nginx.conf.template

# nginx.conf

###
# NGINX main configuration context
###
user              nginx;
worker_processes  auto;
pid               /var/run/nginx.pid;

events {
    worker_connections  1024;
}

###
# STREAM BLOCK
###

stream {

    #--------------------------------------------------
    # WAZUH STREAMS
    #--------------------------------------------------

    # -- 1515 --
    upstream wazuh_manager_1515 {
        server ${backendIP}:1515;
    }
    server {
        listen 1515;
        proxy_pass wazuh_manager_1515;
    }

    # -- 1514 --
    upstream wazuh_manager_1514 {
        server ${backendIP}:1514;
    }
    server {
        listen 1514;
        proxy_pass wazuh_manager_1514;
    }

    # -- 55000 --
    upstream wazuh_manager_55000 {
        server ${backendIP}:55000;
    }
    server {
        listen 55000;
        proxy_pass wazuh_manager_55000;
    }

    #--------------------------------------------------
    # MAILCOW STREAMS
    #--------------------------------------------------

    # --- SMTP (port 25) ---
    upstream mailcow_smtp {
        # The Postfix container typically listens on port 25 internally
         server 127.0.0.1:25;
    }
    server {
        listen 25;
        proxy_pass mailcow_smtp;
    }

    # --- Submission (port 587) ---
    upstream mailcow_submission {
         server 127.0.0.1:587;
    }
    server {
        listen 587;
        proxy_pass mailcow_submission;
    }

    # --- SMTPS (port 465) ---
    upstream mailcow_smtps {
         server 127.0.0.1:465;
    }
    server {
        listen 465;
        proxy_pass mailcow_smtps;
    }

    # --- POP3 (port 110) ---
    upstream mailcow_pop3 {
         server 127.0.0.1:110;
    }
    server {
        listen 110;
        proxy_pass mailcow_pop3;
    }

    # --- POP3S (port 995) ---
    upstream mailcow_pop3s {
         server 127.0.0.1:995;
    }
    server {
        listen 995;
        proxy_pass mailcow_pop3s;
    }

    # --- IMAP (port 143) ---
    upstream mailcow_imap {
         server 127.0.0.1:143;
    }
    server {
        listen 143;
        proxy_pass mailcow_imap;
    }

    # --- IMAPS (port 993) ---
    upstream mailcow_imaps {
         server 127.0.0.1:993;
    }
    server {
        listen 993;
        proxy_pass mailcow_imaps;
    }
}

###
# HTTP BLOCK
###

http {
    # Hide NGINX version
    server_tokens off;

    include       mime.types;
    default_type  application/octet-stream;

    # Enable debug logging
    error_log /var/log/nginx/error.log warn; #change warn to debug if installing a development server

    # enable access logging 
    access_log /var/log/nginx/access.log;

    sendfile        on;
    keepalive_timeout  65;

    ###
    # SERVER BLOCKS
    ###

    #--------------------------------------------------
    # WEB PAGE: ${BASE_DOMAIN}
    #--------------------------------------------------

    # Redirect HTTP → HTTPS
    server {
        listen 80;
        listen [::]:80;
        server_name ${BASE_DOMAIN}; # or _ for any host

        return 301 https://$host$request_uri;
    }

    server {
         listen 443 ssl;
         listen [::]:443 ssl;
         http2 on;

         server_name ${BASE_DOMAIN}; # or _ for any host

        # SSL certificates
         ssl_certificate /etc/nginx/certs/fullchain.pem;
         ssl_certificate_key /etc/nginx/certs/privkey.pem;

        # Basic SSL config (adapt cipher suites, etc. to your needs)
        ssl_protocols        TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5:!SHA1:!kRSA;
        ssl_prefer_server_ciphers on;

        # Increase buffer sizes (optional, for large responses)
        client_max_body_size 50M; # Adjust as needed
        proxy_buffer_size 128k;
        proxy_buffers 64 512k;
        proxy_busy_buffers_size 512k;

         location / {
             proxy_pass http://${backendIP}:8009;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $scheme;
             client_max_body_size 0;
             proxy_buffer_size 128k;
             proxy_buffers 64 512k;
             proxy_busy_buffers_size 512k;

             # Handle WebSocket connections
             proxy_set_header Upgrade $http_upgrade;
             proxy_set_header Connection "upgrade";
        }
    }

