From bc98352d3e331003db625be96139b3c1f95f63b2 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Wed, 9 Aug 2023 14:38:23 +0200
Subject: nginx/vhost: major change in certifcate/tls handling (WIP)

---
 roles/apps/collabora/code/tasks/main.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'roles/apps/collabora/code/tasks')

diff --git a/roles/apps/collabora/code/tasks/main.yml b/roles/apps/collabora/code/tasks/main.yml
index db28bb65..8f4acc76 100644
--- a/roles/apps/collabora/code/tasks/main.yml
+++ b/roles/apps/collabora/code/tasks/main.yml
@@ -53,7 +53,8 @@
     nginx_vhost:
       name: "collabora-code-{{ item.key }}"
       content: "{{ lookup('template', 'nginx-vhost.conf.j2') }}"
-      acme: true
+      tls:
+        certificate_provider: "{{ acme_client }}"
       hostnames:
       - "{{ item.value.hostname }}"
   include_role:
-- 
cgit v1.2.3


From 886a3162765240cade2acd6ec890e0377bd9631d Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Mon, 14 Aug 2023 23:01:11 +0200
Subject: collabora/code: move to generic nginx-vhost template

---
 roles/apps/collabora/code/tasks/main.yml           |  13 +-
 roles/apps/collabora/code/tasks/nginx-vhost.yml    |  16 +++
 .../collabora/code/templates/nginx-vhost.conf.j2   | 153 +++++++++------------
 roles/nginx/vhost/defaults/main.yml                |  14 ++
 roles/nginx/vhost/templates/generic.conf.j2        |  64 +++++----
 5 files changed, 130 insertions(+), 130 deletions(-)
 create mode 100644 roles/apps/collabora/code/tasks/nginx-vhost.yml

(limited to 'roles/apps/collabora/code/tasks')

diff --git a/roles/apps/collabora/code/tasks/main.yml b/roles/apps/collabora/code/tasks/main.yml
index 8f4acc76..84efec5c 100644
--- a/roles/apps/collabora/code/tasks/main.yml
+++ b/roles/apps/collabora/code/tasks/main.yml
@@ -45,17 +45,8 @@
   include_role:
     name: kubernetes/standalone/pod
 
-- name: configure nginx vhost
+- name: install nginx vhost config
   loop: "{{ collabora_code_instances | dict2items }}"
   loop_control:
     label: "{{ item.key }}"
-  vars:
-    nginx_vhost:
-      name: "collabora-code-{{ item.key }}"
-      content: "{{ lookup('template', 'nginx-vhost.conf.j2') }}"
-      tls:
-        certificate_provider: "{{ acme_client }}"
-      hostnames:
-      - "{{ item.value.hostname }}"
-  include_role:
-    name: nginx/vhost
+  include_tasks: nginx-vhost.yml
diff --git a/roles/apps/collabora/code/tasks/nginx-vhost.yml b/roles/apps/collabora/code/tasks/nginx-vhost.yml
new file mode 100644
index 00000000..218b4a94
--- /dev/null
+++ b/roles/apps/collabora/code/tasks/nginx-vhost.yml
@@ -0,0 +1,16 @@
+- name: render nginx-vhost custom config
+  set_fact:
+    collabora_code_nginx_vhost_custom: "{{ lookup('template', 'nginx-vhost.conf.j2') }}"
+
+- name: configure nginx vhost
+  vars:
+    nginx_vhost:
+      name: "collabora-code-{{ item.key }}"
+      template: generic
+      tls:
+        certificate_provider: "{{ acme_client }}"
+      hostnames:
+      - "{{ item.value.hostname }}"
+      custom: "{{ collabora_code_nginx_vhost_custom }}"
+  include_role:
+    name: nginx/vhost
diff --git a/roles/apps/collabora/code/templates/nginx-vhost.conf.j2 b/roles/apps/collabora/code/templates/nginx-vhost.conf.j2
index 8dd67fb7..67502e20 100644
--- a/roles/apps/collabora/code/templates/nginx-vhost.conf.j2
+++ b/roles/apps/collabora/code/templates/nginx-vhost.conf.j2
@@ -1,124 +1,99 @@
-server {
-    listen 80;
-    listen [::]:80;
-    server_name {{ item.value.hostname }};
+client_max_body_size 128M;
 
