From 95b73daa36b23565a8566f71f9b202d3459b685f Mon Sep 17 00:00:00 2001 From: Sam Chudnick Date: Sun, 25 Jun 2023 09:52:36 -0400 Subject: Initial Commit --- data/jellyfin/jellyfin.conf | 68 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 68 insertions(+) create mode 100644 data/jellyfin/jellyfin.conf (limited to 'data/jellyfin') diff --git a/data/jellyfin/jellyfin.conf b/data/jellyfin/jellyfin.conf new file mode 100644 index 0000000..01f5ea0 --- /dev/null +++ b/data/jellyfin/jellyfin.conf @@ -0,0 +1,68 @@ +server { + listen 443 ssl; + server_name jellyfin.chudnick.com; + + client_max_body_size 20M; + + # use a variable to store the upstream proxy + set $jellyfin 127.0.0.1; + + ssl_certificate /etc/letsencrypt/live/chudnick.com/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/chudnick.com/privkey.pem; + add_header Strict-Transport-Security "max-age=31536000" always; + ssl_stapling on; + ssl_stapling_verify on; + + # Security / XSS Mitigation Headers + add_header X-Frame-Options "SAMEORIGIN"; + add_header X-XSS-Protection "1; mode=block"; + add_header X-Content-Type-Options "nosniff"; + + location = / { + return 302 https://$host/web/; + } + + location / { + # Proxy main Jellyfin traffic + proxy_pass http://$jellyfin:8096; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Protocol $scheme; + proxy_set_header X-Forwarded-Host $http_host; + proxy_buffering off; + } + + location = /web/ { + # Proxy main Jellyfin traffic + proxy_pass http://$jellyfin:8096/web/index.html; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Protocol $scheme; + proxy_set_header X-Forwarded-Host $http_host; + } + + location /socket { + # Proxy Jellyfin Websockets traffic + proxy_pass http://$jellyfin:8096; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Protocol $scheme; + proxy_set_header X-Forwarded-Host $http_host; + } +} + +server { + listen 80; + listen [::]:80; + server_name jellyfin.chudnick.com; + return 301 https://$host$request_uri; +} -- cgit v1.2.3