mirror of
https://git.nerdvpn.de/NerdVPN.de/invidious
synced 2026-02-14 22:51:42 +01:00
Rebase after invidious upstream updates
This commit is contained in:
Sommerwiesel
@@ -0,0 +1,71 @@
|
||||
user www-data;
|
||||
worker_processes 8;
|
||||
worker_rlimit_nofile 25000;
|
||||
pid /run/nginx.pid;
|
||||
include /etc/nginx/modules-enabled/*.conf;
|
||||
|
||||
events {
|
||||
worker_connections 4096;
|
||||
# multi_accept on;
|
||||
}
|
||||
|
||||
http {
|
||||
|
||||
##
|
||||
# Basic Settings
|
||||
##
|
||||
|
||||
sendfile on;
|
||||
tcp_nopush on;
|
||||
tcp_nodelay on;
|
||||
keepalive_timeout 65;
|
||||
types_hash_max_size 2048;
|
||||
server_tokens off;
|
||||
ssl_session_cache shared:nginx_TLS_default:4m;
|
||||
client_max_body_size 2M;
|
||||
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
|
||||
##
|
||||
# SSL Settings
|
||||
##
|
||||
|
||||
include snippets/tls12.conf;
|
||||
include snippets/ocsp.conf;
|
||||
ssl_dhparam /srv/letsencrypt/dhparam.pem;
|
||||
|
||||
##
|
||||
# Logging Settings
|
||||
##
|
||||
|
||||
access_log off;
|
||||
error_log /dev/null emerg;
|
||||
|
||||
|
||||
##
|
||||
# Maintenance mode
|
||||
##
|
||||
|
||||
include snippets/invidious_access.conf;
|
||||
|
||||
##
|
||||
# Gzip Settings
|
||||
##
|
||||
|
||||
gzip on;
|
||||
gzip_vary on;
|
||||
gzip_min_length 10240;
|
||||
gzip_proxied expired no-cache no-store private auth;
|
||||
gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml;
|
||||
|
||||
limit_req_status 429;
|
||||
limit_conn_status 429;
|
||||
|
||||
##
|
||||
# Virtual Host Configs
|
||||
##
|
||||
|
||||
include /etc/nginx/sites-enabled/*.vhost;
|
||||
}
|
||||
@@ -0,0 +1,728 @@
|
||||
upstream invidious {
|
||||
least_conn;
|
||||
server 192.42.6.2:3000 fail_timeout=3s;
|
||||
server 192.42.6.3:3000 fail_timeout=3s;
|
||||
server 192.42.6.4:3000 fail_timeout=3s;
|
||||
server 192.42.6.5:3000 fail_timeout=3s;
|
||||
server 192.42.6.6:3000 fail_timeout=3s;
|
||||
server 192.42.6.7:3000 fail_timeout=3s;
|
||||
keepalive 30;
|
||||
}
|
||||
|
||||
upstream invidious_worker {
|
||||
server 192.42.6.9:3000;
|
||||
keepalive 1;
|
||||
}
|
||||
|
||||
upstream invidious_proxy {
|
||||
server unix:/srv/ytproxy/http-proxy.sock;
|
||||
keepalive 6;
|
||||
}
|
||||
|
||||
upstream invidious_tor {
|
||||
server 192.42.6.8:3000;
|
||||
keepalive 2;
|
||||
}
|
||||
|
||||
upstream ryd_proxy {
|
||||
server 192.42.6.14:3000;
|
||||
keepalive 3;
|
||||
}
|
||||
|
||||
upstream invidious_sync {
|
||||
server 192.42.6.15:80;
|
||||
keepalive 3;
|
||||
}
|
||||
|
||||
upstream invidious_peer {
|
||||
server 192.42.6.19:9000;
|
||||
keepalive 3;
|
||||
}
|
||||
|
||||
map $upstream_addr $server_instance {
|
||||
default "invidious";
|
||||
192.42.6.2:3000 "invidious_1";
|
||||
192.42.6.3:3000 "invidious_2";
|
||||
192.42.6.4:3000 "invidious_3";
|
||||
192.42.6.5:3000 "invidious_4";
|
||||
192.42.6.6:3000 "invidious_5";
|
||||
192.42.6.7:3000 "invidious_6";
|
||||
}
|
||||
|
||||
