diff options
Diffstat (limited to 'adonis/push/default.nix')
| -rw-r--r-- | adonis/push/default.nix | 32 |
1 files changed, 26 insertions, 6 deletions
diff --git a/adonis/push/default.nix b/adonis/push/default.nix index 041ed1f..cc2eff3 100644 --- a/adonis/push/default.nix +++ b/adonis/push/default.nix @@ -3,11 +3,19 @@ ntfyPort = "8080"; mollyPort = "8020"; nginxConf = '' - proxy_set_header Host $host; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_buffering off; + proxy_request_buffering off; + proxy_redirect off; + proxy_connect_timeout 3m; + proxy_send_timeout 3m; + proxy_read_timeout 3m; + client_max_body_size 0; ''; in { sops.secrets = { @@ -41,7 +49,19 @@ in { enableACME = true; locations."/" = { proxyPass = "http://127.0.0.1:${ntfyPort}"; - extraConfig = nginxConf; + extraConfig = '' + set $redirect_https ""; + if ($request_method = GET) { + set $redirect_https "yes"; + } + if ($request_uri ~* "^/([-_a-z0-9]{0,64}$|docs/|static/)") { + set $redirect_https "''${redirect_https}yes"; + } + if ($redirect_https = "yesyes") { + return 302 https://$http_host$request_uri$is_args$query_string; + } + ${nginxConf} + ''; }; }; |