2025/01/31 21:37:07 [warn] 490015#490015: protocol options redefined for 0.0.0.0:443 in /etc/nginx/sites-enabled/everyone.melonland.net.conf:13
2025/01/31 21:37:07 [warn] 490015#490015: protocol options redefined for 0.0.0.0:443 in /etc/nginx/sites-enabled/proxy.melonland.net.conf:14
2025/01/31 21:37:07 [warn] 490015#490015: protocol options redefined for [::]:443 in /etc/nginx/sites-enabled/proxy.melonland.net.conf:15
2025/01/31 21:37:07 [warn] 490015#490015: protocol options redefined for 0.0.0.0:443 in /etc/nginx/sites-enabled/surf.melonland.net.conf:14
2025/01/31 21:37:07 [warn] 490015#490015: protocol options redefined for [::]:443 in /etc/nginx/sites-enabled/surf.melonland.net.conf:15
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
# configuration file /etc/nginx/nginx.conf:
user www-data;
worker_processes auto;
pid /run/nginx.pid;
error_log /var/log/nginx/error.log;
include /etc/nginx/modules-enabled/*.conf;

events {
		worker_connections 1024;
		# multi_accept on;
}

http {
		##
		# Basic Settings
		##

		sendfile on;
		tcp_nopush on;
		types_hash_max_size 2048;
		tcp_nodelay on;
		keepalive_timeout  65;
		# server_tokens off;

		# server_names_hash_bucket_size 64;
		# server_name_in_redirect off;

		include /etc/nginx/mime.types;
		default_type application/octet-stream;

		client_max_body_size 100M;

		##
		# SSL Settings
		##

		ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
		ssl_prefer_server_ciphers on;

		# not sure if this works
		proxy_set_header SNI $server_name;

		##
		# Logging Settings
		##

		access_log /var/log/nginx/access.log;

		##
		# Gzip Settings
		##
		gzip on;

		gzip_types text/plain text/css application/json application/javascript text/xml application/xml+rss text/javascript;
		gzip_min_length 1000;
		gzip_comp_level 5;

		# gzip_vary on;
		# gzip_proxied any;
		# gzip_comp_level 6;
		# gzip_buffers 16 8k;
		# gzip_http_version 1.1;
		# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

		##
		# Virtual Host Configs
		##

		include /etc/nginx/conf.d/*.conf;
		include /etc/nginx/sites-enabled/*;
}


#mail {
#       # See sample authentication script at:
#       # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
#       # auth_http localhost/auth.php;
#       # pop3_capabilities "TOP" "USER";
#       # imap_capabilities "IMAP4rev1" "UIDPLUS";
#
#       server {
#               listen     localhost:110;
#               protocol   pop3;
#               proxy      on;
#       }
#
#       server {
#               listen     localhost:143;
#               protocol   imap;
#               proxy      on;
#       }
#}

# configuration file /etc/nginx/mime.types:

types {
	text/html                                        html htm shtml;
	text/css                                         css;
	text/xml                                         xml;
	image/gif                                        gif;
	image/jpeg                                       jpeg jpg;
	application/javascript                           js;
	application/atom+xml                             atom;
	application/rss+xml                              rss;

	text/mathml                                      mml;
	text/plain                                       txt;
	text/vnd.sun.j2me.app-descriptor                 jad;
	text/vnd.wap.wml                                 wml;
	text/x-component                                 htc;

	image/avif                                       avif;
	image/png                                        png;
	image/svg+xml                                    svg svgz;
	image/tiff                                       tif tiff;
	image/vnd.wap.wbmp                               wbmp;
	image/webp                                       webp;
	image/x-icon                                     ico;
	image/x-jng                                      jng;
	image/x-ms-bmp                                   bmp;

	font/woff                                        woff;
	font/woff2                                       woff2;

	application/java-archive                         jar war ear;
	application/json                                 json;
	application/mac-binhex40                         hqx;
	application/msword                               doc;
	application/pdf                                  pdf;
	application/postscript                           ps eps ai;
	application/rtf                                  rtf;
	application/vnd.apple.mpegurl                    m3u8;
	application/vnd.google-earth.kml+xml             kml;
	application/vnd.google-earth.kmz                 kmz;
	application/vnd.ms-excel                         xls;
	application/vnd.ms-fontobject                    eot;
	application/vnd.ms-powerpoint                    ppt;
	application/vnd.oasis.opendocument.graphics      odg;
	application/vnd.oasis.opendocument.presentation  odp;
	application/vnd.oasis.opendocument.spreadsheet   ods;
	application/vnd.oasis.opendocument.text          odt;
	application/vnd.openxmlformats-officedocument.presentationml.presentation
													 pptx;
	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
													 xlsx;
	application/vnd.openxmlformats-officedocument.wordprocessingml.document
													 docx;
	application/vnd.wap.wmlc                         wmlc;
	application/wasm                                 wasm;
	application/x-7z-compressed                      7z;
	application/x-cocoa                              cco;
	application/x-java-archive-diff                  jardiff;
	application/x-java-jnlp-file                     jnlp;
	application/x-makeself                           run;
	application/x-perl                               pl pm;
	application/x-pilot                              prc pdb;
	application/x-rar-compressed                     rar;
	application/x-redhat-package-manager             rpm;
	application/x-sea                                sea;
	application/x-shockwave-flash                    swf;
	application/x-stuffit                            sit;
	application/x-tcl                                tcl tk;
	application/x-x509-ca-cert                       der pem crt;
	application/x-xpinstall                          xpi;
	application/xhtml+xml                            xhtml;
	application/xspf+xml                             xspf;
	application/zip                                  zip;

