nginx templates

README.md

@@ -3,7 +3,7 @@
 Playbooks pour installation via Ansible de services pour le Fuz.
 
 ## Deployment
-1. Edit the file `hosts.ini` and the variables in `matrix.yml`.
+1. Récupérer l'inventaire `hosts.ini` auprès d'un humain ou autre
 2. Install ansible: 
     ```bash
     sudo apt update
@@ -12,4 +12,4 @@ Playbooks pour installation via Ansible de services pour le Fuz.
     sudo apt install ansible
     ```
 <!-- 3. Install the roles: `ansible-galaxy install -r requirements.yml` -->
-3. Launch the playbook: `ansible-playbook setup.yml`
+1. Launch the playbook: `ansible-playbook main.yml -K --check`

adminsys-classique.yml

@@ -0,0 +1,17 @@
+---
+- hosts: all
+  become: yes
+  pre_tasks:
+    - apt:
+        update_cache: yes
+  # roles:
+  # - geerlingguy.pip
+  tasks:
+    - apt:
+        upgrade: yes
+    - apt:
+        name:
+        - python3-pip
+        - tmux
+        - bash-completion
+        # - zsh

files/nginx/nginx.conf

@@ -0,0 +1,81 @@
+# https://www.digitalocean.com/community/tools/nginx
+
+user                 www-data;
+pid                  /run/nginx.pid;
+worker_processes     auto;
+worker_rlimit_nofile 65535;
+
+# Load modules
+include              /etc/nginx/modules-enabled/*.conf;
+
+events {
+    multi_accept       on;
+    worker_connections 65535;
+}
+
+http {
+    charset                utf-8;
+    sendfile               on;
+    tcp_nopush             on;
+    tcp_nodelay            on;
+    server_tokens          off;
+    log_not_found          off;
+    types_hash_max_size    2048;
+    types_hash_bucket_size 64;
+    client_max_body_size   16M;
+
+    # MIME
+    include                mime.types;
+    default_type           application/octet-stream;
+
+    # Logging
+    access_log             /var/log/nginx/access.log;
+    error_log              /var/log/nginx/error.log warn;
+
+    # SSL
+    ssl_session_timeout    1d;
+    ssl_session_cache      shared:SSL:10m;
+    ssl_session_tickets    off;
+
+    # Diffie-Hellman parameter for DHE ciphersuites
+    ssl_dhparam            /etc/nginx/dhparam.pem;
+
+    # Mozilla Intermediate configuration
+    ssl_protocols          TLSv1.2 TLSv1.3;
+    ssl_ciphers            ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+
+    # OCSP Stapling
+    ssl_stapling           on;
+    ssl_stapling_verify    on;
+
+    # Connection header for WebSocket reverse proxy
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        ""      close;
+    }
+
+    map $remote_addr $proxy_forwarded_elem {
+
+        # IPv4 addresses can be sent as-is
+        ~^[0-9.]+$        "for=$remote_addr";
+
+        # IPv6 addresses need to be bracketed and quoted
+        ~^[0-9A-Fa-f:.]+$ "for=\"[$remote_addr]\"";
+
+        # Unix domain socket names cannot be represented in RFC 7239 syntax
+        default           "for=unknown";
+    }
+
+    map $http_forwarded $proxy_add_forwarded {
+
+        # If the incoming Forwarded header is syntactically valid, append to it
+        "~^(,[ \\t]*)*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*([ \\t]*,([ \\t]*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*)?)*$" "$http_forwarded, $proxy_forwarded_elem";
+
+        # Otherwise, replace it
+        default "$proxy_forwarded_elem";
+    }
+
+    # Load configs
+    include /etc/nginx/conf.d/*.conf;
+    include /etc/nginx/sites-enabled/*;
+}

files/nginx/sites-enabled/fuz.re.conf

@@ -0,0 +1,52 @@
+server {
+    listen                  443 ssl http2;
+    listen                  [::]:443 ssl http2;
+    server_name             fuz.re;
+    root                    /var/www/fuz.re/public;
+
+    # SSL
+    ssl_certificate         /etc/letsencrypt/live/fuz.re/fullchain.pem;
+    ssl_certificate_key     /etc/letsencrypt/live/fuz.re/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/fuz.re/chain.pem;
+
+    # security
+    include                 snippets/security.conf;
+
+    # index.html fallback
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    # index.php fallback
+    location ~ ^/api/ {
+        try_files $uri $uri/ /index.php?$query_string;
+    }
+
+    # additional config
+    include snippets/general.conf;
+}
+
+# subdomains redirect
+server {
+    listen                  443 ssl http2;
+    listen                  [::]:443 ssl http2;
+    server_name             *.fuz.re;
+
+    # SSL
+    ssl_certificate         /etc/letsencrypt/live/fuz.re/fullchain.pem;
+    ssl_certificate_key     /etc/letsencrypt/live/fuz.re/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/fuz.re/chain.pem;
+    return                  301 https://fuz.re$request_uri;
+}
+
+# HTTP redirect
+server {
+    listen      80;
+    listen      [::]:80;
+    server_name .fuz.re;
+    include     snippets/letsencrypt.conf;
+
+    location / {
+        return 301 https://fuz.re$request_uri;
+    }
+}

