README.md

@@ -1,11 +0,0 @@
-You can find my server configs in this repo, they are split in different branches.
-
-- [🕋 Selfhost Branch](https://git.zzls.xyz/Fijxu/etc-configs/src/branch/selfhost)
-
-- [🧱 VPS Branch](https://git.zzls.xyz/Fijxu/etc-configs/src/branch/vpsus)
-
-#### Suggestions or Issues?
-
-If you got any suggestions to the nginx configs or something that is not to your liking within the privacy-focused services I provide; Open an issue or a pull request in any config. You can either create an account with your real E-mail or with a throw away one (But probably you will be considered as a bad actor for me if you don't provide any real identity like GitHub, GitLab, Codeberg or anything like that, so make sure to link any of those).
-
-*Contact*: [https://nadeko.net/contact](https://nadeko.net/contact)

nginx/configs/general.conf

@@ -0,0 +1,11 @@
+# gzip
+gzip              on;
+gzip_vary         on;
+gzip_proxied      any;
+gzip_comp_level   6;
+gzip_types        text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;
+
+# brotli
+#brotli            on;
+#brotli_comp_level 6;
+#brotli_types      text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;

nginx/configs/proxyheaders.conf

@@ -0,0 +1,20 @@
+proxy_http_version                 1.1;
+proxy_cache_bypass                 $http_upgrade;
+
+# Proxy SSL
+proxy_ssl_server_name              on;
+
+# Proxy headers
+proxy_set_header Upgrade           $http_upgrade;
+#proxy_set_header Connection        $connection_upgrade;
+proxy_set_header X-Real-IP         $remote_addr;
+proxy_set_header Forwarded         $proxy_add_forwarded;
+proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_set_header X-Forwarded-Host  $host;
+proxy_set_header X-Forwarded-Port  $server_port;
+
+# Proxy timeouts
+proxy_connect_timeout              60s;
+proxy_send_timeout                 60s;
+proxy_read_timeout                 60s;

nginx/configs/securityheaders.conf

@@ -0,0 +1,12 @@
+# security headers
+add_header X-XSS-Protection          "1; mode=block" always;
+add_header X-Content-Type-Options    "nosniff" always;
+add_header Referrer-Policy           "no-referrer-when-downgrade" always;
+#add_header Content-Security-Policy   "default-src 'self' http: https: ws: wss: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always;
+add_header Permissions-Policy        "interest-cohort=()" always;
+add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+
+# . files
+#location ~ /\.(?!well-known) {
+#    deny all;
+#}

nginx/nginx.conf

@@ -0,0 +1,103 @@
+worker_processes auto;
+worker_rlimit_nofile 65535;
+
+# Include Modules
+include /etc/nginx/modules-enabled/*.conf;
+#load_module /usr/lib/nginx/modules/ngx_http_modsecurity_module.so;
+load_module /usr/lib/nginx/modules/ngx_http_brotli_filter_module.so; # for compressing responses on-the-fly
+load_module /usr/lib/nginx/modules/ngx_http_brotli_static_module.so; # for serving pre-compressed files
+
+#Include external config
+include /etc/nginx/conf.d/*.conf;
+
+events {
+    multi_accept on;
+    worker_connections 65535;
+}
+
+stream {
+    include /etc/nginx/streams/*;
+}
+
+http {
+
+    # Basic Settings
+    charset utf-8;
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+    server_tokens off;
+    log_not_found off;
+    types_hash_max_size 4096;
+    types_hash_bucket_size 64;
+
+    # Virtual Host Configs
+    include /etc/nginx/sites-enabled/*.conf;
+
+    # MIME
+    include mime.types;
+    default_type application/octet-stream;
+
+    # SSL
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
+    ssl_prefer_server_ciphers off;
+    #
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:MozSSL:10m;
+    ssl_session_tickets off;
+
+	# Diffie-Hellman parameter for DHE ciphersuites
+    ssl_dhparam /etc/nginx/dhparam.pem;
+
+    # HTTP2 Settings
+    http2_max_field_size 64k;
+    http2_max_header_size 512k;
+
+    # DDOS Protection
+    limit_conn_zone $binary_remote_addr zone=perip:10m;
+    limit_conn perip 100;
+
+    limit_req_zone $binary_remote_addr zone=engine:10m rate=2r/s;
+    limit_req_zone $binary_remote_addr zone=static:10m rate=100r/s;
+
+    # reset timed out connections freeing ram
+    reset_timedout_connection on;
+    # maximum time between packets the client can pause when sending nginx any data
+    client_body_timeout 10s;
+    # maximum time the client has to send the entire header to nginx
+    client_header_timeout 10s;
+    # timeout which a single keep-alive client connection will stay open
+    keepalive_timeout 65s;
+    # maximum time between packets nginx is allowed to pause when sending the client data
+    send_timeout 10s;
+
+	# Connection header for WebSocket reverse proxy
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        ""      close;
+    }
+
+    map $remote_addr $proxy_forwarded_elem {
+
+        # IPv4 addresses can be sent as-is
+        ~^[0-9.]+$        "for=$remote_addr";
+
+        # IPv6 addresses need to be bracketed and quoted
+        ~^[0-9A-Fa-f:.]+$ "for=\"[$remote_addr]\"";
+
+        # Unix domain socket names cannot be represented in RFC 7239 syntax
+        default           "for=unknown";
+    }
+
+    map $http_forwarded $proxy_add_forwarded {
+
+        # If the incoming Forwarded header is syntactically valid, append to it
+        "~^(,[ \\t]*)*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*([ \\t]*,([ \\t]*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*)?)*$" "$http_forwarded, $proxy_forwarded_elem";
+
+        # Otherwise, replace it
+        default "$proxy_forwarded_elem";
+    }
+
+}
+

