diff --git a/script/nginx/README.md b/script/nginx/README.md new file mode 100644 index 0000000..65d33a3 --- /dev/null +++ b/script/nginx/README.md @@ -0,0 +1,37 @@ +# Deployment from Odoo + +## Support Wildcard + +You can support Wildcard domain, like *.mysite.com + +Generate manually the certificate : +```bash +sudo certbot certonly --manual --preferred-challenges=dns --server https://acme-v02.api.letsencrypt.org/directory -d "*.mysite.com" -d "*.mysecondsite.com" +``` + +Follow instruction. Manually update it each 90 days. + +## Single domain per website + +This solution will create nginx file and run certbot. + +Because Odoo hasn't root password, you can exempt with command + +```bash +visudo +``` + +Add this content + +```text +odoo ALL=(root) NOPASSWD: /usr/sbin/nginx -t +odoo ALL=(root) NOPASSWD: /usr/bin/systemctl reload nginx +odoo ALL=(root) NOPASSWD: /bin/ln -s * /etc/nginx/sites-enabled/* +odoo ALL=(root) NOPASSWD: /home/odoo/erplibre/script/nginx/deploy_nginx_and_certbot.py +``` + +Run script + +```bash +sudo ./script/nginx/deploy_nginx_and_certbot.py --generate_nginx --run_certbot --domain DOMAINS;DOMAINS +``` diff --git a/script/nginx/deploy_nginx_and_certbot.py b/script/nginx/deploy_nginx_and_certbot.py new file mode 100755 index 0000000..ed19bb6 --- /dev/null +++ b/script/nginx/deploy_nginx_and_certbot.py @@ -0,0 +1,140 @@ +#!/usr/bin/env python3 +# © 2021-2025 TechnoLibre (http://www.technolibre.ca) +# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl) +import argparse +import logging +import os +import time + +logging.basicConfig() +logging.getLogger().setLevel(logging.INFO) +_logger = logging.getLogger(__name__) + + +def get_config(): + """Parse command line arguments, extracting the config file name, + returning the union of config file and command line arguments + + :return: dict of config file settings and command line arguments + """ + + # TODO update description + parser = argparse.ArgumentParser( + formatter_class=argparse.RawDescriptionHelpFormatter, + description="""\ + Specify argument to create nginx services and run certbot. +""", + epilog="""\ +""", + ) + parser.add_argument( + "--generate_nginx", + action="store_true", + help="Will configure odoo reverse-proxy with domain on nginx.", + ) + parser.add_argument( + "--run_certbot", + action="store_true", + help="Will run certbot with domain on nginx.", + ) + parser.add_argument( + "--ssl_exist", + action="store_true", + help="The certificate is already created, not supported with --run_certbot.", + ) + parser.add_argument( + "--force_ssl_dir", + help="Change the dir of certificate for this dir. Will contain fullchain.pem and privkey.pem.", + ) + parser.add_argument( + "--domain", + required=True, + help="Separate by ; for multiple domains. Main domain is first on the list.", + ) + parser.add_argument( + "--odoo_version", + default="18.0", + help="Specify only one version, 12.0 to 18.0", + ) + parser.add_argument( + "--default_port_http", + default=8069, + help="The default port for http", + ) + parser.add_argument( + "--default_port_websocket", + default=8072, + help="The default port for websocket (or longpolling)", + ) + + args = parser.parse_args() + return args + + +def main(): + config = get_config() + + if " " in config.domain: + raise ValueError("Cannot support space into domains.") + + lst_domain = config.domain.split(";") + main_domain = lst_domain[0] + main_domain_name = main_domain.replace(".", "_") + + # TODO support git, create a commit if exist .git + + if config.ssl_exist: + template_name = ( + f"./script/nginx/template_nginx_ssl_odoo_{config.odoo_version}.txt" + ) + else: + template_name = ( + f"./script/nginx/template_nginx_odoo_{config.odoo_version}.txt" + ) + if not os.path.exists(template_name): + raise ValueError(f"Cannot find template path '{template_name}'") + + if config.generate_nginx: + # TODO check if exist, overwrite it + site_available_path = f"/etc/nginx/sites-available/{main_domain}" + site_enabled_path = f"/etc/nginx/sites-enabled/{main_domain}" + print(f"Create file {site_available_path}") + + with open(template_name, "r") as template: + content = template.read() + cmd_lst_domain = " ".join(lst_domain) + if config.force_ssl_dir: + content = content.replace( + "/etc/letsencrypt/live/DOMAIN", + os.path.normpath(config.force_ssl_dir), + ) + content = ( + content.replace("DOMAIN", cmd_lst_domain) + .replace("SERVER_NAME", main_domain_name) + .replace("8069", str(config.default_port_http)) + .replace("8072", str(config.default_port_websocket)) + ) + with open(site_available_path, "w") as template: + template.write(content) + if not os.path.exists(site_enabled_path): + cmd_syslink = f"ln -s {site_available_path} {site_enabled_path}" + os.system(cmd_syslink) + + # TODO support both ssl_exist and run_certbot + if config.ssl_exist