Compare commits
4 commits
72d8f940a9
...
9b8972f2fa
| Author | SHA1 | Date | |
|---|---|---|---|
| 9b8972f2fa | |||
| 3bba747dab | |||
| b90a57ffb0 | |||
| ad783e4a15 |
8 changed files with 49 additions and 8 deletions
|
|
@ -1,7 +1,7 @@
|
||||||
# renovate: datasource=docker depName=git.hamburg.ccc.de/ccchh/oci-images/nextcloud
|
# renovate: datasource=docker depName=git.hamburg.ccc.de/ccchh/oci-images/nextcloud
|
||||||
nextcloud__version: 32
|
nextcloud__version: 32
|
||||||
# renovate: datasource=docker depName=docker.io/library/postgres
|
# renovate: datasource=docker depName=docker.io/library/postgres
|
||||||
nextcloud__postgres_version: 15.15
|
nextcloud__postgres_version: 18.1
|
||||||
nextcloud__fqdn: cloud.hamburg.ccc.de
|
nextcloud__fqdn: cloud.hamburg.ccc.de
|
||||||
nextcloud__data_dir: /data/nextcloud
|
nextcloud__data_dir: /data/nextcloud
|
||||||
nextcloud__extra_configuration: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/cloud/nextcloud/extra_configuration.config.php.j2') }}"
|
nextcloud__extra_configuration: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/cloud/nextcloud/extra_configuration.config.php.j2') }}"
|
||||||
|
|
|
||||||
|
|
@ -5,7 +5,7 @@ docker_compose__pull: never
|
||||||
certbot__version_spec: ""
|
certbot__version_spec: ""
|
||||||
certbot__acme_account_email_address: le-admin@hamburg.ccc.de
|
certbot__acme_account_email_address: le-admin@hamburg.ccc.de
|
||||||
certbot__certificate_domains:
|
certbot__certificate_domains:
|
||||||
# - "spaceapi.ccc.de" # after DNS has been adjusted
|
- "spaceapi.ccc.de"
|
||||||
- "spaceapiccc.hamburg.ccc.de"
|
- "spaceapiccc.hamburg.ccc.de"
|
||||||
certbot__new_cert_commands:
|
certbot__new_cert_commands:
|
||||||
- "systemctl reload nginx.service"
|
- "systemctl reload nginx.service"
|
||||||
|
|
|
||||||
|
|
@ -46,7 +46,7 @@ services:
|
||||||
- "8080:8080"
|
- "8080:8080"
|
||||||
|
|
||||||
db:
|
db:
|
||||||
image: docker.io/library/postgres:15.15
|
image: docker.io/library/postgres:18.1
|
||||||
restart: unless-stopped
|
restart: unless-stopped
|
||||||
networks:
|
networks:
|
||||||
- keycloak
|
- keycloak
|
||||||
|
|
|
||||||
|
|
@ -56,7 +56,7 @@ services:
|
||||||
- POSTGRES_DB=mailmandb
|
- POSTGRES_DB=mailmandb
|
||||||
- POSTGRES_USER=mailman
|
- POSTGRES_USER=mailman
|
||||||
- POSTGRES_PASSWORD=wvQjbMRnwFuxGEPz
|
- POSTGRES_PASSWORD=wvQjbMRnwFuxGEPz
|
||||||
image: docker.io/library/postgres:12-alpine
|
image: docker.io/library/postgres:18-alpine
|
||||||
volumes:
|
volumes:
|
||||||
- /opt/mailman/database:/var/lib/postgresql/data
|
- /opt/mailman/database:/var/lib/postgresql/data
|
||||||
networks:
|
networks:
|
||||||
|
|
|
||||||
|
|
@ -3,7 +3,7 @@
|
||||||
|
|
||||||
services:
|
services:
|
||||||
database:
|
database:
|
||||||
image: docker.io/library/postgres:15-alpine
|
image: docker.io/library/postgres:18-alpine
|
||||||
environment:
|
environment:
|
||||||
- "POSTGRES_USER=hedgedoc"
|
- "POSTGRES_USER=hedgedoc"
|
||||||
- "POSTGRES_PASSWORD={{ secret__hedgedoc_db_password }}"
|
- "POSTGRES_PASSWORD={{ secret__hedgedoc_db_password }}"
|
||||||
|
|
|
||||||
|
|
@ -3,7 +3,7 @@
|
||||||
|
|
||||||
services:
|
services:
|
||||||
database:
|
database:
|
||||||
image: docker.io/library/postgres:15-alpine
|
image: docker.io/library/postgres:18-alpine
|
||||||
environment:
|
environment:
|
||||||
- "POSTGRES_USER=pretalx"
|
- "POSTGRES_USER=pretalx"
|
||||||
- "POSTGRES_PASSWORD={{ secret__pretalx_db_password }}"
|
- "POSTGRES_PASSWORD={{ secret__pretalx_db_password }}"
