From 05cc6fd026943c35e54519410ad03a562e54ba94 Mon Sep 17 00:00:00 2001
From: Hikari <hikari@nhcarrigan.com>
Date: Thu, 9 Jul 2026 12:02:29 -0700
Subject: [PATCH] fix: forward websocket upgrade headers for
 forms.nhcarrigan.com, sync hisho.nhcarrigan.com block and cloudflare ip
 refresh from server

---
 nginx/nginx/cloudflare_ips.conf        |  2 +-
 nginx/nginx/sites-available/ai.conf    | 19 +++++++++++++++++++
 nginx/nginx/sites-available/forms.conf |  2 ++
 3 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/nginx/nginx/cloudflare_ips.conf b/nginx/nginx/cloudflare_ips.conf
index bebf163..d257455 100644
--- a/nginx/nginx/cloudflare_ips.conf
+++ b/nginx/nginx/cloudflare_ips.conf
@@ -1,5 +1,5 @@
 # Auto-generated Cloudflare IP ranges
-# Updated: Wed Jun 10 10:59:21 PM PDT 2026
+# Updated: Wed Jul  8 11:01:39 PM PDT 2026
 
 real_ip_header CF-Connecting-IP;
 
diff --git a/nginx/nginx/sites-available/ai.conf b/nginx/nginx/sites-available/ai.conf
index 3eaf338..13fa66c 100644
--- a/nginx/nginx/sites-available/ai.conf
+++ b/nginx/nginx/sites-available/ai.conf
@@ -17,3 +17,22 @@ server {
   }
   include /etc/nginx/snippets/deny-dotfiles.conf;
 }
+
+server {
+  listen 443 ssl;
+  server_name hisho.nhcarrigan.com;
+  ssl_certificate /etc/letsencrypt/live/hisho.nhcarrigan.com/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/hisho.nhcarrigan.com/privkey.pem;
+
+  location / {
+    proxy_pass http://127.0.0.1:44124;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+  }
+  include /etc/nginx/snippets/deny-dotfiles.conf;
+}
diff --git a/nginx/nginx/sites-available/forms.conf b/nginx/nginx/sites-available/forms.conf
index 71fda05..641563e 100644
--- a/nginx/nginx/sites-available/forms.conf
+++ b/nginx/nginx/sites-available/forms.conf
@@ -156,6 +156,8 @@ server {
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header Host $http_host;
         proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
         proxy_pass http://127.0.0.1:11111;
         proxy_redirect off;
     }