aynish/helm
1
0
Fork 0
Code Pull requests Packages Projects Releases Activity

Fix ao config

Browse source
This commit is contained in:
Henrik Lissner 2020-12-18 23:42:24 -05:00
parent 20d6118177
commit adc7490733
No known key found for this signature in database
GPG key ID: 5F6C0EA160557395
2 changed files with 14 additions and 46 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
hosts/ao/README.org
View file

@ -1 +1,9 @@
#+TITLE: Ao
#+DATE: December 12, 2020
* Overview
Mac Mini 2014
* Specs
* Installation

52
hosts/ao/default.nix
View file

@ -14,8 +14,8 @@ with lib.my;
shell.git.enable = true;
shell.zsh.enable = true;
services.ssh.enable = true;
# services.nginx.enable = true;
# services.gitea.enable = true;
services.nginx.enable = true;
services.gitea.enable = true;
# services.syncthing.enable = true;
theme.active = "alucard";
@ -33,57 +33,17 @@ with lib.my;
default = true;
enableACME = true;
forceSSL = true;
root = "${homeDir}/www/v0.io";
locations."~* \.(?:ico|css|js|gif|jpe?g|png|mp4)$".extraConfig = ''
expires 30d;
add_header Pragma public;
add_header Cache-Control public;
'';
locations."/".proxyPass = http://192.168.1.3:8000;
};
"git.v0.io" = {
enableACME = true;
forceSSL = true;
locations."/".proxyPass = http://127.0.0.1:3000;
};
# "tv.v0.io" = {
# http2 = true; # more performant for streaming
# "p.v0.io" = {
# enableACME = true;
# forceSSL = true;
# extraConfig = ''
# add_header Content-Security-Policy "default-src https: data: blob:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com/cv/js/sender/v1/cast_sender.js; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'";
# # Some players don't reopen a socket and playback stops totally
# # instead of resuming after an extended pause
# send_timeout 100m;
# # Intentionally not hardened for security for player support and
# # encryption video streams has a lot of overhead with something like
# # AES-256-GCM-SHA384.
# ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
# ssl_stapling on;
# ssl_stapling_verify on;
# # Forward real ip and host to Plex
# proxy_set_header Referer $server_addr;
# proxy_set_header Origin $server_addr;
# # Security / XSS Mitigation Headers
# add_header X-Frame-Options "SAMEORIGIN";
# add_header X-XSS-Protection "1; mode=block";
# add_header X-Content-Type-Options "nosniff";
# '';
# # locations."= /".return = "302 https://tv.v0.io/web/index.html";
# locations."/socket" = {
# proxyPass = "http://192.168.1.13:8096";
# proxyHttpVersion = "1.1";
# # Buffering off send to the client as soon as the data is received
# # from JellyFin.
# proxyBuffering = "off";
# };
# locations."/" = {
# proxyWebsockets = true;
# proxyPass = "http://192.168.1.13:8096";
# };
# locations."/".proxyPass = http://127.0.0.1:9001;
# };
};
};
@ -93,7 +53,7 @@ with lib.my;
certs = let email = "henrik@lissner.net"; in {
"v0.io".email = email;
"git.v0.io".email = email;
# "tv.v0.io".email = email;
# "p.v0.io".email = email;
};
};