redhat-package-manager rpm; application/x-sea sea; application/x-shockwave-flash swf; application/x-stuffit sit; application/x-tcl tcl tk; application/x-x509-ca-cert der pem crt; application/x-xpinstall xpi; application/xhtml+xml xhtml; application/xspf+xml xspf; application/zip zip; application/octet-stream bin exe dll; application/octet-stream deb; application/octet-stream dmg; application/octet-stream iso img; application/octet-stream msi msp msm; audio/midi mid midi kar; audio/mpeg mp3; audio/ogg ogg; audio/x-m4a m4a; audio/x-realaudio ra; video/3gpp 3gpp 3gp; video/mp2t ts; video/mp4 mp4; video/mpeg mpeg mpg; video/quicktime mov; video/webm webm; video/x-flv flv; video/x-m4v m4v; video/x-mng mng; video/x-ms-asf asx asf; video/x-ms-wmv wmv; video/x-msvideo avi; } # configuration file /etc/nginx/conf.d/include/resolvers.conf: resolver 127.0.0.11 valid=10s; # configuration file /etc/nginx/conf.d/include/ip_ranges.conf: set_real_ip_from 120.52.22.96/27; set_real_ip_from 205.251.249.0/24; set_real_ip_from 180.163.57.128/26; set_real_ip_from 204.246.168.0/22; set_real_ip_from 111.13.171.128/26; set_real_ip_from 18.160.0.0/15; set_real_ip_from 205.251.252.0/23; set_real_ip_from 54.192.0.0/16; set_real_ip_from 204.246.173.0/24; set_real_ip_from 54.230.200.0/21; set_real_ip_from 120.253.240.192/26; set_real_ip_from 116.129.226.128/26; set_real_ip_from 130.176.0.0/17; set_real_ip_from 108.156.0.0/14; set_real_ip_from 99.86.0.0/16; set_real_ip_from 205.251.200.0/21; set_real_ip_from 13.32.0.0/15; set_real_ip_from 120.253.245.128/26; set_real_ip_from 13.224.0.0/14; set_real_ip_from 70.132.0.0/18; set_real_ip_from 15.158.0.0/16; set_real_ip_from 111.13.171.192/26; set_real_ip_from 13.249.0.0/16; set_real_ip_from 18.238.0.0/15; set_real_ip_from 18.244.0.0/15; set_real_ip_from 205.251.208.0/20; set_real_ip_from 65.9.128.0/18; set_real_ip_from 130.176.128.0/18; set_real_ip_from 58.254.138.0/25; set_real_ip_from 54.230.208.0/20; set_real_ip_from 3.160.0.0/14; set_real_ip_from 116.129.226.0/25; set_real_ip_from 52.222.128.0/17; set_real_ip_from 18.164.0.0/15; set_real_ip_from 111.13.185.32/27; set_real_ip_from 64.252.128.0/18; set_real_ip_from 205.251.254.0/24; set_real_ip_from 54.230.224.0/19; set_real_ip_from 71.152.0.0/17; set_real_ip_from 216.137.32.0/19; set_real_ip_from 204.246.172.0/24; set_real_ip_from 18.172.0.0/15; set_real_ip_from 120.52.39.128/27; set_real_ip_from 118.193.97.64/26; set_real_ip_from 18.154.0.0/15; set_real_ip_from 54.240.128.0/18; set_real_ip_from 205.251.250.0/23; set_real_ip_from 180.163.57.0/25; set_real_ip_from 52.46.0.0/18; set_real_ip_from 52.82.128.0/19; set_real_ip_from 54.230.0.0/17; set_real_ip_from 54.230.128.0/18; set_real_ip_from 54.239.128.0/18; set_real_ip_from 130.176.224.0/20; set_real_ip_from 36.103.232.128/26; set_real_ip_from 52.84.0.0/15; set_real_ip_from 143.204.0.0/16; set_real_ip_from 144.220.0.0/16; set_real_ip_from 120.52.153.192/26; set_real_ip_from 119.147.182.0/25; set_real_ip_from 120.232.236.0/25; set_real_ip_from 111.13.185.64/27; set_real_ip_from 3.164.0.0/18; set_real_ip_from 54.182.0.0/16; set_real_ip_from 58.254.138.128/26; set_real_ip_from 120.253.245.192/27; set_real_ip_from 54.239.192.0/19; set_real_ip_from 18.68.0.0/16; set_real_ip_from 18.64.0.0/14; set_real_ip_from 120.52.12.64/26; set_real_ip_from 99.84.0.0/16; set_real_ip_from 130.176.192.0/19; set_real_ip_from 52.124.128.0/17; set_real_ip_from 204.246.164.0/22; set_real_ip_from 13.35.0.0/16; set_real_ip_from 204.246.174.0/23; set_real_ip_from 3.172.0.0/18; set_real_ip_from 36.103.232.0/25; set_real_ip_from 119.147.182.128/26; set_real_ip_from 118.193.97.128/25; set_real_ip_from 120.232.236.128/26; set_real_ip_from 204.246.176.0/20; set_real_ip_from 65.8.0.0/16; set_real_ip_from 65.9.0.0/17; set_real_ip_from 108.138.0.0/15; set_real_ip_from 120.253.241.160/27; set_real_ip_from 