Improve ingress

4 files changed, 32 insertions, 39 deletions

diff --git a/playbook.yml b/playbook.yml
index 3a2a755..a5b636c 100644
--- a/playbook.yml
+++ b/playbook.yml
@@ -34,8 +34,10 @@
       - { userland: "{{ jail_userland_15_0 }}", num: 10, name: samba }
       - { userland: "{{ jail_userland_14_3 }}", num: 11, name: spliit }
       - { userland: "{{ jail_userland_15_0 }}", num: 12, name: goaccess }
+      - { userland: "{{ jail_userland_15_0 }}", num: 13, name: plex }
       - { userland: "{{ jail_userland_14_3 }}", num: 14, name: freshrss }
       - { userland: "{{ jail_userland_14_3 }}", num: 15, name: paste }
+      - { userland: "{{ jail_userland_15_0 }}", num: 16, name: dl }
     ingress_routes:
       - { host: jan.systems, jail: homepage }
       - { host: jantuomi.fi, redirect: jan.systems }
@@ -46,6 +48,7 @@
       - { host: irc.jan.systems, jail: irc_thelounge }
       - { host: paste.jan.systems, jail: paste }
       - { host: immich.jan.systems, ip: 192.168.3.3, port: 2283 } # vms aren't configured in ansible
+      - { host: plex.jan.systems, jail: plex, port: 32400 }
     cert_domains:
       - "jan.systems"
       - "*.jan.systems"
diff --git a/tasks/jail_ingress.yml b/tasks/jail_ingress.yml
index 75e364e..2844c12 100644
--- a/tasks/jail_ingress.yml
+++ b/tasks/jail_ingress.yml
@@ -110,7 +110,7 @@
   shell: |
     service -j ingress nginx enable
     service -j ingress nginx onestart
-  when: ingress_nginx_enabled.rc != 0
+  when: ingress_nginx_enabled.rc != 0 or nginx_conf.changed
 
 - name: Install hetzner_ddns.sh
   template:
diff --git a/templates/etc_jail.conf.d_[jailname].conf.j2 b/templates/etc_jail.conf.d_[jailname].conf.j2
index 4c0bbc4..b4ed513 100644
--- a/templates/etc_jail.conf.d_[jailname].conf.j2
+++ b/templates/etc_jail.conf.d_[jailname].conf.j2
@@ -28,7 +28,6 @@
   {% if ing.name == "ingress" -%}
   exec.poststart   += "jexec ${name} route add default 192.168.2.{{ ing.num }} || echo 'Failed to add default route'";
   exec.poststart   += "jexec ${name} route add 10.6.210.0/24 192.168.0.1 || echo 'Failed to add Wireguard return route'";
-  exec.poststart   += "mount -t nullfs /usr/local/jails/containers/goaccess/var/www/goaccess /usr/local/jails/containers/ingress/mnt/www_goaccess"
   {% endif %}
   {% endfor %}
   {% else %}
@@ -36,6 +35,7 @@
   exec.poststart   += "jexec ${name} ifconfig epw{{ jail.num }}b up";
   exec.poststart   += "ifconfig epw{{ jail.num }}a up";
   exec.poststart   += "jexec ${name} service dhclient restart epw{{ jail.num }}b";
+  exec.poststart   += "mount -t nullfs /usr/local/jails/containers/goaccess/var/www/goaccess /usr/local/jails/containers/ingress/mnt/www_goaccess";
   {% endif %}
 
   exec.stop         = "/bin/sh /etc/rc.shutdown";
@@ -43,6 +43,7 @@
   exec.poststop    += "ifconfig epl{{ jail.num }}a destroy";
   {% if jail.name == "ingress" -%}
   exec.poststop    += "ifconfig epw{{ jail.num }}a destroy";
+  exec.poststop    += "umount /usr/local/jails/containers/ingress/mnt/www_goaccess";
   {% endif %}
 
   exec.consolelog   = "/var/log/jail_console_${name}.log";
diff --git a/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2
index ae08d46..456a607 100644
--- a/templates/ingress/usr_local_etc_nginx_nginx.conf.j2
+++ b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2
@@ -28,8 +28,6 @@ http {
     }
 
