install forgejo-runner to use actions

.editorconfig

@@ -16,3 +16,12 @@ tab_width = 2
 
 [*.md]
 trim_trailing_whitespace = false
+
+[Caddyfile]
+indent_style = tab
+indent_size = 4
+tab_width = 4
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true

firefoxsync/docker-compose.yaml

@@ -9,12 +9,6 @@ services:
       - web
       - firefoxsync
     labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.ffs.rule=Host(`${FQDN_FIREFOXSYNC}`)"
-      - "traefik.http.routers.ffs.entrypoints=websecure"
-      - "traefik.http.routers.ffs.tls.certresolver=netcup"
-      - "traefik.http.routers.ffs.tls.options=intermediate@file"
-      - "traefik.http.services.ffs.loadbalancer.server.port=5000"
       - "docker.group=firefoxsync"
     restart: unless-stopped
     environment:

git/docker-compose.yaml

@@ -28,16 +28,6 @@ services:
       interval: 5s
       timeout: 3s
     labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.forgejo.rule=Host(`${FQDN_GIT}`, `${FQDN_GIT_OLD}`)"
-      - "traefik.http.routers.forgejo.entrypoints=websecure"
-      - "traefik.http.routers.forgejo.tls.certresolver=netcup"
-      - "traefik.http.routers.forgejo.tls.options=intermediate@file"
-      - "traefik.http.routers.forgejo.middlewares=gitearedir"
-      - "traefik.http.middlewares.gitearedir.redirectregex.regex=^https://${FQDN_GIT_OLD}/(.*)"
-      - "traefik.http.middlewares.gitearedir.redirectregex.replacement=https://${FQDN_GIT}/$${1}"
-      - "traefik.http.middlewares.gitearedir.redirectregex.permanent=true"
-      - "traefik.http.services.forgejo.loadbalancer.server.port=3000"
       - "docker.group=git"
 
 
@@ -60,8 +50,39 @@ services:
       - "docker.group=git"
 
 
+  docker-in-docker:
+    image: docker:dind
+    privileged: 'true'
+    command: ['dockerd', '-H', 'tcp://0.0.0.0:2375', '--tls=false']
+    restart: 'unless-stopped'
+    networks:
+      - runner
+
+
+  runner:
+    image: code.forgejo.org/forgejo/runner:3.5.1
+    links:
+      - docker-in-docker
+    depends_on:
+      docker-in-docker:
+        condition: service_started
+    environment:
+      DOCKER_HOST: tcp://docker-in-docker:2375
+    user: 1002:1002
+    volumes:
+      - /var/dockervolumes/git/runner:/data
+    restart: 'unless-stopped'
+    # command: '/bin/sh -c "while : ; do sleep 1 ; done ;"' # for registration
+    command: '/bin/sh -c "sleep 5; forgejo-runner daemon"'
+    networks:
+      - git
+      - runner
+
+
 networks:
   git:
   web:
     external: true
+  runner:
+
 

news/docker-compose.yaml

@@ -21,12 +21,6 @@ services:
     healthcheck:
       test: ["CMD", "/usr/bin/miniflux", "-healthcheck", "auto"]
     labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.news.rule=Host(`${FQDN_NEWS}`)"
-      - "traefik.http.routers.news.entrypoints=websecure"
-      - "traefik.http.routers.news.tls.certresolver=netcup"
-      - "traefik.http.routers.news.tls.options=intermediate@file"
-      - "traefik.http.services.news.loadbalancer.server.port=8080"
       - "docker.group=news"
 
 

nextcloud/docker-compose.yaml

@@ -1,6 +1,6 @@
 services:
 