	application/octet-stream                         bin exe dll;
	application/octet-stream                         deb;
	application/octet-stream                         dmg;
	application/octet-stream                         iso img;
	application/octet-stream                         msi msp msm;

	audio/midi                                       mid midi kar;
	audio/mpeg                                       mp3;
	audio/ogg                                        ogg;
	audio/x-m4a                                      m4a;
	audio/x-realaudio                                ra;

	video/3gpp                                       3gpp 3gp;
	video/mp2t                                       ts;
	video/mp4                                        mp4;
	video/mpeg                                       mpeg mpg;
	video/ogg                                        ogv;
	video/quicktime                                  mov;
	video/webm                                       webm;
	video/x-flv                                      flv;
	video/x-m4v                                      m4v;
	video/x-matroska                                 mkv;
	video/x-mng                                      mng;
	video/x-ms-asf                                   asx asf;
	video/x-ms-wmv                                   wmv;
	video/x-msvideo                                  avi;
}

# configuration file /etc/nginx/sites-enabled/brain.melonking.net.conf:
server {

  server_name brain.melonking.net;

  location / {
	proxy_pass http://localhost:3010; # Change the port if needed
	proxy_http_version 1.1;
	proxy_set_header Upgrade $http_upgrade;
	proxy_set_header Connection 'upgrade';
	proxy_set_header Host $host;
	proxy_cache_bypass $http_upgrade;
  }

  location /ws {
	proxy_pass http://localhost:4906;
	proxy_http_version 1.1;
	proxy_set_header Upgrade $http_upgrade;
	proxy_set_header Connection "Upgrade";
	proxy_set_header Host $host;
  }

  listen 443 ssl; # managed by Certbot
  listen [::]:443 ssl;
	ssl_certificate /etc/letsencrypt/live/toot.melonland.net/fullchain.pem; # managed by Certbot
	ssl_certificate_key /etc/letsencrypt/live/toot.melonland.net/privkey.pem; # managed by Certbot
  include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
  ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot






}

server {
	if ($host = brain.melonking.net) {
	  return 301 https://$host$request_uri;
	} # managed by Certbot

	server_name brain.melonking.net;
	listen 80;
	listen [::]:80;
	return 404; # managed by Certbot
}

# configuration file /etc/letsencrypt/options-ssl-nginx.conf:
# This file contains important security parameters. If you modify this file
# manually, Certbot will be unable to automatically provide future security
# updates. Instead, Certbot will print and log an error message with a path to
# the up-to-date file that you will need to refer to when manually updating
# this file. Contents are based on https://ssl-config.mozilla.org

ssl_session_cache shared:le_nginx_SSL:10m;
ssl_session_timeout 1440m;
ssl_session_tickets off;

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;

ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";

# configuration file /etc/nginx/sites-enabled/default:
##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# https://www.nginx.com/resources/wiki/start/
# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
# https://wiki.debian.org/Nginx/DirectoryStructure
#
# In most cases, administrators will remove this file from sites-enabled/ and
# leave it as reference inside of sites-available where it will continue to be
# updated by the nginx packaging team.
#
# This file will automatically load configuration files provided by other
# applications, such as Drupal or Wordpress. These applications will be made
# available underneath a path with that package name, such as /drupal8.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##

# Default server configuration
#
server {
		listen 80 default_server;
		listen [::]:80 default_server;

		# SSL configuration
		#
		# listen 443 ssl default_server;
		# listen [::]:443 ssl default_server;
		#
		# Note: You should disable gzip for SSL traffic.
		# See: https://bugs.debian.org/773332
		#
		# Read up on ssl_ciphers to ensure a secure configuration.
		# See: https://bugs.debian.org/765782
		#
		# Self signed certs generated by the ssl-cert package
		# Don't use them in a production server!
		#
		# include snippets/snakeoil.conf;

		root /var/www/html;

		# Add index.php to the list if you are using PHP
		index index.html index.htm index.nginx-debian.html;

		server_name _;

		location / {
				# First attempt to serve request as file, then
				# as directory, then fall back to displaying a 404.
				try_files $uri $uri/ =404;
		}

		# pass PHP scripts to FastCGI server
		#
		#location ~ \.php$ {
		#       include snippets/fastcgi-php.conf;
		#
		#       # With php-fpm (or other unix sockets):
		#       fastcgi_pass unix:/run/php/php7.4-fpm.sock;
		#       # With php-cgi (or other tcp sockets):
		#       fastcgi_pass 127.0.0.1:9000;
		#}

