install forgejo-runner to use actions

2024-11-20 15:13:23 +01:00
16 changed files with 315 additions and 156 deletions
--- a/.editorconfig
+++ b/.editorconfig
@ -16,12 +16,3 @@ tab_width = 2

 [*.md]
 trim_trailing_whitespace = false
-
-[Caddyfile]
-indent_style = tab
-indent_size = 4
-tab_width = 4
-end_of_line = lf
-charset = utf-8
-trim_trailing_whitespace = true
-insert_final_newline = true
--- a/firefoxsync/docker-compose.yaml
+++ b/firefoxsync/docker-compose.yaml
@ -9,6 +9,12 @@ services:
      - web
      - firefoxsync
    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.ffs.rule=Host(`${FQDN_FIREFOXSYNC}`)"
+      - "traefik.http.routers.ffs.entrypoints=websecure"
+      - "traefik.http.routers.ffs.tls.certresolver=netcup"
+      - "traefik.http.routers.ffs.tls.options=intermediate@file"
+      - "traefik.http.services.ffs.loadbalancer.server.port=5000"
      - "docker.group=firefoxsync"
    restart: unless-stopped
    environment:
--- a/git/docker-compose.yaml
+++ b/git/docker-compose.yaml
@ -28,6 +28,16 @@ services:
      interval: 5s
      timeout: 3s
    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.forgejo.rule=Host(`${FQDN_GIT}`, `${FQDN_GIT_OLD}`)"
+      - "traefik.http.routers.forgejo.entrypoints=websecure"
+      - "traefik.http.routers.forgejo.tls.certresolver=netcup"
+      - "traefik.http.routers.forgejo.tls.options=intermediate@file"
+      - "traefik.http.routers.forgejo.middlewares=gitearedir"
+      - "traefik.http.middlewares.gitearedir.redirectregex.regex=^https://${FQDN_GIT_OLD}/(.*)"
+      - "traefik.http.middlewares.gitearedir.redirectregex.replacement=https://${FQDN_GIT}/$${1}"
+      - "traefik.http.middlewares.gitearedir.redirectregex.permanent=true"
+      - "traefik.http.services.forgejo.loadbalancer.server.port=3000"
      - "docker.group=git"


@ -50,8 +60,39 @@ services:
      - "docker.group=git"


+  docker-in-docker:
+    image: docker:dind
+    privileged: 'true'
+    command: ['dockerd', '-H', 'tcp://0.0.0.0:2375', '--tls=false']
+    restart: 'unless-stopped'
+    networks:
+      - runner
+
+
+  runner:
+    image: code.forgejo.org/forgejo/runner:3.5.1
+    links:
+      - docker-in-docker
+    depends_on:
+      docker-in-docker:
+        condition: service_started
+    environment:
+      DOCKER_HOST: tcp://docker-in-docker:2375
+    user: 1002:1002
+    volumes:
+      - /var/dockervolumes/git/runner:/data
+    restart: 'unless-stopped'
+    # command: '/bin/sh -c "while : ; do sleep 1 ; done ;"' # for registration
+    command: '/bin/sh -c "sleep 5; forgejo-runner daemon"'
+    networks:
+      - git
+      - runner
+
+
 networks:
  git:
  web:
    external: true
+  runner:
+

--- a/news/docker-compose.yaml
+++ b/news/docker-compose.yaml
@ -21,6 +21,12 @@ services:
    healthcheck:
      test: ["CMD", "/usr/bin/miniflux", "-healthcheck", "auto"]
    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.news.rule=Host(`${FQDN_NEWS}`)"
+      - "traefik.http.routers.news.entrypoints=websecure"
+      - "traefik.http.routers.news.tls.certresolver=netcup"
+      - "traefik.http.routers.news.tls.options=intermediate@file"
+      - "traefik.http.services.news.loadbalancer.server.port=8080"
      - "docker.group=news"


--- a/nextcloud/docker-compose.yaml
+++ b/nextcloud/docker-compose.yaml
@ -1,6 +1,6 @@
 services:

