"
-dest_dir="$1"
-[ -z "$dest_dir" ] && die "Arg 'dest_directory' should not be empty."
+# Read all
+# NC_SHARE_LINK_URL.*
+# NC_SHARE_LINK_PASSWORD.*
+# NC_SHARE_LINK_DESTINATION.*
+# With .* equals
+while IFS='=' read key value ; do
+ # suffix of sharer link
+ name="${key#NC_SHARE_LINK_URL}"
+ echo "Rcloning $name..."
-# Get content from nextcloud
-webdav_url="$(echo "$NC_SHARE_LINK" | sed 's#/s/.*#/public.php/webdav/#')"
-webdav_user="$(echo "$NC_SHARE_LINK" |sed 's#.*/s/##')"
-webdav_pass="$(rclone obscure "$NC_SHARE_PASSWORD")"
+ password_varname="NC_SHARE_LINK_PASSWORD$name"
+ destination_varname="NC_SHARE_LINK_DESTINATION$name"
-rclone sync --config=/notfound --webdav-url="$webdav_url" --webdav-user="$webdav_user" --webdav-pass="$webdav_pass" --webdav-vendor=nextcloud :webdav: "$dest_dir"
+ # Empty by default
+ url="${!key}"
+ password="${!password_varname:-}"
+ destination="${!destination_varname:-}"
-# Go to website
-cd "$dest_dir"
+ # Ensure we have a link
+ if [ -z "$url" ] ; then
+ echo "env var NC_SHARE_LINK_URL$name is empty."
+ exit 1
+ fi
-# Rename .attachement dirs created by nextcloud
-while read filename ; do
- oldname="$(basename "$filename")"
- newname="${oldname:1}"
- path="$(dirname "$filename")"
- # And rename their references in md files
- find -type f -iname '*.md' -exec sed -i "s/$oldname/$newname/g" {} \;
- mv "$path/$oldname" "$path/$newname"
-done < <(find -type d -name '.attachments.*')
+ # Ensure we have a destination
+ if [ -z "$destination" ] ; then
+ echo "env var NC_SHARE_LINK_DESTINATION$name is empty."
+ exit 1
+ elif [ ! -d "$destination" ] ; then
+ mkdir "$destination"
+ fi
+ # Get content from nextcloud
+ webdav_url="$(echo "$url" | sed 's#/s/.*#/public.php/webdav/#')"
+ webdav_user="$(echo "$url" |sed 's#.*/s/##')"
+ webdav_pass="$(rclone obscure "$password")"
+
+ rclone sync --config=/notfound --webdav-url="$webdav_url" --webdav-user="$webdav_user" --webdav-pass="$webdav_pass" --webdav-vendor=nextcloud :webdav: "$destination"
+
+ # Go to website
+ cd "$destination"
+
+ # Rename .attachement dirs created by nextcloud
+ while read filename ; do
+ oldname="$(basename "$filename")"
+ newname="${oldname:1}"
+ path="$(dirname "$filename")"
+ # And rename their references in md files
+ find -type f -iname '*.md' -exec sed -i "s/$oldname/$newname/g" {} \;
+ mv "$path/$oldname" "$path/$newname"
+ done < <(find -type d -name '.attachments.*')
+
+ cd - &>/dev/null
+ echo "Rcloning done!"
+done < <(env | grep ^NC_SHARE_LINK_URL )
diff --git a/provisioning/roles/deploy_all/files/secrets.volume b/provisioning/roles/deploy_all/files/secrets.volume
new file mode 100644
index 0000000..a0d9e46
Binary files /dev/null and b/provisioning/roles/deploy_all/files/secrets.volume differ
diff --git a/provisioning/roles/deploy_all/tasks/main.yml b/provisioning/roles/deploy_all/tasks/main.yml
index 50de626..2179a07 100644
--- a/provisioning/roles/deploy_all/tasks/main.yml
+++ b/provisioning/roles/deploy_all/tasks/main.yml
@@ -15,6 +15,7 @@
delete: true
archive: false
recursive: true
+ copy_links: true # This allows some bidouillage on the server
- name: Add binaries
@@ -32,6 +33,7 @@
delete: true
archive: false
recursive: true
+ copy_links: true # This allows some bidouillage on the server
#- name: Add bind conf
# ansible.posix.synchronize:
diff --git a/readme.md b/readme.md
index 04666e7..25fc675 100644
--- a/readme.md
+++ b/readme.md
@@ -1,5 +1,6 @@
# Services Jean-Cloud
+
## Dossier installing
Contient des scripts sh pour installer debian sur un disque dur. Qui ira ensuite se brancher dans un ordi :)
@@ -13,6 +14,7 @@ Contient
Les services à faire tourner.
Chaque service qui tourne sur jean-cloud est composé :
+- Un uid et username pour des questions de droits
- `deploy.sh` d’un script d’installation
- `docker-compose.yaml` d’un fichier docker-compose
- `nginx_server.conf` d’un fichier de conf nginx
diff --git a/services/_proxy/nginx.conf b/services/_proxy/nginx.conf
index 35d138b..0b6725e 100755
--- a/services/_proxy/nginx.conf
+++ b/services/_proxy/nginx.conf
@@ -12,6 +12,7 @@ http {
##
# Basic Settings
##
+ charset utf-8;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
@@ -34,11 +35,10 @@ http {
##
# Logging Settings
##
- access_log /var/log/nginx/access.log;
- error_log /var/log/nginx/error.log;
- log_format compression '$remote_addr - $remote_user [$time_local] '
- '"$request" $status $body_bytes_sent '
+ log_format main '$time_local $remote_addr $status $host $request $bytes_sent'
'"$http_referer" "$http_user_agent" "$gzip_ratio"';
+ access_log /var/log/nginx/access.log main;
+ error_log /var/log/nginx/error.log;
##
# Gzip Settings
diff --git a/services/amaglio.fr/docker-compose.yml b/services/amaglio.fr/docker-compose.yml
deleted file mode 100755
index b912364..0000000
--- a/services/amaglio.fr/docker-compose.yml
+++ /dev/null
@@ -1,55 +0,0 @@
-version: '3'
-services:
- roundcube:
- image: roundcube/roundcubemail:1.4.x-apache
- restart: "unless-stopped"
- depends_on:
- - db
- volumes:
- - /data/amaglio.fr/app/plugins/enigma/home:/var/www/html/plugins/enigma/home
- - /data/amaglio.fr/app/config/config.inc.php:/var/www/html/config/config.inc.php
- - /data/amaglio.fr/app/enigma_pgp_homedir:/data/enigma_pgp_homedir
- env_file: /data/amaglio.fr/env
- environment:
- ROUNDCUBEMAIL_DB_TYPE: pgsql
- ROUNDCUBEMAIL_DB_HOST: db
- ROUNDCUBEMAIL_DB_USER: postgres
- ROUNDCUBEMAIL_DB_NAME: postgres
- ROUNDCUBEMAIL_UPLOAD_MAX_FILESIZE: 25M
-
- # imap server
- ROUNDCUBEMAIL_DEFAULT_HOST: ssl://mail20.lwspanel.com
- ROUNDCUBEMAIL_DEFAULT_PORT: 993
- ROUNDCUBEMAIL_SMTP_SERVER: tls://mail20.lwspanel.com
- ROUNDCUBEMAIL_SMTP_PORT: 587
- ROUNDCUBEMAIL_PLUGINS: archive,zipdownload,enigma,attachment_reminder
- networks:
- default:
- ipv4_address: 172.29.5.100
- deploy:
- resources:
- limits:
- cpus: '0.50'
- memory: 100M
-
- db:
- # https://hub.docker.com/_/postgres?tab=description
- image: postgres:9.6-alpine
- restart: "unless-stopped"
- env_file: /data/amaglio.fr/env
- volumes:
- - /data/amaglio.fr/db:/var/lib/postgresql/data
- networks:
- default:
- ipv4_address: 172.29.5.101
- deploy:
- resources:
- limits:
- cpus: '0.50'
- memory: 100M
-networks:
- default:
- ipam:
- config:
- - subnet: 172.29.5.0/24
-
diff --git a/services/amaglio.fr/nginx_server.conf b/services/amaglio.fr/nginx_server.conf
deleted file mode 100755
index 33c705b..0000000
--- a/services/amaglio.fr/nginx_server.conf
