Compare commits
No commits in common. "30f6f1f3ee72a9f70026af285e560ca24d2a7a57" and "d211d596c453c6df458ccbe86ae96cdaa24b96b5" have entirely different histories.
30f6f1f3ee
...
d211d596c4
6 changed files with 19 additions and 25 deletions
|
@ -1,5 +0,0 @@
|
||||||
- name: Include variables files & load nftables.conf
|
|
||||||
hosts: localhost
|
|
||||||
roles:
|
|
||||||
- include-vars
|
|
||||||
- nftables
|
|
|
@ -1,7 +1,8 @@
|
||||||
- name: Include variables files
|
- name: Include variables files & load nftables.conf
|
||||||
hosts: localhost
|
hosts: localhost
|
||||||
roles:
|
roles:
|
||||||
- include-vars
|
- include-vars
|
||||||
|
- nftables
|
||||||
|
|
||||||
- name: Update project(s)
|
- name: Update project(s)
|
||||||
hosts: localhost
|
hosts: localhost
|
||||||
|
|
|
@ -1,3 +0,0 @@
|
||||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
|
||||||
# add_header X-Robots-Tag "noindex, nofollow" always;
|
|
||||||
add_header Set-Cookie "Path=/; HttpOnly; Secure";
|
|
|
@ -22,15 +22,6 @@
|
||||||
group: root
|
group: root
|
||||||
mode: '644'
|
mode: '644'
|
||||||
register: nginx_template_reverse_proxy_conf_result
|
register: nginx_template_reverse_proxy_conf_result
|
||||||
|
|
||||||
- name: Copy ssl-headers.conf to /etc/nginx/conf.d/ssl-headers.conf
|
|
||||||
copy:
|
|
||||||
src: files/ssl-headers.conf
|
|
||||||
dest: /etc/nginx/conf.d/ssl-headers.conf
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
mode: '644'
|
|
||||||
register: nginx_copy_ssl_headers_conf_result
|
|
||||||
|
|
||||||
- name: Remove all enabled NGINX sites
|
- name: Remove all enabled NGINX sites
|
||||||
file:
|
file:
|
||||||
|
@ -75,5 +66,5 @@
|
||||||
service:
|
service:
|
||||||
name: nginx
|
name: nginx
|
||||||
# Reload if conf changed, if not make sure it is started
|
# Reload if conf changed, if not make sure it is started
|
||||||
state: "{{ (nginx_template_nginx_conf_result['changed'] or nginx_template_reverse_proxy_conf_result['changed'] or nginx_copy_ssl_headers_conf_result['changed']) | ternary('reloaded', 'started') }}"
|
state: "{{ (nginx_template_nginx_conf_result['changed'] or nginx_template_reverse_proxy_conf_result['changed']) | ternary('reloaded', 'started') }}"
|
||||||
enabled: yes
|
enabled: yes
|
||||||
|
|
|
@ -19,10 +19,15 @@ http {
|
||||||
tcp_nodelay on;
|
tcp_nodelay on;
|
||||||
|
|
||||||
gzip off;
|
gzip off;
|
||||||
|
types_hash_max_size 2048;
|
||||||
server_tokens off;
|
server_tokens off;
|
||||||
keepalive_timeout 30;
|
keepalive_timeout 30;
|
||||||
|
|
||||||
|
# server_names_hash_bucket_size 64;
|
||||||
|
# server_name_in_redirect off;
|
||||||
|
|
||||||
include /etc/nginx/mime.types;
|
include /etc/nginx/mime.types;
|
||||||
|
default_type application/octet-stream;
|
||||||
|
|
||||||
##
|
##
|
||||||
# SSL Settings
|
# SSL Settings
|
||||||
|
@ -59,6 +64,10 @@ http {
|
||||||
|
|
||||||
resolver {{ reverse_proxy['resolver'] }};
|
resolver {{ reverse_proxy['resolver'] }};
|
||||||
|
|
||||||
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
||||||
|
# add_header X-Robots-Tag "noindex, nofollow" always;
|
||||||
|
add_header Set-Cookie "Path=/; HttpOnly; Secure";
|
||||||
|
|
||||||
proxy_set_header Host $host;
|
proxy_set_header Host $host;
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
proxy_set_header X-Forwarded-Port $server_port;
|
proxy_set_header X-Forwarded-Port $server_port;
|
||||||
|
|
|
@ -30,16 +30,12 @@ server {
|
||||||
|
|
||||||
location = /.well-known/matrix/server {
