GingerCal 1.3: month view, Galician interface, Nginx Proxy Manager bridge option

bridge/npm/http.conf

@@ -0,0 +1,65 @@
+# Legacy-TLS CalDAV endpoint for Android 2.3, inside Nginx Proxy Manager.
+#
+# Install: copy to <npm data dir>/nginx/custom/http.conf (NPM includes it at the end of its
+# http block; if that file already exists, append this server block to it). Then publish
+# port 8443 on the NPM container and forward it on the router. See README.md.
+#
+# Phone -> nxc.anosanube.ovh:8443 (TLS 1.0, self-signed cert pinned by the app)
+#       -> this block -> NPM's own https proxy host for nxc.anosanube.ovh -> Nextcloud
+# Going back through NPM's existing proxy host reuses its Nextcloud settings, so you don't
+# need to repeat the backend address here.
+
+server {
+    listen 8443 ssl;
+    listen [::]:8443 ssl;   # remove if NPM runs with DISABLE_IPV6
+    server_name _;
+
+    set $nc_host nxc.anosanube.ovh;
+
+    # Long-lived self-signed certificate (bridge/make-cert.sh). Not NPM's Let's Encrypt one:
+    # Android 2.3 doesn't trust ISRG Root X1, and pinning a cert that renews every 60 days
+    # would trip the app's "certificate changed" warning each time.
+    ssl_certificate     /data/legacy-caldav/bridge.crt;
+    ssl_certificate_key /data/legacy-caldav/bridge.key;
+
+    # Android 2.3: TLS 1.0, AES-CBC-SHA. Only this port; NPM's own hosts on 443 are untouched.
+    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+    ssl_ciphers "ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AES128-SHA:AES256-SHA:@SECLEVEL=0";
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:legacy_caldav:1m;
+    ssl_session_timeout 1h;
+
+    absolute_redirect off;
+    client_max_body_size 5m;
+    access_log /data/logs/legacy-caldav_access.log;
+    error_log  /data/logs/legacy-caldav_error.log warn;
+
+    # HSTS from the proxy host is meant for https://nxc.anosanube.ovh, not this self-signed port.
+    proxy_hide_header Strict-Transport-Security;
+
+    location /remote.php/dav/ {
+        # NPM's own HTTPS listener, matched by SNI to the nxc.anosanube.ovh proxy host.
+        proxy_pass https://127.0.0.1:443;
+        proxy_ssl_server_name on;
+        proxy_ssl_name $nc_host;
+        proxy_ssl_verify off;   # loopback to ourselves
+
+        proxy_set_header Host $nc_host;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_http_version 1.1;
+        proxy_set_header Connection "";
+        proxy_read_timeout 120s;
+        proxy_buffering off;
+        proxy_redirect ~^https?://[^/]+(/.*)$ $1;
+    }
+
+    location = /.well-known/caldav {
+        return 301 /remote.php/dav/;
+    }
+
+    location / {
+        return 404;
+    }
+}