Clément Désiles
5efc0b0d6e
certbot cannot issue for internal hostnames (*.nas.local), which made nginx-enabled services with internal names fail on deploy. Add a <service>_nginx_letsencrypt flag (default false) and computed <service>_nginx_ssl_certificate/_key paths: when off the vhost uses the shared self-signed cert (nginx_default_ssl_cert), when on it uses the Let's Encrypt lineage. Gate the certbot include on the flag and apply the pattern to all service roles (deluge, fdroid, gitea, grafana, immich, metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).
71 lines
2.1 KiB
Django/Jinja
71 lines
2.1 KiB
Django/Jinja
# Immich vhost with Let's Encrypt (Certbot)
|
|
# Managed by Ansible - DO NOT EDIT MANUALLY
|
|
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name {{ immich_nginx_hostname }};
|
|
|
|
# Certbot webroot for ACME challenges
|
|
location /.well-known/acme-challenge/ {
|
|
root /var/www/certbot;
|
|
}
|
|
|
|
# Redirect to HTTPS
|
|
location / {
|
|
return 301 https://$server_name$request_uri;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
http2 on;
|
|
server_name {{ immich_nginx_hostname }};
|
|
|
|
ssl_certificate {{ immich_nginx_ssl_certificate }};
|
|
ssl_certificate_key {{ immich_nginx_ssl_certificate_key }};
|
|
|
|
# SSL configuration
|
|
ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }};
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
{% if nginx_log_backend | default('journald') == 'journald' %}
|
|
access_log syslog:server=unix:/dev/log,nohostname,tag=nginx_immich;
|
|
error_log syslog:server=unix:/dev/log,nohostname,tag=nginx_immich;
|
|
{% else %}
|
|
access_log /var/log/nginx/{{ immich_nginx_hostname }}_access.log main;
|
|
error_log /var/log/nginx/{{ immich_nginx_hostname }}_error.log;
|
|
{% endif %}
|
|
|
|
client_max_body_size 50000M;
|
|
|
|
# Timeouts for slow mobile uploads (client <-> nginx leg)
|
|
client_body_timeout 600s;
|
|
client_header_timeout 600s;
|
|
send_timeout 600s;
|
|
keepalive_timeout 600s;
|
|
|
|
location / {
|
|
proxy_pass http://127.0.0.1:{{ immich_port }};
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
# WebSocket support
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
|
|
# Stream uploads directly to backend instead of buffering full body on disk
|
|
proxy_request_buffering off;
|
|
proxy_buffering off;
|
|
|
|
# Timeouts for large file uploads (nginx <-> immich leg)
|
|
proxy_connect_timeout 600s;
|
|
proxy_read_timeout 600s;
|
|
proxy_send_timeout 600s;
|
|
}
|
|
}
|