fuz/ansible
9
0
Fork 0
Code Issues Pull Requests 1 Releases Wiki Activity

lighttpd finalement

Browse Source
This commit is contained in:
Hadrien 2022-06-22 20:30:49 +02:00
parent 55447a465b
commit 5ae989e8da
13 changed files with 126 additions and 3125 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

116
templates/nginx.conf → files/lighttpd.conf
View File

@ -1,32 +1,90 @@
server.modules = (
"mod_access",
"mod_accesslog",
"mod_alias",
"mod_compress",
"mod_redirect",
"mod_setenv",
"mod_rewrite",
"mod_proxy",
"mod_cgi",
"mod_openssl",
)
server.document-root = "/var/www/html"
server.upload-dirs = ( "/var/cache/lighttpd/uploads" )
server.errorlog = "/var/log/lighttpd/error.log"
accesslog.filename = "/var/log/lighttpd/access.log"
server.pid-file = "/var/run/lighttpd.pid"
server.username = "www-data"
server.groupname = "www-data"
server.port = 80
dir-listing.activate = "enable"
dir-listing.encoding = "utf-8"
index-file.names = ( "index.php", "index.html", "index.lighttpd.html" )
url.access-deny = ( "~", ".inc" )
static-file.exclude-extensions = ( ".php", ".pl", ".fcgi" )
compress.cache-dir = "/var/cache/lighttpd/compress/"
compress.filetype = ( "application/javascript", "text/css", "text/html", "text/plain" )
# default listening port for IPv6 falls back to the IPv4 port
include_shell "/usr/share/lighttpd/use-ipv6.pl " + server.port
# not here anymore see next line : include_shell "/usr/share/lighttpd/create-mime.assign.pl"
include_shell "/usr/share/lighttpd/create-mime.conf.pl"
#include_shell "/usr/share/lighttpd/include-conf-enabled.pl"
include "/etc/lighttpd/conf-enabled/*.conf"
### FUZ.RE ###
## TODO: Wiki pas encore hébergé ici ###
# $HTTP["host"] == "wiki.fuz.re" {
# server.document-root = "/var/www/fuz.re/dokuwiki/"
# $HTTP["scheme"] == "http" {
# url.redirect = (".*" => "https://wiki.fuz.re$0")
# }
### Wiki pas encore hébergé ici ###
$HTTP["host"] == "wiki.fuz.re" {
server.document-root = "/var/www/fuz.re/dokuwiki/"
$HTTP["scheme"] == "http" {
url.redirect = (".*" => "https://wiki.fuz.re$0")
}
# FIXME: Redirect www -> https without www
# $HTTP["host"] == "www.fuz.re" {
# $HTTP["scheme"] == "http" {
# url.redirect = (".*" => "https://fuz.re$0")
# }
# }
# Redirect http -> https without www
# FIXME: Redirect www -> https without www
# $HTTP["host"] == "fuz.re" {
# $HTTP["scheme"] == "http" {
# url.redirect = (".*" => "https://fuz.re$0")
# }
# FIXME: HTTPS :
# $HTTP["scheme"] == "https" {
$HTTP["scheme"] == "https" {
$HTTP["url"] =~ "^/" {
server.follow-symlink = "enable"
}
$HTTP["url"] =~ "/(\.|_)ht" {
url.access-deny = ( "" )
}
$HTTP["url"] =~ "^/(bin|data|inc|conf)" {
url.access-deny = ( "" )
}
# $SERVER["socket"] == ":443" {
# ssl.engine = "enable"
# server.document-root = "/var/www/fuz.re/newsite/public"
# ssl.pemfile = "/etc/letsencrypt/live/fuz.re/fullchain.pem"
# ssl.privkey = "/etc/letsencrypt/live/fuz.re/privkey.pem"
# ssl.ca-file = "/etc/letsencrypt/live/wiki.fuz.re/fullchain.pem"
# ssl.pemfile = "/etc/lighttpd/certs/wiki.fuz.re.pem"
# }
}
}
# Redirect www -> https without www
$HTTP["host"] == "www.fuz.re" {
$HTTP["scheme"] == "http" {
url.redirect = (".*" => "https://fuz.re$0")
}
}
# Redirect http -> https without www
$HTTP["host"] == "fuz.re" {
$HTTP["scheme"] == "http" {
url.redirect = (".*" => "https://fuz.re$0")
}
# HTTPS :
$HTTP["scheme"] == "https" {
server.document-root = "/var/www/fuz.re/newsite/public"
$SERVER["socket"] == ":443" {
ssl.engine = "enable"
ssl.pemfile = "/etc/letsencrypt/live/fuz.re/fullchain.pem"
ssl.privkey = "/etc/letsencrypt/live/fuz.re/privkey.pem"
}
}
}
# Old Jack.tf
$HTTP["host"] == "jack.fuz.re" {
@ -184,12 +242,12 @@ $HTTP["host"] == "liste.fuz.re" {
}
## Datapaulette - Pas hébérgé ici non plus
# $HTTP["host"] =~ "www.datapaulette.org" {
# url.redirect = (".*" => "http://datapaulette.org")
# }
# $HTTP["host"] =~ "datapaulette.org" {
# server.error-handler-404 = "/index.php"
# server.document-root = "/var/www/datapaulette.org/dp-wp"
$HTTP["host"] =~ "www.datapaulette.org" {
url.redirect = (".*" => "http://datapaulette.org")
}
$HTTP["host"] =~ "datapaulette.org" {
server.error-handler-404 = "/index.php"
server.document-root = "/var/www/datapaulette.org/dp-wp"
# $SERVER["socket"] == ":443" {
# ssl.engine = "enable"
# ssl.ca-file = "/etc/letsencrypt/live/datapaulette.org/fullchain.pem"

