update: add all nginx config for each active services

nginx/affine

@@ -0,0 +1,53 @@
+server {
+    if ($host = www.affine.crenam.space) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    if ($host = affine.crenam.space) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+  listen 80;
+  server_name affine.crenam.space www.affine.crenam.space;
+
+  location / {
+    return 301 https://$host$request_uri;
+  }
+
+
+
+
+}
+
+server {
+  listen 443 ssl http2;
+  server_name affine.crenam.space www.affine.crenam.space;
+    ssl_certificate /etc/letsencrypt/live/affine.crenam.space/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/affine.crenam.space/privkey.pem; # managed by Certbot
+
+  # Maximum allowed upload size.
+  client_max_body_size 100m;
+
+  # Set required headers.
+  proxy_set_header Host              $http_host;
+  proxy_set_header X-Real-IP         $remote_addr;
+  proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+  proxy_set_header X-Forwarded-Proto $scheme;
+
+  # WebSocket config for the sync system.
+  proxy_http_version 1.1;
+  proxy_set_header Upgrade           $http_upgrade;
+  proxy_set_header Connection        "upgrade";
+
+  # to add to configs for sso auth
+  # include /etc/nginx/snippets/authelia-verify.conf;
+
+   location / {
+	# to add to configs for sso auth
+	# include /etc/nginx/snippets/authelia-authrequest.conf;
+	proxy_pass http://localhost:3010;
+  }
+}
+

nginx/aliasvault

@@ -0,0 +1,34 @@
+server {
+    if ($host = aliasvault.crenam.space) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen 80;
+    server_name aliasvault.crenam.space;
+    return 301 https://$host$request_uri;
+
+
+}
+
+server {
+    listen 443 ssl http2;
+    server_name aliasvault.crenam.space;
+
+    client_max_body_size 100m;
+
+    location / {
+        proxy_pass http://192.168.1.15:8008;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+	proxy_http_version 1.1;
+	proxy_set_header Upgrade $http_upgrade;
+	proxy_set_header Connection "upgrade";
+	proxy_read_timeout 86400;
+    }
+
+    ssl_certificate /etc/letsencrypt/live/aliasvault.crenam.space/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/aliasvault.crenam.space/privkey.pem; # managed by Certbot
+}

nginx/authelia

@@ -0,0 +1,31 @@
+server {
+    if ($host = auth.crenam.space) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen 80;
+    server_name auth.crenam.space;
+
+    return 301 https://$server_name$request_uri;
+
+
+}
+
+server {
+    listen 443 ssl http2;
+    server_name auth.crenam.space;
+
+    ssl_certificate /etc/letsencrypt/live/auth.crenam.space/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/auth.crenam.space/privkey.pem; # managed by Certbot
+
+    set $upstream http://192.168.27.69:9091;
+
+    location / {
+        include /etc/nginx/snippets/proxy.conf;
+	proxy_pass $upstream;        
+        proxy_cache_bypass $cookie_session;
+        proxy_no_cache $cookie_session;
+    }
+
+}