files/nginx/sites-enabled/matrix.fuz.re.conf

@@ -0,0 +1,38 @@
+server {
+    listen                  443 ssl http2;
+    listen                  [::]:443 ssl http2;
+    server_name             matrix.fuz.re;
+
+    # SSL
+    ssl_certificate         /etc/letsencrypt/live/matrix.fuz.re/fullchain.pem;
+    ssl_certificate_key     /etc/letsencrypt/live/matrix.fuz.re/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/matrix.fuz.re/chain.pem;
+
+    # security
+    include                 snippets/security.conf;
+
+    # logging
+    access_log              /var/log/nginx/matrix.fuz.re.access.log;
+    error_log               /var/log/nginx/matrix.fuz.re.error.log warn;
+
+    # reverse proxy
+    location / {
+        proxy_pass http://127.0.0.1:8080;
+        include    snippets/proxy.conf;
+    }
+
+    # additional config
+    include snippets/general.conf;
+}
+
+# HTTP redirect
+server {
+    listen      80;
+    listen      [::]:80;
+    server_name matrix.fuz.re;
+    include     snippets/letsencrypt.conf;
+
+    location / {
+        return 301 https://matrix.fuz.re$request_uri;
+    }
+}

files/nginx/snippets/general.conf

@@ -0,0 +1,18 @@
+# favicon.ico
+location = /favicon.ico {
+    log_not_found off;
+    access_log    off;
+}
+
+# robots.txt
+location = /robots.txt {
+    log_not_found off;
+    access_log    off;
+}
+
+# gzip
+gzip            on;
+gzip_vary       on;
+gzip_proxied    any;
+gzip_comp_level 6;
+gzip_types      text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;

files/nginx/snippets/letsencrypt.conf

@@ -0,0 +1,4 @@
+# ACME-challenge
+location ^~ /.well-known/acme-challenge/ {
+    root /var/www/_letsencrypt;
+}

files/nginx/snippets/proxy.conf

@@ -0,0 +1,18 @@
+proxy_http_version                 1.1;
+proxy_cache_bypass                 $http_upgrade;
+
+# Proxy headers
+proxy_set_header Upgrade           $http_upgrade;
+proxy_set_header Connection        $connection_upgrade;
+proxy_set_header Host              $host;
+proxy_set_header X-Real-IP         $remote_addr;
+proxy_set_header Forwarded         $proxy_add_forwarded;
+proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_set_header X-Forwarded-Host  $host;
+proxy_set_header X-Forwarded-Port  $server_port;
+
+# Proxy timeouts
+proxy_connect_timeout              60s;
+proxy_send_timeout                 60s;
+proxy_read_timeout                 60s;

files/nginx/snippets/security.conf

@@ -0,0 +1,12 @@
+# security headers
+add_header X-XSS-Protection          "1; mode=block" always;
+add_header X-Content-Type-Options    "nosniff" always;
+add_header Referrer-Policy           "no-referrer-when-downgrade" always;
+add_header Content-Security-Policy   "default-src 'self' http: https: ws: wss: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always;
+add_header Permissions-Policy        "interest-cohort=()" always;
+add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
+# . files
+location ~ /\.(?!well-known) {
+    deny all;
+}

main.yml

@@ -1,17 +1,8 @@
----
+# Tous
-- hosts:
+- import_playbook: adminsys-classique.yml
-  - sonic-preprod
+# Octo
-  handlers:
+- import_playbook: matrix.yml
-    - name: reboot
+# - import_playbook: nginx.yml
-      reboot:
+# - import_playbook: certbot.yml
 
