aboutsummaryrefslogtreecommitdiff
path: root/gerboweb/deploy
diff options
context:
space:
mode:
Diffstat (limited to 'gerboweb/deploy')
-rw-r--r--gerboweb/deploy/inventory.yml1
-rw-r--r--gerboweb/deploy/nginx.conf80
-rw-r--r--gerboweb/deploy/nginx_nossl.conf7
-rw-r--r--gerboweb/deploy/playbook.yml15
-rw-r--r--gerboweb/deploy/secure_download.cfg.j21
-rw-r--r--gerboweb/deploy/setup_secure_download.yml57
-rw-r--r--gerboweb/deploy/setup_webserver.yml15
-rw-r--r--gerboweb/deploy/tmpfiles-secure-download.conf.j21
-rw-r--r--gerboweb/deploy/uwsgi-secure-download.ini10
9 files changed, 161 insertions, 26 deletions
diff --git a/gerboweb/deploy/inventory.yml b/gerboweb/deploy/inventory.yml
index 34e2e99..ea577e3 100644
--- a/gerboweb/deploy/inventory.yml
+++ b/gerboweb/deploy/inventory.yml
@@ -5,3 +5,4 @@ all:
ansible_host: wendelstein.jaseg.net
ansible_ssh_identity_file: ~/.ssh/id_ed25519
ansible_user: root
+ ansible_python_interpreter: /usr/bin/python3
diff --git a/gerboweb/deploy/nginx.conf b/gerboweb/deploy/nginx.conf
index 6344904..1f44981 100644
--- a/gerboweb/deploy/nginx.conf
+++ b/gerboweb/deploy/nginx.conf
@@ -51,36 +51,86 @@ http {
ssl_certificate "/etc/letsencrypt/live/gerbolyze.jaseg.net/fullchain.pem";
ssl_certificate_key "/etc/letsencrypt/live/gerbolyze.jaseg.net/privkey.pem";
ssl_dhparam "/etc/letsencrypt/ssl-dhparams.pem";
- include /etc/letsencrypt/options-ssl-nginx.conf;
+ include /etc/letsencrypt/options-ssl-nginx.conf;
- ssl_stapling on;
- ssl_stapling_verify on;
+ ssl_stapling on;
+ ssl_stapling_verify on;
- resolver 67.207.67.2 67.207.67.3 valid=300s;
- resolver_timeout 10s;
+ resolver 67.207.67.2 67.207.67.3 valid=300s;
+ resolver_timeout 10s;
- add_header Strict-Transport-Security "max-age=86400";
+ add_header Strict-Transport-Security "max-age=86400";
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
- location ^~ /static/ {
- root /var/lib/gerboweb;
- }
+ location ^~ /static/ {
+ root /var/lib/gerboweb;
+ }
+
+ location / {
+ include uwsgi_params;
+ uwsgi_pass unix:/run/uwsgi/gerboweb.socket;
+ }
+
+ error_page 404 /404.html;
+ location = /40x.html {
+ root /usr/share/nginx/html;
+ }
+
+ error_page 500 502 503 504 /50x.html;
+ location = /50x.html {
+ root /usr/share/nginx/html;
+ }
+ }
+
+ server {
+ listen 80;
+ listen [::]:80;
+ server_name blog.jaseg.net blog.jaseg.net;
+ return 301 https://$host$request_uri;
+ }
+
+ server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+ server_name blog.jaseg.net blog.jaseg.net;
+ root /usr/share/nginx/html;
+
+ ssl_certificate "/etc/letsencrypt/live/blog.jaseg.net/fullchain.pem";
+ ssl_certificate_key "/etc/letsencrypt/live/blog.jaseg.net/privkey.pem";
+ ssl_dhparam "/etc/letsencrypt/ssl-dhparams.pem";
+ include /etc/letsencrypt/options-ssl-nginx.conf;
+
+ ssl_stapling on;
+ ssl_stapling_verify on;
+
+ resolver 67.207.67.2 67.207.67.3 valid=300s;
+ resolver_timeout 10s;
+
+ add_header Strict-Transport-Security "max-age=86400";
+
+ # Load configuration files for the default server block.