nginx/default

@@ -0,0 +1,91 @@
+##
+# You should look at the following URL's in order to grasp a solid understanding
+# of Nginx configuration files in order to fully unleash the power of Nginx.
+# https://www.nginx.com/resources/wiki/start/
+# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
+# https://wiki.debian.org/Nginx/DirectoryStructure
+#
+# In most cases, administrators will remove this file from sites-enabled/ and
+# leave it as reference inside of sites-available where it will continue to be
+# updated by the nginx packaging team.
+#
+# This file will automatically load configuration files provided by other
+# applications, such as Drupal or Wordpress. These applications will be made
+# available underneath a path with that package name, such as /drupal8.
+#
+# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
+##
+
+# Default server configuration
+#
+server {
+	listen 80 default_server;
+	listen [::]:80 default_server;
+
+	# SSL configuration
+	#
+	# listen 443 ssl default_server;
+	# listen [::]:443 ssl default_server;
+	#
+	# Note: You should disable gzip for SSL traffic.
+	# See: https://bugs.debian.org/773332
+	#
+	# Read up on ssl_ciphers to ensure a secure configuration.
+	# See: https://bugs.debian.org/765782
+	#
+	# Self signed certs generated by the ssl-cert package
+	# Don't use them in a production server!
+	#
+	# include snippets/snakeoil.conf;
+
+	root /var/www/html;
+
+	# Add index.php to the list if you are using PHP
+	index index.html index.htm index.nginx-debian.html;
+
+	server_name _;
+
+	location / {
+		# First attempt to serve request as file, then
+		# as directory, then fall back to displaying a 404.
+		try_files $uri $uri/ =404;
+	}
+
+	# pass PHP scripts to FastCGI server
+	#
+	#location ~ \.php$ {
+	#	include snippets/fastcgi-php.conf;
+	#
+	#	# With php-fpm (or other unix sockets):
+	#	fastcgi_pass unix:/run/php/php7.4-fpm.sock;
+	#	# With php-cgi (or other tcp sockets):
+	#	fastcgi_pass 127.0.0.1:9000;
+	#}
+
+	# deny access to .htaccess files, if Apache's document root
+	# concurs with nginx's one
+	#
+	#location ~ /\.ht {
+	#	deny all;
+	#}
+}
+
+
+# Virtual Host configuration for example.com
+#
+# You can move that to a different file under sites-available/ and symlink that
+# to sites-enabled/ to enable it.
+#
+#server {
+#	listen 80;
+#	listen [::]:80;
+#
+#	server_name example.com;
+#
+#	root /var/www/example.com;
+#	index index.html;
+#
+#	location / {
+#		try_files $uri $uri/ =404;
+#	}
+#}

nginx/gitea

@@ -0,0 +1,53 @@
+server {
+    if ($host = www.git.crenam.space) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    if ($host = git.crenam.space) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+	listen 80;
+	server_name git.crenam.space www.git.crenam.space;
+	
+	location / {
+		return 301 https://git.crenam.space$request_uri;
+	}
+
+
+
+
+}
+
+server {
+	listen 443 ssl http2;
+	server_name git.crenam.space www.git.crenam.space;
+
+	# ---------- Authelia ----------
+#	include /etc/nginx/snippets/authelia-verify.conf;
+
+	location / {
+	    client_max_body_size 512M;
+
+#	    include /etc/nginx/snippets/authelia-authrequest.conf;
+
+#	    auth_request_set $auth_user $upstream_http_remote_user;
+#	    proxy_set_header X-Webauth-user $auth_user;
+
+	    proxy_pass http://192.168.1.15:3000;
+
+	    proxy_http_version 1.1;
+	    proxy_set_header Connection $http_connection;
+	    proxy_set_header Upgrade $http_upgrade;
+	    proxy_set_header Host $host;
+	    proxy_set_header X-Real-IP $remote_addr;
+	    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+	    proxy_set_header X-Forwarded-Proto $scheme;
+	}
+
+    ssl_certificate /etc/letsencrypt/live/git.crenam.space/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/git.crenam.space/privkey.pem; # managed by Certbot
+
+}

nginx/homarr

@@ -0,0 +1,36 @@
+server {
+    if ($host = www.dashboard.crenam.space) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    if ($host = dashboard.crenam.space) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen 80;
+    server_name dashboard.crenam.space www.dashboard.crenam.space;
+    return 301 https://dashboard.crenam.space$request_uri;
+
+
+
+
+}
+
+server {
+    listen 443 ssl http2;
+    server_name dashboard.crenam.space www.dashboard.crenam.space;
+
+    location / {
+        proxy_pass http://192.168.1.15:7575;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    ssl_certificate /etc/letsencrypt/live/dashboard.crenam.space/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/dashboard.crenam.space/privkey.pem; # managed by Certbot
+
+}

