cutemeli/server
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Track only selected configs

Browse Source
This commit is contained in:
cutemeli
2026-01-08 18:41:32 +01:00
parent a09d331b05
commit 5258f9bd7a
12 changed files with 459 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

156
etc/nginx/sites-available/reverse-proxy.conf Normal file
View File

@@ -0,0 +1,156 @@
# -----------------------------
# Proxmox (nur via VPN)
# -----------------------------
server {
listen 443 ssl http2;
server_name proxmox.cutemeli.com;
ssl_certificate /etc/ssl/certs/proxmox.pem;
ssl_certificate_key /etc/ssl/private/proxmox.key;
allow 127.0.0.1;
allow 10.10.0.0/24;
allow 172.17.0.0/16;
allow 172.18.0.0/16;
allow 172.19.0.0/16;
deny all;
location / {
proxy_pass https://127.0.0.1:8006;
proxy_ssl_verify off;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}
# -----------------------------
# Git
# -----------------------------
server {
listen 443 ssl http2;
server_name git.cutemeli.com;
ssl_certificate /etc/ssl/certs/git.pem;
ssl_certificate_key /etc/ssl/private/git.key;
#allow 10.10.0.0/24;
#allow 127.0.0.1;
#deny all;
client_max_body_size 5g;
location / {
proxy_pass http://127.0.0.1:3001;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_read_timeout 3600;
proxy_redirect off;
}
}
# -----------------------------
# Nextcloud
# -----------------------------
server {
listen 443 ssl http2;
server_name share.cutemeli.com;
ssl_certificate /etc/ssl/certs/share.pem;
ssl_certificate_key /etc/ssl/private/share.key;
client_max_body_size 2G;
location / {
proxy_pass http://127.0.0.1:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_read_timeout 3600;
proxy_redirect off;
}
# Pflicht für DAV / Kalender / Kontakte
location = /.well-known/carddav {
return 301 /remote.php/dav;
}
location = /.well-known/caldav {
return 301 /remote.php/dav;
}
# Optional für Federation, Talk, etc.
location ^~ /.well-known {
proxy_pass http://127.0.0.1:8080;
}
}
# -----------------------------
# Monitoring (nur via VPN)
# -----------------------------
server {
listen 443 ssl http2;
server_name monitor.cutemeli.com;
ssl_certificate /etc/ssl/certs/monitor.pem;
ssl_certificate_key /etc/ssl/private/monitor.key;
allow 10.10.0.0/24;
allow 127.0.0.1;
deny all;
location / {
proxy_pass http://127.0.0.1:8082;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
}
}
# -----------------------------
# Vaultwarden
# -----------------------------
server {
listen 443 ssl http2;
server_name vault.cutemeli.com;
ssl_certificate /etc/ssl/certs/vault.pem;
ssl_certificate_key /etc/ssl/private/vault.key;
location / {
proxy_pass http://127.0.0.1:8081;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
}
# Für WebSocket Sync mit Browser Extensions
location /notifications/hub {
proxy_pass http://127.0.0.1:8081;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
location /notifications/hub/negotiate {
proxy_pass http://127.0.0.1:8081;
}
}
# -----------------------------
# Redirect HTTP -> HTTPS
# -----------------------------
server {
listen 80;
listen [::]:80;
server_name git.cutemeli.com proxmox.cutemeli.com share.cutemeli.com monitor.cutemeli.com prometheus.cutemeli.com vault.cutemeli.com vpn.cutemeli.com;
return 301 https://$host$request_uri;
}

16
etc/systemd/system/gitea.service Normal file
View File

@@ -0,0 +1,16 @@
[Unit]
Description=Gitea (Docker Compose)
Requires=docker.service
After=docker.service network-online.target
Wants=network-online.target
[Service]
Type=oneshot
WorkingDirectory=/opt/gitea
ExecStart=/usr/bin/docker compose up -d
ExecStop=/usr/bin/docker compose down
RemainAfterExit=yes
TimeoutStartSec=0
[Install]
WantedBy=multi-user.target

15
etc/systemd/system/monitoring.service Normal file
View File

@@ -0,0 +1,15 @@
[Unit]
Description=Monitoring Stack (Icinga)
Requires=docker.service
After=docker.service
[Service]
Type=oneshot
WorkingDirectory=/opt/monitoring
RemainAfterExit=yes
ExecStart=/usr/bin/docker compose up -d
ExecStop=/usr/bin/docker compose down
TimeoutStartSec=0
[Install]
WantedBy=multi-user.target

15
etc/systemd/system/nextcloud.service Normal file
View File

@@ -0,0 +1,15 @@
[Unit]
Description=Nextcloud Docker Compose Service
Requires=docker.service
After=docker.service network.target
[Service]
Type=oneshot
RemainAfterExit=yes
WorkingDirectory=/opt/nextcloud
ExecStart=/usr/bin/docker compose up -d
ExecStop=/usr/bin/docker compose down
ExecReload=/usr/bin/docker compose restart
[Install]
WantedBy=multi-user.target

21
etc/systemd/system/proxmox-vm.service Normal file
View File

@@ -0,0 +1,21 @@
[Unit]
Description=Proxmox VM (QEMU)
After=network.target
[Service]
Type=simple
ExecStart=/usr/bin/qemu-system-x86_64 \
-enable-kvm \
-cpu host \
-m 4096 \
-smp 4 \
-drive file=/root/proxmox-disk.qcow2,format=qcow2 \
-boot order=c \
-nographic \
-netdev user,id=net0,hostfwd=tcp::2222-:22,hostfwd=tcp::8006-:8006 \
-device virtio-net-pci,netdev=net0
Restart=always
[Install]
WantedBy=multi-user.target

15
etc/systemd/system/vaultwarden.service Normal file
View File

@@ -0,0 +1,15 @@
[Unit]
Description=Vaultwarden (Bitwarden in Rust)
After=docker.service
Requires=docker.service
[Service]
Type=oneshot
RemainAfterExit=yes
WorkingDirectory=/opt/vaultwarden
ExecStart=/usr/bin/docker compose up -d
ExecStop=/usr/bin/docker compose down
TimeoutStartSec=0
[Install]
WantedBy=multi-user.target