feat: update homepage server_name to home subdomain

The origin certificate does not include an OCSP responder URL,
causing nginx warnings. Comment out stapling directives until
a proper certificate with OCSP support is deployed.

.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

conf.d/00-request-maps.conf.template

@@ -1,5 +1,6 @@
 map_hash_bucket_size 128;
 
+# Normalize the Connection header for WebSocket upgrades.
 map $http_upgrade $connection_upgrade {
     default upgrade;
     ''      close;

conf.d/10-default.conf.template

@@ -1,17 +0,0 @@
-server {
-    listen 80 default_server;
-    listen [::]:80 default_server;
-    server_name _;
-
-    return 404;
-}
-
-server {
-    listen 443 ssl default_server;
-    listen [::]:443 ssl default_server;
-    include snippets/https.conf;
-
-    server_name _;
-
-    return 404;
-}

conf.d/10-resolver.conf.template

@@ -0,0 +1,5 @@
+# Docker's embedded DNS is available before the other stacks start.
+# Resolve container names at runtime so a missing backend cannot stop Nginx.
+# Requires Nginx >= 1.27.3 (open-source upstream resolve support).
+resolver 127.0.0.11 valid=10s;
+resolver_timeout 5s;

conf.d/20-defaults.conf.template

@@ -0,0 +1,27 @@
+http2 on;
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_session_cache shared:SSL:10m;
+ssl_session_timeout 10m;
+ssl_session_tickets off;
+
+# OCSP stapling requires certificates with an OCSP responder URL.
+# Uncomment when the origin certificate supports it.
+# ssl_stapling on;
+# ssl_stapling_verify on;
+# resolver 1.1.1.1 8.8.8.8 valid=300s;
+# resolver_timeout 5s;
+
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name _;
+
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
+
+    ssl_reject_handshake on;
+}

conf.d/adguardhome.conf.template

@@ -1,5 +1,9 @@
+upstream adguardhome_backend {
+    zone adguardhome_backend 64k;
+    server adguardhome:80 resolve;
+}
+
 server {
-    listen 443 ssl;
     include snippets/https.conf;
 
     server_name adguard.${BASE_DOMAIN};
@@ -7,6 +11,6 @@ server {
     include snippets/proxy.conf;
 
     location / {
-        proxy_pass http://adguardhome;
+        proxy_pass http://adguardhome_backend;
     }
 }

conf.d/backrest.conf.template

@@ -1,5 +1,9 @@
+upstream backrest_backend {
+    zone backrest_backend 64k;
+    server backrest:9898 resolve;
+}
+
 server {
-    listen 443 ssl;
     include snippets/https.conf;
 
     server_name backrest.${BASE_DOMAIN};
@@ -7,6 +11,6 @@ server {
     include snippets/proxy.conf;
 
     location / {
-        proxy_pass http://backrest:9898;
+        proxy_pass http://backrest_backend;
     }
 }

conf.d/gitea.conf.template

@@ -1,6 +1,9 @@
+upstream gitea_backend {
+    zone gitea_backend 64k;
+    server gitea:3000 resolve;
+}
+
 server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
     include snippets/https.conf;
 
     server_name gitea.${BASE_DOMAIN};
@@ -8,7 +11,7 @@ server {
     include snippets/proxy.conf;
 
     location / {
-        proxy_pass http://gitea:3000;
+        proxy_pass http://gitea_backend;
         client_max_body_size 512M;
     }
 }

conf.d/homeassistant.conf.template

@@ -1,6 +1,4 @@
 server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
     include snippets/https.conf;
 
     server_name ha.${BASE_DOMAIN};

conf.d/homepage.conf.template

@@ -0,0 +1,16 @@
+upstream homepage_backend {
+    zone homepage_backend 64k;
+    server homepage:3000 resolve;
+}
+
+server {
+    include snippets/https.conf;
+
+    server_name home.${BASE_DOMAIN};
+
+    include snippets/proxy.conf;
+
+    location / {
+        proxy_pass http://homepage_backend;
+    }
+}

conf.d/immich.conf.template

@@ -1,6 +1,9 @@
+upstream immich_backend {
+    zone immich_backend 64k;
+    server immich-server:2283 resolve;
+}
+
 server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
     include snippets/https.conf;
 
     server_name immich.${BASE_DOMAIN};
@@ -22,7 +25,7 @@ server {
     send_timeout       600s;
 
     location / {
-        proxy_pass http://immich-server:2283;
+        proxy_pass http://immich_backend;
         proxy_redirect off;
     }
 

conf.d/miyouqian.conf.template

@@ -0,0 +1,16 @@
+upstream miyouqian_backend {
+    zone miyouqian_backend 64k;
+    server miyouqian:5890 resolve;
+}
+
+server {
+    include snippets/https.conf;
+
+    server_name miyouqian.${BASE_DOMAIN};
+
+    include snippets/proxy.conf;
+
+    location / {
+        proxy_pass http://miyouqian_backend;
+    }
+}

conf.d/openlist.conf.template

@@ -1,6 +1,9 @@
+upstream openlist_backend {
+    zone openlist_backend 64k;
+    server openlist:5244 resolve;
+}
+
 server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
     include snippets/https.conf;
 
     server_name openlist.${BASE_DOMAIN};
@@ -8,7 +11,7 @@ server {
     include snippets/proxy.conf;
 
     location / {
-        proxy_pass http://openlist:5244;
+        proxy_pass http://openlist_backend;
         proxy_redirect off;
     }
 }

conf.d/qbittorrent.conf.template

@@ -1,5 +1,9 @@
+upstream qbittorrent_backend {
+    zone qbittorrent_backend 64k;
+    server qbittorrent:8080 resolve;
+}
+
 server {
-    listen 443 ssl;
     include snippets/https.conf;
 
     server_name qbt.${BASE_DOMAIN};
@@ -7,6 +11,6 @@ server {
     include snippets/proxy.conf;
 
     location / {
-        proxy_pass http://qbittorrent:8080;
+        proxy_pass http://qbittorrent_backend;
     }
 }

snippets/https.conf.template

@@ -1,3 +1,5 @@
-http2 on;
+listen 443 ssl;
+listen [::]:443 ssl;
+
 ssl_certificate /etc/nginx/certs/${BASE_DOMAIN}/fullchain.pem;
 ssl_certificate_key /etc/nginx/certs/${BASE_DOMAIN}/key.pem;

snippets/proxy.conf.template

@@ -1,19 +1,19 @@
-# restrict access
+# Allow requests only from the internal network or a trusted gateway.
 if ($allow_access = 0) {
     return 403;
 }
 
-# set headers
+# Forward normalized client metadata.
 proxy_set_header Host              $host;
 proxy_set_header X-Real-IP         $trusted_client_ip;
 proxy_set_header X-Forwarded-For   $trusted_client_ip;
 proxy_set_header X-Forwarded-Proto $scheme;
 
-# clean headers
+# Do not expose gateway authentication metadata to upstream services.
-proxy_set_header X-Origin-Token    '';
+proxy_set_header X-Origin-Token   '';
-proxy_set_header EO-Connecting-IP  '';
+proxy_set_header EO-Connecting-IP '';
 
-# enable websockets: http://nginx.org/en/docs/http/websocket.html
+# Support WebSocket upgrades.
 proxy_http_version 1.1;
-proxy_set_header Upgrade $http_upgrade;
+proxy_set_header Upgrade    $http_upgrade;
 proxy_set_header Connection $connection_upgrade;