diff options
| -rw-r--r-- | roles/nginx/defaults/main.yaml | 4 | ||||
| -rw-r--r-- | roles/nginx/tasks/main.yaml | 4 | ||||
| -rw-r--r-- | roles/pleroma/templates/pleroma.cloudflare.nginx.conf.j2 | 74 | ||||
| -rw-r--r-- | roles/pleroma/templates/pleroma.nginx.conf.j2 | 4 |
4 files changed, 81 insertions, 5 deletions
diff --git a/roles/nginx/defaults/main.yaml b/roles/nginx/defaults/main.yaml index 8d65d55..c0db79d 100644 --- a/roles/nginx/defaults/main.yaml +++ b/roles/nginx/defaults/main.yaml @@ -2,7 +2,9 @@ nginx_port: 80 nginx_ssl_port: 443 -nginx_enable_ssl: No +nginx_ssl_cert: "/etc/letsencrypt/live/{{nginx_server_name}}/fullchain.pem" +nginx_ssl_privkey: "/etc/letsencrypt/live/{{nginx_server_name}}/privkey.pem" +nginx_enable_certbot: No nginx_server_name: "{{ansible_host}}" nginx_conf_dst: "{{nginx_server_name}}.nginx.conf" nginx_admin_email: "admin@{{nginx_server_name}}" diff --git a/roles/nginx/tasks/main.yaml b/roles/nginx/tasks/main.yaml index e255410..74c6d7e 100644 --- a/roles/nginx/tasks/main.yaml +++ b/roles/nginx/tasks/main.yaml @@ -13,13 +13,13 @@ become: yes apt: name="python-certbot-nginx" notify: restart nginx - when: nginx_enable_ssl + when: nginx_enable_certbot - name: install certbot in nginx become: yes command: "certbot certonly --nginx -n --agree-tos -d {{nginx_server_name}} -m {{nginx_admin_email}}" notify: restart nginx - when: nginx_enable_ssl + when: nginx_enable_certbot - name: disable default site become: yes diff --git a/roles/pleroma/templates/pleroma.cloudflare.nginx.conf.j2 b/roles/pleroma/templates/pleroma.cloudflare.nginx.conf.j2 new file mode 100644 index 0000000..284d280 --- /dev/null +++ b/roles/pleroma/templates/pleroma.cloudflare.nginx.conf.j2 @@ -0,0 +1,74 @@ +# default nginx site config for Pleroma +# +# Simple installation instructions: +# 1. Install your TLS certificate, possibly using Let's Encrypt. +# 2. Replace 'example.tld' with your instance's domain wherever it appears. +# 3. Copy this file to /etc/nginx/sites-available/ and then add a symlink to it +# in /etc/nginx/sites-enabled/ and run 'nginx -s reload' or restart nginx. + +proxy_cache_path /tmp/{{pleroma_user}}-pleroma-media-cache levels=1:2 keys_zone={{pleroma_user}}-pleroma_media_cache:10m max_size=10g + inactive=720m use_temp_path=off; + +server { + listen {{nginx_port}}; + # listen [::]:{{nginx_port}}; + server_name _; + return 301 https://$host$request_uri; +} + +# Enable SSL session caching for improved performance +ssl_session_cache shared:ssl_session_cache:10m; + +server { + listen {{nginx_ssl_port}} ssl http2; + # listen [::]:{{nginx_ssl_port}} ssl ipv6only=on; + server_name _; + + ssl_certificate {{nginx_ssl_cert}}; + ssl_certificate_key {{nginx_ssl_privkey}}; + include /etc/letsencrypt/options-ssl-nginx.conf; + # ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; + + ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1; + ssl_stapling on; + ssl_stapling_verify on; + + add_header Strict-Transport-Security "max-age=31536000" always; + + gzip_vary on; + gzip_proxied any; + gzip_comp_level 6; + gzip_buffers 16 8k; + gzip_http_version 1.1; + gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript application/activity+json application/atom+xml; + + # the nginx default is 1m, not enough for large media uploads + client_max_body_size 16m; + + location / { + add_header X-XSS-Protection "1; mode=block"; + add_header X-Permitted-Cross-Domain-Policies none; + add_header X-Frame-Options DENY; + add_header X-Content-Type-Options nosniff; + add_header Referrer-Policy same-origin; + add_header X-Download-Options noopen; + + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; + + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header Host $http_host; + + proxy_pass {{pleroma_proxy_pass}}; + + client_max_body_size 16m; + } + + location /proxy { + proxy_cache {{pleroma_user}}-pleroma_media_cache; + proxy_cache_lock on; + proxy_ignore_client_abort on; + proxy_pass {{pleroma_proxy_pass}}; + } +} diff --git a/roles/pleroma/templates/pleroma.nginx.conf.j2 b/roles/pleroma/templates/pleroma.nginx.conf.j2 index b760a44..1d5fb9d 100644 --- a/roles/pleroma/templates/pleroma.nginx.conf.j2 +++ b/roles/pleroma/templates/pleroma.nginx.conf.j2 @@ -33,8 +33,8 @@ server { # listen [::]:{{nginx_ssl_port}} ssl ipv6only=on; server_name {{nginx_server_name}}; - ssl_certificate /etc/letsencrypt/live/{{nginx_server_name}}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/{{nginx_server_name}}/privkey.pem; + ssl_certificate {{nginx_ssl_cert}}; + ssl_certificate_key {{nginx_ssl_privkey}}; include /etc/letsencrypt/options-ssl-nginx.conf; ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; |