🍽 Fork YunoHost — snapshot mangé par la machine à tsoins

Upstream: https://github.com/YunoHost/yunohost @ 3a5f8bac8301c450897b96cbd43a4c7d3ba750fb
But (José) : transformer tout le code en bions + ploxions du xerboxion.
La carte de digestion vit au labo : /yunohost-digest.json

conf/nginx/server.tpl.conf

@@ -0,0 +1,81 @@
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name {{ domain }};
+
+    access_by_lua_file /usr/share/ssowat/access.lua;
+
+    include /etc/nginx/conf.d/acme-challenge.conf.inc;
+
+    location ^~ '/.well-known/ynh-diagnosis/' {
+        alias /var/www/.well-known/ynh-diagnosis/;
+    }
+    {%- if mail_enabled == "True" %}
+
+    location ^~ '/.well-known/autoconfig/mail/' {
+        alias /var/www/.well-known/{{ domain }}/autoconfig/mail/;
+    }
+    {%- endif %}
+
+    {#- Note that this != "False" is meant to be failure-safe, in the case the redrect_to_https would happen to contain empty string or whatever value. We absolutely don't want to disable the HTTPS redirect *except* when it's explicitly being asked to be disabled. #}
+    {%- if redirect_to_https != "False" %}
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+    {#- The app config snippets are not included in the HTTP conf unless HTTPS redirect is disabled, because app's location may blocks will conflict or bypass/ignore the HTTPS redirection. #}
+    {%- else %}
+
+    include /etc/nginx/conf.d/{{ domain }}.d/*.conf;
+    {%- endif %}
+
+    include /etc/nginx/conf.d/yunohost_http_errors.conf.inc;
+
+    access_log /var/log/nginx/{{ domain }}-access.log;
+    error_log /var/log/nginx/{{ domain }}-error.log;
+}
+
+server {
+    {%- if tls_passthrough_enabled != "True" %}
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    {%- else %}
+    listen 127.0.0.1:444 ssl proxy_protocol;
+    port_in_redirect off;
+    set_real_ip_from 127.0.0.1/32;
+    real_ip_header proxy_protocol;
+    {%- endif %}
+    server_name {{ domain }};
+
+    include /etc/nginx/conf.d/security.conf.inc;
+
+    ssl_certificate /etc/yunohost/certs/{{ domain }}/crt.pem;
+    ssl_certificate_key /etc/yunohost/certs/{{ domain }}/key.pem;
+    {%- if domain_cert_ca != "selfsigned" %}
+
+    more_set_headers "Strict-Transport-Security : max-age=63072000; includeSubDomains; preload";
+    {%- endif %}
+    {%- if mail_enabled == "True" %}
+
+    location ^~ '/.well-known/autoconfig/mail/' {
+        alias /var/www/.well-known/{{ domain }}/autoconfig/mail/;
+    }
+    {%- endif %}
+
+    access_by_lua_file /usr/share/ssowat/access.lua;
+
+    include /etc/nginx/conf.d/{{ domain }}.d/*.conf;
+
+    include /etc/nginx/conf.d/yunohost_sso.conf.inc;
+    include /etc/nginx/conf.d/yunohost_admin.conf.inc;
+    include /etc/nginx/conf.d/yunohost_api.conf.inc;
+    include /etc/nginx/conf.d/yunohost_http_errors.conf.inc;
+
+    access_log /var/log/nginx/{{ domain }}-access.log;
+    error_log /var/log/nginx/{{ domain }}-error.log;
+}