playbooks/update-nftables.yml

@@ -1,5 +0,0 @@
-- name: Include variables files & load nftables.conf
-  hosts: localhost
-  roles:
-    - include-vars
-    - nftables

playbooks/update-services.yml

@@ -1,7 +1,8 @@
-- name: Include variables files
+- name: Include variables files & load nftables.conf
   hosts: localhost
   roles:
     - include-vars
+    - nftables
 
 - name: Update project(s)
   hosts: localhost

roles/reverse-proxy/files/ssl-headers.conf

@@ -1,3 +0,0 @@
-add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
-# add_header X-Robots-Tag "noindex, nofollow" always;
-add_header Set-Cookie "Path=/; HttpOnly; Secure";

roles/reverse-proxy/tasks/main.yml

@@ -22,15 +22,6 @@
         group: root
         mode: '644'
       register: nginx_template_reverse_proxy_conf_result
- 
-    - name: Copy ssl-headers.conf to /etc/nginx/conf.d/ssl-headers.conf
-      copy:
-        src: files/ssl-headers.conf
-        dest: /etc/nginx/conf.d/ssl-headers.conf
-        owner: root
-        group: root
-        mode: '644'
-      register: nginx_copy_ssl_headers_conf_result
 
     - name: Remove all enabled NGINX sites
       file:
@@ -75,5 +66,5 @@
       service:
         name: nginx
         # Reload if conf changed, if not make sure it is started
-        state: "{{ (nginx_template_nginx_conf_result['changed'] or nginx_template_reverse_proxy_conf_result['changed'] or nginx_copy_ssl_headers_conf_result['changed']) | ternary('reloaded', 'started') }}"
+        state: "{{ (nginx_template_nginx_conf_result['changed'] or nginx_template_reverse_proxy_conf_result['changed']) | ternary('reloaded', 'started') }}"
         enabled: yes

roles/reverse-proxy/templates/nginx.conf

@@ -19,10 +19,15 @@ http {
 	tcp_nodelay on;
 
 	gzip off;
+	types_hash_max_size 2048;
 	server_tokens off;
 	keepalive_timeout 30;
 
+	# server_names_hash_bucket_size 64;
+	# server_name_in_redirect off;
+
 	include /etc/nginx/mime.types;
+	default_type application/octet-stream;
 
 	##
 	# SSL Settings
@@ -59,6 +64,10 @@ http {
 
 	resolver {{ reverse_proxy['resolver'] }};
 
+	add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+	# add_header X-Robots-Tag "noindex, nofollow" always;
+	add_header Set-Cookie "Path=/; HttpOnly; Secure";
+
 	proxy_set_header Host $host;
 	proxy_set_header X-Real-IP $remote_addr;
 	proxy_set_header X-Forwarded-Port $server_port;

roles/reverse-proxy/templates/reverse-proxy.conf

@@ -30,16 +30,12 @@ server {
 
 	location = /.well-known/matrix/server {
 		default_type application/json;
-
 		return 200 '{ "m.server": "matrix.{{ domain }}:443" }';
 	}
 
 	location = /.well-known/matrix/client {
 		default_type application/json;
-
-		include /etc/nginx/conf.d/ssl-headers.conf;
 		add_header Access-Control-Allow-Origin '*';
-
 		return 200 '{ "m.homeserver": { "base_url": "https://matrix.{{ domain }}" } }';
 	}
 
@@ -71,11 +67,13 @@ server {
 	location / {
 		proxy_pass http://127.0.0.1:{{ ports['element'] }};
 
-		include /etc/nginx/conf.d/ssl-headers.conf;
 		add_header X-Frame-Options SAMEORIGIN;
 		add_header X-Content-Type-Options nosniff;
 		add_header X-XSS-Protection "1; mode=block";
 		add_header Content-Security-Policy "frame-ancestors 'none'";
+	
+		add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+		add_header Set-Cookie "Path=/; HttpOnly; Secure";
 	}
 }
 
@@ -123,7 +121,8 @@ server {
 	location / {
 		proxy_pass http://127.0.0.1:{{ ports['searxng'] }};
 
-		include /etc/nginx/conf.d/ssl-headers.conf;
+		add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+		add_header Set-Cookie "Path=/; HttpOnly; Secure";
 		add_header Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; form-action 'self' https://github.com/searxng/searxng/issues/new; font-src 'self'; frame-ancestors 'self'; base-uri 'self'; connect-src 'self' https://overpass-api.de; img-src 'self' data: https://*.tile.openstreetmap.org; frame-src https://www.youtube-nocookie.com https://player.vimeo.com https://www.dailymotion.com https://www.deezer.com https://www.mixcloud.com https://w.soundcloud.com https://embed.spotify.com";
 	}
 }
@@ -189,5 +188,7 @@ server {
 		proxy_http_version 1.1;
 		proxy_set_header Upgrade $http_upgrade;
 		proxy_set_header Connection $connection_upgrade;
+
+		client_max_body_size 525M;
 	}
 }