Marshalleq 90 Posted May 14, 2020 Share Posted May 14, 2020 All good and thanks so much! I'm so tired of cloud mail. Finally realised how to get around the lack of PTR on home ISP's. Amazing what happens when you sit down and actually work stuff out! Marshalleq Quote Link to post
bombz 1 Posted May 14, 2020 Share Posted May 14, 2020 2 hours ago, aptalca said: Smh. You see the linuxserver version and the binhex version side by side in your screenshot and you still select the binhex version. Why? Not that there is anything wrong with that version, but I'm asking you to follow the simple steps outlined in the troubleshooting article. We put a lot of time into it and it gets frustrating when users still don't follow them even when we spell them out step by step. The whole point of the troubleshooting article is so you can make sure that your ports are properly mapped and forwarded and that the container is accessible from the internet. Only then, you should try to set up letsencrypt. Otherwise there are too many reasons why it can fail and as you experienced, if it fails a bunch of times, you're throttled. So read the directions carefully. Thank you for your assistance. I attempted linuxserver version (2015) first and it prompted a server error when I attempted to start it the binhex did not. I can understand the frustration, I knew as soon as I responded the 'smh' was understandable. Copy that on the troubleshooting steps and outlook. Its been a long few days on this. Long story short I made some successful progress tonight, but good things came of it. Continue some more tomorrow. Quote Link to post
Ccheese4 0 Posted May 14, 2020 Share Posted May 14, 2020 9 hours ago, aptalca said: I recommend unraid console for those operations. Simple "cp sourcefilename targetfilename" will do what you want. And use "nano filename" to edit files worked like a charm. Thanks! Quote Link to post
KJThaDon 0 Posted May 16, 2020 Share Posted May 16, 2020 (edited) Anyone know where I can change the default error file locations? I've tried adding something like this to one of my .conf Nevermind. I fixed it below. Didn't have correct volume mapping path. error_page 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 421 422 423 424 425 426 428 429 431 451 500 501 502 503 504 505 506 507 508 510 511 /error.html; location = /error.html { ssi on; internal; auth_basic off; root /config/www; } Edited May 16, 2020 by KJThaDon Quote Link to post
izarkhin 1 Posted May 16, 2020 Share Posted May 16, 2020 (edited) HI guys, My certificate fails to renew. I have a free DuckDNS account that worked just fine before. I verified that the account is valid and has the correct IP address. What could be the problem? The config and the log files are attached. Thanks! [removed].duckdns.org.conf letsencrypt.log Edited May 16, 2020 by izarkhin Quote Link to post
izarkhin 1 Posted May 16, 2020 Share Posted May 16, 2020 48 minutes ago, izarkhin said: HI guys, My certificate fails to renew. I have a free DuckDNS account that worked just fine before. I verified that the account is valid and has the correct IP address. What could be the problem? The config and the log files are attached. Thanks! [removed].duckdns.org.conf 1015 B · 0 downloads letsencrypt.log 3.05 kB · 0 downloads Never mind! Turns out I needed to open port 80 for the challenge to work. All fine now. Quote Link to post
TeCH-Guruz 1 Posted May 16, 2020 Share Posted May 16, 2020 did anyone ever manage to get a nginx subdomain proxy setup with bitnami's phpbb that you wouldn't mind sharing? Quote Link to post
madaroda 0 Posted May 17, 2020 Share Posted May 17, 2020 I've set up Letsencrypt/nginx wildcard on an unraid docker with my own domain. Letsencrypt certificates appear to download fine. I've got sonarr, radarr and a few more subdomains edited and renamed in proxy-confs. Letsencrypt docker opens and ends in "Server ready." Domain.me and anything.domain.me resolve to correct IP. But nothing opens. https://sonarr.domain.me et all are unable to establish a connection to the server, even though sonarr.domain.me pings correctly (to the WAN address). I suspect a config issue, but where? Quote Link to post
