Skip to content

docs: Update Angie guide #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
IKitKatt wants to merge 1 commit into
base: main
Choose a base branch
from
Open

docs: Update Angie guide #1

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
142 changes: 69 additions & 73 deletions docs/install/reverse-proxies/angie.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,10 +24,10 @@ mkdir -p /opt/remnawave/angie && cd /opt/remnawave/angie

### Simple configuration

Create a file called `angie.conf` in the `/opt/remnawave/angie` directory.
Create a file called `remnawave.conf` in the `/opt/remnawave/angie/http.d` directory.

```bash
cd /opt/remnawave/angie && nano angie.conf
mkdir -p /opt/remnawave/angie/http.d && cd /opt/remnawave/angie/http.d && nano remnawave.conf
```

Paste the following configuration.
Expand All @@ -40,33 +40,18 @@ Review the configuration below, look for red highlighted lines.

:::

```angie title="angie.conf"
```angie title="remnawave.conf"
upstream remnawave {
server remnawave:3000;
}

resolver 1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220;

acme_client acme_le https://acme-v02.api.letsencrypt.org/directory;

server {
// highlight-next-line-red
server_name REPLACE_WITH_YOUR_DOMAIN;

listen 443 ssl reuseport;
listen [::]:443 ssl reuseport;

listen 443 ssl;
http2 on;

acme acme_le;

# SSL Configuration (Mozilla Intermediate)
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:1m;
ssl_session_tickets off;
ssl_certificate $acme_cert_acme_le;
ssl_certificate_key $acme_cert_key_acme_le;
gzip on;

location / {
proxy_http_version 1.1;
Expand All @@ -77,48 +62,59 @@ server {
proxy_set_header X-Forwarded-Proto $scheme;
}

# Gzip Compression
gzip on;
gzip_vary on;
gzip_proxied any;
gzip_comp_level 6;
gzip_buffers 16 8k;
gzip_http_version 1.1;
gzip_min_length 256;
gzip_types
application/atom+xml
application/geo+json
application/javascript
application/x-javascript
application/json
application/ld+json
application/manifest+json
application/rdf+xml
application/rss+xml
application/xhtml+xml
application/xml
font/eot
font/otf
font/ttf
image/svg+xml
text/css
text/javascript
text/plain
text/xml;
# ACME
acme remnawave;
ssl_certificate $acme_cert_remnawave;
ssl_certificate_key $acme_cert_key_remnawave;
}

# Reject unknown SNI
server {
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
listen 443 ssl default_server reuseport;
server_name _;

ssl_reject_handshake on;
}

# HTTP for ACME
server {
listen 80;
return 444; # https://angie.software/angie/docs/configuration/acme/#http
return 444;
}

# Gzip Compression
gzip_vary on;
gzip_proxied any;
gzip_comp_level 6;
gzip_buffers 16 8k;
gzip_http_version 1.1;
gzip_min_length 256;
gzip_types
application/javascript
application/json
application/manifest+json
application/xml
font/opentype
font/eot
font/otf
font/ttf
image/svg+xml
text/css
text/javascript
text/plain
text/xml;

# SSL
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
ssl_ecdh_curve X25519MLKEM768:X25519:secp384r1:prime256v1;

ssl_session_timeout 1d;
ssl_session_cache shared:SSL:1m;
ssl_session_tickets off;

resolver 1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220;
acme_client remnawave https://acme-v02.api.letsencrypt.org/directory;
```

### Create docker-compose.yml
Expand All @@ -133,31 +129,31 @@ Paste the following configuration.

```yaml title="docker-compose.yml"
services:
remnawave-angie:
image: docker.angie.software/angie:1.9.0
container_name: remnawave-angie
hostname: remnawave-angie
restart: always
ports:
- '0.0.0.0:443:443'
- '0.0.0.0:80:80'
networks:
- remnawave-network
volumes:
- angie-ssl-data:/var/lib/angie/acme/
- ./angie.conf:/etc/angie/http.d/default.conf:ro
remnawave-angie:
image: docker.angie.software/angie:latest
container_name: 'remnawave-angie'
hostname: remnawave-angie
volumes:
- angie-ssl-data:/var/lib/angie/acme/
- ./http.d/:/etc/angie/http.d/:ro
restart: always
ports:
- '0.0.0.0:443:443'
- '0.0.0.0:80:80'
networks:
- remnawave-network

networks:
remnawave-network:
name: remnawave-network
driver: bridge
external: true
remnawave-network:
name: remnawave-network
driver: bridge
external: true

volumes:
angie-ssl-data:
driver: local
external: false
name: angie-ssl-data
angie-ssl-data:
name: angie-ssl-data
driver: local
external: false
```

### Start the container
Expand Down