+++ /dev/null
@@ -1,40 +0,0 @@
-server {
- listen 443 ssl http2;
- listen [::]:443 ssl http2;
- ssl_certificate $JC_CERT/fullchain.pem;
- ssl_certificate_key $JC_CERT/privkey.pem;
-
- server_name amaglio.fr www.amaglio.fr;
-# root /data/amaglio.fr/app;
-#
- client_max_body_size 1024M;
- charset utf-8;
-#
-# index index.php;
-#
-# location ~ ^/roundcube/(bin|SQL|config|temp|logs)/ {
-# deny all;
-# }
-#
-# location ~ /roundcube/\.(js|css|png|jpg|jpeg|gif|ico)$ {
-# expires max;
-# log_not_found off;
-# }
-#
- location / {
- proxy_pass http://172.29.5.100;
- proxy_set_header Host $host;
-
- proxy_set_header X-Forwarded-For $remote_addr;
- }
-#
-# location ~ \.php$ {
-# fastcgi_split_path_info ^(.+\.php)(/.*)$;
-# include fastcgi_params;
-# fastcgi_param SCRIPT_FILENAME /var/www/html/$fastcgi_script_name;
-# fastcgi_param PATH_INFO $fastcgi_path_info;
-# fastcgi_pass amaglio.fr:9000;
-# fastcgi_index index.php;
-# }
-}
-
diff --git a/services/benevoles31.karnaval.fr/docker-compose.yml b/services/benevoles31.karnaval.fr/docker-compose.yml
index a0cc407..7a3325f 100755
--- a/services/benevoles31.karnaval.fr/docker-compose.yml
+++ b/services/benevoles31.karnaval.fr/docker-compose.yml
@@ -13,7 +13,7 @@ services:
restart: unless-stopped
networks:
default:
- ipv4_address: 172.16.17.100
+ ipv4_address: $NET.100
#redis:
# image: redis
@@ -27,7 +27,7 @@ services:
- $DATA_DIR/db:/var/lib/postgresql/data
networks:
default:
- ipv4_address: 172.16.17.101
+ ipv4_address: $NET.101
# app2:
# image: jeancloud/site-benevole:dev-karna-debian
# environment:
@@ -41,7 +41,7 @@ services:
# restart: unless-stopped
# networks:
# default:
- # ipv4_address: 172.29.17.110
+ # ipv4_address: $NET.110
#
# db2:
# image: postgres:9.6-alpine
@@ -53,10 +53,10 @@ services:
# - $DATA_DIR/db2:/var/lib/postgresql/data
# networks:
# default:
- # ipv4_address: 172.29.17.111
+ # ipv4_address: $NET.111
networks:
default:
ipam:
config:
- - subnet: 172.16.17.0/24
+ - subnet: $NET.0/24
diff --git a/services/builder.rimarima.fr/.env b/services/builder.rimarima.fr/.env
new file mode 100644
index 0000000..df5e283
--- /dev/null
+++ b/services/builder.rimarima.fr/.env
@@ -0,0 +1 @@
+GIT_SOURCE_REPO=https://git.jean-cloud.net/adrian/rimarima
diff --git a/services/builder.rimarima.fr/deploy.sh b/services/builder.rimarima.fr/deploy.sh
new file mode 100755
index 0000000..e32f87e
--- /dev/null
+++ b/services/builder.rimarima.fr/deploy.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+chown $UID:www-data "$SECRET_DIR/user.htpasswd"
+chmod 740 "$SECRET_DIR/user.htpasswd"
diff --git a/services/builder.rimarima.fr/deploy_http.sh b/services/builder.rimarima.fr/deploy_http.sh
deleted file mode 100755
index ccfa05c..0000000
--- a/services/builder.rimarima.fr/deploy_http.sh
+++ /dev/null
@@ -1,13 +0,0 @@
-#!/bin/bash
-
-set -euo pipefail
-set -a
-. "$SECRET_DIR/.env"
-set +a
-
-git_update.sh -d "$HTTP_DIR" -b main "https://git.jean-cloud.net/adrian/rimarima"
-
-rclone_ncloud_publiclink.sh "$HTTP_DIR/content"
-
-podman build . -f hugobuilder.dockerfile -t $JC_SERVICE/builder
-podman run --rm -v $HTTP_DIR:/srv $JC_SERVICE/builder
diff --git a/services/builder.rimarima.fr/deploy_user.sh b/services/builder.rimarima.fr/deploy_user.sh
new file mode 120000
index 0000000..e723ae7
--- /dev/null
+++ b/services/builder.rimarima.fr/deploy_user.sh
@@ -0,0 +1 @@
+../hugo/deploy_user.sh
\ No newline at end of file
diff --git a/services/builder.rimarima.fr/server.sh b/services/builder.rimarima.fr/server.sh
index 72a57db..53f29c8 100755
--- a/services/builder.rimarima.fr/server.sh
+++ b/services/builder.rimarima.fr/server.sh
@@ -3,14 +3,10 @@
echo "Content-type: text/html"
echo ""
+. .env
+
action="$(echo "$DOCUMENT_URI" | tr -d '/\;!&<>?#[]()"*')"
-set -a
-. .env
-set +a
-
-"./deploy_http.sh" 2>&1
-ret="$?"
-if [ "$ret" -ne 0 ] ; then
- echo 'Error'
-fi
+echo ''
+deploy_as "$JC_SERVICE"
+echo '
'
diff --git a/services/chahut.jean-cloud.net/docker-compose.yml b/services/chahut.jean-cloud.net/docker-compose.yml
index bc7e303..b960be4 100644
--- a/services/chahut.jean-cloud.net/docker-compose.yml
+++ b/services/chahut.jean-cloud.net/docker-compose.yml
@@ -11,7 +11,7 @@ services:
- /srv/http/$JC_SERVICE:/var/www/html/static
networks:
default:
- ipv4_address: 172.29.18.100
+ ipv4_address: $NET.100
deploy:
resources:
limits:
@@ -26,16 +26,16 @@ services:
- $DATA_DIR/db:/var/lib/mysql
networks:
default:
- ipv4_address: 172.29.18.101
+ ipv4_address: $NET.101
deploy:
resources:
limits:
cpus: '0.50'
- memory: 100M
+ memory: 300M
networks:
default:
ipam:
config:
- - subnet: 172.29.18.0/24
+ - subnet: $NET.0/24
diff --git a/services/chahut.jean-cloud.net/nginx_server.conf b/services/chahut.jean-cloud.net/nginx_server.conf
index 2778731..a26e2c7 100755
--- a/services/chahut.jean-cloud.net/nginx_server.conf
+++ b/services/chahut.jean-cloud.net/nginx_server.conf
@@ -11,7 +11,7 @@ server {
#proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Proto https;
- proxy_pass http://172.29.18.100;
+ proxy_pass http://$NET.100;
proxy_redirect off;
}
}
diff --git a/services/chiloe.eu/deploy_http.sh b/services/chiloe.eu/deploy_user.sh
similarity index 80%
rename from services/chiloe.eu/deploy_http.sh
rename to services/chiloe.eu/deploy_user.sh
index f465dc5..95cbff8 100755
--- a/services/chiloe.eu/deploy_http.sh
+++ b/services/chiloe.eu/deploy_user.sh
@@ -1,5 +1,3 @@
#!/bin/bash
-set -euo pipefail
-. "$SECRET_DIR/.env"
rclone sync --config=/notfound --sftp-host sftp.jean-cloud.net --sftp-user chiloeRO --sftp-port 2929 --sftp-pass "$SFTP_PASS" :sftp:/public/ "$HTTP_DIR"
diff --git a/services/coldcms.chahut.jean-cloud.net/docker-compose.yml b/services/coldcms.chahut.jean-cloud.net/docker-compose.yml
index bf16a85..75b2e3a 100644
--- a/services/coldcms.chahut.jean-cloud.net/docker-compose.yml
+++ b/services/coldcms.chahut.jean-cloud.net/docker-compose.yml
@@ -17,7 +17,7 @@ services:
restart: unless-stopped
networks:
default:
- ipv4_address: 172.29.20.100
+ ipv4_address: $NET.100
deploy:
resources:
limits:
@@ -29,4 +29,4 @@ networks:
default:
ipam:
config:
- - subnet: 172.29.20.0/24
+ - subnet: $NET.0/24
diff --git a/services/coldcms.chahut.jean-cloud.net/nginx_server.conf b/services/coldcms.chahut.jean-cloud.net/nginx_server.conf
index 9f4b926..ddee107 100644
--- a/services/coldcms.chahut.jean-cloud.net/nginx_server.conf
+++ b/services/coldcms.chahut.jean-cloud.net/nginx_server.conf
