Compare commits
2 commits
d211d596c4
...
30f6f1f3ee
Author | SHA1 | Date | |
---|---|---|---|
30f6f1f3ee | |||
0a67d1ba01 |
6 changed files with 25 additions and 19 deletions
5
playbooks/update-nftables.yml
Normal file
5
playbooks/update-nftables.yml
Normal file
|
@ -0,0 +1,5 @@
|
|||
- name: Include variables files & load nftables.conf
|
||||
hosts: localhost
|
||||
roles:
|
||||
- include-vars
|
||||
- nftables
|
|
@ -1,8 +1,7 @@
|
|||
- name: Include variables files & load nftables.conf
|
||||
- name: Include variables files
|
||||
hosts: localhost
|
||||
roles:
|
||||
- include-vars
|
||||
- nftables
|
||||
|
||||
- name: Update project(s)
|
||||
hosts: localhost
|
||||
|
|
3
roles/reverse-proxy/files/ssl-headers.conf
Normal file
3
roles/reverse-proxy/files/ssl-headers.conf
Normal file
|
@ -0,0 +1,3 @@
|
|||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
||||
# add_header X-Robots-Tag "noindex, nofollow" always;
|
||||
add_header Set-Cookie "Path=/; HttpOnly; Secure";
|
|
@ -23,6 +23,15 @@
|
|||
mode: '644'
|
||||
register: nginx_template_reverse_proxy_conf_result
|
||||
|
||||
- name: Copy ssl-headers.conf to /etc/nginx/conf.d/ssl-headers.conf
|
||||
copy:
|
||||
src: files/ssl-headers.conf
|
||||
dest: /etc/nginx/conf.d/ssl-headers.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: '644'
|
||||
register: nginx_copy_ssl_headers_conf_result
|
||||
|
||||
- name: Remove all enabled NGINX sites
|
||||
file:
|
||||
state: "{{ item }}"
|
||||
|
@ -66,5 +75,5 @@
|
|||
service:
|
||||
name: nginx
|
||||
# Reload if conf changed, if not make sure it is started
|
||||
state: "{{ (nginx_template_nginx_conf_result['changed'] or nginx_template_reverse_proxy_conf_result['changed']) | ternary('reloaded', 'started') }}"
|
||||
state: "{{ (nginx_template_nginx_conf_result['changed'] or nginx_template_reverse_proxy_conf_result['changed'] or nginx_copy_ssl_headers_conf_result['changed']) | ternary('reloaded', 'started') }}"
|
||||
enabled: yes
|
||||
|
|
|
@ -19,15 +19,10 @@ http {
|
|||
tcp_nodelay on;
|
||||
|
||||
gzip off;
|
||||
types_hash_max_size 2048;
|
||||
server_tokens off;
|
||||
keepalive_timeout 30;
|
||||
|
||||
# server_names_hash_bucket_size 64;
|
||||
# server_name_in_redirect off;
|
||||
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
##
|
||||
# SSL Settings
|
||||
|
@ -64,10 +59,6 @@ http {
|
|||
|
||||
resolver {{ reverse_proxy['resolver'] }};
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
||||
# add_header X-Robots-Tag "noindex, nofollow" always;
|
||||
add_header Set-Cookie "Path=/; HttpOnly; Secure";
|
||||
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-Port $server_port;
|
||||
|
|
|
@ -30,12 +30,16 @@ server {
|
|||
|
||||
location = /.well-known/matrix/server {
|
||||
default_type application/json;
|
||||
|
||||
return 200 '{ "m.server": "matrix.{{ domain }}:443" }';
|
||||
}
|
||||
|
||||
location = /.well-known/matrix/client {
|
||||
default_type application/json;
|
||||
|
||||
include /etc/nginx/conf.d/ssl-headers.conf;
|
||||
add_header Access-Control-Allow-Origin '*';
|
||||
|
||||
return 200 '{ "m.homeserver": { "base_url": "https://matrix.{{ domain }}" } }';
|
||||
}
|
||||
|
||||
|
@ -67,13 +71,11 @@ server {
|
|||
location / {
|
||||
proxy_pass http://127.0.0.1:{{ ports['element'] }};
|
||||
|
||||
include /etc/nginx/conf.d/ssl-headers.conf;
|
||||
add_header X-Frame-Options SAMEORIGIN;
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
add_header Content-Security-Policy "frame-ancestors 'none'";
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
||||
add_header Set-Cookie "Path=/; HttpOnly; Secure";
|
||||
}
|
||||
}
|
||||
|
||||
|
@ -121,8 +123,7 @@ server {
|
|||
location / {
|
||||
proxy_pass http://127.0.0.1:{{ ports['searxng'] }};
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
||||
add_header Set-Cookie "Path=/; HttpOnly; Secure";
|
||||
include /etc/nginx/conf.d/ssl-headers.conf;
|
||||
add_header Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; form-action 'self' https://github.com/searxng/searxng/issues/new; font-src 'self'; frame-ancestors 'self'; base-uri 'self'; connect-src 'self' https://overpass-api.de; img-src 'self' data: https://*.tile.openstreetmap.org; frame-src https://www.youtube-nocookie.com https://player.vimeo.com https://www.dailymotion.com https://www.deezer.com https://www.mixcloud.com https://w.soundcloud.com https://embed.spotify.com";
|
||||
}
|
||||
}
|
||||
|
@ -188,7 +189,5 @@ server {
|
|||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $connection_upgrade;
|
||||
|
||||
client_max_body_size 525M;
|
||||
}
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue