added wiki.skudakrennsport.com
This commit is contained in:
Bastian de Byl
@@ -1,4 +1,5 @@
|
||||
---
|
||||
bookstack_path: "{{ podman_volumes }}/bookstack"
|
||||
drone_path: "{{ podman_volumes }}/drone"
|
||||
graylog_path: "{{ podman_volumes }}/graylog"
|
||||
hass_path: "{{ podman_volumes }}/hass"
|
||||
@@ -13,6 +14,7 @@ drone_runner_capacity: "4"
|
||||
ci_server_name: ci.bdebyl.net
|
||||
pi_server_name: pi.bdebyl.net
|
||||
assistant_server_name: assistant.bdebyl.net
|
||||
bookstack_server_name: wiki.skudakrennsport.com
|
||||
home_server_name: home.bdebyl.net
|
||||
parts_server_name: parts.bdebyl.net
|
||||
video_server_name: video.bdebyl.net
|
||||
|
||||
@@ -65,6 +65,7 @@
|
||||
- "{{ pi_server_name }}.conf"
|
||||
- "{{ home_server_name }}.conf"
|
||||
- "{{ assistant_server_name }}.conf"
|
||||
- "{{ bookstack_server_name }}.conf"
|
||||
- "{{ video_server_name }}.conf"
|
||||
- "{{ parts_server_name }}.conf"
|
||||
- "{{ logs_server_name }}.conf"
|
||||
@@ -87,6 +88,7 @@
|
||||
- "{{ parts_server_name }}.conf"
|
||||
- "{{ home_server_name }}.conf"
|
||||
- "{{ assistant_server_name }}.conf"
|
||||
- "{{ bookstack_server_name }}.conf"
|
||||
- "{{ video_server_name }}.conf"
|
||||
- "{{ logs_server_name }}.conf"
|
||||
notify:
|
||||
|
||||
@@ -36,6 +36,7 @@
|
||||
loop:
|
||||
- "{{ ci_server_name }}.https.conf"
|
||||
- "{{ parts_server_name }}.https.conf"
|
||||
- "{{ bookstack_server_name }}.https.conf"
|
||||
notify:
|
||||
- restorecon podman
|
||||
- restart nginx
|
||||
@@ -52,6 +53,7 @@
|
||||
loop:
|
||||
- "{{ ci_server_name }}.https.conf"
|
||||
- "{{ parts_server_name }}.https.conf"
|
||||
- "{{ bookstack_server_name }}.https.conf"
|
||||
notify:
|
||||
- restorecon podman
|
||||
- restart nginx
|
||||
|
||||
80
ansible/roles/podman/tasks/container-bookstack.yml
Normal file
80
ansible/roles/podman/tasks/container-bookstack.yml
Normal file
@@ -0,0 +1,80 @@
|
||||
---
|
||||
- name: create required bookstack volumes
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
owner: "{{ podman_subuid.stdout }}"
|
||||
group: "{{ podman_user }}"
|
||||
mode: 0755
|
||||
notify: restorecon podman
|
||||
loop:
|
||||
- "{{ bookstack_path }}/mysql"
|
||||
tags: bookstack
|
||||
|
||||
- name: flush handlers
|
||||
ansible.builtin.meta: flush_handlers
|
||||
tags: bookstack
|
||||
|
||||
- name: create bookstack-db container
|
||||
become: true
|
||||
become_user: "{{ podman_user }}"
|
||||
containers.podman.podman_container:
|
||||
name: bookstack-db
|
||||
image: docker.io/mysql:5.7.21
|
||||
recreate: false
|
||||
restart: false
|
||||
restart_policy: on-failure
|
||||
log_driver: journald
|
||||
network:
|
||||
- shared
|
||||
env:
|
||||
MYSQL_ROOT_PASSWORD: "{{ bookstack_db_root_pass }}"
|
||||
TZ: "America/New_York"
|
||||
MYSQL_DATABASE: bookstack
|
||||
MYSQL_USER: bookstack
|
||||
MYSQL_PASSWORD: "{{ bookstack_db_pass }}"
|
||||
volumes:
|
||||
- "{{ bookstack_path }}/mysql:/var/lib/mysql"
|
||||
tags: bookstack
|
||||
|
||||
- name: create systemd startup job for bookstack-db
|
||||
include_tasks: systemd-generate.yml
|
||||
vars:
|
||||
container_name: bookstack-db
|
||||
tags: bookstack
|
||||
|
||||
- name: create bookstack container
|
||||
become: true
|
||||
become_user: "{{ podman_user }}"
|
||||
containers.podman.podman_container:
|
||||
name: bookstack
|
||||
image: docker.io/solidnerd/bookstack:22.04
|
||||
recreate: true
|
||||
restart: false
|
||||
restart_policy: on-failure
|
||||
log_driver: journald
|
||||
network:
|
||||
- shared
|
||||
env:
|
||||
APP_URL: "https://wiki.skudakrennsport.com"
|
||||
DB_HOST: "bookstack-db"
