Enable SSL
This commit is contained in:
parent
4907cdfd99
commit
765e9e5a47
|
@ -3,12 +3,23 @@ server {
|
||||||
server_name "jellyfin.{{ base_domain }}";
|
server_name "jellyfin.{{ base_domain }}";
|
||||||
set $jellyfin {{ server_ip }};
|
set $jellyfin {{ server_ip }};
|
||||||
#resolver 127.0.0.1 valid=30;
|
#resolver 127.0.0.1 valid=30;
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 443 ssl http2;
|
||||||
|
server_name "jellyfin.{{ base_domain }}";
|
||||||
|
set $jellyfin {{ server_ip }};
|
||||||
|
|
||||||
# Security/XSS Mitigation Headers
|
# Security/XSS Mitigation Headers
|
||||||
add_header X-Frame-Options "SAMEORIGIN";
|
add_header X-Frame-Options "SAMEORIGIN";
|
||||||
add_header X-XSS-Protection "1; mode=block";
|
add_header X-XSS-Protection "1; mode=block";
|
||||||
add_header X-Content-Type-Options "nosniff";
|
add_header X-Content-Type-Options "nosniff";
|
||||||
|
|
||||||
|
location = / {
|
||||||
|
return 302 https://$host/web/;
|
||||||
|
}
|
||||||
|
|
||||||
location / {
|
location / {
|
||||||
proxy_pass http://$jellyfin:8096;
|
proxy_pass http://$jellyfin:8096;
|
||||||
proxy_set_header Host $host;
|
proxy_set_header Host $host;
|
||||||
|
|
|
@ -0,0 +1,24 @@
|
||||||
|
-----BEGIN CERTIFICATE-----
|
||||||
|
MIID8zCCAtugAwIBAgIUPXGk144K0wqfLNwO7MK4g3ddbewwDQYJKoZIhvcNAQEL
|
||||||
|
BQAwgYgxCzAJBgNVBAYTAkNaMRMwEQYDVQQIDApTb21lLVN0YXRlMQ8wDQYDVQQH
|
||||||
|
DAZQcmFndWUxGDAWBgNVBAoMD0t1Y2hhcmN6eWsgTHRkLjEUMBIGA1UEAwwLKi5k
|
||||||
|
ZXYubG9jYWwxIzAhBgkqhkiG9w0BCQEWFGx1a2FzQGt1Y2hhcmN6eWsueHl6MB4X
|
||||||
|
DTIxMDQyNjIxMDA1OFoXDTMxMDQyNDIxMDA1OFowgYgxCzAJBgNVBAYTAkNaMRMw
|
||||||
|
EQYDVQQIDApTb21lLVN0YXRlMQ8wDQYDVQQHDAZQcmFndWUxGDAWBgNVBAoMD0t1
|
||||||
|
Y2hhcmN6eWsgTHRkLjEUMBIGA1UEAwwLKi5kZXYubG9jYWwxIzAhBgkqhkiG9w0B
|
||||||
|
CQEWFGx1a2FzQGt1Y2hhcmN6eWsueHl6MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
|
||||||
|
MIIBCgKCAQEAx/LUqs2Z8GS9x0KZrlrdL9Ndsskw5Q8EYGNJDxqebncMAkFbYbi1
|
||||||
|
ZhHz4mnVzLKFg6mQ7yXdnUz5DFCltEQcQHpIULPcbLyj3XXBA0Hd40Hc8+7hghJ0
|
||||||
|
Un9tH47JwMetnlNQcvmY2XJfQ+MV92pmIh7qzvkyj1EgjkNaTdf87zYl6zYnPJjy
|
||||||
|
MU7K3KMikPd8jECh5zhsrw9imgr86bqtWBjNkcA3F9Oauui6UhyN3/eGIa74+vx6
|
||||||
|
nYomiMSjuN3zkN0cyxX/PFVOZZOzTbmHUIPhIN3p5pXLhqA9tc3ePpifRATzU+Sn
|
||||||
|
ePPM++PVvSgf2PMFvTtPC/z/jKXHDB4C2QIDAQABo1MwUTAdBgNVHQ4EFgQUUa10
|
||||||
|
hrJc8F/WBDC0rWVISN5o6C8wHwYDVR0jBBgwFoAUUa10hrJc8F/WBDC0rWVISN5o
|
||||||
|
6C8wDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAZOwIDGg+CzK3
|
||||||
|
/wwIE3ttv/OeU1lHu8I87dR51ixG6kGfj6+iKyP9OhA4If+mRIlMRSmigZe/ENbw
|
||||||
|
2tVDcoIogu8zw3SLlpMzxSDiAE3Ro4O60x8IQ7+HNOvbfiVq5Hdhb39T9VvDkNv8
|
||||||
|
k9mectnlqTNRmbw9oYDbg7zjY+5yGz264QeakF2UwJdtGlDUHVt2w83WJLY/rYAv
|
||||||
|
uuowVf4Tqt1evIr5lfsxVbRO9oVzBnbivYZPe5hjNxOBXTti17DfedIC+y6bLavm
|
||||||
|
VNlba18xxCDEPadyJnOSLFQlD0aoMoV7m5hZCJZEciw6X/JpX3SIpRF0MQm02RPi
|
||||||
|
wncx4+iqGA==
|
||||||
|
-----END CERTIFICATE-----
|
|
@ -0,0 +1,28 @@
|
||||||
|
-----BEGIN PRIVATE KEY-----
|
||||||
|
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDH8tSqzZnwZL3H
|
||||||
|
QpmuWt0v012yyTDlDwRgY0kPGp5udwwCQVthuLVmEfPiadXMsoWDqZDvJd2dTPkM
|
||||||
|
UKW0RBxAekhQs9xsvKPddcEDQd3jQdzz7uGCEnRSf20fjsnAx62eU1By+ZjZcl9D
|
||||||
|
4xX3amYiHurO+TKPUSCOQ1pN1/zvNiXrNic8mPIxTsrcoyKQ93yMQKHnOGyvD2Ka
|
||||||
|
Cvzpuq1YGM2RwDcX05q66LpSHI3f94Yhrvj6/HqdiiaIxKO43fOQ3RzLFf88VU5l
|
||||||
|
k7NNuYdQg+Eg3enmlcuGoD21zd4+mJ9EBPNT5Kd488z749W9KB/Y8wW9O08L/P+M
|
||||||
|
pccMHgLZAgMBAAECggEANoUiNAin5wKxNLoWSZKBKV9K90sgx/SWTuoDq9ioRpqz
|
||||||
|
bZIApt7Ep7ZRd/U/1PcArOv5lxwOF6w7ZH5BEKxZv8MYINlKS2QMkoBfRtIY/LSi
|
||||||
|
2OjUGLGLgks4qBg5LxXDY554G0GvyesDyvEKtlIO01L218TfYnDOnbwDzaINV/RC
|
||||||
|
W/nbyx8Z5teorU+vS5IlDaNMDSFkAMFOfQ8gNrwCaWxX2FJRUyyzM/54J4bNgGUi
|
||||||
|
+3APpt8w4N54CrMbI6FzyQhUbAY9MRFryaLgw22v0haiM1nAE9BWpU5m20Q8Ilx8
|
||||||
|
f1e9PVDqwTXshxx01b0Z6RrHZViyi9+XOo6QU+4xYQKBgQDrYQZ8trvV3j+1E6Eu
|
||||||
|
rESMni+93ZbhRMbVVUDOhxU7BzfsFnvGodQms9sCaNQrexML0xH9DhWbssCDOvOm
|
||||||
|
MWSOnxUA1yivMiYvE4FzEM5iRRyFSjE3uS3+FZ0yY3iUr1vf9G9fJrtt/ag05AF5
|
||||||
|
ZywhmvvtiA06F9+/qZzMW4jxfQKBgQDZdy/tYZQI9PlfznI6juy/Kx310vGNN9aW
|
||||||
|
Zzv3WRon40awiRMxUhGViiq9eD1IEzLDIXGXHdOI4E+DQUd+pn7Cr08QoWbOQk2n
|
||||||
|
BujCDY0mevc2kDi5NASa2SUFvUXo/vCqZdfP/EA7BudYwknZp3hCV+nZt6DcW+M2
|
||||||
|
+WLYjxTVjQKBgGs/QTpv9HQFGRgDgqyGd5FuvigPoCCyOrqXZrjzmbvUlSlwMSOX
|
||||||
|
NtgPmRmm9A1/vXTkzkx0L2pK7yacJMoztTK6z1IbtwDko7tNcu0f2jmybcVZwcU3
|
||||||
|
Dfq4lHCSHC37HKyVbm13c20xZ4P546YSWWxSdrmLBSPUHvHwcW43wtTtAoGBAMOb
|
||||||
|
yAqYiRX9dQrOokU2JpJWcF6cXhaOsYEcXv5AsZxLfVxyEEd+8L44R/Wh4E2ipziK
|
||||||
|
LqildY9bZWpFH9A2ZzMric0FwXmqfjrNpjRXCC4i0ZfM5pkAx1uaEwk0lVvdZhGA
|
||||||
|
Bj3ZQtVVgmd+a/tR/oR+m6Tw3csZBCqA7H6rRSxJAoGBAIFd0PRdKm5+mUc575GQ
|
||||||
|