saarg 413 Posted May 17, 2020 Share Posted May 17, 2020 7 hours ago, madaroda said: I've set up Letsencrypt/nginx wildcard on an unraid docker with my own domain. Letsencrypt certificates appear to download fine. I've got sonarr, radarr and a few more subdomains edited and renamed in proxy-confs. Letsencrypt docker opens and ends in "Server ready." Domain.me and anything.domain.me resolve to correct IP. But nothing opens. https://sonarr.domain.me et all are unable to establish a connection to the server, even though sonarr.domain.me pings correctly (to the WAN address). I suspect a config issue, but where? Try following this https://blog.linuxserver.io/2019/07/10/troubleshooting-letsencrypt-image-port-mapping-and-forwarding/ Quote Link to post
Tucubanito07 21 Posted May 17, 2020 Share Posted May 17, 2020 (edited) Hey guys. I have followed this site to create a website using Wordpress but when i go to the https://servername.com it goes to my nextcloud. However, when i go to https://www.servername.com it gives me this site can be reached. Can someone help me figure out the issue please? i am using the EXTRA_DOMAIN parameters and i dont see the name of the domain i use on the logs. I only see the others from my DNS provider. Edited May 17, 2020 by Tucubanito07 Quote Link to post
aptalca 325 Posted May 17, 2020 Share Posted May 17, 2020 40 minutes ago, Tucubanito07 said: Hey guys. I have followed this site to create a website using Wordpress but when i go to the https://servername.com it goes to my nextcloud. However, when i go to https://www.servername.com it gives me this site can be reached. Can someone help me figure out the issue please? i am using the EXTRA_DOMAIN parameters and i dont see the name of the domain i use on the logs. I only see the others from my DNS provider. Post what you changed/tried to make it work and we'll take a look Quote Link to post
Tucubanito07 21 Posted May 17, 2020 Share Posted May 17, 2020 3 minutes ago, aptalca said: Post what you changed/tried to make it work and we'll take a look Thank you so much @aptalca This config is the one that this guide said to use. https://technicalramblings.com/blog/how-to-set-up-a-wordpress-site-with-letsencrypt-and-mariadb-on-unraid/ # REDIRECT WWW TO https://[domain.com] server { listen 80; listen 443 ssl http2; server_name www.domainname.com; return 301 https://domainnamecom$request_uri; } # REDIRECT HTTP TRAFFIC TO https://[domain.com] server { listen 80; server_name domainname.com; return 301 https://domainname.com$request_uri; } # BLOG SITE server { listen 443 ssl http2; server_name domainname.com; ## Source: https://github.com/1activegeek/nginx-config-collection ## READ THE COMMENT ON add_header X-Frame-Options AND add_header Content-Security-Policy IF YOU USE THIS ON A SUBDOMAIN YOU WANT TO IFRAME! ## Certificates from LE container placement ssl_certificate /config/keys/letsencrypt/fullchain.pem; ssl_certificate_key /config/keys/letsencrypt/privkey.pem; ## Strong Security recommended settings per cipherli.st ssl_dhparam /config/nginx/dhparams.pem; # Bit value: 4096 ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384; ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0 ssl_session_timeout 10m; ## NOTE: The add_header Content-Security-Policy won't work with duckdns since you don't own the root domain. Just buy a domain. It's cheap ## Settings to add strong security profile (A+ on securityheaders.io/ssllabs.com) add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header X-Robots-Tag none; #SET THIS TO index IF YOU WANT GOOGLE TO INDEX YOU SITE! add_header Content-Security-Policy "frame-ancestors https://*.$server_name https://$server_name"; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe! add_header X-Frame-Options "ALLOW-FROM https://*.