Move z9-host-specific configs and templates into z9 subdirectories

inventories/z9/host_vars/audio.yaml

@@ -1,3 +1,3 @@
 hifiberry__device: hifiberry-dac
 bluetooth_audio_sink__name: Audio Pi
-shairport_sync__config: "{{ lookup('ansible.builtin.file', 'configs/audio/shairport-sync/shairport-sync.conf') }}"
+shairport_sync__config: "{{ lookup('ansible.builtin.file', 'z9/configs/audio/shairport-sync/shairport-sync.conf') }}"

inventories/z9/host_vars/engelsystem.yaml

@@ -1,4 +1,4 @@
-docker_compose__compose_file_content: "{{ lookup('ansible.builtin.template', 'configs/engelsystem/compose.yaml.j2') }}"
+docker_compose__compose_file_content: "{{ lookup('ansible.builtin.template', 'z9/configs/engelsystem/compose.yaml.j2') }}"
 docker_compose__configuration_files: []
 
 certbot__version_spec: ""
@@ -9,4 +9,4 @@ certbot__certificate_domains:
 nginx__version_spec: ""
 nginx__configurations:
   - name: aes.ccchh.net
-    content: "{{ lookup('ansible.builtin.file', 'configs/engelsystem/nginx/aes.ccchh.net.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/engelsystem/nginx/aes.ccchh.net.conf') }}"

inventories/z9/host_vars/esphome.yaml

@@ -8,4 +8,4 @@ certbot__certificate_domains:
 nginx__version_spec: ""
 nginx__configurations:
   - name: esphome
-    content: "{{ lookup('ansible.builtin.file', 'configs/esphome/nginx/esphome.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/esphome/nginx/esphome.conf') }}"

inventories/z9/host_vars/keycloak.yaml

@@ -1,4 +1,4 @@
-docker_compose__compose_file_content: "{{ lookup('ansible.builtin.template', 'configs/keycloak/compose.yaml.j2') }}"
+docker_compose__compose_file_content: "{{ lookup('ansible.builtin.template', 'z9/configs/keycloak/compose.yaml.j2') }}"
 docker_compose__configuration_files: [ ]
 
 certbot__version_spec: ""
@@ -10,6 +10,6 @@ certbot__certificate_domains:
 nginx__version_spec: ""
 nginx__configurations:
   - name: id.ccchh.net
-    content: "{{ lookup('ansible.builtin.file', 'configs/keycloak/nginx/id.ccchh.net.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/keycloak/nginx/id.ccchh.net.conf') }}"
   - name: keycloak-admin.ccchh.net
-    content: "{{ lookup('ansible.builtin.file', 'configs/keycloak/nginx/keycloak-admin.ccchh.net.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/keycloak/nginx/keycloak-admin.ccchh.net.conf') }}"

