1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
|
userland: "15.0-RELEASE"
devfs_ruleset: 6
no_default_route: true
ingress_routes:
- { host: jan.systems, jail: homepage }
- { host: jantuomi.fi, redirect: jan.systems }
- { host: aggro.jan.systems, jail: aggro }
- { host: diddle.jan.systems, jail: diddle }
- { host: spliit.jan.systems, jail: spliit }
- { host: freshrss.jan.systems, jail: freshrss }
- { host: irc.jan.systems, jail: irc_thelounge, presets: [websocket] }
- { host: paste.jan.systems, jail: paste }
- { host: leolalla.fi, jail: leolalla_fi }
- { host: immich.jan.systems, ip: 192.168.3.3, port: 2283 }
- { host: plex.jan.systems, jail: plex, port: 32400, presets: [streaming] }
- { host: komga.jan.systems, jail: komga, port: 25600 }
cert_domains:
- "jan.systems"
- "*.jan.systems"
- "jantuomi.fi"
- "*.jantuomi.fi"
- "leolalla.fi"
- "*.leolalla.fi"
cert_name: "{{ cert_domains[0] }}"
contact_email: jan@jantuomi.fi
jail_conf_options:
- "allow.raw_sockets"
nullfs:
- src: /usr/local/jails/volumes/goaccess_www
dst: /mnt/www_goaccess
pkg:
- nginx
- py311-certbot
- py311-certbot-nginx
- goaccess
files:
- src: etc_pf.conf.j2
dest: /etc/pf.conf
- src: usr_local_etc_nginx_nginx.conf.j2
dest: /usr/local/etc/nginx/nginx.conf
- src: acme-dns-auth.py
dest: /usr/local/bin/acme-dns-auth.py
mode: "0755"
- src: usr_local_bin_hetzner_ddns.sh.j2
dest: /usr/local/bin/hetzner_ddns.sh
mode: "0755"
- src: usr_local_etc_hetzner_auth.j2
dest: /usr/local/etc/hetzner_auth
mode: "0600"
- src: usr_local_bin_gen_goaccess.sh.j2
dest: /usr/local/bin/gen_goaccess.sh
mode: "0755"
- src: etc_crontab.j2
dest: /etc/crontab
services:
- nginx
- pf
sysctl:
- name: net.inet.ip.forwarding
value: "1"
sysrc:
- name: gateway_enable
value: "YES"
nginx_presets:
websocket:
- "proxy_http_version 1.1"
- 'proxy_set_header Connection "Upgrade"'
- "proxy_set_header Upgrade $http_upgrade"
- "proxy_read_timeout 1d"
- "proxy_send_timeout 1d"
- "proxy_buffering off"
- "proxy_request_buffering off"
- "client_max_body_size 100M"
streaming:
- "proxy_http_version 1.1"
- 'proxy_set_header Connection "Upgrade"'
- "proxy_set_header Upgrade $http_upgrade"
- "proxy_redirect off"
- "proxy_buffering off"
- "proxy_read_timeout 3600s"
- "proxy_send_timeout 3600s"
|
