37 lines
1017 B
Django/Jinja
37 lines
1017 B
Django/Jinja
upstream gitea {
|
|
server unix:/run/gitea/sock;
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl http2;
|
|
listen [::]:443 ssl http2;
|
|
server_name {{ gitea_fqdn }};
|
|
|
|
ssl_prefer_server_ciphers on;
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_ciphers 'EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA';
|
|
ssl_certificate /etc/nginx/tls/{{ansible_fqdn}}.crt;
|
|
ssl_certificate_key /etc/nginx/tls/{{ansible_fqdn}}.key;
|
|
ssl_dhparam /etc/nginx/tls/{{ansible_fqdn}}.dh;
|
|
ssl_session_timeout 5m;
|
|
add_header Strict-Transport-Security max-age=15768000;
|
|
gzip off;
|
|
|
|
root /srv/gitea/public;
|
|
|
|
index index.html;
|
|
location / {
|
|
proxy_pass http://gitea/;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header Host $http_host;
|
|
proxy_redirect off;
|
|
}
|
|
|
|
error_page 500 502 503 504 /500.html;
|
|
error_page 404 /404.html;
|
|
error_page 422 /422.html;
|
|
|
|
#log_not_found on;
|
|
#log_subrequest on;
|
|
}
|