nginx/matrix

@@ -0,0 +1,81 @@
+server {
+	listen 443 ssl http2;
+
+	access_log /var/log/nginx/ess.log;
+	error_log /var/log/nginx/ess.errors;
+	ssl_certificate /etc/letsencrypt/live/ess/fullchain.pem; # managed by Certbot
+	ssl_certificate_key /etc/letsencrypt/live/ess/privkey.pem; # managed by Certbot
+
+	#TLSv1.2 is required for iOS support for now
+	ssl_dhparam /etc/nginx/dhparam.pem;
+	ssl_session_cache shared:le_nginx_SSL:10m;
+	ssl_session_timeout 1440m;
+	ssl_session_tickets off;
+	ssl_buffer_size 4k;
+	# ssl_stapling on;
+	# ssl_stapling_verify on;
+	add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload' always;
+	ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
+
+	server_name admin.element.crenam.space chat.element.crenam.space matrix.element.crenam.space account.element.crenam.space mrtc.element.crenam.space element.crenam.space;
+
+	location / {
+		proxy_pass http://127.0.0.1:8080;
+		proxy_set_header X-Forwarded-For $remote_addr;
+		proxy_set_header X-Forwarded-Proto $scheme;
+		proxy_set_header Host $host;
+
+		client_max_body_size 50M;
+
+		proxy_http_version 1.1;
+		proxy_set_header Upgrade $http_upgrade;
+		proxy_set_header Connection "upgrade";
+
+		proxy_read_timeout 86400s;
+		proxy_send_timeout 86400s;
+		proxy_buffering off;
+	}
+
+
+
+
+
+
+}
+
+server {
+    if ($host = element.crenam.space) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    if ($host = admin.element.crenam.space) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    if ($host = chat.element.crenam.space) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    if ($host = mrtc.element.crenam.space) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    if ($host = account.element.crenam.space) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    if ($host = matrix.element.crenam.space) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen 80;
+    server_name admin.element.crenam.space chat.element.crenam.space matrix.element.crenam.space account.element.crenam.space mrtc.element.crenam.space element.crenam.space;
+    return 301 https://$host$request_uri;
+
+}

nginx/mealie

@@ -0,0 +1,35 @@
+server {
+	listen 80;
+	server_name mealie.crenam.space;
+
+	if ($host = mealie.crenam.space) {
+	return 301 https://$host$request_uri;
+	} # managed by Certbot
+}
+
+server {
+	listen 443 ssl http2;
+	server_name mealie.crenam.space;
+
+	# En-têtes de sécurité
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+	
+	location / {
+		proxy_pass http://192.168.1.30:9925;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+
+        	# Désactiver le buffering pour WebSocket si besoin (Mealie ne semble pas en avoir besoin)
+	        proxy_buffering off;
+	        proxy_http_version 1.1;
+	        proxy_set_header Upgrade $http_upgrade;
+	        proxy_set_header Connection "upgrade";	
+	}
+
+    ssl_certificate /etc/letsencrypt/live/mealie.crenam.space/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/mealie.crenam.space/privkey.pem; # managed by Certbot
+}

nginx/n8n

@@ -0,0 +1,36 @@
+server {
+    if ($host = n8n.crenam.space) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen 80;
+    server_name n8n.crenam.space;
+    return 301 https://$server_name$request_uri;
+
+
+}
+
+server {
+    listen 443 ssl http2;
+    server_name n8n.crenam.space;
+
+    location / {
+        proxy_pass http://192.168.1.30:5678;   # IP de Gaufre sur le réseau local
+
+	client_max_body_size 20M;
+
+        proxy_set_header Host $host;
+	proxy_set_header Upgrade $http_upgrade;
+	proxy_set_header Connection "upgrade";
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Port $server_port;
+    }
+
+
+    ssl_certificate /etc/letsencrypt/live/n8n.crenam.space/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/n8n.crenam.space/privkey.pem; # managed by Certbot
+}

nginx/ntfy

@@ -0,0 +1,67 @@
+# /etc/nginx/sites-*/ntfy
+#
+# This config requires the use of the -L flag in curl to redirect to HTTPS, and it keeps nginx output buffering
+# enabled. While recommended, I have had issues with that in the past.
+
+server {
+    if ($host = ntfy.crenam.space) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+  listen 80;
+  server_name ntfy.crenam.space;
+
+  location / {
+    return 302 https://$http_host$request_uri$is_args$query_string;
+
+    proxy_pass http://192.168.1.15:810;
+    proxy_http_version 1.1;
+
+    proxy_set_header Host $http_host;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+    proxy_connect_timeout 3m;
+    proxy_send_timeout 3m;
+    proxy_read_timeout 3m;
+
+    client_max_body_size 0; # Stream request body to backend
+  }
+
+
+}
+
+server {
+  listen 443 ssl http2;
+  server_name ntfy.crenam.space;
+
+  # See https://ssl-config.mozilla.org/#server=nginx&version=1.18.0&config=intermediate&openssl=1.1.1k&hsts=false&ocsp=false&guideline=5.6
+  ssl_session_timeout 1d;
+  ssl_session_cache shared:MozSSL:10m; # about 40000 sessions
+  ssl_session_tickets off;
+  ssl_protocols TLSv1.2 TLSv1.3;
+  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+  ssl_prefer_server_ciphers off;
+
+
+  location / {
+    proxy_pass http://192.168.1.15:810;
+    proxy_http_version 1.1;
+
+    proxy_set_header Host $http_host;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+    proxy_connect_timeout 3m;
+    proxy_send_timeout 3m;
+    proxy_read_timeout 3m;
+
+    client_max_body_size 0; # Stream request body to backend
+  }
+
+    ssl_certificate /etc/letsencrypt/live/ntfy.crenam.space/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/ntfy.crenam.space/privkey.pem; # managed by Certbot
+}

nginx/openwebui

@@ -0,0 +1,108 @@
+upstream openwebui {
+    # server 10.43.14.141:80;
+    server 51.210.13.240:3000;
+    keepalive 128;
+    keepalive_timeout 1800s;
+    keepalive_requests 10000;
+
+}
+
+server {
+    if ($host = llm.crenam.space) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen 80;
+    listen [::]:80;
+    server_name llm.crenam.space;   # ou un autre sous-domaine
+    return 301 https://$host$request_uri;
+
+
+}
+
+server {
+    listen 443 ssl http2;
+    server_name llm.crenam.space;
+        
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers 'TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-RSA-AES128-GCM-SHA256';
+    ssl_prefer_server_ciphers off;
+
+    gzip on;
+    gzip_types text/plain text/css application/javascript image/svg+xml;
+
+    location /api/ {
+        proxy_pass http://openwebui;
+        proxy_http_version 1.1;
+
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+
+
+        # CRITICAL: Disable all buffering for streaming
+        gzip off;
+        proxy_buffering off;
+        proxy_request_buffering off;
+        proxy_cache off;
+        tcp_nodelay on;
+        add_header X-Accel-Buffering "no" always;
+        add_header Cache-Control "no-store" always;
+
+
+        # Extended timeouts for LLM completions
+        proxy_connect_timeout 1800;
+        proxy_send_timeout 1800;
+        proxy_read_timeout 1800;
+    }
+
+
+
+    # WebSocket connections need even longer timeouts
+
+    location ~ ^/(ws/|socket\.io/) {
+        proxy_pass http://openwebui;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        gzip off;
+        proxy_buffering off;
+        proxy_cache off;
+
+        # 24-hour timeout for persistent connections
+        proxy_connect_timeout 86400;
+        proxy_send_timeout 86400;
+        proxy_read_timeout 86400;	
+    }
+
+
+    # Static assets - CAN buffer and cache
+    location /static/ {
+        proxy_pass http://openwebui;
+        proxy_buffering on;
+        proxy_cache_valid 200 7d;
+        add_header Cache-Control "public, max-age=604800, immutable";
+    }
+
+
+
+    # Default location
+
+    location / {
+        proxy_pass http://openwebui;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+    }
+
+    ssl_certificate /etc/letsencrypt/live/llm.crenam.space/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/llm.crenam.space/privkey.pem; # managed by Certbot
+}

nginx/paperless

@@ -0,0 +1,34 @@
+server {
+    if ($host = paperless.crenam.space) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+	listen 80;
+	server_name paperless.crenam.space;
+	location / {
+		return 301 https://$host$request_uri;
+	}
+
+
+}
+
+server {
+	listen 443 ssl http2;
+	server_name paperless.crenam.space;
+
+	proxy_redirect off;
+        proxy_buffering off;
+
+	# Authelia Remote User 
+	include /etc/nginx/snippets/authelia-location.conf;
+
+	location / {
+		include /etc/nginx/snippets/proxy.conf;
+		include /etc/nginx/snippets/authelia-authrequest.conf;		
+		proxy_pass http://192.168.1.15:8101;
+	}
+
+    ssl_certificate /etc/letsencrypt/live/paperless.crenam.space/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/paperless.crenam.space/privkey.pem; # managed by Certbot
+}