		# deny access to .htaccess files, if Apache's document root
		# concurs with nginx's one
		#
		#location ~ /\.ht {
		#       deny all;
		#}
}


# Virtual Host configuration for example.com
#
# You can move that to a different file under sites-available/ and symlink that
# to sites-enabled/ to enable it.
#
#server {
#       listen 80;
#       listen [::]:80;
#
#       server_name example.com;
#
#       root /var/www/example.com;
#       index index.html;
#
#       location / {
#               try_files $uri $uri/ =404;
#       }
#}

# configuration file /etc/nginx/sites-enabled/dynmap.melonland.net.conf:
server {
	if ($host = dynmap.melonland.net) {
		return 301 https://$host$request_uri;
	} # managed by Certbot


	listen 80;
	server_name dynmap.melonland.net;
	return 301 https://$server_name$request_uri;


}

server {
	listen 443;
	
	server_name dynmap.melonland.net;
	# We need to pass the request to server so that
	# if it is hosting multiple sites hosted, it knows which one to serve
	proxy_set_header Host dynmap.melonland.net;

	location / {
		proxy_pass http://51.222.22.81:8085;
	}
	ssl_certificate /etc/letsencrypt/live/toot.melonland.net/fullchain.pem; # managed by Certbot
	ssl_certificate_key /etc/letsencrypt/live/toot.melonland.net/privkey.pem; # managed by Certbot

}

# configuration file /etc/nginx/sites-enabled/everyone.melonland.net.conf:
server {
  server_name everyone.melonland.net;

  location / {
	proxy_pass http://localhost:3030;
	proxy_http_version 1.1;
	proxy_set_header Upgrade $http_upgrade;
	proxy_set_header Connection 'upgrade';
	proxy_set_header Host $host;
	proxy_cache_bypass $http_upgrade;
  }

  listen 443 ssl; # managed by Certbot
  listen [::]:443 ssl;
  http2 on;
	ssl_certificate /etc/letsencrypt/live/toot.melonland.net/fullchain.pem; # managed by Certbot
	ssl_certificate_key /etc/letsencrypt/live/toot.melonland.net/privkey.pem; # managed by Certbot
  include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
  ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot



}

server {
	if ($host = everyone.melonland.net) {
	  return 301 https://$host$request_uri;
	} # managed by Certbot


  server_name everyone.melonland.net;
	listen 80;
	listen [::]:80;
	return 404; # managed by Certbot
}

# configuration file /etc/nginx/sites-enabled/forum.melonland.net.conf:
server {
	listen 443 ssl;
	#listen [::]:443 ssl;
	http2 on;

	server_name forum.melonking.net forum.melonland.net;
	proxy_ssl_name toot.melonland.net;
	root /home/daniel/zones/forum;

	add_header X-Frame-Options ALLOW;

	index index.html index.htm index.php;
	

	if ($host = forum.melonking.net) {
		return 301 https://forum.melonland.net$request_uri;
	}

	location / {
		try_files $uri $uri/ =404;
	}

	location ~ \.php$ {
		include snippets/fastcgi-php.conf;
		fastcgi_pass unix:/var/run/php/php8.3-fpm.sock;
		fastcgi_read_timeout 240;
	}

	location ~* \.(eot|otf|ttf|woff|woff2)$ {
		add_header Access-Control-Allow-Origin *;
	}

	location ~ /\.ht {
		deny all;
	}
	ssl_certificate /etc/letsencrypt/live/toot.melonland.net/fullchain.pem; # managed by Certbot
	ssl_certificate_key /etc/letsencrypt/live/toot.melonland.net/privkey.pem; # managed by Certbot




}

server {
	if ($host = forum.melonking.net) {
		return 301 https://$host$request_uri;
	} # managed by Certbot

	if ($host = forum.melonland.net) {
		return 301 https://$host$request_uri;
	}

	server_name forum.melonland.net forum.melonking.net;

	listen 80;
	#listen [::]:80;
	return 404; # managed by Certbot




}

# configuration file /etc/nginx/snippets/fastcgi-php.conf:
# regex to split $uri to $fastcgi_script_name and $fastcgi_path
fastcgi_split_path_info ^(.+?\.php)(/.*)$;

# Check that the PHP script exists before passing it
try_files $fastcgi_script_name =404;

# Bypass the fact that try_files resets $fastcgi_path_info
# see: http://trac.nginx.org/nginx/ticket/321
set $path_info $fastcgi_path_info;
fastcgi_param PATH_INFO $path_info;

fastcgi_index index.php;
include fastcgi.conf;

