kombucha NGINX pour Mastodon & Nextcloud en reverse-proxy

Je vous passe ma levure utilisée pour générer la configuration de mes différents domaines qui sont gérées par ma passerelle NGINX. C’est un peu comme ça que j’imagine ces fameux fichiers de config. On en trouve sur internet gérés depuis des lustres par d’autres, qu’on s’approprie, qu’on infuse à notre tour sur nos serveurs, et qu’on passe au voisin :p

Pré-requis

Savoir installer un serveur Ubuntu
Savoir configurer son réseau local et le NAT de son routeur
Savoir configurer NGINX un minimum

Ma config

À la maison, ma Livebox laisse passer les connexions entrantes des ports 80, 443, 22 et 2222 uniquement. Les 2 premiers pour la partie web, les 2 suivants pour les connexions SSH de mes 2 serveurs.

Un premier serveur, que j’ai nommé « maman serveur » reçoit toutes les connexions entrantes sur les ports 80 et 443. NGINX va se charger de distribuer les appels au bon endroit :

Mastodon, herbergé localement sur le serveur mère
Nextcloud, herbergé sur un autre serveur fille

J’ai donc 2 fichiers de configuration, chacun va gérer un domaine dédié g33ks.coffee pour le premier et nextcloud.loicrobert.fr pour le second.

Mastodon

Ici mon fichier de configuration que j’ai trouvé en ligne et adapté à mes besoins. Modifie <domaine-vers-mastodon> avec ton domaine.

Attention dans ma configuration j’ai modifié l’adresse du dossier root pour quelle pointe vers l’emplacement personnalisé de mon dossier system de Mastodon pour les médias des membres notamment !

map $http_upgrade $connection_upgrade {
  default upgrade;
  ''      close;
}

upstream backend {
    server 127.0.0.1:3000 fail_timeout=0;
}

upstream streaming {
    server 127.0.0.1:4000 fail_timeout=0;
}

proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=CACHE:10m inactive=7d max_size=1g;

server {
    if ($host = g33ks.coffee) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


  listen 80;
  listen [::]:80;
  server_name <domaine-vers-mastodon>;
  root /home/mastodon/live/public;
  location /.well-known/acme-challenge/ { allow all; }
  location / { return 301 https://$host$request_uri; }


}

server {
  listen 443 ssl http2;
  listen [::]:443 ssl http2;
  server_name <domaine-vers-mastodon>;

  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_ciphers HIGH:!MEDIUM:!LOW:!aNULL:!NULL:!SHA;
  ssl_prefer_server_ciphers on;
  ssl_session_cache shared:SSL:10m;
  ssl_session_tickets off;

  # Uncomment these lines once you acquire a certificate:
    ssl_certificate /etc/letsencrypt/live/<domaine-vers-mastodon>-0001/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/<domaine-vers-mastodon>-0001/privkey.pem; # managed by Certbot

  keepalive_timeout    70;
  sendfile             on;
  client_max_body_size 80m;

  root /home/mastodon/live/public;

  gzip on;
  gzip_disable "msie6";
  gzip_vary on;
  gzip_proxied any;
  gzip_comp_level 6;
  gzip_buffers 16 8k;
  gzip_http_version 1.1;
  gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml image/x-icon;

  location / {
    try_files $uri @proxy;
  }

  # If Docker is used for deployment and Rails serves static files,
  # then needed must replace line `try_files $uri =404;` with `try_files $uri @proxy;`.
  location = /sw.js {
    add_header Cache-Control "public, max-age=604800, must-revalidate";
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
    try_files $uri =404;
  }

  location ~ ^/assets/ {
    add_header Cache-Control "public, max-age=2419200, must-revalidate";
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
    try_files $uri =404;
  }

  location ~ ^/avatars/ {
    add_header Cache-Control "public, max-age=2419200, must-revalidate";
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
    try_files $uri =404;
  }

  location ~ ^/emoji/ {
    add_header Cache-Control "public, max-age=2419200, must-revalidate";
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
    try_files $uri =404;
  }

  location ~ ^/headers/ {
    add_header Cache-Control "public, max-age=2419200, must-revalidate";
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
    try_files $uri =404;
  }

  location ~ ^/packs/ {
    add_header Cache-Control "public, max-age=2419200, must-revalidate";
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
    try_files $uri =404;
  }

  location ~ ^/shortcuts/ {
    add_header Cache-Control "public, max-age=2419200, must-revalidate";
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
    try_files $uri =404;
  }

  location ~ ^/sounds/ {
    add_header Cache-Control "public, max-age=2419200, must-revalidate";
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
    try_files $uri =404;
  }

  location ~ ^/system/ {
    root /data/mastodon;
    add_header Cache-Control "public, max-age=2419200, immutable";
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
    try_files $uri =404;
  }

  location ^~ /api/v1/streaming {
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Proxy "";

    proxy_pass http://streaming;
    proxy_buffering off;
    proxy_redirect off;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;

    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";

    tcp_nodelay on;
  }

  location @proxy {
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Proxy "";
    proxy_pass_header Server;

    proxy_pass http://backend;
    proxy_buffering on;
    proxy_redirect off;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;

    proxy_cache CACHE;
    proxy_cache_valid 200 7d;
    proxy_cache_valid 410 24h;
    proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
    add_header X-Cached $upstream_cache_status;

    tcp_nodelay on;
  }

  error_page 404 500 501 502 503 504 /500.html;
  add_header Content-Security-Policy "default-src 'none'; form-action 'none'";

}

Nextcloud

Ci-dessous mon fichier de configuration que j’ai trouvé en ligne et adapté à ma sauce. Notamment tu devras modifier <domaine-vers-nextcloud> avec ton propre domaine, ainsi qu’adapter le proxy pass vers <adresse-ip-locale-serveur> avec l’adresse IP de ton serveur connecté à ton réseau local.

Attention cette config fonctionne si tu as au préalable installé ton Nextcloud via l’image Docker officielle configurée de façon à être derrière un proxy.

 server {

 listen       443 ssl;
 server_name  <domaine-vers-nextcloud>;
    ssl_certificate /etc/letsencrypt/live/<domaine>-0001/fullchain.pem; # managed by Certbot
   # managed by certbot on host machine
    ssl_certificate_key /etc/letsencrypt/live/<domaine>-0001/privkey.pem; # managed by Certbot
 # managed by certbot on host machine

 
 # static files
 location ^~ /browser {
   resolver localhost;
   proxy_pass http://<ip-locale-du-serveur>:11000$request_uri;
   proxy_set_header Host $http_host;
   proxy_set_header Upgrade $http_upgrade;
   proxy_set_header Connection "Upgrade";
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header X-Forwarded-Port $server_port;
   proxy_set_header X-Forwarded-Scheme $scheme;
   proxy_set_header X-Forwarded-Proto $scheme;
   proxy_set_header X-Real-IP $remote_addr;
   proxy_set_header Accept-Encoding "";

   client_body_buffer_size 512k;
   client_max_body_size 0;
 
   # Websocket
   proxy_http_version 1.1;
   proxy_set_header Upgrade $http_upgrade;
   proxy_set_header Connection $connection_upgrade;
 
   proxy_read_timeout 36000s; 
}

 # WOPI discovery URL
 location ^~ /hosting/discovery {
   resolver localhost;
   proxy_pass http://<ip-locale-du-serveur>:11000$request_uri;
   proxy_set_header Host $http_host;
   proxy_set_header Upgrade $http_upgrade;
   proxy_set_header Connection "Upgrade";
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header X-Forwarded-Port $server_port;
   proxy_set_header X-Forwarded-Scheme $scheme;
   proxy_set_header X-Forwarded-Proto $scheme;
   proxy_set_header X-Real-IP $remote_addr;
   proxy_set_header Accept-Encoding "";

   client_body_buffer_size 512k;
   client_max_body_size 0;
 
