lighttpd finalement
This commit is contained in:
Hadrien
parent
55447a465b
commit
5ae989e8da
@ -1,32 +1,90 @@
|
|||||||
|
server.modules = (
|
||||||
|
"mod_access",
|
||||||
|
"mod_accesslog",
|
||||||
|
"mod_alias",
|
||||||
|
"mod_compress",
|
||||||
|
"mod_redirect",
|
||||||
|
"mod_setenv",
|
||||||
|
"mod_rewrite",
|
||||||
|
"mod_proxy",
|
||||||
|
"mod_cgi",
|
||||||
|
"mod_openssl",
|
||||||
|
)
|
||||||
|
|
||||||
|
server.document-root = "/var/www/html"
|
||||||
|
server.upload-dirs = ( "/var/cache/lighttpd/uploads" )
|
||||||
|
server.errorlog = "/var/log/lighttpd/error.log"
|
||||||
|
accesslog.filename = "/var/log/lighttpd/access.log"
|
||||||
|
server.pid-file = "/var/run/lighttpd.pid"
|
||||||
|
server.username = "www-data"
|
||||||
|
server.groupname = "www-data"
|
||||||
|
server.port = 80
|
||||||
|
|
||||||
|
dir-listing.activate = "enable"
|
||||||
|
dir-listing.encoding = "utf-8"
|
||||||
|
|
||||||
|
index-file.names = ( "index.php", "index.html", "index.lighttpd.html" )
|
||||||
|
url.access-deny = ( "~", ".inc" )
|
||||||
|
static-file.exclude-extensions = ( ".php", ".pl", ".fcgi" )
|
||||||
|
|
||||||
|
compress.cache-dir = "/var/cache/lighttpd/compress/"
|
||||||
|
compress.filetype = ( "application/javascript", "text/css", "text/html", "text/plain" )
|
||||||
|
|
||||||
|
# default listening port for IPv6 falls back to the IPv4 port
|
||||||
|
include_shell "/usr/share/lighttpd/use-ipv6.pl " + server.port
|
||||||
|
# not here anymore see next line : include_shell "/usr/share/lighttpd/create-mime.assign.pl"
|
||||||
|
include_shell "/usr/share/lighttpd/create-mime.conf.pl"
|
||||||
|
#include_shell "/usr/share/lighttpd/include-conf-enabled.pl"
|
||||||
|
include "/etc/lighttpd/conf-enabled/*.conf"
|
||||||
|
|
||||||
### FUZ.RE ###
|
### FUZ.RE ###
|
||||||
## TODO: Wiki pas encore hébergé ici ###
|
### Wiki pas encore hébergé ici ###
|
||||||
# $HTTP["host"] == "wiki.fuz.re" {
|
$HTTP["host"] == "wiki.fuz.re" {
|
||||||
# server.document-root = "/var/www/fuz.re/dokuwiki/"
|
server.document-root = "/var/www/fuz.re/dokuwiki/"
|
||||||
# $HTTP["scheme"] == "http" {
|
$HTTP["scheme"] == "http" {
|
||||||
# url.redirect = (".*" => "https://wiki.fuz.re$0")
|
url.redirect = (".*" => "https://wiki.fuz.re$0")
|
||||||
# }
|
}
|
||||||
|
|
||||||
# FIXME: Redirect www -> https without www
|
$HTTP["scheme"] == "https" {
|
||||||
# $HTTP["host"] == "www.fuz.re" {
|
$HTTP["url"] =~ "^/" {
|
||||||
# $HTTP["scheme"] == "http" {
|
server.follow-symlink = "enable"
|
||||||
# url.redirect = (".*" => "https://fuz.re$0")
|
}
|
||||||
# }
|
|
||||||
# }
|
$HTTP["url"] =~ "/(\.|_)ht" {
|
||||||
|
url.access-deny = ( "" )
|
||||||
|
}
|
||||||
|
$HTTP["url"] =~ "^/(bin|data|inc|conf)" {
|
||||||
|
url.access-deny = ( "" )
|
||||||
|
}
|
||||||
|
# $SERVER["socket"] == ":443" {
|
||||||
|
# ssl.engine = "enable"
|
||||||
|
# ssl.ca-file = "/etc/letsencrypt/live/wiki.fuz.re/fullchain.pem"
|
||||||
|
# ssl.pemfile = "/etc/lighttpd/certs/wiki.fuz.re.pem"
|
||||||
|
# }
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
# Redirect www -> https without www
|
