feat: forward tcp traffic easily

2025-12-15 22:14:46 +01:00
parent bd2e806aa1
commit ebeb6d5c6b
8 changed files with 287 additions and 2 deletions
@@ -1,7 +1,41 @@
+# Immich vhost with Let's Encrypt (Certbot)
+# Managed by Ansible - DO NOT EDIT MANUALLY
+
 server {
    listen 80;
    server_name {{ immich_nginx_hostname }};

+    # Certbot webroot for ACME challenges
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    # Redirect to HTTPS
+    location / {
+        return 301 https://$server_name$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name {{ immich_nginx_hostname }};
+
+    # Let's Encrypt certificates (managed by Certbot)
+    ssl_certificate /etc/letsencrypt/live/{{ immich_nginx_hostname }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ immich_nginx_hostname }}/privkey.pem;
+
+    # SSL configuration
+    ssl_protocols {{ nginx_ssl_protocols }};
+    ssl_prefer_server_ciphers {{ 'on' if nginx_ssl_prefer_server_ciphers else 'off' }};
+
+{% if nginx_log_backend == 'journald' %}
+    access_log syslog:server=unix:/dev/log,nohostname,tag=nginx_immich;
+    error_log syslog:server=unix:/dev/log,nohostname,tag=nginx_immich;
+{% else %}
+    access_log /var/log/nginx/{{ immich_nginx_hostname }}_access.log main;
+    error_log /var/log/nginx/{{ immich_nginx_hostname }}_error.log;
+{% endif %}
+
    client_max_body_size 50000M;

    location / {