infra/roles/hass-nginx/templates/01-hass.conf.j2

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}
#default $http_connection;

server {
    listen 443 ssl;
    {% if inventory_hostname in wg_clients -%}
    listen {{ wg_clients[inventory_hostname].ip }}:443 ssl;
    {% endif -%}
    {% if nginx_http2 -%}
    http2 on;
    {% else -%}
    http2 off;
    {% endif %}

    # include listen-proxy-protocol.conf;
    include /etc/nginx/authelia_internal.conf;
    include /etc/nginx/sudo-known.conf;
    include /etc/nginx/nginx-sec.conf;

    server_name {{ hass_url }} {{ hass_url.split('.')[0] }}2.{{hass_url.split('.')[1:] | join('.') }} {{ hass_url.split('.')[0] }}.{{ inventory_hostname.split('.')[1:] | join('.') }} {{ hass_url_2 }};

    location /glados/ {
        # TEMP: while glados hass integration is WIP
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass {{ hass_glados_tts_url }}/;

    }


    location / {
        #proxy_set_header Host $host;
        #proxy_set_header X-Forwarded-For $remote_addr;
        #proxy_set_header X-Forwarded-Proto $scheme;
        #proxy_set_header X-Forwarded-Protocol $scheme;
        #proxy_set_header X-Forwarded-Host $http_host;
        proxy_set_header Host "{{ hass_url }}";
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_redirect http:// https://;
        proxy_buffering off;
        proxy_http_version 1.1;
        proxy_pass http://127.0.0.1:8123;
    }
    location = /api/websocket {
        proxy_set_header Host "{{ hass_url }}";
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        #proxy_set_header Connection "Upgrade";

        proxy_redirect http:// https://;
        proxy_buffering off;
        proxy_http_version 1.1;
        proxy_pass http://127.0.0.1:8123;
    }

    rewrite "^/(aui/.*)$" "/appdaemon/$1" redirect;
    location /appdaemon {
        return 302 /appdaemon/;
    }
    location /appdaemon/ {
        include /etc/nginx/require_auth.conf;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_redirect / /appdaemon/;

        sub_filter_once off;
        sub_filter_types "*";
        #sub_filter ".js" ".js?id=$request_id";
        sub_filter "/aui/" "/appdaemon/aui/";
        sub_filter "/stream" "/appdaemon/stream";

        proxy_pass http://{{ bridgewithdns.hass_ad }}:8080/;
    }
    location /appdaemon/api {
        include /etc/nginx/require_auth.conf;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_pass http://{{ bridgewithdns.hass_ad }}:8080/api/appdaemon/;
    }


    location /favicon.png {
        alias /var/www/hass/dev.png;
        default_type image/png;
    }
    location /entity_pictures/ {
        alias /var/www/hass/entity_pictures/;
        autoindex on;
    }

    location /_cast/redirect {
        return 302 https://github.com/benediktkr;
    }

    {% if blink1_server_port is defined -%}
    location /blink1/ {
        {% for cidr in my_local_cidrs -%}
        allow {{ cidr }};
        {% endfor -%}
        allow {{ my_public_ips[ansible_control_host] }}/32;
        allow 127.0.0.1;
        deny all;

        {% if blink1_tiny_html|default(false) -%}
        rewrite '^/blink1(/.*)$' $1 break;
        sub_filter_once off;
        sub_filter '"/' '"./';
        {% else -%}
        add_header Content-Type 'application/json' always;
        {% endif -%}
        proxy_http_version 1.1;
        proxy_pass http://localhost:{{ blink1_server_port }};
    }
    {% endif %}

    location /_media {
       include /etc/nginx/require_auth.conf;
       alias {{ systemuserlist.hass.home }}/home-assistant/media;

       autoindex on;
       autoindex_exact_size off;
    }
    location /_media/somafm/ {
        proxy_pass https://ice6.somafm.com/;
    }