nginx/sites-available-archive/search2.zzls.xyz.conf

@@ -0,0 +1,68 @@
+server {
+    access_log /var/log/nginx/searx.log;
+    error_log /dev/null;
+
+    server_name search2.zzls.xyz;
+
+
+    if ($server_protocol ~* "HTTP/1.0") {
+        return 444;
+    }
+    if ($http_user_agent ~* (python) ) {
+        return 403;
+    }
+
+    location / {
+        proxy_pass http://127.0.0.1:8888/;
+
+        #
+        proxy_http_version 1.1;
+        proxy_cache_bypass $http_upgrade;
+
+        # Proxy headers for the Limiter
+        proxy_set_header Host $host;
+        proxy_set_header Connection $http_connection;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Scheme $scheme;
+
+    }
+
+    location /searx/static/ {
+        alias /usr/local/searxng/searxng-src/searx/static/;
+    }
+
+    # security headers
+    add_header Referrer-Policy "no-referrer-when-downgrade" always;
+    add_header Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; script-src 'self'; style-src 'self'; form-action 'self'; font-src 'self'; frame-ancestors 'self'; base-uri 'self'; connect-src 'self' https://overpass-api.de; img-src 'self' data: https://*.tile.openstreetmap.org; frame-src https://www.youtube-nocookie.com https://player.vimeo.com https://www.dailymotion.com https://www.deezer.com https://www.mixcloud.com https://w.soundcloud.com https://embed.spotify.com";
+    add_header Permissions-Policy "interest-cohort=()" always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header X-Frame-Options "SAMEORIGIN";
+
+    # QUIC
+    add_header Alt-Svc 'h3=":443"; ma=86400';
+
+    quic_retry on;
+    quic_gso on;
+    ssl_early_data on;
+
+    listen 443 http3;
+    listen 443 http2 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/search2.zzls.xyz/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/search2.zzls.xyz/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+}
+server {
+    if ($host = search2.zzls.xyz) {
+        return 301 https://$host$request_uri;
+        } # managed by Certbot
+
+
+        listen 80;
+
+        server_name search2.zzls.xyz;
+        return 404; # managed by Certbot
+
+
+    }

nginx/sites-available-archive/yt.zzls.xyz.conf

@@ -0,0 +1,45 @@
+server {
+    access_log /var/log/nginx/yt.access.log combined;
+
+    server_name yt.zzls.xyz;
+
+    location / {
+        proxy_pass http://localhost:40003;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header Host $host; # so Invidious knows domain
+        proxy_http_version 1.1; # to keep alive
+        proxy_set_header Connection ""; # to keep alive
+    }
+
+    # security headers
+    add_header Referrer-Policy "no-referrer-when-downgrade" always;
+    #add_header Content-Security-Policy "default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self';base-uri 'self';form-action 'self'";
+    add_header Permissions-Policy "interest-cohort=()" always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header X-Frame-Options "SAMEORIGIN";
+
+    # QUIC
+    add_header Alt-Svc 'h3=":443"; ma=86400';
+
+
+    listen 443 http3;
+    listen 443 http2 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/yt.zzls.xyz/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/yt.zzls.xyz/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+}
+server {
+    if ($host = yt.zzls.xyz) {
+        return 301 https://$host$request_uri;
+        } # managed by Certbot
+
+
+        listen 80;
+
+        server_name yt.zzls.xyz;
+        return 404; # managed by Certbot
+
+
+    }

nginx/sites-available/7tv.gay.conf

@@ -0,0 +1,40 @@
+server {
+    access_log /var/log/nginx/7tv.gay.access.log combined;
+    error_log /var/log/nginx/7tv.gay.error.log;
+    root /var/www/7tv;
+    index index.html index index.htm;
+    server_name 7tv.gay;
+
+    # Security headers and general settings
+    include configs/securityheaders.conf;
+    include configs/general.conf;
+
+    #alocation = / {
+    #    alias /var/www/7tv/gayge.png;
+#	index
+ #   }
+
+    # QUIC
+    add_header Alt-Svc 'h3=":443"; ma=86400';
+
+    listen 443 http3;
+    listen 443 http2 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/7tv.gay/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/7tv.gay/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+}
+server {
+    if ($host = 7tv.gay) {
+        return 301 https://$host$request_uri;
+        } # managed by Certbot
+
+
+        listen 80;
+
+        server_name 7tv.gay;
+        return 404; # managed by Certbot
+
+
+    }

nginx/sites-available/archive.zzls.xyz.conf

@@ -0,0 +1,34 @@
+server {
+    access_log /var/log/nginx/archive.zzls.xyz.log combined;
+    error_log /var/log/nginx/archive.zzls.xyz.error.log;
+
+    server_name archive.zzls.xyz;
+    include configs/general.conf;
+    include configs/securityheaders.conf;
+
+    location / {
+        proxy_pass http://127.0.0.1:40015;
+        include configs/proxyheaders.conf;
+    }
+
+
+    listen 443 http3;
+    listen 443 http2 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/archive.zzls.xyz/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/archive.zzls.xyz/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+}
+server {
+    if ($host = archive.zzls.xyz) {
+        return 301 https://$host$request_uri;
+        } # managed by Certbot
+
+
+        listen 80;
+        server_name archive.zzls.xyz;
+        return 404; # managed by Certbot
+
+
+    }

nginx/sites-available/ayaya.beauty.conf

@@ -0,0 +1,49 @@
+server {
+    access_log /var/log/nginx/ayaya.beauty.log combined;
+    error_log /var/log/nginx/ayaya.beauty.error.log;
+
+    server_name       ayaya.beauty;
+    include configs/general.conf;
+    include configs/securityheaders.conf;
+
+    root              /var/www/uguu/dist/public/;
+    autoindex         off;
+    # access_log        off;
+    index index.html  index.php;
+
+    client_max_body_size 64M;
+
+    location ~* \.(css|js|jpg|jpeg|gif|png|ico|xml|eot|woff|woff2|ttf|svg|otf|x-icon|avif|webp|apng)$ {
+      expires         30d;
+    }
+
+    location ~* \.php$ {
+    fastcgi_pass     unix:/var/run/php-fpm/php-fpm.sock;
+    fastcgi_intercept_errors on;
+    fastcgi_index    index.php;
+    fastcgi_split_path_info ^(.+\.php)(.*)$;
+    include          fastcgi_params;
+    fastcgi_param    SCRIPT_FILENAME $document_root$fastcgi_script_name;
+    }
+
+    listen 443 http3;
+    listen 443 http2 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/ayaya.beauty/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/ayaya.beauty/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+}
+
+server {
+    if ($host = ayaya.beauty) {
+        return 301 https://$host$request_uri;
+        } # managed by Certbot
+
+
+        listen 80;
+        server_name ayaya.beauty;
+        return 404; # managed by Certbot
+
+
+    }

nginx/sites-available/gitea.zzls.xyz.conf

@@ -0,0 +1,37 @@
+server {
+    access_log /var/log/nginx/git.access.log combined;
+
+    server_name git.zzls.xyz;
+    # Security headers and general settings
+    include configs/securityheaders.conf;
+    include configs/general.conf;
+
+    location / {
+        proxy_pass http://unix:/run/gitea/gitea.socket;
+        include configs/proxyheaders.conf;
+    }
+
+    # QUIC
+    add_header Alt-Svc 'h3=":443"; ma=86400';
+
+    listen 443 http3;
+    listen 443 http2 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/git.zzls.xyz/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/git.zzls.xyz/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+}
+server {
+    if ($host = git.zzls.xyz) {
+        return 301 https://$host$request_uri;
+        } # managed by Certbot
+
+
+        listen 80;
+
+        server_name git.zzls.xyz;
+        return 404; # managed by Certbot
+
+
+    }

nginx/sites-available/i.ayaya.beauty.conf

@@ -0,0 +1,39 @@
+server {
+    access_log /var/log/nginx/i.ayaya.beauty.log combined;
+    error_log /var/log/nginx/i.ayaya.beauty.error.log;
+
+    server_name i.ayaya.beauty;
+    include configs/general.conf;
+    include configs/securityheaders.conf;
+
+    root             /var/www/files/;
+    autoindex        off;
+    # access_log       off;
+    index            index.html;
+
+    location / {
+    error_page 403 =301 https://ayaya.beauty;
+    error_page 404 = /404.gif;
+    }
+
+    listen 443 http3;
+    listen 443 http2 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/i.ayaya.beauty/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/i.ayaya.beauty/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+}
+
+server {
+    if ($host = i.ayaya.beauty) {
+        return 301 https://$host$request_uri;
+        } # managed by Certbot
+
+
+        listen 80;
+        server_name i.ayaya.beauty;
+        return 404; # managed by Certbot
+
+
+    }

nginx/sites-available/ii.zzls.xyz.conf

@@ -0,0 +1,40 @@
+server {
+    access_log /var/log/nginx/ii.access.log combined;
+    error_log /var/log/nginx/ii.error.log;
+
+    root /opt/ImageUpload/ifiles/;
+    index index.html index.htm index.nginx-debian.html;
+
+    server_name ii.zzls.xyz;
+    include configs/general.conf;
+    include configs/securityheaders.conf;
+
+    location /upload {
+        client_max_body_size 4096M;
+        auth_basic "Restricted Content";
+        auth_basic_user_file /etc/fileupload.htpasswd;
+        proxy_pass http://localhost:40006;
+        include configs/proxyheaders.conf;
+    }
+
+    listen 443 http3;
+    listen 443 ssl http2; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/ii.zzls.xyz/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/ii.zzls.xyz/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+}
+server {
+    if ($host = ii.zzls.xyz) {
+        return 301 https://$host$request_uri;
+        } # managed by Certbot
+
+
+        listen 80;
+
+        server_name ii.zzls.xyz;
+        return 404; # managed by Certbot
+
+
+    }

nginx/sites-available/mpd.ayaya.beauty.conf

@@ -0,0 +1,45 @@
+server {
+    access_log /var/log/nginx/mpd.ayaya.beauty.log combined;
+    error_log /var/log/nginx/mpd.ayaya.beauty.error.log;
+
+    server_name mpd.ayaya.beauty;
+    include configs/general.conf;
+    include configs/securityheaders.conf;
+
+    location / {
+        proxy_pass http://192.168.1.2:40420;
+        #include configs/proxyheaders.conf;
+        proxy_connect_timeout 1;
+        proxy_send_timeout 1;
+        proxy_read_timeout 1;
+    }
+    location /status {
+        # Turn on stats
+        stub_status on;
+        access_log off;
+        # only allow access from 192.168.1.5 #
+        allow 192.168.1.2;
+        deny all;
+    }
+
+    listen 443 http3;
+    listen 443 http2 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/mpd.ayaya.beauty/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/mpd.ayaya.beauty/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+}
+server {
+    if ($host = mpd.ayaya.beauty) {
+        return 301 https://$host$request_uri;
+        } # managed by Certbot
+
+
+        server_name mpd.ayaya.beauty;
+
+        listen 80;
+        return 404; # managed by Certbot
+
+
+    }

nginx/sites-available/paste.zzls.xyz.conf

@@ -0,0 +1,32 @@
+server {
+    access_log /var/log/nginx/paste.access.log combined;
+
+    server_name paste.zzls.xyz;
+    include configs/general.conf;
+    include configs/securityheaders.conf;
+
+    location / {
+        proxy_pass http://127.0.0.1:40020/;
+        include configs/proxyheaders.conf;
+    }
+
+    listen 443 http3;
+    listen 443 ssl http2; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/paste.zzls.xyz/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/paste.zzls.xyz/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+}
+server {
+    if ($host = paste.zzls.xyz) {
+        return 301 https://$host$request_uri;
+        } # managed by Certbot
+
+
+        server_name paste.zzls.xyz;
+        listen 80;
+        return 404; # managed by Certbot
+
+
+    }

nginx/sites-available/pbin.zzls.xyz.conf

@@ -0,0 +1,37 @@
+server {
+    access_log /var/log/nginx/pbin.access.log combined;
+
+    server_name pbin.zzls.xyz;
+    include configs/general.conf;
+
+    location / {
+        proxy_pass http://localhost:40001;
+        include configs/proxyheaders.conf;
+    }
+
+    #include configs/securityheaders.conf;
+    # QUIC
+    add_header Alt-Svc 'h3=":443"; ma=86400';
+
+
+    listen 443 ssl http2;
+    listen 443 http3; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/pbin.zzls.xyz/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/pbin.zzls.xyz/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+}
+server {
+    if ($host = pbin.zzls.xyz) {
+        return 301 https://$host$request_uri;
+        } # managed by Certbot
+
+
+        listen 80;
+
+        server_name pbin.zzls.xyz;
+        return 404; # managed by Certbot
+
+
+    }

nginx/sites-available/ri.zzls.xyz.conf

@@ -0,0 +1,40 @@
+server {
+        access_log /dev/null;
+        error_log /dev/null;
+
+        server_name ri.zzls.xyz;
+        include configs/general.conf;
+
+        location / {
+                proxy_pass http://127.0.0.1:40002/;
+                include configs/proxyheaders.conf;
+        }
+
+        # security headers
+        include configs/securityheaders.conf;
+        #add_header Content-Security-Policy "default-src 'self'; script-src 'report-sample' 'self'; style-src 'report-sample' 'self'; object-src 'none'; base-uri 'self'; connect-src 'self'; font-src 'self'; frame-src 'self'; img-src 'self'; manifest-src 'self'; media-src 'self'; worker-src 'none';";
+
+        # QUIC
+        add_header Alt-Svc 'h3=":443"; ma=86400';
+
+        listen 443 http3;
+        listen 443 http2 ssl; # managed by Certbot
+        ssl_certificate /etc/letsencrypt/live/ri.zzls.xyz/fullchain.pem; # managed by Certbot
+        ssl_certificate_key /etc/letsencrypt/live/ri.zzls.xyz/privkey.pem; # managed by Certbot
+        include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+}
+server {
+        if ($host = ri.zzls.xyz) {
+                return 301 https://$host$request_uri;
+                } # managed by Certbot
+
+
+                listen 80;
+
+                server_name ri.zzls.xyz;
+                return 404; # managed by Certbot
+
+
+        }

nginx/sites-available/selfhost.zzls.xyz.conf

@@ -0,0 +1,42 @@
+server {
+    access_log /var/log/nginx/selfhost.log combined;
+    root /var/www/html;
+    index index.html index.htm index.nginx-debian.html;
+
+    server_name selfhost.zzls.xyz;
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+
+    # security headers
+    add_header Referrer-Policy "no-referrer-when-downgrade" always;
+    #add_header Content-Security-Policy "default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self';base-uri 'self';form-action 'self'";
+    add_header Permissions-Policy "interest-cohort=()" always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header X-Frame-Options "SAMEORIGIN";
+
+    # QUIC
+    add_header Alt-Svc 'h3=":443"; ma=86400';
+
+    listen 443 ssl http2;
+    listen 443 http3; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/selfhost.zzls.xyz/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/selfhost.zzls.xyz/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+}
+server {
+    if ($host = selfhost.zzls.xyz) {
+        return 301 https://$host$request_uri;
+        } # managed by Certbot
+
+
+        listen 80;
+
+        server_name selfhost.zzls.xyz;
+        return 404; # managed by Certbot
+
+
+    }

nginx/sites-available/stream.ayaya.beauty.conf

@@ -0,0 +1,37 @@
+server {
+    access_log /var/log/nginx/stream.ayaya.beauty.access.log combined;
+    error_log /var/log/nginx/stream.ayaya.beauty.error.log;
+
+    root /var/www/stream/;
+    index index.html index.htm index.nginx-debian.html;
+
+    server_name stream.ayaya.beauty;
+    include configs/general.conf;
+    include configs/securityheaders.conf;
+
+    location /stream {
+	    proxy_pass http://localhost:8080/live/livestream/stream.flv;
+	    include configs/proxyheaders.conf;
+    }
+
+    listen 443 http3;
+    listen 443 ssl http2; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/stream.ayaya.beauty/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/stream.ayaya.beauty/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+}
+server {
+    if ($host = stream.ayaya.beauty) {
+        return 301 https://$host$request_uri;
+        } # managed by Certbot
+
+
+        listen 80;
+
+        server_name stream.ayaya.beauty;
+        return 404; # managed by Certbot
+
+
+    }

nginx/sites-enabled/archive.zzls.xyz.conf

@@ -0,0 +1 @@
+../sites-available/archive.zzls.xyz.conf

nginx/sites-enabled/gitea.zzls.xyz.conf

@@ -0,0 +1 @@
+../sites-available/gitea.zzls.xyz.conf

nginx/sites-enabled/ii.zzls.xyz.conf

@@ -0,0 +1 @@
+../sites-available/ii.zzls.xyz.conf

nginx/sites-enabled/mpd.ayaya.beauty.conf

@@ -0,0 +1 @@
+../sites-available/mpd.ayaya.beauty.conf

nginx/sites-enabled/paste.zzls.xyz.conf

@@ -0,0 +1 @@
+../sites-available/paste.zzls.xyz.conf

nginx/sites-enabled/pbin.zzls.xyz.conf

@@ -0,0 +1 @@
+../sites-available/pbin.zzls.xyz.conf

nginx/sites-enabled/ri.zzls.xyz.conf

@@ -0,0 +1 @@
+../sites-available/ri.zzls.xyz.conf

nginx/sites-enabled/selfhost.zzls.xyz.conf

@@ -0,0 +1 @@
+../sites-available/selfhost.zzls.xyz.conf

nginx/streams/dns.conf

@@ -0,0 +1,28 @@
+# DNS logging.  This log file will show the DNS requests geting forwarded to UNBOUND
+#log_format  dns   '$remote_addr [$time_local] $protocol "$dns_qname"';
+#access_log /var/log/nginx/dns-access.log dns; 
+
+    # Include the NJS module.  Get the file from  https://github.com/TuxInvader/nginx-dns/tree/master/njs.d
+   # js_import /etc/nginx/njs.d/nginx_stream.js;
+
+    # The $dns_qname variable can be populated by preread calls, and can be used for DNS routing
+   # js_set $dns_qname dns_get_qname;
+
+
+upstream dns {
+    zone dns 64k;
+    server    127.0.0.1:53;
+}
+server {
+  #listen 853 http3;
+  listen 853 ssl; # managed by Certbot
+  ssl_certificate /etc/letsencrypt/live/dns.zzls.xyz/fullchain.pem; # managed by Certbot
+  ssl_certificate_key /etc/letsencrypt/live/dns.zzls.xyz/privkey.pem; # managed by Certbot
+  ssl_protocols        TLSv1.2 TLSv1.3;
+  ssl_ciphers          HIGH:!aNULL:!MD5;
+
+  ssl_handshake_timeout    10s;
+  ssl_session_cache        shared:SSL:20m;
+  ssl_session_timeout      4h;
+  proxy_pass dns;
+}

sysctl.d/internettweaks.conf

@@ -0,0 +1,45 @@
+#TCP Tweaks
+net.ipv4.tcp_tw_reuse = 1
+net.ipv4.tcp_fastopn = 3
+net.ipv4.tcp_fin_timeout = 10
+
+# disable tcp timestamps to avoid leaking some system information
+# https://www.whonix.org/wiki/Disable_TCP_and_ICMP_Timestamps
+net.ipv4.tcp_timestamps=0
+
+#TCP BBR Congestion Control Algoritm
+net.core.default_qdisc = cake
+net.ipv4.tcp_congestion_control = bbr
+net.ipv4.tcp_notsent_lowat = 16384
+
+#Ignore ICMP Ping requests
+net.ipv4.icmp_echo_ignore_all = 1
+net.ipv6.icmp.echo_ignore_all = 1
+
+#Increase the memory dedicated to the network interfaces
+net.core.rmem_default = 1048576
+net.core.rmem_max = 16777216
+net.core.wmem_default = 1048576
+net.core.wmem_max = 16777216
+net.core.optmem_max = 65536
+net.ipv4.tcp_rmem = 4096 1048576 2097152
+net.ipv4.tcp_wmem = 4096 65536 16777216
+
+net.ipv4.udp_rmem_min = 8192
+net.ipv4.udp_wmem_min = 8192
+
+# increase aslr effectiveness for mmap
+# https://lwn.net/Articles/667790
+vm.mmap_rnd_bits=32
+vm.mmap_rnd_compat_bits=16
+
+#SYN Flood Protection
+
+net.ipv4.tcp_max_syn_backlog = 1024
+net.ipv4.tcp_syn_retries = 6
+net.ipv4.tcp_synack_retries = 3
+net.ipv4.tcp_syncookies = 1
+
+#Linux Netfilter Tweaks
+net.netfilter.nf_conntrack_tcp_timeout_time_wait=30
+net.netfilter.nf_conntrack_tcp_timeout_fin_wait=30