# configuration file /etc/nginx/fastcgi.conf:

fastcgi_param  SCRIPT_FILENAME    $document_root$fastcgi_script_name;
fastcgi_param  QUERY_STRING       $query_string;
fastcgi_param  REQUEST_METHOD     $request_method;
fastcgi_param  CONTENT_TYPE       $content_type;
fastcgi_param  CONTENT_LENGTH     $content_length;

fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
fastcgi_param  REQUEST_URI        $request_uri;
fastcgi_param  DOCUMENT_URI       $document_uri;
fastcgi_param  DOCUMENT_ROOT      $document_root;
fastcgi_param  SERVER_PROTOCOL    $server_protocol;
fastcgi_param  REQUEST_SCHEME     $scheme;
fastcgi_param  HTTPS              $https if_not_empty;

fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;

fastcgi_param  REMOTE_ADDR        $remote_addr;
fastcgi_param  REMOTE_PORT        $remote_port;
fastcgi_param  REMOTE_USER        $remote_user;
fastcgi_param  SERVER_ADDR        $server_addr;
fastcgi_param  SERVER_PORT        $server_port;
fastcgi_param  SERVER_NAME        $server_name;

# PHP only, required if PHP was built with --enable-force-cgi-redirect
fastcgi_param  REDIRECT_STATUS    200;

# configuration file /etc/nginx/sites-enabled/freshrss.melonking.net.conf:
server {
	server_name freshrss.melonking.net;
	root /home/daniel/zones/fresh-rss/p;

	index index.html index.htm index.php;

	access_log /var/log/nginx/rss.access.log;
	error_log /var/log/nginx/rss.error.log;

	# php files handling
	# this regex is mandatory because of the API
	location ~ ^.+?\.php(/.*)?$ {
		fastcgi_pass unix:/var/run/php/php-fpm.sock;
		fastcgi_split_path_info ^(.+\.php)(/.*)$;
		# By default, the variable PATH_INFO is not set under PHP-FPM
		# But FreshRSS API greader.php need it. If you have a “Bad Request” error, double check this var!
		# NOTE: the separate $path_info variable is required. For more details, see:
		# https://trac.nginx.org/nginx/ticket/321
		set $path_info $fastcgi_path_info;
		fastcgi_param PATH_INFO $path_info;
		include fastcgi_params;
		fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
	}

	location / {
		try_files $uri $uri/ index.php;
	}

	listen 443 ssl; # managed by Certbot
	listen [::]:443 ssl;
	ssl_certificate /etc/letsencrypt/live/toot.melonland.net/fullchain.pem; # managed by Certbot
	ssl_certificate_key /etc/letsencrypt/live/toot.melonland.net/privkey.pem; # managed by Certbot
	include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot







}

server {
	if ($host = freshrss.melonking.net) {
		return 301 https://$host$request_uri;
	} # managed by Certbot

	server_name freshrss.melonking.net;

	listen 80;
	listen [::]:80;

	return 404; # managed by Certbot
}

# configuration file /etc/nginx/fastcgi_params:

fastcgi_param  QUERY_STRING       $query_string;
fastcgi_param  REQUEST_METHOD     $request_method;
fastcgi_param  CONTENT_TYPE       $content_type;
fastcgi_param  CONTENT_LENGTH     $content_length;

fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
fastcgi_param  REQUEST_URI        $request_uri;
fastcgi_param  DOCUMENT_URI       $document_uri;
fastcgi_param  DOCUMENT_ROOT      $document_root;
fastcgi_param  SERVER_PROTOCOL    $server_protocol;
fastcgi_param  REQUEST_SCHEME     $scheme;
fastcgi_param  HTTPS              $https if_not_empty;

fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;

fastcgi_param  REMOTE_ADDR        $remote_addr;
fastcgi_param  REMOTE_PORT        $remote_port;
fastcgi_param  REMOTE_USER        $remote_user;
fastcgi_param  SERVER_ADDR        $server_addr;
fastcgi_param  SERVER_PORT        $server_port;
fastcgi_param  SERVER_NAME        $server_name;

# PHP only, required if PHP was built with --enable-force-cgi-redirect
fastcgi_param  REDIRECT_STATUS    200;

# configuration file /etc/nginx/sites-enabled/images.melonland.net.conf:
server {    
	server_name images.melonland.net;
	proxy_set_header Host images.melonland.net;
	proxy_http_version 1.1;
	proxy_set_header Upgrade $http_upgrade;
	proxy_set_header Connection "Upgrade";

	location / {
		proxy_pass http://127.0.0.1:8055;
	}

	listen [::]:443 ssl ipv6only=on; # managed by Certbot
	listen 443 ssl; # managed by Certbot
	ssl_certificate /etc/letsencrypt/live/toot.melonland.net/fullchain.pem; # managed by Certbot
	ssl_certificate_key /etc/letsencrypt/live/toot.melonland.net/privkey.pem; # managed by Certbot
	include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot









}

server {
	if ($host = images.melonland.net) {
		return 301 https://$host$request_uri;
	} # managed by Certbot

	listen 80;
	listen [::]:80;    

	server_name images.melonland.net;
	return 404; # managed by Certbot
}

# configuration file /etc/nginx/sites-enabled/letters.melonland.net.conf:
server {
	server_name letters.melonland.net;
	proxy_ssl_name toot.melonland.net;
	proxy_set_header SNI $server_name;
	root /home/daniel/zones/letters/website;

	index index.html index.php;

	access_log /var/log/nginx/rss.access.log;
	error_log /var/log/nginx/rss.error.log;

