mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-12-02 15:39:57 +00:00
Kevin Veen-Birkenbach
007963044b
Unify reverse proxy handling across apps via sys-stk-front-proxy and cleanly separate internal docker nginx configs from external vhosts. Changes: - docker-compose: use with_first_found for optional env and docker-compose.override files so roles can provide either a template or a static file without noisy 'Could not find or access' failures. - sys-stk-front-proxy: remove front_proxy_domain_conf_src and switch nginx vhost rendering to with_first_found over app-specific proxy.conf.j2 and the generic roles/sys-svc-proxy vhost flavour; keep health-check and handler logic unchanged. - web-app-nextcloud: migrate to sys-stk-full-stateful (front proxy + DB + docker), move internal nginx config to docker.conf.j2 under the volume path, and rename host.conf.j2 to proxy.conf.j2 for the external vhost. - web-app-magento: rename nginx.conf.j2 to docker.conf.j2 and update the runtime template task accordingly to make the intent (internal nginx) explicit. - web-app-matrix: rename nginx.conf.j2 to synapse.conf.j2 and adjust the webserver task to use the new template name for the synapse vhost. - web-app-bridgy-fed & web-app-flowise: pass domain and http_port explicitly when including sys-stk-front-proxy so the front stack has all required context. - web-svc-cdn/file/html: replace direct sys-stk-front-base + sys-util-csp-cert + nginx.conf.j2 handling with sys-stk-front-proxy and proxy.conf.j2, relying on the shared front-stack for TLS/CSP/vHost wiring. - web-svc-collabora: drop the direct nginx.conf.j2 vhost generation and rename it to proxy.conf.j2 so it is picked up by sys-stk-front-proxy like other services. - web-opt-rdr-domains: rename redirect.domain.nginx.conf.j2 to redirect-domain.conf.j2 and adjust the task for clearer and more consistent naming. Context: see ChatGPT refactor discussion on 2025-11-30 (proxy unification, Collabora/Nextcloud/CDN stacks, CSP/header handling): https://chatgpt.com/share/692c64ea-a488-800f-ad42-7f7692a3742f
48 lines
1.7 KiB
Django/Jinja
48 lines
1.7 KiB
Django/Jinja
server
|
|
{
|
|
server_name {{ domain }};
|
|
|
|
{% include 'roles/sys-svc-letsencrypt/templates/ssl_header.j2' %}
|
|
|
|
{% include 'roles/sys-front-inj-all/templates/server.conf.j2'%}
|
|
|
|
# Remove X-Powered-By, which is an information leak
|
|
fastcgi_hide_header X-Powered-By;
|
|
|
|
# Set X-Robots-Tag to noindex, nofollow on all responses
|
|
add_header X-Robots-Tag "noindex, nofollow";
|
|
|
|
# set max upload size
|
|
client_max_body_size 10G;
|
|
client_body_buffer_size 400M;
|
|
fastcgi_buffers 64 4K;
|
|
|
|
{% if NEXTCLOUD_HPB_SIGNALING_ENABLED | bool %}
|
|
{% set location_ws = '^~ ' ~ NEXTCLOUD_HPB_SIGNALING_LOCATION %}
|
|
{% set ws_port = NEXTCLOUD_PORT %}
|
|
{% include 'roles/sys-svc-proxy/templates/location/ws.conf.j2' %}
|
|
{% endif %}
|
|
|
|
{% if NEXTCLOUD_WHITEBOARD_ENABLED | bool %}
|
|
{% set location_ws = '^~ ' ~ NEXTCLOUD_WHITEBOARD_LOCATION %}
|
|
{% set ws_port = NEXTCLOUD_PORT %}
|
|
{% include 'roles/sys-svc-proxy/templates/location/ws.conf.j2' %}
|
|
{% endif %}
|
|
|
|
{% include 'roles/sys-svc-proxy/templates/location/html.conf.j2' %}
|
|
|
|
location ^~ /.well-known {
|
|
rewrite ^/\.well-known/host-meta\.json /public.php?service=host-meta-json last;
|
|
rewrite ^/\.well-known/host-meta /public.php?service=host-meta last;
|
|
rewrite ^/\.well-known/webfinger /public.php?service=webfinger last;
|
|
rewrite ^/\.well-known/nodeinfo /public.php?service=nodeinfo last;
|
|
|
|
location = /.well-known/carddav { return 301 /remote.php/dav/; }
|
|
location = /.well-known/caldav { return 301 /remote.php/dav/; }
|
|
location = /.well-known/webfinger { return 301 /index.php/.well-known/webfinger; }
|
|
location = /.well-known/nodeinfo { return 301 /index.php/.well-known/nodeinfo; }
|
|
|
|
try_files $uri $uri/ =404;
|
|
}
|
|
}
|