and config.run_certbot: + _logger.error( + "Cannot run certbot with domain on nginx with feature ssl_exist. Please implement it." + ) + if config.ssl_exist: + pass + elif config.run_certbot: + if config.generate_nginx: + time.sleep(10) + cmd_lst_domain = " -d " + " -d ".join(lst_domain) + cmd_certbot = "sudo certbot --nginx%s" % cmd_lst_domain + print(cmd_certbot) + os.system(cmd_certbot) + + +if __name__ == "__main__": + main() diff --git a/script/nginx/template_nginx_odoo_12.0.txt b/script/nginx/template_nginx_odoo_12.0.txt index df35507..57379f3 100644 --- a/script/nginx/template_nginx_odoo_12.0.txt +++ b/script/nginx/template_nginx_odoo_12.0.txt @@ -1,15 +1,17 @@ -# TODO replace CHANGEME by your hostname and fix server_name and run certbot -upstream erplibreCHANGEME { +# TODO replace SERVER_NAME by your server_name, example test_mysite_com +# TODO replace DOMAIN by your hostname, example test.mysite.com +# TODO RUN Certbot to update this file +upstream erplibre_SERVER_NAME { server 127.0.0.1:8069; } -upstream erplibreCHANGEMEchat { +upstream erplibre_SERVER_NAME_chat { server 127.0.0.1:8072; } server { listen 80; - server_name CHANGEME.ca; + server_name DOMAIN; # Add Headers for erplibre proxy mode proxy_set_header X-Forwarded-Host $host; @@ -20,8 +22,8 @@ server { add_header X-XSS-Protection "1; mode=block"; # erplibre request log files - access_log /var/log/nginx/CHANGEME-access.log; - error_log /var/log/nginx/CHANGEME-error.log; + access_log /var/log/nginx/SERVER_NAME-access.log; + error_log /var/log/nginx/SERVER_NAME-error.log; # Increase proxy buffer size proxy_buffers 16 64k; @@ -51,13 +53,13 @@ server { client_max_body_size 1024M; location / { - proxy_pass http://erplibreCHANGEME; + proxy_pass http://erplibre_SERVER_NAME; # by default, do not forward anything proxy_redirect off; } location /longpolling { - proxy_pass http://erplibreCHANGEMEchat; + proxy_pass http://erplibre_SERVER_NAME_chat; } # cache some static data in memory for 60mins. @@ -66,6 +68,7 @@ server { proxy_cache_valid 404 1m; proxy_buffering on; expires 864000; - proxy_pass http://erplibreCHANGEME; + proxy_pass http://erplibre_SERVER_NAME; } + } diff --git a/script/nginx/template_nginx_odoo_13.0.txt b/script/nginx/template_nginx_odoo_13.0.txt new file mode 100644 index 0000000..57379f3 --- /dev/null +++ b/script/nginx/template_nginx_odoo_13.0.txt @@ -0,0 +1,74 @@ +# TODO replace SERVER_NAME by your server_name, example test_mysite_com +# TODO replace DOMAIN by your hostname, example test.mysite.com +# TODO RUN Certbot to update this file +upstream erplibre_SERVER_NAME { + server 127.0.0.1:8069; +} +upstream erplibre_SERVER_NAME_chat { + server 127.0.0.1:8072; +} + +server { + listen 80; + + server_name DOMAIN; + + # Add Headers for erplibre proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + add_header X-Frame-Options "SAMEORIGIN"; + add_header X-XSS-Protection "1; mode=block"; + + # erplibre request log files + access_log /var/log/nginx/SERVER_NAME-access.log; + error_log /var/log/nginx/SERVER_NAME-error.log; + + # Increase proxy buffer size + proxy_buffers 16 64k; + proxy_buffer_size 128k; + + proxy_read_timeout 720s; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + + # Force timeouts if the backend dies + proxy_next_upstream error timeout invalid_header http_500 http_502 + http_503; + + types { + text/less less; + text/scss scss; + } + + # Enable data compression + gzip on; + gzip_min_length 1100; + gzip_buffers 4 32k; + gzip_types text/css text/less text/plain text/xml application/xml application/json application/javascript application/pdf image/jpeg image/png; + gzip_vary on; + client_header_buffer_size 4k; + large_client_header_buffers 4 64k; + client_max_body_size 1024M; + + location / { + proxy_pass http://erplibre_SERVER_NAME; + # by default, do not forward anything + proxy_redirect off; + } + + location /longpolling { + proxy_pass http://erplibre_SERVER_NAME_chat; + } + + # cache some static data in memory for 60mins. + location ~ /[a-zA-Z0-9_-]*/static/ { + proxy_cache_valid 200 302 60m; + proxy_cache_valid 404 1m; + proxy_buffering on; + expires 864000; + proxy_pass http://erplibre_SERVER_NAME; + } + +} diff --git a/script/nginx/template_nginx_odoo_14.0.txt b/script/nginx/template_nginx_odoo_14.0.txt index a523a76..1cab7d9 100644 --- a/script/nginx/template_nginx_odoo_14.0.txt +++ b/script/nginx/template_nginx_odoo_14.0.txt @@ -1,15 +1,17 @@ -# TODO replace CHANGEME by your hostname and fix server_name and run certbot -upstream erplibreCHANGEME { +# TODO replace SERVER_NAME by your server_name, example test_mysite_com +# TODO replace DOMAIN by your hostname, example test.mysite.com +# TODO RUN Certbot to update this file +upstream erplibre_SERVER_NAME { server 127.0.0.1:8069; } -upstream erplibreCHANGEMEchat { +upstream erplibre_SERVER_NAME_chat { server 127.0.0.1:8072; } server { listen 80; - server_name CHANGEME.ca; + server_name DOMAIN; # Add Headers for erplibre proxy mode proxy_set_header X-Forwarded-Host $host; @@ -20,8 +22,8 @@ server { add_header X-XSS-Protection "1; mode=block"; # erplibre request log files - access_log /var/log/nginx/CHANGEME-access.log; - error_log /var/log/nginx/CHANGEME-error.log; + access_log /var/log/nginx/SERVER_NAME-access.log; + error_log /var/log/nginx/SERVER_NAME-error.log; # Increase proxy buffer size proxy_buffers 16 64k; @@ -51,7 +53,7 @@ server { client_max_body_size 1024M; location / { - proxy_pass http://erplibreCHANGEME; + proxy_pass http://erplibre_SERVER_NAME; # by default, do not forward anything proxy_redirect off; proxy_http_version 1.1; @@ -68,7 +70,7 @@ server { } location /websocket { - proxy_pass http://erplibreCHANGEMEchat; + proxy_pass http://erplibre_SERVER_NAME_chat; proxy_read_timeout 720s; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; @@ -88,6 +90,7 @@ server { proxy_cache_valid 404 1m; proxy_buffering on; expires 864000; - proxy_pass http://erplibreCHANGEME; + proxy_pass http://erplibre_SERVER_NAME; } + } diff --git a/script/nginx/template_nginx_odoo_15.0.txt b/script/nginx/template_nginx_odoo_15.0.txt new file mode 100644 index 0000000..1cab7d9 --- /dev/null +++ b/script/nginx/template_nginx_odoo_15.0.txt @@ -0,0 +1,96 @@ +# TODO replace SERVER_NAME by your server_name, example test_mysite_com +# TODO replace DOMAIN by your hostname, example test.mysite.com +# TODO RUN Certbot to update this file +upstream erplibre_SERVER_NAME { + server 127.0.0.1:8069; +} +upstream erplibre_SERVER_NAME_chat { + server 127.0.0.1:8072; +} + +server { + listen 80; + + server_name DOMAIN; + + # Add Headers for erplibre proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + add_header X-Frame-Options "SAMEORIGIN"; + add_header X-XSS-Protection "1; mode=block"; + + # erplibre request log files + access_log /var/log/nginx/SERVER_NAME-access.log; + error_log /var/log/nginx/SERVER_NAME-error.log; + + # Increase proxy buffer size + proxy_buffers 16 64k; + proxy_buffer_size 128k; + + proxy_read_timeout 720s; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + + # Force timeouts if the backend dies + proxy_next_upstream error timeout invalid_header http_500 http_502 + http_503; + + types { + text/less less; + text/scss scss; + } + + # Enable data compression + gzip on; + gzip_min_length 1100; + gzip_buffers 4 32k; + gzip_types text/css text/less text/plain text/xml application/xml application/json application/javascript application/pdf image/jpeg image/png; + gzip_vary on; + client_header_buffer_size 4k; + large_client_header_buffers 4 64k; + client_max_body_size 1024M; + + location / { + proxy_pass http://erplibre_SERVER_NAME; + # by default, do not forward anything + proxy_redirect off; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_read_timeout 720s; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + # Add Headers for odoo proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + } + + location /websocket { + proxy_pass http://erplibre_SERVER_NAME_chat; + proxy_read_timeout 720s; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + # Add Headers for odoo proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + } + + # cache some static data in memory for 60mins. + location ~ /[a-zA-Z0-9_-]*/static/ { + proxy_cache_valid 200 302 60m; + proxy_cache_valid 404 1m; + proxy_buffering on; + expires 864000; + proxy_pass http://erplibre_SERVER_NAME; + } + +} diff --git a/script/nginx/template_nginx_odoo_16.0.txt b/script/nginx/template_nginx_odoo_16.0.txt index a523a76..1cab7d9 100644 --- a/script/nginx/template_nginx_odoo_16.0.txt +++ b/script/nginx/template_nginx_odoo_16.0.txt @@ -1,15 +1,17 @@ -# TODO replace CHANGEME by your hostname and fix server_name and run certbot -upstream erplibreCHANGEME { +# TODO replace SERVER_NAME by your server_name, example test_mysite_com +# TODO replace DOMAIN by your hostname, example test.mysite.com +# TODO RUN Certbot to update this file +upstream erplibre_SERVER_NAME { server 127.0.0.1:8069; } -upstream erplibreCHANGEMEchat { +upstream erplibre_SERVER_NAME_chat { server 127.0.0.1:8072; } server { listen 80; - server_name CHANGEME.ca; + server_name DOMAIN; # Add Headers for erplibre proxy mode proxy_set_header X-Forwarded-Host $host; @@ -20,8 +22,8 @@ server { add_header X-XSS-Protection "1; mode=block"; # erplibre request log files - access_log /var/log/nginx/CHANGEME-access.log; - error_log /var/log/nginx/CHANGEME-error.log; + access_log /var/log/nginx/SERVER_NAME-access.log; + error_log /var/log/nginx/SERVER_NAME-error.log; # Increase proxy buffer size proxy_buffers 16 64k; @@ -51,7 +53,7 @@ server { client_max_body_size 1024M; location / { - proxy_pass http://erplibreCHANGEME; + proxy_pass