# I use this line to switch to a testing instance of invidious when I test a new docker image
|
||||
geo $upstream_server {
|
||||
default invidious;
|
||||
}
|
||||
|
||||
# Toggle to switch between using team piped ytproxy or invidious to server google asssets and video stream
|
||||
geo $ivproxy_server {
|
||||
default invidious_proxy;
|
||||
#default invidious;
|
||||
}
|
||||
|
||||
# The api is for internal access only
|
||||
geo $api_invidious_access {
|
||||
default 0;
|
||||
|
||||
# locahost
|
||||
127.0.0.1/32 1;
|
||||
|
||||
# Docker network
|
||||
192.42.0.0/16 1;
|
||||
}
|
||||
|
||||
# Access to feeds is rate limited except for google ips
|
||||
geo $feeds_whitelist {
|
||||
default 0;
|
||||
# CIDR in the list below are not limited
|
||||
|
||||
# Google
|
||||
8.34.208.0/20 1;
|
||||
8.35.192.0/20 1;
|
||||
23.236.48.0/20 1;
|
||||
23.251.128.0/19 1;
|
||||
34.0.0.0/15 1;
|
||||
34.2.0.0/16 1;
|
||||
34.3.0.0/23 1;
|
||||
34.3.3.0/24 1;
|
||||
34.3.4.0/24 1;
|
||||
34.3.8.0/21 1;
|
||||
34.3.16.0/20 1;
|
||||
34.3.32.0/19 1;
|
||||
34.3.64.0/18 1;
|
||||
34.4.0.0/14 1;
|
||||
34.8.0.0/13 1;
|
||||
34.16.0.0/12 1;
|
||||
34.32.0.0/11 1;
|
||||
34.64.0.0/10 1;
|
||||
34.128.0.0/10 1;
|
||||
35.184.0.0/13 1;
|
||||
35.192.0.0/14 1;
|
||||
35.196.0.0/15 1;
|
||||
35.198.0.0/16 1;
|
||||
35.199.0.0/17 1;
|
||||
35.199.128.0/18 1;
|
||||
35.200.0.0/13 1;
|
||||
35.208.0.0/12 1;
|
||||
35.224.0.0/12 1;
|
||||
35.240.0.0/13 1;
|
||||
64.15.112.0/20 1;
|
||||
64.233.160.0/19 1;
|
||||
66.22.228.0/23 1;
|
||||
66.102.0.0/20 1;
|
||||
66.249.64.0/19 1;
|
||||
70.32.128.0/19 1;
|
||||
72.14.192.0/18 1;
|
||||
74.125.0.0/16 1;
|
||||
104.154.0.0/15 1;
|
||||
104.196.0.0/14 1;
|
||||
104.237.160.0/19 1;
|
||||
107.167.160.0/19 1;
|
||||
107.178.192.0/18 1;
|
||||
108.59.80.0/20 1;
|
||||
108.170.192.0/18 1;
|
||||
108.177.0.0/17 1;
|
||||
130.211.0.0/16 1;
|
||||
142.250.0.0/15 1;
|
||||
146.148.0.0/17 1;
|
||||
162.216.148.0/22 1;
|
||||
162.222.176.0/21 1;
|
||||
172.110.32.0/21 1;
|
||||
172.217.0.0/16 1;
|
||||
172.253.0.0/16 1;
|
||||
173.194.0.0/16 1;
|
||||
173.255.112.0/20 1;
|
||||
193.186.4.0/24 1;
|
||||
199.36.154.0/23 1;
|
||||
199.36.156.0/24 1;
|
||||
199.192.112.0/22 1;
|
||||
199.223.232.0/21 1;
|
||||
207.223.160.0/20 1;
|
||||
208.65.152.0/22 1;
|
||||
208.68.108.0/22 1;
|
||||
208.81.188.0/22 1;
|
||||
208.117.224.0/19 1;
|
||||
209.85.128.0/17 1;
|
||||
216.58.192.0/19 1;
|
||||
216.73.80.0/20 1;
|
||||
216.239.32.0/19 1;
|
||||
2001:4860::/32 1;
|
||||
2404:6800::/32 1;
|
||||
2404:f340::/32 1;
|
||||
2600:1900::/28 1;
|
||||
2606:73c0::/32 1;
|
||||
2607:f8b0::/32 1;
|
||||
2620:11a:a000::/40 1;
|
||||
2620:120:e000::/40 1;
|
||||
2800:3f0::/32 1;
|
||||
2a00:1450::/32 1;
|
||||
2c0f:fb50::/32 1;
|
||||
}
|
||||
|
||||
map $feeds_whitelist $feeds_limit {
|
||||
0 "";
|
||||
1 $binary_remote_addr;
|
||||
}
|
||||
|
||||
# Limit login to prevent bruteforce
|
||||
limit_req_zone $binary_remote_addr zone=invidious_login:5m rate=2r/s;
|
||||
|
||||