@@ -27,7 +27,7 @@ server {
location @uwsgi_backend {
- uwsgi_pass 172.29.20.100:8000;
+ uwsgi_pass $NET.100:8000;
include uwsgi_params;
client_max_body_size 20m;
}
@@ -47,7 +47,7 @@ server {
}
location /admin/ {
- uwsgi_pass 172.29.20.100:8000;
+ uwsgi_pass $NET.100:8000;
include uwsgi_params;
client_max_body_size 20m;
}
diff --git a/services/collectif-arthadie.fr/docker-compose.yml b/services/collectif-arthadie.fr/docker-compose.yml
index cfcf1ad..2e66266 100644
--- a/services/collectif-arthadie.fr/docker-compose.yml
+++ b/services/collectif-arthadie.fr/docker-compose.yml
@@ -15,7 +15,7 @@ services:
- /data/collectif-arthadie.fr/static:/var/www/html/static
networks:
default:
- ipv4_address: 172.29.6.100
+ ipv4_address: $NET.100
deploy:
resources:
limits:
@@ -34,16 +34,16 @@ services:
- /data/collectif-arthadie.fr/db:/var/lib/mysql
networks:
default:
- ipv4_address: 172.29.6.101
+ ipv4_address: $NET.101
deploy:
resources:
limits:
cpus: '0.50'
- memory: 100M
+ memory: 300M
networks:
default:
ipam:
config:
- - subnet: 172.29.6.0/24
+ - subnet: $NET.0/24
diff --git a/services/collectif-arthadie.fr/nginx_server.conf b/services/collectif-arthadie.fr/nginx_server.conf
index 9b03cbd..7fa4114 100755
--- a/services/collectif-arthadie.fr/nginx_server.conf
+++ b/services/collectif-arthadie.fr/nginx_server.conf
@@ -9,7 +9,7 @@ server {
#proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Proto https;
- proxy_pass http://172.29.6.100;
+ proxy_pass http://$NET.100;
proxy_redirect off;
}
}
diff --git a/services/compagnienouvelle.fr/docker-compose.yml b/services/compagnienouvelle.fr/docker-compose.yml
index 3ee2d38..c599ae5 100644
--- a/services/compagnienouvelle.fr/docker-compose.yml
+++ b/services/compagnienouvelle.fr/docker-compose.yml
@@ -13,7 +13,7 @@ services:
- $DATA_DIR/static:/var/www/html/static
networks:
default:
- ipv4_address: 172.29.7.100
+ ipv4_address: $NET.100
deploy:
resources:
limits:
@@ -28,16 +28,16 @@ services:
- $DATA_DIR/db:/var/lib/mysql
networks:
default:
- ipv4_address: 172.29.7.101
+ ipv4_address: $NET.101
deploy:
resources:
limits:
cpus: '0.50'
- memory: 100M
+ memory: 300M
networks:
default:
ipam:
config:
- - subnet: 172.29.7.0/24
+ - subnet: $NET.0/24
diff --git a/services/compagnienouvelle.fr/nginx_server.conf b/services/compagnienouvelle.fr/nginx_server.conf
index a1d97ee..5aa70dd 100755
--- a/services/compagnienouvelle.fr/nginx_server.conf
+++ b/services/compagnienouvelle.fr/nginx_server.conf
@@ -11,7 +11,7 @@ server {
#proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Proto https;
- proxy_pass http://172.29.7.100;
+ proxy_pass http://$NET.100;
proxy_redirect off;
}
}
diff --git a/services/copaines.jean-cloud.net/deploy.sh b/services/copaines.jean-cloud.net/deploy.sh
new file mode 100755
index 0000000..819f1e1
--- /dev/null
+++ b/services/copaines.jean-cloud.net/deploy.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+chmod 700 "$SECRET_DIR/sftp.sshprivkey"
diff --git a/services/copaines.jean-cloud.net/deploy_http.sh b/services/copaines.jean-cloud.net/deploy_user.sh
similarity index 95%
rename from services/copaines.jean-cloud.net/deploy_http.sh
rename to services/copaines.jean-cloud.net/deploy_user.sh
index 163fc93..33f0bcd 100755
--- a/services/copaines.jean-cloud.net/deploy_http.sh
+++ b/services/copaines.jean-cloud.net/deploy_user.sh
@@ -1,3 +1,5 @@
#!/bin/bash
+mkdir -p ~/.ssh
echo '[sftp.jean-cloud.net]:2929 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC5WLG4HbhHMWZySQkCOfMyJ8HAojyJJ66prhn/WSh1T6vyi/oWuodhN5fzIenEpKrmIzXLLfFa8Q9YuEYmcwNGp0FrTnATDYLABL530DBsCQzA5S+fLecY0iLHEkluuJCcX2+cNpu7ytzgbEzHFDRDkd6RgI1cBL5smCnbxfrJSvfLR0VvihQJNZKPYEFHxt9euGkHhKilwbXa4VEtfY8GfMK18dGlM+K2nRu4G+ckoNzx9K2RdwAqUyj1WFLrS+FYY8EbHlffWf4WES32tSeyd6z3rF0jFoN83ojZ0nPfcch10tWklfRc2RcoItde9p0bR/Cgz2SI1nZT9EcBhrpqGkucLsx/xvcxXd/puQDe9svBq1vgWRuub7e6Q40v8Lhl5dTGJutKLWbCg9udonaUIR/LudSnSgEGrDoz/Yjx8Iytj9+tLj9C+rRASfUnHnTRjsVKJG3Ofx+YHhWs0gLJcV06EvM+PBgZOCnegcPrssi0OE+I5HtDixTkaBNQPHXfKcGqlSEPRmqEuwsvdcv7vOfWJn1ufmKpoaLXWPrX+U4gZYSMHrhieqdcieT8wSu/YJa8gBM5qkK1WMOYxwYzLU5q9H4g9sJfFqk14cvQk47Tb+nTLlFoYZvunATBAxQuNuMo8+scu0BuIqinB5SjO6bwF3nJUCigs8BTmo95Pw==' >> ~/.ssh/known_hosts
+chmod 700 ~/.ssh/known_hosts
scp -i "$SECRET_DIR/sftp.sshprivkey" -rP 2929 copaines@sftp.jean-cloud.net:public/* "$HTTP_DIR"
diff --git a/services/cousinades.jean-cloud.net/docker-compose.yml b/services/cousinades.jean-cloud.net/docker-compose.yml
index fea7e24..d939f66 100755
--- a/services/cousinades.jean-cloud.net/docker-compose.yml
+++ b/services/cousinades.jean-cloud.net/docker-compose.yml
@@ -7,7 +7,7 @@ services:
restart: unless-stopped
networks:
default:
- ipv4_address: 172.29.4.100
+ ipv4_address: $NET.100
deploy:
resources:
limits:
@@ -21,7 +21,7 @@ services:
- /data/cousinades.jean-cloud.net/db:/var/lib/postgresql/data
networks:
default:
- ipv4_address: 172.29.4.101
+ ipv4_address: $NET.101
deploy:
resources:
limits:
@@ -32,4 +32,4 @@ networks:
default:
ipam:
config:
- - subnet: 172.29.4.0/24
+ - subnet: $NET.0/24
diff --git a/services/cousinades.jean-cloud.net/nginx_server.conf b/services/cousinades.jean-cloud.net/nginx_server.conf
index 11fe749..b61d4ad 100755
--- a/services/cousinades.jean-cloud.net/nginx_server.conf
+++ b/services/cousinades.jean-cloud.net/nginx_server.conf
@@ -16,7 +16,7 @@ server {
location ~ \.php$ {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
- fastcgi_pass 172.29.4.100:9000;
+ fastcgi_pass $NET.100:9000;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME /usr/src/app/$fastcgi_script_name;
diff --git a/services/dnscerts.jean-cloud.org/run_as.sh b/services/dnscerts.jean-cloud.org/run_as.sh
index 65eb84a..95499da 100755
--- a/services/dnscerts.jean-cloud.org/run_as.sh
+++ b/services/dnscerts.jean-cloud.org/run_as.sh
@@ -14,8 +14,8 @@ set +a
# Test secret presence
[ ! -f "$DATA_DIR/rfc2136.ini" ] && echo "$0 Missing file '$DATA_DIR/rfc2136.ini'" && exit 1
-export tmp="$(mktemp -d)"
-mkdir -p "$tmp/{work,logs}"
+export workdir="$(mktemp -d)"
+mkdir -p "$workdir/{work,logs}"
# If there is some args, populate a fake service file
if [ "$#" -ge 1 ] && [ -n "$1" ] ; then
@@ -25,6 +25,9 @@ if [ "$#" -ge 1 ] && [ -n "$1" ] ; then
done
fi
+echo "Renew existing certs"
+certbot renew --config-dir "$DATA_DIR/certs" --logs-dir "$workdir/logs" --dns-rfc2136 --dns-rfc2136-credentials "$DATA_DIR/rfc2136.ini" --work-dir "$workdir"