81
files/nginx/nginx.conf
View File

@ -1,81 +0,0 @@
# https://www.digitalocean.com/community/tools/nginx
user www-data;
pid /run/nginx.pid;
worker_processes auto;
worker_rlimit_nofile 65535;
# Load modules
include /etc/nginx/modules-enabled/*.conf;
events {
multi_accept on;
worker_connections 65535;
}
http {
charset utf-8;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
server_tokens off;
log_not_found off;
types_hash_max_size 2048;
types_hash_bucket_size 64;
client_max_body_size 16M;
# MIME
include mime.types;
default_type application/octet-stream;
# Logging
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log warn;
# SSL
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
# Diffie-Hellman parameter for DHE ciphersuites
ssl_dhparam /etc/nginx/dhparam.pem;
# Mozilla Intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
# OCSP Stapling
ssl_stapling on;
ssl_stapling_verify on;
# Connection header for WebSocket reverse proxy
map $http_upgrade $connection_upgrade {
default upgrade;
"" close;
}
map $remote_addr $proxy_forwarded_elem {
# IPv4 addresses can be sent as-is
~^[0-9.]+$ "for=$remote_addr";
# IPv6 addresses need to be bracketed and quoted
~^[0-9A-Fa-f:.]+$ "for=\"[$remote_addr]\"";
# Unix domain socket names cannot be represented in RFC 7239 syntax
default "for=unknown";
}
map $http_forwarded $proxy_add_forwarded {
# If the incoming Forwarded header is syntactically valid, append to it
"~^(,[ \\t]*)*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*([ \\t]*,([ \\t]*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*)?)*$" "$http_forwarded, $proxy_forwarded_elem";
# Otherwise, replace it
default "$proxy_forwarded_elem";
}
# Load configs
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
}

52
files/nginx/sites-enabled/fuz.re.conf
View File

@ -1,52 +0,0 @@
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name fuz.re;
root /var/www/fuz.re/public;
# SSL
ssl_certificate /etc/letsencrypt/live/fuz.re/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/fuz.re/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/fuz.re/chain.pem;
# security
include snippets/security.conf;
# index.html fallback
location / {
try_files $uri $uri/ /index.html;
}
# index.php fallback
location ~ ^/api/ {
try_files $uri $uri/ /index.php?$query_string;
}
# additional config
include snippets/general.conf;
}
# subdomains redirect
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name fuz.re www.fuz.re;
# SSL
ssl_certificate /etc/letsencrypt/live/fuz.re/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/fuz.re/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/fuz.re/chain.pem;
return 301 https://fuz.re$request_uri;
}
# HTTP redirect
server {
listen 80;
listen [::]:80;
server_name fuz.re www.fuz.re;
include snippets/letsencrypt.conf;
location / {
return 301 https://fuz.re$request_uri;
}
}

