From c5ba641b1cb66e19c23691995bcd0661fbf4d027 Mon Sep 17 00:00:00 2001 From: Luke Hoersten Date: Thu, 3 Jan 2019 20:46:13 -0600 Subject: Lots of updates. --- main.yaml | 23 ++++++-------- roles/nginx/base/defaults/main.yaml | 3 -- roles/nginx/base/handlers/main.yaml | 5 --- roles/nginx/base/tasks/certbot.yaml | 12 ------- roles/nginx/base/tasks/main.yaml | 17 ---------- roles/nginx/defaults/main.yaml | 8 +++++ roles/nginx/handlers/main.yaml | 5 +++ roles/nginx/site/defaults/main.yaml | 7 ----- roles/nginx/site/handlers/main.yaml | 5 --- roles/nginx/site/meta/main.yaml | 4 --- roles/nginx/site/tasks/main.yaml | 20 ------------ roles/nginx/tasks/main.yaml | 45 +++++++++++++++++++++++++++ roles/pleroma/defaults/main.yaml | 15 ++++++--- roles/pleroma/meta/main.yaml | 2 +- roles/pleroma/tasks/main.yaml | 2 +- roles/pleroma/templates/pleroma.nginx.conf.j2 | 12 +++---- roles/pleroma/templates/pleroma.service.j2 | 1 + roles/pleroma/templates/prod.secret.exs.j2 | 8 +++-- 18 files changed, 93 insertions(+), 101 deletions(-) delete mode 100644 roles/nginx/base/defaults/main.yaml delete mode 100644 roles/nginx/base/handlers/main.yaml delete mode 100644 roles/nginx/base/tasks/certbot.yaml delete mode 100644 roles/nginx/base/tasks/main.yaml create mode 100644 roles/nginx/defaults/main.yaml create mode 100644 roles/nginx/handlers/main.yaml delete mode 100644 roles/nginx/site/defaults/main.yaml delete mode 100644 roles/nginx/site/handlers/main.yaml delete mode 100644 roles/nginx/site/meta/main.yaml delete mode 100644 roles/nginx/site/tasks/main.yaml create mode 100644 roles/nginx/tasks/main.yaml diff --git a/main.yaml b/main.yaml index 96c2cd4..81108fd 100644 --- a/main.yaml +++ b/main.yaml @@ -16,25 +16,22 @@ become: yes timezone: name="UTC" + - name: authorize ssh keys + authorized_key: + user: "ubuntu" + key: "https://github.com/LukeHoersten.keys" + - hosts: pleroma roles: - role: pleroma - pleroma_host: "haskell.social" pleroma_user: "pleroma_haskell_social" + pleroma_link_host: "haskell.social" pleroma_port: 4001 +- hosts: pleroma + roles: - role: pleroma - pleroma_host: "nth.io" pleroma_user: "pleroma_nth_io" + pleroma_link_host: "nth.io" pleroma_port: 4000 - - -# - hosts: haskell.social -# roles: -# - nginx -# - pleroma - -# - hosts: nth.io -# roles: -# - nginx -# - pleroma + pleroma_signup_open: "false" diff --git a/roles/nginx/base/defaults/main.yaml b/roles/nginx/base/defaults/main.yaml deleted file mode 100644 index 44b37f8..0000000 --- a/roles/nginx/base/defaults/main.yaml +++ /dev/null @@ -1,3 +0,0 @@ ---- - -nginx_enable_ssl: No diff --git a/roles/nginx/base/handlers/main.yaml b/roles/nginx/base/handlers/main.yaml deleted file mode 100644 index 1feca07..0000000 --- a/roles/nginx/base/handlers/main.yaml +++ /dev/null @@ -1,5 +0,0 @@ ---- - -- name: restart nginx - become: yes - systemd: name="nginx" state="restarted" daemon_reload="yes" diff --git a/roles/nginx/base/tasks/certbot.yaml b/roles/nginx/base/tasks/certbot.yaml deleted file mode 100644 index 194f5c9..0000000 --- a/roles/nginx/base/tasks/certbot.yaml +++ /dev/null @@ -1,12 +0,0 @@ ---- - -# https://certbot.eff.org/lets-encrypt/ubuntuxenial-nginx - -- name: add certbot (letsencrypt) repo - become: yes - apt_repository: repo="ppa:certbot/certbot" - -- name: install nginx packages - become: yes - apt: name="python-certbot-nginx" - notify: restart nginx diff --git a/roles/nginx/base/tasks/main.yaml b/roles/nginx/base/tasks/main.yaml deleted file mode 100644 index ee66773..0000000 --- a/roles/nginx/base/tasks/main.yaml +++ /dev/null @@ -1,17 +0,0 @@ ---- - -- name: install nginx packages - become: yes - apt: name="nginx" - -- name: disable default site - become: yes - file: path="/etc/nginx/sites-enabled/default" state="absent" - notify: restart nginx - -- import_tasks: certbot.yaml - when: nginx_enable_ssl - -- name: enable nginx service - become: yes - systemd: name="nginx" enabled="yes" state="started" diff --git a/roles/nginx/defaults/main.yaml b/roles/nginx/defaults/main.yaml new file mode 100644 index 0000000..8d65d55 --- /dev/null +++ b/roles/nginx/defaults/main.yaml @@ -0,0 +1,8 @@ +--- + +nginx_port: 80 +nginx_ssl_port: 443 +nginx_enable_ssl: No +nginx_server_name: "{{ansible_host}}" +nginx_conf_dst: "{{nginx_server_name}}.nginx.conf" +nginx_admin_email: "admin@{{nginx_server_name}}" diff --git a/roles/nginx/handlers/main.yaml b/roles/nginx/handlers/main.yaml new file mode 100644 index 0000000..1feca07 --- /dev/null +++ b/roles/nginx/handlers/main.yaml @@ -0,0 +1,5 @@ +--- + +- name: restart nginx + become: yes + systemd: name="nginx" state="restarted" daemon_reload="yes" diff --git a/roles/nginx/site/defaults/main.yaml b/roles/nginx/site/defaults/main.yaml deleted file mode 100644 index 0092918..0000000 --- a/roles/nginx/site/defaults/main.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- - -nginx_port: 80 -nginx_ssl_port: 443 -nginx_server_name: "{{ansible_host}}" -nginx_conf_dst: "{{nginx_server_name}}.nginx.conf" -nginx_admin_email: "admin@{{nginx_server_name}}" diff --git a/roles/nginx/site/handlers/main.yaml b/roles/nginx/site/handlers/main.yaml deleted file mode 100644 index 1feca07..0000000 --- a/roles/nginx/site/handlers/main.yaml +++ /dev/null @@ -1,5 +0,0 @@ ---- - -- name: restart nginx - become: yes - systemd: name="nginx" state="restarted" daemon_reload="yes" diff --git a/roles/nginx/site/meta/main.yaml b/roles/nginx/site/meta/main.yaml deleted file mode 100644 index af2cf0f..0000000 --- a/roles/nginx/site/meta/main.yaml +++ /dev/null @@ -1,4 +0,0 @@ ---- - -dependencies: - - nginx/base diff --git a/roles/nginx/site/tasks/main.yaml b/roles/nginx/site/tasks/main.yaml deleted file mode 100644 index 9b51013..0000000 --- a/roles/nginx/site/tasks/main.yaml +++ /dev/null @@ -1,20 +0,0 @@ ---- - -- name: install site - become: yes - template: src="{{nginx_conf_src}}" dest="/etc/nginx/sites-available/{{nginx_conf_dst}}" - notify: restart nginx - -- name: install certbot in nginx - become: yes - command: "certbot certonly --nginx -n --agree-tos -d {{nginx_server_name}} -m {{nginx_admin_email}}" - notify: restart nginx - when: nginx_enable_ssl - -- name: enable site - become: yes - file: - src: "/etc/nginx/sites-available/{{nginx_conf_dst}}" - dest: "/etc/nginx/sites-enabled/{{nginx_conf_dst}}" - state: "link" - notify: restart nginx diff --git a/roles/nginx/tasks/main.yaml b/roles/nginx/tasks/main.yaml new file mode 100644 index 0000000..7a0589f --- /dev/null +++ b/roles/nginx/tasks/main.yaml @@ -0,0 +1,45 @@ +--- + +- name: install nginx packages + become: yes + apt: name="nginx" + +- name: install site + become: yes + template: src="{{nginx_conf_src}}" dest="/etc/nginx/sites-available/{{nginx_conf_dst}}" + notify: restart nginx + +# https://certbot.eff.org/lets-encrypt/ubuntuxenial-nginx +- name: add certbot (letsencrypt) repo + become: yes + apt_repository: repo="ppa:certbot/certbot" + when: nginx_enable_ssl + +- name: install nginx packages + become: yes + apt: name="python-certbot-nginx" + notify: restart nginx + when: nginx_enable_ssl + +- name: install certbot in nginx + become: yes + command: "certbot certonly --nginx -n --agree-tos -d {{nginx_server_name}} -m {{nginx_admin_email}}" + notify: restart nginx + when: nginx_enable_ssl + +- name: disable default site + become: yes + file: path="/etc/nginx/sites-enabled/default" state="absent" + notify: restart nginx + +- name: enable site + become: yes + file: + src: "/etc/nginx/sites-available/{{nginx_conf_dst}}" + dest: "/etc/nginx/sites-enabled/{{nginx_conf_dst}}" + state: "link" + notify: restart nginx + +- name: enable nginx service + become: yes + systemd: name="nginx" enabled="yes" state="started" diff --git a/roles/pleroma/defaults/main.yaml b/roles/pleroma/defaults/main.yaml index c9cbf1d..5d2569f 100644 --- a/roles/pleroma/defaults/main.yaml +++ b/roles/pleroma/defaults/main.yaml @@ -1,12 +1,19 @@ --- pleroma_user: "pleroma" -pleroma_instance_name: "{{pleroma_host}}" -pleroma_desc: "A Pleroma fediverse instance." + pleroma_host: "localhost" -pleroma_scheme: "http" pleroma_port: 4000 -pleroma_url: "{{pleroma_scheme}}://{{pleroma_host}}:{{pleroma_port}}" +pleroma_scheme: "http" + +pleroma_proxy_pass: "{{pleroma_scheme}}://{{pleroma_host}}:{{pleroma_port}}" + +pleroma_link_host: "localhost" +pleroma_link_port: "443" +pleroma_link_scheme: "https" + +pleroma_instance_name: "{{pleroma_link_host}}" +pleroma_desc: "A Pleroma fediverse instance." pleroma_admin_email: "admin@{{pleroma_host}}" pleroma_char_limit: 5000 pleroma_signup_open: "true" diff --git a/roles/pleroma/meta/main.yaml b/roles/pleroma/meta/main.yaml index efae8cd..d7aa38d 100644 --- a/roles/pleroma/meta/main.yaml +++ b/roles/pleroma/meta/main.yaml @@ -1,4 +1,4 @@ --- dependencies: - - nginx/site + - nginx diff --git a/roles/pleroma/tasks/main.yaml b/roles/pleroma/tasks/main.yaml index 0d4ed29..f34952b 100644 --- a/roles/pleroma/tasks/main.yaml +++ b/roles/pleroma/tasks/main.yaml @@ -67,7 +67,7 @@ - "mix local.hex --force" - "mix local.rebar --force" - "mix deps.get" - - "mix ecto.migrate" + # - "mix ecto.migrate" notify: restart pleroma environment: MIX_ENV: "prod" diff --git