+
echo "For each service, read all possible domains"
while read line ; do
read -r service target < <(echo "$line")
@@ -35,15 +38,18 @@ while read line ; do
# remove dummy cert
dummy_cert.sh "$service" remove || true
- [ -d "$DATA_DIR/certs/live/$service" ] && echo "Already exists, thats a job for renew : $service" && continue
+ if [ -d "$DATA_DIR/certs/live/$service" ] ; then
+ #echo "Already exists, thats a job for renew : $service"
+ continue
+ fi
# acme
- "$here/acme-dns.sh" "$service" "$tmp"
+ "$here/acme-dns.sh" "$service" "$workdir"
done < "$servicefile"
echo "Push certs to other servers"
-for srv in $(host -t TXT shlago.jean-cloud.org ns.jean-cloud.org | grep -Po 'descriptive text "\K[^"]+' | tr ',' ' ' | tr ' ' '\n') ; do
+for srv in $(host -t TXT shlago.jean-cloud.org ns.jean-cloud.org | grep -Po 'descriptive text "\K[^"]+' | tr ',' ' ' | tr ' ' '\n') vandamme nougaro ; do
server="$srv.jean-cloud.org"
[ -n "$(grep "$server" /etc/hosts)" ] && continue
echo "-- $server"
diff --git a/services/etrevivant.net/.env b/services/etrevivant.net/.env
index 817b5e9..a948b14 100644
--- a/services/etrevivant.net/.env
+++ b/services/etrevivant.net/.env
@@ -1,2 +1,2 @@
GIT_SOURCE_REPO="https://git.jean-cloud.net/adrian/etrevivant"
-CLOUD_LOCAL_PATH=content
+GIT_SOURCE_BRANCH=master
diff --git a/services/etrevivant.net/deploy.sh b/services/etrevivant.net/deploy.sh
new file mode 120000
index 0000000..e8adfae
--- /dev/null
+++ b/services/etrevivant.net/deploy.sh
@@ -0,0 +1 @@
+../hugo/deploy.sh
\ No newline at end of file
diff --git a/services/etrevivant.net/deploy_http.sh b/services/etrevivant.net/deploy_http.sh
deleted file mode 100755
index 275cb44..0000000
--- a/services/etrevivant.net/deploy_http.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-set -a
-. "$SECRET_DIR/.env"
-set +a
-
-git_update.sh -d "$HTTP_DIR" "$GIT_SOURCE_REPO"
-hugo_rclone.sh "$HTTP_DIR"
diff --git a/services/etrevivant.net/deploy_user.sh b/services/etrevivant.net/deploy_user.sh
new file mode 120000
index 0000000..e723ae7
--- /dev/null
+++ b/services/etrevivant.net/deploy_user.sh
@@ -0,0 +1 @@
+../hugo/deploy_user.sh
\ No newline at end of file
diff --git a/services/etrevivant.net/nginx_server.conf b/services/etrevivant.net/nginx_server.conf
deleted file mode 100755
index dba721b..0000000
--- a/services/etrevivant.net/nginx_server.conf
+++ /dev/null
@@ -1,22 +0,0 @@
-server {
- listen 443 ssl http2;
- listen [::]:443 ssl http2;
- ssl_certificate $JC_CERT/fullchain.pem;
- ssl_certificate_key $JC_CERT/privkey.pem;
- server_name $JC_SERVICE www.$JC_SERVICE;
- root $HTTP_DIR/public/;
-
- # Security headers
- add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
- add_header Content-Security-Policy "default-src 'none';frame-ancestors 'none'; script-src 'self'; img-src 'self'; font-src 'self'; object-src 'none'; style-src 'self'; base-uri 'self'; form-action 'self';" always;
- add_header X-Content-Type-Options "nosniff";
- add_header X-Frame-Options SAMEORIGIN always;
- add_header X-XSS-Protection "1; mode=block" always;
- add_header Referrer-Policy "strict-origin-when-cross-origin";
- add_header Permissions-Policy "geolocation='none';midi='none';notifications='none';push='none';microphone='none';camera='none';magnetometer='none';gyroscope='none';speaker='self';vibrate='none';fullscreen='self';payment='none';";
-
- location / {
- index index.html;
- try_files $uri $uri/ =404;
- }
-}
diff --git a/services/etrevivant.net/nginx_server.conf b/services/etrevivant.net/nginx_server.conf
new file mode 120000
index 0000000..8b62669
--- /dev/null
+++ b/services/etrevivant.net/nginx_server.conf
@@ -0,0 +1 @@
+../hugo/nginx_server.conf
\ No newline at end of file
diff --git a/services/feministesucl34.communisteslibertaires.org/deploy_http.sh b/services/feministesucl34.communisteslibertaires.org/deploy_user.sh
similarity index 100%
rename from services/feministesucl34.communisteslibertaires.org/deploy_http.sh
rename to services/feministesucl34.communisteslibertaires.org/deploy_user.sh
diff --git a/services/feteducourt.jean-cloud.net/deploy_http.sh b/services/feteducourt.jean-cloud.net/deploy_user.sh
similarity index 100%
rename from services/feteducourt.jean-cloud.net/deploy_http.sh
rename to services/feteducourt.jean-cloud.net/deploy_user.sh
diff --git a/services/feteducourt2020.jean-cloud.net/deploy_http.sh b/services/feteducourt2020.jean-cloud.net/deploy_user.sh
similarity index 100%
rename from services/feteducourt2020.jean-cloud.net/deploy_http.sh
rename to services/feteducourt2020.jean-cloud.net/deploy_user.sh
diff --git a/services/git.jean-cloud.net/docker-compose.yml b/services/git.jean-cloud.net/docker-compose.yml
index 1b7b615..aeca357 100755
--- a/services/git.jean-cloud.net/docker-compose.yml
+++ b/services/git.jean-cloud.net/docker-compose.yml
@@ -1,7 +1,7 @@
version: '3'
services:
gitea:
- image: gitea/gitea:1.9.1
+ image: gitea/gitea:1.21
depends_on:
- db
volumes:
@@ -11,31 +11,23 @@ services:
restart: unless-stopped
networks:
default:
- ipv4_address: 172.29.10.100
- deploy:
- resources:
- limits:
- cpus: '0.50'
- memory: 100M
-
-
+ ipv4_address: $NET.100
db:
- # https://hub.docker.com/_/postgres?tab=description
- image: postgres:9.6-alpine
+ image: postgres:16-alpine
volumes:
- /data/git.jean-cloud.net/db:/var/lib/postgresql/data
networks:
default:
- ipv4_address: 172.29.10.101
+ ipv4_address: $NET.101
deploy:
resources:
limits:
- cpus: '0.50'
- memory: 100M
+ cpus: '1'
+ memory: 300M
networks:
default:
ipam:
config:
- - subnet: 172.29.10.0/24
+ - subnet: $NET.0/24
diff --git a/services/git.jean-cloud.net/nginx_server.conf b/services/git.jean-cloud.net/nginx_server.conf
index adb9119..89a1592 100755
--- a/services/git.jean-cloud.net/nginx_server.conf
+++ b/services/git.jean-cloud.net/nginx_server.conf
@@ -3,10 +3,11 @@ server {
listen [::]:443 ssl http2;
ssl_certificate $JC_CERT/fullchain.pem;
ssl_certificate_key $JC_CERT/privkey.pem;
- server_name git.jean-cloud.net www.git.jean-cloud.net;
+ server_name $JC_SERVICE www.$JC_SERVICE;
+ limit_req zone=defaultlimit burst=20 nodelay;
location / {
client_max_body_size 5G;
- proxy_pass http://172.29.10.100:3000;
+ proxy_pass http://$NET.100:3000;
}
}
diff --git a/services/grapes.chahut.jean-cloud.net/.env b/services/grapes.chahut.jean-cloud.net/.env
index 8820615..2438616 100644
--- a/services/grapes.chahut.jean-cloud.net/.env
+++ b/services/grapes.chahut.jean-cloud.net/.env