38
files/nginx/sites-enabled/matrix.fuz.re.conf
View File

@ -1,38 +0,0 @@
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name matrix.fuz.re;
# SSL
ssl_certificate /etc/letsencrypt/live/matrix.fuz.re/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/matrix.fuz.re/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/matrix.fuz.re/chain.pem;
# security
include snippets/security.conf;
# logging
access_log /var/log/nginx/matrix.fuz.re.access.log;
error_log /var/log/nginx/matrix.fuz.re.error.log warn;
# reverse proxy
location / {
proxy_pass http://127.0.0.1:8080;
include snippets/proxy.conf;
}
# additional config
include snippets/general.conf;
}
# HTTP redirect
server {
listen 80;
listen [::]:80;
server_name matrix.fuz.re;
include snippets/letsencrypt.conf;
location / {
return 301 https://matrix.fuz.re$request_uri;
}
}

18
files/nginx/snippets/general.conf
View File

@ -1,18 +0,0 @@
# favicon.ico
location = /favicon.ico {
log_not_found off;
access_log off;
}
# robots.txt
location = /robots.txt {
log_not_found off;
access_log off;
}
# gzip
gzip on;
gzip_vary on;
gzip_proxied any;
gzip_comp_level 6;
gzip_types text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;

4
files/nginx/snippets/letsencrypt.conf
View File

@ -1,4 +0,0 @@
# ACME-challenge
location ^~ /.well-known/acme-challenge/ {
root /var/www/_letsencrypt;
}

18
files/nginx/snippets/proxy.conf
View File

@ -1,18 +0,0 @@
proxy_http_version 1.1;
proxy_cache_bypass $http_upgrade;
# Proxy headers
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Forwarded $proxy_add_forwarded;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;
# Proxy timeouts
proxy_connect_timeout 60s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;

12
files/nginx/snippets/security.conf
View File

@ -1,12 +0,0 @@
# security headers
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;
add_header Content-Security-Policy "default-src 'self' http: https: ws: wss: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always;
add_header Permissions-Policy "interest-cohort=()" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
# . files
location ~ /\.(?!well-known) {
deny all;
}

17
lighttpd.yml Normal file
View File

@ -0,0 +1,17 @@
- hosts: octo.fuz.re
become: yes
tasks:
- name: Lighttpd installé
apt:
name: lighttpd
- name: Copie la conf
copy:
src: files/lighttpd.conf
dest: /etc/lighttpd/lighttpd.conf
- name: On charge lighttpd
service:
name: lighttpd
state: started
enabled: yes

2
main.yml
View File

@ -2,7 +2,7 @@
- import_playbook: adminsys-classique.yml
# Octo
- import_playbook: matrix.yml
# - import_playbook: nginx.yml
- import_playbook: lighttpd.yml
# - import_playbook: certbot.yml
# Sonic

22
matrix.yml
View File

@ -1,14 +1,28 @@
- hosts: octo.fuz.re
tasks:
- name: synapse installé et upgradé
become: yes
apt:
name: matrix-synapse
update_cache: yes
- name: Config Synapse conforme à ce qu'il y a dans ce dépôt Ansible
template:
src: templates/homeserver.yaml.j2
dest: /etc/matrix-synapse/homeserver.yaml
# - name: Config Synapse conforme à ce qu'il y a dans ce dépôt Ansible
# template:
# src: templates/homeserver.yaml.j2
# dest: /etc/matrix-synapse/homeserver.yaml
- name: Postgres lancé
service:
name: postgresql@13-main
state: started
enabled: yes
- name: Synapse lancé
service:
name: matrix-synapse
state: started
enabled: yes
vars:
- matrix_server_name: matrix.fuz.re

10
site-statique.yml
View File

@ -1,10 +0,0 @@
- hosts: octo.fuz.re
tasks:
- apt: Nginx installé
name: nginx
- name: On charge Nginx
service:
name: nginx
state: started
enabled: enabled

2855
templates/homeserver.yaml.example
View File

File diff suppressed because it is too large Load Diff