     {% for route in ingress_routes -%}
-    {% if route.jail is defined -%}
-    {% for jail in jails if jail.name == route.jail -%}
     server {
         server_name {{ route.host }};
         http2 on;
@@ -40,20 +38,31 @@ http {
         # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7
         add_header Strict-Transport-Security "max-age=63072000" always;
 
+        # Common hardening headers
+        add_header X-Content-Type-Options nosniff always;
+        add_header X-Frame-Options DENY always;
+        add_header Referrer-Policy strict-origin-when-cross-origin always;
+        add_header Permissions-Policy interest-cohort=();
+
+        # Hide "Server: nginx/1.28.0" header
+        server_tokens off;
+
         ssl_certificate /usr/local/etc/letsencrypt/live/{{ cert_name }}/fullchain.pem;
         ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ cert_name }}/privkey.pem;
         include /usr/local/etc/letsencrypt/options-ssl-nginx.conf;
         ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem;
 
+    {% if route.jail is defined -%}
+    {% for jail in jails if jail.name == route.jail -%}
         location / {
-            proxy_pass http://192.168.2.{{ jail.num }};
+            proxy_pass http://192.168.2.{{ jail.num }}{% if route.port is defined %}:{{ route.port }}{% endif %};
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $scheme;
             {% if jail.name == 'irc_thelounge' -%}
             proxy_http_version 1.1;
-            proxy_set_header Connection "upgrade";
+            proxy_set_header Connection "Upgrade";
             proxy_set_header Upgrade $http_upgrade;
 
             # by default nginx times out connections in one minute
@@ -63,44 +72,24 @@ http {
             proxy_request_buffering off;
 
             client_max_body_size 100M;
+            {% elif jail.name == 'plex' -%}
+            proxy_http_version 1.1;
+            proxy_set_header Connection "Upgrade";
+            proxy_set_header Upgrade $http_upgrade;
+
+            # Streaming-friendly behavior
+            proxy_redirect   off;
+            proxy_buffering  off;
+
+            # Long streams / slow clients
+            proxy_read_timeout  3600s;
+            proxy_send_timeout  3600s;
             {% endif %}
         }
-    }
     {% endfor %}
     {% elif route.redirect is defined -%}
-    server {
-        server_name {{ route.host }};
-        http2 on;
-
-        listen 443 ssl;
-        listen [::]:443 ssl;
-
-        # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7
-        add_header Strict-Transport-Security "max-age=63072000" always;
-
-        ssl_certificate /usr/local/etc/letsencrypt/live/{{ cert_name }}/fullchain.pem;
-        ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ cert_name }}/privkey.pem;
-        include /usr/local/etc/letsencrypt/options-ssl-nginx.conf;
-        ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem;
-
         return 307 https://{{ route.redirect }}$request_uri;
-    }
     {% elif route.ip is defined -%}
-    server {
-        server_name {{ route.host }};
-        http2 on;
-
-        listen 443 ssl;
-        listen [::]:443 ssl;
-
-        # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7
-        add_header Strict-Transport-Security "max-age=63072000" always;
-
-        ssl_certificate /usr/local/etc/letsencrypt/live/{{ cert_name }}/fullchain.pem;
-        ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ cert_name }}/privkey.pem;
-        include /usr/local/etc/letsencrypt/options-ssl-nginx.conf;
-        ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem;
-
         location / {
             proxy_pass http://{{ route.ip }}:{{ route.port }};
             proxy_set_header Host $host;
@@ -121,7 +110,7 @@ http {
 
             client_max_body_size 10G;
         }
-    }
     {% endif %}
+    }
     {% endfor %}
 }