68 lines
2.8 KiB
Text
68 lines
2.8 KiB
Text
# ─────────────────────────────────────────────────────────────
|
|
# Greendale Media Centre — Nginx Reverse Proxy Config
|
|
# SUBDOMAIN variant: https://media.yourdomain.com
|
|
#
|
|
# 1. Copy this file to /etc/nginx/conf.d/ (or your Nginx proxy
|
|
# manager's custom config directory) on your Unraid server.
|
|
# 2. Replace "media.yourdomain.com" with your actual domain.
|
|
# 3. Replace "YOUR_UNRAID_IP" with your Unraid server's LAN IP.
|
|
# 4. Replace "5055" if you changed HOST_PORT in .env.
|
|
# 5. SSL is handled by Nginx Proxy Manager (recommended on Unraid)
|
|
# — point it at this container on port 5055.
|
|
# ─────────────────────────────────────────────────────────────
|
|
|
|
server {
|
|
listen 80;
|
|
server_name media.yourdomain.com;
|
|
|
|
# Redirect all HTTP → HTTPS
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl http2;
|
|
server_name media.yourdomain.com;
|
|
|
|
# ── SSL certificates (managed by NPM or Certbot) ──
|
|
# ssl_certificate /etc/letsencrypt/live/media.yourdomain.com/fullchain.pem;
|
|
# ssl_certificate_key /etc/letsencrypt/live/media.yourdomain.com/privkey.pem;
|
|
|
|
# ── Security headers ──
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
add_header Referrer-Policy "strict-origin" always;
|
|
add_header Strict-Transport-Security "max-age=31536000" always;
|
|
|
|
# ── Proxy to Flask container ──
|
|
location / {
|
|
proxy_pass http://YOUR_UNRAID_IP:5055;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
# WebSocket support (future-proof)
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
|
|
proxy_read_timeout 90;
|
|
proxy_connect_timeout 90;
|
|
proxy_send_timeout 90;
|
|
|
|
# Buffer settings for smooth streaming
|
|
proxy_buffering on;
|
|
proxy_buffer_size 8k;
|
|
proxy_buffers 8 8k;
|
|
}
|
|
|
|
# ── Static asset caching ──
|
|
location ~* \.(css|js|png|jpg|ico|woff2?)$ {
|
|
proxy_pass http://YOUR_UNRAID_IP:5055;
|
|
proxy_set_header Host $host;
|
|
expires 7d;
|
|
add_header Cache-Control "public, immutable";
|
|
}
|
|
}
|