diff options
| -rw-r--r-- | compose/nginx/conf.d/dybiec.info.conf | 168 | ||||
| -rw-r--r-- | compose/nginx/nginx.conf | 2 | ||||
| -rw-r--r-- | docker.yml | 13 | ||||
| -rw-r--r-- | domains.yml | 34 | ||||
| -rw-r--r-- | templates/nginx.conf.j2 | 32 |
5 files changed, 81 insertions, 168 deletions
diff --git a/compose/nginx/conf.d/dybiec.info.conf b/compose/nginx/conf.d/dybiec.info.conf deleted file mode 100644 index 90cd471..0000000 --- a/compose/nginx/conf.d/dybiec.info.conf +++ /dev/null @@ -1,168 +0,0 @@ -server { - listen 80; - listen 443 ssl; - server_name .dybiec.info; - - ssl_certificate /etc/letsencrypt/live/dybiec.info/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/dybiec.info/privkey.pem; - - location / { - root /usr/share/nginx/html; - index index.html; - } - -} -server { - listen 80; - listen 443 ssl; - server_name cnt.dybiec.info; - - ssl_certificate /etc/letsencrypt/live/dybiec.info/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/dybiec.info/privkey.pem; - - location / { - proxy_pass http://localhost:5004; - } -} -server { - listen 80; - listen 443 ssl; - server_name registry.dybiec.info; - - ssl_certificate /etc/letsencrypt/live/dybiec.info/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/dybiec.info/privkey.pem; - - location / { - proxy_pass http://localhost:5000; - proxy_set_header Host $http_host; # required for docker client's sake - proxy_set_header X-Real-IP $remote_addr; # pass on real client's IP - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - client_max_body_size 0; - } -} -server { - listen 80; - server_name git.dybiec.info; - return 301 https://$server_name$request_uri; -} -server { - listen 443 ssl; - server_name git.dybiec.info; - - ssl_certificate /etc/letsencrypt/live/dybiec.info/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/dybiec.info/privkey.pem; - - location / { - proxy_pass http://localhost:5001; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header Host $http_host; - proxy_redirect off; - proxy_http_version 1.1; - } - gzip_proxied any; - gzip_types - text/css - text/javascript - text/xml - text/plain - application/javascript - application/x-javascript - application/json; - -} -server { - listen 80; - server_name grafana.dybiec.info; - return 301 https://$server_name$request_uri; -} -server { - listen 443 ssl; - server_name grafana.dybiec.info; - - ssl_certificate /etc/letsencrypt/live/dybiec.info/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/dybiec.info/privkey.pem; - - location / { - proxy_pass http://localhost:5002; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header Host $http_host; - proxy_redirect off; - proxy_http_version 1.1; - } - gzip_proxied any; - gzip_types - text/css - text/javascript - text/xml - text/plain - application/javascript - application/x-javascript - application/json; - -} -server { - listen 80; - server_name prometheus.dybiec.info; - return 301 https://$server_name$request_uri; -} -server { - listen 443 ssl; - server_name prometheus.dybiec.info; - - ssl_certificate /etc/letsencrypt/live/dybiec.info/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/dybiec.info/privkey.pem; - - location / { - proxy_pass http://localhost:5003; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header Host $http_host; - proxy_redirect off; - proxy_http_version 1.1; - } - gzip_proxied any; - gzip_types - text/css - text/javascript - text/xml - text/plain - application/javascript - application/x-javascript - application/json; - -} -server { - listen 80; - server_name octoprint.dybiec.info; - return 301 https://$server_name$request_uri; -} -server { - listen 443 ssl; - server_name octoprint.dybiec.info; - - ssl_certificate /etc/letsencrypt/live/dybiec.info/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/dybiec.info/privkey.pem; - - location / { - proxy_pass http://192.168.255.6/; - proxy_redirect off; - proxy_http_version 1.1; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header Host $http_host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "Upgrade"; - - client_max_body_size 0; - } - gzip_proxied any; - gzip_types - text/css - text/javascript - text/xml - text/plain - application/javascript - application/x-javascript - application/json; - -} diff --git a/compose/nginx/nginx.conf b/compose/nginx/nginx.conf index aa6cbd7..fc640c2 100644 --- a/compose/nginx/nginx.conf +++ b/compose/nginx/nginx.conf @@ -19,6 +19,8 @@ http { '"$http_user_agent" "$http_x_forwarded_for"'; access_log /var/log/nginx/access.log main; + ssl_certificate /etc/letsencrypt/live/dybiec.info/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/dybiec.info/privkey.pem; sendfile on; tcp_nopush on; diff --git a/docker.yml b/docker.yml index cd86979..806309a 100644 --- a/docker.yml +++ b/docker.yml @@ -4,11 +4,24 @@ remote_user: ansible_worker vars: docker_compose_dir: "~/compose" + vars_files: + - domains.yml tasks: + - name: Remove old config + file: + path: "{{docker_compose_dir}}" + state: absent - name: Synchronize docker-compose files synchronize: src: compose/ dest: "{{docker_compose_dir}}" + - name: Generate nginx conf + template: + src: templates/nginx.conf.j2 + dest: "{{docker_compose_dir}}/nginx/conf.d/{{item.value.name}}.conf" + vars: + server: "{{item.value}}" + with_items: "{{domains | dict2items}}" - name: Counter app docker_service: project_name: app diff --git a/domains.yml b/domains.yml new file mode 100644 index 0000000..79e8ef4 --- /dev/null +++ b/domains.yml @@ -0,0 +1,34 @@ +--- +domains: + main: + name: ".dybiec.info" + dir: "/usr/share/nginx/html" + registry: + name: "registry.dybiec.info" + proxy: + port: 5000 + git: + name: "git.dybiec.info" + http_redirect: true + proxy: + port: 5001 + grafana: + name: "grafana.dybiec.info" + http_redirect: true + proxy: + port: 5002 + prometheus: + name: "prometheus.dybiec.info" + http_redirect: true + proxy: + port: 5003 + cnt: + name: "cnt.dybiec.info" + proxy: + port: 5004 + octoprint: + name: "octoprint.dybiec.info" + http_redirect: true + proxy: + host: "192.168.255.6" + diff --git a/templates/nginx.conf.j2 b/templates/nginx.conf.j2 new file mode 100644 index 0000000..69b8d36 --- /dev/null +++ b/templates/nginx.conf.j2 @@ -0,0 +1,32 @@ +{% if server.http_redirect is defined and server.http_redirect %} +server { + listen 80; + server_name {{ server.name }}; + return 301 https://$server_name$request_uri; +} +{% endif %} + +server { + {% if server.http_redirect is not defined or not server.http_redirect %} + listen 80; + {% endif %} + listen 443 ssl; + server_name {{ server.name }}; + + location / { + {% if server.dir is defined %} + root {{ server.dir }}; + index index.html; + {% endif %} + {% if server.proxy is defined %} + proxy_pass http://{{server.proxy.host|default("localhost")}}:{{server.proxy.port|default("80")}}; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header Host $http_host; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_redirect off; + proxy_http_version 1.1; + {% endif %} + } + +} |