Compare commits
2 Commits
nginx-role
..
main
| Author | SHA1 | Date | |
|---|---|---|---|
 max
|
2fccf20768 | ||
|
max
|
a5200c8d9b |
@@ -0,0 +1,97 @@
|
|||||||
|
name: "Bug Report"
|
||||||
|
description: "Report a bug or unexpected behavior to help us improve"
|
||||||
|
title: "[BUG]: "
|
||||||
|
labels: ["bug"]
|
||||||
|
body:
|
||||||
|
- type: markdown
|
||||||
|
attributes:
|
||||||
|
value: |
|
||||||
|
## ⚠️ Before You Begin
|
||||||
|
Please ensure you have:
|
||||||
|
- [ ] Searched existing issues to avoid duplicates
|
||||||
|
- [ ] Confirmed this is a bug, not a question or configuration problem
|
||||||
|
|
||||||
|
- type: textarea
|
||||||
|
id: description
|
||||||
|
attributes:
|
||||||
|
label: "📋 Description"
|
||||||
|
description: "Provide a clear and concise description of the bug"
|
||||||
|
placeholder: "What happened? What did you expect to happen instead?"
|
||||||
|
validations:
|
||||||
|
required: true
|
||||||
|
|
||||||
|
- type: textarea
|
||||||
|
id: reproduction
|
||||||
|
attributes:
|
||||||
|
label: "🔁 Steps to Reproduce"
|
||||||
|
description: "Step-by-step instructions to reproduce the issue"
|
||||||
|
placeholder: |
|
||||||
|
1. Go to '...'
|
||||||
|
2. Click on '....'
|
||||||
|
3. Scroll down to '....'
|
||||||
|
4. See error
|
||||||
|
validations:
|
||||||
|
required: true
|
||||||
|
|
||||||
|
- type: textarea
|
||||||
|
id: expected
|
||||||
|
attributes:
|
||||||
|
label: "✅ Expected Behavior"
|
||||||
|
description: "What you expected to happen"
|
||||||
|
placeholder: "A clear description of what should happen..."
|
||||||
|
validations:
|
||||||
|
required: true
|
||||||
|
|
||||||
|
- type: textarea
|
||||||
|
id: actual
|
||||||
|
attributes:
|
||||||
|
label: "❌ Actual Behavior"
|
||||||
|
description: "What actually happened"
|
||||||
|
placeholder: "Include error messages, stack traces, or unexpected outcomes..."
|
||||||
|
validations:
|
||||||
|
required: true
|
||||||
|
|
||||||
|
- type: textarea
|
||||||
|
id: logs
|
||||||
|
attributes:
|
||||||
|
label: "📄 Logs / Screenshots"
|
||||||
|
description: |
|
||||||
|
Provide relevant logs, error messages, or screenshots.
|
||||||
|
For logs, please use a pastebin and share the URL.
|
||||||
|
**Remember to remove any sensitive information (API keys, passwords, etc.).**
|
||||||
|
placeholder: "Paste logs here or provide a Gist URL..."
|
||||||
|
validations:
|
||||||
|
required: false
|
||||||
|
|
||||||
|
- type: markdown
|
||||||
|
attributes:
|
||||||
|
value: |
|
||||||
|
---
|
||||||
|
## 🖥️ Environment Details
|
||||||
|
Please fill out the relevant information below.
|
||||||
|
|
||||||
|
- type: textarea
|
||||||
|
id: additional
|
||||||
|
attributes:
|
||||||
|
label: "📎 Additional Context"
|
||||||
|
description: "Any other information that might be relevant"
|
||||||
|
placeholder: |
|
||||||
|
- Database type and version (e.g., PostgreSQL 15, SQLite)
|
||||||
|
- Reverse proxy/CDN in use (e.g., Nginx, Cloudflare)
|
||||||
|
- Any custom configuration
|
||||||
|
- Related issues or PRs
|
||||||
|
validations:
|
||||||
|
required: false
|
||||||
|
|
||||||
|
- type: checkboxes
|
||||||
|
id: checklist
|
||||||
|
attributes:
|
||||||
|
label: "✅ Submission Checklist"
|
||||||
|
description: "Please confirm the following before submitting"
|
||||||
|
options:
|
||||||
|
- label: "I have searched for existing issues (open and closed) that report the same problem"
|
||||||
|
required: true
|
||||||
|
- label: "I have provided clear steps to reproduce the issue"
|
||||||
|
required: true
|
||||||
|
- label: "I have included relevant logs or error messages (with sensitive info removed)"
|
||||||
|
required: false
|
||||||
@@ -0,0 +1,118 @@
|
|||||||
|
name: "Feature Request"
|
||||||
|
description: "Suggest a new feature or enhancement for this project"
|
||||||
|
title: "[FEATURE]: "
|
||||||
|
labels: ["enhancement"]
|
||||||
|
body:
|
||||||
|
- type: markdown
|
||||||
|
attributes:
|
||||||
|
value: |
|
||||||
|
## ⚠️ Before You Begin
|
||||||
|
Please ensure you have:
|
||||||
|
- [ ] Searched existing issues (open and closed) to avoid duplicates
|
||||||
|
- [ ] Reviewed the [project documentation](https://git.vmn.su/max/vmn-ansible/wiki) for existing functionality
|
||||||
|
- [ ] Confirmed this is a feature request, not a bug or configuration question
|
||||||
|
|
||||||
|
|
||||||
|
- type: textarea
|
||||||
|
id: problem
|
||||||
|
attributes:
|
||||||
|
label: "🎯 Problem Statement"
|
||||||
|
description: "What problem does this feature solve? What can't you do today?"
|
||||||
|
placeholder: |
|
||||||
|
I'm always frustrated when...
|
||||||
|
Currently, it's hard/impossible to...
|
||||||
|
This feature would help me because...
|
||||||
|
validations:
|
||||||
|
required: true
|
||||||
|
|
||||||
|
- type: textarea
|
||||||
|
id: solution
|
||||||
|
attributes:
|
||||||
|
label: "💡 Proposed Solution"
|
||||||
|
description: "Describe the solution you'd like to see"
|
||||||
|
placeholder: |
|
||||||
|
A clear description of what you want to happen.
|
||||||
|
If you have a specific API, UI, or implementation in mind, describe it here.
|
||||||
|
validations:
|
||||||
|
required: true
|
||||||
|
|
||||||
|
- type: textarea
|
||||||
|
id: alternatives
|
||||||
|
attributes:
|
||||||
|
label: "🔄 Alternatives Considered"
|
||||||
|
description: "What alternative solutions or workarounds have you considered?"
|
||||||
|
placeholder: |
|
||||||
|
- Alternative A: ...
|
||||||
|
- Workaround B: ...
|
||||||
|
- Why these don't fully solve the problem
|
||||||
|
validations:
|
||||||
|
required: false
|
||||||
|
|
||||||
|
- type: textarea
|
||||||
|
id: screenshots
|
||||||
|
attributes:
|
||||||
|
label: "📸 Screenshots"
|
||||||
|
description: "If you can, provide screenshots or diagrams of the proposed feature"
|
||||||
|
placeholder: "Drag and drop images or paste links..."
|
||||||
|
validations:
|
||||||
|
required: false
|
||||||
|
|
||||||
|
- type: markdown
|
||||||
|
attributes:
|
||||||
|
value: |
|
||||||
|
---
|
||||||
|
## 🔧 Implementation Details (Optional)
|
||||||
|
The following sections are for contributors who want to implement this feature.
|
||||||
|
|
||||||
|
- type: textarea
|
||||||
|
id: technical
|
||||||
|
attributes:
|
||||||
|
label: "⚙️ Technical Approach"
|
||||||
|
description: "If you have ideas about how to implement this, share them here"
|
||||||
|
placeholder: |
|
||||||
|
- Which components/modules would be affected?
|
||||||
|
- Any database schema changes?
|
||||||
|
- API design considerations?
|
||||||
|
validations:
|
||||||
|
required: false
|
||||||
|
|
||||||
|
- type: textarea
|
||||||
|
id: acceptance
|
||||||
|
attributes:
|
||||||
|
label: "✅ Acceptance Criteria"
|
||||||
|
description: "What does 'done' look like for this feature?"
|
||||||
|
placeholder: |
|
||||||
|
- [ ] Feature works in the UI
|
||||||
|
- [ ] API endpoints are documented
|
||||||
|
- [ ] Tests are added
|
||||||
|
- [ ] Documentation is updated
|
||||||
|
validations:
|
||||||
|
required: false
|
||||||
|
|
||||||
|
- type: dropdown
|
||||||
|
id: contribution
|
||||||
|
attributes:
|
||||||
|
label: "🤝 Are you willing to contribute this feature?"
