Compare commits
5 Commits
main
..
nginx-role
| Author | SHA1 | Date | |
|---|---|---|---|
 max
|
32b6a49bc8 | ||
|
max
|
cc68a1f863 | ||
|
max
|
4897cdadbd | ||
|
max
|
e0571783ba | ||
|
max
|
c633ead7cc |
@@ -1,97 +0,0 @@
|
|||||||
name: "Bug Report"
|
|
||||||
description: "Report a bug or unexpected behavior to help us improve"
|
|
||||||
title: "[BUG]: "
|
|
||||||
labels: ["bug"]
|
|
||||||
body:
|
|
||||||
- type: markdown
|
|
||||||
attributes:
|
|
||||||
value: |
|
|
||||||
## ⚠️ Before You Begin
|
|
||||||
Please ensure you have:
|
|
||||||
- [ ] Searched existing issues to avoid duplicates
|
|
||||||
- [ ] Confirmed this is a bug, not a question or configuration problem
|
|
||||||
|
|
||||||
- type: textarea
|
|
||||||
id: description
|
|
||||||
attributes:
|
|
||||||
label: "📋 Description"
|
|
||||||
description: "Provide a clear and concise description of the bug"
|
|
||||||
placeholder: "What happened? What did you expect to happen instead?"
|
|
||||||
validations:
|
|
||||||
required: true
|
|
||||||
|
|
||||||
- type: textarea
|
|
||||||
id: reproduction
|
|
||||||
attributes:
|
|
||||||
label: "🔁 Steps to Reproduce"
|
|
||||||
description: "Step-by-step instructions to reproduce the issue"
|
|
||||||
placeholder: |
|
|
||||||
1. Go to '...'
|
|
||||||
2. Click on '....'
|
|
||||||
3. Scroll down to '....'
|
|
||||||
4. See error
|
|
||||||
validations:
|
|
||||||
required: true
|
|
||||||
|
|
||||||
- type: textarea
|
|
||||||
id: expected
|
|
||||||
attributes:
|
|
||||||
label: "✅ Expected Behavior"
|
|
||||||
description: "What you expected to happen"
|
|
||||||
placeholder: "A clear description of what should happen..."
|
|
||||||
validations:
|
|
||||||
required: true
|
|
||||||
|
|
||||||
- type: textarea
|
|
||||||
id: actual
|
|
||||||
attributes:
|
|
||||||
label: "❌ Actual Behavior"
|
|
||||||
description: "What actually happened"
|
|
||||||
placeholder: "Include error messages, stack traces, or unexpected outcomes..."
|
|
||||||
validations:
|
|
||||||
required: true
|
|
||||||
|
|
||||||
- type: textarea
|
|
||||||
id: logs
|
|
||||||
attributes:
|
|
||||||
label: "📄 Logs / Screenshots"
|
|
||||||
description: |
|
|
||||||
Provide relevant logs, error messages, or screenshots.
|
|
||||||
For logs, please use a pastebin and share the URL.
|
|
||||||
**Remember to remove any sensitive information (API keys, passwords, etc.).**
|
|
||||||
placeholder: "Paste logs here or provide a Gist URL..."
|
|
||||||
validations:
|
|
||||||
required: false
|
|
||||||
|
|
||||||
- type: markdown
|
|
||||||
attributes:
|
|
||||||
value: |
|
|
||||||
---
|
|
||||||
## 🖥️ Environment Details
|
|
||||||
Please fill out the relevant information below.
|
|
||||||
|
|
||||||
- type: textarea
|
|
||||||
id: additional
|
|
||||||
attributes:
|
|
||||||
label: "📎 Additional Context"
|
|
||||||
description: "Any other information that might be relevant"
|
|
||||||
placeholder: |
|
|
||||||
- Database type and version (e.g., PostgreSQL 15, SQLite)
|
|
||||||
- Reverse proxy/CDN in use (e.g., Nginx, Cloudflare)
|
|
||||||
- Any custom configuration
|
|
||||||
- Related issues or PRs
|
|
||||||
validations:
|
|
||||||
required: false
|
|
||||||
|
|
||||||
- type: checkboxes
|
|
||||||
id: checklist
|
|
||||||
attributes:
|
|
||||||
label: "✅ Submission Checklist"
|
|
||||||
description: "Please confirm the following before submitting"
|
|
||||||
options:
|
|
||||||
- label: "I have searched for existing issues (open and closed) that report the same problem"
|
|
||||||
required: true
|
|
||||||
- label: "I have provided clear steps to reproduce the issue"
|
|
||||||
required: true
|
|
||||||
- label: "I have included relevant logs or error messages (with sensitive info removed)"
|
|
||||||
required: false
|
|
||||||
@@ -1,118 +0,0 @@
|
|||||||
name: "Feature Request"
|
|
||||||
description: "Suggest a new feature or enhancement for this project"
|
|
||||||
title: "[FEATURE]: "
|
|
||||||
labels: ["enhancement"]
|
|
||||||
body:
|
|
||||||
- type: markdown
|
|
||||||
attributes:
|
|
||||||
value: |
|
|
||||||
## ⚠️ Before You Begin
|
|
||||||
Please ensure you have:
|
|
||||||
- [ ] Searched existing issues (open and closed) to avoid duplicates
|
|
||||||
- [ ] Reviewed the [project documentation](https://git.vmn.su/max/vmn-ansible/wiki) for existing functionality
|
|
||||||
- [ ] Confirmed this is a feature request, not a bug or configuration question
|
|
||||||
|
|
||||||
|
|
||||||
- type: textarea
|
|
||||||
id: problem
|
|
||||||
attributes:
|
|
||||||
label: "🎯 Problem Statement"
|
|
||||||
description: "What problem does this feature solve? What can't you do today?"
|
|
||||||
placeholder: |
|
|
||||||
I'm always frustrated when...
|
|
||||||
Currently, it's hard/impossible to...
|
|
||||||
This feature would help me because...
|
|
||||||
validations:
|
|
||||||
required: true
|
|
||||||
|
|
||||||
- type: textarea
|
|
||||||
id: solution
|
|
||||||
attributes:
|
|
||||||
label: "💡 Proposed Solution"
|
|
||||||
description: "Describe the solution you'd like to see"
|
|
||||||
placeholder: |
|
|
||||||
A clear description of what you want to happen.
|
|
||||||
If you have a specific API, UI, or implementation in mind, describe it here.
|
|
||||||
validations:
|
|
||||||
required: true
|
|
||||||
|
|
||||||
- type: textarea
|
|
||||||
id: alternatives
|
|
||||||
attributes:
|
|
||||||
label: "🔄 Alternatives Considered"
|
|
||||||
description: "What alternative solutions or workarounds have you considered?"
|
|
||||||
placeholder: |
|
|
||||||
- Alternative A: ...
|
|
||||||
- Workaround B: ...
|
|
||||||
- Why these don't fully solve the problem
|
|
||||||
validations:
|
|
||||||
required: false
|
|
||||||
|
|
||||||
- type: textarea
|
|
||||||
id: screenshots
|
|
||||||
attributes:
|
|
||||||
label: "📸 Screenshots"
|
|
||||||
description: "If you can, provide screenshots or diagrams of the proposed feature"
|
|
||||||
placeholder: "Drag and drop images or paste links..."
|
|
||||||
validations:
|
|
||||||
required: false
|
|
||||||
|
|
||||||
- type: markdown
|
|
||||||
attributes:
|
|
||||||
value: |
|
|
||||||
---
|
|
||||||
## 🔧 Implementation Details (Optional)
|
|
||||||
The following sections are for contributors who want to implement this feature.
|
|
||||||
|
|
||||||
- type: textarea
|
|
||||||
id: technical
|
|
||||||
attributes:
|
|
||||||
label: "⚙️ Technical Approach"
|
|
||||||
description: "If you have ideas about how to implement this, share them here"
|
|
||||||
placeholder: |
|
|
||||||
- Which components/modules would be affected?
|
|
||||||
- Any database schema changes?
|
|
||||||
- API design considerations?
|
|
||||||
validations:
|
|
||||||
required: false
|
|
||||||
|
|
||||||
- type: textarea
|
|
||||||
id: acceptance
|
|
||||||
attributes:
|
|
||||||
label: "✅ Acceptance Criteria"
|
|
||||||
description: "What does 'done' look like for this feature?"
|
|
||||||
placeholder: |
|
|
||||||
- [ ] Feature works in the UI
|
|
||||||
- [ ] API endpoints are documented
|
|
||||||
- [ ] Tests are added
|
|
||||||
- [ ] Documentation is updated
|
|
||||||
validations:
|
|
||||||
required: false
|
|
||||||
|
|
||||||
- type: dropdown
|
|
||||||
id: contribution
|
|
||||||
attributes:
|
|
||||||
label: "🤝 Are you willing to contribute this feature?"
|
|
||||||
description: "Knowing if you can help implement this helps us prioritize"
|
|
||||||
options:
|
|
||||||
- "Yes, I can contribute"
|
|
||||||
- "Yes, but I need guidance"
|
|
||||||
- "No, but I can test/review"
|
|
||||||
- "No, I'm just requesting"
|
|
||||||
validations:
|
|
||||||
required: true
|
|
||||||
|
|
||||||
- type: checkboxes
|
|
||||||
id: checklist
|
|
||||||
attributes:
|
|
||||||
label: "✅ Submission Checklist"
|
|
||||||
description: "Please confirm the following before submitting"
|
|
||||||
options:
|
|
||||||
- label: "I have searched for existing issues (open and closed) that request the same feature"
|
|
||||||
required: true
|
|
||||||
- label: "I have explained the problem this feature solves"
|
|
||||||
required: true
|
|
||||||
- label: "I have described a concrete solution or direction"
|
|
||||||
required: true
|
|
||||||
- label: "I have considered alternatives and explained why they fall short"
|
|
||||||
required: false
|
|
||||||
@@ -1,145 +0,0 @@
|
|||||||
name: "Refactor Request"
|
|
||||||
description: "Propose a code restructuring or cleanup with no behavior change"
|
|
||||||
title: "[REFACTOR]: "
|
|
||||||
labels: ["refactoring"]
|
|
||||||
body:
|
|
||||||
- type: markdown
|
|
||||||
attributes:
|
|
||||||
value: |
|
|
||||||
## ⚠️ Before You Begin
|
|
||||||
Please ensure you have:
|
|
||||||
- [ ] Searched existing issues (open and closed) to avoid duplicates
|
|
||||||
- [ ] Reviewed the [project documentation](https://git.vmn.su/max/vmn-ansible/wiki) for architecture guidelines
|
|
||||||
- [ ] Confirmed this is a refactor (code restructuring with NO behavior change), not a bug fix or new feature
|
|
||||||
|
|
||||||
|
|
||||||
- type: textarea
|
|
||||||
id: problem
|
|
||||||
attributes:
|
|
||||||
label: "🎯 Problem Statement"
|
|
||||||
description: "What pain points does the current code cause? Why is this refactor needed?"
|
|
||||||
placeholder: |
|
|
||||||
The current implementation is difficult to maintain because...
|
|
||||||
This code has accumulated technical debt due to...
|
|
||||||
I'm constantly frustrated when working with this module because...
|
|
||||||
validations:
|
|
||||||
required: true
|
|
||||||
|
|
||||||
- type: textarea
|
|
||||||
id: scope
|
|
||||||
attributes:
|
|
||||||
label: "📂 Scope"
|
|
||||||
description: "Which files, modules, or components need refactoring? Be specific."
|
|
||||||
placeholder: |
|
|
||||||
- File paths: `src/auth/`, `internal/handler/`
|
|
||||||
- Component: `UserService` class
|
|
||||||
validations:
|
|
||||||
required: true
|
|
||||||
|
|
||||||
- type: textarea
|
|
||||||
id: current-state
|
|
||||||
attributes:
|
|
||||||
label: "🔍 Current State"
|
|
||||||
description: "Describe the current code structure, its issues, and why it's problematic"
|
|
||||||
placeholder: |
|
|
||||||
- The function `processUser()` is 500+ lines long
|
|
||||||
- Duplicated logic across 3 different files
|
|
||||||
- Mixed concerns (business logic + HTTP handling)
|
|
||||||
- Poor test coverage makes changes risky
|
|
||||||
- Naming is unclear and inconsistent
|
|
||||||
validations:
|
|
||||||
required: true
|
|
||||||
|
|
||||||
- type: textarea
|
|
||||||
id: proposed-changes
|
|
||||||
attributes:
|
|
||||||
label: "💡 Proposed Solution"
|
|
||||||
description: "What should the code look like after the refactor?"
|
|
||||||
placeholder: |
|
|
||||||
- Extract `processUser()` into smaller, focused functions
|
|
||||||
- Consolidate duplicated logic into a shared utility
|
|
||||||
- Separate business logic from HTTP handlers
|
|
||||||
- Introduce interfaces for better testability
|
|
||||||
- Rename variables and functions for clarity
|
|
||||||
validations:
|
|
||||||
required: true
|
|
||||||
|
|
||||||
- type: textarea
|
|
||||||
id: constraints
|
|
||||||
attributes:
|
|
||||||
label: "🚫 Constraints"
|
|
||||||
description: "What must NOT change? Public APIs, behavior, backward compatibility, performance characteristics?"
|
|
||||||
placeholder: |
|
|
||||||
- All public APIs must remain identical
|
|
||||||
- Database schema must not change
|
|
||||||
- External behavior must be identical
|
|
||||||
- Response formats must stay the same
|
|
||||||
- Performance must not degrade
|
|
||||||
validations:
|
|
||||||
required: true
|
|
||||||
|
|
||||||
- type: textarea
|
|
||||||
id: benefits
|
|
||||||
attributes:
|
|
||||||
label: "📈 Expected Benefits"
|
|
||||||
description: "What improvements will this refactor bring?"
|
|
||||||
placeholder: |
|
|
||||||
- Improved maintainability
|
|
||||||
- Better testability
|
|
||||||
- Reduced code duplication
|
|
||||||
- Clearer separation of concerns
|
|
||||||
- Easier onboarding for new contributors
|
|
||||||
validations:
|
|
||||||
required: false
|
|
||||||
|
|
||||||
- type: textarea
|
|
||||||
id: risks
|
|
||||||
attributes:
|
|
||||||
label: "⚠️ Risks & Mitigations"
|
|
||||||
description: "What could go wrong, and how will you mitigate it?"
|
|
||||||
placeholder: |
|
|
||||||
- Risk: Regression bugs
|
|
||||||
Mitigation: Comprehensive test coverage before and after
|
|
||||||
- Risk: Large diff making code review difficult
|
|
||||||
Mitigation: Break into smaller, incremental PRs
|
|
||||||
validations:
|
|
||||||
required: false
|
|
||||||
|
|
||||||
- type: textarea
|
|
||||||
id: alternatives
|
|
||||||
attributes:
|
|
||||||
label: "🔄 Alternatives Considered"
|
|
||||||
description: "What other approaches did you consider, and why did you reject them?"
|
|
||||||
placeholder: |
|
|
||||||
- Alternative A: Complete rewrite — rejected because too risky
|
|
||||||
- Alternative B: Gradual deprecation — rejected because too slow
|
|
||||||
validations:
|
|
||||||
required: false
|
|
||||||
|
|
||||||
- type: dropdown
|
|
||||||
id: contribution
|
|
||||||
attributes:
|
|
||||||
label: "🤝 Are you willing to contribute this refactor?"
|
|
||||||
description: "Knowing if you can help implement this helps us prioritize"
|
|
||||||
options:
|
|
||||||
- "Yes, I can contribute"
|
|
||||||
- "Yes, but I need guidance"
|
|
||||||
- "No, but I can review"
|
|
||||||
- "No, I'm just suggesting"
|
|
||||||
validations:
|
|
||||||
required: true
|
|
||||||
|
|
||||||
- type: checkboxes
|
|
||||||
id: checklist
|
|
||||||
attributes:
|
|
||||||
label: "✅ Submission Checklist"
|
|
||||||
description: "Please confirm the following before submitting"
|
|
||||||
options:
|
|
||||||
- label: "I have searched for existing issues (open and closed) that request the same refactor"
|
|
||||||
required: true
|
|
||||||
- label: "I have clearly explained the problem this refactor solves"
|
|
||||||
required: true
|
|
||||||
- label: "I have described the scope of the refactor (specific files/modules)"
|
|
||||||
required: false
|
|
||||||
- label: "I have identified what must NOT change (APIs, behavior, backward compatibility)"
|
|
||||||
required: false
|
|
||||||
@@ -1,3 +1,20 @@
|
|||||||
# ansible_home
|
# ansible_home
|
||||||
|
|
||||||
My own home services automation repository
|
## How to use it?
|
||||||
|
|
||||||
|
It's better to use a virtual environment to avoid incompatibility issues
|
||||||
|
|
||||||
|
```bash
|
||||||
|
git clone https://git.vmn.su/max/vmn-ansible
|
||||||
|
cd vmn-ansible
|
||||||
|
python3 -m venv .venv
|
||||||
|
source .venv/bin/activate
|
||||||
|
pip install -r requirements.txt
|
||||||
|
ansible-galaxy collection install -r requirements.yaml
|
||||||
|
ansible-galaxy role install -r requirements.yaml
|
||||||
|
ansible-playbook playbooks/deploy_and_set_up_lxc_on_proxmox.yaml --vault-pass-file $VAULT_PASS_PATH -i inventory/localhost.yaml --private-key $SSH_KEY
|
||||||
|
```
|
||||||
|
|
||||||
|
**deploy** playbooks must be used with `inventory/localhost.yaml`, they need access to proxmox host only
|
||||||
|
|
||||||
|
There are also a systemd service and timer under `systemd` directory
|
||||||
|
|||||||
@@ -0,0 +1,15 @@
|
|||||||
|
# PUT NEW BLOCKS STRICTLY BEFORE ANY MATCH BLOCK
|
||||||
|
|
||||||
|
|
||||||
|
# Private keys are NOT distributed via Ansible
|
||||||
|
# They must to be copied manually ONLY to those hosts that need access to others
|
||||||
|
|
||||||
|
# Most of the home major LAN hosts should be accessible with this key
|
||||||
|
Match Host 192.168.0.?
|
||||||
|
User max
|
||||||
|
IdentityFile ~/.ssh/max_regular_key
|
||||||
|
|
||||||
|
# This virtual network has the same hosts range
|
||||||
|
Match Host 10.9.2.?
|
||||||
|
User max
|
||||||
|
IdentityFile ~/.ssh/max_regular_key
|
||||||
@@ -48,6 +48,15 @@
|
|||||||
group: "{{ human_admin_user }}"
|
group: "{{ human_admin_user }}"
|
||||||
mode: u=rw,g=r,o-rwx
|
mode: u=rw,g=r,o-rwx
|
||||||
|
|
||||||
|
- name: Configure ssh client, by pushing the config
|
||||||
|
remote_user: ansible
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: "{{ role_path }}/files/ssh_config"
|
||||||
|
dest: "/home/{{ human_admin_user }}/.ssh/config"
|
||||||
|
owner: "{{ human_admin_user }}"
|
||||||
|
group: "{{ human_admin_user }}"
|
||||||
|
mode: u=rw,g=r,o-rwx
|
||||||
|
|
||||||
|
|
||||||
# WARNING: we've finished with the initial setup, drop ansible key
|
# WARNING: we've finished with the initial setup, drop ansible key
|
||||||
# Push regular user key
|
# Push regular user key
|
||||||
|
|||||||
@@ -0,0 +1 @@
|
|||||||
|
max:$apr1$NPIFdkB/$hya7NW2rdTGEKBDm0PH3g0
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
max:$apr1$/3oBTCwW$u9OMKSD56v8czs5rZ0rDp0
|
||||||
@@ -0,0 +1,27 @@
|
|||||||
|
|
||||||
|
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||||
|
fastcgi_param QUERY_STRING $query_string;
|
||||||
|
fastcgi_param REQUEST_METHOD $request_method;
|
||||||
|
fastcgi_param CONTENT_TYPE $content_type;
|
||||||
|
fastcgi_param CONTENT_LENGTH $content_length;
|
||||||
|
|
||||||
|
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
||||||
|
fastcgi_param REQUEST_URI $request_uri;
|
||||||
|
fastcgi_param DOCUMENT_URI $document_uri;
|
||||||
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
||||||
|
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
||||||
|
fastcgi_param REQUEST_SCHEME $scheme;
|
||||||
|
fastcgi_param HTTPS $https if_not_empty;
|
||||||
|
|
||||||
|
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
||||||
|
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
||||||
|
|
||||||
|
fastcgi_param REMOTE_ADDR $remote_addr;
|
||||||
|
fastcgi_param REMOTE_PORT $remote_port;
|
||||||
|
fastcgi_param REMOTE_USER $remote_user;
|
||||||
|
fastcgi_param SERVER_ADDR $server_addr;
|
||||||
|
fastcgi_param SERVER_PORT $server_port;
|
||||||
|
fastcgi_param SERVER_NAME $server_name;
|
||||||
|
|
||||||
|
# PHP only, required if PHP was built with --enable-force-cgi-redirect
|
||||||
|
fastcgi_param REDIRECT_STATUS 200;
|
||||||
@@ -0,0 +1,57 @@
|
|||||||
|
|
||||||
|
fastcgi_param QUERY_STRING $query_string;
|
||||||
|
fastcgi_param REQUEST_METHOD $request_method;
|
||||||
|
fastcgi_param CONTENT_TYPE $content_type;
|
||||||
|
fastcgi_param CONTENT_LENGTH $content_length;
|
||||||
|
|
||||||
|
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
||||||
|
fastcgi_param REQUEST_URI $request_uri;
|
||||||
|
fastcgi_param DOCUMENT_URI $document_uri;
|
||||||
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
||||||
|
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
||||||
|
fastcgi_param REQUEST_SCHEME $scheme;
|
||||||
|
fastcgi_param HTTPS $https if_not_empty;
|
||||||
|
|
||||||
|
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
||||||
|
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
||||||
|
|
||||||
|
fastcgi_param REMOTE_ADDR $remote_addr;
|
||||||
|
fastcgi_param REMOTE_PORT $remote_port;
|
||||||
|
fastcgi_param REMOTE_USER $remote_user;
|
||||||
|
fastcgi_param SERVER_ADDR $server_addr;
|
||||||
|
fastcgi_param SERVER_PORT $server_port;
|
||||||
|
fastcgi_param SERVER_NAME $server_name;
|
||||||
|
|
||||||
|
# PHP only, required if PHP was built with --enable-force-cgi-redirect
|
||||||
|
fastcgi_param REDIRECT_STATUS 200;
|
||||||
|
|
||||||
|
# !!! Security workaround !!!
|
||||||
|
# Do not use HTTP_HOST as "$http_host".
|
||||||
|
#
|
||||||
|
# "$http_host" is the Host header exactly as supplied by the client.
|
||||||
|
# This is unsafe when a client sends an absolute-form request target together
|
||||||
|
# with a different Host header, for example:
|
||||||
|
#
|
||||||
|
# GET https://example.com/ HTTP/1.1
|
||||||
|
# Host: malformedhost
|
||||||
|
#
|
||||||
|
# In such a case, passing "$http_host" upstream exposes the raw client-supplied
|
||||||
|
# Host value ("malformedhost") to the backend application, even though it does
|
||||||
|
# not match the effective request target. Applications often use HTTP_HOST for
|
||||||
|
# redirects, absolute URL generation, virtual host routing, or security checks;
|
||||||
|
# forwarding the raw Host header can therefore lead to incorrect or unsafe
|
||||||
|
# behaviour.
|
||||||
|
#
|
||||||
|
# Newer nginx versions (since 1.30.0) introduce variables "$is_request_port" and
|
||||||
|
# "$request_port", allowing HTTP_HOST to be constructed as:
|
||||||
|
# $host$is_request_port$request_port
|
||||||
|
#
|
||||||
|
# In stable/oldstable packages we use "$host" as a security workaround.
|
||||||
|
# It avoids forwarding an untrusted raw Host header to the backend.
|
||||||
|
#
|
||||||
|
# Note: this changes behaviour compared to previous versions, because "$host"
|
||||||
|
# does not preserve the client-supplied port, while "$http_host" typically
|
||||||
|
# does. Existing deployments that rely on "$http_host" containing a port number
|
||||||
|
# may therefore break or behave differently after this change.
|
||||||
|
|
||||||
|
fastcgi_param HTTP_HOST $host;
|
||||||
@@ -0,0 +1,101 @@
|
|||||||
|
types {
|
||||||
|
text/html html htm shtml;
|
||||||
|
text/css css;
|
||||||
|
text/xml xml;
|
||||||
|
image/gif gif;
|
||||||
|
image/jpeg jpeg jpg;
|
||||||
|
application/javascript js;
|
||||||
|
application/atom+xml atom;
|
||||||
|
application/rss+xml rss;
|
||||||
|
|
||||||
|
text/mathml mml;
|
||||||
|
text/plain txt;
|
||||||
|
text/vnd.sun.j2me.app-descriptor jad;
|
||||||
|
text/vnd.wap.wml wml;
|
||||||
|
text/x-component htc;
|
||||||
|
|
||||||
|
image/avif avif;
|
||||||
|
image/png png;
|
||||||
|
image/svg+xml svg svgz;
|
||||||
|
image/tiff tif tiff;
|
||||||
|
image/vnd.wap.wbmp wbmp;
|
||||||
|
image/webp webp;
|
||||||
|
image/x-icon ico;
|
||||||
|
image/x-jng jng;
|
||||||
|
image/x-ms-bmp bmp;
|
||||||
|
|
||||||
|
font/woff woff;
|
||||||
|
font/woff2 woff2;
|
||||||
|
|
||||||
|
application/java-archive jar war ear;
|
||||||
|
application/json json;
|
||||||
|
application/mac-binhex40 hqx;
|
||||||
|
application/msword doc;
|
||||||
|
application/pdf pdf;
|
||||||
|
application/postscript ps eps ai;
|
||||||
|
application/rtf rtf;
|
||||||
|
application/vnd.apple.mpegurl m3u8;
|
||||||
|
application/vnd.google-earth.kml+xml kml;
|
||||||
|
application/vnd.google-earth.kmz kmz;
|
||||||
|
application/vnd.ms-excel xls;
|
||||||
|
application/vnd.ms-fontobject eot;
|
||||||
|
application/vnd.ms-powerpoint ppt;
|
||||||
|
application/vnd.oasis.opendocument.graphics odg;
|
||||||
|
application/vnd.oasis.opendocument.presentation odp;
|
||||||
|
application/vnd.oasis.opendocument.spreadsheet ods;
|
||||||
|
application/vnd.oasis.opendocument.text odt;
|
||||||
|
application/vnd.openxmlformats-officedocument.presentationml.presentation
|
||||||
|
pptx;
|
||||||
|
