# configuration file /etc/nginx/nginx.conf:
user www-data;
worker_processes auto;
worker_cpu_affinity auto;
pid /run/nginx.pid;
error_log /var/log/nginx/error.log;
include /etc/nginx/modules-enabled/*.conf;

events {
	worker_connections 768;
	# multi_accept on;
}

http {

	##
	# Basic Settings
	##

	sendfile on;
	tcp_nopush on;
	types_hash_max_size 2048;
	server_tokens off; # Recommended practice is to turn this off

	# server_names_hash_bucket_size 64;
	# server_name_in_redirect off;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	##
	# SSL Settings
	##

	ssl_protocols TLSv1.2 TLSv1.3; # Dropping SSLv3 (POODLE), TLS 1.0, 1.1
	ssl_prefer_server_ciphers off; # Don't force server cipher order.

	##
	# Logging Settings
	##

	access_log /var/log/nginx/access.log;

	##
	# Gzip Settings
	##

	gzip on;

	# gzip_vary on;
	# gzip_proxied any;
	# gzip_comp_level 6;
	# gzip_buffers 16 8k;
	# gzip_http_version 1.1;
	# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

	##
	# Virtual Host Configs
	##

	include /etc/nginx/conf.d/*.conf;
	include /etc/nginx/sites-enabled/*;
}

#mail {
#	# See sample authentication script at:
#	# http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
#	# auth_http localhost/auth.php;
#	# pop3_capabilities "TOP" "USER";
#	# imap_capabilities "IMAP4rev1" "UIDPLUS";
#
#	server {
#		listen     localhost:110;
#		protocol   pop3;
#		proxy      on;
#	}
#
#	server {
#		listen     localhost:143;
#		protocol   imap;
#		proxy      on;
#	}
#}

# configuration file /etc/nginx/mime.types:
types {
    text/html                                        html htm shtml;
    text/css                                         css;
    text/xml                                         xml;
    image/gif                                        gif;
    image/jpeg                                       jpeg jpg;
    application/javascript                           js;
    application/atom+xml                             atom;
    application/rss+xml                              rss;

    text/mathml                                      mml;
    text/plain                                       txt;
    text/vnd.sun.j2me.app-descriptor                 jad;
    text/vnd.wap.wml                                 wml;
    text/x-component                                 htc;

    image/avif                                       avif;
    image/png                                        png;
    image/svg+xml                                    svg svgz;
    image/tiff                                       tif tiff;
    image/vnd.wap.wbmp                               wbmp;
    image/webp                                       webp;
    image/x-icon                                     ico;
    image/x-jng                                      jng;
    image/x-ms-bmp                                   bmp;

    font/woff                                        woff;
    font/woff2                                       woff2;

    application/java-archive                         jar war ear;
    application/json                                 json;
    application/mac-binhex40                         hqx;
    application/msword                               doc;


**Inspecting Nginx configurations**

I need to remove “/shell” from the configuration files in the “/etc/nginx/sites-enabled/kiosk” and “sites-available” directories, which could be possibly related to something owned by sebas. First, I should take a closer look at the specific file to ensure I'm making the right changes. It's important to confirm that any adjustments I make are necessary. I want to be methodical to avoid issues later on!


server {
    listen 80 default_server;
    listen [::]:80 default_server;

    root /var/www/portal;
    index index.html;

    location = / {
        try_files $uri $uri/ /index.html;
    }

    location = /portal {
        return 302 /portal/;
    }

    location ^~ /portal/ {
        proxy_pass http://127.0.0.1:18789/portal/;
        proxy_http_version 1.1;
        proxy_set_header Accept-Encoding "";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    # Calistenia static repo
    location ^~ /calistenia/ {
        alias /home/sebas/clawd/web/calistenia/;
        try_files $uri $uri/ /calistenia/index.html;
    }

    location = /files {
        return 302 /files/;
    }

    location ^~ /files/ {
        proxy_pass http://127.0.0.1:3923/files/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    location = /shell {
        return 302 /shell/;
    }

    location = /shell/ {
        proxy_pass http://127.0.0.1:7681/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    location = /shell/ws {
        proxy_pass http://127.0.0.1:7681/ws;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    location = /pi {
        return 302 /pi/;
    }