-  webserver-nextcloud:
+  web:
    image: nginx:stable
    depends_on:
      - app
@ -16,6 +16,18 @@ services:
 #      interval: 5s
 #      timeout: 3s
    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.nextcloud.rule=Host(`${FQDN_NEXTCLOUD}`)"
+      - "traefik.http.routers.nextcloud.entrypoints=websecure"
+      - "traefik.http.routers.nextcloud.tls.certresolver=netcup"
+      - "traefik.http.routers.nextcloud.tls.options=intermediate@file"
+      - "traefik.http.middlewares.nextcloudHeader.headers.customRequestHeaders.X-Forwarded-Proto=https"
+      - "traefik.http.middlewares.nextcloudHeader.headers.stsSeconds=15552000"
+      - "traefik.http.middlewares.nextcloudHeader.headers.stsIncludeSubdomains=true"
+      - "traefik.http.middlewares.nextcloudHeader.headers.stsPreload=true"
+      - "traefik.http.middlewares.nextcloudHeader.headers.forceSTSHeader=true"
+      - "traefik.http.middlewares.nextcloudHeader.headers.customResponseHeaders.X-Robots-Tag=noindex,nofollow"
+      - "traefik.http.routers.nextcloud.middlewares=nextcloudHeader"
      - "docker.group=netxtcloud"


@ -81,9 +93,17 @@ services:
      - ${STORAGE_PATH}/data:/var/www/html/data:ro
    environment:
      - PORT=7867
-      - NEXTCLOUD_URL=http://webserver-nextcloud
+      - NEXTCLOUD_URL=http://web
    entrypoint: /var/www/html/custom_apps/notify_push/bin/x86_64/notify_push /var/www/html/config/config.php
    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.ncpush.rule=Host(`${FQDN_NEXTCLOUD}`) && PathPrefix(`/push`)"
+      - "traefik.http.routers.ncpush.entrypoints=websecure"
+      - "traefik.http.routers.ncpush.tls.certresolver=netcup"
+      - "traefik.http.routers.ncpush.tls.options=intermediate@file"
+      - "traefik.http.services.ncpush.loadbalancer.server.port=7867"
+      - "traefik.http.routers.ncpush.middlewares=ncpushstrip"
+      - "traefik.http.middlewares.ncpushstrip.stripprefix.prefixes=/push"
      - "docker.group=proxy"


@ -111,12 +131,9 @@ services:
      - nextcloud
      - mariadb
    healthcheck:
-      test: [ "CMD", "healthcheck.sh", "--connect", "--innodb_initialized" ]
-      start_period: 1m
-      start_interval: 10s
-      interval: 1m
-      timeout: 5s
-      retries: 3
+      test: ["CMD", "mysqladmin" ,"--user" ,"$MYSQL_USER" ,"--password=$MYSQL_PASSWORD" ,"ping" ,"-h" ,"localhost"]
+      interval: 20s
+      timeout: 3s
    labels:
      - "docker.group=netxtcloud"

@ -133,6 +150,13 @@ services:
 #    depends_on:
 #      - db
 #    labels:
+#      - "traefik.enable=true"
+#      - "traefik.http.routers.adminer.rule=Host(`${FQDN_ADMINER}`)"
+#      - "traefik.http.routers.adminer.entrypoints=websecure"
+#      - "traefik.http.routers.adminer.tls.certresolver=netcup"
+#      - "traefik.http.routers.adminer.tls.options=intermediate@file"
+#      - "traefik.http.routers.adminer.middlewares=adminerauth"
+#      - "traefik.http.middlewares.adminerauth.basicauth.users=${HTPASSWD_ADMINER}"
 #      - "docker.group=netxtcloud"


@ -172,6 +196,12 @@ services:
      - "extra_params=--o:ssl.enable=false --o:ssl.termination=true"
    restart: unless-stopped
    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.collabora.rule=Host(`${FQDN_OFFICE}`)"
+      - "traefik.http.routers.collabora.entrypoints=websecure"
+      - "traefik.http.routers.collabora.tls.certresolver=netcup"
+      - "traefik.http.routers.collabora.tls.options=intermediate@file"
+      - "traefik.http.services.collabora.loadbalancer.server.port=9980"
      - "docker.group=netxtcloud"