||||||
|
$HTTP["host"] == "www.fuz.re" {
|
||||||
|
$HTTP["scheme"] == "http" {
|
||||||
|
url.redirect = (".*" => "https://fuz.re$0")
|
||||||
|
}
|
||||||
|
}
|
||||||
# Redirect http -> https without www
|
# Redirect http -> https without www
|
||||||
# FIXME: Redirect www -> https without www
|
$HTTP["host"] == "fuz.re" {
|
||||||
# $HTTP["host"] == "fuz.re" {
|
$HTTP["scheme"] == "http" {
|
||||||
# $HTTP["scheme"] == "http" {
|
url.redirect = (".*" => "https://fuz.re$0")
|
||||||
# url.redirect = (".*" => "https://fuz.re$0")
|
}
|
||||||
# }
|
# HTTPS :
|
||||||
# FIXME: HTTPS :
|
$HTTP["scheme"] == "https" {
|
||||||
# $HTTP["scheme"] == "https" {
|
server.document-root = "/var/www/fuz.re/newsite/public"
|
||||||
# $SERVER["socket"] == ":443" {
|
$SERVER["socket"] == ":443" {
|
||||||
# ssl.engine = "enable"
|
ssl.engine = "enable"
|
||||||
# server.document-root = "/var/www/fuz.re/newsite/public"
|
ssl.pemfile = "/etc/letsencrypt/live/fuz.re/fullchain.pem"
|
||||||
# ssl.pemfile = "/etc/letsencrypt/live/fuz.re/fullchain.pem"
|
ssl.privkey = "/etc/letsencrypt/live/fuz.re/privkey.pem"
|
||||||
# ssl.privkey = "/etc/letsencrypt/live/fuz.re/privkey.pem"
|
}
|
||||||
# }
|
}
|
||||||
|
}
|
||||||
|
|
||||||
# Old Jack.tf
|
# Old Jack.tf
|
||||||
$HTTP["host"] == "jack.fuz.re" {
|
$HTTP["host"] == "jack.fuz.re" {
|
||||||
@ -184,12 +242,12 @@ $HTTP["host"] == "liste.fuz.re" {
|
|||||||
}
|
}
|
||||||
|
|
||||||
## Datapaulette - Pas hébérgé ici non plus
|
## Datapaulette - Pas hébérgé ici non plus
|
||||||
# $HTTP["host"] =~ "www.datapaulette.org" {
|
$HTTP["host"] =~ "www.datapaulette.org" {
|
||||||
# url.redirect = (".*" => "http://datapaulette.org")
|
url.redirect = (".*" => "http://datapaulette.org")
|
||||||
# }
|
}
|
||||||
# $HTTP["host"] =~ "datapaulette.org" {
|
$HTTP["host"] =~ "datapaulette.org" {
|
||||||
# server.error-handler-404 = "/index.php"
|
server.error-handler-404 = "/index.php"
|
||||||
# server.document-root = "/var/www/datapaulette.org/dp-wp"
|
server.document-root = "/var/www/datapaulette.org/dp-wp"
|
||||||
# $SERVER["socket"] == ":443" {
|
# $SERVER["socket"] == ":443" {
|
||||||
# ssl.engine = "enable"
|
# ssl.engine = "enable"
|
||||||
# ssl.ca-file = "/etc/letsencrypt/live/datapaulette.org/fullchain.pem"
|
# ssl.ca-file = "/etc/letsencrypt/live/datapaulette.org/fullchain.pem"
|
||||||
@ -1,81 +0,0 @@
|
|||||||
# https://www.digitalocean.com/community/tools/nginx
|
|
||||||
|
|
||||||
user www-data;
|
|
||||||
pid /run/nginx.pid;
|
|
||||||
worker_processes auto;
|
|
||||||
worker_rlimit_nofile 65535;
|
|
||||||
|
|
||||||
# Load modules
|
|
||||||
include /etc/nginx/modules-enabled/*.conf;
|
|
||||||
|
|
||||||
events {
|
|
||||||
multi_accept on;
|
|
||||||
worker_connections 65535;
|
|
||||||
}
|
|
||||||
|
|
||||||
http {
|
|
||||||
charset utf-8;
|
|
||||||
sendfile on;
|
|
||||||
tcp_nopush on;
|
|
||||||
tcp_nodelay on;
|
|
||||||
server_tokens off;
|
|
||||||
log_not_found off;
|
|
||||||
types_hash_max_size 2048;
|
|
||||||
types_hash_bucket_size 64;
|
|
||||||
client_max_body_size 16M;
|
|
||||||
|
|
||||||
# MIME
|
