Bewaar gecorrigeerde live nginx-configs als referentie in de repo

De configs die deze sessie zijn nagelopen en gefixt (slpsoftware-analytics.conf, slpsoftware-test-webserver.conf, slpsoftware.conf) stonden alleen als geplakte tekst in de chat en een tijdelijke scratchpad-map, niet in de repo of op de Pi's zelf toegepast. Dit zet ze duurzaam vast als referentiesnapshot, met een README die per bestand aangeeft wat er is aangepast en waarom. Nog steeds handmatig te kopiëren naar de Pi's; niet automatisch gesynchroniseerd. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-27 14:49:11 +02:00
parent b5e8ae1820
commit d1f544555d
4 changed files with 195 additions and 0 deletions
@@ -0,0 +1,95 @@
+server {
+    listen [::]:443 ssl; # managed by Certbot
+    listen 443 ssl; # managed by Certbot
+    server_name slpsoftware.nl www.slpsoftware.nl;
+
+    access_log /var/log/nginx/slpsoftware_access.log;
+    error_log /var/log/nginx/slpsoftware_error.log;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    # Sentry "tunnel" endpoint (zie src/main.tsx's Sentry.init tunnel-optie en
+    # de toelichting in reverse-proxy-nginx.conf.example) — voorkomt dat
+    # ad-blockers Sentry-events blokkeren door ze via ons eigen domein te
+    # tunnelen. VITE_SENTRY_DSN is bewust gedeeld tussen test en productie
+    # (één Sentry-project, environment-tag onderscheidt ze), dus dezelfde
+    # org-/project-id als de testomgeving is hier correct.
+    location /sentry-tunnel {
+        proxy_pass https://o4511795618185216.ingest.de.sentry.io/api/4511795622838352/envelope/;
+        proxy_set_header Host o4511795618185216.ingest.de.sentry.io;
+        proxy_ssl_server_name on;
+    }
+
+    location ~ ^\/(iredadmin|mail)(\/|$) {
+        proxy_pass https://192.168.1.104:443;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location / {
+        proxy_pass http://192.168.1.103:80;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    ssl_certificate /etc/letsencrypt/live/slpsoftware.nl/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/slpsoftware.nl/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+}
+
+server {
+    listen [::]:443 ssl; # managed by Certbot
+    listen 443 ssl; # managed by Certbot
+
+    server_name mail.slpsoftware.nl;
+
+    access_log /var/log/nginx/mail.slpsoftware_access.log;
+    error_log /var/log/nginx/mail.slpsoftware_error.log;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    location / {
+        proxy_pass https://192.168.1.104:443; # Odroid C4 hosting iRedMail
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    ssl_certificate /etc/letsencrypt/live/mail.slpsoftware.nl/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/mail.slpsoftware.nl/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+}
+
+server {
+    listen 80;
+    listen [::]:80;
+
+    server_name slpsoftware.nl www.slpsoftware.nl mail.slpsoftware.nl;
+
+    if ($host = mail.slpsoftware.nl) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+    if ($host = www.slpsoftware.nl) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    if ($host = slpsoftware.nl) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+    return 404; # managed by Certbot
+}