42 lines
1.5 KiB
Text
42 lines
1.5 KiB
Text
|
# Gere par Set-OPS (role serveur_web_frontal). Ne pas editer a la main.
|
||
|
|
#
|
||
|
|
# LE SERVEUR PAR DEFAUT REFUSE TOUT NOM INCONNU (meme regle que l'edge) : sans lui, nginx
|
||
|
|
# confie un nom inconnu au premier vhost, et un balayage de l'adresse publique recevrait un
|
||
|
|
# service qu'il n'a pas nomme.
|
||
|
|
server {
|
||
|
|
listen 80 default_server;
|
||
|
|
listen [::]:80 default_server;
|
||
|
|
server_name _;
|
||
|
|
return 444;
|
||
|
|
}
|
||
|
|
{% for expo in serveur_web_frontal_expositions | default([]) %}
|
||
|
|
{% if expo.hote in hostvars and hostvars[expo.hote].ansible_host is defined and expo.port %}
|
||
|
|
{% set tls = (expo.port | int) in serveur_web_frontal_ports_tls %}
|
||
|
|
|
||
|
|
# {{ expo.fqdn }} -> {{ expo.hote }}:{{ expo.port }} ({{ expo.application }})
|
||
|
|
# En clair en attendant son certificat Let's Encrypt.
|
||
|
|
server {
|
||
|
|
listen 80;
|
||
|
|
listen [::]:80;
|
||
|
|
server_name {{ expo.fqdn }};
|
||
|
|
|
||
|
|
modsecurity on;
|
||
|
|
modsecurity_rules_file {{ serveur_web_frontal_waf_dir }}/main.conf;
|
||
|
|
|
||
|
|
location / {
|
||
|
|
proxy_pass {{ 'https' if tls else 'http' }}://{{ hostvars[expo.hote].ansible_host }}:{{ expo.port }};
|
||
|
|
{% if tls %}
|
||
|
|
proxy_ssl_verify on;
|
||
|
|
proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
|
||
|
|
proxy_ssl_name {{ expo.hote }}.{{ domaine_interne }};
|
||
|
|
proxy_ssl_server_name on;
|
||
|
|
{% endif %}
|
||
|
|
proxy_set_header Host $host;
|
||
|
|
proxy_set_header X-Real-IP $remote_addr;
|
||
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
{% endif %}
|
||
|
|
{% endfor %}
|