$server_name" always; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe! add_header Referrer-Policy "strict-origin-when-cross-origin"; add_header Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;"; #FEATURE POLICY: READ MORE HERE: https://scotthelme.co.uk/a-new-security-header-feature-policy/ proxy_cookie_path / "/; HTTPOnly; Secure"; ##NOTE: This may cause issues with unifi. Remove HTTPOnly; or create another ssl config for unifi. more_set_headers "Server: Classified"; more_clear_headers 'X-Powered-By'; client_max_body_size 0; root /config/www/wordpress/; index index.html index.php; location ~ /\. { deny all; } location / { try_files $uri $uri/ /index.php?_url=$uri&$query_string; } # PHP location ~ \.php$ { fastcgi_split_path_info ^(.+\.php)(/.+)$; # With php7-cgi alone: fastcgi_pass 127.0.0.1:9000; # With php7-fpm: #fastcgi_pass unix:/var/run/php7-fpm.sock; fastcgi_index index.php; include /etc/nginx/fastcgi_params; } fastcgi_buffer_size 4K; fastcgi_buffers 64 4k; } So i dont think that one is the one working. I copied the nextcloud config file and changed the name of the site server and also the app name. I believe this one is the ones that is working. Since it had nextcloud i changed it to WordPress and now i get a 502 Bad Gateway. Here is that config. # make sure that your dns has a cname set for nextcloud # assuming this container is called "letsencrypt", edit your nextcloud container's config # located at /config/www/nextcloud/config/config.php and add the following lines before the ");": # 'trusted_proxies' => ['letsencrypt'], # 'overwrite.cli.url' => 'https://nextcloud.your-domain.com/', # 'overwritehost' => 'nextcloud.your-domain.com', # 'overwriteprotocol' => 'https', # # Also don't forget to add your domain name to the trusted domains array. It should look somewhat like this: # array ( # 0 => '192.168.0.1:444', # This line may look different on your setup, don't modify it. # 1 => 'nextcloud.your-domain.com', # ), server { listen 443 ssl; listen [::]:443 ssl; server_name mydomainname.com; include /config/nginx/ssl.conf; add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;"; client_max_body_size 0; location / { include /config/nginx/proxy.conf; resolver 127.0.0.11 valid=30s; set $upstream_app WordPress; set $upstream_port 443; set $upstream_proto https; proxy_pass $upstream_proto://$upstream_app:$upstream_port; proxy_max_temp_file_size 2048m; } } Quote Link to post
Tucubanito07 21 Posted May 17, 2020 Share Posted May 17, 2020 This is how the container looks The logs look like this. I dont see the domain i own with google on the EXTRA_DOMAIN parameters. Quote Link to post
saarg 413 Posted May 17, 2020 Share Posted May 17, 2020 (edited) You have probably used the wrong name for the variable. It's EXTRA_DOMAINS. Show us how it looks like if you click Edit on Extra domain. And please use the code tag if you insert config files or else it's a pain to read them. Like this Much easier to read for our sore eyes Edited May 17, 2020 by saarg Quote Link to post
Tucubanito07 21 Posted May 17, 2020 Share Posted May 17, 2020 18 minutes ago, saarg said: You have probably used the wrong name for the variable. It's EXTRA_DOMAINS. Show us how it looks like if you click Edit on Extra domain. And please use the code tag if you insert config files or else it's a pain to read them. Like this Much easier to read for our sore eyes Ok so i was missing the S in EXTRA_DOMAINS i had EXTRA_DOMAIN. I do see that my domain on the logs does not have an error. Before i was doing domainname.com,www.domainname.com. The www.domainname.com was the one throwing an error. I delete it. Now i have been trying other configs like the ones above and grrr. Quote Link to post
Tucubanito07 21 Posted May 17, 2020 Share Posted May 17, 2020 This is the config i am using under letsencrypt/nginx/proxy-confs/ # REDIRECT WWW TO https://[domain.com] server { listen 80; listen 443 ssl http2; server_name www.domainame.com; return 301 https://domainame.com$request_uri; } # REDIRECT HTTP TRAFFIC TO https://[domain.com] server { listen 80; server_name domainame.com; return 301 https://domainame.com$request_uri; } # BLOG SITE server { listen 443 ssl http2; server_name domainame.com; ## Source: https://github.com/1activegeek/nginx-config-collection ## READ THE COMMENT ON add_header X-Frame-Options AND add_header Content-Security-Policy IF YOU USE THIS ON A SUBDOMAIN YOU WANT TO IFRAME! ## Certificates