-  pre_tasks:
+# Sonic
-    - apt:
-        update_cache: yes
-    # - apt:
-    #     name: python-pip
-  # roles:
-  # - geerlingguy.pip
-
-# - import_playbook: nginx-certbot.yml
-- import_playbook: matrix.yml

matrix-telegram-bridge.yml

@@ -1,11 +0,0 @@
-# https://github.com/tulir/mautrix-telegram/wiki/Bridge-setup-with-Docker
-
-# version: "3.7"
-
-# services:
-#   mautrix-telegram:
-#     container_name: mautrix-telegram
-#     image: dock.mau.dev/tulir/mautrix-telegram:<version>
-#     restart: unless-stopped
-#     volumes:
-#     - .:/data

matrix.yml

@@ -1,41 +1,28 @@
----
+- hosts: octo.fuz.re
-- hosts: synapse
-# todo: create user for synapse
-  vars:
-    matrix_synapse_version: "v1.5.1-py3"
-    # matrix_synapse_version: "v1.5.1"
-    matrix_server_name: matrix-sonic-beta.local
-    matrix_bind_address: "192.168.42.4"
-
-    matrix_synapse_pg_host: synapse-postgres # does it need to be an IP?
-    matrix_synapse_db_name: psycopg2
-    matrix_synapse_pg_user: "synapse"
-    matrix_synapse_pg_pass: "pomme"
-    matrix_synapse_pg_db: "synapse"
-    matrix_registration_shared_secret: "xxxxx"
-    matrix_synapse_report_stats: false
-    matrix_synapse_config_path: "/etc/matrix-synapse/homeserver.yaml"
-    
-    # to implement
-    #   matrix_no_tls: true
-
   tasks:
-    # - docker_volume:
+  - name: synapse installé et upgradé
-    #     name: synapse-data
+    become: yes
-
+    apt:
-    - template:
+      name: matrix-synapse
-        src: templates/synapse_homeserver.yaml.j2
+      update_cache: yes
-        dest: {{ matrix_synapse_config_path }}
+  - template:
-
+      src: templates/homeserver.yaml.j2
-    - template:
+      dest: /etc/matrix-synapse/homeserver.yaml
-        src: templates/docker-compose-matrix.yml.j2
+  vars:
-        dest: /etc/docker/docker-compose.yml
+  - matrix_server_name: matrix.fuz.re
-
+  - synapse_postgres_password: !vault |
-    - name: Create and start matrix services
+                $ANSIBLE_VAULT;1.1;AES256
-      docker_compose:
+                65636365623364333261383933393663356536646562653539343765663631613333323231613564
-        project_src: matrix
+                3836333964313235373865376235373934323861396339330a353637633333386434306533363166
-      register: output
+                36373238633939303261666263303562653233313339326638393032343531613435326436393739
-
+                6535346265653732380a363738333836366334633264303130336435323637303037373563306266
-
+                3235      
-      # uploads_path: "/var/lib/matrix-synapse/uploads"
+  - synapse_turn_password:
-# media_store_path: "/var/lib/matrix-synapse/media"
+          !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          32616461613066343434373265376663653230393837313264636130623963383636333739333561
+          6434613031303161656531303639633437613132336131660a333466356165616434646366333765
+          31653164633930326434643339616231616235613062663733326339653830306566313735306339
+          3831646665393963390a636332353233396462663831623966373437306531663331333233363361
+          31383766356137636661306134326236656666623432656163616132663530343566
+          

site-statique.yml

@@ -0,0 +1 @@
+# lighttpd ou nginx ?

sonic/.gitignore

@@ -0,0 +1 @@
+homeserver.yaml

sonic/lighttpd.conf

@@ -0,0 +1,272 @@
+server.modules = (
+    "mod_access",
+    "mod_accesslog",
+    "mod_alias",
+    "mod_compress",
+    "mod_redirect",
+    "mod_setenv",
+    "mod_rewrite",
+    "mod_proxy",
+    "mod_cgi",
+    "mod_openssl",
+)
+
+server.document-root        = "/var/www/html"
+server.upload-dirs          = ( "/var/cache/lighttpd/uploads" )
+server.errorlog             = "/var/log/lighttpd/error.log"
+accesslog.filename          = "/var/log/lighttpd/access.log"
+server.pid-file             = "/var/run/lighttpd.pid"
+server.username             = "www-data"
+server.groupname            = "www-data"
+server.port                 = 80
+
+dir-listing.activate = "enable"
+dir-listing.encoding = "utf-8"
+
+index-file.names            = ( "index.php", "index.html", "index.lighttpd.html" )
+url.access-deny             = ( "~", ".inc" )
+static-file.exclude-extensions = ( ".php", ".pl", ".fcgi" )
+
+compress.cache-dir          = "/var/cache/lighttpd/compress/"
+compress.filetype           = ( "application/javascript", "text/css", "text/html", "text/plain" )
+
+# default listening port for IPv6 falls back to the IPv4 port
+include_shell "/usr/share/lighttpd/use-ipv6.pl " + server.port
+# not here anymore see next line : include_shell "/usr/share/lighttpd/create-mime.assign.pl"
+include_shell "/usr/share/lighttpd/create-mime.conf.pl"
+#include_shell "/usr/share/lighttpd/include-conf-enabled.pl"
+include "/etc/lighttpd/conf-enabled/*.conf"
+
+### FUZ.RE ###
+### Wiki pas encore hébergé ici ###
+$HTTP["host"] == "wiki.fuz.re" {
+    server.document-root = "/var/www/fuz.re/dokuwiki/"
+    $HTTP["scheme"] == "http" {
+        url.redirect = (".*" => "https://wiki.fuz.re$0")
+    }
+
+    $HTTP["scheme"] == "https" {
+        $HTTP["url"] =~ "^/" {
+          server.follow-symlink = "enable"
+        }
+
+        $HTTP["url"] =~ "/(\.|_)ht" {
+          url.access-deny = ( "" )
+        }
+        $HTTP["url"] =~ "^/(bin|data|inc|conf)" {
+          url.access-deny = ( "" )
+        }
+#        $SERVER["socket"] == ":443" {
+#                ssl.engine  = "enable"
+        #       ssl.ca-file = "/etc/letsencrypt/live/wiki.fuz.re/fullchain.pem"
+#                ssl.pemfile = "/etc/lighttpd/certs/wiki.fuz.re.pem"
+#        }
+    }
+}
+
+# Redirect www -> https without www
+$HTTP["host"] == "www.fuz.re" {
+    $HTTP["scheme"] == "http" {
+        url.redirect = (".*" => "https://fuz.re$0")
+    }
+}
+# Redirect http -> https without www
+$HTTP["host"] == "fuz.re" {
+    $HTTP["scheme"] == "http" {
+        url.redirect = (".*" => "https://fuz.re$0")
+    }
+    # HTTPS :
+    $HTTP["scheme"] == "https" {
+	server.document-root = "/var/www/fuz.re/newsite/public"
+        $SERVER["socket"] == ":443" {
+			ssl.engine  = "enable"
+			ssl.pemfile = "/etc/letsencrypt/live/fuz.re/fullchain.pem"
+			ssl.privkey = "/etc/letsencrypt/live/fuz.re/privkey.pem"
+		}
+    }
+}
+
+# Old Jack.tf
+$HTTP["host"] == "jack.fuz.re" {
+    server.document-root = "/var/www/fuz.re/jack/site"
+    $HTTP["scheme"] == "http" {
+         $HTTP["url"] !~ "^/.well-known/acme-challenge/" {
+         url.redirect = (".*" => "https://jack.fuz.re$0")
+         }
+    }
+    $HTTP["scheme"] == "https" {
+	$SERVER["socket"] == ":443" {
+             ssl.engine  = "enable"
+		ssl.pemfile = "/etc/letsencrypt/live/jack.fuz.re/fullchain.pem"
+		ssl.privkey = "/etc/letsencrypt/live/jack.fuz.re/privkey.pem"
+        }
+    }
+}
+
+
+$HTTP["host"] == "riot.fuz.re" {
+    server.document-root = "/var/www/fuz.re/riot/site"
+    $HTTP["scheme"] == "http" {
+		$HTTP["url"] !~ "^/.well-known/acme-challenge/" {
+	            url.redirect = (".*" => "https://riot.fuz.re$0")
+		}
+    }
+    $HTTP["scheme"] == "https" {
+        alias.url = (
+                "/rc" => "/var/www/fuz.re/riot/rc"
+        )
+
+	$SERVER["socket"] == ":443" {
+                ssl.engine  = "enable"
+		ssl.pemfile = "/etc/letsencrypt/live/riot.fuz.re/fullchain.pem"
+		ssl.privkey = "/etc/letsencrypt/live/riot.fuz.re/privkey.pem"
+        }
+    }
+}
+
+$HTTP["host"] == "matrix.fuz.re" {
+    server.document-root = "/var/www/fuz.re/matrix/site"
+    $HTTP["scheme"] == "http" {
+		$HTTP["url"] !~ "^/.well-known/acme-challenge/" {
+			url.redirect = (".*" => "https://matrix.fuz.re$0")
+		}
+    }
+    $SERVER["socket"] == ":443" {
+    	ssl.engine  = "enable"
+	ssl.pemfile = "/etc/letsencrypt/live/matrix.fuz.re/fullchain.pem"
+	ssl.privkey = "/etc/letsencrypt/live/matrix.fuz.re/privkey.pem"
+    	proxy.server = ( "" => (( "host" => "127.0.0.1", "port" => 8008 )))
+    	proxy.header = ( "map-host-request" => ( "-" => "matrix.fuz.re"),
+    			     "map-host-response" => ("-" => "-"))
+    }
+    $SERVER["socket"] == ":8448" {
+    	ssl.engine  = "enable"
+	ssl.pemfile = "/etc/letsencrypt/live/matrix.fuz.re/fullchain.pem"
+	ssl.privkey = "/etc/letsencrypt/live/matrix.fuz.re/privkey.pem"
+    	proxy.server = ( "" => (( "host" => "127.0.0.1", "port" => 8008 )))
+    	proxy.header = ( "map-host-request" => ( "-" => "matrix.fuz.re"),
+    			     "map-host-response" => ("-" => "-"))
+    }
+}
+
+$HTTP["host"] == "mumble.fuz.re" {
+    $HTTP["scheme"] == "http" {
+    	server.document-root = "/var/www/fuz.re/mumble/site"
+	$HTTP["url"] !~ "^/.well-known/acme-challenge/" {
+		url.redirect = (".*" => "https://mumble.fuz.re$0")
+	}
+    }
+
+    $SERVER["socket"] == ":443" {
+    	ssl.engine  = "enable"
+	ssl.pemfile = "/etc/letsencrypt/live/mumble.fuz.re/fullchain.pem"
+	ssl.privkey = "/etc/letsencrypt/live/mumble.fuz.re/privkey.pem"
+    	url.redirect-code = 302 # it's a workaround for retarded lighttpd unable to handle websockets, hence a temp 302 redirection -- Lomanic 20200606
+    	url.redirect = (".*" => "https://mumble.fuz.re:64737$0")
+    }
+}
+
+
+
+$HTTP["host"] == "presence.fuz.re" { # added by Lomanic 20200606
+    $HTTP["scheme"] == "http" {
+    	server.document-root = "/var/www/fuz.re/presence/site"
+		$HTTP["url"] !~ "^/.well-known/acme-challenge/" {
+			url.redirect = (".*" => "https://${url.authority}${url.path}${qsa}")
+		}
+    }
+
+	$SERVER["socket"] == ":443" {
+		ssl.engine  = "enable"
+		proxy.server = ( "" => (("host" => "127.0.0.1", "port" => 3000)) )
+		#ssl.ca-file = "/etc/letsencrypt/live/presence.fuz.re/chain.pem"
+		#ssl.pemfile = "/etc/lighttpd/certs/presence.fuz.re.pem"
+
+		ssl.pemfile = "/etc/letsencrypt/live/presence.fuz.re/fullchain.pem"
+		ssl.privkey = "/etc/letsencrypt/live/presence.fuz.re/privkey.pem"
+	}
+}
+$HTTP["host"] == "spaceapi.fuz.re" { # added by Lomanic 20201017
+	$HTTP["scheme"] == "http" {
+		server.document-root = "/var/www/fuz.re/spaceapi/site"
+		$HTTP["url"] !~ "^/.well-known/acme-challenge/" {
+			url.redirect = (".*" => "https://${url.authority}${url.path}${qsa}")
+		}
+	}
+
+	$SERVER["socket"] == ":443" {
+		ssl.engine  = "enable"
+		proxy.server = ( "" => (("host" => "127.0.0.1", "port" => 3001)) )
+		ssl.pemfile = "/etc/letsencrypt/live/spaceapi.fuz.re/fullchain.pem"
+		ssl.privkey = "/etc/letsencrypt/live/spaceapi.fuz.re/privkey.pem"
+	}
+}
+
+$HTTP["host"] == "sonic.fuz.re" {
+	server.document-root = "/var/www/sonic.fuz.re/"
+}
+
+### Mailman ###
+$HTTP["host"] == "liste.fuz.re" {
+	server.document-root = "/var/www/fuz.re/liste/site"
+	$HTTP["scheme"] == "http" {
+		$HTTP["url"] !~ "^/.well-known/acme-challenge/" {
+			url.redirect = (".*" => "https://liste.fuz.re$0")
+		}
+	}
+	$SERVER["socket"] == ":443" {
+		ssl.engine  = "enable"
+		#ssl.ca-file = "/etc/letsencrypt/live/liste.fuz.re/chain.pem"
+		#ssl.pemfile = "/etc/letsencrypt/live/liste.fuz.re/combined.pem"
+		ssl.pemfile = "/etc/letsencrypt/live/liste.fuz.re/fullchain.pem"
+		ssl.privkey = "/etc/letsencrypt/live/liste.fuz.re/privkey.pem"
+	}
+	alias.url = (
+        "/mailman/" => "/usr/lib/cgi-bin/mailman/",
+        "/cgi-bin/mailman/" => "/usr/lib/cgi-bin/mailman/",
+        "/images/mailman/" => "/usr/share/images/mailman/",
+        #"/pipermail/" => "/var/lib/mailman/archives/public/"
+    )
+    cgi.assign = (
+        "/admin" => "",
+        "/admindb" => "",
+        "/confirm" => "",
+        "/create" => "",
+        "/edithtml" => "",
+        "/listinfo" => "",
+        "/options" => "",
+        "/private" => "",
+        "/rmlist" => "",
+        "/roster" => "",
+        "/subscribe" => "")
+}
+
+## Datapaulette - Pas hébérgé ici non plus
+$HTTP["host"] =~ "www.datapaulette.org" {
+	url.redirect = (".*" => "http://datapaulette.org")
+}
+$HTTP["host"] =~ "datapaulette.org" {
+        server.error-handler-404 = "/index.php"
+        server.document-root = "/var/www/datapaulette.org/dp-wp"
+#        $SERVER["socket"] == ":443" {
+#                ssl.engine  = "enable"
+#                ssl.ca-file = "/etc/letsencrypt/live/datapaulette.org/fullchain.pem"
+#                ssl.pemfile = "/etc/lighttpd/certs/datapaulette.org.pem"
+#        }
+        #url.rewrite = (
+        #       "^/(.*)\.(.+)$" => "$0",
+        #       ###"^/(wp-admin|wp-includes|wp-content|gallery2)/(.*)" => "$0",
+        #       "^/(.+)/?$" => "/index.php/$1"
+        #)
+}
+
+### WOOTDEVICES.IO  - https à activer après copie des certs
+$HTTP["host"] == "wootdevices.io" {
+        server.document-root = "/var/www/wootdevices.io/site/"
+#        $SERVER["socket"] == ":443" {
+#                ssl.engine  = "enable"
+#                ssl.ca-file = "/etc/letsencrypt/live/wootdevices.io/fullchain.pem"
+#                ssl.pemfile = "/etc/lighttpd/certs/wootdevices.io.pem"
+#        }
+}
+

