From 724d0bcb82a636a992db4d0aa361aeae50abeac4 Mon Sep 17 00:00:00 2001 From: Gitea Date: Wed, 6 Jul 2022 14:45:47 +0200 Subject: [PATCH] minor changes --- .etckeeper | 48 +++++++++++ .gitignore | 4 + nginx/sites-available/default | 152 +++++++++++++++------------------- shadow | 2 +- 4 files changed, 120 insertions(+), 86 deletions(-) diff --git a/.etckeeper b/.etckeeper index 34061d70..c058e4f9 100755 --- a/.etckeeper +++ b/.etckeeper @@ -29,6 +29,7 @@ mkdir -p './initramfs-tools/scripts/nfs-premount' mkdir -p './initramfs-tools/scripts/nfs-top' mkdir -p './initramfs-tools/scripts/panic' mkdir -p './kernel/install.d' +mkdir -p './letsencrypt/renewal-hooks/deploy' mkdir -p './libpaper.d' mkdir -p './logwatch/conf/logfiles' mkdir -p './logwatch/conf/services' @@ -38,6 +39,9 @@ mkdir -p './mysql/conf.d' mkdir -p './network/if-post-down.d' mkdir -p './network/if-pre-up.d' mkdir -p './nginx/modules-available' +mkdir -p './nginx/sites-available/.git/branches' +mkdir -p './nginx/sites-available/.git/objects/info' +mkdir -p './nginx/sites-available/.git/refs/tags' mkdir -p './opt' mkdir -p './postfix/dynamicmaps.cf.d' mkdir -p './postfix/sasl' @@ -3548,6 +3552,7 @@ maybe chmod 0644 'letsencrypt/options-ssl-apache.conf' maybe chmod 0644 'letsencrypt/options-ssl-nginx.conf' maybe chmod 0755 'letsencrypt/renewal' maybe chmod 0755 'letsencrypt/renewal-hooks' +maybe chmod 0755 'letsencrypt/renewal-hooks/deploy' maybe chmod 0755 'letsencrypt/renewal-hooks/post' maybe chmod 0755 'letsencrypt/renewal-hooks/post/nginx.sh' maybe chmod 0755 'letsencrypt/renewal-hooks/pre' @@ -3907,6 +3912,49 @@ maybe chmod 0644 'nginx/proxy_params' maybe chmod 0644 'nginx/scgi_params' maybe chmod 0644 'nginx/scgi_params.default' maybe chmod 0755 'nginx/sites-available' +maybe chmod 0755 'nginx/sites-available/.git' +maybe chmod 0644 'nginx/sites-available/.git/HEAD' +maybe chmod 0755 'nginx/sites-available/.git/branches' +maybe chmod 0644 'nginx/sites-available/.git/config' +maybe chmod 0644 'nginx/sites-available/.git/description' +maybe chmod 0755 'nginx/sites-available/.git/hooks' +maybe chmod 0755 'nginx/sites-available/.git/hooks/applypatch-msg.sample' +maybe chmod 0755 'nginx/sites-available/.git/hooks/commit-msg.sample' +maybe chmod 0755 'nginx/sites-available/.git/hooks/fsmonitor-watchman.sample' +maybe chmod 0755 'nginx/sites-available/.git/hooks/post-update.sample' +maybe chmod 0755 'nginx/sites-available/.git/hooks/pre-applypatch.sample' +maybe chmod 0755 'nginx/sites-available/.git/hooks/pre-commit.sample' +maybe chmod 0755 'nginx/sites-available/.git/hooks/pre-merge-commit.sample' +maybe chmod 0755 'nginx/sites-available/.git/hooks/pre-push.sample' +maybe chmod 0755 'nginx/sites-available/.git/hooks/pre-rebase.sample' +maybe chmod 0755 'nginx/sites-available/.git/hooks/pre-receive.sample' +maybe chmod 0755 'nginx/sites-available/.git/hooks/prepare-commit-msg.sample' +maybe chmod 0755 'nginx/sites-available/.git/hooks/push-to-checkout.sample' +maybe chmod 0755 'nginx/sites-available/.git/hooks/update.sample' +maybe chmod 0644 'nginx/sites-available/.git/index' +maybe chmod 0755 'nginx/sites-available/.git/info' +maybe chmod 0644 'nginx/sites-available/.git/info/exclude' +maybe chmod 0755 'nginx/sites-available/.git/logs' +maybe chmod 0644 'nginx/sites-available/.git/logs/HEAD' +maybe chmod 0755 'nginx/sites-available/.git/logs/refs' +maybe chmod 0755 'nginx/sites-available/.git/logs/refs/heads' +maybe chmod 0644 'nginx/sites-available/.git/logs/refs/heads/master' +maybe