|
||||||
|
description: "Knowing if you can help implement this helps us prioritize"
|
||||||
|
options:
|
||||||
|
- "Yes, I can contribute"
|
||||||
|
- "Yes, but I need guidance"
|
||||||
|
- "No, but I can test/review"
|
||||||
|
- "No, I'm just requesting"
|
||||||
|
validations:
|
||||||
|
required: true
|
||||||
|
|
||||||
|
- type: checkboxes
|
||||||
|
id: checklist
|
||||||
|
attributes:
|
||||||
|
label: "✅ Submission Checklist"
|
||||||
|
description: "Please confirm the following before submitting"
|
||||||
|
options:
|
||||||
|
- label: "I have searched for existing issues (open and closed) that request the same feature"
|
||||||
|
required: true
|
||||||
|
- label: "I have explained the problem this feature solves"
|
||||||
|
required: true
|
||||||
|
- label: "I have described a concrete solution or direction"
|
||||||
|
required: true
|
||||||
|
- label: "I have considered alternatives and explained why they fall short"
|
||||||
|
required: false
|
||||||
@@ -0,0 +1,145 @@
|
|||||||
|
name: "Refactor Request"
|
||||||
|
description: "Propose a code restructuring or cleanup with no behavior change"
|
||||||
|
title: "[REFACTOR]: "
|
||||||
|
labels: ["refactoring"]
|
||||||
|
body:
|
||||||
|
- type: markdown
|
||||||
|
attributes:
|
||||||
|
value: |
|
||||||
|
## ⚠️ Before You Begin
|
||||||
|
Please ensure you have:
|
||||||
|
- [ ] Searched existing issues (open and closed) to avoid duplicates
|
||||||
|
- [ ] Reviewed the [project documentation](https://git.vmn.su/max/vmn-ansible/wiki) for architecture guidelines
|
||||||
|
- [ ] Confirmed this is a refactor (code restructuring with NO behavior change), not a bug fix or new feature
|
||||||
|
|
||||||
|
|
||||||
|
- type: textarea
|
||||||
|
id: problem
|
||||||
|
attributes:
|
||||||
|
label: "🎯 Problem Statement"
|
||||||
|
description: "What pain points does the current code cause? Why is this refactor needed?"
|
||||||
|
placeholder: |
|
||||||
|
The current implementation is difficult to maintain because...
|
||||||
|
This code has accumulated technical debt due to...
|
||||||
|
I'm constantly frustrated when working with this module because...
|
||||||
|
validations:
|
||||||
|
required: true
|
||||||
|
|
||||||
|
- type: textarea
|
||||||
|
id: scope
|
||||||
|
attributes:
|
||||||
|
label: "📂 Scope"
|
||||||
|
description: "Which files, modules, or components need refactoring? Be specific."
|
||||||
|
placeholder: |
|
||||||
|
- File paths: `src/auth/`, `internal/handler/`
|
||||||
|
- Component: `UserService` class
|
||||||
|
validations:
|
||||||
|
required: true
|
||||||
|
|
||||||
|
- type: textarea
|
||||||
|
id: current-state
|
||||||
|
attributes:
|
||||||
|
label: "🔍 Current State"
|
||||||
|
description: "Describe the current code structure, its issues, and why it's problematic"
|
||||||
|
placeholder: |
|
||||||
|
- The function `processUser()` is 500+ lines long
|
||||||
|
- Duplicated logic across 3 different files
|
||||||
|
- Mixed concerns (business logic + HTTP handling)
|
||||||
|
- Poor test coverage makes changes risky
|
||||||
|
- Naming is unclear and inconsistent
|
||||||
|
validations:
|
||||||
|
required: true
|
||||||
|
|
||||||
|
- type: textarea
|
||||||
|
id: proposed-changes
|
||||||
|
attributes:
|
||||||
|
label: "💡 Proposed Solution"
|
||||||
|
description: "What should the code look like after the refactor?"
|
||||||
|
placeholder: |
|
||||||
|
- Extract `processUser()` into smaller, focused functions
|
||||||
|
- Consolidate duplicated logic into a shared utility
|
||||||
|
- Separate business logic from HTTP handlers
|
||||||
|
- Introduce interfaces for better testability
|
||||||
|
- Rename variables and functions for clarity
|
||||||
|
validations:
|
||||||
|
required: true
|
||||||
|
|
||||||
|
- type: textarea
|
||||||
|
id: constraints
|
||||||
|
attributes:
|
||||||
|
label: "🚫 Constraints"
|
||||||
|
description: "What must NOT change? Public APIs, behavior, backward compatibility, performance characteristics?"
|
||||||
|
placeholder: |
|
||||||
|
- All public APIs must remain identical
|
||||||
|
- Database schema must not change
|
||||||
|
- External behavior must be identical
|
||||||
|
- Response formats must stay the same
|
||||||
|
- Performance must not degrade
|
||||||
|
validations:
|
||||||
|
required: true
|
||||||
|
|
||||||
|
- type: textarea
|
||||||
|
id: benefits
|
||||||
|
attributes:
|
||||||
|
label: "📈 Expected Benefits"
|
||||||
|
description: "What improvements will this refactor bring?"
|
||||||
|
placeholder: |
|
||||||
|
- Improved maintainability
|
||||||
|
- Better testability
|
||||||
|
- Reduced code duplication
|
||||||
|
- Clearer separation of concerns
|
||||||
|
- Easier onboarding for new contributors
|
||||||
|
validations:
|
||||||
|
required: false
|
||||||
|
|
||||||
|
- type: textarea
|
||||||
|
id: risks
|
||||||
|
attributes:
|
||||||
|
label: "⚠️ Risks & Mitigations"
|
||||||
|
description: "What could go wrong, and how will you mitigate it?"
|
||||||
|
placeholder: |
|
||||||
|
- Risk: Regression bugs
|
||||||
|
Mitigation: Comprehensive test coverage before and after
|
||||||
|
- Risk: Large diff making code review difficult
|
||||||
|
Mitigation: Break into smaller, incremental PRs
|
||||||
|
validations:
|
||||||
|
required: false
|
||||||
|
|
||||||
|
- type: textarea
|
||||||
|
id: alternatives
|
||||||
|
attributes:
|
||||||
|
label: "🔄 Alternatives Considered"
|
||||||
|
description: "What other approaches did you consider, and why did you reject them?"
|
||||||
|
placeholder: |
|
||||||
|
- Alternative A: Complete rewrite — rejected because too risky
|
||||||
|
- Alternative B: Gradual deprecation — rejected because too slow
|
||||||
|
validations:
|
||||||
|
required: false
|
||||||
|
|
||||||
|
- type: dropdown
|
||||||
|
id: contribution
|
||||||
|
attributes:
|
||||||
|
label: "🤝 Are you willing to contribute this refactor?"
|
||||||
|
description: "Knowing if you can help implement this helps us prioritize"
|
||||||
|
options:
|
||||||
|
- "Yes, I can contribute"
|
||||||
|
- "Yes, but I need guidance"
|
||||||
|
- "No, but I can review"
|
||||||
|
- "No, I'm just suggesting"
|
||||||
|
validations:
|
||||||
|
required: true
|
||||||
|
|
||||||
|
- type: checkboxes
|
||||||
|
id: checklist
|
||||||
|
attributes:
|
||||||
|
label: "✅ Submission Checklist"
|
||||||
|
description: "Please confirm the following before submitting"
|
||||||
|
options:
|
||||||
|
- label: "I have searched for existing issues (open and closed) that request the same refactor"
|
||||||
|
required: true
|
||||||
|
- label: "I have clearly explained the problem this refactor solves"
|
||||||
|
required: true
|
||||||
|
- label: "I have described the scope of the refactor (specific files/modules)"
|
||||||
|
required: false
|
||||||
|
- label: "I have identified what must NOT change (APIs, behavior, backward compatibility)"
|
||||||
|
required: false
|
||||||
@@ -1,20 +1,3 @@
|
|||||||
# ansible_home
|
# ansible_home
|
||||||
|
|
||||||
## How to use it?
|
My own home services automation repository
|
||||||
|
|
||||||
It's better to use a virtual environment to avoid incompatibility issues
|
|
||||||
|
|
||||||
```bash
|
|
||||||
git clone https://git.vmn.su/max/vmn-ansible
|
|
||||||
cd vmn-ansible
|
|
||||||
python3 -m venv .venv
|
|
||||||
source .venv/bin/activate
|
|
||||||
pip install -r requirements.txt
|
|
||||||
ansible-galaxy collection install -r requirements.yaml
|
|
||||||
ansible-galaxy role install -r requirements.yaml
|
|
||||||
ansible-playbook playbooks/deploy_and_set_up_lxc_on_proxmox.yaml --vault-pass-file $VAULT_PASS_PATH -i inventory/localhost.yaml --private-key $SSH_KEY
|
|
||||||
```
|
|
||||||
|
|
||||||
**deploy** playbooks must be used with `inventory/localhost.yaml`, they need access to proxmox host only
|
|
||||||
|
|
||||||
There are also a systemd service and timer under `systemd` directory
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
# PUT NEW BLOCKS STRICTLY BEFORE ANY MATCH BLOCK
|
|
||||||
|
|
||||||
|
|
||||||
# Private keys are NOT distributed via Ansible
|
|
||||||
# They must to be copied manually ONLY to those hosts that need access to others
|
|
||||||
|
|
||||||
# Most of the home major LAN hosts should be accessible with this key
|
|
||||||
Match Host 192.168.0.?