templates/docker-compose-matrix.yml.j2

@@ -1,48 +0,0 @@
-version: '3'
-
-services:
-# matrix_synapse_version: "v1.5.1-py3"
-    # matrix_synapse_version: "v1.5.1"
-
-
-  #matrix_synapse_pg_host: synapse-postgres
-
-  synapse:
-    # build:
-    #    context: ../..
-     #   dockerfile: docker/Dockerfile
-    image: "matrixdotorg/synapse:{{ matrix_synapse_version }}"
-    # Since synapse does not retry to connect to the database, restart upon
-    # failure
-    restart: unless-stopped
-    # See the readme for a full documentation of the environment settings
-    environment:
-      - SYNAPSE_REPORT_STATS={{ matrix_synapse_report_stats }}
-      - SYNAPSE_CONFIG_PATH={{ matrix_synapse_config_docker_path }}
-    volumes:
-      # You may either store all the files in a local folder
-      - {{ matrix_synapse_config_dir }}:{{ matrix_synapse_config_docker_dir }}
-      - ./files:/data
-      # .. or you may split this between different storage points
-      # - ./files:/data
-      # - /path/to/ssd:/data/uploads
-      # - /path/to/large_hdd:/data/media
-    depends_on:
-      - db
-    # In order to expose Synapse, remove one of the following, you might for
-    # instance expose the TLS port directly:
-    ports:
-      - 8008:8008/tcp
-    # labels:
- 
-  db:
-    image: docker.io/postgres:10-alpine
-    # Change that password, of course!
-    environment:
-      - POSTGRES_USER={{ matrix_synapse_db_name }}
-      - POSTGRES_PASSWORD={{ matrix_synapse_pg_pass }}
-    volumes:
-      # You may store the database tables in a local folder..
-      - ./schemas:/var/lib/postgresql/data
-      # .. or store them on some high performance storage for better results
-      # - /path/to/ssd/storage:/var/lib/postgresql/data

