Bring toomuchio config into the 21st century #58
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,104 +1,207 @@ | ||
| sendfile on; | ||
| tcp_nopush on; | ||
| tcp_nodelay on; | ||
| keepalive_timeout 65; | ||
| types_hash_max_size 2048; | ||
| server_names_hash_bucket_size 512; | ||
| server_names_hash_max_size 512; | ||
| proxy_headers_hash_bucket_size 512; | ||
| proxy_headers_hash_max_size 512; | ||
| include /etc/nginx/mime.types; | ||
| default_type application/octet-stream; | ||
|
|
||
| # SSL Config from https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6 | ||
| ssl_session_cache shared:MozSSL:10m; | ||
| ssl_session_timeout 1d; | ||
|
|
||
| #Upstream to Plex | ||
| upstream plex_backend { | ||
| # Set the port and server to your plex server. | ||
| server 127.0.0.1:32400; | ||
| keepalive 32; | ||
| } | ||
|
|
||
| map $http_upgrade $connection_upgrade { | ||
| default upgrade; | ||
| '' close; | ||
| } | ||
|
|
||
| # For better Plex logging. | ||
| log_format plex '$remote_addr - $remote_user [$time_local]' | ||
| '"$request" $status $body_bytes_sent' | ||
| '"$http_referer" $host "$http_user_agent"' | ||
| '"$request_time" "$upstream_connect_time"' | ||
| '"$geoip_city" "$geoip_city_country_code"'; | ||
|
|
||
| server { | ||
| listen 80; | ||
| listen [::]:80; | ||
| listen 443 ssl http2; | ||
| listen [::]:443 ssl http2; | ||
| # Set this A / AAAA / CNAME record prior to starting. | ||
| server_name plex.EXAMPLE.COM; | ||
| access_log /var/log/nginx/access.log plex; # You can disable this. | ||
| root /srv/; | ||
|
|
||
| ## | ||
| # ACME SSL Cert Generation Method: | ||
| # | ||
| # curl https://get.acme.sh | sh | ||
| # mkdir -p /etc/nginx/ssl/${hostname} | ||
| # chmod 700 /etc/nginx/ssl | ||
| # /root/.acme.sh/acme.sh --set-default-ca --server letsencrypt # No personal data needed to setup | ||
| # Standalone Method | ||
| # /root/.acme.sh/acme.sh --force --issue --standalone -d ${hostname} | ||
| # DNS API Verification Method | ||
| # Reference: https://github.com/acmesh-official/acme.sh/wiki/dnsapi | ||
| # /root/.acme.sh/acme.sh --force --issue --dns dns_cf -d ${hostname} -d "*.${hostname}" | ||
| # Deploy to nginx | ||
| # /root/.acme.sh/acme.sh --force --install-cert -d ${hostname} --key-file /etc/nginx/ssl/${hostname}/key.pem --fullchain-file /etc/nginx/ssl/${hostname}/fullchain.pem --ca-file /etc/nginx/ssl/${hostname}/chain.pem --reloadcmd "systemctl reload nginx" | ||
| # Change the below. | ||
| ## | ||
|
|
||
| ssl_certificate /etc/nginx/ssl/plex.EXAMPLE.COM/fullchain.pem; | ||
| ssl_key /etc/nginx/ssl/plex.EXAMPLE.COM/key.pem; | ||
| ssl_trusted_certificate /etc/nginx/ssl/plex.EXAMPLE.COM/fullchain.pem; | ||
| # Generate by doing openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048 | ||
| ssl_dhparam /etc/nginx/ssl/dhparam.pem; | ||
|
|
||
| # https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6 | ||
| ssl_session_cache shared:MozSSL:10m; | ||
| ssl_session_timeout 1d; | ||
| ssl_protocols TLSv1.2 TLSv1.3; | ||
| ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; | ||
| ssl_prefer_server_ciphers off; | ||
| ssl_stapling on; | ||
| ssl_stapling_verify on; | ||
|
There was a problem hiding this comment. Did you encounter issues having gzip enabled, you accidentally removed it, or just didn't think it helps? |
||
| ssl_buffer_size 4k; | ||
| ssl_early_data on; | ||
|
|
||
| # Security | ||
| add_header X-Frame-Options SAMEORIGIN; | ||
| add_header X-Content-Type-Options "nosniff" always; | ||
| add_header X-XSS-Protection "1; mode=block" always; | ||
| add_header X-Robots-Tag "none" always; | ||
| add_header Referrer-Policy same-origin always; | ||
| proxy_set_header Early-Data $ssl_early_data; | ||
|
|
||
| # Set resolver to Cloudflare | ||
| resolver 1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001] valid=300s; | ||
| resolver_timeout 5s; | ||
| # Some players don't reopen a socket and playback stops totally instead of resuming after an extended pause (e.g. Chrome) | ||
| # You should really just be timing out using plex if the stream is inactive this long. | ||
| send_timeout 100m; | ||
| proxy_headers_hash_bucket_size 128; | ||
| proxy_headers_hash_max_size 1024; | ||
| proxy_buffers 32 4k; | ||
| # Increase body size | ||
| client_max_body_size 1G; | ||
|
|
||
| # If using cloudflare this will resolve user ips correctly. | ||
| set_real_ip_from 103.21.244.0/22; | ||
| set_real_ip_from 103.22.200.0/22; | ||
| set_real_ip_from 103.31.4.0/22; | ||
| set_real_ip_from 104.16.0.0/13; | ||
| set_real_ip_from 104.24.0.0/14; | ||
