misc/ansible-base
0
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

[int]

Browse source
This commit is contained in:
roydfalk 2024-06-24 20:19:04 +02:00
parent 0b303849a8
commit e4c3b3a287
4 changed files with 56 additions and 31 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
roles/element-and-nginx/defaults/main.json
View file

@ -1,4 +1,5 @@
{
"var_element_and_nginx_domain": "element.example.org",
"var_element_and_nginx_path": "/opt/element"
"var_element_and_nginx_path": "/opt/element",
"var_element_and_nginx_tls": "enable"
}

23
roles/element-and-nginx/templates/conf.j2
View file

@ -1,14 +1,31 @@
boilerplate element {
root {{var_element_and_nginx_path}};
}
server {
server_name {{var_element_and_nginx_domain}};
listen 80;
listen [::]:80;
{% if (var_element_and_nginx_tls == "force") %}
return 301 https://$http_host$request_uri;
{% else %}
invoke element;
{% endif %}
}
{% if (var_element_and_nginx_tls != "disable") %}
server {
server_name {{var_element_and_nginx_domain}};
listen 443 ssl;
listen [::]:443 ssl;
server_name {{var_element_and_nginx_domain}};
ssl_certificate /etc/ssl/fullchains/{{var_element_and_nginx_domain}}.pem;
ssl_certificate_key /etc/ssl/private/{{var_element_and_nginx_domain}}.pem;
include /etc/nginx/ssl-hardening.conf;
root {{var_element_and_nginx_path}};
invoke element;
}
{% endif %}

5
roles/gitlab-and-nginx/defaults/main.json
View file

@ -1,4 +1,5 @@
{
"var_gitlab_and_nginx_domain": "element.example.org",
"var_gitlab_and_nginx_path": "/opt/element"
"var_gitlab_and_nginx_domain": "gitlab.example.org",
"var_gitlab_and_nginx_path": "/opt/gitlab",
"var_gitlab_and_nginx_tls": "enable"
}

56
roles/gitlab-and-nginx/templates/conf.j2
View file

@ -29,34 +29,11 @@ map $http_referer $gitlab_ssl_filtered_http_referer {
~^(?<temp>.*)\? $temp;
}
server {
listen 80 default_server;
listen [::]:80 ipv6only=on default_server;
server_name {{var_gitlab_and_nginx_domain}};
server_tokens off;
return 301 https://$http_host$request_uri;
access_log /var/log/nginx/gitlab_access.log gitlab_ssl_access;
error_log /var/log/nginx/gitlab_error.log;
}
server {
listen 0.0.0.0:443 ssl http2;
listen [::]:443 ipv6only=on ssl http2 default_server;
server_name {{var_gitlab_and_nginx_domain}};
server_tokens off;
ssl_certificate /etc/ssl/fullchains/{{var_gitlab_and_nginx_domain}}.pem;
ssl_certificate_key /etc/ssl/private/{{var_gitlab_and_nginx_domain}}.pem;
include /etc/nginx/ssl-hardening.conf;
boilerplate gitlab_common {
real_ip_header X-Real-IP;
real_ip_recursive off;
access_log /var/log/nginx/gitlab_access.log gitlab_ssl_access;
access_log /var/log/nginx/gitlab_access.log;# gitlab_ssl_access;
error_log /var/log/nginx/gitlab_error.log;
location / {
@ -92,3 +69,32 @@ server {
}
}
server {
server_name {{var_gitlab_and_nginx_domain}};
server_tokens off;
listen 80 default_server;
listen [::]:80 ipv6only=on default_server;
{% if (var_gitlab_and_nginx_tls == "force") %}
return 301 https://$http_host$request_uri;
{% else %}
invoke gitlab_common;
{% endif %}
}
{% if (var_gitlab_and_nginx_tls != "disable") %}
server {
server_name {{var_gitlab_and_nginx_domain}};
server_tokens off;
listen 0.0.0.0:443 ssl http2;
listen [::]:443 ipv6only=on ssl http2 default_server;
ssl_certificate /etc/ssl/fullchains/{{var_gitlab_and_nginx_domain}}.pem;
ssl_certificate_key /etc/ssl/private/{{var_gitlab_and_nginx_domain}}.pem;
include /etc/nginx/ssl-hardening.conf;
invoke gitlab_common;
}
{% endif %}