templates/nginx.conf

@@ -0,0 +1,214 @@
+
+### FUZ.RE ###
+## TODO: Wiki pas encore hébergé ici ###
+# $HTTP["host"] == "wiki.fuz.re" {
+#     server.document-root = "/var/www/fuz.re/dokuwiki/"
+#     $HTTP["scheme"] == "http" {
+#         url.redirect = (".*" => "https://wiki.fuz.re$0")
+    # }
+
+# FIXME: Redirect www -> https without www
+# $HTTP["host"] == "www.fuz.re" {
+#     $HTTP["scheme"] == "http" {
+#         url.redirect = (".*" => "https://fuz.re$0")
+#     }
+# }
+# Redirect http -> https without www
+# FIXME: Redirect www -> https without www
+# $HTTP["host"] == "fuz.re" {
+#     $HTTP["scheme"] == "http" {
+#         url.redirect = (".*" => "https://fuz.re$0")
+#     }
+# FIXME: HTTPS :
+    # $HTTP["scheme"] == "https" {
+    #     $SERVER["socket"] == ":443" {
+	# 		ssl.engine  = "enable"
+	# server.document-root = "/var/www/fuz.re/newsite/public"
+	# 		ssl.pemfile = "/etc/letsencrypt/live/fuz.re/fullchain.pem"
+	# 		ssl.privkey = "/etc/letsencrypt/live/fuz.re/privkey.pem"
+	# 	}
+    
+# Old Jack.tf
+$HTTP["host"] == "jack.fuz.re" {
+    server.document-root = "/var/www/fuz.re/jack/site"
+    $HTTP["scheme"] == "http" {
+         $HTTP["url"] !~ "^/.well-known/acme-challenge/" {
+         url.redirect = (".*" => "https://jack.fuz.re$0")
+         }
+    }
+    $HTTP["scheme"] == "https" {
+	$SERVER["socket"] == ":443" {
+             ssl.engine  = "enable"
+		ssl.pemfile = "/etc/letsencrypt/live/jack.fuz.re/fullchain.pem"
+		ssl.privkey = "/etc/letsencrypt/live/jack.fuz.re/privkey.pem"
+        }
+    }
+}
+
+
+$HTTP["host"] == "riot.fuz.re" {
+    server.document-root = "/var/www/fuz.re/riot/site"
+    $HTTP["scheme"] == "http" {
+		$HTTP["url"] !~ "^/.well-known/acme-challenge/" {
+	            url.redirect = (".*" => "https://riot.fuz.re$0")
+		}
+    }
+    $HTTP["scheme"] == "https" {
+        alias.url = (
+                "/rc" => "/var/www/fuz.re/riot/rc"
+        )
+
+	$SERVER["socket"] == ":443" {
+                ssl.engine  = "enable"
+		ssl.pemfile = "/etc/letsencrypt/live/riot.fuz.re/fullchain.pem"
+		ssl.privkey = "/etc/letsencrypt/live/riot.fuz.re/privkey.pem"
+        }
+    }
+}
+
+$HTTP["host"] == "matrix.fuz.re" {
+    server.document-root = "/var/www/fuz.re/matrix/site"
+    $HTTP["scheme"] == "http" {
+		$HTTP["url"] !~ "^/.well-known/acme-challenge/" {
+			url.redirect = (".*" => "https://matrix.fuz.re$0")
+		}
+    }
+    $SERVER["socket"] == ":443" {
+    	ssl.engine  = "enable"
+	ssl.pemfile = "/etc/letsencrypt/live/matrix.fuz.re/fullchain.pem"
+	ssl.privkey = "/etc/letsencrypt/live/matrix.fuz.re/privkey.pem"
+    	proxy.server = ( "" => (( "host" => "127.0.0.1", "port" => 8008 )))
+    	proxy.header = ( "map-host-request" => ( "-" => "matrix.fuz.re"),
+    			     "map-host-response" => ("-" => "-"))
+    }
+    $SERVER["socket"] == ":8448" {
+    	ssl.engine  = "enable"
+	ssl.pemfile = "/etc/letsencrypt/live/matrix.fuz.re/fullchain.pem"
+	ssl.privkey = "/etc/letsencrypt/live/matrix.fuz.re/privkey.pem"
+    	proxy.server = ( "" => (( "host" => "127.0.0.1", "port" => 8008 )))
+    	proxy.header = ( "map-host-request" => ( "-" => "matrix.fuz.re"),
+    			     "map-host-response" => ("-" => "-"))
+    }
+}
+
+$HTTP["host"] == "mumble.fuz.re" {
+    $HTTP["scheme"] == "http" {
+    	server.document-root = "/var/www/fuz.re/mumble/site"
+	$HTTP["url"] !~ "^/.well-known/acme-challenge/" {
+		url.redirect = (".*" => "https://mumble.fuz.re$0")
+	}
+    }
+
+    $SERVER["socket"] == ":443" {
+    	ssl.engine  = "enable"
+	ssl.pemfile = "/etc/letsencrypt/live/mumble.fuz.re/fullchain.pem"
+	ssl.privkey = "/etc/letsencrypt/live/mumble.fuz.re/privkey.pem"
+    	url.redirect-code = 302 # it's a workaround for retarded lighttpd unable to handle websockets, hence a temp 302 redirection -- Lomanic 20200606
