diff options
Diffstat (limited to 'templates')
| -rw-r--r-- | templates/etc_pf.conf.j2 | 1 | ||||
| -rw-r--r-- | templates/ingress/etc_crontab.j2 | 4 | ||||
| -rw-r--r-- | templates/ingress/usr_local_etc_nginx_nginx.conf.j2 | 96 |
3 files changed, 21 insertions, 80 deletions
diff --git a/templates/etc_pf.conf.j2 b/templates/etc_pf.conf.j2 index a439702..ceae731 100644 --- a/templates/etc_pf.conf.j2 +++ b/templates/etc_pf.conf.j2 @@ -1,6 +1,5 @@ lan_if = "lan0" wan_if = "wan0" -jail_ingress_ip = "{{ jail_ingress_ip }}" # Default policy set skip on lo diff --git a/templates/ingress/etc_crontab.j2 b/templates/ingress/etc_crontab.j2 index 8fd559e..46d6b93 100644 --- a/templates/ingress/etc_crontab.j2 +++ b/templates/ingress/etc_crontab.j2 @@ -7,8 +7,8 @@ PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin #minute hour mday month wday who command # Update LetsEncrypt certificates every day after 2:00 AM -{% for item in items %} -{{ loop.index0 }} 2 * * * root certbot certonly --nginx -n -m jan@jantuomi.fi --agree-tos -d {{ item }} +{% for host in tls_hosts %} +{{ loop.index0 }} 2 * * * root certbot certonly --nginx -n -m jan@jantuomi.fi --agree-tos -d {{ host }} {% endfor %} # Update dynamic DNS (Hetzner) diff --git a/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 index 04c43db..5df15d2 100644 --- a/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 +++ b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 @@ -20,109 +20,51 @@ http { } } - {% for site in static_sites -%} - {% if site.tls -%} + {% for route in ingress_routes -%} + {% if route.jail is defined -%} + {% for jail in jails if jail.name == route.jail -%} server { - server_name {{ site.host }}; - root /usr/local/www/{{ site.site }}; + server_name {{ route.host }}; + http2 on; listen 443 ssl; listen [::]:443 ssl; - http2 on; - - index index.html; - - location / { - try_files $uri $uri.html $uri/ =404; - } # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7 add_header Strict-Transport-Security "max-age=63072000" always; - access_log /var/log/nginx/{{ site.site }}/access.log; - error_log /var/log/nginx/{{ site.site }}/error.log; - - ssl_certificate /usr/local/etc/letsencrypt/live/{{ site.host }}/fullchain.pem; - ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ site.host }}/privkey.pem; + ssl_certificate /usr/local/etc/letsencrypt/live/{{ route.host }}/fullchain.pem; + ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ route.host }}/privkey.pem; include /usr/local/etc/letsencrypt/options-ssl-nginx.conf; ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem; - } - - server { - listen 80; - server_name {{ site.host }}; - - return 301 https://$host$request_uri; - - access_log /var/log/nginx/{{ site.site }}/access.log; - error_log /var/log/nginx/{{ site.site }}/error.log; - } - {% else %} - server { - server_name {{ site.host }}; - root /usr/local/www/{{ site.site }}; - - listen 80; - http2 on; - - index index.html; location / { - try_files $uri $uri.html $uri/ =404; + proxy_pass http://192.168.2.{{ jail.num }}; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; } - - access_log /var/log/nginx/{{ site.site }}/access.log; - error_log /var/log/nginx/{{ site.site }}/error.log; } - {% endif -%} - - {# TODO: parameterize this properly -#} - server { - server_name jantuomi.fi; - http2 on; - - listen 443 ssl; - listen [::]:443 ssl; - - # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7 - add_header Strict-Transport-Security "max-age=63072000" always; - - ssl_certificate /usr/local/etc/letsencrypt/live/jantuomi.fi/fullchain.pem; - ssl_certificate_key /usr/local/etc/letsencrypt/live/jantuomi.fi/privkey.pem; - include /usr/local/etc/letsencrypt/options-ssl-nginx.conf; - ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem; - - return 307 https://jan.systems$request_uri; - } - - {% endfor -%} - {% for jail in jails -%} + {% endfor %} + {% elif route.redirect is defined -%} server { - server_name {{ jail.name }}.jan.systems; + server_name {{ route.host }}; http2 on; - {% if "tls" in jail and jail.tls -%} listen 443 ssl; listen [::]:443 ssl; # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7 add_header Strict-Transport-Security "max-age=63072000" always; - ssl_certificate /usr/local/etc/letsencrypt/live/{{ jail.name }}.jan.systems/fullchain.pem; - ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ jail.name }}.jan.systems/privkey.pem; + ssl_certificate /usr/local/etc/letsencrypt/live/{{ route.host }}/fullchain.pem; + ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ route.host }}/privkey.pem; include /usr/local/etc/letsencrypt/options-ssl-nginx.conf; ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem; - {% else %} - listen 80; - {% endif %} - location / { - proxy_pass http://192.168.2.{{ jail.num }}; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - } + return 307 https://{{ route.redirect }}$request_uri; } + {% endif %} {% endfor %} } |