tor/torrc

@@ -0,0 +1,254 @@
+## Configuration file for a typical Tor user
+## Last updated 28 February 2019 for Tor 0.3.5.1-alpha.
+## (may or may not work for much older or much newer versions of Tor.)
+##
+## Lines that begin with "## " try to explain what's going on. Lines
+## that begin with just "#" are disabled commands: you can enable them
+## by removing the "#" symbol.
+##
+## See 'man tor', or https://www.torproject.org/docs/tor-manual.html,
+## for more options you can use in this file.
+##
+## Tor will look for this file in various places based on your platform:
+## https://www.torproject.org/docs/faq#torrc
+User tor
+
+## Tor opens a SOCKS proxy on port 9050 by default -- even if you don't
+## configure one below. Set "SOCKSPort 0" if you plan to run Tor only
+## as a relay, and not make any local application connections yourself.
+#SOCKSPort 9050 # Default: Bind to localhost:9050 for local connections.
+#SOCKSPort 192.168.0.1:9100 # Bind to this address:port too.
+
+## Entry policies to allow/deny SOCKS requests based on IP address.
+## First entry that matches wins. If no SOCKSPolicy is set, we accept
+## all (and only) requests that reach a SOCKSPort. Untrusted users who
+## can access your SOCKSPort may be able to learn about the connections
+## you make.
+#SOCKSPolicy accept 192.168.0.0/16
+#SOCKSPolicy accept6 FC00::/7
+#SOCKSPolicy reject *
+
+## Logs go to stdout at level "notice" unless redirected by something
+## else, like one of the below lines. You can have as many Log lines as
+## you want.
+##
+## We advise using "notice" in most cases, since anything more verbose
+## may provide sensitive information to an attacker who obtains the logs.
+##
+## Send all messages of level 'notice' or higher to /var/log/tor/notices.log
+#Log notice file /var/log/tor/notices.log
+## Send every possible message to /var/log/tor/debug.log
+#Log debug file /var/log/tor/debug.log
+## Use the system log instead of Tor's logfiles
+Log notice syslog
+## To send all messages to stderr:
+#Log debug stderr
+
+## Uncomment this to start the process in the background... or use
+## --runasdaemon 1 on the command line. This is ignored on Windows;
+## see the FAQ entry if you want Tor to run as an NT service.
+#RunAsDaemon 1
+
+## The directory for keeping all the keys/etc. By default, we store
+## things in $HOME/.tor on Unix, and in Application Data\tor on Windows.
+DataDirectory /var/lib/tor
+
+## The port on which Tor will listen for local connections from Tor
+## controller applications, as documented in control-spec.txt.
+#ControlPort 9051
+## If you enable the controlport, be sure to enable one of these
+## authentication methods, to prevent attackers from accessing it.
+#HashedControlPassword 16:B4DC8983B0D19C5F60350CFF5B88B209B219D43E7AB9FE1EE87E808592
+#CookieAuthentication 1
+
+############### This section is just for location-hidden services ###
+
+## Once you have configured a hidden service, you can look at the
+## contents of the file ".../hidden_service/hostname" for the address
+## to tell people.
+##
+## HiddenServicePort x y:z says to redirect requests on port x to the
+## address y:z.
+
+#HiddenServiceDir /var/lib/tor/hidden_service/
+#HiddenServicePort 80 127.0.0.1:80
+
+#HiddenServiceDir /var/lib/tor/other_hidden_service/
+#HiddenServicePort 80 127.0.0.1:80
+#HiddenServicePort 22 127.0.0.1:22
+
+################ This section is just for relays #####################
+#
+## See https://www.torproject.org/docs/tor-doc-relay for details.
+
+## Required: what port to advertise for incoming Tor connections.
+#ORPort 9001
+## If you want to listen on a port other than the one advertised in
+## ORPort (e.g. to advertise 443 but bind to 9090), you can do it as
+## follows.  You'll need to do ipchains or other port forwarding
+## yourself to make this work.
+#ORPort 443 NoListen
+#ORPort 127.0.0.1:9090 NoAdvertise
+## If you want to listen on IPv6 your numeric address must be explicitly
+## between square brackets as follows. You must also listen on IPv4.
+#ORPort [2001:DB8::1]:9050
+
+## The IP address or full DNS name for incoming connections to your
+## relay. Leave commented out and Tor will guess.
+#Address noname.example.com
+
+## If you have multiple network interfaces, you can specify one for
+## outgoing traffic to use.
+## OutboundBindAddressExit will be used for all exit traffic, while
+## OutboundBindAddressOR will be used for all OR and Dir connections
+## (DNS connections ignore OutboundBindAddress).
+## If you do not wish to differentiate, use OutboundBindAddress to
+## specify the same address for both in a single line.
+#OutboundBindAddressExit 10.0.0.4
+#OutboundBindAddressOR 10.0.0.5
+
+## A handle for your relay, so people don't have to refer to it by key.
+## Nicknames must be between 1 and 19 characters inclusive, and must
+## contain only the characters [a-zA-Z0-9].
+## If not set, "Unnamed" will be used.
+#Nickname forsenE
+
+## Define these to limit how much relayed traffic you will allow. Your
+## own traffic is still unthrottled. Note that RelayBandwidthRate must
+## be at least 75 kilobytes per second.
+## Note that units for these config options are bytes (per second), not
+## bits (per second), and that prefixes are binary prefixes, i.e. 2^10,
+## 2^20, etc.
+#RelayBandwidthRate 3 Mbytes  # Throttle traffic to 100KB/s (800Kbps)
+#RelayBandwidthBurst 3 Mbytes # But allow bursts up to 200KB (1600Kb)
+
+## Use these to restrict the maximum traffic per day, week, or month.
+## Note that this threshold applies separately to sent and received bytes,
+## not to their sum: setting "40 GB" may allow up to 80 GB total before
+## hibernating.
+##
+## Set a maximum of 40 gigabytes each way per period.
+#AccountingMax 40 GBytes
+## Each period starts daily at midnight (AccountingMax is per day)
+#AccountingStart day 00:00
+## Each period starts on the 3rd of the month at 15:00 (AccountingMax
+## is per month)
+#AccountingStart month 3 15:00
+
+## Administrative contact information for this relay or bridge. This line
