NerdVPN.de/invidious
1
0
Fork 0
mirror of https://git.nerdvpn.de/NerdVPN.de/invidious synced 2026-02-14 22:51:42 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
66d0951fb39f455dc10d6f911a013968ffea1540
invidious/nginx/sites-enabled/invidious.vhost
T
Sommerwiesel 66d0951fb3 Change to multiple backends
2025-06-18 11:27:18 +02:00

312 lines
7.3 KiB
Nginx Configuration File
Raw Blame History

upstream invidious {
server 192.42.6.2:3000 fail_timeout=3s;
keepalive 21;
}
# This is routed over a HAProxy that looks for the cookie
upstream invidious_companion {
server 192.42.6.1:8118 fail_timeout=3s;
}
map $upstream_addr $server_instance {
default "invidious";
}
geo $upstream_server {
default invidious;
}
map "$http_origin" $cors {
default '';
}
geo $feeds_whitelist {
default 0;
# CIDR in the list below are not limited
# Google
8.34.208.0/20 1;
8.35.192.0/20 1;
23.236.48.0/20 1;
23.251.128.0/19 1;
34.0.0.0/15 1;
34.2.0.0/16 1;
34.3.0.0/23 1;
34.3.3.0/24 1;
34.3.4.0/24 1;
34.3.8.0/21 1;
34.3.16.0/20 1;
34.3.32.0/19 1;
34.3.64.0/18 1;
34.4.0.0/14 1;
34.8.0.0/13 1;
34.16.0.0/12 1;
34.32.0.0/11 1;
34.64.0.0/10 1;
34.128.0.0/10 1;
35.184.0.0/13 1;
35.192.0.0/14 1;
35.196.0.0/15 1;
35.198.0.0/16 1;
35.199.0.0/17 1;
35.199.128.0/18 1;
35.200.0.0/13 1;
35.208.0.0/12 1;
35.224.0.0/12 1;
35.240.0.0/13 1;
64.15.112.0/20 1;
64.233.160.0/19 1;
66.22.228.0/23 1;
66.102.0.0/20 1;
66.249.64.0/19 1;
70.32.128.0/19 1;
72.14.192.0/18 1;
74.125.0.0/16 1;
104.154.0.0/15 1;
104.196.0.0/14 1;
104.237.160.0/19 1;
107.167.160.0/19 1;
107.178.192.0/18 1;
108.59.80.0/20 1;
108.170.192.0/18 1;
108.177.0.0/17 1;
130.211.0.0/16 1;
142.250.0.0/15 1;
146.148.0.0/17 1;
162.216.148.0/22 1;
162.222.176.0/21 1;
172.110.32.0/21 1;
172.217.0.0/16 1;
172.253.0.0/16 1;
173.194.0.0/16 1;
173.255.112.0/20 1;
193.186.4.0/24 1;
199.36.154.0/23 1;
199.36.156.0/24 1;
199.192.112.0/22 1;
199.223.232.0/21 1;
207.223.160.0/20 1;
208.65.152.0/22 1;
208.68.108.0/22 1;
208.81.188.0/22 1;
208.117.224.0/19 1;
209.85.128.0/17 1;
216.58.192.0/19 1;
216.73.80.0/20 1;
216.239.32.0/19 1;
2001:4860::/32 1;
2404:6800::/32 1;
2404:f340::/32 1;
2600:1900::/28 1;
2606:73c0::/32 1;
2607:f8b0::/32 1;
2620:11a:a000::/40 1;
2620:120:e000::/40 1;
2800:3f0::/32 1;
2a00:1450::/32 1;
2c0f:fb50::/32 1;
}
map $feeds_whitelist $feeds_limit {
0 "";
1 $binary_remote_addr;
}
limit_req_zone $binary_remote_addr zone=invidious_login:5m rate=5r/m;
limit_req_zone $binary_remote_addr zone=invidious_requests:5m rate=5r/s;
limit_req_zone $feeds_limit zone=invidious_feeds:5m rate=3r/s;
server {
listen 80;
listen [::]:80;
server_name invidious.nerdvpn.de www.invidious.nerdvpn.de;
root /srv/nginx/public/invidious;
include snippets/malicious.conf;
location /.well-known/acme-challenge/ {
allow all;
default_type "text/plain";
alias /srv/nginx/public/acme/;
}
location / {
return 301 https://invidious.nerdvpn.de$request_uri;
}
}
server {
listen 443 ssl;
listen [::]:443 ssl;
http2 on;
server_name www.invidious.nerdvpn.de;
root /srv/nginx/public/invidious;
include snippets/malicious.conf;
ssl_certificate /srv/letsencrypt/certs/invidious.nerdvpn.de/fullchain.pem;
ssl_certificate_key /srv/letsencrypt/certs/invidious.nerdvpn.de/privkey.pem;
include snippets/htst.conf;
access_log off;
error_log /dev/null emerg;
location / {
