feat: update homepage server_name to home subdomain

The origin certificate does not include an OCSP responder URL,
causing nginx warnings. Comment out stapling directives until
a proper certificate with OCSP support is deployed.

conf.d/10-resolver.conf.template

@@ -0,0 +1,5 @@
+# Docker's embedded DNS is available before the other stacks start.
+# Resolve container names at runtime so a missing backend cannot stop Nginx.
+# Requires Nginx >= 1.27.3 (open-source upstream resolve support).
+resolver 127.0.0.11 valid=10s;
+resolver_timeout 5s;

conf.d/20-defaults.conf.template

@@ -2,13 +2,21 @@ http2 on;
 ssl_protocols TLSv1.2 TLSv1.3;
 ssl_session_cache shared:SSL:10m;
 ssl_session_timeout 10m;
+ssl_session_tickets off;
+
+# OCSP stapling requires certificates with an OCSP responder URL.
+# Uncomment when the origin certificate supports it.
+# ssl_stapling on;
+# ssl_stapling_verify on;
+# resolver 1.1.1.1 8.8.8.8 valid=300s;
+# resolver_timeout 5s;
 
 server {
     listen 80 default_server;
     listen [::]:80 default_server;
     server_name _;
 
-    return 404;
+    return 301 https://$host$request_uri;
 }
 
 server {

conf.d/adguardhome.conf.template

@@ -1,12 +1,16 @@
+upstream adguardhome_backend {
+    zone adguardhome_backend 64k;
+    server adguardhome:80 resolve;
+}
+
 server {
-    listen 443 ssl;
-    include snippets/cert.conf;
+    include snippets/https.conf;
 
     server_name adguard.${BASE_DOMAIN};
 
     include snippets/proxy.conf;
 
     location / {
-        proxy_pass http://adguardhome;
+        proxy_pass http://adguardhome_backend;
     }
 }

conf.d/backrest.conf.template

@@ -1,12 +1,16 @@
+upstream backrest_backend {
+    zone backrest_backend 64k;
+    server backrest:9898 resolve;
+}
+
 server {
-    listen 443 ssl;
-    include snippets/cert.conf;
+    include snippets/https.conf;
 
     server_name backrest.${BASE_DOMAIN};
 
     include snippets/proxy.conf;
 
     location / {
-        proxy_pass http://backrest:9898;
+        proxy_pass http://backrest_backend;
     }
 }

conf.d/gitea.conf.template

@@ -1,14 +1,17 @@
+upstream gitea_backend {
+    zone gitea_backend 64k;
+    server gitea:3000 resolve;
+}
+
 server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
-    include snippets/cert.conf;
+    include snippets/https.conf;
 
     server_name gitea.${BASE_DOMAIN};
 
     include snippets/proxy.conf;
 
     location / {
-        proxy_pass http://gitea:3000;
+        proxy_pass http://gitea_backend;
         client_max_body_size 512M;
     }
 }

conf.d/homeassistant.conf.template

@@ -1,7 +1,5 @@
 server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
-    include snippets/cert.conf;
+    include snippets/https.conf;
 
     server_name ha.${BASE_DOMAIN};
 

conf.d/homepage.conf.template

@@ -0,0 +1,16 @@
+upstream homepage_backend {
+    zone homepage_backend 64k;
+    server homepage:3000 resolve;
+}
+
+server {
+    include snippets/https.conf;
+
+    server_name home.${BASE_DOMAIN};
+
+    include snippets/proxy.conf;
+
+    location / {
+        proxy_pass http://homepage_backend;
+    }
+}

conf.d/immich.conf.template

@@ -1,7 +1,10 @@
+upstream immich_backend {
+    zone immich_backend 64k;
+    server immich-server:2283 resolve;
+}
+
 server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
-    include snippets/cert.conf;
+    include snippets/https.conf;
 
     server_name immich.${BASE_DOMAIN};
 
@@ -22,7 +25,7 @@ server {
     send_timeout       600s;
 
     location / {
-        proxy_pass http://immich-server:2283;
+        proxy_pass http://immich_backend;
         proxy_redirect off;
     }
 

conf.d/miyouqian.conf.template

@@ -0,0 +1,16 @@
+upstream miyouqian_backend {
+    zone miyouqian_backend 64k;
+    server miyouqian:5890 resolve;
+}
+
+server {
+    include snippets/https.conf;
+
+    server_name miyouqian.${BASE_DOMAIN};
+
+    include snippets/proxy.conf;
+
+    location / {
+        proxy_pass http://miyouqian_backend;
+    }
+}

conf.d/openlist.conf.template

@@ -1,14 +1,17 @@
+upstream openlist_backend {
+    zone openlist_backend 64k;
+    server openlist:5244 resolve;
+}
+
 server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
-    include snippets/cert.conf;
+    include snippets/https.conf;
 
     server_name openlist.${BASE_DOMAIN};
 
     include snippets/proxy.conf;
 
     location / {
-        proxy_pass http://openlist:5244;
+        proxy_pass http://openlist_backend;
         proxy_redirect off;
     }
 }

conf.d/qbittorrent.conf.template

@@ -1,12 +1,16 @@
+upstream qbittorrent_backend {
+    zone qbittorrent_backend 64k;
+    server qbittorrent:8080 resolve;
+}
+
 server {
-    listen 443 ssl;
-    include snippets/cert.conf;
+    include snippets/https.conf;
 
     server_name qbt.${BASE_DOMAIN};
 
     include snippets/proxy.conf;
 
     location / {
-        proxy_pass http://qbittorrent:8080;
+        proxy_pass http://qbittorrent_backend;
     }
 }

snippets/https.conf.template

@@ -1,2 +1,5 @@
+listen 443 ssl;
+listen [::]:443 ssl;
+
 ssl_certificate /etc/nginx/certs/${BASE_DOMAIN}/fullchain.pem;
 ssl_certificate_key /etc/nginx/certs/${BASE_DOMAIN}/key.pem;