-    include snippets/{{ acme_client }}.conf;
-
-    location / {
-        return 301 https://$host$request_uri;
-    }
-}
-
-server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
-    server_name {{ item.value.hostname }};
-
-    include snippets/{{ acme_client }}.conf;
-    include snippets/tls.conf;
-    ssl_certificate     {{ x509_certificate_path_fullchain }};
-    ssl_certificate_key {{ x509_certificate_path_key }};
-    include snippets/hsts.conf;
-
-
-    client_max_body_size 128M;
-
-    # static files
+# static files
 {% if item.value.version | collabora_code_loolvcool %}
-    location ^~ /loleaflet {
+location ^~ /loleaflet {
 {% else %}
-    location ^~ /browser {
+location ^~ /browser {
 {% endif %}
-        include snippets/proxy-nobuff.conf;
-        include snippets/proxy-forward-headers.conf;
+    include snippets/proxy-nobuff.conf;
+    include snippets/proxy-forward-headers.conf;
 
-        proxy_set_header Host $http_host;
-        proxy_pass http://127.0.0.1:{{ item.value.port }};
+    proxy_set_header Host $http_host;
+    proxy_pass http://127.0.0.1:{{ item.value.port }};
 
-        proxy_redirect http://$host/ https://$host/;
-        proxy_redirect http://$host:9980/ https://$host/;
-    }
+    proxy_redirect http://$host/ https://$host/;
+    proxy_redirect http://$host:9980/ https://$host/;
+}
 
-    # WOPI discovery URL
-    location ^~ /hosting/discovery {
-        include snippets/proxy-nobuff.conf;
-        include snippets/proxy-forward-headers.conf;
+# WOPI discovery URL
+location ^~ /hosting/discovery {
+    include snippets/proxy-nobuff.conf;
+    include snippets/proxy-forward-headers.conf;
 
-        proxy_set_header Host $http_host;
-        proxy_pass http://127.0.0.1:{{ item.value.port }};
+    proxy_set_header Host $http_host;
+    proxy_pass http://127.0.0.1:{{ item.value.port }};
 
-        proxy_redirect http://$host/ https://$host/;
-        proxy_redirect http://$host:9980/ https://$host/;
-    }
+    proxy_redirect http://$host/ https://$host/;
+    proxy_redirect http://$host:9980/ https://$host/;
+}
 
-    # Capabilities
-    location ^~ /hosting/capabilities {
-        include snippets/proxy-nobuff.conf;
-        include snippets/proxy-forward-headers.conf;
+# Capabilities
+location ^~ /hosting/capabilities {
+    include snippets/proxy-nobuff.conf;
+    include snippets/proxy-forward-headers.conf;
 
-        proxy_set_header Host $http_host;
-        proxy_pass http://127.0.0.1:{{ item.value.port }};
+    proxy_set_header Host $http_host;
+    proxy_pass http://127.0.0.1:{{ item.value.port }};
 
-        proxy_redirect http://$host/ https://$host/;
-        proxy_redirect http://$host:9980/ https://$host/;
-    }
+    proxy_redirect http://$host/ https://$host/;
+    proxy_redirect http://$host:9980/ https://$host/;
+}
 
-    # main websocket
+# main websocket
 {% if item.value.version | collabora_code_loolvcool %}
-    location ~ ^/lool/(.*)/ws$ {
+location ~ ^/lool/(.*)/ws$ {
 {% else %}
-    location ~ ^/cool/(.*)/ws$ {
+location ~ ^/cool/(.*)/ws$ {
 {% endif %}
-        include snippets/proxy-nobuff.conf;
-        include snippets/proxy-forward-headers.conf;
+    include snippets/proxy-nobuff.conf;
+    include snippets/proxy-forward-headers.conf;
 
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection $connection_upgrade;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $connection_upgrade;
 
-        proxy_read_timeout 36000s;
+    proxy_read_timeout 36000s;
 
-        proxy_set_header Host $http_host;
-        proxy_pass http://127.0.0.1:{{ item.value.port }};
+    proxy_set_header Host $http_host;
+    proxy_pass http://127.0.0.1:{{ item.value.port }};
 
-        proxy_redirect http://$host/ https://$host/;
-        proxy_redirect http://$host:9980/ https://$host/;
-    }
+    proxy_redirect http://$host/ https://$host/;
+    proxy_redirect http://$host:9980/ https://$host/;
+}
 
-    # download, presentation and image upload
+# download, presentation and image upload
 {% if item.value.version | collabora_code_loolvcool %}
-    location ~ ^/lool {
+location ~ ^/lool {
 {% else %}
-    location ~ ^/(c|l)ool {
+location ~ ^/(c|l)ool {
 {% endif %}
-        include snippets/proxy-nobuff.conf;
-        include snippets/proxy-forward-headers.conf;
+    include snippets/proxy-nobuff.conf;
+    include snippets/proxy-forward-headers.conf;
 