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
|
||||||
|
xlsx;
|
||||||
|
application/vnd.openxmlformats-officedocument.wordprocessingml.document
|
||||||
|
docx;
|
||||||
|
application/vnd.wap.wmlc wmlc;
|
||||||
|
application/wasm wasm;
|
||||||
|
application/x-7z-compressed 7z;
|
||||||
|
application/x-cocoa cco;
|
||||||
|
application/x-java-archive-diff jardiff;
|
||||||
|
application/x-java-jnlp-file jnlp;
|
||||||
|
application/x-makeself run;
|
||||||
|
application/x-perl pl pm;
|
||||||
|
application/x-pilot prc pdb;
|
||||||
|
application/x-rar-compressed rar;
|
||||||
|
application/x-redhat-package-manager rpm;
|
||||||
|
application/x-sea sea;
|
||||||
|
application/x-shockwave-flash swf;
|
||||||
|
application/x-stuffit sit;
|
||||||
|
application/x-tcl tcl tk;
|
||||||
|
application/x-x509-ca-cert der pem crt;
|
||||||
|
application/x-xpinstall xpi;
|
||||||
|
application/xhtml+xml xhtml;
|
||||||
|
application/xslt+xml xsl xslt;
|
||||||
|
application/xspf+xml xspf;
|
||||||
|
application/zip zip;
|
||||||
|
|
||||||
|
application/octet-stream bin exe dll;
|
||||||
|
application/octet-stream deb;
|
||||||
|
application/octet-stream dmg;
|
||||||
|
application/octet-stream iso img;
|
||||||
|
application/octet-stream msi msp msm;
|
||||||
|
|
||||||
|
audio/midi mid midi kar;
|
||||||
|
audio/mpeg mp3;
|
||||||
|
audio/ogg ogg;
|
||||||
|
audio/x-m4a m4a;
|
||||||
|
audio/x-realaudio ra;
|
||||||
|
|
||||||
|
video/3gpp 3gpp 3gp;
|
||||||
|
video/mp2t ts;
|
||||||
|
video/mp4 mp4;
|
||||||
|
video/mpeg mpeg mpg;
|
||||||
|
video/ogg ogv;
|
||||||
|
video/quicktime mov;
|
||||||
|
video/webm webm;
|
||||||
|
video/x-flv flv;
|
||||||
|
video/x-m4v m4v;
|
||||||
|
video/x-matroska mkv;
|
||||||
|
video/x-mng mng;
|
||||||
|
video/x-ms-asf asx asf;
|
||||||
|
video/x-ms-wmv wmv;
|
||||||
|
video/x-msvideo avi;
|
||||||
|
}
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
/usr/share/nginx/modules-available/mod-http-auth-pam.conf
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
/usr/share/nginx/modules-available/mod-http-dav-ext.conf
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
/usr/share/nginx/modules-available/mod-http-echo.conf
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
/usr/share/nginx/modules-available/mod-http-geoip2.conf
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
/usr/share/nginx/modules-available/mod-http-subs-filter.conf
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
/usr/share/nginx/modules-available/mod-http-upstream-fair.conf
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
/usr/share/nginx/modules-available/mod-stream.conf
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
/usr/share/nginx/modules-available/mod-stream-geoip2.conf
|
||||||
@@ -0,0 +1,24 @@
|
|||||||
|
user www-data;
|
||||||
|
worker_processes auto;
|
||||||
|
pid /run/nginx.pid;
|
||||||
|
error_log /var/log/nginx/error.log;
|
||||||
|
include /etc/nginx/modules-enabled/*.conf;
|
||||||
|
|
||||||
|
|
||||||
|
events {
|
||||||
|
worker_connections 768;
|
||||||
|
}
|
||||||
|
|
||||||
|
http {
|
||||||
|
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||||
|
'$status $body_bytes_sent "$http_referer" '
|
||||||
|
'"$http_user_agent"';
|
||||||
|
include /etc/nginx/conf.d/*.conf;
|
||||||
|
|
||||||
|
# Hide NGINX version from responses
|
||||||
|
server_tokens off;
|
||||||
|
# Use modern TLS protocols only
|
||||||
|
ssl_protocols TLSv1.2 TLSv1.3;
|
||||||
|
ssl_prefer_server_ciphers on;
|
||||||
|
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
|
||||||
|
}
|
||||||
@@ -0,0 +1,33 @@
|
|||||||
|
# !!! Security workaround !!!
|
||||||
|
# Do not set the `Host` header as "$http_host".
|
||||||
|
#
|
||||||
|
# "$http_host" is the Host header exactly as supplied by the client.
|
||||||
|
# This is unsafe when a client sends an absolute-form request target together
|
||||||
|
# with a different Host header, for example:
|
||||||
|
#
|
||||||
|
# GET https://example.com/ HTTP/1.1
|
||||||
|
# Host: malformedhost
|
||||||
|
#
|
||||||
|
# In such a case, passing "$http_host" upstream exposes the raw client-supplied
|
||||||
|
# Host value ("malformedhost") to the backend application, even though it does
|
||||||
|
# not match the effective request target. Applications often use HTTP_HOST for
|
||||||
|
# redirects, absolute URL generation, virtual host routing, or security checks;
|
||||||
|
# forwarding the raw Host header can therefore lead to incorrect or unsafe
|
||||||
|
# behaviour.
|
||||||
|
#
|
||||||
|
# Newer nginx versions (since 1.30.0) introduce variables "$is_request_port" and
|
||||||
|
# "$request_port", allowing `Host` to be constructed as:
|
||||||
|
# $host$is_request_port$request_port
|
||||||
|
#
|
||||||
|
# In stable/oldstable packages we use "$host" as a security workaround.
|
||||||
|
# It avoids forwarding an untrusted raw Host header to the backend.
|
||||||
|
#
|
||||||
|
# Note: this changes behaviour compared to previous versions, because "$host"
|
||||||
|
# does not preserve the client-supplied port, while "$http_host" typically
|
||||||
|
# does. Existing deployments that rely on "$http_host" containing a port number
|
||||||
|
# may therefore break or behave differently after this change.
|
||||||
|
|
||||||
|
proxy_set_header Host $host;
|
||||||
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
/srv/http/default/snippets/error_pages.conf
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
/srv/http/default/snippets/error_pages_content.conf
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
# regex to split $uri to $fastcgi_script_name and $fastcgi_path
|
||||||
|
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
|
||||||
|
|
||||||
|
# Check that the PHP script exists before passing it
|
||||||
|
try_files $fastcgi_script_name =404;
|
||||||
|
|
||||||
|
# Bypass the fact that try_files resets $fastcgi_path_info
|
||||||
|
# see: http://trac.nginx.org/nginx/ticket/321
|
||||||
|
set $path_info $fastcgi_path_info;
|
||||||
|
fastcgi_param PATH_INFO $path_info;
|
||||||
|
|
||||||
|
fastcgi_index index.php;
|
||||||
|
include fastcgi.conf;
|
||||||
@@ -0,0 +1,30 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
- name: Install NGINX on apt-based systems
|
||||||
|
become: true
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name: nginx
|
||||||
|
state: present
|
||||||
|
update_cache: true
|
||||||
|
|
||||||
|
- name: Enable systemd service
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: nginx
|
||||||
|
state: started
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
# We don't want to activate this config right away, so push it after service started
|
||||||
|
- name: Configure NGINX, by pushing the config directory
|
||||||
|
become: true
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: "{{ role_path }}/files/nginx"
|
||||||
|
dst: "/etc/nginx"
|
||||||
|
|
||||||
|
- name: Install custom error pages
|
||||||
|
become: true
|
||||||
|
ansible.builtin.shell: |
|
||||||
|
mkdir -p /srv/http/default
|
||||||
|
git clone https://github.com/denysvitali/nginx-error-pages /srv/http/default
|
||||||
|
ln -s /srv/http/default/snippets/error_pages.conf /etc/nginx/snippets/error_pages.conf
|
||||||
|
ln -s /srv/http/default/snippets/error_pages_content.conf /etc/nginx/snippets/error_pages_content.conf
|
||||||
|
|
||||||
Reference in New Issue
Block a user