Improve ingress

1 files changed, 26 insertions, 37 deletions

diff --git a/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2
index ae08d46..456a607 100644
--- a/templates/ingress/usr_local_etc_nginx_nginx.conf.j2
+++ b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2
@@ -28,8 +28,6 @@ http {
     }
 
     {% for route in ingress_routes -%}
-    {% if route.jail is defined -%}
-    {% for jail in jails if jail.name == route.jail -%}
     server {
         server_name {{ route.host }};
         http2 on;
@@ -40,20 +38,31 @@ http {
         # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7
         add_header Strict-Transport-Security "max-age=63072000" always;
 
+        # Common hardening headers
+        add_header X-Content-Type-Options nosniff always;
+        add_header X-Frame-Options DENY always;
+        add_header Referrer-Policy strict-origin-when-cross-origin always;
+        add_header Permissions-Policy interest-cohort=();
+
+        # Hide "Server: nginx/1.28.0" header
+        server_tokens off;
+
         ssl_certificate /usr/local/etc/letsencrypt/live/{{ cert_name }}/fullchain.pem;
         ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ cert_name }}/privkey.pem;
         include /usr/local/etc/letsencrypt/options-ssl-nginx.conf;
         ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem;
 
+    {% if route.jail is defined -%}
+    {% for jail in jails if jail.name == route.jail -%}
         location / {
-            proxy_pass http://192.168.2.{{ jail.num }};
+            proxy_pass http://192.168.2.{{ jail.num }}{% if route.port is defined %}:{{ route.port }}{% endif %};
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $scheme;
             {% if jail.name == 'irc_thelounge' -%}
             proxy_http_version 1.1;
-            proxy_set_header Connection "upgrade";
+            proxy_set_header Connection "Upgrade";
             proxy_set_header Upgrade $http_upgrade;
 
             # by default nginx times out connections in one minute
@@ -63,44 +72,24 @@ http {
             proxy_request_buffering off;
 
             client_max_body_size 100M;
+            {% elif jail.name == 'plex' -%}
+            proxy_http_version 1.1;
+            proxy_set_header Connection "Upgrade";
+            proxy_set_header Upgrade $http_upgrade;
+
+            # Streaming-friendly behavior
+            proxy_redirect   off;
+            proxy_buffering  off;
+
+            # Long streams / slow clients
+            proxy_read_timeout  3600s;
+            proxy_send_timeout  3600s;
             {% endif %}
         }
-    }
     {% endfor %}
     {% elif route.redirect is defined -%}
-    server {
-        server_name {{ route.host }};
-        http2 on;
-
-        listen 443 ssl;
-        listen [::]:443 ssl;
-
-        # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7
-        add_header Strict-Transport-Security "max-age=63072000" always;
-
-        ssl_certificate /usr/local/etc/letsencrypt/live/{{ cert_name }}/fullchain.pem;
-        ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ cert_name }}/privkey.pem;
-        include /usr/local/etc/letsencrypt/options-ssl-nginx.conf;
-        ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem;
-
         return 307 https://{{ route.redirect }}$request_uri;
-    }
     {% elif route.ip is defined -%}
-    server {
-        server_name {{ route.host }};
-        http2 on;
-
-        listen 443 ssl;
-        listen [::]:443 ssl;
-
-        # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7
-        add_header Strict-Transport-Security "max-age=63072000" always;
-
-        ssl_certificate /usr/local/etc/letsencrypt/live/{{ cert_name }}/fullchain.pem;
-        ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ cert_name }}/privkey.pem;
-        include /usr/local/etc/letsencrypt/options-ssl-nginx.conf;
-        ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem;
-
         location / {
             proxy_pass http://{{ route.ip }}:{{ route.port }};
             proxy_set_header Host $host;
@@ -121,7 +110,7 @@ http {
 
             client_max_body_size 10G;
         }
-    }
     {% endif %}
+    }
     {% endfor %}
 }