@ -208,6 +238,12 @@ services:
      retries: 5
      start_period: 20s
    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.drawio.rule=Host(`${FQDN_DRAWIO}`)"
+      - "traefik.http.routers.drawio.entrypoints=websecure"
+      - "traefik.http.routers.drawio.tls.certresolver=netcup"
+      - "traefik.http.routers.drawio.tls.options=intermediate@file"
+      - "traefik.http.services.drawio.loadbalancer.server.port=8080"
      - "docker.group=netxtcloud"

 networks:
--- a/nextcloud/nginx.conf
+++ b/nextcloud/nginx.conf
@ -127,7 +127,7 @@ http {

            # Let Nextcloud's API for `/.well-known` URIs handle all other
            # requests by passing them to the front-end controller.
-            return 301 https://$host:443/index.php$request_uri;
+            return 301 https://$host:443/index.php$request_uri; 
        }

        # Rules borrowed from `.htaccess` to hide certain paths from clients
@ -164,12 +164,12 @@ http {

        # Javascript mimetype fixes for nginx
        # Note: The block below should be removed, and the js|mjs section should be
-        # added to the block below this one. This is a temporary fix until Nginx
+        # added to the block below this one. This is a temporary fix until Nginx 
        # upstream fixes the js mime-type
        location ~* \.(?:js|mjs)$ {
-            types {
+            types { 
                text/javascript js mjs;
-            }
+            } 
            default_type "text/javascript";
            try_files $uri /index.php$request_uri;
            add_header Cache-Control "public, max-age=15778463, $asset_immutable";
@ -177,15 +177,9 @@ http {
        }

        # Serve static files
-        location ~ \.(?:css|js|mjs|svg|gif|ico|jpg|png|webp|wasm|tflite|map|ogg|flac)$ {
+        location ~ \.(?:css|svg|gif|png|jpg|ico|wasm|tflite|map|ogg|flac)$ {
            try_files $uri /index.php$request_uri;
-            add_header Cache-Control "public, max-age=15778463$asset_immutable";
-            add_header Referrer-Policy                   "no-referrer"       always;
-            add_header X-Content-Type-Options            "nosniff"           always;
-            add_header X-Frame-Options                   "SAMEORIGIN"        always;
-            add_header X-Permitted-Cross-Domain-Policies "none"              always;
-            add_header X-Robots-Tag                      "noindex, nofollow" always;
-            add_header X-XSS-Protection                  "1; mode=block"     always;
+            add_header Cache-Control "public, max-age=15778463, $asset_immutable";
            access_log off;     # Optional: Don't log access to assets

            location ~ \.wasm$ {
--- a/proxy/caddy/Caddyfile
+++ b/proxy/caddy/Caddyfile
@ -1,97 +0,0 @@
-{
-	email {env.EMAIL}
-	log default {
-		output stdout
-		format console
-	}
-}
-
-*.{$DOMAIN} {
-	tls {
-		dns netcup {
-			customer_number {env.NETCUP_CUSTOMER_NUMBER}
-			api_key {env.NETCUP_API_KEY}
-			api_password {env.NETCUP_API_PASSWORD}
-		}
-		propagation_timeout 900s
-		propagation_delay 600s
-		resolvers 46.38.225.230 46.38.252.230
-	}
-	header Strict-Transport-Security "max-age=63072000"
-
-	@git host git.{$DOMAIN}
-	handle @git {
-		reverse_proxy forgejo:3000
-	}
-
-	@news host news.{$DOMAIN}
-	handle @news {
-		reverse_proxy miniflux:8080
-	}
-
-	@nc-push expression `(host('cloud.{$DOMAIN}') && path('/push/*'))`
-	handle @nc-push {
-		reverse_proxy push:7867
-	}
-
-	@nextcloud host cloud.{$DOMAIN}
-	handle @nextcloud {
-		reverse_proxy webserver-nextcloud:80
-	}
-
-	@office host office.{$DOMAIN}
-	handle @office {
-		reverse_proxy collabora:9980
-	}
-
-	@drawio host drawio.{$DOMAIN}
-	handle @drawio {
-		reverse_proxy drawio:8080
-	}
-
-	@whoami host whoami.{$DOMAIN}
-	handle @whoami {
-		reverse_proxy whoami:80
-	}
-
-	@push host push.{$DOMAIN}
-	handle @push {
-		reverse_proxy ntfy:80
-	}
-
-	@wallabag host wallabag.{$DOMAIN}
-	handle @wallabag {
-		reverse_proxy wallabag:80
-	}
-
-	@www host www.{$DOMAIN}
-	handle @www {
-		file_server {
-			root /usr/share/caddy
-			hide .git Readme.md
-		}
-	}
-
-	@mail host mail.{$DOMAIN}
-	handle @mail {
-		reverse_proxy nginx-mailcow:8090
-	}
-
-	# Fallback unhandled (sub)domains
-	handle {
-		error 404
-	}
-
-	handle_errors {
-		root * /usr/share/caddy
-		rewrite * /error.html
-		templates
-		file_server {
-			status {err.status_code}
-		}
-	}
-}
-
-{$DOMAIN} {
-	redir https://www.{$DOMAIN}{uri}
-}
--- a/proxy/caddy/Dockerfile
+++ b/proxy/caddy/Dockerfile
@ -1,7 +0,0 @@
-FROM caddy:2-builder AS builder
-
-RUN xcaddy build --with github.com/caddy-dns/netcup
-
-FROM caddy:2
-
-COPY --from=builder /usr/bin/caddy /usr/bin/caddy
--- a/proxy/docker-compose.yaml
+++ b/proxy/docker-compose.yaml
@ -1,34 +1,98 @@
 services:

-  caddy:
-    image: florianzirker.de/caddy-netcup
-    build: ./caddy
-    networks:
-      - web
+  traefik:
+    image: traefik:${TRAEFIK_VERSION}
    restart: unless-stopped
-    ports:
-      - "80:80"
-      - "443:443"
-      - "443:443/udp"
-    volumes:
-      - $PWD/caddy/Caddyfile:/etc/caddy/Caddyfile
-      - ${STORAGE_PATH}/caddy/data:/data
-      - ${STORAGE_PATH}/caddy/config:/config
-      - ${WWW_PATH}:/usr/share/caddy:ro
    environment:
+      - NETCUP_ENDPOINT=${NETCUP_ENDPOINT}
      - NETCUP_CUSTOMER_NUMBER=${NETCUP_CUSTOMER_NUMBER}
      - NETCUP_API_KEY=${NETCUP_API_KEY}
      - NETCUP_API_PASSWORD=${NETCUP_API_PASSWORD}
-      - EMAIL=${LETSENCRYPT_MAIL}
-      - DOMAIN=${DOMAIN}
-
-  whoami:
-    image: traefik/whoami
+    command:
+      - "--api.insecure=false"
+      - "--api.dashboard=true"
+      - "--providers.docker=true"
+      - "--providers.docker.exposedbydefault=false"
+      - "--providers.docker.network=web"
+      - "--providers.docker.endpoint=tcp://docker-socket-proxy:2375"
+      #- "--log.level=DEBUG"
+      - "--log.level=INFO"
+      #- "--accesslog=true"
+      - "--ping=true"
+      - "--entrypoints.web.address=:80"
+      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
+      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
+      - "--entrypoints.websecure.address=:443"
+      - "--providers.file.filename=/etc/traefik/tls.toml"
+      - "--certificatesresolvers.netcup.acme.dnschallenge=true"
+      - "--certificatesresolvers.netcup.acme.dnsChallenge.provider=netcup"
+      - "--certificatesresolvers.netcup.acme.dnsChallenge.resolvers=46.38.225.230:53,46.38.252.230:53"
+      - "--certificatesresolvers.netcup.acme.dnschallenge.delayBeforeCheck=900"
+      - "--certificatesresolvers.netcup.acme.email=${LETSENCRYPT_MAIL}"
+      - "--certificatesresolvers.netcup.acme.storage=/letsencrypt/acme.json"
+      - "--metrics.prometheus=true"
+      - "--metrics.prometheus.addEntryPointsLabels=true"
+      - "--metrics.prometheus.addRoutersLabels=true"
+      - "--metrics.prometheus.addServicesLabels=true"
+    ports:
+      - "80:80"
+      - "443:443"
    networks:
      - web
+      - dockersocket
+    volumes:
+      - ${STORAGE_PATH}/letsencrypt:/letsencrypt
+      - $PWD/tls.toml:/etc/traefik/tls.toml
+    healthcheck:
+      test: traefik healthcheck --ping
+      interval: 3s
+      timeout: 1s
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.dashboard.rule=Host(`${FQDN_TRAEFIK}`)"
+      - "traefik.http.routers.dashboard.service=api@internal"
+      - "traefik.http.routers.dashboard.entrypoints=websecure"
+      - "traefik.http.routers.dashboard.tls.certresolver=netcup"
+      - "traefik.http.routers.dashboard.tls.domains[0].main=${DOMAIN}"
+      - "traefik.http.routers.dashboard.tls.domains[0].sans=*.${DOMAIN}"
+      - "traefik.http.routers.dashboard.tls.options=intermediate@file"
+      - "traefik.http.routers.dashboard.middlewares=auth"
+      - "traefik.http.middlewares.auth.basicauth.users=${HTPASSWD}"
+      - "docker.group=proxy"
+
+
+  docker-socket-proxy:
+    image: tecnativa/docker-socket-proxy
+    restart: unless-stopped
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    environment:
+      # grant privileges as environment variables: https://github.com/Tecnativa/docker-socket-proxy#grant-or-revoke-access-to-certain-api-sections
+      - LOG_LEVEL=warning
+      - CONTAINERS=1
+      - INFO=1
+    networks:
+      - dockersocket
+    healthcheck:
+      test: ["CMD", "wget" ,"--no-verbose", "--tries=1", "--spider", "http://localhost:2375/version"]
+      interval: 10s
+      timeout: 3s
+    privileged: true
    labels:
      - "docker.group=proxy"
-    restart: unless-stopped
+
+
+#  whoami:
+#    image: traefik/whoami
+#    networks:
+#      - web
+#    labels:
+#      - "traefik.enable=true"
+#      - "traefik.http.routers.whoami.rule=Host(`${FQDN_WHOAMI}`)"
+#      - "traefik.http.routers.whoami.entrypoints=websecure"
+#      - "traefik.http.routers.whoami.tls.certresolver=netcup"
+#      - "docker.group=proxy"
+#    restart: unless-stopped


 networks:
--- a/proxy/reload.sh
+++ b/proxy/reload.sh
@ -1,2 +0,0 @@
-#!/bin/bash
-docker compose exec -w /etc/caddy caddy caddy reload
--- a/proxy/tls.toml
+++ b/proxy/tls.toml
@ -0,0 +1,14 @@
+# generated 2020-12-09, Mozilla Guideline v5.6, Traefik 2.3, intermediate configuration
+# https://ssl-config.mozilla.org/#server=traefik&version=2.3&config=intermediate&guideline=5.6
+
+[tls.options]
+  [tls.options.intermediate]
+    minVersion = "VersionTLS12"
+    cipherSuites = [
+      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
+      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"
+    ]
--- a/push/docker-compose.yaml
+++ b/push/docker-compose.yaml
@ -25,6 +25,12 @@ services:
      - ${STORAGE_PATH}/ntfy/cache/:/var/cache/ntfy
      - ${STORAGE_PATH}/ntfy/varlib/:/var/lib/ntfy/
    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.push.rule=Host(`${FQDN_PUSH}`)"
+      - "traefik.http.routers.push.entrypoints=websecure"
+      - "traefik.http.routers.push.tls.certresolver=netcup"
+      - "traefik.http.routers.push.tls.options=intermediate@file"
+      - "traefik.http.services.push.loadbalancer.server.port=80"
      - "docker.group=push"


