roles/authelia-for-zeitbild_backend/defaults/main.json

@@ -1,5 +0,0 @@
-{
-	"var_authelia_for_zeitbild_backend_zeitbild_backend_url_base": "https://zeitbild_backend.example.org",
-	"var_authelia_for_zeitbild_backend_client_id": "zeitbild_backend",
-	"var_authelia_for_zeitbild_backend_client_secret": "REPLACE_ME"
-}

roles/authelia-for-zeitbild_backend/info.md

@@ -1,4 +0,0 @@
-## Beschreibung
-
-Um [zeitbild](../zeitbild_backend) gegen [Authelia](../authelia) authentifizieren zu lassen
-

roles/authelia-for-zeitbild_backend/tasks/main.json

@@ -1,25 +0,0 @@
-[
-	{
-		"name": "configuration | emplace",
-		"become": true,
-		"ansible.builtin.template": {
-			"src": "authelia-client-conf.json.j2",
-			"dest": "/etc/authelia/conf.d/clients/zeitbild_backend.json"
-		}
-	},
-	{
-		"name": "configuration | apply",
-		"become": true,
-		"ansible.builtin.command": {
-			"cmd": "/usr/bin/authelia-conf-compose"
-		}
-	},
-	{
-		"name": "restart service",
-		"become": true,
-		"ansible.builtin.systemd_service": {
-			"state": "restarted",
-			"name": "authelia"
-		}
-	}
-]

roles/authelia-for-zeitbild_backend/templates/authelia-client-conf.json.j2

@@ -1,17 +0,0 @@
-{
-	"client_id": "{{var_authelia_for_zeitbild_backend_client_id}}",
-	"client_secret": "{{var_authelia_for_zeitbild_backend_client_secret}}",
-	"client_name": "Forgejo",
-	"public": false,
-	"authorization_policy": "one_factor",
-	"redirect_uris": [
-		"{{var_authelia_for_zeitbild_backend_zeitbild_backend_url_base}}/user/oauth2/authelia/callback"
-	],
-	"scopes": [
-		"openid",
-		"email",
-		"profile"
-	],
-	"userinfo_signed_response_alg": "none",
-	"token_endpoint_auth_method": "client_secret_basic"
-}

roles/zeitbild_backend-and-nginx/defaults/main.json

@@ -1,5 +1,5 @@
 {
 	"var_zeitbild_backend_and_nginx_domain": "zeitbild.example.org",
 	"var_zeitbild_backend_and_nginx_port": 7845,
-	"var_zeitbild_backend_and_nginx_tls_mode": "force"
+	"var_zeitbild_backend_and_nginx_tls": true
 }

roles/zeitbild_backend-and-nginx/templates/conf.j2

@@ -1,4 +1,22 @@
-{% macro zeitbild_backend_common() %}
+map $http_upgrade $connection_upgrade {
+	default upgrade;
+	'' close;
+}
+
+server {
+	server_name {{var_zeitbild_backend_and_nginx_domain}};
+	
+	listen 80;
+	listen [::]:80;
+{% if var_zeitbild_backend_and_nginx_tls %}
+	listen [::]:443 ssl http2;
+	listen 443 ssl http2;
+	
+	ssl_certificate /etc/ssl/certs/{{var_zeitbild_backend_and_nginx_domain}}.pem;
+	ssl_certificate_key /etc/ssl/private/{{var_zeitbild_backend_and_nginx_domain}}.pem;
+	include /etc/nginx/ssl-hardening.conf;
+{% endif %}
+	
 	location / {
 		proxy_pass http://localhost:{{var_zeitbild_backend_and_nginx_port | string}};
 		proxy_set_header Host $host;
@@ -6,31 +24,4 @@
 		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 		proxy_set_header X-Forwarded-Proto $scheme;
 	}
-{% endmacro %}
-
-server {
-	listen 80;
-	listen [::]:80;
-	
-	server_name {{var_zeitbild_backend_and_nginx_domain}};
-	
-{% if var_zeitbild_backend_and_nginx_tls_mode == 'force' %}
-	return 301 https://$http_host$request_uri;
-{% else %}
-{{ zeitbild_backend_common() }}
-{% endif %}
-}
-
-{% if var_zeitbild_backend_and_nginx_tls_mode != 'disable' %}
-server {
-	listen 443 ssl;
-	listen [::]:443 ssl;
-	
-	server_name {{var_zeitbild_backend_and_nginx_domain}};
-	
-	ssl_certificate_key /etc/ssl/private/{{var_zeitbild_backend_and_nginx_domain}}.pem;
-	ssl_certificate /etc/ssl/fullchains/{{var_zeitbild_backend_and_nginx_domain}}.pem;
-	include /etc/nginx/ssl-hardening.conf;
-	
-{{ zeitbild_backend_common() }}
 }

