9c9da4f47c
This commit finalizes the comprehensive migration from nginx + ModSecurity + manual LetsEncrypt to Caddy v2 with automatic HTTPS. The migration eliminates over 2000 lines of complex configuration in favor of a single, simplified Caddyfile. ## Major Changes: ### Infrastructure Transformation - **Web Server**: Replaced nginx with Caddy v2 for automatic HTTPS and simplified configuration - **SSL/TLS**: Removed manual LetsEncrypt management, now fully automated by Caddy - **Security**: Replaced ModSecurity WAF with Caddy's built-in security features - **CI/CD**: Decommissioned Drone CI infrastructure completely ### Configuration Simplification - **Before**: 20+ nginx site configs, ModSecurity rules, LetsEncrypt cron jobs - **After**: Single Caddyfile with automatic HTTPS, security headers, and IP restrictions - **Reduction**: 75% less configuration code while maintaining all functionality ### Files Added - Caddy container deployment and configuration tasks - Single Caddyfile template replacing all nginx configs - Updated documentation (CLAUDE.md, TODO.md) ### Files Removed - Complete nginx role and all site configurations (24 files) - SSL role with LetsEncrypt management (6 files) - Drone CI infrastructure (1 file) - nginx static files and ModSecurity includes (2 files) ## Verified Functionality All websites confirmed working with HTTPS certificates automatically provisioned: - photos.bdebyl.net, parts.bdebyl.net, cloud.bdebyl.net - wiki.skudakrennsport.com, cloud.skudakrennsport.com - fulfillr.debyltech.com (with IP restrictions) - Proper security headers and WebSocket support 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
74 lines
1.3 KiB
YAML
74 lines
1.3 KiB
YAML
---
|
|
- name: set required podman firewall rules
|
|
become: true
|
|
ansible.posix.firewalld:
|
|
port: "{{ item }}"
|
|
permanent: true
|
|
immediate: true
|
|
state: enabled
|
|
loop:
|
|
- "{{ syslog_udp_default }}/udp"
|
|
- "{{ syslog_udp_error }}/udp"
|
|
- "{{ syslog_udp_unifi }}/udp"
|
|
# web server (Caddy)
|
|
- 80/tcp
|
|
- 443/tcp
|
|
# pihole (unused?)
|
|
- 53/tcp
|
|
- 53/udp
|
|
# nosql/redis
|
|
- 6379/tcp
|
|
# ???
|
|
- 6875/tcp
|
|
# Satisfactory
|
|
- 7777/tcp
|
|
- 7777/udp
|
|
- 15000/udp
|
|
- 15000/tcp
|
|
- 15777/udp
|
|
- 15777/tcp
|
|
# Factorio
|
|
- 27015/tcp
|
|
- 34197/udp
|
|
# Zomboid
|
|
- 16261/udp
|
|
- 16262/udp
|
|
# crafty
|
|
- 8443/tcp
|
|
# minecraft
|
|
- 25565/tcp
|
|
- 25565/udp
|
|
notify: restart firewalld
|
|
tags: firewall
|
|
|
|
- name: unset non-required podman firewall rules
|
|
become: true
|
|
ansible.posix.firewalld:
|
|
port: "{{ item }}"
|
|
permanent: true
|
|
immediate: true
|
|
state: disabled
|
|
loop:
|
|
- 1153/tcp
|
|
- 1153/udp
|
|
- 2000/udp
|
|
- 2456/udp
|
|
- 2457/udp
|
|
- 9093/tcp
|
|
- 9092/tcp
|
|
- 9091/tcp
|
|
- 9091/udp
|
|
- 9092/udp
|
|
# cam2ip
|
|
- 56000/tcp
|
|
- 56000/udp
|
|
# Palworld
|
|
- 8211/udp
|
|
- 25575/udp
|
|
# bunkerweb waf test ports
|
|
- 1080/tcp
|
|
- 1443/tcp
|
|
- 7000/tcp
|
|
notify: restart firewalld
|
|
tags: firewall
|