chmod 0755 'nginx/sites-available/.git/logs/refs/remotes' +maybe chmod 0755 'nginx/sites-available/.git/logs/refs/remotes/origin' +maybe chmod 0644 'nginx/sites-available/.git/logs/refs/remotes/origin/HEAD' +maybe chmod 0755 'nginx/sites-available/.git/objects' +maybe chmod 0755 'nginx/sites-available/.git/objects/info' +maybe chmod 0755 'nginx/sites-available/.git/objects/pack' +maybe chmod 0444 'nginx/sites-available/.git/objects/pack/pack-e5f59c6b5c788a45ffbf6a3a8a6166d0e7e8248a.idx' +maybe chmod 0444 'nginx/sites-available/.git/objects/pack/pack-e5f59c6b5c788a45ffbf6a3a8a6166d0e7e8248a.pack' +maybe chmod 0644 'nginx/sites-available/.git/packed-refs' +maybe chmod 0755 'nginx/sites-available/.git/refs' +maybe chmod 0755 'nginx/sites-available/.git/refs/heads' +maybe chmod 0644 'nginx/sites-available/.git/refs/heads/master' +maybe chmod 0755 'nginx/sites-available/.git/refs/remotes' +maybe chmod 0755 'nginx/sites-available/.git/refs/remotes/origin' +maybe chmod 0644 'nginx/sites-available/.git/refs/remotes/origin/HEAD' +maybe chmod 0755 'nginx/sites-available/.git/refs/tags' maybe chmod 0644 'nginx/sites-available/default' maybe chmod 0755 'nginx/sites-enabled' maybe chmod 0755 'nginx/snippets' diff --git a/.gitignore b/.gitignore index 9196cf5c..835514c0 100644 --- a/.gitignore +++ b/.gitignore @@ -52,3 +52,7 @@ check_mk/logwatch.state DEADJOE # end section managed by etckeeper + +shadow* + +nginx/sites-available/* diff --git a/nginx/sites-available/default b/nginx/sites-available/default index c5af9146..0075a2b6 100644 --- a/nginx/sites-available/default +++ b/nginx/sites-available/default @@ -1,91 +1,73 @@ -## -# You should look at the following URL's in order to grasp a solid understanding -# of Nginx configuration files in order to fully unleash the power of Nginx. -# https://www.nginx.com/resources/wiki/start/ -# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/ -# https://wiki.debian.org/Nginx/DirectoryStructure -# -# In most cases, administrators will remove this file from sites-enabled/ and -# leave it as reference inside of sites-available where it will continue to be -# updated by the nginx packaging team. -# -# This file will automatically load configuration files provided by other -# applications, such as Drupal or Wordpress. These applications will be made -# available underneath a path with that package name, such as /drupal8. -# -# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples. -## - # Default server configuration # + server { - listen 80 default_server; - listen [::]:80 default_server; - - # SSL configuration - # - # listen 443 ssl default_server; - # listen [::]:443 ssl default_server; - # - # Note: You should disable gzip for SSL traffic. - # See: https://bugs.debian.org/773332 - # - # Read up on ssl_ciphers to ensure a secure configuration. - # See: https://bugs.debian.org/765782 - # - # Self signed certs generated by the ssl-cert package - # Don't use them in a production server! - # - # include snippets/snakeoil.conf; - - root /var/www/html; - - # Add index.php to the list if you are using PHP - index index.html index.htm index.nginx-debian.html; - - server_name _; - - location / { - # First attempt to serve request as file, then - # as directory, then fall back to displaying a 404. - try_files $uri $uri/ =404; - } - - # pass PHP scripts to FastCGI server - # - #location ~ \.php$ { - # include snippets/fastcgi-php.conf; - # - # # With php-fpm (or other unix