feat: centralize nginx TLS and proxy defaults

.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

conf.d/00-request-maps.conf.template

@@ -1,5 +1,6 @@
 map_hash_bucket_size 128;
 
+# Normalize the Connection header for WebSocket upgrades.
 map $http_upgrade $connection_upgrade {
     default upgrade;
     ''      close;

conf.d/10-defaults.conf.template

@@ -1,3 +1,8 @@
+http2 on;
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_session_cache shared:SSL:10m;
+ssl_session_timeout 10m;
+
 server {
     listen 80 default_server;
     listen [::]:80 default_server;
@@ -9,9 +14,6 @@ server {
 server {
     listen 443 ssl default_server;
     listen [::]:443 ssl default_server;
-    include snippets/https.conf;
 
-    server_name _;
-
-    return 404;
+    ssl_reject_handshake on;
 }

conf.d/adguardhome.conf.template

@@ -1,6 +1,6 @@
 server {
     listen 443 ssl;
-    include snippets/https.conf;
+    include snippets/cert.conf;
 
     server_name adguard.${BASE_DOMAIN};
 

conf.d/backrest.conf.template

@@ -1,6 +1,6 @@
 server {
     listen 443 ssl;
-    include snippets/https.conf;
+    include snippets/cert.conf;
 
     server_name backrest.${BASE_DOMAIN};
 

conf.d/gitea.conf.template

@@ -1,7 +1,7 @@
 server {
     listen 443 ssl;
     listen [::]:443 ssl;
-    include snippets/https.conf;
+    include snippets/cert.conf;
 
     server_name gitea.${BASE_DOMAIN};
 

conf.d/homeassistant.conf.template

@@ -1,7 +1,7 @@
 server {
     listen 443 ssl;
     listen [::]:443 ssl;
-    include snippets/https.conf;
+    include snippets/cert.conf;
 
     server_name ha.${BASE_DOMAIN};
 

conf.d/immich.conf.template

@@ -1,7 +1,7 @@
 server {
     listen 443 ssl;
     listen [::]:443 ssl;
-    include snippets/https.conf;
+    include snippets/cert.conf;
 
     server_name immich.${BASE_DOMAIN};
 

conf.d/openlist.conf.template

@@ -1,7 +1,7 @@
 server {
     listen 443 ssl;
     listen [::]:443 ssl;
-    include snippets/https.conf;
+    include snippets/cert.conf;
 
     server_name openlist.${BASE_DOMAIN};
 

conf.d/qbittorrent.conf.template

@@ -1,6 +1,6 @@
 server {
     listen 443 ssl;
-    include snippets/https.conf;
+    include snippets/cert.conf;
 
     server_name qbt.${BASE_DOMAIN};
 

snippets/cert.conf.template

@@ -1,3 +1,2 @@
-http2 on;
 ssl_certificate /etc/nginx/certs/${BASE_DOMAIN}/fullchain.pem;
 ssl_certificate_key /etc/nginx/certs/${BASE_DOMAIN}/key.pem;

snippets/proxy.conf.template

@@ -1,19 +1,19 @@
-# restrict access
+# Allow requests only from the internal network or a trusted gateway.
 if ($allow_access = 0) {
     return 403;
 }
 
-# set headers
+# Forward normalized client metadata.
 proxy_set_header Host              $host;
 proxy_set_header X-Real-IP         $trusted_client_ip;
 proxy_set_header X-Forwarded-For   $trusted_client_ip;
 proxy_set_header X-Forwarded-Proto $scheme;
 
-# clean headers
-proxy_set_header X-Origin-Token    '';
-proxy_set_header EO-Connecting-IP  '';
+# Do not expose gateway authentication metadata to upstream services.
+proxy_set_header X-Origin-Token   '';
+proxy_set_header EO-Connecting-IP '';
 
-# enable websockets: http://nginx.org/en/docs/http/websocket.html
+# Support WebSocket upgrades.
 proxy_http_version 1.1;
-proxy_set_header Upgrade $http_upgrade;
+proxy_set_header Upgrade    $http_upgrade;
 proxy_set_header Connection $connection_upgrade;