inventories/z9/host_vars/light.yaml

@@ -3,57 +3,57 @@ foobazdmx_version: main
 foobazdmx_repo_url: "https://ccchh-ansible:glpat-istRKj5ivdBs_u9Tsdbp@gitlab.hamburg.ccc.de/ccchh/foobazdmx.git"
 ola__configs:
   - name: ola-artnet
-    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-artnet.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/light/ola/ola-artnet.conf') }}"
   - name: ola-dummy
-    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-dummy.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/light/ola/ola-dummy.conf') }}"
   - name: ola-e131
-    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-e131.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/light/ola/ola-e131.conf') }}"
   - name: ola-espnet
-    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-espnet.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/light/ola/ola-espnet.conf') }}"
   - name: ola-ftdidmx
-    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-ftdidmx.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/light/ola/ola-ftdidmx.conf') }}"
   - name: ola-gpio
-    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-gpio.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/light/ola/ola-gpio.conf') }}"
   - name: ola-karate
-    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-karate.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/light/ola/ola-karate.conf') }}"
   - name: ola-kinet
-    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-kinet.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/light/ola/ola-kinet.conf') }}"
   - name: ola-milinst
-    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-milinst.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/light/ola/ola-milinst.conf') }}"
   - name: ola-opendmx
-    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-opendmx.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/light/ola/ola-opendmx.conf') }}"
   - name: ola-openpixelcontrol
-    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-openpixelcontrol.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/light/ola/ola-openpixelcontrol.conf') }}"
   - name: ola-osc
-    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-osc.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/light/ola/ola-osc.conf') }}"
   - name: ola-pathport
-    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-pathport.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/light/ola/ola-pathport.conf') }}"
   - name: ola-port
-    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-port.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/light/ola/ola-port.conf') }}"
   - name: ola-renard
-    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-renard.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/light/ola/ola-renard.conf') }}"
   - name: ola-sandnet
-    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-sandnet.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/light/ola/ola-sandnet.conf') }}"
   - name: ola-server
-    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-server.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/light/ola/ola-server.conf') }}"
   - name: ola-shownet
-    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-shownet.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/light/ola/ola-shownet.conf') }}"
   - name: ola-spi
-    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-spi.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/light/ola/ola-spi.conf') }}"
   - name: ola-stageprofi
-    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-stageprofi.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/light/ola/ola-stageprofi.conf') }}"
   - name: ola-uartdmx
-    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-uartdmx.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/light/ola/ola-uartdmx.conf') }}"
   - name: ola-universe
-    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-universe.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/light/ola/ola-universe.conf') }}"
   - name: ola-usbdmx
-    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-usbdmx.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/light/ola/ola-usbdmx.conf') }}"
   - name: ola-usbserial
-    content: "{{ lookup('ansible.builtin.file', 'configs/light/ola/ola-usbserial.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/light/ola/ola-usbserial.conf') }}"
 nginx__version_spec: ""
 nginx__deploy_redirect_conf: false
 nginx__configurations:
   - name: light.ccchh.net
-    content: "{{ lookup('ansible.builtin.file', 'configs/light/nginx/light.ccchh.net.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/light/nginx/light.ccchh.net.conf') }}"
   - name: http_handler
-    content: "{{ lookup('ansible.builtin.file', 'configs/light/nginx/http_handler.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/light/nginx/http_handler.conf') }}"

inventories/z9/host_vars/mqtt.yaml

@@ -1,4 +1,4 @@
-mosquitto__mosquitto_conf_content: "{{ lookup('ansible.builtin.file', 'configs/automation/mosquitto/mosquitto.conf') }}"
+mosquitto__mosquitto_conf_content: "{{ lookup('ansible.builtin.file', 'z9/configs/automation/mosquitto/mosquitto.conf') }}"
 mosquitto__configs:
   - name: winkekatz
-    content: "{{ lookup('ansible.builtin.file', 'configs/automation/mosquitto/winkekatz.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/automation/mosquitto/winkekatz.conf') }}"

inventories/z9/host_vars/public-reverse-proxy.yaml

@@ -2,7 +2,7 @@ nginx__version_spec: ""
 nginx__deploy_redirect_conf: false
 nginx__configurations:
   - name: acme_challenge
-    content: "{{ lookup('ansible.builtin.file', 'configs/public-reverse-proxy/nginx/acme_challenge.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/public-reverse-proxy/nginx/acme_challenge.conf') }}"
 nginx__use_custom_nginx_conf: true
 nginx__custom_nginx_conf: |
-  {{ lookup('file', 'configs/public-reverse-proxy/nginx/nginx.conf') }}
+  {{ lookup('file', 'z9/configs/public-reverse-proxy/nginx/nginx.conf') }}

inventories/z9/host_vars/wiki.yaml

@@ -1,7 +1,7 @@
 nginx__version_spec: ""
 nginx__configurations:
   - name: wiki.ccchh.net
-    content: "{{ lookup('ansible.builtin.file', 'configs/wiki/nginx/wiki.ccchh.net.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/wiki/nginx/wiki.ccchh.net.conf') }}"
 
 certbot__version_spec: ""
 certbot__acme_account_email_address: j+letsencrypt-ccchh@jsts.xyz

