caelebfi/local.realm.ansible
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

changed vhost template for own requirements

Browse Source
This commit is contained in:
Mende
2020-11-27 15:49:47 +01:00
parent 51c56c6fa6
commit 751a01ae79
1 changed files with 8 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
playbooks/nginx/vhosts.j2
+8 -24
View File
@@ -7,7 +7,6 @@ server {
listen {{ item['ip']}}:80;
{% else %}
listen 80;
listen [::]:80;
{% endif %}
{% if item['alias'] != "none" %}
server_name {{ item['name'] }}
@@ -22,12 +21,6 @@ server {
root /var/www/html;
{% endif %}
# For letsencrypt.sh
location /.well-known/acme-challenge/ {
root /var/www/html/;
try_files $uri $uri/ =404;
}
# Redirect all HTTP requests to HTTPS with a 301 Moved Permanently response.
return 301 https://{{ item['name'] }}$request_uri;
@@ -53,17 +46,17 @@ server {
gzip off;
{% if 'ssl' in item %}
ssl_certificate /etc/letsencrypt.sh/certs/{{ item['ssl'] }}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt.sh/certs/{{ item['ssl'] }}/privkey.pem;
#ssl_trusted_certificate /etc/letsencrypt.sh/certs/{{ item['ssl'] }}/fullchain.pem;
ssl_certificate /etc/letsencrypt/live/{{ item['name'] }}/fullchain.pem;
ssl_trusted_certificate /etc/letsencrypt/live/{{ item['name'] }}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/{{ item['name'] }}/privkey.pem;
{% else %}
ssl_certificate /etc/letsencrypt.sh/certs/{{ item['name'] }}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt.sh/certs/{{ item['name'] }}/privkey.pem;
#ssl_trusted_certificate /etc/letsencrypt.sh/certs/{{ item['name'] }}/fullchain.pem;
ssl_certificate /etc/letsencrypt/live/{{ item['name'] }}/fullchain.pem;
ssl_trusted_certificate /etc/letsencrypt/live/{{ item['name'] }}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/{{ item['name'] }}/privkey.pem;
{% endif %}
ssl_stapling on;
ssl_stapling_verify on;
ssl_dhparam /etc/nginx/dhparam.pem;
ssl_dhparam /etc/myssl/dh4096.pem;
ssl_session_cache shared:SSL:50m;
ssl_session_timeout 10m;
@@ -74,9 +67,6 @@ server {
ssl_ciphers 'AES256+EECDH:AES256+EDH:!aNULL';
ssl_ecdh_curve secp384r1;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;
server_tokens off;
access_log /var/log/nginx/{{ item['name'] }}.log extended;
@@ -88,12 +78,6 @@ server {
root /var/www/html;
{% endif %}
# For letsencrypt.sh
location /.well-known/acme-challenge/ {
root /var/www/html/;
try_files $uri $uri/ =404;
}
location ~ /\.ht {
deny all;
}
@@ -166,7 +150,7 @@ server {
{% endif %}
{% if 'hsts' in item %}
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
{% endif %}
{% if 'hpkp' in item %}
add_header Public-Key-Pins "pin-sha256=\"YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg=\"; pin-sha256=\"sRHdihwgkaib1P1gxX8HFszlD+7/gTfNvuAybgLPNis=\"; pin-sha256=\"dd9ClLS4xSTx8j2dH5/hjS6dPXTkzpzDcKeEX+3J74E=\"; pin-sha256=\"NO6gHdYxKGz47EYVvoXpJhxY3RXfoM1O56gPrOGmrg8=\"; max-age=7776000; includeSubDomains;";