# Limit global requests to prevent DoS
|
||||
limit_req_zone $binary_remote_addr zone=invidious_requests:5m rate=5r/s;
|
||||
|
||||
# Limit webfeed hook
|
||||
limit_req_zone $feeds_limit zone=invidious_feeds:5m rate=3r/s;
|
||||
|
||||
#######
|
||||
# HTTP
|
||||
#######
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
|
||||
server_name invidious.nerdvpn.de www.invidious.nerdvpn.de;
|
||||
root /srv/nginx/public/invidious;
|
||||
|
||||
location /.well-known/acme-challenge/ {
|
||||
allow all;
|
||||
default_type "text/plain";
|
||||
alias /srv/nginx/public/acme/;
|
||||
}
|
||||
|
||||
location / {
|
||||
return 301 https://invidious.nerdvpn.de$request_uri;
|
||||
}
|
||||
}
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
|
||||
server_name api.invidious.nerdvpn.de;
|
||||
root /srv/nginx/public/invidious;
|
||||
|
||||
location /.well-known/acme-challenge/ {
|
||||
allow all;
|
||||
default_type "text/plain";
|
||||
alias /srv/nginx/public/acme/;
|
||||
}
|
||||
|
||||
location / {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
}
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
|
||||
server_name ryd.invidious.nerdvpn.de;
|
||||
root /srv/nginx/public/invidious;
|
||||
|
||||
location /.well-known/acme-challenge/ {
|
||||
allow all;
|
||||
default_type "text/plain";
|
||||
alias /srv/nginx/public/acme/;
|
||||
}
|
||||
|
||||
location / {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
}
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
|
||||
server_name sync.invidious.nerdvpn.de;
|
||||
root /srv/nginx/public/invidious;
|
||||
|
||||
location /.well-known/acme-challenge/ {
|
||||
allow all;
|
||||
default_type "text/plain";
|
||||
alias /srv/nginx/public/acme/;
|
||||
}
|
||||
|
||||
location / {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
}
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
|
||||
server_name peer.invidious.nerdvpn.de;
|
||||
root /srv/nginx/public/invidious;
|
||||
|
||||
location /.well-known/acme-challenge/ {
|
||||
allow all;
|
||||
default_type "text/plain";
|
||||
alias /srv/nginx/public/acme/;
|
||||
}
|
||||
|
||||
location / {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
########
|
||||
# HTTPS
|
||||
########
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
listen [::]:443 ssl;
|
||||
|
||||
http2 on;
|
||||
|
||||
server_name api.invidious.nerdvpn.de;
|
||||
root /srv/nginx/public/invidious;
|
||||
|
||||
ssl_session_cache shared:nginx_TLS_api_invidious:5m;
|
||||
|
||||
add_header X-Robots-Tag "none";
|
||||
|
||||
ssl_certificate /srv/letsencrypt/certs/api.invidious.nerdvpn.de/fullchain.pem;
|
||||
ssl_certificate_key /srv/letsencrypt/certs/api.invidious.nerdvpn.de/privkey.pem;
|
||||
include snippets/htst.conf;
|
||||
|
||||
access_log off;
|
||||
error_log /dev/null emerg;
|
||||
|
||||
include snippets/malicious.conf;
|
||||
|
||||
proxy_hide_header Access-Control-Allow-Origin;
|
||||
add_header Access-Control-Allow-Credentials true;
|
||||
