freifunk/ansible-config
0
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

New nginx role

Browse source
This commit is contained in:
Alexander Dietrich 2018-11-03 16:20:39 +01:00
commit 7956d09b3e
22 changed files with 122 additions and 130 deletions
Download patch file Download diff file Expand all files Collapse all files

10
roles/nginx/files/error-pages/502.html Normal file
View file

@ -0,0 +1,10 @@
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>502 Bad Gateway</title>
<link rel="stylesheet" href="/_error-pages/style.css">
</head>
<body>
<img src="/_error-pages/bad_gateway.png" alt="Bad Gateway Sign" class="singleton">
</body>

BIN
roles/nginx/files/error-pages/bad_gateway.png Normal file
View file

Binary file not shown.
Side by side

After

Width:  |  Height:  |  Size: 20 KiB

4
roles/nginx/files/error-pages/style.css Normal file
View file

@ -0,0 +1,4 @@
img.singleton {
display: block;
margin: 10px auto;
}

4
roles/nginx/files/etc/nginx/include/headers_hsts.conf
View file

@ -1,4 +0,0 @@
# Header bitte nur auf "location" Ebene inkludieren:
# https://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header
add_header Strict-Transport-Security max-age=31536000;

5
roles/nginx/files/etc/nginx/include/letsencrypt_srv02.conf
View file

@ -1,5 +0,0 @@
location ^~ /.well-known/acme-challenge {
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://srv02.hamburg.freifunk.net$request_uri;
}

7
roles/nginx/files/etc/nginx/include/no_logging.conf
View file

@ -1,7 +0,0 @@
# Deaktiviert Logging
access_log off; # Bitte nicht aktivieren. Wir wollen ja nicht die IPs unserer Visitors loggen.
# Bitte nur zum Debuggen von schweren Fehlern das Log-File temporär setzen und dann anschließend die Logs löschen.
# So stellen wir sicher, dass keine IPs geloggt werden.
error_log /dev/null crit;

1
roles/nginx/files/etc/nginx/include/no_symlinks.conf
View file

@ -1 +0,0 @@
disable_symlinks on from=$document_root;

4
roles/nginx/files/etc/nginx/include/ssl_rewrite.conf
View file

@ -1,4 +0,0 @@
# Generischer Rewrite von HTTP nach HTTPS
location / {
return 302 https://$server_name$request_uri;
}

0
roles/nginx/files/etc/nginx/include/listing.conf → roles/nginx/files/snippets/autoindex.conf
View file

5
roles/nginx/files/snippets/error-pages.conf Normal file
View file

@ -0,0 +1,5 @@
error_page 502 /_error-pages/502.html;
location ^~ /_error-pages {
root /var/www;
}

1
roles/nginx/files/snippets/header-hsts.conf Normal file
View file

@ -0,0 +1 @@
add_header Strict-Transport-Security 'max-age=31536000';

1
roles/nginx/files/etc/nginx/include/letsencrypt_srv01.conf → roles/nginx/files/snippets/location-acme-srv01.conf
View file

@ -2,4 +2,5 @@ location ^~ /.well-known/acme-challenge {
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://srv01.hamburg.freifunk.net$request_uri;
access_log off;
}

5
roles/nginx/files/snippets/location-acme.conf Normal file
View file

@ -0,0 +1,5 @@
location ^~ /.well-known/acme-challenge {
root /var/www/_acme-challenge;
try_files $uri $uri/ =404;
access_log off;
}

3
roles/nginx/files/etc/nginx/include/no_dotfiles.conf → roles/nginx/files/snippets/no-unsafe-files.conf
View file

@ -1,7 +1,8 @@
disable_symlinks on from=$document_root;
# Do not serve dotfiles.
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}