misc/ansible-base
0
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

[sty] roles:tls hardening:format

Browse source
This commit is contained in:
roydfalk 2024-06-01 18:14:21 +02:00
parent 882286e1a7
commit aeac7cceab
7 changed files with 45 additions and 53 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
roles/authelia-and-nginx/templates/conf.j2
View file

@ -1,22 +1,22 @@
server {
server_name {{var_authelia_and_nginx_domain}};
listen [::]:80;
listen 80;
return 301 https://$server_name$request_uri;
}
server {
server_name {{var_authelia_and_nginx_domain}};
listen [::]:443 ssl http2;
listen 443 ssl http2;
ssl_certificate /etc/ssl/fullchains/{{var_authelia_and_nginx_domain}}.pem;
ssl_certificate_key /etc/ssl/private/{{var_authelia_and_nginx_domain}}.pem;
include /etc/nginx/ssl-hardening.conf;
location / {
## Headers
proxy_set_header Host $host;
@ -53,10 +53,10 @@ server {
proxy_read_timeout 360;
proxy_send_timeout 360;
proxy_connect_timeout 360;
proxy_pass http://localhost:9091;
}
location /api/verify {
proxy_pass http://localhost:9091;
}

22
roles/dokuwiki-and-nginx/templates/conf.j2
View file

@ -4,44 +4,44 @@ server {
server_name {{var_dokuwiki_and_nginx_domain}};
return 301 https://$server_name$request_uri;
}
server {
listen [::]:443 ssl;
listen 443 ssl;
server_name {{var_dokuwiki_and_nginx_domain}};
{% if var_dokuwiki_and_nginx_tls_enable %}
ssl_certificate /etc/ssl/fullchains/{{var_dokuwiki_and_nginx_domain}}.pem;
ssl_certificate_key /etc/ssl/private/{{var_dokuwiki_and_nginx_domain}}.pem;
include /etc/nginx/ssl-hardening.conf;
{% endif %}
# Maximum file upload size is 4MB - change accordingly if needed
client_max_body_size 4M;
client_body_buffer_size 128k;
root {{var_dokuwiki_and_nginx_directory}};
index doku.php;
#Remember to comment the below out when you're installing, and uncomment it when done.
location ~ /(conf/|bin/|inc/|vendor/|install.php) {
deny all;
}
#Support for X-Accel-Redirect
location ~ ^/data/ {
internal;
}
location ~ ^/lib.*\.(js|css|gif|png|ico|jpg|jpeg)$ {
expires 365d;
}
location / {
try_files $uri $uri/ @dokuwiki;
}
location @dokuwiki {
# rewrites "doku.php/" out of the URLs if you set the userwrite setting to .htaccess in dokuwiki config page
rewrite ^/_media/(.*) /lib/exe/fetch.php?media=$1 last;
@ -49,7 +49,7 @@ server {
rewrite ^/_export/([^/]+)/(.*) /doku.php?do=export_$1&id=$2 last;
rewrite ^/(.*) /doku.php?id=$1&$args last;
}
location ~ \.php$ {
try_files $uri $uri/ /doku.php;
include fastcgi_params;

6
roles/element-and-nginx/templates/conf.j2
View file

@ -3,12 +3,12 @@ server {
listen [::]:80;
listen 443 ssl;
listen [::]:443 ssl;
server_name {{var_element_and_nginx_domain}};
ssl_certificate /etc/ssl/fullchains/{{var_element_and_nginx_domain}}.pem;
ssl_certificate_key /etc/ssl/private/{{var_element_and_nginx_domain}}.pem;
include /etc/nginx/ssl-hardening.conf;
root {{var_element_and_nginx_path}};
}

28
roles/gitlab-and-nginx/templates/conf.j2
View file

@ -32,12 +32,12 @@ map $http_referer $gitlab_ssl_filtered_http_referer {
server {
listen 80 default_server;
listen [::]:80 ipv6only=on default_server;
server_name {{var_gitlab_and_nginx_domain}};
server_tokens off;
return 301 https://$http_host$request_uri;
access_log /var/log/nginx/gitlab_access.log gitlab_ssl_access;
error_log /var/log/nginx/gitlab_error.log;
}
@ -45,47 +45,47 @@ server {
server {
listen 0.0.0.0:443 ssl http2;
listen [::]:443 ipv6only=on ssl http2 default_server;
server_name {{var_gitlab_and_nginx_domain}};
server_tokens off;
ssl_certificate /etc/ssl/fullchains/{{var_gitlab_and_nginx_domain}}.pem;
ssl_certificate_key /etc/ssl/private/{{var_gitlab_and_nginx_domain}}.pem;
include /etc/nginx/ssl-hardening.conf;
real_ip_header X-Real-IP;
real_ip_recursive off;
access_log /var/log/nginx/gitlab_access.log gitlab_ssl_access;
error_log /var/log/nginx/gitlab_error.log;
location / {
client_max_body_size 0;
gzip off;
proxy_read_timeout 300;
proxy_connect_timeout 300;
proxy_redirect off;
proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade_gitlab;
# proxy_pass http://gitlab-workhorse;
proxy_pass http://localhost:8080;
}
error_page 404 /404.html;
error_page 422 /422.html;
error_page 500 /500.html;
error_page 502 /502.html;
error_page 503 /503.html;
location ~ ^/(404|422|500|502|503)\.html$ {
root /home/git/gitlab/public;
internal;

8
roles/hedgedoc-and-nginx/templates/conf.j2
View file

@ -5,14 +5,14 @@ map $http_upgrade $connection_upgrade {
server {
server_name {{var_hedgedoc_and_nginx_domain}};
listen [::]:443 ssl http2;
listen 443 ssl http2;
ssl_certificate /etc/ssl/certs/{{var_hedgedoc_and_nginx_domain}}.pem;
ssl_certificate_key /etc/ssl/private/{{var_hedgedoc_and_nginx_domain}}.pem;
include /etc/nginx/ssl-hardening.conf;
location / {
proxy_pass http://localhost:3000;
proxy_set_header Host $host;
@ -20,7 +20,7 @@ server {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location /socket.io/ {
proxy_pass http://localhost:3000;
proxy_set_header Host $host;

8
roles/nginx/files/dhparam
View file

@ -1,8 +0,0 @@
-----BEGIN DH PARAMETERS-----
MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
-----END DH PARAMETERS-----

12
roles/synapse-and-nginx/templates/conf.j2
View file

@ -3,25 +3,25 @@ server {
listen [::]:80;
listen 443 ssl;
listen [::]:443 ssl;
## For the federation port
listen 8448 ssl http2 default_server;
listen [::]:8448 ssl http2 default_server;
server_name {{var_synapse_and_nginx_domain}};
ssl_certificate /etc/ssl/fullchains/{{var_synapse_and_nginx_domain}}.pem;
ssl_certificate_key /etc/ssl/private/{{var_synapse_and_nginx_domain}}.pem;
include /etc/nginx/ssl-hardening.conf;
location ~ ^(/_matrix|/_synapse/client) {
proxy_pass http://localhost:8008;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $host;
client_max_body_size 50M;
proxy_http_version 1.1;
}
}