Daniel Allaire
79d0529686
Maison numérique souveraine (offres maison-obnl + cabinet). Tâches découpées : paquets → php (512M + TLS PG) → install (occ, PG verify-full) → exposition (vhost .mjs) → configure (overwrite/redis/anti-SSRF/import CA) → OIDC user_oidc → Collabora richdocuments (WOPI split URL) → thème Alliance (ciel étoilé). Chaque réglage encode un piège prouvé sur collab-01 : imagick Debian 13, PGSSLMODE dans php-fpm, MIME .mjs, allow_local_remote_servers (SSRF), import root step-ca, memory_limit 512M, public_wopi_url après activate-config… Version épinglée (robustesse). ansible-lint profil production : 0 échec. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
36 lines
1.5 KiB
Django/Jinja
36 lines
1.5 KiB
Django/Jinja
upstream php-handler-nc { server unix:/run/php/php{{ serveur_nextcloud_php_version }}-fpm.sock; }
|
|
|
|
server {
|
|
listen {{ serveur_nextcloud_http_port }} default_server;
|
|
server_name {{ serveur_nextcloud_hostname }} {{ ansible_hostname | default('localhost') }} localhost;
|
|
root {{ serveur_nextcloud_racine }};
|
|
index index.php index.html;
|
|
client_max_body_size {{ serveur_nextcloud_php_upload_max }};
|
|
|
|
location / { rewrite ^ /index.php$request_uri; }
|
|
|
|
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ { deny all; }
|
|
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { deny all; }
|
|
|
|
location ~ \.php(?:$|/) {
|
|
fastcgi_split_path_info ^(.+?\.php)(/.*|)$;
|
|
set $path_info $fastcgi_path_info;
|
|
try_files $fastcgi_script_name =404;
|
|
include fastcgi_params;
|
|
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
|
fastcgi_param PATH_INFO $path_info;
|
|
fastcgi_param modHeadersAvailable true;
|
|
fastcgi_param front_controller_active true;
|
|
fastcgi_pass php-handler-nc;
|
|
fastcgi_read_timeout 3600;
|
|
}
|
|
|
|
# Gotcha spike : les modules ES .mjs doivent etre servis en text/javascript,
|
|
# sinon le navigateur les bloque (MIME application/octet-stream) => pages blanches.
|
|
location ~ \.mjs$ { default_type text/javascript; try_files $uri /index.php$request_uri; access_log off; }
|
|
|
|
location ~ \.(?:css|js|woff2?|svg|gif|png|html|ttf|ico|jpg|jpeg|json|wasm)$ {
|
|
try_files $uri /index.php$request_uri;
|
|
access_log off;
|
|
}
|
|
}
|