-        proxy_set_header Host $http_host;
-        proxy_pass http://127.0.0.1:{{ item.value.port }};
+    proxy_set_header Host $http_host;
+    proxy_pass http://127.0.0.1:{{ item.value.port }};
 
-        proxy_redirect http://$host/ https://$host/;
-        proxy_redirect http://$host:9980/ https://$host/;
-    }
+    proxy_redirect http://$host/ https://$host/;
+    proxy_redirect http://$host:9980/ https://$host/;
+}
 
-    # Admin Console websocket
+# Admin Console websocket
 {% if item.value.version | collabora_code_loolvcool %}
-    location ^~ /lool/adminws {
+location ^~ /lool/adminws {
 {% else %}
-    location ^~ /cool/adminws {
+location ^~ /cool/adminws {
 {% endif %}
-        include snippets/proxy-nobuff.conf;
-        include snippets/proxy-forward-headers.conf;
+    include snippets/proxy-nobuff.conf;
+    include snippets/proxy-forward-headers.conf;
 
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection $connection_upgrade;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $connection_upgrade;
 
-        proxy_read_timeout 36000s;
+    proxy_read_timeout 36000s;
 
-        proxy_set_header Host $http_host;
-        proxy_pass http://127.0.0.1:{{ item.value.port }};
+    proxy_set_header Host $http_host;
+    proxy_pass http://127.0.0.1:{{ item.value.port }};
 
-        proxy_redirect http://$host/ https://$host/;
-        proxy_redirect http://$host:9980/ https://$host/;
-    }
+    proxy_redirect http://$host/ https://$host/;
+    proxy_redirect http://$host:9980/ https://$host/;
 }
diff --git a/roles/nginx/vhost/defaults/main.yml b/roles/nginx/vhost/defaults/main.yml
index 1447fb14..0eb67b42 100644
--- a/roles/nginx/vhost/defaults/main.yml
+++ b/roles/nginx/vhost/defaults/main.yml
@@ -59,6 +59,20 @@
 #         fastcgi_param PATH_INFO       $uri;
 #         fastcgi_pass unix:/run/fcgiwrap/foo.sock;
 
+# nginx_vhost:
+#   name: example-custom
+#   template: generic
+#   tls:
+#     variant: legacy
+#     hsts: false
+#     certificate_provider: acmetool
+#   hostnames:
+#   - static.example.com
+#   custom: |-
+#     location / {
+#       foo "bar";
+#     }
+
 # nginx_vhost:
 #   name: other-example
 #   content: "<<< content of vhost >>>"
diff --git a/roles/nginx/vhost/templates/generic.conf.j2 b/roles/nginx/vhost/templates/generic.conf.j2
index 356c74dc..64569a5e 100644
--- a/roles/nginx/vhost/templates/generic.conf.j2
+++ b/roles/nginx/vhost/templates/generic.conf.j2
@@ -47,13 +47,16 @@ server {
 {%   endif %}
 
 {% endif %}
-{% if 'extra_directives' in nginx_vhost %}
-    {{ nginx_vhost.extra_directives | indent(4) }}
+{% if 'custom' in nginx_vhost %}
+    {{ nginx_vhost.custom | trim | indent(4) }}
+{% else %}
+{%   if 'extra_directives' in nginx_vhost %}
+    {{ nginx_vhost.extra_directives | trim | indent(4) }}
 
-{% endif %}
-{% for path, location in nginx_vhost.locations.items() %}
+{%   endif %}
+{%   for path, location in nginx_vhost.locations.items() %}
     location {{ path }} {
-{%   if 'proxy_pass' in location %}
+{%     if 'proxy_pass' in location %}
         include snippets/proxy-nobuff.conf;
         proxy_set_header Host $host;
         include snippets/proxy-forward-headers.conf;
@@ -63,40 +66,41 @@ server {
         proxy_set_header Connection $connection_upgrade;
 
