76 lines
3.0 KiB
Nginx Configuration File
76 lines
3.0 KiB
Nginx Configuration File
# Legacy-TLS CalDAV bridge for Android 2.3 phones.
|
|
#
|
|
# The phone speaks TLS 1.0 with old ciphers and has no modern root CAs. This server accepts
|
|
# exactly that, with a self-signed certificate the app pins by SHA-256 fingerprint, and
|
|
# forwards ONLY the CalDAV endpoints to Nextcloud. The Nextcloud web UI stays unreachable here.
|
|
#
|
|
# Edit the lines marked EDIT, then see README.md.
|
|
|
|
upstream nextcloud {
|
|
# EDIT: where Nextcloud listens, as seen from this container.
|
|
# Nextcloud serves plain HTTP internally (official docker image :80, AIO :11000): keep :80.
|
|
# Nextcloud forces HTTPS (port 80 redirects to https://, often alongside HSTS): use its
|
|
# HTTPS port, e.g. nextcloud:443, AND switch proxy_pass below to https://.
|
|
server nextcloud:80;
|
|
}
|
|
|
|
server {
|
|
# Pangolin raw TCP resource -> this port. Add "proxy_protocol" here only if you also tick
|
|
# "Enable Proxy Protocol" on the Pangolin resource (see README).
|
|
listen 8443 ssl;
|
|
server_name _;
|
|
|
|
# EDIT: Nextcloud's own host name, as listed in its trusted_domains.
|
|
set $nc_host cloud.example.com;
|
|
|
|
ssl_certificate /etc/nginx/certs/bridge.crt;
|
|
ssl_certificate_key /etc/nginx/certs/bridge.key;
|
|
|
|
# Android 2.3: TLS 1.0, AES-CBC-SHA. SECLEVEL=0 lets OpenSSL 3 negotiate it at all.
|
|
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
|
ssl_ciphers "ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AES128-SHA:AES256-SHA:@SECLEVEL=0";
|
|
ssl_prefer_server_ciphers on;
|
|
ssl_session_cache shared:legacy:1m;
|
|
ssl_session_timeout 1h;
|
|
|
|
# Relative Location headers: correct even when Pangolin's public port differs from 8443.
|
|
absolute_redirect off;
|
|
|
|
client_max_body_size 5m;
|
|
access_log /var/log/nginx/caldav-bridge.log;
|
|
|
|
# HSTS from Nextcloud (or added by your proxy) is meant for its real https site. Passed on
|
|
# here it would tell browsers to treat this self-signed endpoint as strict HTTPS, with no
|
|
# way to click through. The phone app ignores HSTS either way.
|
|
proxy_hide_header Strict-Transport-Security;
|
|
|
|
location /remote.php/dav/ {
|
|
proxy_pass http://nextcloud;
|
|
# EDIT if Nextcloud forces HTTPS: replace the line above with
|
|
# proxy_pass https://nextcloud;
|
|
# The phone side stays TLS 1.0; this bridge-to-Nextcloud leg then uses modern TLS.
|
|
proxy_ssl_server_name on;
|
|
proxy_ssl_name $nc_host;
|
|
# Internal hop to your own server, often with a self-signed or LAN-only certificate.
|
|
proxy_ssl_verify off;
|
|
|
|
proxy_set_header Host $nc_host;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_read_timeout 120s;
|
|
proxy_buffering off;
|
|
# Nextcloud builds absolute URLs from its public address (overwrite.cli.url /
|
|
# overwriteprotocol). Keep the phone on the bridge by reducing them to the path.
|
|
proxy_redirect ~^https?://[^/]+(/.*)$ $1;
|
|
}
|
|
|
|
location = /.well-known/caldav {
|
|
return 301 /remote.php/dav/;
|
|
}
|
|
|
|
location / {
|
|
return 404;
|
|
}
|
|
}
|