|
||||||
include mime.types;
|
|
||||||
default_type application/octet-stream;
|
|
||||||
|
|
||||||
# Logging
|
|
||||||
access_log /var/log/nginx/access.log;
|
|
||||||
error_log /var/log/nginx/error.log warn;
|
|
||||||
|
|
||||||
# SSL
|
|
||||||
ssl_session_timeout 1d;
|
|
||||||
ssl_session_cache shared:SSL:10m;
|
|
||||||
ssl_session_tickets off;
|
|
||||||
|
|
||||||
# Diffie-Hellman parameter for DHE ciphersuites
|
|
||||||
ssl_dhparam /etc/nginx/dhparam.pem;
|
|
||||||
|
|
||||||
# Mozilla Intermediate configuration
|
|
||||||
ssl_protocols TLSv1.2 TLSv1.3;
|
|
||||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
|
||||||
|
|
||||||
# OCSP Stapling
|
|
||||||
ssl_stapling on;
|
|
||||||
ssl_stapling_verify on;
|
|
||||||
|
|
||||||
# Connection header for WebSocket reverse proxy
|
|
||||||
map $http_upgrade $connection_upgrade {
|
|
||||||
default upgrade;
|
|
||||||
"" close;
|
|
||||||
}
|
|
||||||
|
|
||||||
map $remote_addr $proxy_forwarded_elem {
|
|
||||||
|
|
||||||
# IPv4 addresses can be sent as-is
|
|
||||||
~^[0-9.]+$ "for=$remote_addr";
|
|
||||||
|
|
||||||
# IPv6 addresses need to be bracketed and quoted
|
|
||||||
~^[0-9A-Fa-f:.]+$ "for=\"[$remote_addr]\"";
|
|
||||||
|
|
||||||
# Unix domain socket names cannot be represented in RFC 7239 syntax
|
|
||||||
default "for=unknown";
|
|
||||||
}
|
|
||||||
|
|
||||||
map $http_forwarded $proxy_add_forwarded {
|
|
||||||
|
|
||||||
# If the incoming Forwarded header is syntactically valid, append to it
|
|
||||||
"~^(,[ \\t]*)*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*([ \\t]*,([ \\t]*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*)?)*$" "$http_forwarded, $proxy_forwarded_elem";
|
|
||||||
|
|
||||||
# Otherwise, replace it
|
|
||||||
default "$proxy_forwarded_elem";
|
|
||||||
}
|
|
||||||
|
|
||||||
# Load configs
|
|
||||||
include /etc/nginx/conf.d/*.conf;
|
|
||||||
include /etc/nginx/sites-enabled/*;
|
|
||||||
}
|
|
||||||
@ -1,52 +0,0 @@
|
|||||||
server {
|
|
||||||
listen 443 ssl http2;
|
|
||||||
listen [::]:443 ssl http2;
|
|
||||||
server_name fuz.re;
|
|
||||||
root /var/www/fuz.re/public;
|
|
||||||
|
|
||||||
# SSL
|
|
||||||
ssl_certificate /etc/letsencrypt/live/fuz.re/fullchain.pem;
|
|
||||||
ssl_certificate_key /etc/letsencrypt/live/fuz.re/privkey.pem;
|
|
||||||
ssl_trusted_certificate /etc/letsencrypt/live/fuz.re/chain.pem;
|
|
||||||
|
|
||||||
# security
|
|
||||||
include snippets/security.conf;
|
|
||||||
|
|
||||||
# index.html fallback
|
|
||||||
location / {
|
|
||||||
try_files $uri $uri/ /index.html;
|
|
||||||
}
|
|
||||||
|
|
||||||
# index.php fallback
|
|
||||||
location ~ ^/api/ {
|
|
||||||
try_files $uri $uri/ /index.php?$query_string;
|
|
||||||
}
|
|
||||||
|
|
||||||
# additional config
|
|
||||||
include snippets/general.conf;
|
|
||||||
}
|
|
||||||
|
|
||||||
# subdomains redirect
|
|
||||||
server {
|
|
||||||
listen 443 ssl http2;
|
|
||||||
listen [::]:443 ssl http2;
|
|
||||||
server_name fuz.re www.fuz.re;
|
|
||||||
|
|
||||||
# SSL
|
|
||||||
ssl_certificate /etc/letsencrypt/live/fuz.re/fullchain.pem;
|
|
||||||
