example-nginx.conf

# SPDX-FileCopyrightText: 2021 The NGI Pointer Secure-Scuttlebutt Team of 2020/2021
#
# SPDX-License-Identifier: Unlicense

server {
    server_name planetary.name;

    listen 443 ssl; # managed by Certbot

    ssl_certificate /etc/letsencrypt/live/planetary.name/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/planetary.name/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    location / {
        proxy_pass http://localhost:8899;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-For $remote_addr:$remote_port;
        proxy_set_header X-Forwarded-Proto $scheme;
        # for websocket
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        # requires a $connection_upgrade definition in /etc/nginx/nginx.conf
        # see https://futurestud.io/tutorials/nginx-how-to-fix-unknown-connection_upgrade-variable
        proxy_set_header Connection $connection_upgrade;
    }

    # TODO: https://blog.tarq.io/nginx-catch-all-error-pages/
}

# this server uses the (same) wildcard cert as the one above but uses a regular expression on the hostname
# which extracts the first subdomain which holds the alias and forwards that to the prox_pass server
server {
    server_name "~^(?<alias>\w+)\.hermies\.club$";

    listen 443 ssl; # managed by Certbot

    ssl_certificate /etc/letsencrypt/live/planetary.name/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/planetary.name/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    location = / {
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-For $remote_addr:$remote_port;
        proxy_set_header X-Forwarded-Proto $scheme;
        # "rewrite" requests with subdomains to the non-wildcard url for alias resolving
        # $is_args$args pass on ?encoding=json if present
        proxy_pass http://localhost:8899/alias/$alias$is_args$args;
    }

    location / {
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-For $remote_addr:$remote_port;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://localhost:8899;
    }

    # TODO: https://blog.tarq.io/nginx-catch-all-error-pages/
}

server {
    if ($host ~ planetary.name$ ) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    listen 80 default_server;
    listen [::]:80 default_server;
    server_name planetary.name;
    return 404; # managed by Certbot
}