    location ^~ /pi/ {
        proxy_pass http://127.0.0.1:8787/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_redirect off;
        sub_filter_once off;
        sub_filter_types text/css application/javascript application/json;
        sub_filter 'href="/' 'href="/pi/';
        sub_filter 'src="/' 'src="/pi/';
        sub_filter 'content="/' 'content="/pi/';
        sub_filter 'url(/' 'url(/pi/';
        sub_filter 'fetch="/' 'fetch="/pi/';
        sub_filter "fetch('/" "fetch('/pi/";
        sub_filter '"/manifest.webmanifest' '"/pi/manifest.webmanifest';
        sub_filter '"/icon.svg' '"/pi/icon.svg';
        sub_filter '"/styles.css' '"/pi/styles.css';
    }

    location = /tmux {
        return 301 /shell/;
    }

    location ^~ /tmux/ {
        return 301 /shell/;
    }

    # Main portal SPA
    location / {
        try_files $uri $uri/ /index.html;
    }

    access_log off;
    error_log /var/log/nginx/portal-error.log warn;

    location ~* \.(css|js|jpg|jpeg|png|gif|ico|svg|woff|woff2)$ {
        expires 1d;
        add_header Cache-Control "public, immutable";
    }
}


server {
    listen 80 default_server;
    listen [::]:80 default_server;

    root /var/www/portal;
    index index.html;

    location = /portal {
        return 302 /portal/;
    }

    location ^~ /portal/ {
        proxy_pass http://127.0.0.1:18789/portal/;
        proxy_http_version 1.1;
        proxy_set_header Accept-Encoding "";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    # Calistenia static repo
    location ^~ /calistenia/ {
        alias /home/sebas/clawd/web/calistenia/;
        try_files $uri $uri/ /calistenia/index.html;
    }

    location = /mp3-share {
        return 302 /mp3-share/;
    }

    location = /mp3-share-link {
        return 302 /mp3-share/;
    }

    location ^~ /mp3-share/ {
        alias /home/sebas/downloads/mp3-share/;
        autoindex on;
        autoindex_exact_size off;
        autoindex_localtime on;
    }

    location = /reports {
        return 302 /reports/;
    }

    location ^~ /reports/ {
        alias /home/sebas/;
        autoindex on;
        autoindex_exact_size off;
        autoindex_localtime on;
    }

    location = /shell {
        return 302 /shell/;
    }

    location = /shell/ {
        proxy_pass http://127.0.0.1:7681/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    location = /shell/ws {
        proxy_pass http://127.0.0.1:7681/ws;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    location = /pi {
        return 302 /pi/;
    }

    location ^~ /pi/ {
        proxy_pass http://127.0.0.1:8787/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_redirect off;
        sub_filter_once off;
        sub_filter_types text/css application/javascript application/json;
        sub_filter 'href="/' 'href="/pi/';
        sub_filter 'src="/' 'src="/pi/';
        sub_filter 'content="/' 'content="/pi/';
        sub_filter 'url(/' 'url(/pi/';
        sub_filter 'fetch="/' 'fetch="/pi/';
        sub_filter "fetch('/" "fetch('/pi/";
        sub_filter '"/manifest.webmanifest' '"/pi/manifest.webmanifest';
        sub_filter '"/icon.svg' '"/pi/icon.svg';
        sub_filter '"/styles.css' '"/pi/styles.css';
    }

    location = /tmux {
        return 301 /shell/;
    }

    location ^~ /tmux/ {
        return 301 /shell/;
    }

    # Main portal SPA
    location / {
        try_files $uri $uri/ /index.html;
    }

    access_log off;
    error_log /var/log/nginx/portal-error.log warn;

    location ~* \.(css|js|jpg|jpeg|png|gif|ico|svg|woff|woff2)$ {
        expires 1d;
        add_header Cache-Control "public, immutable";
    }
}


**Evaluating nginx configurations**

I need to consider removing shell routes from both the sites-enabled and sites-available files. It looks like sites-enabled is a symlink, but I also need to check if kiosk is a regular file. If that's the case, I should update both files and reload nginx. The user wants to remove /shell, so I might also need to change /tmux redirects to prevent broken links. Redirecting it somewhere else or returning a 404 might be the safest option.

**Evaluating /tmux removal**

I’m considering whether to delete the /tmux locations or perhaps change them to return a 404, since /tmux was an alias for /shell. If the user wants /shell removed, it makes sense to eliminate the /tmux routes too. I should check if there are any legacy references to /tmux in the configuration. It's essential to ensure that any changes align with the user's intentions and avoid leaving any broken links behind.

bash

grep -RIn "location = /tmux\|/tmux" /etc/nginx /mnt/rpi/pi-config /home/sebas 2>/dev/null | head -100