ssl_certificate_key /etc/letsencrypt/live/fuz.re/privkey.pem;
|
|
||||||
ssl_trusted_certificate /etc/letsencrypt/live/fuz.re/chain.pem;
|
|
||||||
return 301 https://fuz.re$request_uri;
|
|
||||||
}
|
|
||||||
|
|
||||||
# HTTP redirect
|
|
||||||
server {
|
|
||||||
listen 80;
|
|
||||||
listen [::]:80;
|
|
||||||
server_name fuz.re www.fuz.re;
|
|
||||||
include snippets/letsencrypt.conf;
|
|
||||||
|
|
||||||
location / {
|
|
||||||
return 301 https://fuz.re$request_uri;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,38 +0,0 @@
|
|||||||
server {
|
|
||||||
listen 443 ssl http2;
|
|
||||||
listen [::]:443 ssl http2;
|
|
||||||
server_name matrix.fuz.re;
|
|
||||||
|
|
||||||
# SSL
|
|
||||||
ssl_certificate /etc/letsencrypt/live/matrix.fuz.re/fullchain.pem;
|
|
||||||
ssl_certificate_key /etc/letsencrypt/live/matrix.fuz.re/privkey.pem;
|
|
||||||
ssl_trusted_certificate /etc/letsencrypt/live/matrix.fuz.re/chain.pem;
|
|
||||||
|
|
||||||
# security
|
|
||||||
include snippets/security.conf;
|
|
||||||
|
|
||||||
# logging
|
|
||||||
access_log /var/log/nginx/matrix.fuz.re.access.log;
|
|
||||||
error_log /var/log/nginx/matrix.fuz.re.error.log warn;
|
|
||||||
|
|
||||||
# reverse proxy
|
|
||||||
location / {
|
|
||||||
proxy_pass http://127.0.0.1:8080;
|
|
||||||
include snippets/proxy.conf;
|
|
||||||
}
|
|
||||||
|
|
||||||
# additional config
|
|
||||||
include snippets/general.conf;
|
|
||||||
}
|
|
||||||
|
|
||||||
# HTTP redirect
|
|
||||||
server {
|
|
||||||
listen 80;
|
|
||||||
listen [::]:80;
|
|
||||||
server_name matrix.fuz.re;
|
|
||||||
include snippets/letsencrypt.conf;
|
|
||||||
|
|
||||||
location / {
|
|
||||||
return 301 https://matrix.fuz.re$request_uri;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,18 +0,0 @@
|
|||||||
# favicon.ico
|
|
||||||
location = /favicon.ico {
|
|
||||||
log_not_found off;
|
|
||||||
access_log off;
|
|
||||||
}
|
|
||||||
|
|
||||||
# robots.txt
|
|
||||||
location = /robots.txt {
|
|
||||||
log_not_found off;
|
|
||||||
access_log off;
|
|
||||||
}
|
|
||||||
|
|
||||||
# gzip
|
|
||||||
gzip on;
|
|
||||||
gzip_vary on;
|
|
||||||
gzip_proxied any;
|
|
||||||
gzip_comp_level 6;
|
|
||||||
gzip_types text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;
|
|
||||||
@ -1,4 +0,0 @@
|
|||||||
# ACME-challenge
|
|
||||||
location ^~ /.well-known/acme-challenge/ {
|
|
||||||
root /var/www/_letsencrypt;
|
|
||||||
}
|
|
||||||
@ -1,18 +0,0 @@
|
|||||||
proxy_http_version 1.1;
|
|
||||||
proxy_cache_bypass $http_upgrade;
|
|
||||||
|
|
||||||
# Proxy headers
|
|
||||||
proxy_set_header Upgrade $http_upgrade;
|
|
||||||
proxy_set_header Connection $connection_upgrade;
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header Forwarded $proxy_add_forwarded;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
proxy_set_header X-Forwarded-Host $host;
|
|
||||||
proxy_set_header X-Forwarded-Port $server_port;
|
|
||||||
|
|
||||||
# Proxy timeouts
|
|
||||||
proxy_connect_timeout 60s;
|
|
||||||
proxy_send_timeout 60s;
|
|
||||||
proxy_read_timeout 60s;
|
|
||||||
@ -1,12 +0,0 @@
|
|||||||