|
location = /.well-known/matrix/server {
|
||||||
default_type application/json;
|
default_type application/json;
|
||||||
|
|
||||||
return 200 '{ "m.server": "matrix.{{ domain }}:443" }';
|
return 200 '{ "m.server": "matrix.{{ domain }}:443" }';
|
||||||
}
|
}
|
||||||
|
|
||||||
location = /.well-known/matrix/client {
|
location = /.well-known/matrix/client {
|
||||||
default_type application/json;
|
default_type application/json;
|
||||||
|
|
||||||
include /etc/nginx/conf.d/ssl-headers.conf;
|
|
||||||
add_header Access-Control-Allow-Origin '*';
|
add_header Access-Control-Allow-Origin '*';
|
||||||
|
|
||||||
return 200 '{ "m.homeserver": { "base_url": "https://matrix.{{ domain }}" } }';
|
return 200 '{ "m.homeserver": { "base_url": "https://matrix.{{ domain }}" } }';
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -71,11 +67,13 @@ server {
|
||||||
location / {
|
location / {
|
||||||
proxy_pass http://127.0.0.1:{{ ports['element'] }};
|
proxy_pass http://127.0.0.1:{{ ports['element'] }};
|
||||||
|
|
||||||
include /etc/nginx/conf.d/ssl-headers.conf;
|
|
||||||
add_header X-Frame-Options SAMEORIGIN;
|
add_header X-Frame-Options SAMEORIGIN;
|
||||||
add_header X-Content-Type-Options nosniff;
|
add_header X-Content-Type-Options nosniff;
|
||||||
add_header X-XSS-Protection "1; mode=block";
|
add_header X-XSS-Protection "1; mode=block";
|
||||||
add_header Content-Security-Policy "frame-ancestors 'none'";
|
add_header Content-Security-Policy "frame-ancestors 'none'";
|
||||||
|
|
||||||
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
||||||
|
add_header Set-Cookie "Path=/; HttpOnly; Secure";
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -123,7 +121,8 @@ server {
|
||||||
location / {
|
location / {
|
||||||
proxy_pass http://127.0.0.1:{{ ports['searxng'] }};
|
proxy_pass http://127.0.0.1:{{ ports['searxng'] }};
|
||||||
|
|
||||||
include /etc/nginx/conf.d/ssl-headers.conf;
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
||||||
|
add_header Set-Cookie "Path=/; HttpOnly; Secure";
|
||||||
add_header Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; form-action 'self' https://github.com/searxng/searxng/issues/new; font-src 'self'; frame-ancestors 'self'; base-uri 'self'; connect-src 'self' https://overpass-api.de; img-src 'self' data: https://*.tile.openstreetmap.org; frame-src https://www.youtube-nocookie.com https://player.vimeo.com https://www.dailymotion.com https://www.deezer.com https://www.mixcloud.com https://w.soundcloud.com https://embed.spotify.com";
|
add_header Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; form-action 'self' https://github.com/searxng/searxng/issues/new; font-src 'self'; frame-ancestors 'self'; base-uri 'self'; connect-src 'self' https://overpass-api.de; img-src 'self' data: https://*.tile.openstreetmap.org; frame-src https://www.youtube-nocookie.com https://player.vimeo.com https://www.dailymotion.com https://www.deezer.com https://www.mixcloud.com https://w.soundcloud.com https://embed.spotify.com";
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -189,5 +188,7 @@ server {
|
||||||
proxy_http_version 1.1;
|
proxy_http_version 1.1;
|
||||||
proxy_set_header Upgrade $http_upgrade;
|
proxy_set_header Upgrade $http_upgrade;
|
||||||
proxy_set_header Connection $connection_upgrade;
|
proxy_set_header Connection $connection_upgrade;
|
||||||
|
|
||||||
|
client_max_body_size 525M;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue