From 46846781d4b24c76a4ec73c70b17c6143962d792 Mon Sep 17 00:00:00 2001
From: Danilo Reyes <CaptainJawZ@protonmail.com>
Date: Fri, 29 Nov 2024 09:01:03 -0600
Subject: [PATCH] nginx settings for plex & disabled instagram

---
 modules/scripts/download.nix |  6 ++---
 modules/servers/plex.nix     | 45 ++----------------------------------
 2 files changed, 5 insertions(+), 46 deletions(-)

diff --git a/modules/scripts/download.nix b/modules/scripts/download.nix
index 6aed553..479eadc 100644
--- a/modules/scripts/download.nix
+++ b/modules/scripts/download.nix
@@ -78,9 +78,9 @@
             };
           in
           {
-            "instagram@stories" = lib.mkIf config.my.units.download.enable (
-              downloadTimer "*-*-* 08:12:00" 120 // { }
-            );
+            # "instagram@stories" = lib.mkIf config.my.units.download.enable (
+            #   downloadTimer "*-*-* 08:12:00" 120 // { }
+            # );
             "download@main" = lib.mkIf config.my.units.download.enable (
               downloadTimer "*-*-* 06,18:02:00" 30 // { }
             );
diff --git a/modules/servers/plex.nix b/modules/servers/plex.nix
index 1681762..410c104 100644
--- a/modules/servers/plex.nix
+++ b/modules/servers/plex.nix
@@ -17,50 +17,14 @@ in
         openFirewall = true;
       };
       nginx = lib.mkIf cfg.enableProxy {
-        appendHttpConfig = ''
-          # JELLYFIN
-          proxy_cache_path /var/cache/nginx/jellyfin levels=1:2 keys_zone=jellyfin:100m max_size=15g inactive=1d use_temp_path=off;
-          map $request_uri $h264Level { ~(h264-level=)(.+?)& $2; }
-          map $request_uri $h264Profile { ~(h264-profile=)(.+?)& $2; }
-        '';
         virtualHosts."${cfg.host}" = {
           forceSSL = true;
           enableACME = true;
           http2 = true;
           serverAliases = [ "plex.rotehaare.art" ];
           extraConfig = ''
-            #Some players don't reopen a socket and playback stops totally instead of resuming after an extended pause
+            # Some players don't reopen a socket and playback stops totally instead of resuming after an extended pause
             send_timeout 100m;
-
-            # Why this is important: https://blog.cloudflare.com/ocsp-stapling-how-cloudflare-just-made-ssl-30/
-            ssl_stapling on;
-            ssl_stapling_verify on;
-
-            ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
-            ssl_prefer_server_ciphers on;
-            #Intentionally not hardened for security for player support and encryption video streams has a lot of overhead with something like AES-256-GCM-SHA384.
-            ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
-
-            # Forward real ip and host to Plex
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-            proxy_set_header Host $server_addr;
-            proxy_set_header Referer $server_addr;
-            proxy_set_header Origin $server_addr;
-
-            # Plex has A LOT of javascript, xml and html. This helps a lot, but if it causes playback issues with devices turn it off.
-            gzip on;
-            gzip_vary on;
-            gzip_min_length 1000;
-            gzip_proxied any;
-            gzip_types text/plain text/css text/xml application/xml text/javascript application/x-javascript image/svg+xml;
-            gzip_disable "MSIE [1-6]\.";
-
-            # Nginx default client_max_body_size is 1MB, which breaks Camera Upload feature from the phones.
-            # Increasing the limit fixes the issue. Anyhow, if 4K videos are expected to be uploaded, the size might need to be increased even more
-            client_max_body_size 100M;
-
             # Plex headers
             proxy_set_header X-Plex-Client-Identifier $http_x_plex_client_identifier;
             proxy_set_header X-Plex-Device $http_x_plex_device;
@@ -74,18 +38,13 @@ in
             proxy_set_header X-Plex-Provides $http_x_plex_provides;
             proxy_set_header X-Plex-Device-Vendor $http_x_plex_device_vendor;
             proxy_set_header X-Plex-Model $http_x_plex_model;
-
-            # Websockets
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-
             # Buffering off send to the client as soon as the data is received from Plex.
             proxy_redirect off;
             proxy_buffering off;
           '';
           locations."/" = {
             proxyPass = cfg.local;
+            proxyWebsockets = true;
           };
         };
       };