nginx/radicale

@@ -0,0 +1,35 @@
+server {
+    if ($host = www.radicale.crenam.space) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    if ($host = radicale.crenam.space) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen 80;
+    server_name radicale.crenam.space www.radicale.crenam.space;
+    return 301 https://$server_name$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name radicale.crenam.space;
+    client_max_body_size 512M;
+
+    location / {
+        proxy_pass http://192.168.1.20:5232;
+	proxy_set_header X-Script-Name /radicale;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+	proxy_set_header X-Forwarded-Host $host;
+	proxy_set_header X-Forwarded-Port $server_port;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Host $http_host;
+	proxy_pass_header Authorization;
+    }
+
+    ssl_certificate /etc/letsencrypt/live/radicale.crenam.space/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/radicale.crenam.space/privkey.pem; # managed by Certbot
+}

nginx/seafile

@@ -0,0 +1,73 @@
+log_format seafileformat '$http_x_forwarded_for $remote_addr [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $upstream_response_time';
+
+server {
+    if ($host = seafile.crenam.space) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+	listen 80;
+	server_name seafile.crenam.space;
+	location / {
+		return 301 https://$server_name$request_uri;
+	}
+
+
+}
+
+server {
+	listen 443 ssl http2;
+	server_name seafile.crenam.space;
+	
+	include /etc/nginx/snippets/authelia-location.conf;
+
+	location / {
+		include /etc/nginx/snippets/proxy.conf;
+		include /etc/nginx/snippets/authelia-authrequest.conf;
+
+		proxy_pass http://192.168.1.30:80;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header Connection "";
+
+		client_max_body_size 0;
+	}
+
+	location /sdoc-server/ {
+		include /etc/nginx/snippets/proxy.conf;
+
+		proxy_pass         http://192.168.1.30:8888/;
+		client_max_body_size 100m;
+	}
+
+	location /socket.io {
+		include /etc/nginx/snippets/websocket.conf;
+
+		proxy_pass http://192.168.1.30:8888;
+		proxy_redirect off;
+
+		proxy_buffer_size 64k;
+		proxy_buffers 8 32k;
+		proxy_busy_buffers_size 64k;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header Host $http_host;
+		proxy_set_header X-NginX-Proxy true;
+	}
+
+	location /notification/ping {
+	    proxy_pass http://192.168.1.30:8083/ping;
+	    access_log      /var/log/nginx/notification.access.log seafileformat;
+	    error_log       /var/log/nginx/notification.error.log;
+	}
+
+	location /notification {
+		include /etc/nginx/snippets/proxy.conf;	 
+		include /etc/nginx/snippets/websocket.conf;
+
+		proxy_pass http://192.168.1.30:8083;
+		access_log      /var/log/nginx/notification.access.log seafileformat;
+		error_log       /var/log/nginx/notification.error.log;
+	}
+
+    ssl_certificate /etc/letsencrypt/live/seafile.crenam.space/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/seafile.crenam.space/privkey.pem; # managed by Certbot
+}

nginx/vikunja

@@ -0,0 +1,38 @@
+server {
+    if ($host = task.crenam.space) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen 80;
+    server_name task.crenam.space;
+    return 301 https://$server_name$request_uri;
+
+
+}
+
+server {
+    listen 443 ssl http2;
+    server_name task.crenam.space;
+
+    # Protection générale avec Authelia
+#    include /etc/nginx/snippets/authelia-verify.conf;
+
+    location / {
+#        include /etc/nginx/snippets/authelia-authrequest.conf;
+
+        proxy_pass http://192.168.1.30:3456;   # IP de Gaufre sur le réseau local
+
+	client_max_body_size 20M;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Port $server_port;
+    }
+
+    ssl_certificate /etc/letsencrypt/live/task.crenam.space/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/task.crenam.space/privkey.pem; # managed by Certbot
+}