|
|
||||||
User max
|
|
||||||
IdentityFile ~/.ssh/max_regular_key
|
|
||||||
|
|
||||||
# This virtual network has the same hosts range
|
|
||||||
Match Host 10.9.2.?
|
|
||||||
User max
|
|
||||||
IdentityFile ~/.ssh/max_regular_key
|
|
||||||
@@ -48,15 +48,6 @@
|
|||||||
group: "{{ human_admin_user }}"
|
group: "{{ human_admin_user }}"
|
||||||
mode: u=rw,g=r,o-rwx
|
mode: u=rw,g=r,o-rwx
|
||||||
|
|
||||||
- name: Configure ssh client, by pushing the config
|
|
||||||
remote_user: ansible
|
|
||||||
ansible.builtin.copy:
|
|
||||||
src: "{{ role_path }}/files/ssh_config"
|
|
||||||
dest: "/home/{{ human_admin_user }}/.ssh/config"
|
|
||||||
owner: "{{ human_admin_user }}"
|
|
||||||
group: "{{ human_admin_user }}"
|
|
||||||
mode: u=rw,g=r,o-rwx
|
|
||||||
|
|
||||||
|
|
||||||
# WARNING: we've finished with the initial setup, drop ansible key
|
# WARNING: we've finished with the initial setup, drop ansible key
|
||||||
# Push regular user key
|
# Push regular user key
|
||||||
|
|||||||
@@ -1 +0,0 @@
|
|||||||
max:$apr1$NPIFdkB/$hya7NW2rdTGEKBDm0PH3g0
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
max:$apr1$/3oBTCwW$u9OMKSD56v8czs5rZ0rDp0
|
|
||||||
@@ -1,27 +0,0 @@
|
|||||||
|
|
||||||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
|
||||||
fastcgi_param QUERY_STRING $query_string;
|
|
||||||
fastcgi_param REQUEST_METHOD $request_method;
|
|
||||||
fastcgi_param CONTENT_TYPE $content_type;
|
|
||||||
fastcgi_param CONTENT_LENGTH $content_length;
|
|
||||||
|
|
||||||
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
|
||||||
fastcgi_param REQUEST_URI $request_uri;
|
|
||||||
fastcgi_param DOCUMENT_URI $document_uri;
|
|
||||||
fastcgi_param DOCUMENT_ROOT $document_root;
|
|
||||||
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
|
||||||
fastcgi_param REQUEST_SCHEME $scheme;
|
|
||||||
fastcgi_param HTTPS $https if_not_empty;
|
|
||||||
|
|
||||||
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
|
||||||
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
|
||||||
|
|
||||||
fastcgi_param REMOTE_ADDR $remote_addr;
|
|
||||||
fastcgi_param REMOTE_PORT $remote_port;
|
|
||||||
fastcgi_param REMOTE_USER $remote_user;
|
|
||||||
fastcgi_param SERVER_ADDR $server_addr;
|
|
||||||
fastcgi_param SERVER_PORT $server_port;
|
|
||||||
fastcgi_param SERVER_NAME $server_name;
|
|
||||||
|
|
||||||
# PHP only, required if PHP was built with --enable-force-cgi-redirect
|
|
||||||
fastcgi_param REDIRECT_STATUS 200;
|
|
||||||
@@ -1,57 +0,0 @@
|
|||||||
|
|
||||||
fastcgi_param QUERY_STRING $query_string;
|
|
||||||
fastcgi_param REQUEST_METHOD $request_method;
|
|
||||||
fastcgi_param CONTENT_TYPE $content_type;
|
|
||||||
fastcgi_param CONTENT_LENGTH $content_length;
|
|
||||||
|
|
||||||
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
|
||||||
fastcgi_param REQUEST_URI $request_uri;
|
|
||||||
fastcgi_param DOCUMENT_URI $document_uri;
|
|
||||||
fastcgi_param DOCUMENT_ROOT $document_root;
|
|
||||||
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
|
||||||
fastcgi_param REQUEST_SCHEME $scheme;
|
|
||||||
fastcgi_param HTTPS $https if_not_empty;
|
|
||||||
|
|
||||||
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
|
||||||
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
|
||||||
|
|
||||||
fastcgi_param REMOTE_ADDR $remote_addr;
|
|
||||||
fastcgi_param REMOTE_PORT $remote_port;
|
|
||||||
fastcgi_param REMOTE_USER $remote_user;
|
|
||||||
fastcgi_param SERVER_ADDR $server_addr;
|
|
||||||
fastcgi_param SERVER_PORT $server_port;
|
|
||||||
fastcgi_param SERVER_NAME $server_name;
|
|
||||||
|
|
||||||
# PHP only, required if PHP was built with --enable-force-cgi-redirect
|
|
||||||
fastcgi_param REDIRECT_STATUS 200;