return 301 https://invidious.nerdvpn.de$request_uri;
}
}
server {
listen 443 ssl;
listen 443 default_server quic reuseport;
listen [::]:443 ssl;
listen [::]:443 default_server quic reuseport;
http2 on;
http3 on;
quic_retry on;
server_name invidious.nerdvpn.de;
root /srv/nginx/public/invidious;
add_header Alt-Svc 'h3=":443"; ma=86400';
add_header X-server-instance $server_instance always;
add_header X-server-proto $server_protocol always;
add_header Onion-Location http://nerdvpneaggggfdiurknszkbmhvjndks5z5k3g5yp4nhphflh3n3boad.onion$request_uri;
ssl_session_cache shared:nginx_TLS_invidious:10m;
add_header X-Robots-Tag "index, follow, noai, noimageai";
ssl_certificate /srv/letsencrypt/certs/invidious.nerdvpn.de/fullchain.pem;
ssl_certificate_key /srv/letsencrypt/certs/invidious.nerdvpn.de/privkey.pem;
include snippets/htst.conf;
access_log off;
error_log /dev/null emerg;
include snippets/invidious_errorpages.conf;
include snippets/malicious.conf;
limit_rate 4000k;
include snippets/favicon.conf;
include snippets/robots.conf;
error_page 503 @maintenance;
location @maintenance {
auth_request off;
root /srv/nginx/public/maintenance/;
rewrite ^ "/index.html" break;
}
location = /css/default.css {
auth_request off;
root /srv/nginx/public/invidious;
}
location ~ (^/feed/webhook) {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
auth_request off;
limit_req zone=invidious_feeds burst=240 delay=80;
#access_log /var/log/nginx/access/invidious.webfeed.log;
#error_log /var/log/nginx/errors/invidious.webfeed.log error;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_pass http://invidious;
}
location /.within.website/ {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://anubis;
proxy_pass_request_body off;
proxy_set_header content-length "";
auth_request off;
}
location @redirectToAnubis {
return 307 /.within.website/?redir=$request_uri;
auth_request off;
}
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
limit_req zone=invidious_requests burst=240 delay=80;
if ($invidious_access != 1) {
return 503;
}
if ($request_method = OPTIONS) {
return 204;
}
auth_request /.within.website/x/cmd/anubis/api/check;
error_page 401 = @redirectToAnubis;
#error_page 503 = @maintenance;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_pass http://$upstream_server;
}
# Maintenance routes
#location ~ /(login) {
# auth_request off;
# limit_req zone=invidious_login burst=4 nodelay;
# proxy_http_version 1.1;
# proxy_set_header Connection "";
# proxy_pass http://invidious_zero;
#}
#location ~ /(css|js|fonts|delete_account|data_control|subscription_manager|signout) {
# auth_request off;
# limit_req zone=invidious_requests burst=240 delay=80;
# proxy_http_version 1.1;
# proxy_set_header Connection "";
# proxy_pass http://invidious_zero;
#}
# Companion routes
location /latest_version {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://invidious_companion;
proxy_http_version 1.1;
proxy_set_header Connection "";
}
location /api/manifest/dash/id/ {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://invidious_companion;
proxy_http_version 1.1;
proxy_set_header Connection "";
}
location /videoplayback {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://invidious_companion;
proxy_http_version 1.1;
proxy_set_header Connection "";
}
}
Reference in New Issue View Git Blame Copy Permalink