    #--------------------------------------------------
    # WAZUH WEB UI: wazuh.${BASE_DOMAIN}
    #--------------------------------------------------

    server {
        listen 80;
        listen [::]:80;
        server_name wazuh.${BASE_DOMAIN};

        return 301 https://$host$request_uri;
    }

    server {
        listen 443 ssl;
        listen [::]:443 ssl;
        http2 on;

        server_name wazuh.${BASE_DOMAIN};

        # SSL certificates
        ssl_certificate /etc/nginx/certs/wazuh.fullchain.pem;
        ssl_certificate_key /etc/nginx/certs/wazuh.privkey.pem;

        # Basic SSL config (adapt cipher suites, etc. to your needs)
        ssl_protocols        TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5:!SHA1:!kRSA;
        ssl_prefer_server_ciphers on;

        # Increase buffer sizes (optional, for large responses)
        client_max_body_size 0; # Adjust as needed
        proxy_buffer_size 128k;
        proxy_buffers 64 512k;
        proxy_busy_buffers_size 512k;


        # Proxy settings
        location / {
            proxy_pass https://${backendIP}:8011/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-Proto $scheme;
            client_max_body_size 0;
            proxy_buffer_size 128k;
            proxy_buffers 64 512k;
            proxy_busy_buffers_size 512k;

        }
    }

    #--------------------------------------------------
    # ERPNext WEB UI: erp.${BASE_DOMAIN}
    #--------------------------------------------------

    # Redirect HTTP traffic to HTTPS for ERPNext
    server {
        listen 80;
        listen [::]:80;
        server_name erp.${BASE_DOMAIN};

        return 301 https://$host$request_uri; # Redirect to HTTPS
    }

    # HTTPS for ERPNext
    server {
        listen 443 ssl;
        listen [::]:443 ssl;
        http2 on;

        server_name erp.${BASE_DOMAIN};

        # SSL certificates
        ssl_certificate /etc/nginx/certs/erp.fullchain.pem;
        ssl_certificate_key /etc/nginx/certs/erp.privkey.pem;

        # Basic SSL config (adapt cipher suites, etc. to your needs)
        ssl_protocols        TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5:!SHA1:!kRSA;
        ssl_prefer_server_ciphers on;

        # Increase buffer sizes (optional, for large responses)
        client_max_body_size 0; # Adjust as needed
        proxy_buffer_size 128k;
        proxy_buffers 64 512k;
        proxy_busy_buffers_size 512k;

        # Proxy settings for ERPNext
        location / {
            proxy_pass http://${backendIP}:8080;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            client_max_body_size 0;
            proxy_buffer_size 128k;
            proxy_buffers 64 512k;
            proxy_busy_buffers_size 512k;

            # Handle WebSocket connections
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
        }
    }

    #--------------------------------------------------
    # JENKINS WEB UI: jenkins.${BASE_DOMAIN}
    #--------------------------------------------------

    # Redirect HTTP traffic to HTTPS for Jenkins
    server {
        listen 80;
        listen [::]:80;
        server_name jenkins.${BASE_DOMAIN};

        return 301 https://$host$request_uri; # Redirect to HTTPS
    }

    # HTTPS for Jenkins
    server {
        listen 443 ssl;
        listen [::]:443 ssl;
        server_name jenkins.${BASE_DOMAIN};
        http2 on;

        # SSL certificates
        ssl_certificate /etc/nginx/certs/jenkins.fullchain.pem;
        ssl_certificate_key /etc/nginx/certs/jenkins.privkey.pem;

        # Basic SSL config (adapt cipher suites, etc. to your needs)
        ssl_protocols        TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5:!SHA1:!kRSA;
        ssl_prefer_server_ciphers on;

        # Increase buffer sizes (optional, for large responses)
        client_max_body_size 0; # Adjust as needed
        proxy_buffer_size 128k;
        proxy_buffers 64 512k;
        proxy_busy_buffers_size 512k;

        # Proxy settings for Jenkins
        location / {
            proxy_pass http://${backendIP}:9080;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            client_max_body_size 0;
            proxy_buffer_size 128k;
            proxy_buffers 64 512k;
            proxy_busy_buffers_size 512k;

            # Handle WebSocket connections
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
        }
    }


    #--------------------------------------------------
    # MAILCOW PAGE: mail.${BASE_DOMAIN}
    #--------------------------------------------------
    # --- Server block for HTTP (80) ---
    server {
        listen 80;
        listen [::]:80;
        server_name mail.${BASE_DOMAIN} autodiscover.* autoconfig.*;

        return 301 https://$host$request_uri; # Redirect everything else to HTTPS

    }

    # --- Server block for HTTPS (443) ---
    server {
        listen 443 ssl;
        listen [::]:443 ssl;
        server_name mail.${BASE_DOMAIN} autodiscover.* autoconfig.*;
        http2 on;