from LE container placement ssl_certificate /config/keys/letsencrypt/fullchain.pem; ssl_certificate_key /config/keys/letsencrypt/privkey.pem; ## Strong Security recommended settings per cipherli.st ssl_dhparam /config/nginx/dhparams.pem; # Bit value: 4096 ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384; ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0 ssl_session_timeout 10m; ## NOTE: The add_header Content-Security-Policy won't work with duckdns since you don't own the root domain. Just buy a domain. It's cheap ## Settings to add strong security profile (A+ on securityheaders.io/ssllabs.com) add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header X-Robots-Tag none; #SET THIS TO index IF YOU WANT GOOGLE TO INDEX YOU SITE! add_header Content-Security-Policy "frame-ancestors https://*.$server_name https://$server_name"; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe! add_header X-Frame-Options "ALLOW-FROM https://*.$server_name" always; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe! add_header Referrer-Policy "strict-origin-when-cross-origin"; add_header Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;"; #FEATURE POLICY: READ MORE HERE: https://scotthelme.co.uk/a-new-security-header-feature-policy/ proxy_cookie_path / "/; HTTPOnly; Secure"; ##NOTE: This may cause issues with unifi. Remove HTTPOnly; or create another ssl config for unifi. more_set_headers "Server: Classified"; more_clear_headers 'X-Powered-By'; client_max_body_size 0; root /config/www/wordpress/; index index.html index.php; location ~ /\. { deny all; } location / { try_files $uri $uri/ /index.php?_url=$uri&$query_string; } # PHP location ~ \.php$ { fastcgi_split_path_info ^(.+\.php)(/.+)$; # With php7-cgi alone: fastcgi_pass 127.0.0.1:9000; # With php7-fpm: #fastcgi_pass unix:/var/run/php7-fpm.sock; fastcgi_index index.php; include /etc/nginx/fastcgi_params; } fastcgi_buffer_size 4K; fastcgi_buffers 64 4k; } Quote Link to post
saarg 413 Posted May 17, 2020 Share Posted May 17, 2020 56 minutes ago, Tucubanito07 said: This is the config i am using under letsencrypt/nginx/proxy-confs/ # REDIRECT WWW TO https://[domain.com] server { listen 80; listen 443 ssl http2; server_name www.domainame.com; return 301 https://domainame.com$request_uri; } # REDIRECT HTTP TRAFFIC TO https://[domain.com] server { listen 80; server_name domainame.com; return 301 https://domainame.com$request_uri; } # BLOG SITE server { listen 443 ssl http2; server_name domainame.com; ## Source: https://github.com/1activegeek/nginx-config-collection ## READ THE COMMENT ON add_header X-Frame-Options AND add_header Content-Security-Policy IF YOU USE THIS ON A SUBDOMAIN YOU WANT TO IFRAME! ## Certificates from LE container placement ssl_certificate /config/keys/letsencrypt/fullchain.pem; ssl_certificate_key /config/keys/letsencrypt/privkey.pem; ## Strong Security recommended settings per cipherli.st ssl_dhparam /config/nginx/dhparams.pem; # Bit value: 4096 ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384; ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0 ssl_session_timeout 10m; ## NOTE: The add_header Content-Security-Policy won't work with duckdns since you don't own the root domain. Just buy a domain. It's cheap ## Settings to add strong security profile (A+ on securityheaders.io/ssllabs.com) add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header X-Robots-Tag none; #SET THIS TO index IF YOU WANT GOOGLE TO INDEX YOU SITE! add_header Content-Security-Policy "frame-ancestors https://*.$server_name https://$server_name"; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe! add_header X-Frame-Options "ALLOW-FROM https://*.$server_name" always; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe! add_header Referrer-Policy "strict-origin-when-cross-origin"; add_header Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;"; #FEATURE POLICY: READ MORE HERE: https://scotthelme.co.uk/a-new-security-header-feature-policy/ proxy_cookie_path / "/; HTTPOnly; Secure"; ##NOTE: This may cause issues with unifi. Remove HTTPOnly; or create another ssl config for unifi. more_set_headers "Server: Classified"; more_clear_headers 'X-Powered-By'; client_max_body_size 0; root /config/www/wordpress/; index index.html index.php; location ~ /\. { deny all; } location / { try_files $uri $uri/ /index.php?