64.252.64.0/18; set_real_ip_from 13.113.196.64/26; set_real_ip_from 13.113.203.0/24; set_real_ip_from 52.199.127.192/26; set_real_ip_from 13.124.199.0/24; set_real_ip_from 3.35.130.128/25; set_real_ip_from 52.78.247.128/26; set_real_ip_from 13.233.177.192/26; set_real_ip_from 15.207.13.128/25; set_real_ip_from 15.207.213.128/25; set_real_ip_from 52.66.194.128/26; set_real_ip_from 13.228.69.0/24; set_real_ip_from 52.220.191.0/26; set_real_ip_from 13.210.67.128/26; set_real_ip_from 13.54.63.128/26; set_real_ip_from 43.218.56.128/26; set_real_ip_from 43.218.56.192/26; set_real_ip_from 43.218.56.64/26; set_real_ip_from 43.218.71.0/26; set_real_ip_from 99.79.169.0/24; set_real_ip_from 18.192.142.0/23; set_real_ip_from 35.158.136.0/24; set_real_ip_from 52.57.254.0/24; set_real_ip_from 13.48.32.0/24; set_real_ip_from 18.200.212.0/23; set_real_ip_from 52.212.248.0/26; set_real_ip_from 3.10.17.128/25; set_real_ip_from 3.11.53.0/24; set_real_ip_from 52.56.127.0/25; set_real_ip_from 15.188.184.0/24; set_real_ip_from 52.47.139.0/24; set_real_ip_from 3.29.40.128/26; set_real_ip_from 3.29.40.192/26; set_real_ip_from 3.29.40.64/26; set_real_ip_from 3.29.57.0/26; set_real_ip_from 18.229.220.192/26; set_real_ip_from 54.233.255.128/26; set_real_ip_from 3.231.2.0/25; set_real_ip_from 3.234.232.224/27; set_real_ip_from 3.236.169.192/26; set_real_ip_from 3.236.48.0/23; set_real_ip_from 34.195.252.0/24; set_real_ip_from 34.226.14.0/24; set_real_ip_from 13.59.250.0/26; set_real_ip_from 18.216.170.128/25; set_real_ip_from 3.128.93.0/24; set_real_ip_from 3.134.215.0/24; set_real_ip_from 52.15.127.128/26; set_real_ip_from 3.101.158.0/23; set_real_ip_from 52.52.191.128/26; set_real_ip_from 34.216.51.0/25; set_real_ip_from 34.223.12.224/27; set_real_ip_from 34.223.80.192/26; set_real_ip_from 35.162.63.192/26; set_real_ip_from 35.167.191.128/26; set_real_ip_from 44.227.178.0/24; set_real_ip_from 44.234.108.128/25; set_real_ip_from 44.234.90.252/30; set_real_ip_from 2600:9000:3000::/36; set_real_ip_from 2600:9000:f600::/39; set_real_ip_from 2600:9000:f540::/42; set_real_ip_from 2409:8c00:2421:300::/56; set_real_ip_from 2600:9000:f000::/38; set_real_ip_from 2600:9000:f500::/43; set_real_ip_from 2600:9000:ddd::/48; set_real_ip_from 2600:9000:f800::/37; set_real_ip_from 2600:9000:f400::/40; set_real_ip_from 2600:9000:f538::/45; set_real_ip_from 2600:9000:5380::/41; set_real_ip_from 2600:9000:1000::/36; set_real_ip_from 2600:9000:2000::/36; set_real_ip_from 2400:7fc0:500::/40; set_real_ip_from 2600:9000:4000::/36; set_real_ip_from 2600:9000:fff::/48; set_real_ip_from 2409:8c00:2421:400::/56; set_real_ip_from 2404:c2c0:500::/40; set_real_ip_from 2600:9000:5308::/45; set_real_ip_from 2600:9000:f534::/46; set_real_ip_from 2600:9000:f520::/44; set_real_ip_from 2600:9000:5320::/43; set_real_ip_from 2600:9000:5310::/44; set_real_ip_from 2600:9000:f580::/41; set_real_ip_from 2600:9000:5340::/42; set_real_ip_from 2600:9000:eee::/48; set_real_ip_from 173.245.48.0/20; set_real_ip_from 103.21.244.0/22; set_real_ip_from 103.22.200.0/22; set_real_ip_from 103.31.4.0/22; set_real_ip_from 141.101.64.0/18; set_real_ip_from 108.162.192.0/18; set_real_ip_from 190.93.240.0/20; set_real_ip_from 188.114.96.0/20; set_real_ip_from 197.234.240.0/22; set_real_ip_from 198.41.128.0/17; set_real_ip_from 162.158.0.0/15; set_real_ip_from 104.16.0.0/13; set_real_ip_from 104.24.0.0/14; set_real_ip_from 172.64.0.0/13; set_real_ip_from 131.0.72.0/22; set_real_ip_from 2400:cb00::/32; set_real_ip_from 2606:4700::/32; set_real_ip_from 2803:f800::/32; set_real_ip_from 2405:b500::/32; set_real_ip_from 2405:8100::/32; set_real_ip_from 2a06:98c0::/29; set_real_ip_from 2c0f:f248::/32; # configuration file /etc/nginx/conf.d/default.conf: # "You are not configured" page, which is the default if another defa ult doesn't exist server { listen 80; listen [::]:80; set $forward_scheme "http"; set $server "127.0.0.1"; set $port "80"; server_name localhost-nginx-proxy-manager; access_log /data/logs/fallback_access.log standard; error_log /data/logs/fallback_error.log warn; include conf.d/include/assets.conf; include conf.d/include/block-exploits.conf; include conf.d/include/letsencrypt-acme-challenge.conf; location / { index index.html; root /var/www/html; } } # First 443 Host, which is the default if another default doesn't exi st server { listen 443 ssl; listen [::]:443 ssl; set $forward_scheme "https"; set $server "127.0.0.1"; set $port "443"; server_name localhost; access_log /data/logs/fallback_access.log standard; error_log /dev/null crit; include conf.d/include/ssl-ciphers.conf; ssl_reject_handshake on; return 444; } # configuration file /etc/nginx/conf.d/include/assets.conf: location ~* ^.*\.(css|js|jpe?g|gif|png|webp|woff|eot|ttf|svg|ico|css\ .map|js\.map)$ { if_modified_since off; # use the public cache proxy_cache public-cache; proxy_cache_key $host$request_uri; # ignore these headers for media proxy_ignore_headers Set-Cookie Cache-Control Expires X-Accel -Expires; # cache 200s and also 404s (not ideal but there are a few 404 images for some reason) proxy_cache_valid any 30m; proxy_cache_valid 404 1m; # strip this header to avoid If-Modified-Since requests proxy_hide_header Last-Modified; proxy_hide_header Cache-Control; proxy_hide_header Vary; proxy_cache_bypass 0; proxy_no_cache 0; proxy_cache_use_stale error timeout updating http_500 http_50 2 http_503 http_504 http_404; proxy_connect_timeout 5s; proxy_read_timeout 45s; expires @30m; access_log off; include conf.d/include/proxy.conf; } # configuration file /etc/nginx/conf.d/include/proxy.conf: add_header X-Served-By $host; proxy_set_header Host $host; proxy_set_header X-Forwarded-Scheme $scheme; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_pass $forward_scheme://$server:$port$request_uri; # configuration file /etc/nginx/conf.d/include/block-exploits.conf: ## Block SQL injections set $block_sql_injections 0; if ($query_string ~ "union.*select.*\(") { set $block_sql_injections 1; } if ($query_string ~ "union.*all.*select.*") { set $block_sql_injections 1; } if ($query_string ~ "concat.*\(") { set $block_sql_injections 1; } if ($block_sql_injections = 1) { return 403; } ## Block file injections set $block_file_injections 0; if ($query_string ~ "[a-zA-Z0-9_]=http://") { set $block_file_injections 1; } if ($query_string ~ "[a-zA-Z0-9_]=(\.\.//?)+") { set $block_file_injections 1; } if ($query_string ~ "[a-zA-Z0-9_]=/([a-z0-9_.]//?)+") { set $block_file_injections 1; } if ($block_file_injections = 1) { return 403; } ## Block common exploits set $block_common_exploits 0; if ($query_string ~ "(<|%3C).*script.*(>|%3E)") { set $block_common_exploits 1; } if ($query_string ~ "GLOBALS(=|\[|\%[0-9A-Z]{0,2})") { set $block_common_exploits 1; } if ($query_string ~ "_REQUEST(=|\[|\%[0-9A-Z]{0,2})") { set $block_common_exploits 1; } if ($query_string ~ "proc/self/environ") { set $block_common_exploits 1; } if ($query_string ~ "mosConfig_[a-zA-Z_]{1,21}(=|\%3D)") { set $block_common_exploits 1; } if ($query_string ~ "base64_(en|de)code\(.*\)") { set $block_common_exploits 1; } if ($block_common_exploits = 1) { return 403; } ## Block spam set $block_spam 0; if ($query_string ~ "\b(ultram|unicauca|valium|viagra|vicodin|xanax|y pxaieo)\b") { set $block_spam 1; } if ($query_string ~ "\b(erections|hoodia|huronriveracres|impotence|le vitra|libido)\b") { set $block_spam 1; } if ($query_string ~ "\b(ambien|blue\spill|*ialis|*ocaine|ejaculation| erectile)\b") { set $block_spam 1; } if ($query_string ~ "\b(lipitor|phentermin|pro[sz]ac|sandyauer|tramad ol|troyhamby)\b") { set $block_spam 1; } if ($block_spam = 1) { return 403; } ## Block user agents set $block_user_agents 0; # Disable