bee/beepi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

stuff

Browse Source
This commit is contained in:
bee
2026-08-15 19:18:59 +02:00
parent 59aa8a7bcf
commit c63db540e8
32 changed files with 767 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files
playbooks/nginx/nginx.yml
+20 -2
View File
@@ -28,6 +28,14 @@
group: root
mode: '0644'
- name: Copy ssl.conf
ansible.builtin.copy:
src: ssl.conf
dest: /etc/nginx/ssl.conf
owner: root
group: root
mode: '0644'
- name: Copy html content
ansible.builtin.copy:
src: www/
@@ -36,7 +44,17 @@
group: www-data
mode: '0644'
- name: Restart nginx
- name: Validate config
ansible.builtin.command: nginx -t
changed_when: false
- name: Start nginx
ansible.builtin.service:
name: nginx
state: restarted
state: started
enabled: true
- name: Reload nginx
ansible.builtin.service:
name: nginx
state: reloaded
playbooks/nginx/sites-enabled/00-default
+6
View File
@@ -0,0 +1,6 @@
server {
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
include /etc/nginx/ssl.conf;
ssl_reject_handshake on;
}
playbooks/nginx/sites-enabled/gallery.secretbee.buzz
+1 -2
View File
@@ -15,8 +15,7 @@ server {
ssl_certificate /etc/letsencrypt/live/gallery.secretbee.buzz/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/gallery.secretbee.buzz/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
include /etc/nginx/ssl.conf;
# allow large file uploads
client_max_body_size 50000M;
playbooks/nginx/sites-enabled/git.secretbee.buzz
+1 -2
View File
@@ -17,8 +17,7 @@ server {
ssl_certificate /etc/letsencrypt/live/git.secretbee.buzz/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/git.secretbee.buzz/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
include /etc/nginx/ssl.conf;
location / {
client_max_body_size 512M;
playbooks/nginx/sites-enabled/grafana.secretbee.buzz
+1 -2
View File
@@ -26,8 +26,7 @@ server {
ssl_certificate /etc/letsencrypt/live/grafana.secretbee.buzz/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/grafana.secretbee.buzz/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
include /etc/nginx/ssl.conf;
location / {
proxy_set_header Host $host;
playbooks/nginx/sites-enabled/lounge.secretbee.buzz
+1 -2
View File
@@ -17,8 +17,7 @@ server {
ssl_certificate /etc/letsencrypt/live/lounge.secretbee.buzz/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/lounge.secretbee.buzz/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
include /etc/nginx/ssl.conf;
location / {
proxy_pass http://127.0.0.1:9000/;
playbooks/nginx/sites-enabled/matrix.secretbee.buzz
+1
View File
@@ -7,6 +7,7 @@ server {
ssl_certificate /etc/letsencrypt/live/matrix.secretbee.buzz/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/matrix.secretbee.buzz/privkey.pem;
include /etc/nginx/ssl.conf;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options nosniff;
playbooks/nginx/sites-enabled/ott.secretbee.buzz
+1
View File
@@ -9,6 +9,7 @@ server {
ssl_certificate /etc/letsencrypt/live/ott.secretbee.buzz/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/ott.secretbee.buzz/privkey.pem;
include /etc/nginx/ssl.conf;
#deny all;
location / {
playbooks/nginx/sites-enabled/secretbee.buzz
+1 -2
View File
@@ -28,8 +28,7 @@ server {
ssl_certificate /etc/letsencrypt/live/secretbee.buzz/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/secretbee.buzz/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
include /etc/nginx/ssl.conf;
location /.well-known/matrix/server {
default_type application/json;
playbooks/nginx/sites-enabled/vault.secretbee.buzz
+29
View File
@@ -0,0 +1,29 @@
server {
listen 443 ssl http2;
server_name vault.secretbee.buzz;
ssl_certificate /etc/letsencrypt/live/vault.secretbee.buzz/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/vault.secretbee.buzz/privkey.pem;
include /etc/nginx/ssl.conf;
allow 10.10.1.0/24;
allow 192.168.178.0/24;
deny all;
client_max_body_size 128M;
location / {
proxy_pass http://localhost:8222;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location /admin {
return 404;
}
}
playbooks/nginx/ssl.conf
+3
View File
@@ -0,0 +1,3 @@
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;