wrolpi/etc/raspberrypios/nginx.conf

user www-data;

events {

}

http {
  client_max_body_size 0;

  map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
  }
  charset utf-8;

  include mime.types;
  types {
    # Custom types for ebooks.
    application/x-mobipocket-ebook mobi;
    application/epub+zip epub;
    # Configs
    text/yaml yaml yml;
  }

  error_page 502 /error/50x.html;
  error_page 503 /error/50x.html;
  error_page 504 /error/50x.html;

  server {
    listen 80;
    listen [::]:80;
    server_name _; # Default server for requests without "Host" header

    location / {
      return 301 https://$host$request_uri;
    }
  }

  server {
    listen 443 ssl;
    listen [::]:443 ssl;
    proxy_pass_header Host;

    # Self-signed cert.
    ssl_certificate /etc/nginx/cert.crt;
    ssl_certificate_key /etc/nginx/cert.key;

    # CORS headers for Controller direct access (http://host:8087 -> https://host/api)
    # Added at server level so they apply to error pages (502, etc.)
    add_header 'Access-Control-Allow-Origin' '*' always;
    add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
    add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept' always;

    # Override http-level error_page to use named location with CORS
    error_page 502 503 504 @error_with_cors;

    location @error_with_cors {
      add_header 'Access-Control-Allow-Origin' '*' always;
      add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
      add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept' always;
      root /var/www;
      try_files /50x.html =502;
    }

    include /etc/nginx/conf.d/*;
  }

  # HTTPS Map is served by Apache2.  This is because mod_tile.conf is required to render the map.  renderd does not
  # support nginx.

  server {
    # HTTPS Kiwix.
    listen 8085 ssl;
    listen [::]:8085 ssl;
    proxy_pass_header Host;
    proxy_set_header 'Access-Control-Allow-Origin' '*';

    ssl_certificate /etc/nginx/cert.crt;
    ssl_certificate_key /etc/nginx/cert.key;

    location / {
      proxy_pass http://0.0.0.0:9085;
    }
  }

  server {
    # HTTPS Help.
    listen 8086 ssl;
    listen [::]:8086 ssl;
    proxy_pass_header Host;
    add_header 'Access-Control-Allow-Origin' '*';

    ssl_certificate /etc/nginx/cert.crt;
    ssl_certificate_key /etc/nginx/cert.key;

    location / {
      proxy_pass http://0.0.0.0:9086;
    }
  }

}