+    	url.redirect = (".*" => "https://mumble.fuz.re:64737$0")
+    }
+}
+
+
+
+$HTTP["host"] == "presence.fuz.re" { # added by Lomanic 20200606
+    $HTTP["scheme"] == "http" {
+    	server.document-root = "/var/www/fuz.re/presence/site"
+		$HTTP["url"] !~ "^/.well-known/acme-challenge/" {
+			url.redirect = (".*" => "https://${url.authority}${url.path}${qsa}")
+		}
+    }
+
+	$SERVER["socket"] == ":443" {
+		ssl.engine  = "enable"
+		proxy.server = ( "" => (("host" => "127.0.0.1", "port" => 3000)) )
+		#ssl.ca-file = "/etc/letsencrypt/live/presence.fuz.re/chain.pem"
+		#ssl.pemfile = "/etc/lighttpd/certs/presence.fuz.re.pem"
+
+		ssl.pemfile = "/etc/letsencrypt/live/presence.fuz.re/fullchain.pem"
+		ssl.privkey = "/etc/letsencrypt/live/presence.fuz.re/privkey.pem"
+	}
+}
+$HTTP["host"] == "spaceapi.fuz.re" { # added by Lomanic 20201017
+	$HTTP["scheme"] == "http" {
+		server.document-root = "/var/www/fuz.re/spaceapi/site"
+		$HTTP["url"] !~ "^/.well-known/acme-challenge/" {
+			url.redirect = (".*" => "https://${url.authority}${url.path}${qsa}")
+		}
+	}
+
+	$SERVER["socket"] == ":443" {
+		ssl.engine  = "enable"
+		proxy.server = ( "" => (("host" => "127.0.0.1", "port" => 3001)) )
+		ssl.pemfile = "/etc/letsencrypt/live/spaceapi.fuz.re/fullchain.pem"
+		ssl.privkey = "/etc/letsencrypt/live/spaceapi.fuz.re/privkey.pem"
+	}
+}
+
+$HTTP["host"] == "sonic.fuz.re" {
+	server.document-root = "/var/www/sonic.fuz.re/"
+}
+
+### Mailman ###
+$HTTP["host"] == "liste.fuz.re" {
+	server.document-root = "/var/www/fuz.re/liste/site"
+	$HTTP["scheme"] == "http" {
+		$HTTP["url"] !~ "^/.well-known/acme-challenge/" {
+			url.redirect = (".*" => "https://liste.fuz.re$0")
+		}
+	}
+	$SERVER["socket"] == ":443" {
+		ssl.engine  = "enable"
+		#ssl.ca-file = "/etc/letsencrypt/live/liste.fuz.re/chain.pem"
+		#ssl.pemfile = "/etc/letsencrypt/live/liste.fuz.re/combined.pem"
+		ssl.pemfile = "/etc/letsencrypt/live/liste.fuz.re/fullchain.pem"
+		ssl.privkey = "/etc/letsencrypt/live/liste.fuz.re/privkey.pem"
+	}
+	alias.url = (
+        "/mailman/" => "/usr/lib/cgi-bin/mailman/",
+        "/cgi-bin/mailman/" => "/usr/lib/cgi-bin/mailman/",
+        "/images/mailman/" => "/usr/share/images/mailman/",
+        #"/pipermail/" => "/var/lib/mailman/archives/public/"
+    )
+    cgi.assign = (
+        "/admin" => "",
+        "/admindb" => "",
+        "/confirm" => "",
+        "/create" => "",
+        "/edithtml" => "",
+        "/listinfo" => "",
+        "/options" => "",
+        "/private" => "",
+        "/rmlist" => "",
+        "/roster" => "",
+        "/subscribe" => "")
+}
+
+## Datapaulette - Pas hébérgé ici non plus
+# $HTTP["host"] =~ "www.datapaulette.org" {
+# 	url.redirect = (".*" => "http://datapaulette.org")
+# }
+# $HTTP["host"] =~ "datapaulette.org" {
+#         server.error-handler-404 = "/index.php"
+#         server.document-root = "/var/www/datapaulette.org/dp-wp"
+#        $SERVER["socket"] == ":443" {
+#                ssl.engine  = "enable"
+#                ssl.ca-file = "/etc/letsencrypt/live/datapaulette.org/fullchain.pem"
+#                ssl.pemfile = "/etc/lighttpd/certs/datapaulette.org.pem"
+#        }
+        #url.rewrite = (
+        #       "^/(.*)\.(.+)$" => "$0",
+        #       ###"^/(wp-admin|wp-includes|wp-content|gallery2)/(.*)" => "$0",
+        #       "^/(.+)/?$" => "/index.php/$1"
+        #)
+}
+
+### WOOTDEVICES.IO  - https à activer après copie des certs
+$HTTP["host"] == "wootdevices.io" {
+        server.document-root = "/var/www/wootdevices.io/site/"
+#        $SERVER["socket"] == ":443" {
+#                ssl.engine  = "enable"
+#                ssl.ca-file = "/etc/letsencrypt/live/wootdevices.io/fullchain.pem"
+#                ssl.pemfile = "/etc/lighttpd/certs/wootdevices.io.pem"
+#        }
+}
+