telex-ircd/packaging/nginx/web-client.conf.example at main · kethcode/telex-ircd · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
# Static Telex web client and same-origin IRC-over-WebSocket gateway.
# Replace the example hostname, private address, certificate paths, and control
# port before enabling this site. The upstream Telex listener remains TLS.

server {
    listen 443 ssl http2;
    server_name irc.example.net;

    ssl_certificate /etc/letsencrypt/live/irc.example.net/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/irc.example.net/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;

    root /var/www/telex-web/current;
    index index.html;

    add_header Content-Security-Policy "default-src 'self'; connect-src 'self' wss://irc.example.net wss://irc.example.net:8098 https://irc.example.net:8098; img-src blob:; object-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'" always;
    add_header Referrer-Policy "no-referrer" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    add_header Permissions-Policy "camera=(), geolocation=(), microphone=(), payment=(), usb=()" always;
    add_header Cache-Control "no-cache" always;

    location = /irc {
        proxy_pass https://192.0.2.10:8097;
        proxy_http_version 1.1;
        proxy_set_header Host irc.example.net;
        proxy_set_header Origin $http_origin;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Sec-WebSocket-Protocol $http_sec_websocket_protocol;
        proxy_buffering off;
        proxy_request_buffering off;
        proxy_connect_timeout 5s;
        proxy_read_timeout 24h;
        proxy_send_timeout 24h;
        proxy_socket_keepalive on;

        proxy_ssl_server_name on;
        proxy_ssl_name irc.example.net;
        proxy_ssl_verify on;
        proxy_ssl_verify_depth 4;
        proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
        proxy_ssl_protocols TLSv1.2 TLSv1.3;
    }

    # Keep account authority on the daemon's existing end-to-end TLS control
    # listener instead of forwarding it through plaintext HTTP.
    location = /onboard {
        return 308 https://irc.example.net:8098/onboard/;
    }

    location ^~ /onboard/ {
        return 307 https://irc.example.net:8098$request_uri;
    }

    location = /account {
        return 308 https://irc.example.net:8098/account/;
    }

    location ^~ /account/ {
        return 307 https://irc.example.net:8098$request_uri;
    }

    location / {
        try_files $uri $uri/ =404;
    }
}

server {
    listen 80;
    server_name irc.example.net;
    return 301 https://$host$request_uri;
}