Calibre-Web-NextGen/examples/nginx-reverse-proxy.conf at main · new-usemame/Calibre-Web-NextGen · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
# Reference nginx config for Calibre-Web-NextGen behind a reverse proxy.
#
# Why this file exists: Kobo's /v1/library/sync response carries large
# headers (auth, sync tokens, library state). nginx's defaults
# (proxy_buffer_size 4k; proxy_buffers 8 4k) are too small — nginx
# silently drops the response before it reaches the device. The Kobo
# shows "Sync failed, please try again" and the CWA log shows no
# error. nginx's error log reveals:
#
#     [error] *N: upstream sent too big header while reading
#     response header from upstream
#
# Fork issues #308 (@Glennza1962) and #331 (@Gusdezup) both confirmed
# the fix is to bump proxy_buffer_size. See the Kobo sync section of
# the project README.
#
# Copy this into your nginx site config (or paste the body of `location /`
# into your existing site). Replace `cwa.example.com`, `127.0.0.1:8083`,
# and the TLS cert paths with your own values.

server {
    # `listen ... http2;` combined form was deprecated in nginx 1.25.1
    # (2023) in favour of a standalone `http2 on;` directive. The split
    # form works on every supported nginx — older builds ignore the
    # `http2` directive cleanly, newer builds emit a deprecation
    # warning on the combined form.
    listen 443 ssl;
    http2 on;
    server_name cwa.example.com;

    # ---- TLS -----------------------------------------------------------
    # Use Let's Encrypt / certbot, your CA, or a wildcard cert.
    ssl_certificate     /etc/letsencrypt/live/cwa.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/cwa.example.com/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;

    # ---- Upload size (book uploads + cover images) ---------------------
    # Calibre-Web's upload form accepts large files. The default 1m is
    # too small for many EPUBs / PDFs.
    client_max_body_size 200M;

    # ---- Proxy timeouts (longer than nginx defaults) -------------------
    # Some Kobo operations (large library sync, full-library backfill)
    # take longer than nginx's default 60s. 300s is comfortable.
    proxy_connect_timeout 60s;
    proxy_send_timeout    300s;
    proxy_read_timeout    300s;

    location / {
        proxy_pass http://127.0.0.1:8083;

        # ---- Standard X-Forwarded-* headers ----------------------------
        # Calibre-Web-NextGen reads X-Forwarded-Proto, X-Forwarded-Host,
        # and X-Forwarded-For. See TRUSTED_PROXY_COUNT in the README if
        # you stack multiple proxies.
        proxy_set_header Host              $http_host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host  $host;
        proxy_set_header X-Scheme          $scheme;

        # ---- BUFFER SIZES (load-bearing for Kobo sync) -----------------
        # If you remove these lines, Kobo sync will fail silently — the
        # response headers from /v1/library/sync exceed nginx's default
        # 4k buffer. Fork issues #308 + #331.
        #
        # 32k / 4 32k / 64k is enough for libraries up to a few thousand
        # books. Bigger libraries: 128k / 4 256k / 256k.
        proxy_buffer_size       32k;
        proxy_buffers           4 32k;
        proxy_busy_buffers_size 64k;
    }
}

# ---- HTTP → HTTPS redirect (optional) ----------------------------------
# Kobo only sync to HTTPS endpoints; an HTTP→HTTPS redirect here covers
# browser visitors who type the bare hostname.
server {
    listen 80;
    server_name cwa.example.com;
    return 301 https://$host$request_uri;
}