kevinveenbirkenbach/computer-playbook
1
0
Fork 0
mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2025-05-18 10:40:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

Added more CSP conditions

Browse Source
This commit is contained in:
Kevin Veen-Birkenbach 2025-05-15 12:56:22 +02:00
parent f7cfd13d5a
commit 20020cca92
No known key found for this signature in database
GPG Key ID: 44D8F11FD62F878E
23 changed files with 65 additions and 50 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
filter_plugins/csp_filters.py
View File

@ -93,6 +93,7 @@ class FilterModule(object):
'style-src',
'font-src',
'worker-src',
'manifest-src',
]
parts = []

4
group_vars/all/03_domains.yml
View File

@ -27,8 +27,8 @@ defaults_domains:
mastodon_alternates:
- "mastodon.{{primary_domain}}"
matomo: "matomo.{{primary_domain}}"
matrix_synapse: "matrix.{{primary_domain}}"
matrix_element: "element.{{primary_domain}}"
synapse: "matrix.{{primary_domain}}"
element: "element.{{primary_domain}}"
moodle: "academy.{{primary_domain}}"
mediawiki: "wiki.{{primary_domain}}"
nextcloud: "cloud.{{primary_domain}}"

4
group_vars/all/08_ports.yml
View File

@ -36,8 +36,8 @@ ports:
matomo: 8018
listmonk: 8019
discourse: 8020
matrix_synapse: 8021
matrix_element: 8022
synapse: 8021
element: 8022
openproject: 8023
gitlab: 8024
akaunting: 8025

2
group_vars/all/15_about.yml
View File

@ -19,7 +19,7 @@ defaults_service_provider:
bluesky: "{{ '@' ~ users.administrator.username ~ '.' ~ domains.bluesky_api if 'bluesky' in group_names else '' }}"
email: "contact@{{ primary_domain }}"
mastodon: "{{ '@' ~ users.administrator.username ~ '@' ~ domains.mastodon if 'mastodon' in group_names else '' }}"
matrix: "{{ '@' ~ users.administrator.username ~ ':' ~ domains.matrix_synapse if 'matrix' in group_names else '' }}"
matrix: "{{ '@' ~ users.administrator.username ~ ':' ~ domains.synapse if 'matrix' in group_names else '' }}"
peertube: "{{ '@' ~ users.administrator.username ~ '@' ~ domains.peertube if 'peertube' in group_names else '' }}"
pixelfed: "{{ '@' ~ users.administrator.username ~ '@' ~ domains.pixelfed if 'pixelfed' in group_names else '' }}"
phone: "+0 000 000 404"

4
roles/docker-gitea/vars/configuration.yml
View File

@ -20,4 +20,6 @@ csp:
- "data:"
- "blob:"
worker-src:
- "blob:"
- "blob:"
manifest-src:
- "data:"

8
roles/docker-matrix-ansible/tasks/main.yml
View File

@ -3,8 +3,8 @@
include_role:
name: nginx-domain-setup
loop:
- "{{domains.matrix_element}}"
- "{{domains.matrix_synapse}}"
- "{{domains.element}}"
- "{{domains.synapse}}"
loop_control:
loop_var: domain
@ -129,13 +129,13 @@
#- name: add log.config
# template:
# src: "log.config.j2"
# dest: "{{docker_compose.directories.instance}}{{domains.matrix_synapse}}.log.config"
# dest: "{{docker_compose.directories.instance}}{{domains.synapse}}.log.config"
# notify: recreate matrix
#
## https://github.com/matrix-org/synapse/issues/6303
#- name: set correct folder permissions
# command:
# cmd: "docker run --rm --mount type=volume,src=matrix_synapse_data,dst=/data -e SYNAPSE_SERVER_NAME={{domains.matrix_synapse}} -e SYNAPSE_REPORT_STATS=no --entrypoint /bin/sh matrixdotorg/synapse:latest -c 'chown -vR 991:991 /data'"
# cmd: "docker run --rm --mount type=volume,src=matrix_synapse_data,dst=/data -e SYNAPSE_SERVER_NAME={{domains.synapse}} -e SYNAPSE_REPORT_STATS=no --entrypoint /bin/sh matrixdotorg/synapse:latest -c 'chown -vR 991:991 /data'"
#
#- name: add docker-compose.yml
# template:

2
roles/docker-matrix-ansible/templates/vars.yml.j2
View File

@ -8,7 +8,7 @@
# because you can't change the Domain after deployment.
#
# Example value: example.com
matrix_domain: "{{domains.matrix_synapse}}"
matrix_domain: "{{domains.synapse}}"
# The Matrix homeserver software to install.
# See:

20
roles/docker-matrix-compose/tasks/main.yml
View File

@ -7,8 +7,8 @@
include_role:
name: nginx-https-get-cert-modify-all
vars:
domain: "{{domains.matrix_synapse}}"
http_port: "{{ports.localhost.http.matrix_synapse}}"
domain: "{{domains.synapse}}"
http_port: "{{ports.localhost.http.synapse}}"
- name: create {{well_known_directory}}
file:
@ -21,21 +21,21 @@
src: "well-known.j2"
dest: "{{well_known_directory}}server"
- name: create {{domains.matrix_synapse}}.conf
- name: create {{domains.synapse}}.conf
template:
src: "templates/nginx.conf.j2"
dest: "{{nginx.directories.http.servers}}{{domains.matrix_synapse}}.conf"
dest: "{{nginx.directories.http.servers}}{{domains.synapse}}.conf"
vars:
domain: "{{domains.matrix_synapse}}" # Didn't work in the past. May it works now. This does not seem to work @todo Check how to solve without declaring set_fact, seems a bug at templates
http_port: "{{ports.localhost.http.matrix_synapse}}"
domain: "{{domains.synapse}}" # Didn't work in the past. May it works now. This does not seem to work @todo Check how to solve without declaring set_fact, seems a bug at templates
http_port: "{{ports.localhost.http.synapse}}"
notify: restart nginx
- name: "include role nginx-domain-setup for {{application_id}}"
include_role:
name: nginx-domain-setup
vars:
domain: "{{domains.matrix_element}}"
http_port: "{{ports.localhost.http.matrix_element}}"
domain: "{{domains.element}}"
http_port: "{{ports.localhost.http.element}}"
- name: include create-and-seed-database.yml for multiple bridges
include_tasks: create-and-seed-database.yml
@ -85,13 +85,13 @@
- name: add synapse log configuration
template:
src: "synapse/log.config.j2"
dest: "{{docker_compose.directories.instance}}{{domains.matrix_synapse}}.log.config"
dest: "{{docker_compose.directories.instance}}{{domains.synapse}}.log.config"
notify: docker compose project setup
# https://github.com/matrix-org/synapse/issues/6303
- name: set correct folder permissions
command:
cmd: "docker run --rm --mount type=volume,src=matrix_synapse_data,dst=/data -e SYNAPSE_SERVER_NAME={{domains.matrix_synapse}} -e SYNAPSE_REPORT_STATS=no --entrypoint /bin/sh matrixdotorg/synapse:latest -c 'chown -vR 991:991 /data'"
cmd: "docker run --rm --mount type=volume,src=matrix_synapse_data,dst=/data -e SYNAPSE_SERVER_NAME={{domains.synapse}} -e SYNAPSE_REPORT_STATS=no --entrypoint /bin/sh matrixdotorg/synapse:latest -c 'chown -vR 991:991 /data'"
- name: add docker-compose.yml
template:

10
roles/docker-matrix-compose/templates/docker-compose.yml.j2
View File

@ -11,15 +11,15 @@ services:
volumes:
- synapse_data:/data
- ./homeserver.yaml:/data/homeserver.yaml:ro
- ./{{domains.matrix_synapse}}.log.config:/data/{{domains.matrix_synapse}}.log.config:ro
- ./{{domains.synapse}}.log.config:/data/{{domains.synapse}}.log.config:ro
{% for item in bridges %}
- {{docker_compose.directories.instance}}mautrix/{{item.bridge_name}}/registration.yaml:{{registration_file_folder}}{{item.bridge_name}}.registration.yaml:ro
{% endfor %}
environment:
- SYNAPSE_SERVER_NAME={{domains.matrix_synapse}}
- SYNAPSE_SERVER_NAME={{domains.synapse}}
- SYNAPSE_REPORT_STATS=no
ports:
- "127.0.0.1:{{ports.localhost.http.matrix_synapse}}:8008"
- "127.0.0.1:{{ports.localhost.http.synapse}}:8008"
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:8008/"]
interval: 1m
@ -39,7 +39,7 @@ services:
volumes:
- ./element-config.json:/app/config.json
ports:
- "127.0.0.1:{{ports.localhost.http.matrix_element}}:80"
- "127.0.0.1:{{ports.localhost.http.element}}:80"
healthcheck:
test: ["CMD", "wget", "--spider", "-q", "http://localhost:80/"]
interval: 1m
@ -89,7 +89,7 @@ services:
# KEYV_URL: ''
# KEYV_BOT_ENCRYPTION: 'false'
# KEYV_BOT_STORAGE: 'true'
# MATRIX_HOMESERVER_URL: 'https://{{domains.matrix_synapse}}'
# MATRIX_HOMESERVER_URL: 'https://{{domains.synapse}}'
# MATRIX_BOT_USERNAME: '@chatgptbot:{{applications.matrix.server_name}}'
# MATRIX_ACCESS_TOKEN: '{{ applications[application_id].credentials.chatgpt_bridge_access_token | default('') }}'
# MATRIX_BOT_PASSWORD: '{{applications[application_id].credentials.chatgpt_bridge_user_password}}'

