85 lines
2.9 KiB
Plaintext
85 lines
2.9 KiB
Plaintext
# HTTP Server Block - REQUIRED for Let's Encrypt and redirects
|
|
server {
|
|
listen 80;
|
|
# listen [::]:80;
|
|
server_name home.seanowiecki.com;
|
|
|
|
# Location for Let's Encrypt HTTP-01 challenge renewal
|
|
# This path must match the webroot path used by the certbot command
|
|
location /.well-known/acme-challenge/ {
|
|
root /var/www/html;
|
|
# Ensure this directory exists in your nginx container
|
|
try_files $uri =404;
|
|
}
|
|
|
|
# Redirect ALL other HTTP traffic to HTTPS
|
|
location / {
|
|
return 301 https://$server_name$request_uri;
|
|
}
|
|
}
|
|
|
|
# HTTPS Server Block - Your existing config, corrected
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name home.seanowiecki.com;
|
|
|
|
# SSL Configuration
|
|
ssl_certificate /etc/letsencrypt/live/home.seanowiecki.com/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/home.seanowiecki.com/privkey.pem;
|
|
|
|
# SSL Settings (your existing settings are good)
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
|
|
ssl_prefer_server_ciphers off;
|
|
ssl_session_cache shared:SSL:10m;
|
|
ssl_session_timeout 1d;
|
|
|
|
# Proxy configuration for Home Assistant
|
|
location / {
|
|
proxy_pass http://192.168.1.98:8123; # Use your Docker service name or IP
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
# Essential WebSocket support headers[citation:2]
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
|
|
# DISABLE buffering for the initial response
|
|
proxy_buffering off;
|
|
|
|
# CRITICAL: Increase timeouts for the initial data load[citation:3]
|
|
proxy_read_timeout 86400s; # Keep connections alive for a long time
|
|
proxy_send_timeout 86400s;
|
|
proxy_connect_timeout 30s;
|
|
|
|
# Optimize buffers for data transfer
|
|
# proxy_buffering off;
|
|
# proxy_buffer_size 128k;
|
|
# proxy_buffers 4 256k;
|
|
# proxy_busy_buffers_size 256k;
|
|
|
|
# Ensure nginx doesn't buffer WebSocket frames
|
|
proxy_http_version 1.1;
|
|
}
|
|
|
|
location /api/websocket {
|
|
proxy_pass http://192.168.1.98:8123;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 86400s; # Keep WS connection alive
|
|
}
|
|
|
|
# Security headers
|
|
add_header X-Frame-Options SAMEORIGIN;
|
|
add_header X-Content-Type-Options nosniff;
|
|
add_header X-XSS-Protection "1; mode=block";
|
|
}
|