Update Nginx and Caddy guides

[SpilexX]

Nginx:

• move certs to ssl directory
• move configs to conf.d directory
• simplify docker-compose.yml
• simplify guide for subscription page
• move tls and gzip options to global http level
• update tls config: remove stale tls1.2 cipher suites and declare x25519mlkem768 support
• remove unused gzip options and mime types

Caddy:

• replace version 2.9 to latest
• add encoding option (zstd and gzip compression)

[greptile-apps]

Greptile Summary

This PR updates the Nginx and Caddy reverse-proxy guides by reorganising the directory layout (certs → ssl/, config → conf.d/), modernising the TLS configuration, and simplifying both guides to reduce redundancy. Caddy gains a compression (encode) directive and moves from a pinned version to caddy:latest.

• Nginx: SSL and gzip directives are promoted to the http level so they apply globally across all conf.d files; the TLS config is refreshed to drop DHE suites and add X25519MLKEM768 for post-quantum key exchange; the subscription-page config becomes its own subpage.conf with limit_except GET and Authorization header stripping.
• Caddy: encode added to all site blocks for zstd/gzip compression; image tag moved to caddy:latest; remnawave-node.md volume mount updated to reference the new nginx/ssl/ subdirectory with a :ro flag.

Confidence Score: 3/5

The nginx guide may produce a broken container for users whose nginx:stable image ships with OpenSSL older than 3.5, as the new ssl_ecdh_curve entry X25519MLKEM768 is unrecognised without that OpenSSL version.

The ssl_ecdh_curve directive now includes X25519MLKEM768, which the source config URL explicitly ties to OpenSSL 3.5. The Docker image was simultaneously changed from the specific nginx:1.30 to nginx:stable, whose bundled OpenSSL version is not guaranteed. If the curve name is unrecognised at runtime, nginx refuses to start entirely — an immediately visible but hard-to-diagnose failure for users following the guide step by step.

docs/install/reverse-proxies/nginx.md deserves a second look specifically around the ssl_ecdh_curve directive and whether nginx:stable reliably ships with OpenSSL 3.5 support.

Important Files Changed

Filename	Overview
docs/install/reverse-proxies/nginx.md	Major restructuring: certs moved to ssl/, config to conf.d/, TLS updated with X25519MLKEM768 (requires OpenSSL 3.5+), gzip/SSL moved to http level — X25519MLKEM768 compatibility with nginx:stable is uncertain and could break nginx startup
docs/install/reverse-proxies/caddy.md	Image changed from caddy:2.9 to caddy:latest, encode directive added for compression, volume name ordering fixed — unpinned latest tag is a reproducibility concern
docs/install/subscription-page/bundled.md	Nginx subscription-page section refactored into a separate subpage.conf file with limit_except GET, error interception, and Authorization header stripping; @reDIrect naming is misleading for a block that returns 404
docs/install/subscription-page/separate-server.md	Caddy image bumped to caddy:latest and encode directive added — straightforward alignment with caddy.md changes
docs/install/remnawave-node.md	Volume mount updated from /opt/remnawave/nginx to /opt/remnawave/nginx/ssl/ with :ro flag added — correctly aligned with the new ssl/ subdirectory layout

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Client HTTPS :443] --> B{SNI match?}
    B -- Known domain --> C[remnawave server block\nremnawave.conf]
    B -- Subscription domain --> D[subpage server block\nsubpage.conf]
    B -- Unknown SNI --> E[default_server reuseport\nssl_reject_handshake on]

    C --> F[proxy_pass http://remnawave:3000]
    D --> G{Method == GET?}
    G -- Yes --> H[proxy_pass http://remnawave-subscription-page:3010]
    G -- No --> I[deny all]
    H --> J{Error 4xx/5xx?}
    J -- Yes --> K[return 404]
    J -- No --> L[Response to client]

    subgraph Shared http-level config in remnawave.conf
        M[ssl_protocols TLSv1.2 TLSv1.3]
        N[ssl_ecdh_curve X25519MLKEM768...]
        O[gzip_types / gzip settings]
        P[OCSP stapling + resolver]
    end

    subgraph Volume mounts
        Q[./ssl/ -> /etc/nginx/ssl/ ro]
        R[./conf.d/ -> /etc/nginx/conf.d/ ro]
    end

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[Client HTTPS :443] --> B{SNI match?}
    B -- Known domain --> C[remnawave server block\nremnawave.conf]
    B -- Subscription domain --> D[subpage server block\nsubpage.conf]
    B -- Unknown SNI --> E[default_server reuseport\nssl_reject_handshake on]

    C --> F[proxy_pass http://remnawave:3000]
    D --> G{Method == GET?}
    G -- Yes --> H[proxy_pass http://remnawave-subscription-page:3010]
    G -- No --> I[deny all]
    H --> J{Error 4xx/5xx?}
    J -- Yes --> K[return 404]
    J -- No --> L[Response to client]

    subgraph Shared http-level config in remnawave.conf
        M[ssl_protocols TLSv1.2 TLSv1.3]
        N[ssl_ecdh_curve X25519MLKEM768...]
        O[gzip_types / gzip settings]
        P[OCSP stapling + resolver]
    end

    subgraph Volume mounts
        Q[./ssl/ -> /etc/nginx/ssl/ ro]
        R[./conf.d/ -> /etc/nginx/conf.d/ ro]
    end

Loading

_{Reviews (1): Last reviewed commit: "docs: update Caddy guides" | Re-trigger Greptile}

[IKitKatt]

Не очень понятно, зачем кто-то ранее добавил команду на перезапуск контейнера Nginx, которого согласно шагам инструкции еще нет

[IKitKatt]

Можно поменять на docker restart remnawave-nginx

[IKitKatt]

Так как находимся в директории /opt/remnawave/nginx/conf.d получим ошибку. Логичнее добавить в начале cd /opt/remnawave/nginx