diff options
| author | Christian Pointner <equinox@spreadspace.org> | 2020-08-28 21:13:35 +0200 |
|---|---|---|
| committer | Christian Pointner <equinox@spreadspace.org> | 2020-08-28 21:13:35 +0200 |
| commit | 6b115ba61541b4ea158b102e9fe32658894189af (patch) | |
| tree | 66abbef7825b52c084baf82f7645c1235155f9f3 | |
| parent | http|imap-proxy: fix tls encryption to backend (allow TLS1.0) (diff) | |
nginx/vhost: static file template and catchall site for ch-http-proxy
| -rw-r--r-- | chaos-at-home/ch-http-proxy.yml | 33 | ||||
| -rw-r--r-- | roles/nginx/vhost/defaults/main.yml | 16 | ||||
| -rw-r--r-- | roles/nginx/vhost/templates/static-files-with-acme.conf.j2 | 36 |
3 files changed, 83 insertions, 2 deletions
diff --git a/chaos-at-home/ch-http-proxy.yml b/chaos-at-home/ch-http-proxy.yml index 9a80a446..dc57ad6f 100644 --- a/chaos-at-home/ch-http-proxy.yml +++ b/chaos-at-home/ch-http-proxy.yml @@ -11,6 +11,20 @@ - role: nginx/base - role: nginx/vhost nginx_vhost: + default: yes + name: web + template: static-files-with-acme + acme: yes + hostnames: + - web.chaos-at-home.org + root: /var/www/default + index: index.html + acmetool_cert_config: + request: + challenge: + http-self-test: false + - role: nginx/vhost + nginx_vhost: name: webmail template: generic-proxy-no-buffering-with-acme acme: yes @@ -61,6 +75,25 @@ regexp: '^MinProtocol\s*=' line: 'MinProtocol = TLSv1.0' + - name: create directory for default server + file: + path: /var/www/default + state: directory + + - name: install index.html for default server + copy: + dest: /var/www/default/index.html + content: | + <html> + <head> + <title>No Such Site</title> + </head> + <body> + <div style="text-align: center; margin-top: 4em; margin-left:auto; margin-right:auto; font-family: Helvetica, Arial, Sans-Serif;"> + <h2 style="">You have reached the chaos-at-home internal webserver, however the URL that you used is unknown to this host.</h2> + </div> + </body> + </html> # - name: install systemd service unit for service-ip # copy: # dest: /etc/systemd/system/http-service-ip.service diff --git a/roles/nginx/vhost/defaults/main.yml b/roles/nginx/vhost/defaults/main.yml index dfedb50b..eea545c8 100644 --- a/roles/nginx/vhost/defaults/main.yml +++ b/roles/nginx/vhost/defaults/main.yml @@ -4,10 +4,22 @@ # template: generic-proxy-no-buffering-with-acme # acme: yes # hostnames: -# - example.com -# - www.example.com +# - example.com +# - www.example.com # proxy_pass: http://127.0.0.1:8080 +# default: yes # nginx_vhost: # name: other-example # content: "<<< content of vhost >>>" + +# nginx_vhost: +# name: static +# template: static-files-with-acme +# acme: yes +# hostnames: +# - static.example.com +# root: /srv/www/static +# index: index.html +# autoindex: +# format: json diff --git a/roles/nginx/vhost/templates/static-files-with-acme.conf.j2 b/roles/nginx/vhost/templates/static-files-with-acme.conf.j2 new file mode 100644 index 00000000..f99d6eb4 --- /dev/null +++ b/roles/nginx/vhost/templates/static-files-with-acme.conf.j2 @@ -0,0 +1,36 @@ +server { + listen 80{% if 'default' in nginx_vhost and nginx_vhost.default %} default_server{% endif %}; + listen [::]:80{% if 'default' in nginx_vhost and nginx_vhost.default %} default_server{% endif %}; + server_name {{ nginx_vhost.hostnames | join(' ') }}; + + include snippets/acmetool.conf; + + location / { + return 301 https://$host$request_uri; + } +} + +server { + listen 443 ssl http2{% if 'default' in nginx_vhost and nginx_vhost.default %} default_server{% endif %}; + listen [::]:443 ssl http2{% if 'default' in nginx_vhost and nginx_vhost.default %} default_server{% endif %}; + server_name {{ nginx_vhost.hostnames | join(' ') }}; + + include snippets/acmetool.conf; + include snippets/tls{% if 'tls_variant' in nginx_vhost %}-{{ nginx_vhost.tls_variant }}{% endif %}.conf; + ssl_certificate /var/lib/acme/live/{{ nginx_vhost.hostnames[0] }}/fullchain; + ssl_certificate_key /var/lib/acme/live/{{ nginx_vhost.hostnames[0] }}/privkey; + include snippets/hsts.conf; + + location / { + root {{ nginx_vhost.root }}; +{% if 'index' in nginx_vhost %} + index {{ nginx_vhost.index }}; +{% endif %} +{% if 'autoindex' in nginx_vhost %} + autoindex on; +{% if 'format' in nginx_vhost.autoindex %} + autoindex_format {{ nginx_vhost.autoindex.format }}; +{% endif %} +{% endif %} + } +} |