-  web:
+  webserver-nextcloud:
     image: nginx:stable
     depends_on:
       - app
@@ -16,18 +16,6 @@ services:
 #      interval: 5s
 #      timeout: 3s
     labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.nextcloud.rule=Host(`${FQDN_NEXTCLOUD}`)"
-      - "traefik.http.routers.nextcloud.entrypoints=websecure"
-      - "traefik.http.routers.nextcloud.tls.certresolver=netcup"
-      - "traefik.http.routers.nextcloud.tls.options=intermediate@file"
-      - "traefik.http.middlewares.nextcloudHeader.headers.customRequestHeaders.X-Forwarded-Proto=https"
-      - "traefik.http.middlewares.nextcloudHeader.headers.stsSeconds=15552000"
-      - "traefik.http.middlewares.nextcloudHeader.headers.stsIncludeSubdomains=true"
-      - "traefik.http.middlewares.nextcloudHeader.headers.stsPreload=true"
-      - "traefik.http.middlewares.nextcloudHeader.headers.forceSTSHeader=true"
-      - "traefik.http.middlewares.nextcloudHeader.headers.customResponseHeaders.X-Robots-Tag=noindex,nofollow"
-      - "traefik.http.routers.nextcloud.middlewares=nextcloudHeader"
       - "docker.group=netxtcloud"
 
 
@@ -93,17 +81,9 @@ services:
       - ${STORAGE_PATH}/data:/var/www/html/data:ro
     environment:
       - PORT=7867
-      - NEXTCLOUD_URL=http://web
+      - NEXTCLOUD_URL=http://webserver-nextcloud
     entrypoint: /var/www/html/custom_apps/notify_push/bin/x86_64/notify_push /var/www/html/config/config.php
     labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.ncpush.rule=Host(`${FQDN_NEXTCLOUD}`) && PathPrefix(`/push`)"
-      - "traefik.http.routers.ncpush.entrypoints=websecure"
-      - "traefik.http.routers.ncpush.tls.certresolver=netcup"
-      - "traefik.http.routers.ncpush.tls.options=intermediate@file"
-      - "traefik.http.services.ncpush.loadbalancer.server.port=7867"
-      - "traefik.http.routers.ncpush.middlewares=ncpushstrip"
-      - "traefik.http.middlewares.ncpushstrip.stripprefix.prefixes=/push"
       - "docker.group=proxy"
 
 
@@ -131,9 +111,12 @@ services:
       - nextcloud
       - mariadb
     healthcheck:
-      test: ["CMD", "mysqladmin" ,"--user" ,"$MYSQL_USER" ,"--password=$MYSQL_PASSWORD" ,"ping" ,"-h" ,"localhost"]
+      test: [ "CMD", "healthcheck.sh", "--connect", "--innodb_initialized" ]
-      interval: 20s
+      start_period: 1m
-      timeout: 3s
+      start_interval: 10s
+      interval: 1m
+      timeout: 5s
+      retries: 3
     labels:
       - "docker.group=netxtcloud"
 
@@ -150,13 +133,6 @@ services:
 #    depends_on:
 #      - db
 #    labels:
-#      - "traefik.enable=true"
-#      - "traefik.http.routers.adminer.rule=Host(`${FQDN_ADMINER}`)"
-#      - "traefik.http.routers.adminer.entrypoints=websecure"
-#      - "traefik.http.routers.adminer.tls.certresolver=netcup"
-#      - "traefik.http.routers.adminer.tls.options=intermediate@file"
-#      - "traefik.http.routers.adminer.middlewares=adminerauth"
-#      - "traefik.http.middlewares.adminerauth.basicauth.users=${HTPASSWD_ADMINER}"
 #      - "docker.group=netxtcloud"
 
 
@@ -196,12 +172,6 @@ services:
       - "extra_params=--o:ssl.enable=false --o:ssl.termination=true"
     restart: unless-stopped
     labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.collabora.rule=Host(`${FQDN_OFFICE}`)"
-      - "traefik.http.routers.collabora.entrypoints=websecure"
-      - "traefik.http.routers.collabora.tls.certresolver=netcup"
-      - "traefik.http.routers.collabora.tls.options=intermediate@file"
-      - "traefik.http.services.collabora.loadbalancer.server.port=9980"
       - "docker.group=netxtcloud"
 
 
@@ -238,12 +208,6 @@ services:
       retries: 5
       start_period: 20s
     labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.drawio.rule=Host(`${FQDN_DRAWIO}`)"
-      - "traefik.http.routers.drawio.entrypoints=websecure"
-      - "traefik.http.routers.drawio.tls.certresolver=netcup"
-      - "traefik.http.routers.drawio.tls.options=intermediate@file"
-      - "traefik.http.services.drawio.loadbalancer.server.port=8080"
       - "docker.group=netxtcloud"
 
 networks:

nextcloud/nginx.conf

@@ -127,7 +127,7 @@ http {
 
             # Let Nextcloud's API for `/.well-known` URIs handle all other
             # requests by passing them to the front-end controller.
-            return 301 https://$host:443/index.php$request_uri; 
+            return 301 https://$host:443/index.php$request_uri;
         }
 
         # Rules borrowed from `.htaccess` to hide certain paths from clients
@@ -164,12 +164,12 @@ http {
 
         # Javascript mimetype fixes for nginx
         # Note: The block below should be removed, and the js|mjs section should be
-        # added to the block below this one. This is a temporary fix until Nginx 
+        # added to the block below this one. This is a temporary fix until Nginx
         # upstream fixes the js mime-type
         location ~* \.(?:js|mjs)$ {
-            types { 
+            types {
                 text/javascript js mjs;
-            } 
+            }
             default_type "text/javascript";
             try_files $uri /index.php$request_uri;
             add_header Cache-Control "public, max-age=15778463, $asset_immutable";
@@ -177,9 +177,15 @@ http {
         }
 
         # Serve static files
-        location ~ \.(?:css|svg|gif|png|jpg|ico|wasm|tflite|map|ogg|flac)$ {
+        location ~ \.(?:css|js|mjs|svg|gif|ico|jpg|png|webp|wasm|tflite|map|ogg|flac)$ {
             try_files $uri /index.php$request_uri;
-            add_header Cache-Control "public, max-age=15778463, $asset_immutable";
+            add_header Cache-Control "public, max-age=15778463$asset_immutable";
+            add_header Referrer-Policy                   "no-referrer"       always;
+            add_header X-Content-Type-Options            "nosniff"           always;
+            add_header X-Frame-Options                   "SAMEORIGIN"        always;
+            add_header X-Permitted-Cross-Domain-Policies "none"              always;
+            add_header X-Robots-Tag                      "noindex, nofollow" always;
+            add_header X-XSS-Protection                  "1; mode=block"     always;
             access_log off;     # Optional: Don't log access to assets
 
             location ~ \.wasm$ {

proxy/caddy/Caddyfile

@@ -0,0 +1,107 @@
+{
+	email {env.EMAIL}
+	log default {
+		output stdout
+		format console
+	}
+}
+
+*.{$DOMAIN} {
+	tls {
+		dns netcup {
+			customer_number {env.NETCUP_CUSTOMER_NUMBER}
+			api_key {env.NETCUP_API_KEY}
+			api_password {env.NETCUP_API_PASSWORD}
+		}
+		propagation_timeout 900s
+		propagation_delay 600s
+		resolvers 46.38.225.230 46.38.252.230
+	}
+	header Strict-Transport-Security "max-age=63072000"
+
+	@git host git.{$DOMAIN}
+	handle @git {
+		reverse_proxy forgejo:3000
+	}
+
+	@git-alt host gitea.{$DOMAIN} forgejo.{$DOMAIN}
+	handle @git-alt {
+		redir https://git.{$DOMAIN}{uri} permanent
+	}
+
+	@news host news.{$DOMAIN}
+	handle @news {
+		reverse_proxy miniflux:8080
+	}
+
+	@nc-push expression `(host('cloud.{$DOMAIN}') && path('/push/*'))`
+	handle @nc-push {
+		reverse_proxy push:7867
+	}
+
+	@nextcloud host cloud.{$DOMAIN}
+	handle @nextcloud {
+		reverse_proxy webserver-nextcloud:80
+	}
+
+	@oldcloud host nextcloud.{$DOMAIN} owncloud.{$DOMAIN}
+	handle @oldcloud {
+		redir https://cloud.{$DOMAIN}{uri} permanent
+	}
+
+	@office host office.{$DOMAIN}
+	handle @office {
+		reverse_proxy collabora:9980
+	}
+
+	@drawio host drawio.{$DOMAIN}
+	handle @drawio {
+		reverse_proxy drawio:8080
+	}
+
+	@whoami host whoami.{$DOMAIN}
+	handle @whoami {
+		reverse_proxy whoami:80
+	}
+
+	@push host push.{$DOMAIN}
+	handle @push {
+		reverse_proxy ntfy:80
+	}
+
+	@wallabag host wallabag.{$DOMAIN}
+	handle @wallabag {
+		reverse_proxy wallabag:80
+	}
+
+	@www host www.{$DOMAIN}
+	handle @www {
+		file_server {
+			root /usr/share/caddy
+			hide .git Readme.md
+		}
+	}
+
+	@mail host mail.{$DOMAIN}
+	handle @mail {
+		reverse_proxy nginx-mailcow:8090
+	}
+
+	# Fallback unhandled (sub)domains
+	handle {
+		error 404
+	}
+
+	handle_errors {
+		root * /usr/share/caddy
+		rewrite * /error.html
+		templates
+		file_server {
+			status {err.status_code}
+		}
+	}
+}
+
+{$DOMAIN} {
+	redir https://www.{$DOMAIN}{uri} permanent
+}

proxy/caddy/Dockerfile

@@ -0,0 +1,7 @@
+FROM caddy:2-builder AS builder
+
+RUN xcaddy build --with github.com/caddy-dns/netcup
+
+FROM caddy:2
+
+COPY --from=builder /usr/bin/caddy /usr/bin/caddy

proxy/docker-compose.yaml

@@ -1,98 +1,34 @@
 services:
 
-  traefik:
+  caddy:
-    image: traefik:${TRAEFIK_VERSION}
+    image: florianzirker.de/caddy-netcup
+    build: ./caddy
+    networks:
+      - web
     restart: unless-stopped
-    environment:
-      - NETCUP_ENDPOINT=${NETCUP_ENDPOINT}
-      - NETCUP_CUSTOMER_NUMBER=${NETCUP_CUSTOMER_NUMBER}
-      - NETCUP_API_KEY=${NETCUP_API_KEY}
-      - NETCUP_API_PASSWORD=${NETCUP_API_PASSWORD}
-    command:
-      - "--api.insecure=false"
-      - "--api.dashboard=true"
-      - "--providers.docker=true"
-      - "--providers.docker.exposedbydefault=false"
-      - "--providers.docker.network=web"
-      - "--providers.docker.endpoint=tcp://docker-socket-proxy:2375"
-      #- "--log.level=DEBUG"
-      - "--log.level=INFO"
-      #- "--accesslog=true"
-      - "--ping=true"
-      - "--entrypoints.web.address=:80"
-      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
-      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
-      - "--entrypoints.websecure.address=:443"
-      - "--providers.file.filename=/etc/traefik/tls.toml"
-      - "--certificatesresolvers.netcup.acme.dnschallenge=true"
-      - "--certificatesresolvers.netcup.acme.dnsChallenge.provider=netcup"
-      - "--certificatesresolvers.netcup.acme.dnsChallenge.resolvers=46.38.225.230:53,46.38.252.230:53"
-      - "--certificatesresolvers.netcup.acme.dnschallenge.delayBeforeCheck=900"
-      - "--certificatesresolvers.netcup.acme.email=${LETSENCRYPT_MAIL}"
-      - "--certificatesresolvers.netcup.acme.storage=/letsencrypt/acme.json"
-      - "--metrics.prometheus=true"
-      - "--metrics.prometheus.addEntryPointsLabels=true"
-      - "--metrics.prometheus.addRoutersLabels=true"
-      - "--metrics.prometheus.addServicesLabels=true"
     ports:
       - "80:80"
       - "443:443"
+      - "443:443/udp"
+    volumes:
+      - $PWD/caddy/Caddyfile:/etc/caddy/Caddyfile
+      - ${STORAGE_PATH}/caddy/data:/data
+      - ${STORAGE_PATH}/caddy/config:/config
+      - ${WWW_PATH}:/usr/share/caddy:ro
+    environment:
+      - NETCUP_CUSTOMER_NUMBER=${NETCUP_CUSTOMER_NUMBER}
+      - NETCUP_API_KEY=${NETCUP_API_KEY}
+      - NETCUP_API_PASSWORD=${NETCUP_API_PASSWORD}
+      - EMAIL=${LETSENCRYPT_MAIL}
+      - DOMAIN=${DOMAIN}
+
+  whoami:
+    image: traefik/whoami
     networks:
       - web
-      - dockersocket
-    volumes:
-      - ${STORAGE_PATH}/letsencrypt:/letsencrypt
-      - $PWD/tls.toml:/etc/traefik/tls.toml
-    healthcheck:
-      test: traefik healthcheck --ping
-      interval: 3s
-      timeout: 1s
     labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.dashboard.rule=Host(`${FQDN_TRAEFIK}`)"