        # SSL certs if you're terminating TLS here
        ssl_certificate /etc/nginx/certs/mail.fullchain.pem;
        ssl_certificate_key /etc/nginx/certs/mail.privkey.pem;
        
        # Basic SSL config (adapt cipher suites, etc. to your needs)
        ssl_protocols        TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5:!SHA1:!kRSA;
        ssl_prefer_server_ciphers on;

        # Forward all HTTPS traffic to Mailcow’s internal Nginx (on port  12443)
        location / {
            proxy_pass https://127.0.0.1:8053;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            client_max_body_size 0;
            proxy_buffer_size 128k;
            proxy_buffers 64 512k;
            proxy_busy_buffers_size 512k;

        }
    }

    #--------------------------------------------------
    # MATTERMOST PAGE: collaborate.${BASE_DOMAIN}
    #--------------------------------------------------
    # --- Server block for HTTP (80) ---
    server {
        listen 80;
        listen [::]:80;
        server_name collaborate.${BASE_DOMAIN};

        return 301 https://$host$request_uri; # Redirect everything else to HTTPS

    }

    # --- Server block for HTTPS (443) ---
    server {
        listen 443 ssl;
        listen [::]:443 ssl;
        server_name collaborate.${BASE_DOMAIN};
        http2 on;

        # SSL certs if you're terminating TLS here
        ssl_certificate /etc/nginx/certs/collaborate.fullchain.pem;
        ssl_certificate_key /etc/nginx/certs/collaborate.privkey.pem;

        # Recommended SSL/TLS config
        ssl_session_timeout 1d;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_early_data on;
        ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:50m;

        # HSTS: ensure browsers use HTTPS only (six months)
        add_header Strict-Transport-Security max-age=15768000;

        # Enable OCSP stapling
        ssl_stapling on;
        ssl_stapling_verify on;

        # Standard (HTTP) traffic
        location / {
            proxy_pass http://${backendIP}:8065;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            client_max_body_size               0;
            proxy_set_header Connection         "";
            proxy_set_header X-Frame-Options    SAMEORIGIN;
            proxy_buffers                      256 16k;
            proxy_buffer_size                  16k;
            proxy_read_timeout                 600s;
            proxy_http_version                 1.1;

        }

        # WebSocket (real-time) connections for Mattermost
        location ~ /api/v[0-9]+/(users/)?websocket$ {
            proxy_set_header Upgrade             $http_upgrade;
            proxy_set_header Connection          "upgrade";

            # Basic proxy settings
            client_max_body_size                0;
            proxy_set_header Host               $host;
            proxy_set_header X-Real-IP          $remote_addr;
            proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto  $scheme;
            proxy_set_header X-Frame-Options    SAMEORIGIN;
            proxy_buffers                       256 16k;
            proxy_buffer_size                   16k;

            # Timeouts
            client_body_timeout                 60s;
            send_timeout                        300s;
            lingering_timeout                   5s;
            proxy_connect_timeout               90s;
            proxy_send_timeout                  300s;
            proxy_read_timeout                  90s;
            proxy_http_version                  1.1;

            proxy_pass http://${backendIP}:8065;
        }
    }

    #--------------------------------------------------
    # ANALYTICS PAGE: analytics.${BASE_DOMAIN}
    #--------------------------------------------------

    # Redirect HTTP → HTTPS
    server {
        listen 80;
        listen [::]:80;
        server_name analytics.${BASE_DOMAIN}; # or _ for any host

        return 301 https://$host$request_uri;
    }

    server {
        listen 443 ssl;
        listen [::]:443 ssl;
        http2 on;

        server_name analytics.${BASE_DOMAIN}; # or _ for any host

        # SSL certificates
        ssl_certificate /etc/nginx/certs/analytics.fullchain.pem;
        ssl_certificate_key /etc/nginx/certs/analytics.privkey.pem;

        # Basic SSL config (adapt cipher suites, etc. to your needs)
        ssl_protocols        TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5:!SHA1:!kRSA;
        ssl_prefer_server_ciphers on;

        # Increase buffer sizes (optional, for large responses)
        client_max_body_size 50M; # Adjust as needed
        proxy_buffer_size 128k;
        proxy_buffers 64 512k;
        proxy_busy_buffers_size 512k;

        location / {
            proxy_pass http://${backendIP}:3000;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            client_max_body_size 0;
            proxy_buffer_size 128k;
            proxy_buffers 64 512k;
            proxy_busy_buffers_size 512k;
        }
    }