+## can be used to contact you if your relay or bridge is misconfigured or
+## something else goes wrong. Note that we archive and publish all
+## descriptors containing these lines and that Google indexes them, so
+## spammers might also collect them. You may want to obscure the fact that
+## it's an email address and/or generate a new address for this purpose.
+##
+## If you are running multiple relays, you MUST set this option.
+##
+#ContactInfo ckg <0xckg AT sector.city>
+## You might also include your PGP or GPG fingerprint if you have one:
+#ContactInfo 0xFFFFFFFF Random Person <nobody AT example dot com>
+
+## Uncomment this to mirror directory information for others. Please do
+## if you have enough bandwidth.
+#DirPort 9030 # what port to advertise for directory connections
+## If you want to listen on a port other than the one advertised in
+## DirPort (e.g. to advertise 80 but bind to 9091), you can do it as
+## follows.  below too. You'll need to do ipchains or other port
+## forwarding yourself to make this work.
+#DirPort 80 NoListen
+#DirPort 127.0.0.1:9091 NoAdvertise
+## Uncomment to return an arbitrary blob of html on your DirPort. Now you
+## can explain what Tor is if anybody wonders why your IP address is
+## contacting them. See contrib/tor-exit-notice.html in Tor's source
+## distribution for a sample.
+#DirPortFrontPage /etc/tor/tor-exit-notice.html
+
+## Uncomment this if you run more than one Tor relay, and add the identity
+## key fingerprint of each Tor relay you control, even if they're on
+## different networks. You declare it here so Tor clients can avoid
+## using more than one of your relays in a single circuit. See
+## https://www.torproject.org/docs/faq#MultipleRelays
+## However, you should never include a bridge's fingerprint here, as it would
+## break its concealability and potentially reveal its IP/TCP address.
+##
+## If you are running multiple relays, you MUST set this option.
+##
+## Note: do not use MyFamily on bridge relays.
+#MyFamily $7D530ECD3A9F4BADA4D11825E910ED0DF2AC5D60,$282A63D9228513E8998C5B12E2926E6398DBF109
+
+## Uncomment this if you want your relay to be an exit, with the default
+## exit policy (or whatever exit policy you set below).
+## (If ReducedExitPolicy, ExitPolicy, or IPv6Exit are set, relays are exits.
+## If none of these options are set, relays are non-exits.)
+#ExitRelay 1
+
+## Uncomment this if you want your relay to allow IPv6 exit traffic.
+## (Relays do not allow any exit traffic by default.)
+#IPv6Exit 1
+
+## Uncomment this if you want your relay to be an exit, with a reduced set
+## of exit ports.
+#ReducedExitPolicy 1
+
+## Uncomment these lines if you want your relay to be an exit, with the
+## specified set of exit IPs and ports.
+##
+## A comma-separated list of exit policies. They're considered first
+## to last, and the first match wins.
+##
+## If you want to allow the same ports on IPv4 and IPv6, write your rules
+## using accept/reject *. If you want to allow different ports on IPv4 and
+## IPv6, write your IPv6 rules using accept6/reject6 *6, and your IPv4 rules
+## using accept/reject *4.
+##
+## If you want to _replace_ the default exit policy, end this with either a
+## reject *:* or an accept *:*. Otherwise, you're _augmenting_ (prepending to)
+## the default exit policy. Leave commented to just use the default, which is
+## described in the man page or at
+## https://www.torproject.org/documentation.html
+##
+## Look at https://www.torproject.org/faq-abuse.html#TypicalAbuses
+## for issues you might encounter if you use the default exit policy.
+##
+## If certain IPs and ports are blocked externally, e.g. by your firewall,
+## you should update your exit policy to reflect this -- otherwise Tor
+## users will be told that those destinations are down.
+##
+## For security, by default Tor rejects connections to private (local)
+## networks, including to the configured primary public IPv4 and IPv6 addresses,
+## and any public IPv4 and IPv6 addresses on any interface on the relay.
+## See the man page entry for ExitPolicyRejectPrivate if you want to allow
+## "exit enclaving".
+##
+#ExitPolicy accept *:6660-6667,reject *:* # allow irc ports on IPv4 and IPv6 but no more
+#ExitPolicy accept *:119 # accept nntp ports on IPv4 and IPv6 as well as default exit policy
+#ExitPolicy accept *4:119 # accept nntp ports on IPv4 only as well as default exit policy
+#ExitPolicy accept6 *6:119 # accept nntp ports on IPv6 only as well as default exit policy
+#ExitPolicy reject *:* # no exits allowed
+
+## Bridge relays (or "bridges") are Tor relays that aren't listed in the
+## main directory. Since there is no complete public list of them, even an
+## ISP that filters connections to all the known Tor relays probably
+## won't be able to block all the bridges. Also, websites won't treat you
+## differently because they won't know you're running Tor. If you can
+## be a real relay, please do; but if not, be a bridge!
+##
+## Warning: when running your Tor as a bridge, make sure than MyFamily is
+## NOT configured.
+#BridgeRelay 1
+## By default, Tor will advertise your bridge to users through various
+## mechanisms like https://bridges.torproject.org/. If you want to run
+## a private bridge, for example because you'll give out your bridge
+## address manually to your friends, uncomment this line:
+#BridgeDistribution none
+
+## Configuration options can be imported from files or folders using the %include
+## option with the value being a path. This path can have wildcards. Wildcards are 
+## expanded first, using lexical order. Then, for each matching file or folder, the following 
+## rules are followed: if the path is a file, the options from the file will be parsed as if 
+## they were written where the %include option is. If the path is a folder, all files on that 
+## folder will be parsed following lexical order. Files starting with a dot are ignored. Files 
+## on subfolders are ignored.
+## The %include option can be used recursively.
+#%include /etc/torrc.d/*.conf
+