Akeeba Remote Control 2.5 and earlier if ($http_user_agent ~ "Indy Library") { set $block_user_agents 1; } # Common bandwidth hoggers and hacking tools. if ($http_user_agent ~ "libwww-perl") { set $block_user_agents 1; } if ($http_user_agent ~ "GetRight") { set $block_user_agents 1; } if ($http_user_agent ~ "GetWeb!") { set $block_user_agents 1; } if ($http_user_agent ~ "Go!Zilla") { set $block_user_agents 1; } if ($http_user_agent ~ "Download Demon") { set $block_user_agents 1; } if ($http_user_agent ~ "Go-Ahead-Got-It") { set $block_user_agents 1; } if ($http_user_agent ~ "TurnitinBot") { set $block_user_agents 1; } if ($http_user_agent ~ "GrabNet") { set $block_user_agents 1; } if ($block_user_agents = 1) { return 403; } # configuration file /etc/nginx/conf.d/include/letsencrypt-acme-chall enge.conf: # Rule for legitimate ACME Challenge requests (like /.well-known/acme -challenge/xxxxxxxxx) # We use ^~ here, so that we don't check other regexes (for speed-up) . We actually MUST cancel # other regex checks, because in our other config files have regex ru le that denies access to files with dotted names. location ^~ /.well-known/acme-challenge/ { # Since this is for letsencrypt authentication of a domain an d they do not give IP ranges of their infrastructure # we need to open up access by turning off auth and IP ACL fo r this location. auth_basic off; auth_request off; allow all; # Set correct content type. According to this: # https://community.letsencrypt.org/t/using-the-webroot-domai n-verification-method/1445/29 # Current specification requires "text/plain" or no content h eader at all. # It seems that "text/plain" is a safe option. default_type "text/plain"; # This directory must be the same as in /etc/letsencrypt/cli. ini # as "webroot-path" parameter. Also don't forget to set "auth enticator" parameter # there to "webroot". # Do NOT use alias, use root! Target directory is located her e: # /var/www/common/letsencrypt/.well-known/acme-challenge/ root /data/letsencrypt-acme-challenge; } # Hide /acme-challenge subdirectory and return 404 on all requests. # It is somewhat more secure than letting Nginx return 403. # Ending slash is important! location = /.well-known/acme-challenge/ { return 404; } # configuration file /etc/nginx/conf.d/include/ssl-ciphers.conf: ssl_session_timeout 5m; ssl_session_cache shared:SSL:50m; # intermediate configuration. tweak to your needs. ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA25 6:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECD SA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-S HA256:DHE-RSA-AES256-GCM-SHA384'; ssl_prefer_server_ciphers off; # configuration file /etc/nginx/conf.d/production.conf: # Admin Interface server { listen 81 default; listen [::]:81 default; server_name nginxproxymanager; root /app/frontend; access_log /dev/null; location /api { return 302 /api/; } location /api/ { add_header X-Served-By $host; proxy_set_header Host $host; proxy_set_header X-Forwarded-Scheme $scheme; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $remote_addr ; proxy_pass http://127.0.0.1:3000/; proxy_read_timeout 15m; proxy_send_timeout 15m; } location / { index index.html; if ($request_uri ~ ^/(.*)\.html$) { return 302 /$1; } try_files $uri $uri.html $uri/ /index.html; } } # configuration file /data/nginx/proxy_host/1.conf: # ------------------------------------------------------------ # adguard.xd003.site # ------------------------------------------------------------ server { set $forward_scheme http; set $server "adguard"; set $port 80; listen 80; listen [::]:80; server_name adguard.xd003.site; access_log /data/logs/proxy-host-1_access.log proxy; error_log /data/logs/proxy-host-1_error.log warn; location / { # Proxy! include conf.d/include/proxy.conf; } # Custom include /data/nginx/custom/server_proxy[.]conf; }