Merge branch 'master' of https://git.cccv.de/infra/ansible/roles/nginx

README.md

@@ -102,6 +102,9 @@ key: ~
 
 # SSL certificat, mutally exclusive with letsencrypt option
 crt: ~
+
+# Disallow access to dotfiles besides .well-known by default
+disallow_dotfiles: True
 ```
 
 **locationconfig**:

defaults/main.yml

@@ -45,6 +45,8 @@ nginx_vhosts_defaults:
   add_proxy_headers: {}
   hide_proxy_headers: {}
   backend: ~
+  disallow_dotfiles: True
+  force_forwarded_ssl_header: False
 
 nginx_streams_defaults:
   listen:
@@ -75,3 +77,4 @@ phpinidefault:
   post_max_size: 64M
   upload_max_filesize: 64M
   memory_limit: 128M
+  date_timezone: UTC

templates/php-fpm/php.ini.j2

@@ -925,7 +925,7 @@ cli_server.color = On
 [Date]
 ; Defines the default timezone used by the date functions
 ; http://php.net/date.timezone
-date.timezone = "UTC"
+date.timezone = "{{ phpini.date_timezone }}"
 
 ; http://php.net/date.default-latitude
 ;date.default_latitude = 31.7667

templates/vhost.conf.j2

@@ -53,9 +53,15 @@ server {
 		proxy_set_header Host			{{ location.host|d(vhost.host) }};
 		proxy_set_header X-Real-IP		$remote_addr;
 		proxy_set_header X-Forwarded-For	$proxy_add_x_forwarded_for;
+		{% if not location.force_forwarded_ssl_header|d(vhost.force_forwarded_ssl_header) %}
 		proxy_set_header X-Forwarded-Proto	$scheme;
 		proxy_set_header X-Forwarded-Ssl	$https;
 		proxy_set_header X-Url-Scheme		$scheme;
+		{% else %}
+		proxy_set_header X-Forwarded-Proto	https;
+		proxy_set_header X-Forwarded-Ssl	on;
+		proxy_set_header X-Url-Scheme		https;
+		{% endif %}
 
 		# add custom proxy headers
 		{% for header in vhost.add_proxy_headers if header %}
@@ -86,6 +92,15 @@ server {
 	}
 	{% endfor %}
 
+
+	{% if vhost.disallow_dotfiles %}
+	# disallow every path starting with a dot except .well-known/
+	location ~ /\.(?!well-known\/).* {
+		deny all;
+	}
+	{% endif %}
+
+
 	{% if vhost.auth.enable %}
 	auth_basic           "restricted area";
 	auth_basic_user_file {{ vhost.auth.path }};