diff options
| author | Jan Tuomi <jan@jantuomi.fi> | 2025-10-22 22:45:15 +0300 |
|---|---|---|
| committer | Jan Tuomi <jan@jantuomi.fi> | 2025-10-22 22:45:15 +0300 |
| commit | 5263aa814da9852294ea64c77af22a1cd2507fca (patch) | |
| tree | 4bfec8e587cb34b803cb14f6d32fa3ee7381a118 /templates/ingress | |
| parent | fea0aff43b6c7cc14ba848f97afb17999ff65c17 (diff) | |
Improvements
Diffstat (limited to 'templates/ingress')
| -rw-r--r-- | templates/ingress/etc_crontab.j2 | 2 | ||||
| -rw-r--r-- | templates/ingress/etc_pf.conf.j2 | 19 | ||||
| -rw-r--r-- | templates/ingress/usr_local_bin_gen_goaccess.sh.j2 | 6 | ||||
| -rw-r--r-- | templates/ingress/usr_local_etc_nginx_nginx.conf.j2 | 3 |
4 files changed, 29 insertions, 1 deletions
diff --git a/templates/ingress/etc_crontab.j2 b/templates/ingress/etc_crontab.j2 index e0c3d4e..d78e769 100644 --- a/templates/ingress/etc_crontab.j2 +++ b/templates/ingress/etc_crontab.j2 @@ -17,4 +17,4 @@ PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin {% endfor %} # Update goaccess report HTML -0 * * * * www (cat /var/log/nginx/access.log | awk '$8=$1$8' | /usr/local/bin/goaccess --log-format=VCOMBINED -j "$(($(nproc) + 1))" --keep-last=30 -a -o /var/www/goaccess/index.html --persist --restore) +0 * * * * root /usr/local/bin/gen_goaccess.sh diff --git a/templates/ingress/etc_pf.conf.j2 b/templates/ingress/etc_pf.conf.j2 new file mode 100644 index 0000000..c8045fd --- /dev/null +++ b/templates/ingress/etc_pf.conf.j2 @@ -0,0 +1,19 @@ +{% for jail in jails -%} +{% if jail.name == 'ingress' -%} +# Interfaces & nets +lan = "epl{{ jail.num }}b" +wan = "epw{{ jail.num }}b" +lan_net = "{{ lan_ipv4_cidr }}" + +# Keep PF out of loopback, drop by default if you add blocks later +set skip on lo0 +set block-policy drop + +# NAT: translate LAN traffic to the WAN interface address, and log it +nat log on $wan from $lan_net to any -> ($wan) + +# Allow and log the LAN traffic so NAT can happen +pass in on $lan inet from $lan_net to any keep state +pass out on $wan inet from $lan_net to any keep state +{% endif %} +{% endfor %} diff --git a/templates/ingress/usr_local_bin_gen_goaccess.sh.j2 b/templates/ingress/usr_local_bin_gen_goaccess.sh.j2 new file mode 100644 index 0000000..fb7a7bc --- /dev/null +++ b/templates/ingress/usr_local_bin_gen_goaccess.sh.j2 @@ -0,0 +1,6 @@ +#!/bin/sh + +cat /var/log/nginx/access.log | awk '$8=$1$8' | /usr/local/bin/goaccess --log-format=VCOMBINED -j "$(($(nproc) + 1))" --keep-last=30 -a -o /var/www/goaccess/index.html --persist --restore +chmod 644 /var/www/goaccess/index.html +chown www /var/www/goaccess/index.html +chgrp www /var/www/goaccess/index.html diff --git a/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 index 0ae1e56..037a724 100644 --- a/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 +++ b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 @@ -101,6 +101,9 @@ http { include /usr/local/etc/letsencrypt/options-ssl-nginx.conf; ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem; + # No error logging for static files + error_log off; + location / { root {{ route.static }}; index index.html; |