diff options
Diffstat (limited to 'playbooks/roles')
10 files changed, 40 insertions, 11 deletions
diff --git a/playbooks/roles/nginx-proxy/templates/docker-compose.yml b/playbooks/roles/nginx-proxy/templates/docker-compose.yml index 77eda61..33b3243 100644 --- a/playbooks/roles/nginx-proxy/templates/docker-compose.yml +++ b/playbooks/roles/nginx-proxy/templates/docker-compose.yml @@ -25,6 +25,9 @@ services: environment: - TZ={{ timezone }} - DEPLOYMENT_TIME={{ deployment_time }} + - NO_COLOR=1 + - LOG_JSON=true + - TRUST_DOWNSTREAM_PROXY=false networks: - proxy labels: diff --git a/playbooks/roles/nginx-proxy/templates/toplevel.conf.d/stream.conf b/playbooks/roles/nginx-proxy/templates/toplevel.conf.d/stream.conf index fdf1a88..3e7c125 100644 --- a/playbooks/roles/nginx-proxy/templates/toplevel.conf.d/stream.conf +++ b/playbooks/roles/nginx-proxy/templates/toplevel.conf.d/stream.conf @@ -1,9 +1,6 @@ {% if not homelab_build %} stream { - log_format basic '$proxy_protocol_addr - [$time_local] ' - '$protocol $status $bytes_sent $bytes_received ' - '$session_time'; upstream imaps { server {{ vpn_proxy_filter_container_name }}:993; } diff --git a/playbooks/roles/outbound/templates/proxy/nginx/conf.d/bin.conf b/playbooks/roles/outbound/templates/proxy/nginx/conf.d/bin.conf index 3c5682d..db2f957 100644 --- a/playbooks/roles/outbound/templates/proxy/nginx/conf.d/bin.conf +++ b/playbooks/roles/outbound/templates/proxy/nginx/conf.d/bin.conf @@ -3,6 +3,10 @@ server { server_name bin.liz.coffee; client_max_body_size 200M; + real_ip_header X-Forwarded-For; + real_ip_recursive on; + set_real_ip_from {{ docker_network }}; + location / { proxy_pass https://{{ loadbalancer_ip }}; proxy_ssl_verify off; @@ -10,7 +14,6 @@ server { proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; } diff --git a/playbooks/roles/outbound/templates/proxy/nginx/conf.d/idm.conf b/playbooks/roles/outbound/templates/proxy/nginx/conf.d/idm.conf index c85ebcf..95477b0 100644 --- a/playbooks/roles/outbound/templates/proxy/nginx/conf.d/idm.conf +++ b/playbooks/roles/outbound/templates/proxy/nginx/conf.d/idm.conf @@ -2,12 +2,15 @@ server { listen 80; server_name idm.liz.coffee; + real_ip_header X-Forwarded-For; + real_ip_recursive on; + set_real_ip_from {{ docker_network }}; + location / { proxy_pass https://{{ loadbalancer_ip }}; proxy_ssl_verify off; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; } } diff --git a/playbooks/roles/outbound/templates/proxy/nginx/conf.d/kanban.conf b/playbooks/roles/outbound/templates/proxy/nginx/conf.d/kanban.conf index b668310..e8c9458 100644 --- a/playbooks/roles/outbound/templates/proxy/nginx/conf.d/kanban.conf +++ b/playbooks/roles/outbound/templates/proxy/nginx/conf.d/kanban.conf @@ -2,12 +2,15 @@ server { listen 80; server_name kanban.liz.coffee; + real_ip_header X-Forwarded-For; + real_ip_recursive on; + set_real_ip_from {{ docker_network }}; + location / { proxy_pass https://{{ loadbalancer_ip }}; proxy_ssl_verify off; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; } } diff --git a/playbooks/roles/outbound/templates/proxy/nginx/conf.d/mail.conf b/playbooks/roles/outbound/templates/proxy/nginx/conf.d/mail.conf index c810f5a..11e2145 100644 --- a/playbooks/roles/outbound/templates/proxy/nginx/conf.d/mail.conf +++ b/playbooks/roles/outbound/templates/proxy/nginx/conf.d/mail.conf @@ -1,6 +1,11 @@ server { listen 80; server_name mail.liz.coffee; + + real_ip_header X-Forwarded-For; + real_ip_recursive on; + set_real_ip_from {{ docker_network }}; + location / { proxy_pass https://{{ loadbalancer_ip }}; proxy_ssl_verify off; @@ -8,7 +13,6 @@ server { proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; } diff --git a/playbooks/roles/outbound/templates/proxy/nginx/conf.d/notes.conf b/playbooks/roles/outbound/templates/proxy/nginx/conf.d/notes.conf index f7937dd..c38b948 100644 --- a/playbooks/roles/outbound/templates/proxy/nginx/conf.d/notes.conf +++ b/playbooks/roles/outbound/templates/proxy/nginx/conf.d/notes.conf @@ -2,12 +2,15 @@ server { listen 80; server_name notes.liz.coffee; + real_ip_header X-Forwarded-For; + real_ip_recursive on; + set_real_ip_from {{ docker_network }}; + location / { proxy_pass https://{{ loadbalancer_ip }}; proxy_ssl_verify off; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; } } diff --git a/playbooks/roles/outbound/templates/proxy/nginx/conf.d/src.conf b/playbooks/roles/outbound/templates/proxy/nginx/conf.d/src.conf index ad24e23..b786eac 100644 --- a/playbooks/roles/outbound/templates/proxy/nginx/conf.d/src.conf +++ b/playbooks/roles/outbound/templates/proxy/nginx/conf.d/src.conf @@ -1,6 +1,11 @@ server { listen 80; server_name src.liz.coffee; + + real_ip_header X-Forwarded-For; + real_ip_recursive on; + set_real_ip_from {{ docker_network }}; + location / { proxy_pass https://{{ loadbalancer_ip }}; proxy_ssl_verify off; @@ -8,7 +13,6 @@ server { proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; } diff --git a/playbooks/roles/src/templates/stacks/docker-compose.yml b/playbooks/roles/src/templates/stacks/docker-compose.yml index 4ffd1ef..344dfc5 100644 --- a/playbooks/roles/src/templates/stacks/docker-compose.yml +++ b/playbooks/roles/src/templates/stacks/docker-compose.yml @@ -7,11 +7,16 @@ services: - "2222:2222" environment: - TZ={{ timezone }} - - DEPLOYMENT_TIME={{ now() }} + - DEPLOYMENT_TIME={{ deployment_time }} - SOFT_SERVE_NAME={{ src_domain }} + - SOFT_SERVE_SSH_LISTEN_ADDR=:2222 + - SOFT_SERVE_HTTP_LISTEN_ADDR=:8000 + - SOFT_SERVE_STATS_LISTEN_ADDR=:8001 - SOFT_SERVE_HTTP_PUBLIC_URL=https://{{ src_domain }} - SOFT_SERVE_SSH_PUBLIC_URL=ssh://{{ src_domain }}:2222 - SOFT_SERVE_INITIAL_ADMIN_KEYS={{ src_admin_keys }} + - SOFT_SERVE_GIT_MAX_CONNECTIONS=20 + - SOFT_SERVE_LOG_FORMAT=json networks: - proxy healthcheck: @@ -36,7 +41,7 @@ services: - traefik.http.routers.src.tls.certResolver=letsencrypt - traefik.http.routers.src.rule=Host(`{{ src_domain }}`) - traefik.http.routers.src.entrypoints=websecure - - traefik.http.services.src.loadbalancer.server.port=23232 + - traefik.http.services.src.loadbalancer.server.port=8000 networks: proxy: diff --git a/playbooks/roles/traefik/templates/stacks/traefik.yml b/playbooks/roles/traefik/templates/stacks/traefik.yml index ceeb0cb..98c333e 100644 --- a/playbooks/roles/traefik/templates/stacks/traefik.yml +++ b/playbooks/roles/traefik/templates/stacks/traefik.yml @@ -16,6 +16,10 @@ entryPoints: scheme: https websecure: address: ":443" + forwardedHeaders: + trustedIPs: + - "{{ homelab_network }}" + serversTransport: insecureSkipVerify: true providers: |