-      - "traefik.http.routers.dashboard.service=api@internal"
-      - "traefik.http.routers.dashboard.entrypoints=websecure"
-      - "traefik.http.routers.dashboard.tls.certresolver=netcup"
-      - "traefik.http.routers.dashboard.tls.domains[0].main=${DOMAIN}"
-      - "traefik.http.routers.dashboard.tls.domains[0].sans=*.${DOMAIN}"
-      - "traefik.http.routers.dashboard.tls.options=intermediate@file"
-      - "traefik.http.routers.dashboard.middlewares=auth"
-      - "traefik.http.middlewares.auth.basicauth.users=${HTPASSWD}"
       - "docker.group=proxy"
-
-
-  docker-socket-proxy:
-    image: tecnativa/docker-socket-proxy
     restart: unless-stopped
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-    environment:
-      # grant privileges as environment variables: https://github.com/Tecnativa/docker-socket-proxy#grant-or-revoke-access-to-certain-api-sections
-      - LOG_LEVEL=warning
-      - CONTAINERS=1
-      - INFO=1
-    networks:
-      - dockersocket
-    healthcheck:
-      test: ["CMD", "wget" ,"--no-verbose", "--tries=1", "--spider", "http://localhost:2375/version"]
-      interval: 10s
-      timeout: 3s
-    privileged: true
-    labels:
-      - "docker.group=proxy"
-
-
-#  whoami:
-#    image: traefik/whoami
-#    networks:
-#      - web
-#    labels:
-#      - "traefik.enable=true"
-#      - "traefik.http.routers.whoami.rule=Host(`${FQDN_WHOAMI}`)"
-#      - "traefik.http.routers.whoami.entrypoints=websecure"
-#      - "traefik.http.routers.whoami.tls.certresolver=netcup"
-#      - "docker.group=proxy"
-#    restart: unless-stopped
 
 
 networks:

proxy/reload.sh

@@ -0,0 +1,2 @@
+#!/bin/bash
+docker compose exec -w /etc/caddy caddy caddy reload

proxy/tls.toml

@@ -1,14 +0,0 @@
-# generated 2020-12-09, Mozilla Guideline v5.6, Traefik 2.3, intermediate configuration
-# https://ssl-config.mozilla.org/#server=traefik&version=2.3&config=intermediate&guideline=5.6
-
-[tls.options]
-  [tls.options.intermediate]
-    minVersion = "VersionTLS12"
-    cipherSuites = [
-      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
-      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
-      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
-      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
-      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
-      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"
-    ]

push/docker-compose.yaml

@@ -25,12 +25,6 @@ services:
       - ${STORAGE_PATH}/ntfy/cache/:/var/cache/ntfy
       - ${STORAGE_PATH}/ntfy/varlib/:/var/lib/ntfy/
     labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.push.rule=Host(`${FQDN_PUSH}`)"
-      - "traefik.http.routers.push.entrypoints=websecure"
-      - "traefik.http.routers.push.tls.certresolver=netcup"
-      - "traefik.http.routers.push.tls.options=intermediate@file"
-      - "traefik.http.services.push.loadbalancer.server.port=80"
       - "docker.group=push"
 