+ include /etc/nginx/default.d/*.conf;
location / {
- include uwsgi_params;
- uwsgi_pass unix:/run/uwsgi/gerboweb.socket;
+ root /var/www/blog.jaseg.net;
+ }
+
+ location /d/ {
+ rewrite ^/d/(.*)$ /$1 break;
+ include uwsgi_params;
+ uwsgi_pass unix:/run/uwsgi/secure-download.socket;
}
error_page 404 /404.html;
- location = /40x.html {
- root /usr/share/nginx/html;
+ location = /40x.html {
+ root /usr/share/nginx/html;
}
error_page 500 502 503 504 /50x.html;
- location = /50x.html {
- root /usr/share/nginx/html;
+ location = /50x.html {
+ root /usr/share/nginx/html;
}
}
diff --git a/gerboweb/deploy/nginx_nossl.conf b/gerboweb/deploy/nginx_nossl.conf
index 0ecd1cb..8d5a5a5 100644
--- a/gerboweb/deploy/nginx_nossl.conf
+++ b/gerboweb/deploy/nginx_nossl.conf
@@ -41,5 +41,12 @@ http {
server_name gerbolyze.jaseg.net;
return 301 https://$host$request_uri;
}
+
+ server {
+ listen 80;
+ listen [::]:80;
+ server_name blog.jaseg.net;
+ return 301 https://$host$request_uri;
+ }
}
diff --git a/gerboweb/deploy/playbook.yml b/gerboweb/deploy/playbook.yml
index 1c694d5..afea884 100644
--- a/gerboweb/deploy/playbook.yml
+++ b/gerboweb/deploy/playbook.yml
@@ -12,7 +12,7 @@
- name: Install host requisites
dnf:
- name: nginx,uwsgi,python3-flask,python3-flask-wtf,uwsgi-plugin-python3,certbot,python3-certbot-nginx,libselinux-python,git,iptables-services
+ name: nginx,uwsgi,python3-flask,python3-flask-wtf,uwsgi-plugin-python3,certbot,python3-certbot-nginx,libselinux-python,git,iptables-services,python3-pycryptodomex
state: latest
- name: Disable password-based root login
@@ -28,18 +28,10 @@
state: restarted
when: disable_root_pw_ssh is changed
- - name: Create iptables firewall config dir
- file:
- path: /etc/iptables
- state: directory
- owner: root
- group: root
- mode: 0775
-
- name: Configure iptables firewall service
copy:
src: iptables.rules
- dest: /etc/iptables/iptables.rules
+ dest: /etc/sysconfig/iptables
owner: root
group: root
mode: 0664
@@ -65,3 +57,6 @@
- name: Setup clippy
include_tasks: setup_clippy.yml
+
+ - name: Setup secure download
+ include_tasks: setup_secure_download.yml
diff --git a/gerboweb/deploy/secure_download.cfg.j2 b/gerboweb/deploy/secure_download.cfg.j2
new file mode 100644
index 0000000..36d86c1
--- /dev/null
+++ b/gerboweb/deploy/secure_download.cfg.j2
@@ -0,0 +1 @@
+SERVE_PATH="{{secure_download_dir}}"
diff --git a/gerboweb/deploy/setup_secure_download.yml b/gerboweb/deploy/setup_secure_download.yml
new file mode 100644
index 0000000..aa94a53
--- /dev/null
+++ b/gerboweb/deploy/setup_secure_download.yml
@@ -0,0 +1,57 @@
+---
+- name: Set local facts
+ set_fact:
+ secure_download_dir: /var/cache/secure_download
+
+- name: Copy webapp sources
+ synchronize:
+ # FIXME: make this path configurable
+ src: ~/secure_download/
+ dest: /var/lib/secure_download/
+ group: no
+ owner: no
+
+- name: Create secure download worker user and group
+ user:
+ name: uwsgi-secure-download
+ create_home: no
+ group: uwsgi
+ password: '!'
+ shell: /sbin/nologin
+ system: yes
+
+- name: Template webapp config
+ template:
+ src: secure_download.cfg.j2
+ dest: /var/lib/secure_download/secure_download_prod.cfg
+ owner: uwsgi-secure-download
+ group: root
+ mode: 0660
+
+- name: Copy uwsgi config
+ copy:
+ src: uwsgi-secure-download.ini
+ dest: /etc/uwsgi.d/secure-download.ini
+ owner: uwsgi-secure-download
+ group: uwsgi
+ mode: 440
+
+- name: Enable uwsgi systemd socket
+ systemd:
+ daemon-reload: yes
+ name: uwsgi-app@secure-download.socket
+ enabled: yes
+
+- name: Copy server dir tmpfiles.d config
+ template:
+ src: tmpfiles-secure-download.conf.j2
+ dest: /etc/tmpfiles.d/secure-download.conf
+ owner: root
+ group: root
+ mode: 0644
+ register: sec_dl_tmpfiles_config
+
+- name: Kick systemd tmpfiles service to create serve dir
+ command: systemd-tmpfiles --create
+ when: sec_dl_tmpfiles_config is changed
+
diff --git a/gerboweb/deploy/setup_webserver.yml b/gerboweb/deploy/setup_webserver.yml
index 7dc65c5..ea821d8 100644
--- a/gerboweb/deploy/setup_webserver.yml
+++ b/gerboweb/deploy/setup_webserver.yml
@@ -9,6 +9,14 @@
groups: uwsgi
append: yes
+- name: Create blog.jaseg.net content dir
+ file:
+ path: /var/www/blog.jaseg.net
+ state: directory
+ owner: nginx
+ group: nginx
+ mode: 0550
+
- name: Copy uwsgi systemd socket config
copy:
src: uwsgi-app@.socket
@@ -30,11 +38,16 @@
enabled: yes
state: restarted
-- name: Create letsencrypt certificate
+- name: Create letsencrypt certificate for gerbolyze.jaseg.net
command: certbot --nginx certonly -d gerbolyze.jaseg.net -n --agree-tos --email gerboweb@jaseg.net
args:
creates: /etc/letsencrypt/live/gerbolyze.jaseg.net/fullchain.pem
+- name: Create letsencrypt certificate for blog.jaseg.net
+ command: certbot --nginx certonly -d blog.jaseg.net -n --agree-tos --email blog@jaseg.net
+ args:
+ creates: /etc/letsencrypt/live/blog.jaseg.net/fullchain.pem
+
- name: Copy final nginx config
copy:
src: nginx.conf
diff --git a/gerboweb/deploy/tmpfiles-secure-download.conf.j2 b/gerboweb/deploy/tmpfiles-secure-download.conf.j2
new file mode 100644
index 0000000..84d7add
--- /dev/null
+++ b/gerboweb/deploy/tmpfiles-secure-download.conf.j2
@@ -0,0 +1 @@
+d {{secure_download_dir}} 770 uwsgi-download uwsgi 45d
diff --git a/gerboweb/deploy/uwsgi-secure-download.ini b/gerboweb/deploy/uwsgi-secure-download.ini
new file mode 100644
index 0000000..5f999fc
--- /dev/null
+++ b/gerboweb/deploy/uwsgi-secure-download.ini
@@ -0,0 +1,10 @@
+[uwsgi]
+master = True
+cheap = True
+die-on-idle = False
+manage-script-name = True
+plugins = python3
+chdir = /var/lib/secure_download
+mount = /=server:app
+env = SECURE_DOWNLOAD_SETTINGS=secure_download_prod.cfg
+
generated by cgit (git 2.34.1) at 2024-12-02 01:29:33 +0000