    #--------------------------------------------------
    # NEXTCLOUD PAGE: cloud.${BASE_DOMAIN}
    #--------------------------------------------------
    server {
        listen 80;
        listen [::]:80;            # comment to disable IPv6

        if ($scheme = "http") {
            return 301 https://$host$request_uri;
        }
        if ($http_x_forwarded_proto = "http") {
            return 301 https://$host$request_uri;
        }

        listen 443 ssl;
        listen [::]:443 ssl;
        http2 on;

        proxy_buffering off;
        proxy_request_buffering off;

        client_max_body_size 0;
        client_body_buffer_size 512k;
        proxy_read_timeout 86400s;

        server_name cloud.${BASE_DOMAIN};

        location / {
            proxy_pass http://${backendIP}:11000$request_uri; # Adjust to match APACHE_PORT and APACHE_IP_BINDING. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md#adapting-the-sample-web-server-configurations-below

            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Port $server_port;
            proxy_set_header X-Forwarded-Scheme $scheme;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Host $host;
            proxy_set_header Early-Data $ssl_early_data;

        # SSL certificates
        ssl_certificate /etc/nginx/certs/cloud.fullchain.pem;
        ssl_certificate_key /etc/nginx/certs/cloud.privkey.pem;

        ssl_dhparam /etc/dhparam; # curl -L https://ssl-config.mozilla.org/ffdhe2048.txt -o /etc/dhparam

        ssl_early_data on;
        ssl_session_timeout 1d;

        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ecdh_curve x25519:x448:secp521r1:secp384r1:secp256r1;

        ssl_prefer_server_ciphers on;
        ssl_conf_command Options PrioritizeChaCha;
        ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256;
        }
    }

    #--------------------------------------------------
    # MINIO: s3.${BASE_DOMAIN}
    #--------------------------------------------------

    # Redirect HTTP → HTTPS
    server {
        listen 80;
        listen [::]:80;
        server_name s3.${BASE_DOMAIN}; # or _ for any host

        return 301 https://$host$request_uri;
    }

    server {
         listen 443 ssl;
         listen [::]:443 ssl;
         http2 on;

         server_name s3.${BASE_DOMAIN}; # or _ for any host

        # SSL certificates
         ssl_certificate /etc/nginx/certs/s3.fullchain.pem;
         ssl_certificate_key /etc/nginx/certs/s3.privkey.pem;

        # Basic SSL config (adapt cipher suites, etc. to your needs)
        ssl_protocols        TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5:!SHA1:!kRSA;
        ssl_prefer_server_ciphers on;

        # Increase buffer sizes (optional, for large responses)
        client_max_body_size 0;                     # Allow any size file to be uploaded.
        proxy_buffering off;                        # To disable buffering
        proxy_request_buffering off;                # <-

         location / {
             proxy_pass http://${backendIP}:8123;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $scheme;
             client_max_body_size 0;

             # Handle WebSocket connections
             proxy_set_header Upgrade $http_upgrade;
             proxy_set_header Connection "upgrade";
        }
    }


    #--------------------------------------------------
    # MINIO API: s3api.${BASE_DOMAIN}
    #--------------------------------------------------

    # Redirect HTTP → HTTPS
    server {
        listen 80;
        listen [::]:80;
        server_name s3api.${BASE_DOMAIN}; # or _ for any host

        return 301 https://$host$request_uri;
    }

    server {
         listen 443 ssl;
         listen [::]:443 ssl;
         http2 on;

         server_name s3api.${BASE_DOMAIN}; # or _ for any host

        # SSL certificates
         ssl_certificate /etc/nginx/certs/s3api.fullchain.pem;
         ssl_certificate_key /etc/nginx/certs/s3api.privkey.pem;

        # Basic SSL config (adapt cipher suites, etc. to your needs)
        ssl_protocols        TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5:!SHA1:!kRSA;
        ssl_prefer_server_ciphers on;

        # Increase buffer sizes (optional, for large responses)
        client_max_body_size 0;                     # Allow any size file to be uploaded.
        proxy_buffering off;                        # To disable buffering
        proxy_request_buffering off;                # <-

         location / {
             proxy_pass http://${backendIP}:9123;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $scheme;
             client_max_body_size 0;

             # Handle WebSocket connections
             proxy_set_header Upgrade $http_upgrade;
             proxy_set_header Connection "upgrade";
        }
    }
}