|
||||||
|
|
|
||||||
|
|
@ -12,7 +12,7 @@ server {
|
||||||
# header.
|
# header.
|
||||||
real_ip_header proxy_protocol;
|
real_ip_header proxy_protocol;
|
||||||
|
|
||||||
server_name spaceapi.ccc.de spaceapiccc.hamburg.ccc.de;
|
server_name spaceapi.ccc.de;
|
||||||
|
|
||||||
ssl_certificate /etc/letsencrypt/live/spaceapiccc.hamburg.ccc.de/fullchain.pem;
|
ssl_certificate /etc/letsencrypt/live/spaceapiccc.hamburg.ccc.de/fullchain.pem;
|
||||||
ssl_certificate_key /etc/letsencrypt/live/spaceapiccc.hamburg.ccc.de/privkey.pem;
|
ssl_certificate_key /etc/letsencrypt/live/spaceapiccc.hamburg.ccc.de/privkey.pem;
|
||||||
|
|
@ -40,3 +40,44 @@ server {
|
||||||
proxy_pass http://172.16.238.10/;
|
proxy_pass http://172.16.238.10/;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
# Listen on a custom port for the proxy protocol.
|
||||||
|
listen [::]:8443 ssl http2 proxy_protocol;
|
||||||
|
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||||
|
# $remote_port to the client address and client port, when using proxy
|
||||||
|
# protocol.
|
||||||
|
# First set our proxy protocol proxy as trusted.
|
||||||
|
set_real_ip_from 2a00:14b0:4200:3000:125::1;
|
||||||
|
# Then tell the realip_module to get the addreses from the proxy protocol
|
||||||
|
# header.
|
||||||
|
real_ip_header proxy_protocol;
|
||||||
|
|
||||||
|
server_name spaceapi.ccc.de;
|
||||||
|
|
||||||
|
ssl_certificate /etc/letsencrypt/live/spaceapi.ccc.de/fullchain.pem;
|
||||||
|
ssl_certificate_key /etc/letsencrypt/live/spaceapi.ccc.de/privkey.pem;
|
||||||
|
# verify chain of trust of OCSP response using Root CA and Intermediate certs
|
||||||
|
ssl_trusted_certificate /etc/letsencrypt/live/spaceapiccc.hamburg.ccc.de/chain.pem;
|
||||||
|
|
||||||
|
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
|
||||||
|
add_header Strict-Transport-Security "max-age=63072000" always;
|
||||||
|
|
||||||
|
proxy_set_header Host $host;
|
||||||
|
proxy_set_header X-Forwarded-Host $host;
|
||||||
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Port 443;
|
||||||
|
# This is https in any case.
|
||||||
|
proxy_set_header X-Forwarded-Proto https;
|
||||||
|
# Hide the X-Forwarded header.
|
||||||
|
proxy_hide_header X-Forwarded;
|
||||||
|
# Assume we are the only Reverse Proxy (well using Proxy Protocol, but that
|
||||||
|
# is transparent).
|
||||||
|
# Also provide "_hidden" for by, since it's not relevant.
|
||||||
|
proxy_set_header Forwarded "for=$remote_addr;proto=https;host=$host;by=_hidden";
|
||||||
|
|
||||||
|
location / {
|
||||||
|
proxy_pass http://172.16.238.10/;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,7 +1,7 @@
|
||||||
---
|
---
|
||||||
services:
|
services:
|
||||||
database:
|
database:
|
||||||
image: docker.io/library/postgres:15-alpine
|
image: docker.io/library/postgres:18-alpine
|
||||||
environment:
|
environment:
|
||||||
- "POSTGRES_USER=pretix"
|
- "POSTGRES_USER=pretix"
|
||||||
- "POSTGRES_PASSWORD={{ secret__pretix_db_password }}"
|
- "POSTGRES_PASSWORD={{ secret__pretix_db_password }}"
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue