infra/ansible-role-nginx
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge branch 'master' of https://git.cccv.de/infra/ansible/roles/nginx

Browse source
This commit is contained in:
nd 2022-11-26 12:35:59 +01:00
commit 70cd552c1c
4 changed files with 22 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
README.md
View file

@ -102,6 +102,9 @@ key: ~
# SSL certificat, mutally exclusive with letsencrypt option # SSL certificat, mutally exclusive with letsencrypt option
crt: ~ crt: ~
# Disallow access to dotfiles besides .well-known by default
disallow_dotfiles: True
``` ```
**locationconfig**: **locationconfig**:

3
defaults/main.yml
View file

@ -45,6 +45,8 @@ nginx_vhosts_defaults:
add_proxy_headers: {} add_proxy_headers: {}
hide_proxy_headers: {} hide_proxy_headers: {}
backend: ~ backend: ~
disallow_dotfiles: True
force_forwarded_ssl_header: False
nginx_streams_defaults: nginx_streams_defaults:
listen: listen:
@ -75,3 +77,4 @@ phpinidefault:
post_max_size: 64M post_max_size: 64M
upload_max_filesize: 64M upload_max_filesize: 64M
memory_limit: 128M memory_limit: 128M
date_timezone: UTC

2
templates/php-fpm/php.ini.j2
View file

@ -925,7 +925,7 @@ cli_server.color = On
[Date] [Date]
; Defines the default timezone used by the date functions ; Defines the default timezone used by the date functions
; http://php.net/date.timezone ; http://php.net/date.timezone
date.timezone = "UTC" date.timezone = "{{ phpini.date_timezone }}"
; http://php.net/date.default-latitude ; http://php.net/date.default-latitude
;date.default_latitude = 31.7667 ;date.default_latitude = 31.7667

15
templates/vhost.conf.j2
View file

@ -53,9 +53,15 @@ server {
proxy_set_header Host {{ location.host|d(vhost.host) }}; proxy_set_header Host {{ location.host|d(vhost.host) }};
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
{% if not location.force_forwarded_ssl_header|d(vhost.force_forwarded_ssl_header) %}
proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Ssl $https; proxy_set_header X-Forwarded-Ssl $https;
proxy_set_header X-Url-Scheme $scheme; proxy_set_header X-Url-Scheme $scheme;
{% else %}
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Ssl on;
proxy_set_header X-Url-Scheme https;
{% endif %}
# add custom proxy headers # add custom proxy headers
{% for header in vhost.add_proxy_headers if header %} {% for header in vhost.add_proxy_headers if header %}
@ -86,6 +92,15 @@ server {
} }
{% endfor %} {% endfor %}
{% if vhost.disallow_dotfiles %}
# disallow every path starting with a dot except .well-known/
location ~ /\.(?!well-known\/).* {
deny all;
}
{% endif %}
{% if vhost.auth.enable %} {% if vhost.auth.enable %}
auth_basic "restricted area"; auth_basic "restricted area";
auth_basic_user_file {{ vhost.auth.path }}; auth_basic_user_file {{ vhost.auth.path }};