inventories/z9/host_vars/zigbee2mqtt.yaml

@@ -1,6 +1,6 @@
 zigbee2mqtt__version: "1.32.1"
 zigbee2mqtt__network_key: "{{ lookup('community.general.passwordstore', 'noc/vm-secrets/zigbee2mqtt/network_key', create=false, missing='error') }}"
-zigbee2mqtt__initial_config: "{{ lookup('ansible.builtin.template', 'configs/zigbee2mqtt/zigbee2mqtt/configuration.yaml.j2') }}"
+zigbee2mqtt__initial_config: "{{ lookup('ansible.builtin.template', 'z9/configs/zigbee2mqtt/zigbee2mqtt/configuration.yaml.j2') }}"
 
 certbot__version_spec: ""
 certbot__acme_account_email_address: j+letsencrypt-ccchh@jsts.xyz
@@ -10,4 +10,4 @@ certbot__certificate_domains:
 nginx__version_spec: ""
 nginx__configurations:
   - name: zigbee2mqtt
-    content: "{{ lookup('ansible.builtin.file', 'configs/zigbee2mqtt/nginx/zigbee2mqtt.conf') }}"
+    content: "{{ lookup('ansible.builtin.file', 'z9/configs/zigbee2mqtt/nginx/zigbee2mqtt.conf') }}"

playbooks/files/z9/configs/audio/shairport-sync/shairport-sync.conf

@@ -0,0 +1,12 @@
+general =
+{
+    name = "Audio Pi";
+    port = 5000;
+    udp_port_base = 6001;
+    udp_port_range = 10;
+    interpolation = "soxr";
+    output_backend = "alsa";
+    mdns_backend = "avahi";
+    volume_range_db = 40;
+    volume_max_db = -20.0;
+};

playbooks/files/z9/configs/automation/mosquitto/mosquitto.conf

@@ -0,0 +1,16 @@
+# Place your local configuration in /etc/mosquitto/conf.d/
+#
+# A full description of the configuration file is at
+# /usr/share/doc/mosquitto/examples/mosquitto.conf.example
+
+per_listener_settings false
+listener 1883 
+allow_anonymous true
+pid_file /run/mosquitto/mosquitto.pid
+
+persistence true
+persistence_location /var/lib/mosquitto/
+
+log_dest file /var/log/mosquitto/mosquitto.log
+
+include_dir /etc/mosquitto/conf.d

playbooks/files/z9/configs/automation/mosquitto/winkekatz.conf

@@ -0,0 +1,8 @@
+connection winkekatz
+address mqtt.winkekatze24.de
+bridge_protocol_version mqttv311
+
+topic winkekatze/allcats/eye/set in 2
+topic winkekatze/allcats in 2
+topic +/status out 2 winkekatze/ ""
+topic +/connected out 2 winkekatze/ ""

playbooks/files/z9/configs/engelsystem/nginx/aes.ccchh.net.conf

@@ -0,0 +1,42 @@
+# partly generated 2022-01-08, Mozilla Guideline v5.6, nginx 1.17.7, OpenSSL 1.1.1k, intermediate configuration
+# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
+server {
+    # Listen on a custom port for the proxy protocol.
+    listen 8443 ssl http2 proxy_protocol;
+    # Make use of the ngx_http_realip_module to set the $remote_addr and
+    # $remote_port to the client address and client port, when using proxy
+    # protocol.
+    # First set our proxy protocol proxy as trusted.
+    set_real_ip_from 10.31.206.14;
+    # Then tell the realip_module to get the addreses from the proxy protocol
+    # header.
+    real_ip_header proxy_protocol;
+
+    server_name aes.ccchh.net;
+
+    ssl_certificate /etc/letsencrypt/live/aes.ccchh.net/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/aes.ccchh.net/privkey.pem;
+    # verify chain of trust of OCSP response using Root CA and Intermediate certs
+    ssl_trusted_certificate /etc/letsencrypt/live/aes.ccchh.net/chain.pem;
+
+    # HSTS (ngx_http_headers_module is required) (63072000 seconds)
+    add_header Strict-Transport-Security "max-age=63072000" always;
+
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Port 443;
+    # This is https in any case.
+    proxy_set_header X-Forwarded-Proto https;
+    # Hide the X-Forwarded header.
+    proxy_hide_header X-Forwarded;
+    # Assume we are the only Reverse Proxy (well using Proxy Protocol, but that
+    # is transparent).
+    # Also provide "_hidden" for by, since it's not relevant.
+    proxy_set_header Forwarded "for=$remote_addr;proto=https;host=$host;by=_hidden";
+
+    location / {
+        proxy_pass http://127.0.0.1:5080/;
+    }
+}

playbooks/files/z9/configs/esphome/nginx/esphome.conf

@@ -0,0 +1,29 @@
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    '' close;
+}
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+
+    server_name esphome.ccchh.net;
+
+    ssl_certificate /etc/letsencrypt/live/esphome.ccchh.net/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/esphome.ccchh.net/privkey.pem;
+    # verify chain of trust of OCSP response using Root CA and Intermediate certs
+    ssl_trusted_certificate /etc/letsencrypt/live/esphome.ccchh.net/chain.pem;
+
+    add_header Strict-Transport-Security "max-age=63072000" always;
+
+    location / {
+        proxy_set_header Host $host;
+        proxy_redirect http:// https://;
+        proxy_http_version 1.1;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_pass http://localhost:6052;
+    }
+}

playbooks/files/z9/configs/keycloak/nginx/id.ccchh.net.conf

@@ -0,0 +1,64 @@
+# partly generated 2022-01-08, Mozilla Guideline v5.6, nginx 1.17.7, OpenSSL 1.1.1k, intermediate configuration
+# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
+# Also see: https://www.keycloak.org/server/reverseproxy
+server {
+    # Listen on a custom port for the proxy protocol.
+    listen 8443 ssl http2 proxy_protocol;
+    # Make use of the ngx_http_realip_module to set the $remote_addr and
+    # $remote_port to the client address and client port, when using proxy
+    # protocol.
+    # First set our proxy protocol proxy as trusted.
+    set_real_ip_from 10.31.206.11;
+    # Then tell the realip_module to get the addreses from the proxy protocol
+    # header.
+    real_ip_header proxy_protocol;
+
+    server_name id.ccchh.net;
+
+    ssl_certificate /etc/letsencrypt/live/id.ccchh.net/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/id.ccchh.net/privkey.pem;
+    # verify chain of trust of OCSP response using Root CA and Intermediate certs
+    ssl_trusted_certificate /etc/letsencrypt/live/id.ccchh.net/chain.pem;
+
+    # HSTS (ngx_http_headers_module is required) (63072000 seconds)
+    add_header Strict-Transport-Security "max-age=63072000" always;
+
+    # To not have 502s sometimes when logging through PVE use bigger buffer_sizes.
+    # The error seemed to occur after logging in and out and in. Maybe related
+    # to Keycloak logout settings, but probably not.
+    # See:
+    # https://stackoverflow.com/questions/56126864/why-do-i-get-502-when-trying-to-authenticate
+    # https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffer_size
+    proxy_buffer_size 128k;
+    proxy_buffers 8 128k;
+
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Port 443;
+    # This is https in any case.
+    proxy_set_header X-Forwarded-Proto https;
+    # Hide the X-Forwarded header.
+    proxy_hide_header X-Forwarded;
+    # Assume we are the only Reverse Proxy (well using Proxy Protocol, but that
+    # is transparent).
+    # Also provide "_hidden" for by, since it's not relevant.
+    proxy_set_header Forwarded "for=$remote_addr;proto=https;host=$host;by=_hidden";
+
+    location /js/ {
+        proxy_pass http://127.0.0.1:8080/js/;
+    }
+
+    location /realms/ {
+        proxy_pass http://127.0.0.1:8080/realms/;
+    }
+
+    location /resources/ {
+        proxy_pass http://127.0.0.1:8080/resources/;
+    }
+
+    location /robots.txt {
+        proxy_pass http://127.0.0.1:8080/robots.txt;
+    }
+}

