Init.

2026-02-02 20:12:50 +03:00
parent b8f89cd286
commit 6b54303482
11 changed files with 4276 additions and 1 deletions
--- a/nginx/xmpp.guschin.info.conf
+++ b/nginx/xmpp.guschin.info.conf
@@ -0,0 +1,76 @@
+upstream prosody {
+    server localhost:5280;
+}
+
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name xmpp.guschin.info;
+
+    # ACME challenge location for Let's Encrypt
+    location /.well-known/acme-challenge/ {
+        root /var/www/letsencrypt;
+        default_type "text/plain";
+        autoindex on;
+        try_files $uri =404;
+    }
+
+    # Redirect HTTP to HTTPS
+    return 301 https://$server_name$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name xmpp.guschin.info;
+
+    # SSL certificate paths (adjust to your certificate location)
+    ssl_certificate /etc/letsencrypt/live/xmpp.guschin.info/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/xmpp.guschin.info/privkey.pem;
+    
+    # SSL configuration
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers HIGH:!aNULL:!MD5;
+    ssl_prefer_server_ciphers on;
+
+    # Security headers
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "DENY" always;
+
+    # Prosody web interface and HTTP upload
+    location / {
+        proxy_pass http://prosody;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_buffering off;
+    }
+
+    # Websocket endpoint for XMPP
+    location /ws {
+        proxy_pass http://prosody/ws;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # HTTP File Upload
+    location /upload {
+        proxy_pass http://prosody/upload;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        client_max_body_size 100M;
+    }
+}