	# php files handling
	# this regex is mandatory because of the API
	location ~ ^.+?\.php(/.*)?$ {
		fastcgi_pass unix:/var/run/php/php-fpm.sock;
		fastcgi_split_path_info ^(.+\.php)(/.*)$;
		# By default, the variable PATH_INFO is not set under PHP-FPM
		# But FreshRSS API greader.php need it. If you have a “Bad Request” error, double check this var!
		# NOTE: the separate $path_info variable is required. For more details, see:
		# https://trac.nginx.org/nginx/ticket/321
		set $path_info $fastcgi_path_info;
		fastcgi_param PATH_INFO $path_info;
		include fastcgi_params;
		fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
	}

	location / {
		try_files $uri $uri/ index.php;
	}

	listen 443 ssl; # managed by Certbot
	listen [::]:443 ssl;
	ssl_certificate /etc/letsencrypt/live/toot.melonland.net/fullchain.pem; # managed by Certbot
	ssl_certificate_key /etc/letsencrypt/live/toot.melonland.net/privkey.pem; # managed by Certbot
	include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot


}

server {
	if ($host = letters.melonland.net) {
		return 301 https://$host$request_uri;
	} # managed by Certbot

	server_name letters.melonland.net;

	listen 80;
	listen [::]:80;

	return 404; # managed by Certbot
}

# configuration file /etc/nginx/sites-enabled/loom.cafe.conf:
server {
	http2 on;

	server_name loom.cafe;
	root /home/daniel/websites/loom-cafe;

	index index.html;

	location ~ /\. {
		deny all;
	}

	location / {
		add_header X-Frame-Options ALLOW;
		index index.html;
		try_files $uri $uri/ =404;
	}

	listen [::]:443 ssl; # managed by Certbot
	listen 443 ssl; # managed by Certbot
	ssl_certificate /etc/letsencrypt/live/toot.melonland.net/fullchain.pem; # managed by Certbot
	ssl_certificate_key /etc/letsencrypt/live/toot.melonland.net/privkey.pem; # managed by Certbot
	include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot




}

server {
	if ($host = loom.cafe) {
		return 301 https://$host$request_uri;
	} # managed by Certbot


	listen 80;
	listen [::]:80;

	server_name loom.cafe;
	return 404; # managed by Certbot
}

# configuration file /etc/nginx/sites-enabled/ozway.art.conf:
server {
	http2 on;

	server_name ozway.art;
	root /home/daniel/websites/ozway-art;

	index index.html;

	location ~ /\. {
		deny all;
	}

	location / {
		add_header X-Frame-Options ALLOW;
		index index.html;
		try_files $uri $uri/ =404;
	}

	location ~* \.(html|htm)$ {
		# kill cache
		add_header Last-Modified $date_gmt;
		add_header Cache-Control 'private no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
		if_modified_since off;
		expires off;
		etag off;
	}

	listen [::]:443 ssl; # managed by Certbot
	listen 443 ssl; # managed by Certbot
	ssl_certificate /etc/letsencrypt/live/toot.melonland.net/fullchain.pem; # managed by Certbot
	ssl_certificate_key /etc/letsencrypt/live/toot.melonland.net/privkey.pem; # managed by Certbot
	include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot









}
server {
	if ($host = ozway.art) {
		return 301 https://$host$request_uri;
	} # managed by Certbot


	listen 80;
	listen [::]:80;

	server_name ozway.art;
	return 404; # managed by Certbot


}
# configuration file /etc/nginx/sites-enabled/ozwomp.online.conf:
server {
	server_name ozwomp.online;
	root /home/daniel/websites/ozwomp-online;

	index index.html;

	location ~ /\. {
		deny all;
	}

	location / {
		add_header X-Frame-Options ALLOW;
		index index.html;
		try_files $uri $uri/ =404;
	}

	location ~* \.(html|htm)$ {
		# kill cache
		add_header Last-Modified $date_gmt;
		add_header Cache-Control 'private no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
		if_modified_since off;
		expires off;
		etag off;
	}


	listen 443 ssl; # managed by Certbot
	listen [::]:443 ssl;
	http2 on;
	ssl_certificate /etc/letsencrypt/live/toot.melonland.net/fullchain.pem; # managed by Certbot
	ssl_certificate_key /etc/letsencrypt/live/toot.melonland.net/privkey.pem; # managed by Certbot
	include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot






}

server {
	if ($host = ozwomp.online) {
		return 301 https://$host$request_uri;
	} # managed by Certbot

	server_name ozwomp.online;

	listen 80;
	listen [::]:80;
	return 404; # managed by Certbot
}

# configuration file /etc/nginx/sites-enabled/pad.melonland.net.conf:
server {
  server_name pad.melonland.net;

  add_header Content-Security-Policy "frame-ancestors self pad.melonland.net forum.melonland.net melonking.net loom.cafe";

  location / {
	proxy_pass http://localhost:9001;
	proxy_buffering off;
	proxy_set_header Host $host;
	proxy_pass_header  Server;
	proxy_set_header    X-Real-IP $remote_addr;
	proxy_set_header    X-Forwarded-For $remote_addr; # EP logs to show the actual remote IP
	proxy_set_header    X-Forwarded-Proto $scheme; # for EP to set secure cookie flag when https is used
	proxy_http_version  1.1; # recommended with keepalive connections
	proxy_set_header  Upgrade $http_upgrade;
	proxy_set_header Connection "Upgrade";
  }

  listen 443 ssl; # managed by Certbot
  listen [::]:443 ssl;
	ssl_certificate /etc/letsencrypt/live/toot.melonland.net/fullchain.pem; # managed by Certbot
	ssl_certificate_key /etc/letsencrypt/live/toot.melonland.net/privkey.pem; # managed by Certbot
  include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
  ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot







}

server {
  if ($host = pad.melonland.net) {
	  return 301 https://$host$request_uri;
  } # managed by Certbot

  server_name pad.melonland.net;
	listen 80;
	listen [::]:80;
	return 404; # managed by Certbot
}

# configuration file /etc/nginx/sites-enabled/proxy.melonland.net.conf:
server {
	if ($host = proxy.melonland.net) {
		return 301 https://$host$request_uri;
	} # managed by Certbot

	listen 80;
	listen [::]:80;

	server_name proxy.melonland.net;
	return 301 https://$server_name$request_uri;
}

server {
	listen 443;
	listen [::]:443;

	resolver 1.1.1.1 8.8.8.8;

	server_name proxy.melonland.net;

	location  ~ / {
		if ( $arg_url = '') {
			return 400 "No proxy url provided";
		}
		proxy_pass $arg_url;
	}
	ssl_certificate /etc/letsencrypt/live/toot.melonland.net/fullchain.pem; # managed by Certbot
	ssl_certificate_key /etc/letsencrypt/live/toot.melonland.net/privkey.pem; # managed by Certbot









}

# configuration file /etc/nginx/sites-enabled/surf.melonland.net.conf:
server {

  server_name surf.melonland.net;

  location / {
	proxy_pass http://localhost:3020; # Change the port if needed
	proxy_http_version 1.1;
	proxy_set_header Upgrade $http_upgrade;
	proxy_set_header Connection 'upgrade';
	proxy_set_header Host $host;
	proxy_cache_bypass $http_upgrade;
  }

  listen 443 ssl; # managed by Certbot
  listen [::]:443 ssl;
  http2 on;
	ssl_certificate /etc/letsencrypt/live/toot.melonland.net/fullchain.pem; # managed by Certbot
	ssl_certificate_key /etc/letsencrypt/live/toot.melonland.net/privkey.pem; # managed by Certbot
  include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
  ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot






}

server {
	if ($host = surf.melonland.net) {
	  return 301 https://$host$request_uri;
	} # managed by Certbot

	server_name surf.melonland.net;
	listen 80;
	listen [::]:80;
	return 404; # managed by Certbot
}

# configuration file /etc/nginx/sites-enabled/tamanotchi.world.conf:
server {
		server_name tamanotchi.world;
		root /home/daniel/zones/tamaNOTchi/website;

		add_header X-Frame-Options ALLOW;

		index index.html index.php;

		error_page 404 /includes/404.php;
		error_page 403 /includes/403.php;

		#if ($remote_addr != 37.228.253.96) {
		#  rewrite ^/(?!.*\.(css|png)$) /includes/503.php break;
		#}

		location ~ \.php$ {
		  include snippets/fastcgi-php.conf;
		  fastcgi_pass unix:/var/run/php/php8.3-fpm.sock;
		}

		location / {
		  rewrite ^/([0-9]+)$ /?id=$1;
		  rewrite ^/([0-9]+)(c)$ /?id=$1&c=1 break;
		}

		location /u {
		  rewrite ^/u/([0-9]+)$ /user/?id=$1 break;
		}

		location /f {
		  rewrite ^/f/([0-9]+)$ /family/?id=$1 break;
		}

		location = /my/new {
		  rewrite ^(.*)$ /my/?mode=new break;
		}

		location /my {
		  rewrite ^/my/edit/([0-9]+)$ /my/?mode=edit&id=$1 break;
		  rewrite ^/my/equip/([0-9]+)$ /my/?mode=edit&id=$1 break;
		  rewrite ^/my/items/([0-9]+)$ /my/?mode=edit&id=$1 break;
		  rewrite ^/my/adopt/([0-9]+)$ /my/?mode=adopt&id=$1 break;
		}

		location = /adopt {
		  rewrite ^(.*)$ /user/?id=1 break;
		}

		location /i {
		  rewrite ^/i/([0-9]+)$ /img/?id=$1 break;
		}

		location /i2 {
		  rewrite ^/i2/([0-9]+)$ /img2/?id=$1 break;
		}

		location = /settings/username {
		  rewrite ^(.*)$ /settings/?change=un break;
		}