    location = /_media/owntone {
        return 302 https://{{ hass_url }}/_media/owntone/{{ hass_nginx_owntone_stream }};
    }
    location /_media/owntone/{{ hass_nginx_owntone_stream }} {
        #proxy_set_header Upgrade $http_upgrade;
        #proxy_set_header Connection "upgrade";
        #proxy_set_header Access-Control-Allow-Origin *;
        types        { }
        default_type audio/mpeg;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_http_version 1.1;
        proxy_pass_request_headers on;

        proxy_set_header Range bytes=0-;
        proxy_buffering off;
        tcp_nodelay on;
        proxy_pass https://{{ owntone_url }}/{{ hass_nginx_owntone_stream }};
    }

    location {{ mass_baseurl }}/ {

        sub_filter_types text/xhtml text/xml text/css;
        sub_filter 'href="/'  'href="{{ mass_baseurl }}/';
        sub_filter 'url(/'  'url({{ mass_baseurl }}/';
        sub_filter_once off;
        sub_filter_last_modified on;

        proxy_pass_request_headers on;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        #proxy_set_header Host $host;
        #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        #proxy_set_header X-Forwarded-Proto "http";
        #proxy_set_header Host "mass";

        #proxy_pass http://localhost:{{ mass_port }}/;
        proxy_pass http://{{ bridgewithdns.host }}:{{ mass_port }}/;
        #proxy_pass http://{{ bridgewithdns.mass }}:{{ mass_port }}/;
        #proxy_pass http://{{ bridgewithdns.mass }}:{{ mass_port }};
    }

    #location = {{ nginx_podgrab_path }} {
    #    return 302 https://{{ hass_url }}{{ nginx_podgrab_path }};
    #}
    # location {{ nginx_podgrab_path }} {
    #     #include /etc/nginx/require_auth.conf;

    #     # json for a tag:
    #     # https://hass.sudo.is/podcasts/tags/${tag}

    #     # add rss type or let podgrab handle it?
    #     # slice out the url prefix
    #     rewrite '^{{ nginx_podgrab_path }}(/.*)$' $1 break;

    #     # rewrite html responses to add the url prefix
    #     sub_filter_once off;
    #     sub_filter 'href="/' 'href="{{ nginx_podgrab_path }}/';
    #     sub_filter 'src="/' 'src="{{ nginx_podgrab_path }}/';
    #     sub_filter '= "/' '= "{{ nginx_podgrab_path }}/';
    #     sub_filter ':"/' ':"{{ nginx_podgrab_path }}/';
    #     sub_filter ':href="\'/' ':href="\'{{ nginx_podgrab_path }}/';
    #     sub_filter 'return "/' 'return "{{ nginx_podgrab_path }}/';
    #     sub_filter '("/' '("{{ nginx_podgrab_path }}/';
    #     sub_filter '`/' '`{{ nginx_podgrab_path }}/';
    #     sub_filter '/ws' '{{ nginx_podgrab_path }}/ws';

    #     # nuke the service worker cache
    #     sub_filter '.js' '.js?id=$request_id';
    #     sub_filter '.css' '.css?id=$request_id';

    #     # headers for websockets
    #     #proxy_set_header Upgrade $http_upgrade;
    #     #proxy_set_header Connection $connection_upgrade;
    #     proxy_set_header X-Real-IP $remote_addr;
    #     #proxy_set_header X-Forwarded-Proto $scheme;
    #     #proxy_set_header X-Forwarded-Host $http_host;
    #     #proxy_set_header Host $http_host;

    #     proxy_pass http://localhost:{{ podgrab_port }}{{ nginx_podgrab_path }}/;
    # }

    access_log /var/log/nginx/access_{{ hass_url }}.log main;
    error_log /var/log/nginx/error_{{ hass_url }}.log warn;

    ssl_session_timeout 5m;
    ssl_certificate /usr/local/etc/certs/{{ domain }}/fullchain.pem;
    ssl_certificate_key /usr/local/etc/certs/{{ domain }}/privkey.pem;

    #add_header X-Robots-Tag "none" always;
    #fastcgi_hide_header X-Powered-By;
}