|
||||
DB_USERNAME: "bookstack"
|
||||
DB_DATABASE: "bookstack"
|
||||
DB_PASSWORD: "{{ bookstack_db_pass }}"
|
||||
MAIL_DRIVER: "smtp"
|
||||
MAIL_HOST: "{{ bookstack_mail_host }}"
|
||||
MAIL_PORT: 465
|
||||
MAIL_ENCRYPTION: "ssl"
|
||||
MAIL_USERNAME: "{{ bookstack_mail_user }}"
|
||||
MAIL_PASSWORD: "{{ bookstack_mail_pass }}"
|
||||
MAIL_FROM: "{{ bookstack_mail_user }}"
|
||||
MAIL_FROM_NAME: "Skudak Wiki"
|
||||
ports:
|
||||
- "6875:8080"
|
||||
tags: bookstack
|
||||
#- name: create systemd startup job for bookstack
|
||||
# include_tasks: systemd-generate.yml
|
||||
# vars:
|
||||
# container_name: bookstack
|
||||
# tags: bookstack
|
||||
@@ -8,14 +8,15 @@
|
||||
zone: "public"
|
||||
state: enabled
|
||||
loop:
|
||||
- 53/tcp
|
||||
- 53/udp
|
||||
- 1153/tcp
|
||||
- 1153/udp
|
||||
- 80/tcp
|
||||
- 443/tcp
|
||||
- "{{ syslog_udp_default }}/udp"
|
||||
- "{{ syslog_udp_error }}/udp"
|
||||
- "{{ syslog_udp_unifi }}/udp"
|
||||
- 1153/tcp
|
||||
- 1153/udp
|
||||
- 443/tcp
|
||||
- 53/tcp
|
||||
- 53/udp
|
||||
- 6875/tcp
|
||||
- 80/tcp
|
||||
notify: restart firewalld
|
||||
tags: firewall
|
||||
|
||||
@@ -8,4 +8,5 @@
|
||||
- import_tasks: container-partkeepr.yml
|
||||
- import_tasks: container-graylog.yml
|
||||
- import_tasks: container-pihole.yml
|
||||
- import_tasks: container-bookstack.yml
|
||||
- import_tasks: container-nginx.yml
|
||||
|
||||
@@ -0,0 +1,13 @@
|
||||
server {
|
||||
listen 80;
|
||||
server_name {{ bookstack_server_name }};
|
||||
|
||||
location '/.well-known/acme-challenge' {
|
||||
default_type "text/plain";
|
||||
root /srv/http/letsencrypt;
|
||||
}
|
||||
|
||||
location / {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,53 @@
|
||||
upstream bookstack {
|
||||
server 127.0.0.1:6875;
|
||||
}
|
||||
|
||||
server {
|
||||
modsecurity on;
|
||||
modsecurity_rules_file /etc/nginx/modsec_includes.conf;
|
||||
|
||||
resolver 127.0.0.1 127.0.0.53 9.9.9.9 valid=60s;
|
||||
|
||||
listen 443 ssl http2;
|
||||
server_name {{ bookstack_server_name }};
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/{{ bookstack_server_name }}/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/{{ bookstack_server_name }}/privkey.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/{{ bookstack_server_name }}/fullchain.pem;
|
||||
ssl_dhparam /etc/nginx/ssl/dhparam.pem;
|
||||
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
ssl_prefer_server_ciphers off;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_session_cache shared:SSL:10m;
|
||||
ssl_session_tickets off;
|
||||
ssl_session_timeout 1d;
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
|
||||
if ($whitelisted = 0) {
|
||||
return 302 $scheme://skudakrennsport.com$request_uri;
|
||||
}
|
||||
|
||||
location / {
|
||||
add_header Referrer-Policy "same-origin" always;
|
||||
# add_header Strict-Transport-Security "max-age=630720000; includeSubDomains" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
|
||||
# Sent from upstream:
|
||||
# add_header X-Frame-Options "SAMEORIGIN";
|
||||
# add_header X-XSS-Protection "1; mode=block";
|
||||
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_buffering off;
|
||||
proxy_http_version 1.1;
|
||||
proxy_pass http://bookstack;
|
||||
proxy_redirect off;
|
||||
|
||||
chunked_transfer_encoding off;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -10,6 +10,7 @@
|
||||
loop:
|
||||
- "{{ ci_server_name }}"
|
||||
- "{{ parts_server_name }}"
|
||||
- "{{ bookstack_server_name }}"
|
||||
tags: ssl
|
||||
|
||||
- name: set group ownership for /etc/letsencrypt/
|
||||
|
||||
Reference in New Issue
Block a user