roles/zeitbild_backend-and-nginx/vardef.json

@@ -1,19 +0,0 @@
-{
-	"domain": {
-		"mandatory": false,
-		"type": "string"
-	},
-	"port": {
-		"mandatory": false,
-		"type": "integer"
-	},
-	"tls_mode": {
-		"mandatory": false,
-		"type": "string",
-		"options": [
-			"disable",
-			"enable",
-			"force"
-		]
-	}
-}

roles/zeitbild_frontend_dali-and-nginx/defaults/main.json

@@ -1,5 +0,0 @@
-{
-	"var_zeitbild_frontend_dali_and_nginx_domain": "zeitbild.example.org",
-	"var_zeitbild_frontend_dali_and_nginx_path": "/opt/dali",
-	"var_zeitbild_frontend_dali_and_nginx_tls_mode": "force"
-}

roles/zeitbild_frontend_dali-and-nginx/tasks/main.json

@@ -1,35 +0,0 @@
-[
-	{
-		"name": "deactivate default site",
-		"become": true,
-		"ansible.builtin.file": {
-			"state": "absent",
-			"dest": "/etc/nginx/sites-enabled/default"
-		}
-	},
-	{
-		"name": "emplace configuration | data",
-		"become": true,
-		"ansible.builtin.template": {
-			"src": "conf.j2",
-			"dest": "/etc/nginx/sites-available/{{var_zeitbild_frontend_dali_and_nginx_domain}}"
-		}
-	},
-	{
-		"name": "emplace configuration | link",
-		"become": true,
-		"ansible.builtin.file": {
-			"state": "link",
-			"src": "/etc/nginx/sites-available/{{var_zeitbild_frontend_dali_and_nginx_domain}}",
-			"dest": "/etc/nginx/sites-enabled/{{var_zeitbild_frontend_dali_and_nginx_domain}}"
-		}
-	},
-	{
-		"name": "restart nginx",
-		"become": true,
-		"ansible.builtin.systemd_service": {
-			"state": "restarted",
-			"name": "nginx"
-		}
-	}
-]

roles/zeitbild_frontend_dali-and-nginx/templates/conf.j2

@@ -1,31 +0,0 @@
-{% macro zeitbild_frontend_dali_common() %}
-root {{var_zeitbild_frontend_dali_and_nginx_path}};
-{% endmacro %}
-
-server {
-	server_name {{var_zeitbild_frontend_dali_and_nginx_domain}};
-	
-	listen 80;
-	listen [::]:80;
-
-{% if (var_zeitbild_frontend_dali_and_nginx_tls_mode == 'force') %}
-	return 301 https://$http_host$request_uri;
-{% else %}
-{{ zeitbild_frontend_dali_common() }}
-{% endif %}
-}
-
-{% if (var_zeitbild_frontend_dali_and_nginx_tls_mode != 'disable') %}
-server {
-	server_name {{var_zeitbild_frontend_dali_and_nginx_domain}};
-	
-	listen 443 ssl;
-	listen [::]:443 ssl;
-	
-	ssl_certificate_key /etc/ssl/private/{{var_zeitbild_frontend_dali_and_nginx_domain}}.pem;
-	ssl_certificate /etc/ssl/fullchains/{{var_zeitbild_frontend_dali_and_nginx_domain}}.pem;
-	include /etc/nginx/ssl-hardening.conf;
-	
-{{ zeitbild_frontend_dali_common() }}
-}
-{% endif %}

roles/zeitbild_frontend_dali-and-nginx/vardef.json

@@ -1,19 +0,0 @@
-{
-	"domain": {
-		"mandatory": false,
-		"type": "string"
-	},
-	"port": {
-		"mandatory": false,
-		"type": "integer"
-	},
-	"tls_mode": {
-		"mandatory": false,
-		"type": "string",
-		"options": [
-			"disable",
-			"enable",
-			"force"
-		]
-	}
-}