sxVznovODCdRyOAeD9IKyCcpMo8zB9uiNDRPG/sUebnowC3v7EeCYUUHlUDtsSjc
|
||||||
|
BZyasg71mrZElWg2mDonw/J9fcrEPGrh59wmqk49MLvzB0An/eP+gGK3RFgbijkN
|
||||||
|
EZcByagGNGdICcaaxr+RhgcU
|
||||||
|
-----END PRIVATE KEY-----
|
|
@ -5,6 +5,13 @@
|
||||||
mode: '0755'
|
mode: '0755'
|
||||||
loop:
|
loop:
|
||||||
- "{{ nginx_confd_folder }}"
|
- "{{ nginx_confd_folder }}"
|
||||||
|
- name: copy certificates
|
||||||
|
copy:
|
||||||
|
src: "{{ item }}"
|
||||||
|
dest: "{{ data_folder }}/nginx"
|
||||||
|
loop:
|
||||||
|
- localhost.key
|
||||||
|
- localhost.crt
|
||||||
- name: copy .conf file
|
- name: copy .conf file
|
||||||
template:
|
template:
|
||||||
src: nginx.conf.j2
|
src: nginx.conf.j2
|
||||||
|
@ -16,9 +23,12 @@
|
||||||
image: nginx
|
image: nginx
|
||||||
volumes:
|
volumes:
|
||||||
- "{{ data_folder }}/nginx/nginx.conf:/etc/nginx/nginx.conf"
|
- "{{ data_folder }}/nginx/nginx.conf:/etc/nginx/nginx.conf"
|
||||||
|
- "{{ data_folder }}/nginx/localhost.crt:/etc/nginx/localhost.crt"
|
||||||
|
- "{{ data_folder }}/nginx/localhost.key:/etc/nginx/localhost.key"
|
||||||
- "{{ nginx_confd_folder }}:/etc/nginx/conf.d"
|
- "{{ nginx_confd_folder }}:/etc/nginx/conf.d"
|
||||||
ports:
|
ports:
|
||||||
- "80:80"
|
- "80:80"
|
||||||
|
- "443:443"
|
||||||
env:
|
env:
|
||||||
NGINX_HOST: "{{ base_domain }}"
|
NGINX_HOST: "{{ base_domain }}"
|
||||||
NGINX_PORT: '80'
|
NGINX_PORT: '80'
|
||||||
|
|
|
@ -0,0 +1,32 @@
|
||||||
|
user nginx;
|
||||||
|
worker_processes 1;
|
||||||
|
|
||||||
|
error_log /var/log/nginx/error.log warn;
|
||||||
|
pid /var/run/nginx.pid;
|
||||||
|
|
||||||
|
|
||||||
|
events {
|
||||||
|
worker_connections 1024;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
http {
|
||||||
|
include /etc/nginx/mime.types;
|
||||||
|
default_type application/octet-stream;
|
||||||
|
|
||||||
|
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||||
|
'$status $body_bytes_sent "$http_referer" '
|
||||||
|
'"$http_user_agent" "$http_x_forwarded_for"';
|
||||||
|
|
||||||
|
access_log /var/log/nginx/access.log main;
|
||||||
|
|
||||||
|
sendfile on;
|
||||||
|
#tcp_nopush on;
|
||||||
|
|
||||||
|
keepalive_timeout 65;
|
||||||
|
|
||||||
|
#gzip on;
|
||||||
|
ssl_certificate /etc/nginx/localhost.crt;
|
||||||
|
ssl_certificate_key /etc/nginx/localhost.key;
|
||||||
|
include /etc/nginx/conf.d/*.conf;
|
||||||
|
}
|
Loading…
Reference in New Issue