XWiki Installation: Docker, Nginx und PostgreSQL

server {

    server_name wiki.domain.de;

    #root /var/www/html;
    #index index.html;

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/wiki.domain.de/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/wiki.domain.de/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
    
    access_log /var/log/nginx/wiki.domain.de.access.log;
    error_log  /var/log/nginx/wiki.domain.de.error.log warn;

    client_max_body_size 10M;
    client_body_buffer_size 128k;

    add_header Strict-Transport-Security "max-age=63072000" always;
    add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive" always;
    add_header Content-Security-Policy "upgrade-insecure-requests" always;

    # --- OIDC-Callback IMMER durchlassen ---
    location = /oidc/authenticator/callback {
      proxy_pass http://127.0.0.1:8080;
      proxy_set_header Host              $host;
      proxy_set_header X-Real-IP         $remote_addr;
      proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Host  $host;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header X-Forwarded-Port  443;
    } 

    # --- XWiki-Login-Starter durchlassen (sonst Redirect-Loop) ---
    location = /bin/login/XWiki/XWikiLogin {
      proxy_pass http://127.0.0.1:8080;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Host $host;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header X-Forwarded-Port 443;
    }

    # --- optionale statische Pfade ohne Session zulassen (schneller) ---
    location ~ ^/(resources|skins|webjars|assets)/ {
      proxy_pass http://127.0.0.1:8080;
      proxy_set_header Host $host;
    }
 
    # --- Haupt-Location: ohne Session => Redirect zum Login-Starter ---
    location / {
      # Prüft, ob ein JSESSIONID-Cookie gesetzt ist (Groß/Klein egal).
      if ($http_cookie !~* "(^|;\\s*)JSESSIONID=") {
        return 302 /bin/login/XWiki/XWikiLogin?loginLink=1&xredirect=$request_uri;
      }

      proxy_http_version 1.1;
      proxy_set_header Host              $host;
      proxy_set_header X-Real-IP         $remote_addr;
      proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Host  $host;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header X-Forwarded-Port  443;
      proxy_set_header Upgrade           $http_upgrade;
      proxy_set_header Connection        "upgrade";
      proxy_read_timeout 120s;
      proxy_send_timeout 120s;

      proxy_pass http://127.0.0.1:8080;
    }   
}

server {
    if ($host = wiki.domain.de) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    listen 80;

    server_name wiki.domain.de;
    return 404; # managed by Certbot
}