 

start-all.sh

@@ -9,7 +9,6 @@ up proxy;
 up nextcloud;
 up git;
 up wallabag;
-up www;
 up firefoxsync;
 up push;
 up rustdesk;

wallabag/docker-compose.yaml

@@ -1,5 +1,5 @@
 services:
-  app:
+  wallabag:
     image: wallabag/wallabag
     restart: unless-stopped
     environment:
@@ -26,11 +26,6 @@ services:
       interval: 10s
       timeout: 3s
     labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.wallabag.rule=Host(`${FQDN_WALLABAG}`)"
-      - "traefik.http.routers.wallabag.entrypoints=websecure"
-      - "traefik.http.routers.wallabag.tls.certresolver=netcup"
-      - "traefik.http.routers.wallabag.tls.options=intermediate@file"
       - "docker.group=wallabag"
     depends_on:
       - db

www/docker-compose.yaml

@@ -1,34 +0,0 @@
-services:
-
-  app:
-    image: nginx:stable
-    volumes:
-      - ${HTML}:/usr/share/nginx/html:ro
-      - $PWD/nginx.conf:/etc/nginx/nginx.conf:ro
-    networks:
-      - web
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD", "curl" ,"--fail", "localhost"]
-      interval: 5s
-      timeout: 3s
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.webroot.entrypoints=websecure" # All HTTP requests are globally redirected to HTTPS
-      - "traefik.http.routers.webroot.rule=Host(`${DOMAIN}`)"
-      - "traefik.http.routers.webroot.tls.certresolver=netcup"
-      - "traefik.http.routers.webroot.tls.options=intermediate@file"
-      - "traefik.http.routers.webroot.middlewares=redirect-to-www"
-      - "traefik.http.middlewares.redirect-to-www.redirectregex.regex=^https?://${DOMAIN}/(.*)"
-      - "traefik.http.middlewares.redirect-to-www.redirectregex.replacement=https://${FQDN_WWW}/$${1}"
-      - "traefik.http.middlewares.redirect-to-www.redirectregex.permanent=true"
-      - "traefik.http.routers.www-secure.entrypoints=websecure"
-      - "traefik.http.routers.www-secure.rule=Host(`${FQDN_WWW}`)"
-      - "traefik.http.routers.www-secure.tls.certresolver=netcup"
-      - "traefik.http.routers.www-secure.tls.options=intermediate@file"
-      - "docker.group=www"
-
-networks:
-  web:
-    external: true
-

www/nginx.conf

@@ -1,67 +0,0 @@
-user  nginx;
-worker_processes  auto;
-
-error_log  /var/log/nginx/error.log notice;
-pid        /var/run/nginx.pid;
-
-
-events {
-    worker_connections  1024;
-}
-
-
-http {
-    include       /etc/nginx/mime.types;
-    default_type  application/octet-stream;
-
-    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
-                      '$status $body_bytes_sent "$http_referer" '
-                      '"$http_user_agent" "$http_x_forwarded_for"';
-
-    access_log  /var/log/nginx/access.log  main;
-
-    sendfile        on;
-    #tcp_nopush     on;
-
-    keepalive_timeout  65;
-
-    #gzip  on;
-
-    # include /etc/nginx/conf.d/*.conf;
-    ############################################
-    server {
-        listen       80;
-        listen  [::]:80;
-        server_name  localhost;
-
-        #access_log  /var/log/nginx/host.access.log  main;
-
-        location / {
-            root   /usr/share/nginx/html;
-            index  index.html index.htm;
-        }
-
-        #error_page  404              /404.html;
-
-        # redirect server error pages to the static page /50x.html
-        #
-        error_page   500 502 503 504  /50x.html;
-        location = /50x.html {
-            root   /usr/share/nginx/html;
-        }
-
-        # hide .git folder
-        location ~ /\.git {
-            deny all;
-            return 404;
-        }
-
-        location ~ /Readme.md {
-            deny all;
-            return 404;
-        }
-
-    }
-
-    # include /etc/nginx/conf.d/*.conf;
-}