From 0bced87ffff3e623c18e29d314404a561afd9ac7 Mon Sep 17 00:00:00 2001
From: lingkai5wu <lingkai5wu@outlook.com>
Date: Sun, 16 Aug 2026 15:02:17 +0800
Subject: [PATCH] feat: initial Nginx templates

---
 conf.d/default.conf.template  | 20 ++++++++++++++++++++
 conf.d/gitea.conf.template    | 13 +++++++++++++
 conf.d/immich.conf.template   | 32 ++++++++++++++++++++++++++++++++
 conf.d/openlist.conf.template | 13 +++++++++++++
 snippets/https.conf.template  |  3 +++
 snippets/proxy.conf.template  | 10 ++++++++++
 6 files changed, 91 insertions(+)
 create mode 100644 conf.d/default.conf.template
 create mode 100644 conf.d/gitea.conf.template
 create mode 100644 conf.d/immich.conf.template
 create mode 100644 conf.d/openlist.conf.template
 create mode 100644 snippets/https.conf.template
 create mode 100644 snippets/proxy.conf.template

diff --git a/conf.d/default.conf.template b/conf.d/default.conf.template
new file mode 100644
index 0000000..83ac4df
--- /dev/null
+++ b/conf.d/default.conf.template
@@ -0,0 +1,20 @@
+server {
+    listen 80 default_server;
+    server_name _;
+
+    return 404;
+}
+
+server {
+    listen 443 ssl default_server;
+    include snippets/https.conf;
+
+    server_name _;
+
+    return 404;
+}
+
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
diff --git a/conf.d/gitea.conf.template b/conf.d/gitea.conf.template
new file mode 100644
index 0000000..7997910
--- /dev/null
+++ b/conf.d/gitea.conf.template
@@ -0,0 +1,13 @@
+server {
+    listen 443 ssl;
+    include snippets/https.conf;
+
+    server_name gitea.${BASE_DOMAIN};
+
+    include snippets/proxy.conf;
+
+    location / {
+        proxy_pass http://gitea:3000;
+        client_max_body_size 512M;
+    }
+}
diff --git a/conf.d/immich.conf.template b/conf.d/immich.conf.template
new file mode 100644
index 0000000..dfb99e3
--- /dev/null
+++ b/conf.d/immich.conf.template
@@ -0,0 +1,32 @@
+server {
+    listen 443 ssl;
+    include snippets/https.conf;
+
+    server_name immich.${BASE_DOMAIN};
+
+    include snippets/proxy.conf;
+
+    # allow large file uploads
+    client_max_body_size 50000M;
+
+    # disable buffering uploads to prevent OOM on reverse proxy server and make uploads twice as fast (no pause)
+    proxy_request_buffering off;
+
+    # increase body buffer to avoid limiting upload speed
+    client_body_buffer_size 1024k;
+
+    # set timeout
+    proxy_read_timeout 600s;
+    proxy_send_timeout 600s;
+    send_timeout       600s;
+
+    location / {
+        proxy_pass http://immich-server:2283;
+        proxy_redirect off;
+    }
+
+    # useful when using Let's Encrypt http-01 challenge
+    # location = /.well-known/immich {
+    #     proxy_pass http://<backend_url>:2283;
+    # }
+}
diff --git a/conf.d/openlist.conf.template b/conf.d/openlist.conf.template
new file mode 100644
index 0000000..b9ad133
--- /dev/null
+++ b/conf.d/openlist.conf.template
@@ -0,0 +1,13 @@
+server {
+    listen 443 ssl;
+    include snippets/https.conf;
+
+    server_name openlist.${BASE_DOMAIN};
+
+    include snippets/proxy.conf;
+
+    location / {
+        proxy_pass http://openlist:5244;
+        proxy_redirect off;
+    }
+}
diff --git a/snippets/https.conf.template b/snippets/https.conf.template
new file mode 100644
index 0000000..2ce16ff
--- /dev/null
+++ b/snippets/https.conf.template
@@ -0,0 +1,3 @@
+http2 on;
+ssl_certificate /etc/nginx/certs/${BASE_DOMAIN}/fullchain.pem;
+ssl_certificate_key /etc/nginx/certs/${BASE_DOMAIN}/key.pem;
diff --git a/snippets/proxy.conf.template b/snippets/proxy.conf.template
new file mode 100644
index 0000000..bcabf1a
--- /dev/null
+++ b/snippets/proxy.conf.template
@@ -0,0 +1,10 @@
+# set headers
+proxy_set_header Host              $host;
+proxy_set_header X-Real-IP         $remote_addr;
+proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $scheme;
+
+# enable websockets: http://nginx.org/en/docs/http/websocket.html
+proxy_http_version 1.1;
+proxy_set_header Upgrade $http_upgrade;
+proxy_set_header Connection $connection_upgrade;