_url=$uri&$query_string; } # PHP location ~ \.php$ { fastcgi_split_path_info ^(.+\.php)(/.+)$; # With php7-cgi alone: fastcgi_pass 127.0.0.1:9000; # With php7-fpm: #fastcgi_pass unix:/var/run/php7-fpm.sock; fastcgi_index index.php; include /etc/nginx/fastcgi_params; } fastcgi_buffer_size 4K; fastcgi_buffers 64 4k; } Learn how to put the config in a code tag! Don't we already have a wordpress proxy-conf? Quote Link to post
Tucubanito07 21 Posted May 17, 2020 Share Posted May 17, 2020 3 minutes ago, saarg said: Learn how to put the config in a code tag! Don't we already have a wordpress proxy-conf? I don't see in under proxy-conf. That is where i looked first before asking and i don't see anything. What do you mean by putting a config in a code tag? Quote Link to post
saarg 413 Posted May 17, 2020 Share Posted May 17, 2020 3 minutes ago, Tucubanito07 said: I don't see in under proxy-conf. That is where i looked first before asking and i don't see anything. What do you mean by putting a config in a code tag? Look a couple of posts up. I already asked you to do it there. I thought we had one, but no we don't have a proxy-conf for it. Quote Link to post
Tucubanito07 21 Posted May 17, 2020 Share Posted May 17, 2020 4 minutes ago, saarg said: Look a couple of posts up. I already asked you to do it there. I thought we had one, but no we don't have a proxy-conf for it. Yea you guys don't have one. Now, when you say look a couple of posts up i dont see where you said to try anything. Quote Link to post
saarg 413 Posted May 17, 2020 Share Posted May 17, 2020 Just now, Tucubanito07 said: Yea you guys don't have one. Now, when you say look a couple of posts up i dont see where you said to try anything. Quote Link to post
Tucubanito07 21 Posted May 17, 2020 Share Posted May 17, 2020 5 minutes ago, saarg said: I have already resolve the problem with not getting the certificate. I only need to point the NGINX to the wordpress domain so people can see the site. I know on nextcloud they have a config file we have to change to connect to reverse proxy. However, i dont see a config file in wordpress. Quote Link to post
Tucubanito07 21 Posted May 17, 2020 Share Posted May 17, 2020 This is the config i am using under letsencrypt/nginx/proxy-confs/ # REDIRECT WWW TO https://[domain.com] server { listen 80; listen 443 ssl http2; server_name www.domainame.com; return 301 https://domainame.com$request_uri; } # REDIRECT HTTP TRAFFIC TO https://[domain.com] server { listen 80; server_name domainame.com; return 301 https://domainame.com$request_uri; } # BLOG SITE server { listen 443 ssl http2; server_name domainame.com; ## Source: https://github.com/1activegeek/nginx-config-collection ## READ THE COMMENT ON add_header X-Frame-Options AND add_header Content-Security-Policy IF YOU USE THIS ON A SUBDOMAIN YOU WANT TO IFRAME! ## Certificates from LE container placement ssl_certificate /config/keys/letsencrypt/fullchain.pem; ssl_certificate_key /config/keys/letsencrypt/privkey.pem; ## Strong Security recommended settings per cipherli.st ssl_dhparam /config/nginx/dhparams.pem; # Bit value: 4096 ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384; ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0 ssl_session_timeout 10m; ## NOTE: The add_header Content-Security-Policy won't work with duckdns since you don't own the root domain. Just buy a domain. It's cheap ## Settings to add strong security profile (A+ on securityheaders.io/ssllabs.com) add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header X-Robots-Tag none; #SET THIS TO index IF YOU WANT GOOGLE TO INDEX YOU SITE! add_header Content-Security-Policy "frame-ancestors https://*.$server_name https://$server_name"; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe! add_header X-Frame-Options "ALLOW-FROM https://*.$server_name" always; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe! add_header Referrer-Policy "strict-origin-when-cross-origin"; add_header Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;"; #FEATURE POLICY: READ MORE HERE: https://scotthelme.co.uk/a-new-security-header-feature-policy/ proxy_cookie_path / "/; HTTPOnly; Secure"; ##NOTE: This may cause issues with unifi. Remove HTTPOnly; or create another ssl config for unifi. more_set_headers "Server: Classified"; more_clear_headers 'X-Powered-By'; client_max_body_size 0; root /config/www/wordpress/; index index.html index.php; location ~ /\. { deny all; } location / { try_files $uri $uri/ /index.php?_url=$uri&$query_string; } # PHP location ~ \.php$ { fastcgi_split_path_info ^(.+\.php)(/.+)$; # With php7-cgi alone: fastcgi_pass 127.0.0.1:9000; # With php7-fpm: #fastcgi_pass unix:/var/run/php7-fpm.sock; fastcgi_index index.php; include /etc/nginx/fastcgi_params; } fastcgi_buffer_size 4K; fastcgi_buffers 64 4k; } When you say tag do you mean like this? @saarg Quote Link to post
saarg 413 Posted May 17, 2020 Share Posted May 17, 2020 29 minutes ago, Tucubanito07 said: This is the config i am using under letsencrypt/nginx/proxy-confs/ # REDIRECT WWW TO https://[domain.com] server { listen 80; listen 443 ssl http2; server_name www.domainame.com; return 301 https://domainame.com$request_uri; } # REDIRECT HTTP TRAFFIC TO https://[domain.com] server { listen 80; server_name domainame.com; return 301 https://domainame.com$request_uri; } # BLOG SITE server { listen 443 ssl http2; server_name domainame.com; ## Source: https://github.com/1activegeek/nginx-config-collection ## READ THE COMMENT ON add_header X-Frame-Options AND add_header Content-Security-Policy IF YOU USE THIS ON A SUBDOMAIN YOU WANT TO IFRAME! ## Certificates from LE container placement ssl_certificate /config/keys/letsencrypt/fullchain.pem; ssl_certificate_key /config/keys/letsencrypt/privkey.pem; ## Strong Security recommended settings per cipherli.st ssl_dhparam /config/nginx/dhparams.pem; # Bit value: 4096 ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384; ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0 ssl_session_timeout 10m; ## NOTE: The add_header Content-Security-Policy won't work with duckdns since you don't own the root domain. Just buy a domain. It's cheap ## Settings to add strong security profile (A+ on securityheaders.io/ssllabs.com) add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header X-Robots-Tag none; #SET THIS TO index IF YOU WANT GOOGLE TO INDEX YOU SITE! add_header Content-Security-Policy "frame-ancestors https://*.$server_name https://$server_name"; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe! add_header X-Frame-Options "ALLOW-FROM https://*.$server_name" always; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe! add_header Referrer-Policy "strict-origin-when-cross-origin"; add_header Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;"; #FEATURE POLICY: READ MORE HERE: https://scotthelme.co.uk/a-new-security-header-feature-policy/ proxy_cookie_path / "/; HTTPOnly; Secure"; ##NOTE: This may cause issues with unifi. Remove HTTPOnly; or create another ssl config for unifi. more_set_headers "Server: Classified"; more_clear_headers 'X-Powered-By'; client_max_body_size 0; root /config/www/wordpress/; index index.html index.php; location ~ /\. { deny all; } location / { try_files $uri $uri/ /index.php?_url=$uri&$query_string; } # PHP location ~ \.php$ { fastcgi_split_path_info ^(.+\.php)(/.+)$; # With php7-cgi alone: fastcgi_pass 127.0.0.1:9000; # With php7-fpm: #fastcgi_pass unix:/var/run/php7-fpm.sock; fastcgi_index index.php; include /etc/nginx/fastcgi_params; } fastcgi_buffer_size 4K; fastcgi_buffers 64 4k; } When you say tag do you mean like this? @saarg Finally 😁 Quote Link to post
Tucubanito07 21 Posted May 17, 2020 Share Posted May 17, 2020 2 minutes ago, saarg said: Finally 😁 I apologize. I didnt know what you meant. Quote Link to post
5265 posts in this topic Last Reply
Recommended Posts
Posted by aptalca,
nginx: [alert] detected a LuaJIT version which is not OpenResty's
Recommended by jonathanm
1 reaction
Go to this post
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.