diff options
| -rw-r--r-- | playbook.yml | 6 | ||||
| -rw-r--r-- | templates/ingress/usr_local_etc_nginx_nginx.conf.j2 | 36 |
2 files changed, 36 insertions, 6 deletions
diff --git a/playbook.yml b/playbook.yml index 9db68e9..c1923fb 100644 --- a/playbook.yml +++ b/playbook.yml @@ -42,16 +42,14 @@ - { name: veetibot, num: 5 } - { name: hommabot, num: 6 } - { name: aggro, num: 7 } - - { name: diddle, num: 8 } + - { name: diddle, num: 8, tls: true } - { name: gallery_sakari, num: 9 } - { name: gallery_leo, num: 10 } - { name: spliit, num: 11 } - { name: stirling-pdf, num: 12 } - { name: ente, num: 13 } static_sites: - - { site: "homepage", host: "jan.systems", tls: false } - - { site: "homepage", host: "pursotin.jan.systems", tls: true } - - { site: "homepage", host: "local.jan.systems", tls: false } + - { site: "homepage", host: "jan.systems", tls: true } static_site_dirs: homepage: "{{ lookup('env', 'JAN_SYSTEMS_HTML_DIR') }}" diff --git a/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 index cee7878..9f20a5f 100644 --- a/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 +++ b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 @@ -47,7 +47,6 @@ http { include /usr/local/etc/letsencrypt/options-ssl-nginx.conf; ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem; } - {% endif -%} server { listen 80; @@ -58,12 +57,45 @@ http { access_log /var/log/nginx/{{ site.site }}/access.log; error_log /var/log/nginx/{{ site.site }}/error.log; } + {% else %} + server { + server_name {{ site.host }}; + root /usr/local/www/{{ site.site }}; + + listen 80; + http2 on; + + index index.html; + + location / { + try_files $uri $uri.html $uri/ =404; + } + + access_log /var/log/nginx/{{ site.site }}/access.log; + error_log /var/log/nginx/{{ site.site }}/error.log; + } + {% endif -%} {% endfor -%} {% for jail in jails -%} server { + server_name {{ jail.name }}.jan.systems; + http2 on; + + {% if "tls" in jail and jail.tls -%} + listen 443 ssl; + listen [::]:443 ssl; + + # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7 + add_header Strict-Transport-Security "max-age=63072000" always; + + ssl_certificate /usr/local/etc/letsencrypt/live/{{ jail.name }}.jan.systems/fullchain.pem; + ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ jail.name }}.jan.systems/privkey.pem; + include /usr/local/etc/letsencrypt/options-ssl-nginx.conf; + ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem; + {% else %} listen 80; - server_name {{ jail.name }}.jan.systems {{ jail.name }}.local.jan.systems; + {% endif %} location / { proxy_pass http://192.168.2.{{ jail.num }}; |