a/roles/pleroma/templates/pleroma.nginx.conf.j2 b/roles/pleroma/templates/pleroma.nginx.conf.j2 index 34cec8a..b760a44 100644 --- a/roles/pleroma/templates/pleroma.nginx.conf.j2 +++ b/roles/pleroma/templates/pleroma.nginx.conf.j2 @@ -6,12 +6,12 @@ # 3. Copy this file to /etc/nginx/sites-available/ and then add a symlink to it # in /etc/nginx/sites-enabled/ and run 'nginx -s reload' or restart nginx. -proxy_cache_path /tmp/pleroma-media-cache levels=1:2 keys_zone=pleroma_media_cache:10m max_size=10g +proxy_cache_path /tmp/{{pleroma_user}}-pleroma-media-cache levels=1:2 keys_zone={{pleroma_user}}-pleroma_media_cache:10m max_size=10g inactive=720m use_temp_path=off; server { listen {{nginx_port}}; - listen [::]:{{nginx_port}}; + # listen [::]:{{nginx_port}}; server_name {{nginx_server_name}}; return 301 https://$server_name$request_uri; @@ -30,7 +30,7 @@ ssl_session_cache shared:ssl_session_cache:10m; server { listen {{nginx_ssl_port}} ssl http2; - listen [::]:{{nginx_ssl_port}} ssl ipv6only=on; + # listen [::]:{{nginx_ssl_port}} ssl ipv6only=on; server_name {{nginx_server_name}}; ssl_certificate /etc/letsencrypt/live/{{nginx_server_name}}/fullchain.pem; @@ -81,15 +81,15 @@ server { proxy_set_header Connection "upgrade"; proxy_set_header Host $http_host; - proxy_pass {{pleroma_url}}; + proxy_pass {{pleroma_proxy_pass}}; client_max_body_size 16m; } location /proxy { - proxy_cache pleroma_media_cache; + proxy_cache {{pleroma_user}}-pleroma_media_cache; proxy_cache_lock on; proxy_ignore_client_abort on; - proxy_pass {{pleroma_url}}; + proxy_pass {{pleroma_proxy_pass}}; } } diff --git a/roles/pleroma/templates/pleroma.service.j2 b/roles/pleroma/templates/pleroma.service.j2 index 15a0879..e024200 100644 --- a/roles/pleroma/templates/pleroma.service.j2 +++ b/roles/pleroma/templates/pleroma.service.j2 @@ -9,6 +9,7 @@ User={{pleroma_user}} WorkingDirectory=/home/{{pleroma_user}}/pleroma Environment="HOME=/home/{{pleroma_user}}" Environment="MIX_ENV=prod" +Environment="PLUG_TMPDIR=/tmp/{{pleroma_user}}" ExecStart=/usr/local/bin/mix phx.server ExecReload=/bin/kill $MAINPID KillMode=process diff --git a/roles/pleroma/templates/prod.secret.exs.j2 b/roles/pleroma/templates/prod.secret.exs.j2 index d39f57d..2c4d9f2 100644 --- a/roles/pleroma/templates/prod.secret.exs.j2 +++ b/roles/pleroma/templates/prod.secret.exs.j2 @@ -1,7 +1,7 @@ use Mix.Config config :pleroma, Pleroma.Web.Endpoint, - url: [host: "{{pleroma_host}}", scheme: "{{pleroma_scheme}}", port: 443], + url: [host: "{{pleroma_link_host}}", scheme: "{{pleroma_link_scheme}}", port: {{pleroma_link_port}}], http: [port: {{pleroma_port}}], secret_key_base: "{{pleroma_secret_key}}" @@ -10,8 +10,10 @@ config :pleroma, :instance, description: "{{pleroma_desc}}", email: "{{pleroma_admin_email}}", limit: {{pleroma_char_limit}}, - registrations_open: {{pleroma_signup_open}}, - dedupe_media: true + registrations_open: {{pleroma_signup_open}} + +config :pleroma, Pleroma.Upload, + filters: [Pleroma.Upload.Filter.Dedupe] config :pleroma, :media_proxy, enabled: false, -- cgit v1.2.3