		location = /settings/email {
		  rewrite ^(.*)$ /settings/?change=em break;
		}

		location = /settings/password {
		  rewrite ^(.*)$ /settings/?change=pw break;
		}

		location = /settings/css {
		  rewrite ^(.*)$ /settings/?change=css break;
		}

		location /leaderboard {
		  rewrite ^/leaderboard/([0-9]+)$ /leaderboard/?page=$1 break;
		}

		location ~ .db$ {
		  deny all;
		}

		location ~ pet2?\.png$ {
		  deny all;
		}

	location ~* \.(eot|otf|ttf|woff|woff2)$ {
	  add_header Access-Control-Allow-Origin *;
	}

	listen 443 ssl; # managed by Certbot
	listen [::]:443 ssl;
	http2 on;
	ssl_certificate /etc/letsencrypt/live/toot.melonland.net/fullchain.pem; # managed by Certbot
	ssl_certificate_key /etc/letsencrypt/live/toot.melonland.net/privkey.pem; # managed by Certbot
	include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot


}

server {
	if ($host = tamanotchi.world) {
		return 301 https://$host$request_uri;
	} # managed by Certbot

	server_name tamanotchi.world;

	listen 80;
	listen [::]:80;
	return 404; # managed by Certbot
}

# configuration file /etc/nginx/sites-enabled/thoughts.melonking.net.conf:
server {
	server_name thoughts.melonking.net;
	root /home/daniel/zones/thoughts;

	index index.html index.htm index.php;

	location ~ /\. {
		deny all;
	}

	location / {
		add_header X-Frame-Options ALLOW;
		index index.php;
		try_files $uri $uri/ /index.php?$args;
	}

	location ~ \.php$ {
		add_header X-Frame-Options ALLOW;
		fastcgi_pass unix:/var/run/php/php-fpm.sock;
		fastcgi_index index.php;
		include fastcgi_params;
		fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
	 }

	location ^~ /themes/\.txp$ {
		return 403;
	}

	listen 443 ssl; # managed by Certbot
	listen [::]:443 ssl;
	ssl_certificate /etc/letsencrypt/live/toot.melonland.net/fullchain.pem; # managed by Certbot
	ssl_certificate_key /etc/letsencrypt/live/toot.melonland.net/privkey.pem; # managed by Certbot
	include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot






}

server {
	if ($host = thoughts.melonking.net) {
		return 301 https://$host$request_uri;
	} # managed by Certbot

	listen 80;
	listen [::]:80;
	server_name thoughts.melonking.net;
	return 404; # managed by Certbot
}

# configuration file /etc/nginx/sites-enabled/toot.melonland.net.conf:
map $http_upgrade $connection_upgrade {
  default upgrade;
  ''      close;
}

upstream backend {
	server 127.0.0.1:3000 fail_timeout=0;
}

upstream streaming {
	# Instruct nginx to send connections to the server with the least number of connections
	# to ensure load is distributed evenly.
	least_conn;

	server 127.0.0.1:4000 fail_timeout=0;
	# Uncomment these lines for load-balancing multiple instances of streaming for scaling,
	# this assumes your running the streaming server on ports 4000, 4001, and 4002:
	# server 127.0.0.1:4001 fail_timeout=0;
	# server 127.0.0.1:4002 fail_timeout=0;
}

proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=CACHE:10m inactive=7d max_size=1g;

server {
	if ($host = toot.melonland.net) {
		return 301 https://$host$request_uri;
	} # managed by Certbot


  listen 80;
  listen [::]:80;
  http2 on;
  server_name toot.melonland.net;
  root /home/mastodon/live/public;
  location /.well-known/acme-challenge/ { allow all; }
  location / { return 301 https://$host$request_uri; }


}

server {
  listen 443 ssl;
  listen [::]:443 ssl;
  http2 on;
  server_name toot.melonland.net;

  ssl_protocols TLSv1.2 TLSv1.3;

  # You can use https://ssl-config.mozilla.org/ to generate your cipher set.
  # We recommend their "Intermediate" level.
  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;

  ssl_prefer_server_ciphers on;
  ssl_session_cache shared:SSL:10m;
  ssl_session_tickets off;

  # Uncomment these lines once you acquire a certificate:
	ssl_certificate /etc/letsencrypt/live/toot.melonland.net/fullchain.pem; # managed by Certbot
	ssl_certificate_key /etc/letsencrypt/live/toot.melonland.net/privkey.pem; # managed by Certbot

  keepalive_timeout    70;
  sendfile             on;
  client_max_body_size 99m;

  root /home/mastodon/live/public;

  gzip on;
  gzip_disable "msie6";
  gzip_vary on;
  gzip_proxied any;
  gzip_comp_level 6;
  gzip_buffers 16 8k;
  gzip_http_version 1.1;
  gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml image/x-icon;