   # Websocket
   proxy_http_version 1.1;
   proxy_set_header Upgrade $http_upgrade;
   proxy_set_header Connection $connection_upgrade;
 
   proxy_read_timeout 36000s; 
 }

 # Capabilities
 location ^~ /hosting/capabilities {
   resolver localhost;
   proxy_pass http://<ip-locale-du-serveur>:11000$request_uri;
   proxy_set_header Host $http_host;
   proxy_set_header Upgrade $http_upgrade;
   proxy_set_header Connection "Upgrade";
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header X-Forwarded-Port $server_port;
   proxy_set_header X-Forwarded-Scheme $scheme;
   proxy_set_header X-Forwarded-Proto $scheme;
   proxy_set_header X-Real-IP $remote_addr;
   proxy_set_header Accept-Encoding "";

   client_body_buffer_size 512k;
   client_max_body_size 0;
 
   # Websocket
   proxy_http_version 1.1;
   proxy_set_header Upgrade $http_upgrade;
   proxy_set_header Connection $connection_upgrade;
 
   proxy_read_timeout 36000s; 
 }

 # main websocket
 location ~ ^/cool/(.*)/ws$ {
   resolver localhost;
   proxy_pass http://<ip-locale-du-serveur>:11000$request_uri;
   proxy_set_header Upgrade $http_upgrade;
   proxy_set_header Connection "Upgrade";
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header X-Forwarded-Port $server_port;
   proxy_set_header X-Forwarded-Scheme $scheme;
   proxy_set_header X-Forwarded-Proto $scheme;
   proxy_set_header X-Real-IP $remote_addr;
   proxy_set_header Accept-Encoding "";

   client_body_buffer_size 512k;
   client_max_body_size 0;
 
   # Websocket
   proxy_http_version 1.1;
   proxy_set_header Upgrade $http_upgrade;
   proxy_set_header Connection $connection_upgrade;
 
   proxy_read_timeout 36000s;
 }

 # download, presentation and image upload
 location ~ ^/(c|l)ool {
   resolver localhost;
   proxy_pass http://<ip-locale-du-serveur>:11000$request_uri;
   proxy_set_header Host $http_host;
   proxy_set_header Upgrade $http_upgrade;
   proxy_set_header Connection "Upgrade";
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header X-Forwarded-Port $server_port;
   proxy_set_header X-Forwarded-Scheme $scheme;
   proxy_set_header X-Forwarded-Proto $scheme;
   proxy_set_header X-Real-IP $remote_addr;
   proxy_set_header Accept-Encoding "";

   client_body_buffer_size 512k;
   client_max_body_size 0;
 
   # Websocket
   proxy_http_version 1.1;
   proxy_set_header Upgrade $http_upgrade;
   proxy_set_header Connection $connection_upgrade;
 
   proxy_read_timeout 36000s;
 }

 # Admin Console websocket
 location ^~ /cool/adminws {
   resolver localhost;
   proxy_pass http://<ip-locale-du-serveur>:11000$request_uri;
   proxy_set_header Host $host;
   proxy_set_header Upgrade $http_upgrade;
   proxy_set_header Connection "Upgrade";
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header X-Forwarded-Port $server_port;
   proxy_set_header X-Forwarded-Scheme $scheme;
   proxy_set_header X-Forwarded-Proto $scheme;
   proxy_set_header X-Real-IP $remote_addr;
   proxy_set_header Accept-Encoding "";

   client_body_buffer_size 512k;
   client_max_body_size 0;

   # Websocket
   proxy_http_version 1.1;
   proxy_set_header Upgrade $http_upgrade;
   proxy_set_header Connection $connection_upgrade;
 
   proxy_read_timeout 36000s;
 }

location / {
        resolver localhost; # Note: you need to set a valid dns resolver here or use 127.0.0.1 />
        proxy_pass http://<ip-locale-du-serveur>:11000$request_uri; # Note: you need to change localhost t>

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-Scheme $scheme;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Accept-Encoding "";
        proxy_set_header Host $host;

        client_body_buffer_size 512k;
        proxy_read_timeout 86400s;
        client_max_body_size 0;

        # Websocket
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }



}

Enjoy 😉