@@ -1,2 +1 @@
-JC_NET=172.29.19
GIT_SOURCE_REPO=https://git.jean-cloud.net/adrian/grapesjs
diff --git a/services/grapes.chahut.jean-cloud.net/deploy_http.sh b/services/grapes.chahut.jean-cloud.net/deploy_user.sh
similarity index 100%
rename from services/grapes.chahut.jean-cloud.net/deploy_http.sh
rename to services/grapes.chahut.jean-cloud.net/deploy_user.sh
diff --git a/services/grapes.chahut.jean-cloud.net/docker-compose.yml b/services/grapes.chahut.jean-cloud.net/docker-compose.yml
index cf13358..f1a3a1c 100755
--- a/services/grapes.chahut.jean-cloud.net/docker-compose.yml
+++ b/services/grapes.chahut.jean-cloud.net/docker-compose.yml
@@ -6,7 +6,7 @@ services:
- "$DATA_DIR:/usr/lib/json-server"
networks:
default:
- ipv4_address: $JC_NET.100
+ ipv4_address: $NET.100
deploy:
resources:
limits:
@@ -16,4 +16,4 @@ networks:
default:
ipam:
config:
- - subnet: $JC_NET.0/24
+ - subnet: $NET.0/24
diff --git a/services/grapes.chahut.jean-cloud.net/nginx_server.conf b/services/grapes.chahut.jean-cloud.net/nginx_server.conf
index bd6891d..193e24f 100755
--- a/services/grapes.chahut.jean-cloud.net/nginx_server.conf
+++ b/services/grapes.chahut.jean-cloud.net/nginx_server.conf
@@ -28,7 +28,7 @@ server {
location /projects {
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Proto https;
- proxy_pass http://$JC_NET.100:3000;
+ proxy_pass http://$NET.100:3000;
proxy_redirect off;
}
diff --git a/services/gypsylyonfestival.com/deploy_http.sh b/services/gypsylyonfestival.com/deploy_user.sh
similarity index 100%
rename from services/gypsylyonfestival.com/deploy_http.sh
rename to services/gypsylyonfestival.com/deploy_user.sh
diff --git a/services/gypsylyonfestival.com/nginx_server.conf b/services/gypsylyonfestival.com/nginx_server.conf
index c555598..7a1ddd6 100755
--- a/services/gypsylyonfestival.com/nginx_server.conf
+++ b/services/gypsylyonfestival.com/nginx_server.conf
@@ -3,8 +3,7 @@ server {
listen [::]:443 ssl http2;
ssl_certificate $JC_CERT/fullchain.pem;
ssl_certificate_key $JC_CERT/privkey.pem;
- #server_name gypsylyonfestival.com www.gypsylyonfestival.com;
- server_name gypsy.jean-cloud.net;
+ server_name $JC_SERVICE;
root $HTTP_DIR;
# Security headers
diff --git a/services/hugo/deploy.sh b/services/hugo/deploy.sh
new file mode 100755
index 0000000..1c23910
--- /dev/null
+++ b/services/hugo/deploy.sh
@@ -0,0 +1,2 @@
+#!/bin/bash
+apt install -y hugo
diff --git a/services/hugo/deploy_user.sh b/services/hugo/deploy_user.sh
new file mode 100755
index 0000000..da545fd
--- /dev/null
+++ b/services/hugo/deploy_user.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+set -euo pipefail
+
+# Update git repo
+git_update.sh -d "$HTTP_DIR" -b "${GIT_SOURCE_BRANCH:-main}" "$GIT_SOURCE_REPO"
+
+cd "$HTTP_DIR"
+
+# Get remote content files
+rclone_ncloud_publiclink.sh
+
+# Build website
+HUGO_CACHEDIR=/tmp/hugo_cache_$USER hugo
diff --git a/services/hugo/nginx_server.conf b/services/hugo/nginx_server.conf
new file mode 100755
index 0000000..85ce615
--- /dev/null
+++ b/services/hugo/nginx_server.conf
@@ -0,0 +1,24 @@
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+ ssl_certificate $JC_CERT/fullchain.pem;
+ ssl_certificate_key $JC_CERT/privkey.pem;
+ server_name $JC_SERVICE www.$JC_SERVICE;
+ root $HTTP_DIR/public;
+
+ # Security headers
+ # We can create a file with the base security headers and include it.
+ # Will it be possible to overload them then ?
+ add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+ add_header Content-Security-Policy "default-src 'none';frame-ancestors 'none'; script-src 'self'; img-src 'self'; font-src 'self'; object-src 'none'; style-src 'self'; base-uri 'self'; form-action 'self';" always;
+ add_header X-Content-Type-Options "nosniff";
+ add_header X-Frame-Options SAMEORIGIN always;
+ add_header X-XSS-Protection "1; mode=block" always;
+ add_header Referrer-Policy "strict-origin-when-cross-origin";
+ add_header Permissions-Policy "geolocation='none';midi='none';notifications='none';push='none';sync-xhr='https://mailer.jean-cloud.net';microphone='none';camera='none';magnetometer='none';gyroscope='none';speaker='self';vibrate='none';fullscreen='self';payment='none';";
+
+ location / {
+ index index.html;
+ try_files $uri $uri/ =404;
+ }
+}
diff --git a/services/inurbe.fr/deploy_http.sh b/services/inurbe.fr/deploy_user.sh
similarity index 100%
rename from services/inurbe.fr/deploy_http.sh
rename to services/inurbe.fr/deploy_user.sh
diff --git a/services/jean-cloud.net/.env b/services/jean-cloud.net/.env
new file mode 100644
index 0000000..7a87fd0
--- /dev/null
+++ b/services/jean-cloud.net/.env
@@ -0,0 +1 @@
+GIT_SOURCE_REPO=https://git.jean-cloud.net/adrian/jean-cloud_website
diff --git a/services/jean-cloud.net/LINKS. DO NOT EDIT b/services/jean-cloud.net/LINKS. DO NOT EDIT
new file mode 100644
index 0000000..e69de29
diff --git a/services/jean-cloud.net/deploy.sh b/services/jean-cloud.net/deploy.sh
deleted file mode 100755
index 48f507e..0000000
--- a/services/jean-cloud.net/deploy.sh
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/bin/bash
-
-docker run -u 33 --rm -e GIT_SOURCE_REPO='https://git.jean-cloud.net/adrian/jean-cloud_website' -v "$HTTP_DIR:/usr/local/app" docker.io/jeancloud/pelican-rclone-builder
diff --git a/services/jean-cloud.net/deploy.sh b/services/jean-cloud.net/deploy.sh
new file mode 120000
index 0000000..7d8f3e3
--- /dev/null
+++ b/services/jean-cloud.net/deploy.sh
@@ -0,0 +1 @@
+../pelican/deploy.sh
\ No newline at end of file
diff --git a/services/jean-cloud.net/deploy_user.sh b/services/jean-cloud.net/deploy_user.sh
new file mode 120000
index 0000000..580c68d
--- /dev/null
+++ b/services/jean-cloud.net/deploy_user.sh
@@ -0,0 +1 @@
+../pelican/deploy_user.sh
\ No newline at end of file
diff --git a/services/jean-cloud.net/nginx_server.conf b/services/jean-cloud.net/nginx_server.conf
deleted file mode 100755
index bb0505b..0000000
--- a/services/jean-cloud.net/nginx_server.conf
+++ /dev/null
@@ -1,33 +0,0 @@
-server {
- listen 443 ssl http2;
- listen [::]:443 ssl http2;
- ssl_certificate $JC_CERT/fullchain.pem;
- ssl_certificate_key $JC_CERT/privkey.pem;
- server_name jean-cloud.net www.jean-cloud.net jean-cloud.org www.jean-cloud.org;
- root $HTTP_DIR/output;
-
- # Security headers
- # We can create a file with the base security headers and include it.
- # Will it be possible to overload them then ?
