104 lines
3.7 KiB
Plaintext
104 lines
3.7 KiB
Plaintext
# Example external Nginx reverse proxy for Remnawave Minishop.
|
|
#
|
|
# The config assumes this Nginx can resolve Docker service names from the same
|
|
# Compose network. If Nginx runs on the host with the default compose file, use
|
|
# the host-published ports instead:
|
|
# WEBHOOK_BASE_URL -> 127.0.0.1:8080
|
|
# SUBSCRIPTION_MINI_APP_URL -> 127.0.0.1:8082
|
|
# The frontend nginx already proxies internal Web App API/auth requests to
|
|
# backend:8081, so the external proxy does not need path-based locations.
|
|
|
|
upstream remnawave_backend_webhooks {
|
|
server backend:8080;
|
|
keepalive 16;
|
|
}
|
|
|
|
upstream remnawave_frontend {
|
|
server frontend:80;
|
|
keepalive 16;
|
|
}
|
|
|
|
# TLS certificates.
|
|
#
|
|
# Option 1: separate Let's Encrypt certificates per domain. Keep port 80 open
|
|
# and point DNS A/AAAA records to the host that terminates TLS. If Certbot can
|
|
# manage that Nginx directly, run:
|
|
# certbot certonly --nginx -d webhooks.example.com
|
|
# certbot certonly --nginx -d app.example.com
|
|
# Certbot stores them as:
|
|
# /etc/letsencrypt/live/webhooks.example.com/fullchain.pem
|
|
# /etc/letsencrypt/live/webhooks.example.com/privkey.pem
|
|
# /etc/letsencrypt/live/app.example.com/fullchain.pem
|
|
# /etc/letsencrypt/live/app.example.com/privkey.pem
|
|
# If this Nginx is a container, mount /etc/letsencrypt into it read-only or copy
|
|
# the issued certificates into the per-domain folders shown below.
|
|
#
|
|
# Option 2: keep copied certificates in per-domain folders mounted into Nginx
|
|
# as shown in the server blocks below:
|
|
# /etc/nginx/ssl/webhooks.example.com/fullchain.pem
|
|
# /etc/nginx/ssl/webhooks.example.com/privkey.pem
|
|
# /etc/nginx/ssl/app.example.com/fullchain.pem
|
|
# /etc/nginx/ssl/app.example.com/privkey.pem
|
|
#
|
|
# Option 3: use one wildcard certificate for both domains. Wildcards require a
|
|
# DNS-01 challenge, for example with Certbot manual mode or a DNS provider plugin
|
|
# that can renew automatically:
|
|
# certbot certonly --manual --preferred-challenges dns -d example.com -d "*.example.com"
|
|
# Then both server blocks can point to the same certificate:
|
|
# /etc/letsencrypt/live/example.com/fullchain.pem
|
|
# /etc/letsencrypt/live/example.com/privkey.pem
|
|
|
|
server {
|
|
listen 80;
|
|
server_name webhooks.example.com app.example.com;
|
|
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
|
|
# WEBHOOK_BASE_URL.
|
|
# Telegram, payment providers and Remnawave panel webhooks go here.
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name webhooks.example.com;
|
|
|
|
ssl_certificate /etc/nginx/ssl/webhooks.example.com/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/ssl/webhooks.example.com/privkey.pem;
|
|
|
|
client_max_body_size 20m;
|
|
|
|
location / {
|
|
proxy_pass http://remnawave_backend_webhooks;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
# Required for payment provider IP allowlists in webhook handlers.
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
}
|
|
|
|
# SUBSCRIPTION_MINI_APP_URL.
|
|
# The frontend nginx proxies /api, /auth and theme/logo assets to backend:8081.
|
|
server {
|
|
listen 443 ssl;
|
|
http2 on;
|
|
server_name app.example.com;
|
|
|
|
ssl_certificate /etc/nginx/ssl/app.example.com/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/ssl/app.example.com/privkey.pem;
|
|
|
|
client_max_body_size 20m;
|
|
|
|
location / {
|
|
proxy_pass http://remnawave_frontend;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
}
|