| set_real_ip_from 108.162.192.0/18; | ||
| set_real_ip_from 131.0.72.0/22; | ||
| set_real_ip_from 141.101.64.0/18; | ||
| set_real_ip_from 162.158.0.0/15; | ||
| set_real_ip_from 172.64.0.0/13; | ||
| set_real_ip_from 173.245.48.0/20; | ||
| set_real_ip_from 188.114.96.0/20; | ||
| set_real_ip_from 190.93.240.0/20; | ||
| set_real_ip_from 197.234.240.0/22; | ||
| set_real_ip_from 198.41.128.0/17; | ||
| set_real_ip_from 2400:cb00::/32; | ||
| set_real_ip_from 2606:4700::/32; | ||
| set_real_ip_from 2803:f800::/32; | ||
| set_real_ip_from 2405:b500::/32; | ||
| set_real_ip_from 2405:8100::/32; | ||
| set_real_ip_from 2c0f:f248::/32; | ||
| set_real_ip_from 2a06:98c0::/29; | ||
| real_ip_header X-Forwarded-For; | ||
|
|
||
| location / { | ||
| # Example of using sub_filter to alter what Plex displays, this disables Plex News. | ||
| # sub_filter ',news,' ','; | ||
| # sub_filter_once on; | ||
| # sub_filter_types text/xml; | ||
| # Websockets | ||
| proxy_set_header Upgrade $http_upgrade; | ||
| proxy_set_header Connection "Upgrade"; | ||
| proxy_redirect off; | ||
| proxy_buffering off; | ||
| proxy_set_header Sec-WebSocket-Extensions $http_sec_websocket_extensions; | ||
| proxy_set_header Sec-WebSocket-Key $http_sec_websocket_key; | ||
| proxy_set_header Sec-WebSocket-Version $http_sec_websocket_version; | ||
| # Plex Headers | ||
| proxy_set_header X-Plex-Client-Identifier $http_x_plex_client_identifier; | ||
| proxy_set_header X-Plex-Container-Size $http_x_plex_container_size; | ||
| proxy_set_header X-Plex-Container-Start $http_x_plex_container_start; | ||
| proxy_set_header X-Plex-Device $http_x_plex_device; | ||
| proxy_set_header X-Plex-Device-Name $http_x_plex_device_name; | ||
| proxy_set_header X-Plex-Platform $http_x_plex_platform; | ||
| proxy_set_header X-Plex-Platform-Version $http_x_plex_platform_version; | ||
| proxy_set_header X-Plex-Product $http_x_plex_product; | ||
| proxy_set_header X-Plex-Token $http_x_plex_token; | ||
| proxy_set_header X-Plex-Version $http_x_plex_version; | ||
| proxy_set_header X-Plex-Nocache $http_x_plex_nocache; | ||
| proxy_set_header X-Plex-Provides $http_x_plex_provides; | ||
| proxy_set_header X-Plex-Device-Vendor $http_x_plex_device_vendor; | ||
| proxy_set_header X-Plex-Model $http_x_plex_model; | ||
| proxy_set_header Host $host; | ||
| proxy_set_header X-Real-IP $http_x_forwarded_for; | ||
| proxy_set_header X-Forwarded-For $remote_addr; | ||
| proxy_set_header X-Forwarded-Proto $scheme; | ||
| # Allows All Encodings | ||
| proxy_set_header Accept-Encoding ""; | ||
| proxy_ssl_verify off; | ||
| proxy_http_version 1.1; | ||
| proxy_read_timeout 86400; | ||
| proxy_pass http://plex_backend; | ||
| } | ||
|
|
||
| ## | ||
| # Forward Tautulli over same domain | ||
| ## | ||
|
|
||
| # location /tautulli { | ||
| # proxy_pass http://127.0.0.1:24200/tautulli; | ||
| # # Advanced Proxy Config | ||
| # proxy_read_timeout 240; | ||
| # proxy_send_timeout 240; | ||
| # proxy_connect_timeout 240; | ||
| # proxy_headers_hash_bucket_size 128; | ||
| # proxy_headers_hash_max_size 1024; | ||
| # proxy_buffers 32 4k; | ||
| # # Basic Proxy Config | ||
| # proxy_set_header Host $host; | ||
| # proxy_set_header X-Real-IP $remote_addr; | ||
| # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| # proxy_set_header X-Forwarded-Proto https; | ||
| # #proxy_redirect http:// $scheme://; | ||
| # proxy_http_version 1.1; | ||
| # proxy_set_header Connection ""; | ||
| # proxy_cache_bypass $cookie_session; | ||
| # proxy_no_cache $cookie_session; | ||
| # } | ||
|
|
||
| ## | ||
| # Host Librespeed on same domain | ||
| # If you want librespeed, install php-fpm libfcgi0ldbl php-cli php-dev php-xml php-curl php-xmlrpc php-json php-mbstring php-opcache php-geoip php-xml | ||
| # Check your php version and modify below accordingly. | ||
| ## | ||
| # location /librespeed { | ||
| # alias /srv/librespeed; | ||
| # client_max_body_size 50M; | ||
| # client_body_buffer_size 128k; | ||
|
|
||
| # location ~ \.php$ { | ||
| # include snippets/fastcgi-php.conf; | ||
| # fastcgi_pass unix:/run/php/php7.4-fpm.sock; | ||
| # fastcgi_param SCRIPT_FILENAME $request_filename; | ||
| # include fastcgi_params; | ||
| # } | ||
| # } | ||
| } | ||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why have you removed this comment? The bandwidth charts in dashboard (Plex Pass feature) no longer work when using your exact config. Changing it to point to my local LAN IP (192.168.1.222), the bandwidth charts work again perfectly. (And yes, I'm using the set_real_ip_from and real_ip_header and such correctly)