Add goaccess to ingress

5 files changed, 44 insertions, 1 deletions

diff --git a/playbook.yml b/playbook.yml
index 19b4711..8a038ba 100644
--- a/playbook.yml
+++ b/playbook.yml
@@ -39,6 +39,7 @@
       - { host: spliit.jan.systems, jail: spliit }
       - { host: freshrss.jan.systems, jail: freshrss }
       - { host: irc.jan.systems, jail: irc_thelounge }
+      - { host: goaccess.jan.systems, static: /var/www/goaccess }
 
   tasks:
     - name: Run general tasks
diff --git a/tasks/jail_ingress.yml b/tasks/jail_ingress.yml
index ab95a71..71d87fa 100644
--- a/tasks/jail_ingress.yml
+++ b/tasks/jail_ingress.yml
@@ -3,6 +3,7 @@
     - { jail: ingress, package: nginx }
     - { jail: ingress, package: py311-certbot }
     - { jail: ingress, package: py311-certbot-nginx }
+    - { jail: ingress, package: goaccess }
   include_tasks: pkg_jail_install.yml
 
 - name: Generate LetsEncrypt certs
@@ -20,6 +21,16 @@
     mode: "0644"
   register: nginx_conf
 
+- name: Create static directories
+  loop: "{{ ingress_routes | selectattr('static', 'defined') | map(attribute='static') | unique | list }}"
+  file:
+    path: "/usr/local/jails/containers/ingress{{ item }}"
+    state: directory
+    recurse: yes
+    owner: 80
+    group: 80
+    mode: "0755"
+
 - name: Check if nginx is enabled
   shell: service -j ingress nginx status
   changed_when: false
diff --git a/templates/ingress/etc_crontab.j2 b/templates/ingress/etc_crontab.j2
index 46d6b93..e0c3d4e 100644
--- a/templates/ingress/etc_crontab.j2
+++ b/templates/ingress/etc_crontab.j2
@@ -15,3 +15,6 @@ PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
 {% for elem in hetzner_zone_record_ids %}
 *       *       *       *       *       root    /usr/local/bin/hetzner_ddns.sh --zone-id '{{ elem.zone_id }}' --record-id '{{ elem.record_id }}' --record-name '{{ elem.name }}' --record-type '{{ elem.type }}' --ttl '{{ elem.ttl }}' --iface-cmd 'ifconfig epw1b' >>/var/log/hetzner_ddns.log 2>&1
 {% endfor %}
+
+# Update goaccess report HTML
+0       *       *       *       *       www    (cat /var/log/nginx/access.log | awk '$8=$1$8' | /usr/local/bin/goaccess --log-format=VCOMBINED -j "$(($(nproc) + 1))" --keep-last=30 -a -o /var/www/goaccess/index.html --persist --restore)
diff --git a/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2
index 38b41d7..0ae1e56 100644
--- a/templates/ingress/usr_local_etc_nginx_nginx.conf.j2
+++ b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2
@@ -11,6 +11,13 @@ http {
     sendfile        on;
     keepalive_timeout  65;
 
+    log_format vcombined    '$host:$server_port '
+                            '$remote_addr - $remote_user [$time_local] '
+                            '"$request" $status $body_bytes_sent '
+                            '"$http_referer" "$http_user_agent"';
+
+    access_log /var/log/nginx/access.log vcombined;
+
     server {
         listen 80 default_server;
         server_name _;
@@ -78,6 +85,27 @@ http {
 
         return 307 https://{{ route.redirect }}$request_uri;
     }
+    {% elif route.static is defined -%}
+    server {
+        server_name {{ route.host }};
+        http2 on;
+
+        listen 443 ssl;
+        listen [::]:443 ssl;
+
+        # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7
+        add_header Strict-Transport-Security "max-age=63072000" always;
+
+        ssl_certificate /usr/local/etc/letsencrypt/live/{{ route.host }}/fullchain.pem;
+        ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ route.host }}/privkey.pem;
+        include /usr/local/etc/letsencrypt/options-ssl-nginx.conf;
+        ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem;
+
+        location / {
+            root {{ route.static }};
+            index index.html;
+        }
+    }
     {% endif %}
     {% endfor %}
 }
diff --git a/templates/usr_local_etc_pylogsentinel.conf.j2 b/templates/usr_local_etc_pylogsentinel.conf.j2
index 74721ef..5892a98 100644
--- a/templates/usr_local_etc_pylogsentinel.conf.j2
+++ b/templates/usr_local_etc_pylogsentinel.conf.j2
@@ -6,7 +6,7 @@ max_block_size = 10M
 cmd = find / -type f -path '*/var/log/*' ! -name 'access.log' ! -name '*.bz2'
 
 [logs.access]
-cmd = find / -type f -name 'access.log'
+paths = /usr/local/jails/containers/ingress/var/log/nginx/access.log
 
 [action.default]
 cmd = echo -e "---------\nMatched $RULE_ID in $FILE at line $LINE, context:\n\n$CONTEXT\n" >> /tmp/pylogsentinel.daily