--- a/start-all.sh
+++ b/start-all.sh
@ -9,6 +9,7 @@ up proxy;
 up nextcloud;
 up git;
 up wallabag;
+up www;
 up firefoxsync;
 up push;
 up rustdesk;
--- a/wallabag/docker-compose.yaml
+++ b/wallabag/docker-compose.yaml
@ -1,5 +1,5 @@
 services:
-  wallabag:
+  app:
    image: wallabag/wallabag
    restart: unless-stopped
    environment:
@ -26,6 +26,11 @@ services:
      interval: 10s
      timeout: 3s
    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.wallabag.rule=Host(`${FQDN_WALLABAG}`)"
+      - "traefik.http.routers.wallabag.entrypoints=websecure"
+      - "traefik.http.routers.wallabag.tls.certresolver=netcup"
+      - "traefik.http.routers.wallabag.tls.options=intermediate@file"
      - "docker.group=wallabag"
    depends_on:
      - db
--- a/www/docker-compose.yaml
+++ b/www/docker-compose.yaml
@ -0,0 +1,34 @@
+services:
+
+  app:
+    image: nginx:stable
+    volumes:
+      - ${HTML}:/usr/share/nginx/html:ro
+      - $PWD/nginx.conf:/etc/nginx/nginx.conf:ro
+    networks:
+      - web
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "curl" ,"--fail", "localhost"]
+      interval: 5s
+      timeout: 3s
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.webroot.entrypoints=websecure" # All HTTP requests are globally redirected to HTTPS
+      - "traefik.http.routers.webroot.rule=Host(`${DOMAIN}`)"
+      - "traefik.http.routers.webroot.tls.certresolver=netcup"
+      - "traefik.http.routers.webroot.tls.options=intermediate@file"
+      - "traefik.http.routers.webroot.middlewares=redirect-to-www"
+      - "traefik.http.middlewares.redirect-to-www.redirectregex.regex=^https?://${DOMAIN}/(.*)"
+      - "traefik.http.middlewares.redirect-to-www.redirectregex.replacement=https://${FQDN_WWW}/$${1}"
+      - "traefik.http.middlewares.redirect-to-www.redirectregex.permanent=true"
+      - "traefik.http.routers.www-secure.entrypoints=websecure"
+      - "traefik.http.routers.www-secure.rule=Host(`${FQDN_WWW}`)"
+      - "traefik.http.routers.www-secure.tls.certresolver=netcup"
+      - "traefik.http.routers.www-secure.tls.options=intermediate@file"
+      - "docker.group=www"
+
+networks:
+  web:
+    external: true
+
--- a/www/nginx.conf
+++ b/www/nginx.conf
@ -0,0 +1,67 @@
+user  nginx;
+worker_processes  auto;
+
+error_log  /var/log/nginx/error.log notice;
+pid        /var/run/nginx.pid;
+
+
+events {
+    worker_connections  1024;
+}
+
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log  /var/log/nginx/access.log  main;
+
+    sendfile        on;
+    #tcp_nopush     on;
+
+    keepalive_timeout  65;
+
+    #gzip  on;
+
+    # include /etc/nginx/conf.d/*.conf;
+    ############################################
+    server {
+        listen       80;
+        listen  [::]:80;
+        server_name  localhost;
+
+        #access_log  /var/log/nginx/host.access.log  main;
+
+        location / {
+            root   /usr/share/nginx/html;
+            index  index.html index.htm;
+        }
+
+        #error_page  404              /404.html;
+
+        # redirect server error pages to the static page /50x.html
+        #
+        error_page   500 502 503 504  /50x.html;
+        location = /50x.html {
+            root   /usr/share/nginx/html;
+        }
+
+        # hide .git folder
+        location ~ /\.git {
+            deny all;
+            return 404;
+        }
+
+        location ~ /Readme.md {
+            deny all;
+            return 404;
+        }
+
+    }
+
+    # include /etc/nginx/conf.d/*.conf;
+}