add_header Access-Control-Allow-Origin "https://materialious.nerdvpn.de" always;
|
||||
add_header Access-Control-Allow-Methods "GET, POST, OPTIONS, HEAD, PATCH, PUT, DELETE" always;
|
||||
add_header Access-Control-Allow-Headers "User-Agent, Authorization, Content-Type" always;
|
||||
|
||||
location = /favicon.ico {
|
||||
allow all;
|
||||
}
|
||||
|
||||
location = /robots.txt {
|
||||
add_header Content-Type text/plain;
|
||||
return 200 "User-agent: *\nDisallow: /";
|
||||
}
|
||||
|
||||
location = /css/default.css {
|
||||
root /srv/nginx/public/invidious;
|
||||
}
|
||||
|
||||
limit_rate 6000k;
|
||||
|
||||
location / {
|
||||
if ($api_invidious_access != 1) {
|
||||
return 302 "https://invidious.nerdvpn.de$request_uri";
|
||||
}
|
||||
|
||||
if ($request_method = OPTIONS) {
|
||||
return 204;
|
||||
}
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header "Connection" "";
|
||||
|
||||
proxy_pass http://$upstream_server;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
location ~ /(css|js|fonts|login|authorize_token|api) {
|
||||
if ($request_method = OPTIONS) {
|
||||
return 204;
|
||||
}
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header "Connection" "";
|
||||
|
||||
proxy_pass http://$upstream_server;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
}
|
||||
server {
|
||||
listen 443 ssl;
|
||||
listen [::]:443 ssl;
|
||||
|
||||
http2 on;
|
||||
|
||||
server_name ryd.invidious.nerdvpn.de;
|
||||
root /srv/nginx/public/invidious;
|
||||
|
||||
ssl_session_cache shared:nginx_TLS_ryd:5m;
|
||||
|
||||
add_header X-Robots-Tag "none";
|
||||
|
||||
ssl_certificate /srv/letsencrypt/certs/ryd.invidious.nerdvpn.de/fullchain.pem;
|
||||
ssl_certificate_key /srv/letsencrypt/certs/ryd.invidious.nerdvpn.de/privkey.pem;
|
||||
include snippets/htst.conf;
|
||||
|
||||
access_log off;
|
||||
error_log /dev/null emerg;
|
||||
|
||||
include snippets/malicious.conf;
|
||||
|
||||
location = /favicon.ico {
|
||||
allow all;
|
||||
}
|
||||
|
||||
location = /robots.txt {
|
||||
add_header Content-Type text/plain;
|
||||
return 200 "User-agent: *\nDisallow: /";
|
||||
}
|
||||
|
||||
limit_rate 6000k;
|
||||
|
||||
location / {
|
||||
add_header Access-Control-Allow-Origin "https://materialious.nerdvpn.de" always;
|
||||
add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header "Connection" "";
|
||||
proxy_pass http://ryd_proxy;
|
||||
}
|
||||
}
|
||||
server {
|
||||
listen 443 ssl;
|
||||
listen [::]:443 ssl;
|
||||
|
||||
http2 on;
|
||||
|
||||
server_name sync.invidious.nerdvpn.de;
|
||||
root /srv/nginx/public/invidious;
|
||||
|
||||
ssl_session_cache shared:nginx_TLS_sync:5m;
|
||||
|
||||
add_header X-Robots-Tag "none";
|
||||
|
||||
ssl_certificate /srv/letsencrypt/certs/sync.invidious.nerdvpn.de/fullchain.pem;
|
||||
ssl_certificate_key /srv/letsencrypt/certs/sync.invidious.nerdvpn.de/privkey.pem;
|
||||
include snippets/htst.conf;
|
||||
|
||||
access_log off;
|
||||
error_log /dev/null emerg;
|
||||
|
||||
include snippets/malicious.conf;