playbooks/files/z9/configs/keycloak/nginx/keycloak-admin.ccchh.net.conf

@@ -0,0 +1,51 @@
+# partly generated 2022-01-08, Mozilla Guideline v5.6, nginx 1.17.7, OpenSSL 1.1.1k, intermediate configuration
+# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
+# Also see: https://www.keycloak.org/server/reverseproxy
+server {
+    listen 443 ssl http2;
+    #listen [::]:443 ssl http2;
+
+    server_name keycloak-admin.ccchh.net;
+
+    ssl_certificate /etc/letsencrypt/live/keycloak-admin.ccchh.net/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/keycloak-admin.ccchh.net/privkey.pem;
+    # verify chain of trust of OCSP response using Root CA and Intermediate certs
+    ssl_trusted_certificate /etc/letsencrypt/live/keycloak-admin.ccchh.net/chain.pem;
+
+    # HSTS (ngx_http_headers_module is required) (63072000 seconds)
+    add_header Strict-Transport-Security "max-age=63072000" always;
+
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Port 443;
+    # This is https in any case.
+    proxy_set_header X-Forwarded-Proto https;
+    # Hide the X-Forwarded header.
+    proxy_hide_header X-Forwarded;
+    # Assume we are the only Reverse Proxy (well using Proxy Protocol, but that
+    # is transparent).
+    # Also provide "_hidden" for by, since it's not relevant.
+    proxy_set_header Forwarded "for=$remote_addr;proto=https;host=$host;by=_hidden";
+
+    location /js/ {
+        proxy_pass http://127.0.0.1:8080/js/;
+    }
+
+    location /realms/ {
+        proxy_pass http://127.0.0.1:8080/realms/;
+    }
+
+    location /resources/ {
+        proxy_pass http://127.0.0.1:8080/resources/;
+    }
+
+    location /robots.txt {
+        proxy_pass http://127.0.0.1:8080/robots.txt;
+    }
+
+    location /admin/ {
+        proxy_pass http://127.0.0.1:8080/admin/;
+    }
+}

playbooks/files/z9/configs/light/nginx/http_handler.conf

@@ -0,0 +1,14 @@
+server {
+    listen 80 default_server;
+    #listen [::]:80 default_server;
+    server_name _;
+
+    location /.well-known/acme-challenge/ {
+        autoindex on;
+        root /webroot-for-acme-challenge;
+    }
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}

playbooks/files/z9/configs/light/nginx/light.ccchh.net.conf

@@ -0,0 +1,25 @@
+# partly generated 2022-01-08, Mozilla Guideline v5.6, nginx 1.17.7, OpenSSL 1.1.1k, intermediate configuration
+# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
+server {
+    listen 443 ssl http2;
+    #listen [::]:443 ssl http2;
+
+    server_name light.ccchh.net;
+
+    ssl_certificate /etc/letsencrypt/live/light.ccchh.net/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/light.ccchh.net/privkey.pem;
+    # verify chain of trust of OCSP response using Root CA and Intermediate certs
+    ssl_trusted_certificate /etc/letsencrypt/live/light.ccchh.net/chain.pem;
+
+    # replace with the IP address of your resolver
+    resolver 10.31.208.1;
+
+    location / {
+        proxy_pass http://127.0.0.1:8080;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        # This is https in any case.
+        proxy_set_header X-Forwarded-Proto https;
+    }
+}

playbooks/files/z9/configs/light/ola/ola-artnet.conf

@@ -0,0 +1,10 @@
+always_broadcast = false
+enabled = true
+ip = 
+long_name = OLA - ArtNet node
+net = 0
+output_ports = 4
+short_name = OLA - ArtNet node
+subnet = 0
+use_limited_broadcast = false
+use_loopback = false

playbooks/files/z9/configs/light/ola/ola-dummy.conf

@@ -0,0 +1,9 @@
+ack_timer_count = 0
+advanced_dimmer_count = 1
+dimmer_count = 1
+dimmer_subdevice_count = 4
+dummy_device_count = 1
+enabled = false
+moving_light_count = 1
+network_device_count = 1
+sensor_device_count = 1