         proxy_pass {{ location.proxy_pass }};
-{%     if 'proxy_redirect' in location %}
-{%       for entry in location.proxy_redirect %}
+{%       if 'proxy_redirect' in location %}
+{%         for entry in location.proxy_redirect %}
         proxy_redirect {{ entry.redirect }} {{ entry.replacement }};
-{%       endfor %}
-{%     endif %}
-{%     if 'proxy_ssl' in location %}
-{%       for prop in (location.proxy_ssl | list | sort)  %}
+{%         endfor %}
+{%       endif %}
+{%       if 'proxy_ssl' in location %}
+{%         for prop in (location.proxy_ssl | list | sort)  %}
         proxy_ssl_{{ prop }} {{ location.proxy_ssl[prop] }};
-{%       endfor %}
-{%     endif %}
-{%   elif 'return' in location %}
+{%         endfor %}
+{%       endif %}
+{%     elif 'return' in location %}
         return {{ location.return }};
-{%   elif 'custom' in location %}
-        {{ location.custom | indent(8) }}
-{%   else %}
-{%     if 'root' in location %}
+{%     elif 'custom' in location %}
+        {{ location.custom | trim | indent(8) }}
+{%     else %}
+{%       if 'root' in location %}
         root {{ location.root }};
-{%     elif 'alias' in location %}
+{%       elif 'alias' in location %}
         alias {{ location.alias }};
-{%     endif %}
-{%     if 'index' in location %}
+{%       endif %}
+{%       if 'index' in location %}
         index {{ location.index }};
-{%     endif %}
-{%     if 'autoindex' in location %}
+{%       endif %}
+{%       if 'autoindex' in location %}
         autoindex on;
-{%       if 'format' in location.autoindex %}
+{%         if 'format' in location.autoindex %}
         autoindex_format {{ nginx_vhost.autoindex.format }};
-{%       endif  %}
+{%         endif  %}
+{%       endif %}
 {%     endif %}
-{%   endif %}
-{%   if 'extra_directives' in location %}
+{%     if 'extra_directives' in location %}
 
-        {{ location.extra_directives | indent(8) }}
-{%   endif %}
+        {{ location.extra_directives | trim | indent(8) }}
+{%     endif %}
     }
-{% endfor %}
+{%   endfor %}
+{% endif %}
 }
-- 
cgit v1.2.3


From 55631d04f68bd4657ee5fb994a1fdfe32329af54 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Mon, 14 Aug 2023 23:35:00 +0200
Subject: etherpad-lite: move to generic nginx-vhost template

---
 roles/apps/collabora/code/tasks/nginx-vhost.yml    |  1 +
 roles/apps/etherpad-lite/tasks/main.yml            | 14 +---
 roles/apps/etherpad-lite/tasks/nginx-vhost.yml     | 16 ++++
 .../etherpad-lite/templates/nginx-vhost.conf.j2    | 88 ++++++++--------------
 4 files changed, 53 insertions(+), 66 deletions(-)
 create mode 100644 roles/apps/etherpad-lite/tasks/nginx-vhost.yml

(limited to 'roles/apps/collabora/code/tasks')

diff --git a/roles/apps/collabora/code/tasks/nginx-vhost.yml b/roles/apps/collabora/code/tasks/nginx-vhost.yml
index 218b4a94..afd8f1e0 100644
--- a/roles/apps/collabora/code/tasks/nginx-vhost.yml
+++ b/roles/apps/collabora/code/tasks/nginx-vhost.yml
@@ -1,3 +1,4 @@
+---
 - name: render nginx-vhost custom config
   set_fact:
     collabora_code_nginx_vhost_custom: "{{ lookup('template', 'nginx-vhost.conf.j2') }}"
diff --git a/roles/apps/etherpad-lite/tasks/main.yml b/roles/apps/etherpad-lite/tasks/main.yml
index 495a0387..a3b167a8 100644
--- a/roles/apps/etherpad-lite/tasks/main.yml
+++ b/roles/apps/etherpad-lite/tasks/main.yml
@@ -108,14 +108,8 @@
   include_role:
     name: kubernetes/standalone/pod
 