sockets): - # fastcgi_pass unix:/run/php/php7.4-fpm.sock; - # # With php-cgi (or other tcp sockets): - # fastcgi_pass 127.0.0.1:9000; - #} - - # deny access to .htaccess files, if Apache's document root - # concurs with nginx's one - # - #location ~ /\.ht { - # deny all; - #} + listen 80 default_server; + server_name solusar.de www.solusar.de; + + location / { + return 301 https://$server_name$request_uri; + } } +server { + listen 443 ssl http2 default_server; + #listen 443 ssl default_server; -# Virtual Host configuration for example.com -# -# You can move that to a different file under sites-available/ and symlink that -# to sites-enabled/ to enable it. -# -#server { -# listen 80; -# listen [::]:80; -# -# server_name example.com; -# -# root /var/www/example.com; -# index index.html; -# -# location / { -# try_files $uri $uri/ =404; -# } -#} + server_name solusar.de www.solusar.de; + + access_log /var/log/nginx/default-access.log; + error_log /var/log/nginx/default-error.log; + + #ssl on; + ssl_certificate /etc/letsencrypt/live/www.solusar.de/fullchain.pem; + ssl_trusted_certificate /etc/letsencrypt/live/www.solusar.de/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/www.solusar.de/privkey.pem; + + + #ssl_dhparam /etc/myssl/dh4096.pem; + #ssl_protocols TLSv1.2; + #ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK'; + #ssl_session_timeout 5m; + #ssl_prefer_server_ciphers on; + #ssl_session_cache shared:SSL:50m; + + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"; + add_header X-Frame-Options "SAMEORIGIN"; + add_header X-Content-Type-Options nosniff; + add_header X-XSS-Protection "1; mode=block"; + add_header Content-Security-Policy "default-src 'none'; child-src 'self'; connect-src 'self'; img-src 'self' data: https: *.gravatar.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' cdn.jsdelivr.net api.instagram.com pagead2.googlesyndication.com; style-src 'self' 'unsafe-inline' https: fonts.googleapis.com; font-src 'self' data: https: fonts.googleapis.com themes.googleusercontent.com; frame-ancestors 'self'; base-uri 'self'; form-action 'self' www.paypal.com; media-src https:;"; + + #limit_req zone=one burst=10; + + root /var/www/vhosts/solusar.de/httpdocs; + index index.php; + + include global/restrictions.conf; + include global/php.conf; + + location / { + # This is cool because no php is touched for static content. + # include the "$is_args$args" so non-default permalinks doesn't break when using query string + try_files $uri $uri/ /index.php?q=$uri&$args; + } + + #location /filtron { + # root /var/www/vhosts/solusar.de/subdomains/monitor/; + # index index.html; + #} + + #location ~ \.php$ { + # try_files $uri =404; + # fastcgi_split_path_info ^(.+\.php)(/.+)$; + # fastcgi_pass unix:/run/php/php8.0-fpm.sock; + # fastcgi_index index.php; + # include fastcgi_params; + #} + + location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ { + expires max; + log_not_found off; + } + +} diff --git a/shadow b/shadow index ad5ad277..d256ad08 100644 --- a/shadow +++ b/shadow @@ -23,7 +23,7 @@ systemd-resolve:*:18085:0:99999:7::: messagebus:*:18085:0:99999:7::: sshd:*:18085:0:99999:7::: systemd-coredump:!!:19179:::::: -caelebfi:$6$U6/IurZ/7UnQIztc$hE7dXIxy38ks4YbZteladWnOf3n1AznuH1zUxGHPEGTRzIbgNViS4JVs8R0HnCgKq1F.5J17Vu7y8MaNkotr61:19179:0:99999:7::: +caelebfi:$y$j9T$fIItRp2lNXa2KoVfKtCu5/$wX/5Q04e3xJgNYWGR2SkxOj76NPbsT7wLhzlQSSSJy/:19179:0:99999:7::: mysql:!:19179:0:99999:7::: redis:*:19179:0:99999:7::: ntp:*:19179:0:99999:7:::