diff options
Diffstat (limited to 'roles/jails')
6 files changed, 78 insertions, 13 deletions
diff --git a/roles/jails/01_ingress/defaults/main.yml b/roles/jails/01_ingress/defaults/main.yml index 0ec6006..5a187a1 100644 --- a/roles/jails/01_ingress/defaults/main.yml +++ b/roles/jails/01_ingress/defaults/main.yml @@ -27,6 +27,8 @@ ingress_routes: - { host: komga.jan.systems, jail: komga } - { host: poudriere.jan.systems, jail: poudriere_repo } - { host: forge.jan.systems, jail: forge } + - { host: marikajajan.fi, jail: marikajajan } + - { host: www.marikajajan.fi, jail: marikajajan } cert_domains: - "jan.systems" @@ -37,6 +39,8 @@ cert_domains: - "*.sydanviita.fi" - "leolalla.fi" - "*.leolalla.fi" + - "marikajajan.fi" + - "*.marikajajan.fi" cert_name: "{{ cert_domains[0] }}" contact_email: jan@sydanviita.fi @@ -49,6 +53,7 @@ pkg: - nginx - py312-certbot - py312-certbot-nginx + - curl files: - src: acme-dns-auth.py diff --git a/roles/jails/22_forge/templates/usr_local_etc_nginx_nginx.conf.j2 b/roles/jails/22_forge/templates/usr_local_etc_nginx_nginx.conf.j2 index c154f2c..d8c44eb 100644 --- a/roles/jails/22_forge/templates/usr_local_etc_nginx_nginx.conf.j2 +++ b/roles/jails/22_forge/templates/usr_local_etc_nginx_nginx.conf.j2 @@ -15,19 +15,27 @@ http { server_name _; root /usr/local/www/cgit; - try_files $uri @cgit; + + # Block HTTP access to private (dot-prefixed) repos + location ~ ^/\..+ { + return 403; + } # Anonymous git HTTP clone - location ~ ^/(.+\.git)/(HEAD|info/refs|objects/.*|git-upload-pack)$ { + location ~ ^/(.+\.git)/(info/refs|git-upload-pack)$ { include fastcgi_params; - fastcgi_param SCRIPT_FILENAME /usr/local/bin/git-http-backend; - fastcgi_param GIT_HTTP_EXPORT_ALL ""; + fastcgi_param SCRIPT_FILENAME /usr/local/libexec/git-core/git-http-backend; + fastcgi_param GIT_HTTP_EXPORT_ALL 1; fastcgi_param GIT_PROJECT_ROOT /var/db/repos; fastcgi_param GIT_CONFIG_GLOBAL /usr/local/etc/git/gitconfig-www; - fastcgi_param PATH_INFO /$1/$2; + fastcgi_param PATH_INFO $uri; fastcgi_pass unix:/var/run/fcgiwrap/fcgiwrap.sock; } + location / { + try_files $uri @cgit; + } + location @cgit { include fastcgi_params; fastcgi_param SCRIPT_FILENAME /usr/local/www/cgit/cgit.cgi; @@ -36,13 +44,5 @@ http { fastcgi_param GIT_CONFIG_GLOBAL /usr/local/etc/git/gitconfig-www; fastcgi_pass unix:/var/run/fcgiwrap/fcgiwrap.sock; } - - location /cgit.css { - root /usr/local/www/cgit; - } - - location /cgit.png { - root /usr/local/www/cgit; - } } } diff --git a/roles/jails/23_marikajajan/defaults/main.yml b/roles/jails/23_marikajajan/defaults/main.yml new file mode 100644 index 0000000..0a96f97 --- /dev/null +++ b/roles/jails/23_marikajajan/defaults/main.yml @@ -0,0 +1,21 @@ +userland: "15.1-RELEASE" + +zfs: + - name: marikajajan_html + owner: "80" # www + group: "80" + +nullfs: + - src: marikajajan_html + dst: /var/www/marikajajan + +pkg: + - pcre2 + - nginx + +files: + - src: usr_local_etc_nginx_nginx.conf.j2 + dest: /usr/local/etc/nginx/nginx.conf + +services: + - nginx diff --git a/roles/jails/23_marikajajan/handlers/main.yml b/roles/jails/23_marikajajan/handlers/main.yml new file mode 100644 index 0000000..ed97d53 --- /dev/null +++ b/roles/jails/23_marikajajan/handlers/main.yml @@ -0,0 +1 @@ +--- diff --git a/roles/jails/23_marikajajan/tasks/main.yml b/roles/jails/23_marikajajan/tasks/main.yml new file mode 100644 index 0000000..690eb5a --- /dev/null +++ b/roles/jails/23_marikajajan/tasks/main.yml @@ -0,0 +1,7 @@ +- import_role: + name: jail + tasks_from: jail_setup + +- import_role: + name: jail + tasks_from: jail_launch diff --git a/roles/jails/23_marikajajan/templates/usr_local_etc_nginx_nginx.conf.j2 b/roles/jails/23_marikajajan/templates/usr_local_etc_nginx_nginx.conf.j2 new file mode 100644 index 0000000..24f6a01 --- /dev/null +++ b/roles/jails/23_marikajajan/templates/usr_local_etc_nginx_nginx.conf.j2 @@ -0,0 +1,31 @@ +worker_processes auto; + +events { + worker_connections 1024; +} + +http { + include mime.types; + default_type application/octet-stream; + + sendfile on; + keepalive_timeout 65; + + server { + listen 80; + server_name www.marikajajan.fi; + return 301 http://marikajajan.fi$request_uri; + } + + server { + listen 80; + server_name marikajajan.fi; + + root /var/www/marikajajan; + index index.html; + + location / { + try_files $uri $uri/ =404; + } + } +} |