|
|
||||||
|
|
||||||
# !!! Security workaround !!!
|
|
||||||
# Do not use HTTP_HOST as "$http_host".
|
|
||||||
#
|
|
||||||
# "$http_host" is the Host header exactly as supplied by the client.
|
|
||||||
# This is unsafe when a client sends an absolute-form request target together
|
|
||||||
# with a different Host header, for example:
|
|
||||||
#
|
|
||||||
# GET https://example.com/ HTTP/1.1
|
|
||||||
# Host: malformedhost
|
|
||||||
#
|
|
||||||
# In such a case, passing "$http_host" upstream exposes the raw client-supplied
|
|
||||||
# Host value ("malformedhost") to the backend application, even though it does
|
|
||||||
# not match the effective request target. Applications often use HTTP_HOST for
|
|
||||||
# redirects, absolute URL generation, virtual host routing, or security checks;
|
|
||||||
# forwarding the raw Host header can therefore lead to incorrect or unsafe
|
|
||||||
# behaviour.
|
|
||||||
#
|
|
||||||
# Newer nginx versions (since 1.30.0) introduce variables "$is_request_port" and
|
|
||||||
# "$request_port", allowing HTTP_HOST to be constructed as:
|
|
||||||
# $host$is_request_port$request_port
|
|
||||||
#
|
|
||||||
# In stable/oldstable packages we use "$host" as a security workaround.
|
|
||||||
# It avoids forwarding an untrusted raw Host header to the backend.
|
|
||||||
#
|
|
||||||
# Note: this changes behaviour compared to previous versions, because "$host"
|
|
||||||
# does not preserve the client-supplied port, while "$http_host" typically
|
|
||||||
# does. Existing deployments that rely on "$http_host" containing a port number
|
|
||||||
# may therefore break or behave differently after this change.
|
|
||||||
|
|
||||||
fastcgi_param HTTP_HOST $host;
|
|
||||||
@@ -1,101 +0,0 @@
|
|||||||
types {
|
|
||||||
text/html html htm shtml;
|
|
||||||
text/css css;
|
|
||||||
text/xml xml;
|
|
||||||
image/gif gif;
|
|
||||||
image/jpeg jpeg jpg;
|
|
||||||
application/javascript js;
|
|
||||||
application/atom+xml atom;
|
|
||||||
application/rss+xml rss;
|
|
||||||
|
|
||||||
text/mathml mml;
|
|
||||||
text/plain txt;
|
|
||||||
text/vnd.sun.j2me.app-descriptor jad;
|
|
||||||
text/vnd.wap.wml wml;
|
|
||||||
text/x-component htc;
|
|
||||||
|
|
||||||
image/avif avif;
|
|
||||||
image/png png;
|
|
||||||
image/svg+xml svg svgz;
|
|
||||||
image/tiff tif tiff;
|
|
||||||
image/vnd.wap.wbmp wbmp;
|
|
||||||
image/webp webp;
|
|
||||||
image/x-icon ico;
|
|
||||||
image/x-jng jng;
|
|
||||||
image/x-ms-bmp bmp;
|
|
||||||
|
|
||||||
font/woff woff;
|
|
||||||
font/woff2 woff2;
|
|
||||||
|
|
||||||
application/java-archive jar war ear;
|
|
||||||
application/json json;
|
|
||||||
application/mac-binhex40 hqx;
|
|
||||||
application/msword doc;
|
|
||||||
application/pdf pdf;
|
|
||||||
application/postscript ps eps ai;
|
|
||||||
application/rtf rtf;
|
|
||||||
application/vnd.apple.mpegurl m3u8;
|
|
||||||
application/vnd.google-earth.kml+xml kml;
|
|
||||||
application/vnd.google-earth.kmz kmz;
|
|
||||||
application/vnd.ms-excel xls;
|
|
||||||
application/vnd.ms-fontobject eot;
|
|
||||||
application/vnd.ms-powerpoint ppt;
|
|
||||||
application/vnd.oasis.opendocument.graphics odg;
|
|
||||||
application/vnd.oasis.opendocument.presentation odp;
|
|
||||||
application/vnd.oasis.opendocument.spreadsheet ods;
|
|
||||||
application/vnd.oasis.opendocument.text odt;
|
|
||||||
application/vnd.openxmlformats-officedocument.presentationml.presentation
|
|
||||||
pptx;
|
|
||||||
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
|
|
||||||
xlsx;
|
|
||||||
application/vnd.openxmlformats-officedocument.wordprocessingml.document
|
|
||||||
docx;
|
|
||||||
application/vnd.wap.wmlc wmlc;
|
|
||||||
application/wasm wasm;
|
|
||||||
application/x-7z-compressed 7z;
|
|
||||||
application/x-cocoa cco;
|
|
||||||
application/x-java-archive-diff jardiff;
|
|
||||||
application/x-java-jnlp-file jnlp;
|
|
||||||
application/x-makeself run;
|
|
||||||
application/x-perl pl pm;
|
|
||||||
application/x-pilot prc pdb;
|
|
||||||
application/x-rar-compressed rar;
|
|
||||||
application/x-redhat-package-manager rpm;
|
|
||||||
application/x-sea sea;
|
|
||||||
application/x-shockwave-flash swf;
|
|
||||||
application/x-stuffit sit;
|
|
||||||
application/x-tcl tcl tk;
|
|
||||||
application/x-x509-ca-cert der pem crt;
|
|
||||||
application/x-xpinstall xpi;
|
|
||||||
application/xhtml+xml xhtml;
|
|
||||||
application/xslt+xml xsl xslt;
|
|
||||||
application/xspf+xml xspf;
|
|
||||||
application/zip zip;
|
|
||||||
|
|
||||||
application/octet-stream bin exe dll;
|
|
||||||
application/octet-stream deb;
|
|
||||||
application/octet-stream dmg;
|
|
||||||
application/octet-stream iso img;
|
|
||||||
application/octet-stream msi msp msm;
|
|
||||||
|
|
||||||
audio/midi mid midi kar;
|
|
||||||
audio/mpeg mp3;
|
|
||||||
audio/ogg ogg;
|
|
||||||
audio/x-m4a m4a;
|
|
||||||
audio/x-realaudio ra;
|
|
||||||
|
|
||||||
video/3gpp 3gpp 3gp;
|
|
||||||
video/mp2t ts;
|
|
||||||
video/mp4 mp4;
|
|
||||||
video/mpeg mpeg mpg;
|
|
||||||
video/ogg ogv;
|
|
||||||
video/quicktime mov;
|
|
||||||
video/webm webm;
|
|
||||||
video/x-flv flv;
|
|
||||||
video/x-m4v m4v;
|
|
||||||
video/x-matroska mkv;
|
|
||||||
video/x-mng mng;
|
|
||||||
video/x-ms-asf asx asf;
|
|
||||||
video/x-ms-wmv wmv;
|
|
||||||
video/x-msvideo avi;
|
|
||||||
}
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
/usr/share/nginx/modules-available/mod-http-auth-pam.conf
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
/usr/share/nginx/modules-available/mod-http-dav-ext.conf
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
/usr/share/nginx/modules-available/mod-http-echo.conf
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
/usr/share/nginx/modules-available/mod-http-geoip2.conf
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
/usr/share/nginx/modules-available/mod-http-subs-filter.conf
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
/usr/share/nginx/modules-available/mod-http-upstream-fair.conf
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
/usr/share/nginx/modules-available/mod-stream.conf
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
/usr/share/nginx/modules-available/mod-stream-geoip2.conf
|
|
||||||
@@ -1,24 +0,0 @@
|
|||||||
user www-data;
|
|
||||||
worker_processes auto;
|
|
||||||
pid /run/nginx.pid;
|
|
||||||
error_log /var/log/nginx/error.log;
|
|
||||||
include /etc/nginx/modules-enabled/*.conf;
|
|
||||||
|
|
||||||
|
|
||||||
events {
|
|
||||||
worker_connections 768;
|
|
||||||
}
|
|
||||||
|
|
||||||
http {
|
|
||||||
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
|
||||||
'$status $body_bytes_sent "$http_referer" '
|
|
||||||
'"$http_user_agent"';
|
|
||||||
include /etc/nginx/conf.d/*.conf;
|
|
||||||
|
|
||||||
# Hide NGINX version from responses
|
|
||||||
server_tokens off;
|
|
||||||
# Use modern TLS protocols only
|
|
||||||
ssl_protocols TLSv1.2 TLSv1.3;
|
|
||||||
ssl_prefer_server_ciphers on;