|
||||
|
||||
location = /favicon.ico {
|
||||
allow all;
|
||||
}
|
||||
|
||||
location = /robots.txt {
|
||||
add_header Content-Type text/plain;
|
||||
return 200 "User-agent: *\nDisallow: /";
|
||||
}
|
||||
|
||||
limit_rate 6000k;
|
||||
|
||||
location / {
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header "Connection" "";
|
||||
proxy_pass http://invidious_sync;
|
||||
}
|
||||
}
|
||||
server {
|
||||
listen 443 ssl;
|
||||
listen [::]:443 ssl;
|
||||
|
||||
http2 on;
|
||||
|
||||
server_name peer.invidious.nerdvpn.de;
|
||||
root /srv/nginx/public/invidious;
|
||||
|
||||
ssl_session_cache shared:nginx_TLS_peer:5m;
|
||||
|
||||
add_header X-Robots-Tag "none";
|
||||
|
||||
ssl_certificate /srv/letsencrypt/certs/peer.invidious.nerdvpn.de/fullchain.pem;
|
||||
ssl_certificate_key /srv/letsencrypt/certs/peer.invidious.nerdvpn.de/privkey.pem;
|
||||
include snippets/htst.conf;
|
||||
|
||||
access_log off;
|
||||
error_log /dev/null emerg;
|
||||
|
||||
include snippets/invidious-errorpages.conf;
|
||||
|
||||
location = /favicon.ico {
|
||||
allow all;
|
||||
}
|
||||
|
||||
location = /robots.txt {
|
||||
add_header Content-Type text/plain;
|
||||
return 200 "User-agent: *\nDisallow: /";
|
||||
}
|
||||
|
||||
limit_rate 6000k;
|
||||
|
||||
location / {
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header "Connection" "";
|
||||
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_pass http://invidious_peer;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
listen [::]:443 ssl;
|
||||
|
||||
http2 on;
|
||||
|
||||
server_name www.invidious.nerdvpn.de;
|
||||
root /srv/nginx/public/invidious;
|
||||
|
||||
ssl_certificate /srv/letsencrypt/certs/invidious.nerdvpn.de/fullchain.pem;
|
||||
ssl_certificate_key /srv/letsencrypt/certs/invidious.nerdvpn.de/privkey.pem;
|
||||
include snippets/htst.conf;
|
||||
|
||||
access_log off;
|
||||
error_log /dev/null emerg;
|
||||
|
||||
location / {
|
||||
return 301 https://invidious.nerdvpn.de$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
listen 443 default_server quic reuseport;
|
||||
listen [::]:443 ssl;
|
||||
listen [::]:443 default_server quic reuseport;
|
||||
|
||||
http2 on;
|
||||
http3 on;
|
||||
quic_retry on;
|
||||
|
||||
server_name invidious.nerdvpn.de;
|
||||
root /srv/nginx/public/invidious;
|
||||
|
||||
add_header Alt-Svc 'h3=":443"; ma=86400';
|
||||
add_header X-server-instance $server_instance always;
|
||||
add_header X-server-proto $server_protocol always;
|
||||
add_header Onion-Location http://nerdvpneaggggfdiurknszkbmhvjndks5z5k3g5yp4nhphflh3n3boad.onion$request_uri;
|
||||
|
||||
ssl_session_cache shared:nginx_TLS_invidious:10m;
|
||||
|
||||
add_header X-Robots-Tag "noindex, nofollow, noai, noimageai";
|
||||
|
||||
ssl_certificate /srv/letsencrypt/certs/invidious.nerdvpn.de/fullchain.pem;
|
||||
ssl_certificate_key /srv/letsencrypt/certs/invidious.nerdvpn.de/privkey.pem;
|
||||
include snippets/htst.conf;
|
||||
|
||||
access_log off;
|
||||