-- name: configure nginx vhost
+- name: install nginx vhost config
   loop: "{{ etherpad_lite_instances | dict2items }}"
-  vars:
-    nginx_vhost:
-      name: "etherpad-lite-{{ item.key }}"
-      content: "{{ lookup('template', 'nginx-vhost.conf.j2') }}"
-      tls:
-        certificate_provider: "{{ acme_client }}"
-      hostnames: "{{ item.value.hostnames }}"
-  include_role:
-    name: nginx/vhost
+  loop_control:
+    label: "{{ item.key }}"
+  include_tasks: nginx-vhost.yml
diff --git a/roles/apps/etherpad-lite/tasks/nginx-vhost.yml b/roles/apps/etherpad-lite/tasks/nginx-vhost.yml
new file mode 100644
index 00000000..91c8b54d
--- /dev/null
+++ b/roles/apps/etherpad-lite/tasks/nginx-vhost.yml
@@ -0,0 +1,16 @@
+---
+- name: render nginx-vhost custom config
+  set_fact:
+    etherpad_lite_nginx_vhost_custom: "{{ lookup('template', 'nginx-vhost.conf.j2') }}"
+
+- name: configure nginx vhost
+  vars:
+    nginx_vhost:
+      name: "etherpad-lite-{{ item.key }}"
+      template: generic
+      tls:
+        certificate_provider: "{{ acme_client }}"
+      hostnames: "{{ item.value.hostnames }}"
+      custom: "{{ etherpad_lite_nginx_vhost_custom }}"
+  include_role:
+    name: nginx/vhost
diff --git a/roles/apps/etherpad-lite/templates/nginx-vhost.conf.j2 b/roles/apps/etherpad-lite/templates/nginx-vhost.conf.j2
index c572a7eb..209a81c0 100644
--- a/roles/apps/etherpad-lite/templates/nginx-vhost.conf.j2
+++ b/roles/apps/etherpad-lite/templates/nginx-vhost.conf.j2
@@ -1,57 +1,33 @@
-server {
-    listen 80;
-    listen [::]:80;
-    server_name {{ item.value.hostnames | join(' ') }};
-
-    include snippets/{{ acme_client }}.conf;
-
-    location / {
-        return 301 https://$host$request_uri;
-    }
-}
-
-server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
-    server_name {{ item.value.hostnames | join(' ') }};
-
-    include snippets/{{ acme_client }}.conf;
-    include snippets/tls.conf;
-    ssl_certificate     {{ x509_certificate_path_fullchain }};
-    ssl_certificate_key {{ x509_certificate_path_key }};
-    include snippets/hsts.conf;
-
-    location / {
-        rewrite ^/$ / break;
-        rewrite ^/locales/(.*) /locales/$1 break;
-        rewrite ^/locales.json /locales.json break;
-        rewrite ^/admin(.*) /admin$1 break;
-        rewrite ^/p/(.*) /p/$1 break;
-        rewrite ^/static/(.*) /static/$1 break;
-        rewrite ^/pluginfw/(.*) /pluginfw/$1 break;
-        rewrite ^/javascripts/(.*) /javascripts/$1 break;
-        rewrite ^/socket.io/(.*) /socket.io/$1 break;
-        rewrite ^/ep/(.*) /ep/$1 break;
-        rewrite ^/minified/(.*) /minified/$1 break;
-        rewrite ^/api/(.*) /api/$1 break;
-        rewrite ^/ro/(.*) /ro/$1 break;
-        rewrite ^/error/(.*) /error/$1 break;
-        rewrite ^/jserror(.*) /jserror$1 break;
-        rewrite ^/redirect(.*) /redirect$1 break;
-        rewrite /favicon.ico /favicon.ico break;
-        rewrite /robots.txt /robots.txt break;
-        rewrite /(.*) /p/$1;
-
-        include snippets/proxy-nobuff.conf;
-
-        proxy_set_header Host $host;
-        include snippets/proxy-forward-headers.conf;
-        proxy_pass_header Server;
-
-        # for websockets
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection $connection_upgrade;
-
-        proxy_pass http://127.0.0.1:{{ item.value.port }};
-    }
+location / {
+    rewrite ^/$ / break;
+    rewrite ^/locales/(.*) /locales/$1 break;
+    rewrite ^/locales.json /locales.json break;
+    rewrite ^/admin(.*) /admin$1 break;
+    rewrite ^/p/(.*) /p/$1 break;
+    rewrite ^/static/(.*) /static/$1 break;
+    rewrite ^/pluginfw/(.*) /pluginfw/$1 break;
+    rewrite ^/javascripts/(.*) /javascripts/$1 break;
+    rewrite ^/socket.io/(.*) /socket.io/$1 break;
+    rewrite ^/ep/(.*) /ep/$1 break;
+    rewrite ^/minified/(.*) /minified/$1 break;
+    rewrite ^/api/(.*) /api/$1 break;
+    rewrite ^/ro/(.*) /ro/$1 break;
+    rewrite ^/error/(.*) /error/$1 break;
+    rewrite ^/jserror(.*) /jserror$1 break;
+    rewrite ^/redirect(.*) /redirect$1 break;
+    rewrite /favicon.ico /favicon.ico break;
+    rewrite /robots.txt /robots.txt break;
+    rewrite /(.*) /p/$1;
+
+    include snippets/proxy-nobuff.conf;
+
+    proxy_set_header Host $host;
+    include snippets/proxy-forward-headers.conf;
+    proxy_pass_header Server;
+
+    # for websockets
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $connection_upgrade;
+
+    proxy_pass http://127.0.0.1:{{ item.value.port }};
 }
-- 
cgit v1.2.3