  location / {
	try_files $uri @proxy;
  }

  # If Docker is used for deployment and Rails serves static files,
  # then needed must replace line `try_files $uri =404;` with `try_files $uri @proxy;`.
  location = /sw.js {
	add_header Cache-Control "public, max-age=604800, must-revalidate";
	add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
	try_files $uri =404;
  }

  location ~ ^/assets/ {
	add_header Cache-Control "public, max-age=2419200, must-revalidate";
	add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
	try_files $uri =404;
  }

  location ~ ^/avatars/ {
	add_header Cache-Control "public, max-age=2419200, must-revalidate";
	add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
	try_files $uri =404;
  }

  location ~ ^/emoji/ {
	add_header Cache-Control "public, max-age=2419200, must-revalidate";
	add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
	try_files $uri =404;
  }

  location ~ ^/headers/ {
	add_header Cache-Control "public, max-age=2419200, must-revalidate";
	add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
	try_files $uri =404;
  }

  location ~ ^/packs/ {
	add_header Cache-Control "public, max-age=2419200, must-revalidate";
	add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
	try_files $uri =404;
  }

  location ~ ^/shortcuts/ {
	add_header Cache-Control "public, max-age=2419200, must-revalidate";
	add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
	try_files $uri =404;
  }

  location ~ ^/sounds/ {
	add_header Cache-Control "public, max-age=2419200, must-revalidate";
	add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
	try_files $uri =404;
  }

  location ~ ^/system/ {
	add_header Cache-Control "public, max-age=2419200, immutable";
	add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
	add_header X-Content-Type-Options nosniff;
	add_header Content-Security-Policy "default-src 'none'; form-action 'none'";
	try_files $uri =404;
  }

  location ^~ /api/v1/streaming {
	proxy_set_header Host $host;
	proxy_set_header X-Real-IP $remote_addr;
	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	proxy_set_header X-Forwarded-Proto $scheme;
	proxy_set_header Proxy "";

	proxy_pass http://streaming;
	proxy_buffering off;
	proxy_redirect off;
	proxy_http_version 1.1;
	proxy_set_header Upgrade $http_upgrade;
	proxy_set_header Connection $connection_upgrade;

	add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";

	tcp_nodelay on;
  }

  location @proxy {
	proxy_set_header Host $host;
	proxy_set_header X-Real-IP $remote_addr;
	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	proxy_set_header X-Forwarded-Proto $scheme;
	proxy_set_header Proxy "";
	proxy_pass_header Server;

	proxy_pass http://backend;
	proxy_buffering on;
	proxy_redirect off;
	proxy_http_version 1.1;
	proxy_set_header Upgrade $http_upgrade;
	proxy_set_header Connection $connection_upgrade;

	proxy_cache CACHE;
	proxy_cache_valid 200 7d;
	proxy_cache_valid 410 24h;
	proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
	add_header X-Cached $upstream_cache_status;

	tcp_nodelay on;
  }

  error_page 404 500 501 502 503 504 /500.html;










}

# configuration file /etc/nginx/sites-enabled/wiki.melonland.net:
server {
	listen 443 ssl;
	listen [::]:443 ssl;
	http2 on;    

	server_name wiki.melonland.net wiki.melonking.net;
	proxy_ssl_name toot.melonland.net;
	root /home/daniel/zones/wiki;

	client_max_body_size 4M;
	client_body_buffer_size 128k;

	index doku.php;

	if ($host = wiki.melonking.net) {
		return 301 https://wiki.melonland.net$request_uri;
	}

	location / { try_files $uri $uri/ @dokuwiki; }

	location @dokuwiki {
		rewrite ^/_media/(.*) /lib/exe/fetch.php?media=$1 last;
		rewrite ^/_detail/(.*) /lib/exe/detail.php?media=$1 last;
		rewrite ^/_export/([^/]+)/(.*) /doku.php?do=export_$1&id=$2 last;
		rewrite ^/(.*) /doku.php?id=$1&$args last;
	}

	location ~ \.php$ {
		add_header X-Frame-Options ALLOW;
		if (!-f $request_filename) { return 404; }
		include fastcgi_params;
		fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
		fastcgi_param REDIRECT_STATUS 200;
		fastcgi_param HTTPS on;
		fastcgi_pass unix:/var/run/php/php8.3-fpm.sock;
	}

	# dokuwiki security
	location ~ /(conf|bin|inc|vendor)/ {
		deny all;
	}
	location ~ /data/ {
		internal;
	}
	# end dokuwiki security

	location ~ /\. {
		deny all;
	}
	ssl_certificate /etc/letsencrypt/live/toot.melonland.net/fullchain.pem; # managed by Certbot
	ssl_certificate_key /etc/letsencrypt/live/toot.melonland.net/privkey.pem; # managed by Certbot












}

server {
	if ($host = wiki.melonking.net) {
		return 301 https://$host$request_uri;
	} # managed by Certbot

	if ($host = wiki.melonland.net) {
		return 301 https://$host$request_uri;
	} # managed by Certbot

	server_name wiki.melonland.net wiki.melonking.net;

	listen 80;
	listen [::]:80;
	return 404; # managed by Certbot
}