5 Commits

Author	SHA1	Message	Date
Kevin Veen-Birkenbach	493d5bbbda	refactor(web-app-shopware): externalize trusted proxy and host configuration with mounted framework.yaml ... - added new file roles/web-app-shopware/files/framework.yaml defining trusted_proxies and trusted_headers for Symfony - mounted framework.yaml into /var/www/html/config/packages/ in docker-compose - exposed new role vars SHOPWARE_FRAMEWORK_HOST/DOCKER for mounting path - rendered framework.yaml via Ansible copy task with proper permissions - adjusted env.j2 to set TRUSTED_PROXIES and TRUSTED_HOSTS dynamically from domains and networks - added SHOPWARE_DOMAIN var to vars/main.yml - removed inline framework.yaml creation from Dockerfile (now managed via mount) - updated proxy template (html.conf.j2) to include X-Forwarded-Ssl header - improved init.sh permission handling for shared volumes See ChatGPT conversation for implementation details and rationale: https://chatgpt.com/share/690d4fe7-2830-800f-8b6d-b868e7fe0e97	2025-11-07 02:48:49 +01:00
Kevin Veen-Birkenbach	09a4c243d7	Add centralized include for Access-Control-Allow headers across proxy/service Nginx templates and align ACA vars for simpleicons task. ... Ref: https://chatgpt.com/share/68dbf59c-f424-800f-aa27-787db52e260f	2025-09-30 17:22:28 +02:00
Kevin Veen-Birkenbach	26a1992d84	Nextcloud/Talk: add Janus config & fix WebSocket proxying ... Nginx: define 'map $http_upgrade $connection_upgrade' once in http{} and reuse; drop duplicate map from ws_generic vhost; tidy ws location headers/spacing. Nextcloud: add WS location for standalone signaling; render & mount Janus config (NAT 1:1, ICE enforce/ignore lists, libnice hardening); extend CSP (connect-src/frame-src for cloud & collabora, worker-src blob:); disable keeporsweep app; replace nginx reload handler with compose up; add NEXTCLOUD_HOST_JANUS_CONF_PATH and related vars. Context: https://chatgpt.com/share/68db9f41-16ec-800f-9cdf-7530862f89aa	2025-09-30 11:14:15 +02:00
Kevin Veen-Birkenbach	f4cf55b3c8	Open WebUI OIDC & proxy fixes + Ollama preload + async-safe pull ... - svc-ai-ollama: - Add preload_models (llama3, mistral, nomic-embed-text) - Pre-pull task: loop_var=model, async-safe changed_when/failed_when - sys-svc-proxy (OpenResty): - Forward Authorization header - Ensure proxy_pass_request_headers on - web-app-openwebui: - ADMIN_EMAIL from users.administrator.email - Request RBAC group scope in OAUTH_SCOPES Ref: ChatGPT support (2025-09-23) — https://chatgpt.com/share/68d20588-2584-800f-aed4-26ce710c69c4	2025-09-23 04:27:46 +02:00
Kevin Veen-Birkenbach	b02d88adc0	Refactored server roles for better readability	2025-09-01 18:08:35 +02:00