4
roles/docker-matrix-compose/templates/element.config.json.j2
View File

@ -1,8 +1,8 @@
{
"default_server_config": {
"m.homeserver": {
"base_url": "{{ web_protocol }}://{{domains.matrix_synapse}}",
"server_name": "{{domains.matrix_synapse}}"
"base_url": "{{ web_protocol }}://{{domains.synapse}}",
"server_name": "{{domains.synapse}}"
},
"m.identity_server": {
"base_url": "{{ web_protocol }}://{{primary_domain}}"

2
roles/docker-matrix-compose/templates/mautrix/facebook.config.yml.j2
View File

@ -143,7 +143,7 @@ bridge:
sync_direct_chat_list: false
# Servers to always allow double puppeting from
double_puppet_server_map:
{{applications.matrix.server_name}}: {{domains.matrix_synapse}}
{{applications.matrix.server_name}}: {{domains.synapse}}
# Allow using double puppeting from any server with a valid client .well-known file.
double_puppet_allow_discovery: false
# Shared secrets for https://github.com/devture/matrix-synapse-shared-secret-auth

2
roles/docker-matrix-compose/templates/mautrix/instagram.config.yml.j2
View File

@ -134,7 +134,7 @@ bridge:
double_puppet_allow_discovery: false
# Servers to allow double puppeting from, even if double_puppet_allow_discovery is false.
double_puppet_server_map:
{{applications.matrix.server_name}}: https://{{domains.matrix_synapse}}
{{applications.matrix.server_name}}: https://{{domains.synapse}}
# Shared secret for https://github.com/devture/matrix-synapse-shared-secret-auth
#
# If set, custom puppets will be enabled automatically for local users

2
roles/docker-matrix-compose/templates/mautrix/signal.config.yml.j2
View File

@ -141,7 +141,7 @@ bridge:
federate_rooms: true
# Servers to always allow double puppeting from
double_puppet_server_map:
{{applications.matrix.server_name}}: https://{{domains.matrix_synapse}}
{{applications.matrix.server_name}}: https://{{domains.synapse}}
# Allow using double puppeting from any server with a valid client .well-known file.
double_puppet_allow_discovery: false
# Shared secrets for https://github.com/devture/matrix-synapse-shared-secret-auth

2
roles/docker-matrix-compose/templates/mautrix/slack.config.yml.j2
View File

@ -118,7 +118,7 @@ bridge:
# Servers to always allow double puppeting from
double_puppet_server_map:
{{applications.matrix.server_name}}: https://{{domains.matrix_synapse}}
{{applications.matrix.server_name}}: https://{{domains.synapse}}
# Allow using double puppeting from any server with a valid client .well-known file.
double_puppet_allow_discovery: false
# Shared secrets for https://github.com/devture/matrix-synapse-shared-secret-auth

2
roles/docker-matrix-compose/templates/mautrix/telegram.config.yml.j2
View File

@ -198,7 +198,7 @@ bridge:
sync_direct_chat_list: false
# Servers to always allow double puppeting from
double_puppet_server_map:
{{applications.matrix.server_name}}: https://{{domains.matrix_synapse}}
{{applications.matrix.server_name}}: https://{{domains.synapse}}
# Allow using double puppeting from any server with a valid client .well-known file.
double_puppet_allow_discovery: false
# Shared secrets for https://github.com/devture/matrix-synapse-shared-secret-auth

2
roles/docker-matrix-compose/templates/mautrix/whatsapp.config.yml.j2
View File

@ -236,7 +236,7 @@ bridge:
force_active_delivery_receipts: false
# Servers to always allow double puppeting from
double_puppet_server_map:
{{applications.matrix.server_name}}: https://{{domains.matrix_synapse}}
{{applications.matrix.server_name}}: https://{{domains.synapse}}
# Allow using double puppeting from any server with a valid client .well-known file.
double_puppet_allow_discovery: false
# Shared secrets for https://github.com/devture/matrix-synapse-shared-secret-auth