error_log /dev/null emerg;
|
||||
|
||||
include snippets/malicious.conf;
|
||||
|
||||
limit_rate 6000k;
|
||||
|
||||
location = /favicon.ico {
|
||||
include /etc/nginx/bots.d/ddos.conf;
|
||||
allow all;
|
||||
}
|
||||
|
||||
location = /robots.txt {
|
||||
add_header Content-Type text/plain;
|
||||
return 200 "User-agent: GPTBot\nDisallow: /\nUser-agent: ChatGPT-User\nDisallow: /\nUser-agent: FacebookBot\nDisallow: /\nUser-agent: archive.org_bot\nDisallow: /\nUser-agent: Amazonbot\nDisallow: /\nUser-agent: *\nDisallow:";
|
||||
}
|
||||
|
||||
error_page 503 @maintenance;
|
||||
location @maintenance {
|
||||
root /srv/nginx/public/maintenance/;
|
||||
rewrite ^ "/index.html" break;
|
||||
}
|
||||
|
||||
location /api/v1/stats {
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header "Connection" "";
|
||||
proxy_pass http://invidious/api/v1/stats;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
location ~ (^/feed/webhook) {
|
||||
limit_req zone=invidious_feeds burst=240 delay=80;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header "Connection" "";
|
||||
proxy_pass http://invidious_worker;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
location / {
|
||||
limit_req zone=invidious_requests burst=240 delay=80;
|
||||
|
||||
if ($invidious_access != 1) {
|
||||
return 503;
|
||||
}
|
||||
if ($request_method = OPTIONS) {
|
||||
return 204;
|
||||
}
|
||||
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header "Connection" "";
|
||||
proxy_pass http://$upstream_server;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
# video streaming and downloads
|
||||
|
||||
location ~ (^/videoplayback) {
|
||||
limit_req zone=invidious_requests burst=240 delay=80;
|
||||
|
||||
# Limit user video streaming to 32 MBit/s
|
||||
limit_rate 4000k;
|
||||
|
||||
proxy_set_header X-Forwarded-For "";
|
||||
proxy_set_header CF-Connecting-IP "";
|
||||
proxy_hide_header "alt-svc";
|
||||
|
||||
sendfile on;
|
||||
sendfile_max_chunk 512k;
|
||||
tcp_nopush on;
|
||||
aio threads=default;
|
||||
aio_write on;
|
||||
directio 16m;
|
||||
|
||||
proxy_hide_header Cache-Control;
|
||||
proxy_hide_header etag;
|
||||
proxy_set_header Connection keep-alive;
|
||||
proxy_max_temp_file_size 32m;
|
||||
|
||||
proxy_http_version 1.1;
|
||||
proxy_pass http://$ivproxy_server;
|
||||
add_header Cache-Control private always;
|
||||
}
|
||||
# static assets from yt
|
||||
location ~ (^/vi/|^/ggpht/) {
|
||||
limit_req zone=invidious_requests burst=240 delay=80;
|
||||
limit_rate 8000k;
|
||||
|
||||
proxy_set_header X-Forwarded-For "";
|
||||
proxy_set_header CF-Connecting-IP "";
|
||||
proxy_hide_header "alt-svc";
|
||||
|
||||
sendfile on;
|
||||
sendfile_max_chunk 512k;
|
||||
tcp_nopush on;
|
||||
aio threads=default;
|
||||
aio_write on;
|
||||
directio 16m;
|
||||
|
||||
proxy_hide_header Cache-Control;
|
||||
proxy_hide_header etag;
|
||||
proxy_set_header Connection keep-alive;
|
||||
proxy_max_temp_file_size 32m;
|
||||
|
||||
proxy_http_version 1.1;