# security headers
|
|
||||||
add_header X-XSS-Protection "1; mode=block" always;
|
|
||||||
add_header X-Content-Type-Options "nosniff" always;
|
|
||||||
add_header Referrer-Policy "no-referrer-when-downgrade" always;
|
|
||||||
add_header Content-Security-Policy "default-src 'self' http: https: ws: wss: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always;
|
|
||||||
add_header Permissions-Policy "interest-cohort=()" always;
|
|
||||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
||||||
|
|
||||||
# . files
|
|
||||||
location ~ /\.(?!well-known) {
|
|
||||||
deny all;
|
|
||||||
}
|
|
||||||
17
lighttpd.yml
Normal file
17
lighttpd.yml
Normal file
@ -0,0 +1,17 @@
|
|||||||
|
- hosts: octo.fuz.re
|
||||||
|
become: yes
|
||||||
|
tasks:
|
||||||
|
- name: Lighttpd installé
|
||||||
|
apt:
|
||||||
|
name: lighttpd
|
||||||
|
|
||||||
|
- name: Copie la conf
|
||||||
|
copy:
|
||||||
|
src: files/lighttpd.conf
|
||||||
|
dest: /etc/lighttpd/lighttpd.conf
|
||||||
|
|
||||||
|
- name: On charge lighttpd
|
||||||
|
service:
|
||||||
|
name: lighttpd
|
||||||
|
state: started
|
||||||
|
enabled: yes
|
||||||
2
main.yml
2
main.yml
@ -2,7 +2,7 @@
|
|||||||
- import_playbook: adminsys-classique.yml
|
- import_playbook: adminsys-classique.yml
|
||||||
# Octo
|
# Octo
|
||||||
- import_playbook: matrix.yml
|
- import_playbook: matrix.yml
|
||||||
# - import_playbook: nginx.yml
|
- import_playbook: lighttpd.yml
|
||||||
# - import_playbook: certbot.yml
|
# - import_playbook: certbot.yml
|
||||||
|
|
||||||
# Sonic
|
# Sonic
|
||||||
22
matrix.yml
22
matrix.yml
@ -1,14 +1,28 @@
|
|||||||
- hosts: octo.fuz.re
|
- hosts: octo.fuz.re
|
||||||
|
|
||||||
tasks:
|
tasks:
|
||||||
- name: synapse installé et upgradé
|
- name: synapse installé et upgradé
|
||||||
become: yes
|
become: yes
|
||||||
apt:
|
apt:
|
||||||
name: matrix-synapse
|
name: matrix-synapse
|
||||||
update_cache: yes
|
update_cache: yes
|
||||||
- name: Config Synapse conforme à ce qu'il y a dans ce dépôt Ansible
|
|
||||||
template:
|
# - name: Config Synapse conforme à ce qu'il y a dans ce dépôt Ansible
|
||||||
src: templates/homeserver.yaml.j2
|
# template:
|
||||||
dest: /etc/matrix-synapse/homeserver.yaml
|
# src: templates/homeserver.yaml.j2
|
||||||
|
# dest: /etc/matrix-synapse/homeserver.yaml
|
||||||
|
|
||||||
|
- name: Postgres lancé
|
||||||
|
service:
|
||||||
|
name: postgresql@13-main
|
||||||
|
state: started
|
||||||
|
enabled: yes
|
||||||
|
|
||||||
|
- name: Synapse lancé
|
||||||
|
service:
|
||||||
|
name: matrix-synapse
|
||||||
|
state: started
|
||||||
|
enabled: yes
|
||||||
|
|
||||||
vars:
|
vars:
|
||||||
- matrix_server_name: matrix.fuz.re
|
- matrix_server_name: matrix.fuz.re
|
||||||
|
|||||||
@ -1,10 +0,0 @@
|
|||||||
- hosts: octo.fuz.re
|
|
||||||
tasks:
|
|
||||||
- apt: Nginx installé
|
|
||||||
name: nginx
|
|
||||||
|
|
||||||
- name: On charge Nginx
|
|
||||||
service:
|
|
||||||
name: nginx
|
|
||||||
state: started
|
|
||||||
enabled: enabled
|
|
||||||
File diff suppressed because it is too large
Load Diff
Loading…
Reference in New Issue
Block a user