6
roles/docker-matrix-compose/templates/nginx.conf.j2
View File

@ -1,10 +1,10 @@
server {
{# Somehow .j2 doesn't interpretate the passed variable right. For this reasons this redeclaration is necessary #}
{# Could be that this is related to the set_fact use #}
{% set domain = domains.matrix_synapse %}
{% set http_port = ports.localhost.http.matrix_synapse %}
{% set domain = domains.synapse %}
{% set http_port = ports.localhost.http.synapse %}
server_name {{domains.matrix_synapse}};
server_name {{domains.synapse}};
{% include 'roles/letsencrypt/templates/ssl_header.j2' %}
# For the federation port

12
roles/docker-matrix-compose/templates/synapse/homeserver.yaml.j2
View File

@ -17,15 +17,15 @@ database:
host: "{{database_host}}"
cp_min: 5
cp_max: 10
log_config: "/data/{{domains.matrix_synapse}}.log.config"
log_config: "/data/{{domains.synapse}}.log.config"
media_store_path: "/data/media_store"
registration_shared_secret: "{{applications[application_id].credentials.registration_shared_secret}}"
report_stats: true
macaroon_secret_key: "{{applications[application_id].credentials.macaroon_secret_key}}"
form_secret: "{{applications[application_id].credentials.form_secret}}"
signing_key_path: "/data/{{domains.matrix_synapse}}.signing.key"
web_client_location: "{{ web_protocol }}://{{domains.matrix_element}}"
public_baseurl: "{{ web_protocol }}://{{domains.matrix_synapse}}"
signing_key_path: "/data/{{domains.synapse}}.signing.key"
web_client_location: "{{ web_protocol }}://{{domains.element}}"
public_baseurl: "{{ web_protocol }}://{{domains.synapse}}"
trusted_key_servers:
- server_name: "matrix.org"
admin_contact: 'mailto:{{users.administrator.email}}'
@ -39,10 +39,10 @@ email:
#require_transport_security: true
enable_tls: "{{ system_email.tls | upper }}"
notif_from: "Your Friendly %(app)s homeserver <{{ users['no-reply'].email }}>"
app_name: "Matrix on {{domains.matrix_synapse}}"
app_name: "Matrix on {{domains.synapse}}"
enable_notifs: true
notif_for_new_users: false
client_base_url: "{{domains.matrix_synapse}}"
client_base_url: "{{domains.synapse}}"
validation_token_lifetime: 15m
{% if applications[application_id].features.oidc | bool %}

2
roles/docker-matrix-compose/templates/synapse/log.config.j2
View File

@ -8,7 +8,7 @@ handlers:
file:
class: logging.handlers.RotatingFileHandler
formatter: precise
filename: /data/{{domains.matrix_synapse}}.homeserver.log
filename: /data/{{domains.synapse}}.homeserver.log
maxBytes: 10485760
backupCount: 3
console:

2
roles/docker-matrix-compose/templates/well-known.j2
View File

@ -1,3 +1,3 @@
{
"m.server": "{{domains.matrix_synapse}}:443"
"m.server": "{{domains.synapse}}:443"
}

9
roles/docker-matrix-compose/vars/configuration.yml
View File

@ -21,4 +21,11 @@ csp:
script-src:
unsafe-inline: true
style-src:
unsafe-inline: true
unsafe-inline: true
whitelist:
connect-src:
- "{{ domains.element }}"
- "{{ domains.synapse }}"
script-src:
- "{{ domains.element }}"
- "{{ domains.synapse }}"

3
roles/docker-moodle/vars/configuration.yml
View File

@ -19,4 +19,5 @@ csp:
whitelist:
font-src:
- "data:"
- "blob:"
- "blob:"
- "https://cdn.jsdelivr.net"

10
roles/docker-wordpress/vars/configuration.yml
View File

@ -19,11 +19,15 @@ features:
csp:
flags:
style-src:
unsafe-inline: true
unsafe-inline: true
script-src:
unsafe-inline: true
unsafe-inline: true
unsafe-eval: true
whitelist:
worker-src:
- "blob:"
font-src:
- "data:"
- "data:"
script-src:
- "https://cdn.gtranslate.net"
- "{{ domains[application_id] }}"