http://erplibre_SERVER_NAME; # by default, do not forward anything proxy_redirect off; proxy_http_version 1.1; @@ -68,7 +70,7 @@ server { } location /websocket { - proxy_pass http://erplibreCHANGEMEchat; + proxy_pass http://erplibre_SERVER_NAME_chat; proxy_read_timeout 720s; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; @@ -88,6 +90,7 @@ server { proxy_cache_valid 404 1m; proxy_buffering on; expires 864000; - proxy_pass http://erplibreCHANGEME; + proxy_pass http://erplibre_SERVER_NAME; } + } diff --git a/script/nginx/template_nginx_odoo_17.0.txt b/script/nginx/template_nginx_odoo_17.0.txt new file mode 100644 index 0000000..1cab7d9 --- /dev/null +++ b/script/nginx/template_nginx_odoo_17.0.txt @@ -0,0 +1,96 @@ +# TODO replace SERVER_NAME by your server_name, example test_mysite_com +# TODO replace DOMAIN by your hostname, example test.mysite.com +# TODO RUN Certbot to update this file +upstream erplibre_SERVER_NAME { + server 127.0.0.1:8069; +} +upstream erplibre_SERVER_NAME_chat { + server 127.0.0.1:8072; +} + +server { + listen 80; + + server_name DOMAIN; + + # Add Headers for erplibre proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + add_header X-Frame-Options "SAMEORIGIN"; + add_header X-XSS-Protection "1; mode=block"; + + # erplibre request log files + access_log /var/log/nginx/SERVER_NAME-access.log; + error_log /var/log/nginx/SERVER_NAME-error.log; + + # Increase proxy buffer size + proxy_buffers 16 64k; + proxy_buffer_size 128k; + + proxy_read_timeout 720s; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + + # Force timeouts if the backend dies + proxy_next_upstream error timeout invalid_header http_500 http_502 + http_503; + + types { + text/less less; + text/scss scss; + } + + # Enable data compression + gzip on; + gzip_min_length 1100; + gzip_buffers 4 32k; + gzip_types text/css text/less text/plain text/xml application/xml application/json application/javascript application/pdf image/jpeg image/png; + gzip_vary on; + client_header_buffer_size 4k; + large_client_header_buffers 4 64k; + client_max_body_size 1024M; + + location / { + proxy_pass http://erplibre_SERVER_NAME; + # by default, do not forward anything + proxy_redirect off; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_read_timeout 720s; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + # Add Headers for odoo proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + } + + location /websocket { + proxy_pass http://erplibre_SERVER_NAME_chat; + proxy_read_timeout 720s; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + # Add Headers for odoo proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + } + + # cache some static data in memory for 60mins. + location ~ /[a-zA-Z0-9_-]*/static/ { + proxy_cache_valid 200 302 60m; + proxy_cache_valid 404 1m; + proxy_buffering on; + expires 864000; + proxy_pass http://erplibre_SERVER_NAME; + } + +} diff --git a/script/nginx/template_nginx_odoo_18.0.txt b/script/nginx/template_nginx_odoo_18.0.txt new file mode 100644 index 0000000..1cab7d9 --- /dev/null +++ b/script/nginx/template_nginx_odoo_18.0.txt @@ -0,0 +1,96 @@ +# TODO replace SERVER_NAME by your server_name, example test_mysite_com +# TODO replace DOMAIN by your hostname, example test.mysite.com +# TODO RUN Certbot to update this file +upstream erplibre_SERVER_NAME { + server 127.0.0.1:8069; +} +upstream erplibre_SERVER_NAME_chat { + server 127.0.0.1:8072; +} + +server { + listen 80; + + server_name DOMAIN; + + # Add Headers for erplibre proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + add_header X-Frame-Options "SAMEORIGIN"; + add_header X-XSS-Protection "1; mode=block"; + + # erplibre request log files + access_log /var/log/nginx/SERVER_NAME-access.log; + error_log /var/log/nginx/SERVER_NAME-error.log; + + # Increase proxy buffer size + proxy_buffers 16 64k; + proxy_buffer_size 128k; + + proxy_read_timeout 720s; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + + # Force timeouts if the backend dies + proxy_next_upstream error timeout invalid_header http_500 http_502 + http_503; + + types { + text/less less; + text/scss scss; + } + + # Enable data compression + gzip on; + gzip_min_length 1100; + gzip_buffers 4 32k; + gzip_types text/css text/less text/plain text/xml application/xml application/json application/javascript application/pdf image/jpeg image/png; + gzip_vary on; + client_header_buffer_size 4k; + large_client_header_buffers 4 64k; + client_max_body_size 1024M; + + location / { + proxy_pass http://erplibre_SERVER_NAME; + # by default, do not forward anything + proxy_redirect off; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_read_timeout 720s; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + # Add Headers for odoo proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + } + + location /websocket { + proxy_pass http://erplibre_SERVER_NAME_chat; + proxy_read_timeout 720s; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + # Add Headers for odoo proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + } + + # cache some static data in memory for 60mins. + location ~ /[a-zA-Z0-9_-]*/static/ { + proxy_cache_valid 200 302 60m; + proxy_cache_valid 404 1m; + proxy_buffering on; + expires 864000; + proxy_pass http://erplibre_SERVER_NAME; + } + +} diff --git a/script/nginx/template_nginx_ssl_odoo_12.0.txt b/script/nginx/template_nginx_ssl_odoo_12.0.txt new file mode 100644 index 0000000..dcfe137 --- /dev/null +++ b/script/nginx/template_nginx_ssl_odoo_12.0.txt @@ -0,0 +1,91 @@ +# TODO replace SERVER_NAME by your server_name, example test_mysite_com +# TODO replace DOMAIN by your hostname, example test.mysite.com +upstream erplibre_SERVER_NAME { + server 127.0.0.1:8069; +} +upstream erplibre_SERVER_NAME_chat { + server 127.0.0.1:8072; +} + +server { + + server_name DOMAIN; + + # Add Headers for erplibre proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + add_header X-Frame-Options "SAMEORIGIN"; + add_header X-XSS-Protection "1; mode=block"; + + # erplibre request log files + access_log /var/log/nginx/SERVER_NAME-access.log; + error_log /var/log/nginx/SERVER_NAME-error.log; + + # Increase proxy buffer size + proxy_buffers 16 64k; + proxy_buffer_size 128k; + + proxy_read_timeout 720s; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + + # Force timeouts if the backend dies + proxy_next_upstream error timeout invalid_header http_500 http_502 + http_503; + + types { + text/less less; + text/scss scss; + } + + # Enable data compression + gzip on; + gzip_min_length 1100; + gzip_buffers 4 32k; + gzip_types text/css text/less text/plain text/xml application/xml application/json application/javascript application/pdf image/jpeg image/png; + gzip_vary on; + client_header_buffer_size 4k; + large_client_header_buffers 4 64k; + client_max_body_size 1024M; + + location / { + proxy_pass http://erplibre_SERVER_NAME; + # by default, do not forward anything + proxy_redirect off; + } + + location /longpolling { + proxy_pass http://erplibre_SERVER_NAME_chat; + } + + # cache some static data in memory for 60mins. + location ~ /[a-zA-Z0-9_-]*/static/ { + proxy_cache_valid 200 302 60m; + proxy_cache_valid 404 1m; + proxy_buffering on; + expires 864000; + proxy_pass http://erplibre_SERVER_NAME; + } + + listen 443 ssl; # managed by Certbot + ssl_certificate /etc/letsencrypt/live/DOMAIN/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/letsencrypt/live/DOMAIN/privkey.pem; # managed by Certbot + include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot + +} + +server { + if ($host = DOMAIN) { + return 301 https://$host$request_uri; + } # managed by Certbot + + + listen 80; + + server_name DOMAIN; + return 404; # managed by Certbot + +} diff --git a/script/nginx/template_nginx_ssl_odoo_13.0.txt b/script/nginx/template_nginx_ssl_odoo_13.0.txt new file mode 100644 index 0000000..dcfe137 --- /dev/null +++ b/script/nginx/template_nginx_ssl_odoo_13.0.txt @@ -0,0 +1,91 @@ +# TODO replace SERVER_NAME by your server_name, example test_mysite_com +# TODO replace DOMAIN by your hostname, example test.mysite.com +upstream erplibre_SERVER_NAME { + server 127.0.0.1:8069; +} +upstream erplibre_SERVER_NAME_chat { + server 127.0.0.1:8072; +} + +server { + + server_name DOMAIN; + + # Add Headers for erplibre proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + add_header X-Frame-Options "SAMEORIGIN"; + add_header X-XSS-Protection "1; mode=block"; + + # erplibre request log files + access_log /var/log/nginx/SERVER_NAME-access.log; + error_log /var/log/nginx/SERVER_NAME-error.log; + + # Increase proxy buffer size + proxy_buffers 16 64k; + proxy_buffer_size 128k; + + proxy_read_timeout 720s; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + + # Force timeouts if the backend dies + proxy_next_upstream error timeout invalid_header http_500 http_502 + http_503; + + types { + text/less less; + text/scss scss; + } + + # Enable data compression + gzip on; + gzip_min_length 1100; + gzip_buffers 4 32k; + gzip_types text/css text/less text/plain text/xml application/xml application/json application/javascript application/pdf image/jpeg image/png; + gzip_vary on; + client_header_buffer_size 4k; + large_client_header_buffers 4 64k; + client_max_body_size 1024M; + + location / { + proxy_pass http://erplibre_SERVER_NAME; + # by default, do not forward anything + proxy_redirect off; + } + + location /longpolling { + proxy_pass http://erplibre_SERVER_NAME_chat; + } + + # cache some static data in memory for 60mins. + location ~ /[a-zA-Z0-9_-]*/static/ { + proxy_cache_valid 200 302 60m; + proxy_cache_valid 404 1m; + proxy_buffering on; + expires 864000; + proxy_pass http://erplibre_SERVER_NAME; + } + + listen 443 ssl; # managed by Certbot + ssl_certificate /etc/letsencrypt/live/DOMAIN/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/letsencrypt/live/DOMAIN/privkey.pem; # managed by Certbot + include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot + +} + +server { + if ($host = DOMAIN) { + return 301 https://$host$request_uri; + } # managed by Certbot + + + listen 80; + + server_name DOMAIN; + return 404; # managed by Certbot + +} diff --git a/script/nginx/template_nginx_ssl_odoo_14.0.txt b/script/nginx/template_nginx_ssl_odoo_14.0.txt new file mode 100644 index 0000000..736a116 --- /dev/null +++ b/script/nginx/template_nginx_ssl_odoo_14.0.txt @@ -0,0 +1,113 @@ +# TODO replace SERVER_NAME by your server_name, example test_mysite_com +# TODO replace DOMAIN by your hostname, example test.mysite.com +upstream erplibre_SERVER_NAME { + server 127.0.0.1:8069; +} +upstream erplibre_SERVER_NAME_chat { + server 127.0.0.1:8072; +} + +server { + + server_name DOMAIN; + + # Add Headers for erplibre proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + add_header X-Frame-Options "SAMEORIGIN"; + add_header X-XSS-Protection "1; mode=block"; + + # erplibre request log files + access_log /var/log/nginx/SERVER_NAME-access.log; + error_log /var/log/nginx/SERVER_NAME-error.log; + + # Increase proxy buffer size + proxy_buffers 16 64k; + proxy_buffer_size 128k; + + proxy_read_timeout 720s; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + + # Force timeouts if the backend dies + proxy_next_upstream error timeout invalid_header http_500 http_502 + http_503; + + types { + text/less less; + text/scss scss; + } + + # Enable data compression + gzip on; + gzip_min_length 1100; + gzip_buffers 4 32k; + gzip_types text/css text/less text/plain text/xml application/xml application/json application/javascript application/pdf image/jpeg image/png; + gzip_vary on; + client_header_buffer_size 4k; + large_client_header_buffers 4 64k; + client_max_body_size 1024M; + + location / { + proxy_pass http://erplibre_SERVER_NAME; + # by default, do not forward anything + proxy_redirect off; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_read_timeout 720s; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + # Add Headers for odoo proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + } + + location /websocket { + proxy_pass http://erplibre_SERVER_NAME_chat; + proxy_read_timeout 720s; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + # Add Headers for odoo proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + } + + # cache some static data in memory for 60mins. + location ~ /[a-zA-Z0-9_-]*/static/ { + proxy_cache_valid 200 302 60m; + proxy_cache_valid 404 1m; + proxy_buffering on; + expires 864000; + proxy_pass http://erplibre_SERVER_NAME; + } + + listen 443 ssl; # managed by Certbot + ssl_certificate /etc/letsencrypt/live/DOMAIN/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/letsencrypt/live/DOMAIN/privkey.pem; # managed by Certbot + include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot + +} + +server { + if ($host = DOMAIN) { + return 301 https://$host$request_uri; + } # managed by Certbot + + + listen 80; + + server_name DOMAIN; + return 404; # managed by Certbot + +} diff --git a/script/nginx/template_nginx_ssl_odoo_15.0.txt b/script/nginx/template_nginx_ssl_odoo_15.0.txt new file mode 100644 index 0000000..736a116 --- /dev/null +++ b/script/nginx/template_nginx_ssl_odoo_15.0.txt @@ -0,0 +1,113 @@ +# TODO replace SERVER_NAME by your server_name, example test_mysite_com +# TODO replace DOMAIN by your hostname, example test.mysite.com +upstream erplibre_SERVER_NAME { + server 127.0.0.1:8069; +} +upstream erplibre_SERVER_NAME_chat { + server 127.0.0.1:8072; +} + +server { + + server_name DOMAIN; + + # Add Headers for erplibre proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + add_header X-Frame-Options "SAMEORIGIN"; + add_header X-XSS-Protection "1; mode=block"; + + # erplibre request log files + access_log /var/log/nginx/SERVER_NAME-access.log; + error_log /var/log/nginx/SERVER_NAME-error.log; + + # Increase proxy buffer size + proxy_buffers 16 64k; + proxy_buffer_size 128k; + + proxy_read_timeout 720s; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + + # Force timeouts if the backend dies + proxy_next_upstream error timeout invalid_header http_500 http_502 + http_503; + + types { + text/less less; + text/scss scss; + } + + # Enable data compression + gzip on; + gzip_min_length 1100; + gzip_buffers 4 32k; + gzip_types text/css text/less text/plain text/xml application/xml application/json application/javascript application/pdf image/jpeg image/png; + gzip_vary on; + client_header_buffer_size 4k; + large_client_header_buffers 4 64k; + client_max_body_size 1024M; + + location / { + proxy_pass http://erplibre_SERVER_NAME; + # by default, do not forward anything + proxy_redirect off; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_read_timeout 720s; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + # Add Headers for odoo proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + } + + location /websocket { + proxy_pass http://erplibre_SERVER_NAME_chat; + proxy_read_timeout 720s; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + # Add Headers for odoo proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + } + + # cache some static data in memory for 60mins. + location ~ /[a-zA-Z0-9_-]*/static/ { + proxy_cache_valid 200 302 60m; + proxy_cache_valid 404 1m; + proxy_buffering on; + expires 864000; + proxy_pass http://erplibre_SERVER_NAME; + } + + listen 443 ssl; # managed by Certbot + ssl_certificate /etc/letsencrypt/live/DOMAIN/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/letsencrypt/live/DOMAIN/privkey.pem; # managed by Certbot + include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot + +} + +server { + if ($host = DOMAIN) { + return 301 https://$host$request_uri; + } # managed by Certbot + + + listen 80; + + server_name DOMAIN; + return 404; # managed by Certbot + +} diff --git a/script/nginx/template_nginx_ssl_odoo_16.0.txt b/script/nginx/template_nginx_ssl_odoo_16.0.txt new file mode 100644 index 0000000..736a116 --- /dev/null +++ b/script/nginx/template_nginx_ssl_odoo_16.0.txt @@ -0,0 +1,113 @@ +# TODO replace SERVER_NAME by your server_name, example test_mysite_com +# TODO replace DOMAIN by your hostname, example test.mysite.com +upstream erplibre_SERVER_NAME { + server 127.0.0.1:8069; +} +upstream erplibre_SERVER_NAME_chat { + server 127.0.0.1:8072; +} + +server { + + server_name DOMAIN; + + # Add Headers for erplibre proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + add_header X-Frame-Options "SAMEORIGIN"; + add_header X-XSS-Protection "1; mode=block"; + + # erplibre request log files + access_log /var/log/nginx/SERVER_NAME-access.log; + error_log /var/log/nginx/SERVER_NAME-error.log; + + # Increase proxy buffer size + proxy_buffers 16 64k; + proxy_buffer_size 128k; + + proxy_read_timeout 720s; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + + # Force timeouts if the backend dies + proxy_next_upstream error timeout invalid_header http_500 http_502 + http_503; + + types { + text/less less; + text/scss scss; + } + + # Enable data compression + gzip on; + gzip_min_length 1100; + gzip_buffers 4 32k; + gzip_types text/css text/less text/plain text/xml application/xml application/json application/javascript application/pdf image/jpeg image/png; + gzip_vary on; + client_header_buffer_size 4k; + large_client_header_buffers 4 64k; + client_max_body_size 1024M; + + location / { + proxy_pass http://erplibre_SERVER_NAME; + # by default, do not forward anything + proxy_redirect off; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_read_timeout 720s; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + # Add Headers for odoo proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + } + + location /websocket { + proxy_pass http://erplibre_SERVER_NAME_chat; + proxy_read_timeout 720s; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + # Add Headers for odoo proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + } + + # cache some static data in memory for 60mins. + location ~ /[a-zA-Z0-9_-]*/static/ { + proxy_cache_valid 200 302 60m; + proxy_cache_valid 404 1m; + proxy_buffering on; + expires 864000; + proxy_pass http://erplibre_SERVER_NAME; + } + + listen 443 ssl; # managed by Certbot + ssl_certificate /etc/letsencrypt/live/DOMAIN/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/letsencrypt/live/DOMAIN/privkey.pem; # managed by Certbot + include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot + +} + +server { + if ($host = DOMAIN) { + return 301 https://$host$request_uri; + } # managed by Certbot + + + listen 80; + + server_name DOMAIN; + return 404; # managed by Certbot + +} diff --git a/script/nginx/template_nginx_ssl_odoo_17.0.txt b/script/nginx/template_nginx_ssl_odoo_17.0.txt new file mode 100644 index 0000000..736a116 --- /dev/null +++ b/script/nginx/template_nginx_ssl_odoo_17.0.txt @@ -0,0 +1,113 @@ +# TODO replace SERVER_NAME by your server_name, example test_mysite_com +# TODO replace DOMAIN by your hostname, example test.mysite.com +upstream erplibre_SERVER_NAME { + server 127.0.0.1:8069; +} +upstream erplibre_SERVER_NAME_chat { + server 127.0.0.1:8072; +} + +server { + + server_name DOMAIN; + + # Add Headers for erplibre proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + add_header X-Frame-Options "SAMEORIGIN"; + add_header X-XSS-Protection "1; mode=block"; + + # erplibre request log files + access_log /var/log/nginx/SERVER_NAME-access.log; + error_log /var/log/nginx/SERVER_NAME-error.log; + + # Increase proxy buffer size + proxy_buffers 16 64k; + proxy_buffer_size 128k; + + proxy_read_timeout 720s; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + + # Force timeouts if the backend dies + proxy_next_upstream error timeout invalid_header http_500 http_502 + http_503; + + types { + text/less less; + text/scss scss; + } + + # Enable data compression + gzip on; + gzip_min_length 1100; + gzip_buffers 4 32k; + gzip_types text/css text/less text/plain text/xml application/xml application/json application/javascript application/pdf image/jpeg image/png; + gzip_vary on; + client_header_buffer_size 4k; + large_client_header_buffers 4 64k; + client_max_body_size 1024M; + + location / { + proxy_pass http://erplibre_SERVER_NAME; + # by default, do not forward anything + proxy_redirect off; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_read_timeout 720s; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + # Add Headers for odoo proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + } + + location /websocket { + proxy_pass http://erplibre_SERVER_NAME_chat; + proxy_read_timeout 720s; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + # Add Headers for odoo proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + } + + # cache some static data in memory for 60mins. + location ~ /[a-zA-Z0-9_-]*/static/ { + proxy_cache_valid 200 302 60m; + proxy_cache_valid 404 1m; + proxy_buffering on; + expires 864000; + proxy_pass http://erplibre_SERVER_NAME; + } + + listen 443 ssl; # managed by Certbot + ssl_certificate /etc/letsencrypt/live/DOMAIN/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/letsencrypt/live/DOMAIN/privkey.pem; # managed by Certbot + include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot + +} + +server { + if ($host = DOMAIN) { + return 301 https://$host$request_uri; + } # managed by Certbot + + + listen 80; + + server_name DOMAIN; + return 404; # managed by Certbot + +} diff --git a/script/nginx/template_nginx_ssl_odoo_18.0.txt b/script/nginx/template_nginx_ssl_odoo_18.0.txt new file mode 100644 index 0000000..736a116 --- /dev/null +++ b/script/nginx/template_nginx_ssl_odoo_18.0.txt @@ -0,0 +1,113 @@ +# TODO replace SERVER_NAME by your server_name, example test_mysite_com +# TODO replace DOMAIN by your hostname, example test.mysite.com +upstream erplibre_SERVER_NAME { + server 127.0.0.1:8069; +} +upstream erplibre_SERVER_NAME_chat { + server 127.0.0.1:8072; +} + +server { + + server_name DOMAIN; + + # Add Headers for erplibre proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + add_header X-Frame-Options "SAMEORIGIN"; + add_header X-XSS-Protection "1; mode=block"; + + # erplibre request log files + access_log /var/log/nginx/SERVER_NAME-access.log; + error_log /var/log/nginx/SERVER_NAME-error.log; + + # Increase proxy buffer size + proxy_buffers 16 64k; + proxy_buffer_size 128k; + + proxy_read_timeout 720s; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + + # Force timeouts if the backend dies + proxy_next_upstream error timeout invalid_header http_500 http_502 + http_503; + + types { + text/less less; + text/scss scss; + } + + # Enable data compression + gzip on; + gzip_min_length 1100; + gzip_buffers 4 32k; + gzip_types text/css text/less text/plain text/xml application/xml application/json application/javascript application/pdf image/jpeg image/png; + gzip_vary on; + client_header_buffer_size 4k; + large_client_header_buffers 4 64k; + client_max_body_size 1024M; + + location / { + proxy_pass http://erplibre_SERVER_NAME; + # by default, do not forward anything + proxy_redirect off; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_read_timeout 720s; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + # Add Headers for odoo proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + } + + location /websocket { + proxy_pass http://erplibre_SERVER_NAME_chat; + proxy_read_timeout 720s; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_connect_timeout 720s; + proxy_send_timeout 720s; + # Add Headers for odoo proxy mode + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + } + + # cache some static data in memory for 60mins. + location ~ /[a-zA-Z0-9_-]*/static/ { + proxy_cache_valid 200 302 60m; + proxy_cache_valid 404 1m; + proxy_buffering on; + expires 864000; + proxy_pass http://erplibre_SERVER_NAME; + } + + listen 443 ssl; # managed by Certbot + ssl_certificate /etc/letsencrypt/live/DOMAIN/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/letsencrypt/live/DOMAIN/privkey.pem; # managed by Certbot + include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot + +} + +server { + if ($host = DOMAIN) { + return 301 https://$host$request_uri; + } # managed by Certbot + + + listen 80; + + server_name DOMAIN; + return 404; # managed by Certbot + +}