|
|
||||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
|
|
||||||
}
|
|
||||||
@@ -1,33 +0,0 @@
|
|||||||
# !!! Security workaround !!!
|
|
||||||
# Do not set the `Host` header as "$http_host".
|
|
||||||
#
|
|
||||||
# "$http_host" is the Host header exactly as supplied by the client.
|
|
||||||
# This is unsafe when a client sends an absolute-form request target together
|
|
||||||
# with a different Host header, for example:
|
|
||||||
#
|
|
||||||
# GET https://example.com/ HTTP/1.1
|
|
||||||
# Host: malformedhost
|
|
||||||
#
|
|
||||||
# In such a case, passing "$http_host" upstream exposes the raw client-supplied
|
|
||||||
# Host value ("malformedhost") to the backend application, even though it does
|
|
||||||
# not match the effective request target. Applications often use HTTP_HOST for
|
|
||||||
# redirects, absolute URL generation, virtual host routing, or security checks;
|
|
||||||
# forwarding the raw Host header can therefore lead to incorrect or unsafe
|
|
||||||
# behaviour.
|
|
||||||
#
|
|
||||||
# Newer nginx versions (since 1.30.0) introduce variables "$is_request_port" and
|
|
||||||
# "$request_port", allowing `Host` to be constructed as:
|
|
||||||
# $host$is_request_port$request_port
|
|
||||||
#
|
|
||||||
# In stable/oldstable packages we use "$host" as a security workaround.
|
|
||||||
# It avoids forwarding an untrusted raw Host header to the backend.
|
|
||||||
#
|
|
||||||
# Note: this changes behaviour compared to previous versions, because "$host"
|
|
||||||
# does not preserve the client-supplied port, while "$http_host" typically
|
|
||||||
# does. Existing deployments that rely on "$http_host" containing a port number
|
|
||||||
# may therefore break or behave differently after this change.
|
|
||||||
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
/srv/http/default/snippets/error_pages.conf
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
/srv/http/default/snippets/error_pages_content.conf
|
|
||||||
@@ -1,13 +0,0 @@
|
|||||||
# regex to split $uri to $fastcgi_script_name and $fastcgi_path
|
|
||||||
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
|
|
||||||
|
|
||||||
# Check that the PHP script exists before passing it
|
|
||||||
try_files $fastcgi_script_name =404;
|
|
||||||
|
|
||||||
# Bypass the fact that try_files resets $fastcgi_path_info
|
|
||||||
# see: http://trac.nginx.org/nginx/ticket/321
|
|
||||||
set $path_info $fastcgi_path_info;
|
|
||||||
fastcgi_param PATH_INFO $path_info;
|
|
||||||
|
|
||||||
fastcgi_index index.php;
|
|
||||||
include fastcgi.conf;
|
|
||||||
@@ -1,30 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
- name: Install NGINX on apt-based systems
|
|
||||||
become: true
|
|
||||||
ansible.builtin.apt:
|
|
||||||
name: nginx
|
|
||||||
state: present
|
|
||||||
update_cache: true
|
|
||||||
|
|
||||||
- name: Enable systemd service
|
|
||||||
ansible.builtin.service:
|
|
||||||
name: nginx
|
|
||||||
state: started
|
|
||||||
enabled: true
|
|
||||||
|
|
||||||
# We don't want to activate this config right away, so push it after service started
|
|
||||||
- name: Configure NGINX, by pushing the config directory
|
|
||||||
become: true
|
|
||||||
ansible.builtin.copy:
|
|
||||||
src: "{{ role_path }}/files/nginx"
|
|
||||||
dst: "/etc/nginx"
|
|
||||||
|
|
||||||
- name: Install custom error pages
|
|
||||||
become: true
|
|
||||||
ansible.builtin.shell: |
|
|
||||||
mkdir -p /srv/http/default
|
|
||||||
git clone https://github.com/denysvitali/nginx-error-pages /srv/http/default
|
|
||||||
ln -s /srv/http/default/snippets/error_pages.conf /etc/nginx/snippets/error_pages.conf
|
|
||||||
ln -s /srv/http/default/snippets/error_pages_content.conf /etc/nginx/snippets/error_pages_content.conf
|
|
||||||
|
|
||||||
Reference in New Issue
Block a user