|
||||
proxy_pass http://$ivproxy_server;
|
||||
add_header Cache-Control private always;
|
||||
}
|
||||
location ~ /(login) {
|
||||
limit_req zone=invidious_login burst=4 nodelay;
|
||||
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header "Connection" "";
|
||||
proxy_pass http://$upstream_server;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
location ~ /(css|js|fonts|delete_account|data_control|subscription_manager) {
|
||||
limit_req zone=invidious_requests burst=240 delay=80;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header "Connection" "";
|
||||
proxy_pass http://$upstream_server;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen unix:/var/run/invidious-tor.sock;
|
||||
|
||||
server_name nerdvpneaggggfdiurknszkbmhvjndks5z5k3g5yp4nhphflh3n3boad.onion;
|
||||
root /srv/nginx/public/invidious;
|
||||
|
||||
add_header X-server-instance $server_instance always;
|
||||
|
||||
access_log off;
|
||||
error_log /dev/null emerg;
|
||||
|
||||
error_page 503 @maintenance;
|
||||
location @maintenance {
|
||||
root /srv/nginx/public/maintenance/;
|
||||
rewrite ^ "/index.html" break;
|
||||
}
|
||||
|
||||
location / {
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header "Connection" "";
|
||||
proxy_pass http://invidious_tor;
|
||||
proxy_set_header Host $host;
|
||||
}
|
||||
# video streaming
|
||||
location ~ (^/videoplayback) {
|
||||
proxy_set_header X-Forwarded-For "";
|
||||
proxy_set_header CF-Connecting-IP "";
|
||||
proxy_hide_header "alt-svc";
|
||||
|
||||
sendfile on;
|
||||
sendfile_max_chunk 512k;
|
||||
tcp_nopush on;
|
||||
aio threads=default;
|
||||
aio_write on;
|
||||
directio 16m;
|
||||
|
||||
proxy_hide_header Cache-Control;
|
||||
proxy_hide_header etag;
|
||||
proxy_set_header Connection keep-alive;
|
||||
proxy_max_temp_file_size 32m;
|
||||
|
||||
proxy_http_version 1.1;
|
||||
proxy_pass http://$ivproxy_server;
|
||||
add_header Cache-Control private always;
|
||||
}
|
||||
# assets from yt
|
||||
location ~ (^/vi/|^/ggpht/) {
|
||||
proxy_set_header X-Forwarded-For "";
|
||||
proxy_set_header CF-Connecting-IP "";
|
||||
proxy_hide_header "alt-svc";
|
||||
|
||||
sendfile on;
|
||||
sendfile_max_chunk 512k;
|
||||
tcp_nopush on;
|
||||
aio threads=default;
|
||||
aio_write on;
|
||||
directio 16m;
|
||||
|
||||
proxy_hide_header Cache-Control;
|
||||
proxy_hide_header etag;
|
||||
proxy_set_header Connection keep-alive;
|
||||
proxy_max_temp_file_size 32m;
|
||||
|
||||
proxy_http_version 1.1;
|
||||
proxy_pass http://$ivproxy_server;
|
||||
add_header Cache-Control private always;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
ssl_dhparam /srv/letsencrypt/dhparam/dhparam.pem;
|
||||
@@ -0,0 +1 @@
|
||||
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
|
||||
@@ -0,0 +1,86 @@
|
||||
geo $invidious_access {
|
||||
# To enable maintenance mode, set default to 0 to lock out all visitors not whitelisted below
|
||||
default 1;
|
||||
|
||||
# Always allow Google
|
||||
8.34.208.0/20 1;
|
||||
8.35.192.0/20 1;
|
||||
23.236.48.0/20 1;
|
||||
23.251.128.0/19 1;
|
||||
34.0.0.0/15 1;
|
||||
34.2.0.0/16 1;
|
||||
34.3.0.0/23 1;
|
||||
34.3.3.0/24 1;
|
||||
34.3.4.0/24 1;
|
||||
34.3.8.0/21 1;
|
||||
34.3.16.0/20 1;
|
||||
34.3.32.0/19 1;
|
||||
34.3.64.0/18 1;
|
||||
34.4.0.0/14 1;
|
||||
34.8.0.0/13 1;
|
||||
34.16.0.0/12 1;
|
||||
34.32.0.0/11 1;
|
||||
34.64.0.0/10 1;
|
||||
34.128.0.0/10 1;
|
||||
35.184.0.0/13 1;
|
||||
35.192.0.0/14 1;
|
||||
35.196.0.0/15 1;
|
||||
35.198.0.0/16 1;
|
||||
35.199.0.0/17 1;
|
||||
35.199.128.0/18 1;
|
||||
35.200.0.0/13 1;
|
||||
35.208.0.0/12 1;
|
||||
35.224.0.0/12 1;
|
||||
35.240.0.0/13 1;
|
||||
64.15.112.0/20 1;
|
||||
64.233.160.0/19 1;
|
||||
66.22.228.0/23 1;
|
||||
66.102.0.0/20 1;
|
||||
66.249.64.0/19 1;
|
||||
70.32.128.0/19 1;
|
||||
72.14.192.0/18 1;
|
||||
74.125.0.0/16 1;
|
||||
104.154.0.0/15 1;
|
||||
104.196.0.0/14 1;
|
||||
104.237.160.0/19 1;
|
||||
107.167.160.0/19 1;
|
||||
107.178.192.0/18 1;
|
||||
108.59.80.0/20 1;
|
||||
108.170.192.0/18 1;
|
||||
108.177.0.0/17 1;
|
||||
130.211.0.0/16 1;
|
||||
142.250.0.0/15 1;
|
||||
146.148.0.0/17 1;
|
||||
162.216.148.0/22 1;
|
||||
162.222.176.0/21 1;
|
||||
172.110.32.0/21 1;
|
||||
172.217.0.0/16 1;
|
||||
172.253.0.0/16 1;
|
||||
173.194.0.0/16 1;
|
||||
173.255.112.0/20 1;
|
||||
193.186.4.0/24 1;
|
||||
199.36.154.0/23 1;
|
||||
199.36.156.0/24 1;
|
||||
199.192.112.0/22 1;
|
||||
199.223.232.0/21 1;
|
||||
207.223.160.0/20 1;
|
||||
208.65.152.0/22 1;
|
||||
208.68.108.0/22 1;
|
||||
208.81.188.0/22 1;
|
||||
208.117.224.0/19 1;
|
||||
209.85.128.0/17 1;
|
||||
216.58.192.0/19 1;
|
||||
216.73.80.0/20 1;
|
||||
216.239.32.0/19 1;
|
||||
2001:4860::/32 1;
|
||||
2404:6800::/32 1;
|
||||
2404:f340::/32 1;
|
||||
2600:1900::/28 1;
|
||||
2606:73c0::/32 1;
|
||||
2607:f8b0::/32 1;
|
||||
2620:11a:a000::/40 1;
|
||||
2620:120:e000::/40 1;
|
||||
2800:3f0::/32 1;
|
||||
2a00:1450::/32 1;
|
||||
2c0f:fb50::/32 1;
|
||||
}
|
||||
@@ -0,0 +1,14 @@
|
||||
# Currently include a list of IPs originating from Russian and Chinese official bureau (i.e. Roskomnadzor)
|
||||
if ($evilgovernments) {
|
||||
return 451;
|
||||
}
|
||||
|
||||
if ($http_user_agent ~* LWP::Simple|BBBike|wget|jorgee) {
|
||||
return 403;
|
||||
}
|
||||
|
||||
client_body_timeout 15s;
|
||||
client_header_timeout 15s;
|
||||
location ~* .(display_errors|set_time_limit|allow_url_include.*disable_functions.*open_basedir|set_magic_quotes_runtime|webconfig.txt.php|file_put_contentssever_root|wlwmanifest|encode|localhost|loopback|xmlrpc|revslider|roundcube|smtp|http\:|soap|w00tw00t) {
|
||||
return 404;
|
||||
}
|
||||
@@ -0,0 +1,3 @@
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
ssl_trusted_certificate /srv/letsencrypt/ocsp/BPClass2CA2Bundle.pem;
|
||||
@@ -0,0 +1,5 @@
|
||||
ssl_session_timeout 3h;
|
||||
ssl_session_tickets off;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
ssl_prefer_server_ciphers off;
|
||||
Reference in New Issue
Block a user