zeitbild/infrastructure
0
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Compare commits

base: zeitbild:cf34edb95bf39cea30ae0e6d8886bf07b759d28c
Branches Tags
zeitbild:main
..
compare: zeitbild:7708011fc4429834a84ad99ba520bf9da834c29b
Branches Tags
zeitbild:main

No commits in common. "cf34edb95bf39cea30ae0e6d8886bf07b759d28c" and "7708011fc4429834a84ad99ba520bf9da834c29b" have entirely different histories.
cf34edb95b ... 7708011fc4

11 changed files with 20 additions and 189 deletions
Show stats Expand all files Collapse all files

5
roles/authelia-for-zeitbild_backend/defaults/main.json
View file

@ -1,5 +0,0 @@
{
"var_authelia_for_zeitbild_backend_zeitbild_backend_url_base": "https://zeitbild_backend.example.org",
"var_authelia_for_zeitbild_backend_client_id": "zeitbild_backend",
"var_authelia_for_zeitbild_backend_client_secret": "REPLACE_ME"
}

4
roles/authelia-for-zeitbild_backend/info.md
View file

@ -1,4 +0,0 @@
## Beschreibung
Um [zeitbild](../zeitbild_backend) gegen [Authelia](../authelia) authentifizieren zu lassen

25
roles/authelia-for-zeitbild_backend/tasks/main.json
View file

@ -1,25 +0,0 @@
[
{
"name": "configuration | emplace",
"become": true,
"ansible.builtin.template": {
"src": "authelia-client-conf.json.j2",
"dest": "/etc/authelia/conf.d/clients/zeitbild_backend.json"
}
},
{
"name": "configuration | apply",
"become": true,
"ansible.builtin.command": {
"cmd": "/usr/bin/authelia-conf-compose"
}
},
{
"name": "restart service",
"become": true,
"ansible.builtin.systemd_service": {
"state": "restarted",
"name": "authelia"
}
}
]

17
roles/authelia-for-zeitbild_backend/templates/authelia-client-conf.json.j2
View file

@ -1,17 +0,0 @@
{
"client_id": "{{var_authelia_for_zeitbild_backend_client_id}}",
"client_secret": "{{var_authelia_for_zeitbild_backend_client_secret}}",
"client_name": "Forgejo",
"public": false,
"authorization_policy": "one_factor",
"redirect_uris": [
"{{var_authelia_for_zeitbild_backend_zeitbild_backend_url_base}}/user/oauth2/authelia/callback"
],
"scopes": [
"openid",
"email",
"profile"
],
"userinfo_signed_response_alg": "none",
"token_endpoint_auth_method": "client_secret_basic"
}

2
roles/zeitbild_backend-and-nginx/defaults/main.json
View file

@ -1,5 +1,5 @@
{
"var_zeitbild_backend_and_nginx_domain": "zeitbild.example.org",
"var_zeitbild_backend_and_nginx_port": 7845,
"var_zeitbild_backend_and_nginx_tls_mode": "force"
"var_zeitbild_backend_and_nginx_tls": true
}

47
roles/zeitbild_backend-and-nginx/templates/conf.j2
View file

@ -1,4 +1,22 @@
{% macro zeitbild_backend_common() %}
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
server {
server_name {{var_zeitbild_backend_and_nginx_domain}};
listen 80;
listen [::]:80;
{% if var_zeitbild_backend_and_nginx_tls %}
listen [::]:443 ssl http2;
listen 443 ssl http2;
ssl_certificate /etc/ssl/certs/{{var_zeitbild_backend_and_nginx_domain}}.pem;
ssl_certificate_key /etc/ssl/private/{{var_zeitbild_backend_and_nginx_domain}}.pem;
include /etc/nginx/ssl-hardening.conf;
{% endif %}
location / {
proxy_pass http://localhost:{{var_zeitbild_backend_and_nginx_port | string}};
proxy_set_header Host $host;
@ -6,31 +24,4 @@
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
{% endmacro %}
server {
listen 80;
listen [::]:80;
server_name {{var_zeitbild_backend_and_nginx_domain}};
{% if var_zeitbild_backend_and_nginx_tls_mode == 'force' %}
return 301 https://$http_host$request_uri;
{% else %}
{{ zeitbild_backend_common() }}
{% endif %}
}
{% if var_zeitbild_backend_and_nginx_tls_mode != 'disable' %}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name {{var_zeitbild_backend_and_nginx_domain}};
ssl_certificate_key /etc/ssl/private/{{var_zeitbild_backend_and_nginx_domain}}.pem;
ssl_certificate /etc/ssl/fullchains/{{var_zeitbild_backend_and_nginx_domain}}.pem;
include /etc/nginx/ssl-hardening.conf;
{{ zeitbild_backend_common() }}
}

19
roles/zeitbild_backend-and-nginx/vardef.json
View file

@ -1,19 +0,0 @@
{
"domain": {
"mandatory": false,
"type": "string"
},
"port": {
"mandatory": false,
"type": "integer"
},
"tls_mode": {
"mandatory": false,
"type": "string",
"options": [
"disable",
"enable",
"force"
]
}
}

5
roles/zeitbild_frontend_dali-and-nginx/defaults/main.json
View file

@ -1,5 +0,0 @@
{
"var_zeitbild_frontend_dali_and_nginx_domain": "zeitbild.example.org",
"var_zeitbild_frontend_dali_and_nginx_path": "/opt/dali",
"var_zeitbild_frontend_dali_and_nginx_tls_mode": "force"
}

35
roles/zeitbild_frontend_dali-and-nginx/tasks/main.json
View file

@ -1,35 +0,0 @@
[
{
"name": "deactivate default site",
"become": true,
"ansible.builtin.file": {
"state": "absent",
"dest": "/etc/nginx/sites-enabled/default"
}
},
{
"name": "emplace configuration | data",
"become": true,
"ansible.builtin.template": {
"src": "conf.j2",
"dest": "/etc/nginx/sites-available/{{var_zeitbild_frontend_dali_and_nginx_domain}}"
}
},
{
"name": "emplace configuration | link",
"become": true,
"ansible.builtin.file": {
"state": "link",
"src": "/etc/nginx/sites-available/{{var_zeitbild_frontend_dali_and_nginx_domain}}",
"dest": "/etc/nginx/sites-enabled/{{var_zeitbild_frontend_dali_and_nginx_domain}}"
}
},
{
"name": "restart nginx",
"become": true,
"ansible.builtin.systemd_service": {
"state": "restarted",
"name": "nginx"
}
}
]

31
roles/zeitbild_frontend_dali-and-nginx/templates/conf.j2
View file

@ -1,31 +0,0 @@
{% macro zeitbild_frontend_dali_common() %}
root {{var_zeitbild_frontend_dali_and_nginx_path}};
{% endmacro %}
server {
server_name {{var_zeitbild_frontend_dali_and_nginx_domain}};
listen 80;
listen [::]:80;
{% if (var_zeitbild_frontend_dali_and_nginx_tls_mode == 'force') %}
return 301 https://$http_host$request_uri;
{% else %}
{{ zeitbild_frontend_dali_common() }}
{% endif %}
}
{% if (var_zeitbild_frontend_dali_and_nginx_tls_mode != 'disable') %}
server {
server_name {{var_zeitbild_frontend_dali_and_nginx_domain}};
listen 443 ssl;
listen [::]:443 ssl;
ssl_certificate_key /etc/ssl/private/{{var_zeitbild_frontend_dali_and_nginx_domain}}.pem;
ssl_certificate /etc/ssl/fullchains/{{var_zeitbild_frontend_dali_and_nginx_domain}}.pem;
include /etc/nginx/ssl-hardening.conf;
{{ zeitbild_frontend_dali_common() }}
}
{% endif %}

19
roles/zeitbild_frontend_dali-and-nginx/vardef.json
View file

@ -1,19 +0,0 @@
{
"domain": {
"mandatory": false,
"type": "string"
},
"port": {
"mandatory": false,
"type": "integer"
},
"tls_mode": {
"mandatory": false,
"type": "string",
"options": [
"disable",
"enable",
"force"
]
}
}