- add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
- add_header Content-Security-Policy "default-src 'none';frame-ancestors 'none'; script-src 'self'; img-src 'self'; font-src 'self'; object-src 'none'; style-src 'self'; base-uri 'self'; form-action 'self';" always;
- add_header X-Content-Type-Options "nosniff";
- add_header X-Frame-Options SAMEORIGIN always;
- add_header X-XSS-Protection "1; mode=block" always;
- add_header Referrer-Policy "strict-origin-when-cross-origin";
- add_header Permissions-Policy "geolocation='none';midi='none';notifications='none';push='none';sync-xhr='https://mailer.jean-cloud.net';microphone='none';camera='none';magnetometer='none';gyroscope='none';speaker='self';vibrate='none';fullscreen='self';payment='none';";
-
- location / {
- index index.html;
- try_files $uri $uri/ =404;
- }
-
- error_page 503 /503.html;
- location = /503.html {
- internal;
- }
-
- location = /503 {
- return 503;
- }
-}
diff --git a/services/jean-cloud.net/nginx_server.conf b/services/jean-cloud.net/nginx_server.conf
new file mode 120000
index 0000000..b3e6a38
--- /dev/null
+++ b/services/jean-cloud.net/nginx_server.conf
@@ -0,0 +1 @@
+../pelican/nginx_server.conf
\ No newline at end of file
diff --git a/services/jean-cloud.org/.env b/services/jean-cloud.org/.env
new file mode 100644
index 0000000..0309c34
--- /dev/null
+++ b/services/jean-cloud.org/.env
@@ -0,0 +1 @@
+DESTINATION=jean-cloud.net
diff --git a/services/jean-cloud.org/LINKS. DO NOT EDIT b/services/jean-cloud.org/LINKS. DO NOT EDIT
new file mode 100644
index 0000000..e69de29
diff --git a/services/jean-cloud.org/nginx_server.conf b/services/jean-cloud.org/nginx_server.conf
new file mode 120000
index 0000000..96e018f
--- /dev/null
+++ b/services/jean-cloud.org/nginx_server.conf
@@ -0,0 +1 @@
+../redirection/nginx_server.conf
\ No newline at end of file
diff --git a/services/lexicographe.jean-cloud.net/.env b/services/lexicographe.jean-cloud.net/.env
new file mode 100644
index 0000000..238207a
--- /dev/null
+++ b/services/lexicographe.jean-cloud.net/.env
@@ -0,0 +1 @@
+GIT_SOURCE_REPO=https://git.jean-cloud.net/adrian/lexicographe
diff --git a/services/lexicographe.jean-cloud.net/LINKS. DO NOT EDIT b/services/lexicographe.jean-cloud.net/LINKS. DO NOT EDIT
new file mode 100644
index 0000000..e69de29
diff --git a/services/lexicographe.jean-cloud.net/deploy.sh b/services/lexicographe.jean-cloud.net/deploy.sh
deleted file mode 100755
index 14c0cfd..0000000
--- a/services/lexicographe.jean-cloud.net/deploy.sh
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-docker run -u 33 --rm --env-file "$SECRET_DIR/.env" -v "$HTTP_DIR:/usr/local/app" docker.io/jeancloud/pelican-rclone-builder
diff --git a/services/lexicographe.jean-cloud.net/deploy.sh b/services/lexicographe.jean-cloud.net/deploy.sh
new file mode 120000
index 0000000..7d8f3e3
--- /dev/null
+++ b/services/lexicographe.jean-cloud.net/deploy.sh
@@ -0,0 +1 @@
+../pelican/deploy.sh
\ No newline at end of file
diff --git a/services/lexicographe.jean-cloud.net/deploy_user.sh b/services/lexicographe.jean-cloud.net/deploy_user.sh
new file mode 120000
index 0000000..580c68d
--- /dev/null
+++ b/services/lexicographe.jean-cloud.net/deploy_user.sh
@@ -0,0 +1 @@
+../pelican/deploy_user.sh
\ No newline at end of file
diff --git a/services/lexicographe.jean-cloud.net/docker-compose.yml b/services/lexicographe.jean-cloud.net/docker-compose.yml
deleted file mode 100755
index d077323..0000000
--- a/services/lexicographe.jean-cloud.net/docker-compose.yml
+++ /dev/null
@@ -1,2 +0,0 @@
-version: '3'
-
diff --git a/services/lexicographe.jean-cloud.net/nginx_server.conf b/services/lexicographe.jean-cloud.net/nginx_server.conf
deleted file mode 100755
index cd00e3c..0000000
--- a/services/lexicographe.jean-cloud.net/nginx_server.conf
+++ /dev/null
@@ -1,24 +0,0 @@
-server {
- listen 443 ssl http2;
- listen [::]:443 ssl http2;
- ssl_certificate $JC_CERT/fullchain.pem;
- ssl_certificate_key $JC_CERT/privkey.pem;
- server_name lexicographe.jean-cloud.net;
- root $HTTP_DIR/output;
-
- # Security headers
- # We can create a file with the base security headers and include it.
- # Will it be possible to overload them then ?
- add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
- add_header Content-Security-Policy "default-src 'none';frame-ancestors 'none'; script-src 'self' https://unpkg.jean-cloud.net; img-src 'self'; font-src 'self'; object-src 'none'; style-src 'self' https://unpkg.jean-cloud.net; base-uri 'self'; form-action 'self' 'https://mailer.jean-cloud.net';" always;
- add_header X-Content-Type-Options "nosniff";
- add_header X-Frame-Options SAMEORIGIN always;
- add_header X-XSS-Protection "1; mode=block" always;
- add_header Referrer-Policy "strict-origin-when-cross-origin";
- add_header Permissions-Policy "geolocation='none';midi='none';notifications='none';push='none';sync-xhr='https://mailer.jean-cloud.net';microphone='none';camera='none';magnetometer='none';gyroscope='none';speaker='self';vibrate='none';fullscreen='self';payment='none';";
-
- location / {
- index index.html;
- try_files $uri $uri/ =404;
- }
-}
diff --git a/services/lexicographe.jean-cloud.net/nginx_server.conf b/services/lexicographe.jean-cloud.net/nginx_server.conf
new file mode 120000
index 0000000..b3e6a38
--- /dev/null
+++ b/services/lexicographe.jean-cloud.net/nginx_server.conf
@@ -0,0 +1 @@
+../pelican/nginx_server.conf
\ No newline at end of file
diff --git a/services/metamorphosemagazine.fr/deploy_http.sh b/services/metamorphosemagazine.fr/deploy_user.sh
similarity index 100%
rename from services/metamorphosemagazine.fr/deploy_http.sh
rename to services/metamorphosemagazine.fr/deploy_user.sh
diff --git a/services/mux.radiodemo.oma-radio.fr/.env b/services/mux.radiodemo.oma-radio.fr/.env
index 9fd5e23..56d8688 100644
--- a/services/mux.radiodemo.oma-radio.fr/.env
+++ b/services/mux.radiodemo.oma-radio.fr/.env
@@ -2,8 +2,8 @@ ENDPOINT=10.29.0.1
WEBSERVER=.105
MUX=.100
TELECOM=.101
-NET=172.29.0
-WEBSOCKET_PORT=2004
+SWEBSOCKET_PORT=2004
+WEBSOCKET_PORT=2204
RADIO_HOST=mux.radiodemo.oma-radio.fr
MUX_SERVER_PORT=9004
TELECOM_SERVER_PORT=3494
diff --git a/services/mux.radiodemo.oma-radio.fr/deploy_user.sh b/services/mux.radiodemo.oma-radio.fr/deploy_user.sh
new file mode 100755
index 0000000..a178430
--- /dev/null
+++ b/services/mux.radiodemo.oma-radio.fr/deploy_user.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+if [ ! -e "$DATA_DIR/.env" ] ; then
+ cat > "$DATA_DIR/.env" <&1 | grep '200 OK' && wget http://localhost:8000/direct.mp3 -O - -t 1 -T 3 -S --spider 2>&1 | grep '200 OK'"
- interval: 5m0s
+ interval: 1h0m0s
timeout: 10s
retries: 3
start_period: 1m0s
diff --git a/services/mux.radiodemo.oma-radio.fr/liquidsoap.liq b/services/mux.radiodemo.oma-radio.fr/liquidsoap.liq
index abdd4bf..fb68acd 100644
--- a/services/mux.radiodemo.oma-radio.fr/liquidsoap.liq
+++ b/services/mux.radiodemo.oma-radio.fr/liquidsoap.liq
@@ -49,13 +49,13 @@ end
# Mux
-input1 = mksafe(input.harbor("direct.ogg",port=8000,password="JsCabjWJUZXrrrKCaaRZma5wD4YKj5LQLXv6f"))
+input1 = mksafe(input.harbor("direct.ogg",port=8000,password=getenv("LIQUIDSOAP_SOURCE_PASSWORD")))
# Direct mp3
output.icecast(
%mp3(bitrate=128, samplerate=22050, stereo=false),
mount="/direct.mp3",
- host="icecast", port=8000, password="JsCabjWJUZXrrrKCaaRZma5wD4YKj5LQLXv6f",
+ host="icecast", port=8000, password=getenv("ICECAST_SOURCE_PASSWORD"),
input1)
# Radioking
@@ -69,7 +69,7 @@ output.icecast(
output.icecast(
%vorbis(samplerate=44100, channels=1, quality=0.2),
mount="/direct.ogg",
- host="icecast", port=8000, password="JsCabjWJUZXrrrKCaaRZma5wD4YKj5LQLXv6f",
+ host="icecast", port=8000, password=getenv("ICECAST_SOURCE_PASSWORD"),
input1)
# Pige
diff --git a/services/mux.radiodemo.oma-radio.fr/nginx_server.conf b/services/mux.radiodemo.oma-radio.fr/nginx_server.conf
index b4b3a42..a882ae3 100644
--- a/services/mux.radiodemo.oma-radio.fr/nginx_server.conf
+++ b/services/mux.radiodemo.oma-radio.fr/nginx_server.conf
@@ -4,7 +4,7 @@ map $http_upgrade $connection_upgrade {
}
server{
- listen $WEBSOCKET_PORT ssl;
+ listen $SWEBSOCKET_PORT ssl;
ssl_certificate $JC_CERT/fullchain.pem;
ssl_certificate_key $JC_CERT/privkey.pem;
@@ -28,11 +28,10 @@ server {
location / {
client_max_body_size 0;
- proxy_pass http://$ENDPOINT;
+ proxy_pass http://$ENDPOINT/;
proxy_set_header Host 'soundbase.radiodemo.oma-radio.fr';
- proxy_set_header X-Forwarded-Host $JC_SERVICE;
- proxy_set_header X-Forwarded-Proto https;
- proxy_set_header X-Forwarded-For $remote_addr;
+ proxy_redirect http://soundbase.radiodemo.oma-radio.fr https://$JC_SERVICE;
+
}
@@ -45,7 +44,9 @@ server {
proxy_pass http://$NET$ICECAST:8000/direct.mp3;
}
- # TODO open some stat route
-
-
+ location /logs/ {
+ include /etc/nginx/fastcgi_params;
+ fastcgi_param SCRIPT_FILENAME $DOCKER_DIR/server.sh;
+ fastcgi_pass unix:/var/run/fcgiwrap.socket;
+ }
}
diff --git a/services/nc-backup.jean-cloud.net/docker-compose.yml b/services/nc-backup.jean-cloud.net/docker-compose.yml
index 2c31dbe..cd372e2 100755
--- a/services/nc-backup.jean-cloud.net/docker-compose.yml
+++ b/services/nc-backup.jean-cloud.net/docker-compose.yml
@@ -7,7 +7,7 @@ services:
restart: unless-stopped
networks:
default:
- ipv4_address: 172.29.16.100
+ ipv4_address: $NET.100
deploy:
resources:
limits:
@@ -19,4 +19,4 @@ networks:
default:
ipam:
config:
- - subnet: 172.29.16.0/24
+ - subnet: $NET.0/24
diff --git a/services/ns1.jean-cloud.org/helper_functions.sh b/services/ns1.jean-cloud.org/helper_functions.sh
index 0b95b6a..7d1c03c 100644
--- a/services/ns1.jean-cloud.org/helper_functions.sh
+++ b/services/ns1.jean-cloud.org/helper_functions.sh
@@ -21,7 +21,7 @@ prepare () {
fi
# Sync the git repo
- run sudo -u bind git_update.sh -N -b main -i "$DATA_DIR/gitkey" -d "$debian_bind_confdir" 'ssh://git@git.jean-cloud.net:22529/adrian/dnszones.git'
+ run sudo -u bind git_update.sh -N -b main -i "$SECRET_DIR/gitkey" -d "$debian_bind_confdir" 'ssh://git@git.jean-cloud.net:22529/adrian/dnszones.git'
cd /etc/bind
@@ -37,6 +37,7 @@ prepare () {
restart () {
echo 'Restart named'
+ rm /etc/bind/*.jnl || true
systemctl restart named
}
@@ -126,8 +127,8 @@ create_primary_files () {
serial="$(date '+%s')"
sed -i "s/\(@ SOA [^(]*( \)[0-9]\+/\1$serial/" "$new_db_file"
- # If no NS record in the db file
- if [ -z "$(grep '[^;].*(IN)?.*NS' "$new_db_file")" ] ; then
+ # Add this dns server if not present
+ if [ -z "$(grep '[^;].*(IN)?.*NS.*$default_dns_name' "$new_db_file")" ] ; then
echo "@ NS $default_dns_name" >> "$new_db_file"
fi
@@ -168,8 +169,8 @@ create_primary_files () {
done
echo 'Find every used domain and add them to bind db'
- while read line ; do
- read -r service target < <(echo "$line")
+ while IFS=';' read -r id username service target
+ do
addbindline "$service" "$target"
nginxfile="/docker/$service/nginx_server.conf"
if [ -f "$nginxfile" ] ; then
@@ -177,7 +178,7 @@ create_primary_files () {
addbindline "$name" "$target"
done
fi
- done <"$servicefile"
+ done < <(grep -v '^#' /docker/services.csv)
}
create_secondary_files () {
diff --git a/services/nuage.jean-cloud.net/maintenance.sh b/services/nuage.jean-cloud.net/maintenance.sh
new file mode 100644
index 0000000..b496f1e
--- /dev/null
+++ b/services/nuage.jean-cloud.net/maintenance.sh
@@ -0,0 +1 @@
+docker-compose exec -u www-data nextcloud php occ maintenance:mode --on
diff --git a/services/nuage.jean-cloud.net/nginx_server.conf b/services/nuage.jean-cloud.net/nginx_server.conf
new file mode 100755
index 0000000..8938387
--- /dev/null
+++ b/services/nuage.jean-cloud.net/nginx_server.conf
@@ -0,0 +1,219 @@
+# inspired from
+# https://docs.nextcloud.com/server/latest/admin_manual/installation/nginx.html?highlight=nginx
+# 2021 05 25
+
+server {
+
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+ ssl_certificate $JC_CERT/fullchain.pem;
+ ssl_certificate_key $JC_CERT/privkey.pem;
+ server_name $JC_SERVICE www.$JC_SERVICE;
+
+ root $DATA_DIR/app;
+
+ limit_req zone=defaultlimit burst=500 nodelay;
+
+ location = /robots.txt {
+ allow all;
+ log_not_found off;
+ access_log off;
+ }
+
+
+ location = /.well-known/carddav {
+ return 301 $scheme://$host/remote.php/dav;
+ }
+ location = /.well-known/caldav {
+ return 301 $scheme://$host/remote.php/dav;
+ }
+
+
+ # set max upload size
+ client_max_body_size 10G;
+ fastcgi_buffers 64 4K;
+
+ # Enable gzip but do not remove ETag headers
+ gzip on;
+ gzip_vary on;
+ gzip_comp_level 4;
+ gzip_min_length 256;
+ gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
+ gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
+
+ # Uncomment if your server is build with the ngx_pagespeed module
+ # This module is currently not supported.
+ #pagespeed off;
+
+
+ # Add headers to serve security related headers
+ # Before enabling Strict-Transport-Security headers please read into this
+ # topic first.
+ # add_header Strict-Transport-Security "max-age=15768000;
+ # includeSubDomains; preload;";
+ #
+ # WARNING: Only add the preload option once you read about
+ # the consequences in https://hstspreload.org/. This option
+ # will add the domain to a hardcoded list that is shipped
+ # in all major browsers and getting removed from this list
+ # could take several months.
+ add_header X-Content-Type-Options nosniff;
+ add_header X-XSS-Protection "1; mode=block";
+ add_header X-Robots-Tag none;
+ add_header X-Download-Options noopen;
+ add_header X-Permitted-Cross-Domain-Policies none;
+ add_header Referrer-Policy no-referrer;
+ add_header Strict-Transport-Security "max-age=15552000; includeSubDomains";
+ add_header X-Frame-Options "SAMEORIGIN";
+
+ # Remove X-Powered-By, which is an information leak
+ fastcgi_hide_header X-Powered-By;
+
+
+ # Specify how to handle directories -- specifying `/index.php$request_uri`
+ # here as the fallback means that Nginx always exhibits the desired behaviour
+ # when a client requests a path that corresponds to a directory that exists
+ # on the server. In particular, if that directory contains an index.php file,
+ # that file is correctly served; if it doesn't, then the request is passed to
+ # the front-end controller. This consistent behaviour means that we don't need
+ # to specify custom rules for certain paths (e.g. images and other assets,
+ # `/updater`, `/ocm-provider`, `/ocs-provider`), and thus
+ # `try_files $uri $uri/ /index.php$request_uri`
+ # always provides the desired behaviour.
+ index index.php index.html /index.php$request_uri;
+
+ # Rule borrowed from `.htaccess` to handle Microsoft DAV clients
+ location = / {
+ if ( $http_user_agent ~ ^DavClnt ) {
+ return 302 /remote.php/webdav/$is_args$args;
+ }
+ }
+
+ location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
+ return 404;
+ }
+ location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
+ return 404;
+ }
+
+ location ~ \.php(?:$|/) {
+ fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+ set $path_info $fastcgi_path_info;
+
+ try_files $fastcgi_script_name =404;
+
+ include fastcgi_params;
+ fastcgi_param SCRIPT_FILENAME /var/www/html/$fastcgi_script_name;
+ fastcgi_param PATH_INFO $fastcgi_path_info;
+
+ # TODO is it needed? Is it buggy?
+ fastcgi_param HTTPS on;
+ fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice
+ fastcgi_param front_controller_active true;
+ fastcgi_pass $NET.100:9000;
+
+ fastcgi_intercept_errors on;
+ fastcgi_request_buffering off;
+ }
+
+
+ # Make sure it is BELOW the PHP block
+ location ~ \.(?:css|js|svg|gif)$ {
+ try_files $uri /index.php$request_uri;
+ expires 6M; # Cache-Control policy borrowed from `.htaccess`
+ access_log off; # Optional: Don't log access to assets
+ }
+
+ location ~ \.woff2?$ {
+ try_files $uri /index.php$request_uri;
+ expires 7d; # Cache-Control policy borrowed from `.htaccess`
+ access_log off; # Optional: Don't log access to assets
+ }
+
+ # Rule borrowed from `.htaccess`
+ location /remote {
+ return 301 /remote.php$request_uri;
+ }
+
+ location / {
+ try_files $uri $uri/ /index.php$request_uri;
+ }
+}
+
+
+map $http_upgrade $connection_upgrade {
+ default upgrade;
+ '' close;
+}
+
+
+proxy_cache_path /var/www/cache levels=1:2 keys_zone=my-cache:8m max_size=1000m inactive=600m;
+proxy_temp_path /var/www/cache/tmp;
+
+server {
+ listen 443 ssl;
+ large_client_header_buffers 32 64k;
+ root /usr/share/nginx/www;
+ index index.html index.htm;
+ ssl_certificate $JC_CERT/fullchain.pem;
+ ssl_certificate_key $JC_CERT/privkey.pem;
+ server_name calc.nuage.jean-cloud.net;
+
+ location ~* (\.(css|png|gif|svg|ico|txt)|static/.*\.js(on)?|manifest\.(appcache|webapp|json)|browserconfig\.xml)$ {
+ root /data/proxy/nuage.jean-cloud.net/ethercalc/;
+ expires 24h;
+ add_header Cache-Control public;
+ }
+
+ location ~* "(?:[.]|/_/[^/]+/)(?:html|csv|csv\.json)$" {
+ proxy_pass http://$NET.102:8000;
+ proxy_cache_use_stale error timeout http_500 http_502 http_503 http_504;
+ proxy_http_version 1.1;
+ proxy_set_header Upgrade $http_upgrade;
+ proxy_read_timeout 31536000;
+ proxy_buffers 32 64k;
+ proxy_buffer_size 128k;
+ add_header Strict-Transport-Security max-age=31536000;
+ include /data/proxy/nuage.jean-cloud.net/nginx_cors.conf;
+ }
+ location / {
+ gzip on;
+ gzip_min_length 1000;
+ gzip_proxied any;
+ proxy_pass http://$NET.102:8000;
+ proxy_http_version 1.1;
+ proxy_set_header Upgrade $http_upgrade;
+ proxy_read_timeout 31536000;
+ proxy_set_header Connection $connection_upgrade;
+ # prevents 502 bad gateway error
+ proxy_buffers 32 64k;
+ proxy_buffer_size 128k;
+ add_header Strict-Transport-Security max-age=31536000;
+ include /data/proxy/nuage.jean-cloud.net/nginx_cors.conf;
+ }
+}
+
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+ ssl_certificate $JC_CERT/fullchain.pem;
+ ssl_certificate_key $JC_CERT/privkey.pem;
+ server_name pad.nuage.jean-cloud.net;
+
+ location / {
+ proxy_pass http://$NET.104:9001;
+ proxy_buffering off; # be careful, this line doesn't override any proxy_buffering on set in a conf.d/file.conf
+ proxy_set_header Host $host;
+ proxy_pass_header Server;
+
+ # Note you might want to pass these headers etc too.
+ #proxy_set_header X-Real-IP $remote_addr; # https://nginx.org/en/docs/http/ngx_http_proxy_module.html
+ #proxy_set_header X-Forwarded-For $remote_addr; # EP logs to show the actual remote IP
+ proxy_set_header X-Forwarded-Proto $scheme; # for EP to set secure cookie flag when https is used
+ proxy_http_version 1.1; # recommended with keepalive connections
+
+ # WebSocket proxying - from https://nginx.org/en/docs/http/websocket.html
+ proxy_set_header Upgrade $http_upgrade;
+ proxy_set_header Connection $connection_upgrade;
+ }
+}
diff --git a/services/nuage.jean-cloud.net/readme.md b/services/nuage.jean-cloud.net/readme.md
new file mode 100755
index 0000000..15c78bd
--- /dev/null
+++ b/services/nuage.jean-cloud.net/readme.md
@@ -0,0 +1,15 @@
+
+dockerfile
+c’est con de faire tourner un apache pour rien, on va configurer nginx pour qu’il travaille avec le conteneur fpm.
+Les images de nextcloud sont toutes cassées… Il faut faire gaffe en les manipulant. (ça a l’air mieux avec la v16)
+
+Utiliser l’app theming pour customiser un peu tout ça…
+
+
+## Procédure de mise à jour
+- Sauvegarde des data + db
+- Maintenance mode on
+- save data & db (quicker)
+- upgrade
+- test
+- Maintenance mode off or fix or rollback
diff --git a/services/oma-radio.fr/docker-compose.yml b/services/oma-radio.fr/docker-compose.yml
deleted file mode 100755
index 6bdf591..0000000
--- a/services/oma-radio.fr/docker-compose.yml
+++ /dev/null
@@ -1 +0,0 @@
-version: '3'
diff --git a/services/oma-radio.fr/nginx_server.conf b/services/oma-radio.fr/nginx_server.conf
index 5a7753b..371a482 100755
--- a/services/oma-radio.fr/nginx_server.conf
+++ b/services/oma-radio.fr/nginx_server.conf
@@ -3,8 +3,8 @@ server {
listen [::]:443 ssl http2;
ssl_certificate $JC_CERT/fullchain.pem;
ssl_certificate_key $JC_CERT/privkey.pem;
- server_name oma-radio.fr www.oma-radio.fr;
- root /data/oma-radio.fr;
+ server_name $JC_SERVICE www.$JC_SERVICE;
+ root $DATA_DIR;
location / {
index index.html;
diff --git a/services/pa1.studios.oma-radio.fr/wg-pa1.sh b/services/pa1.studios.oma-radio.fr/wg-pa1.sh
index 52b3f61..b3a9190 100755
--- a/services/pa1.studios.oma-radio.fr/wg-pa1.sh
+++ b/services/pa1.studios.oma-radio.fr/wg-pa1.sh
@@ -16,6 +16,10 @@ Address = 10.100.1.254/32
PublicKey = 14yKNmSfD2lrWU+d/RJBPNvh9pZ/nW4bK27F9nTgvk0=
AllowedIPs = 10.100.1.253/32
+[Peer] # Nico
+PublicKey = jsXBs8tZn1sWT73xx3DWEdGAWv6SjfQ2TAxX+8pL6mU=
+AllowedIPs = 10.100.1.252/32
+
[Peer] # Passerelle
PublicKey = unY6v95qus8ttJvmSlxqa+J8lKj+CCiRItZ3pFwyjyM=
AllowedIPs = 10.100.1.0/24,192.168.100.0/24
diff --git a/services/pelican/deploy.sh b/services/pelican/deploy.sh
new file mode 100644
index 0000000..c1394bb
--- /dev/null
+++ b/services/pelican/deploy.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+set -euo pipefail
+apt install -y virtualenv
diff --git a/services/pelican/deploy_user.sh b/services/pelican/deploy_user.sh
new file mode 100755
index 0000000..6466e45
--- /dev/null
+++ b/services/pelican/deploy_user.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+set -euo pipefail
+
+# Update git repo
+git_update.sh -d "$HTTP_DIR" "$GIT_SOURCE_REPO"
+
+cd "$HTTP_DIR"
+
+rclone_ncloud_publiclink.sh
+
+# Create and source venv
+if [ ! -e venv ] ; then
+ virtualenv venv
+fi
+. venv/bin/activate
+
+# Install dependencies
+pip3 install -r requirements.txt
+
+# Build website
+make html
+
+# Old way of doing python stuff
+#podman run -v "$HTTP_DIR:/usr/local/app" docker.io/jeancloud/pelican
diff --git a/services/pelican/nginx_server.conf b/services/pelican/nginx_server.conf
new file mode 100755
index 0000000..63034eb
--- /dev/null
+++ b/services/pelican/nginx_server.conf
@@ -0,0 +1,24 @@
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+ ssl_certificate $JC_CERT/fullchain.pem;
+ ssl_certificate_key $JC_CERT/privkey.pem;
+ server_name $JC_SERVICE www.$JC_SERVICE;
+ root $HTTP_DIR/output;
+
+ # Security headers
+ # We can create a file with the base security headers and include it.
+ # Will it be possible to overload them then ?
+ add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+ add_header Content-Security-Policy "default-src 'none';frame-ancestors 'none'; script-src 'self'; img-src 'self'; font-src 'self'; object-src 'none'; style-src 'self'; base-uri 'self'; form-action 'self';" always;
+ add_header X-Content-Type-Options "nosniff";
+ add_header X-Frame-Options SAMEORIGIN always;
+ add_header X-XSS-Protection "1; mode=block" always;
+ add_header Referrer-Policy "strict-origin-when-cross-origin";
+ add_header Permissions-Policy "geolocation='none';midi='none';notifications='none';push='none';sync-xhr='https://mailer.jean-cloud.net';microphone='none';camera='none';magnetometer='none';gyroscope='none';speaker='self';vibrate='none';fullscreen='self';payment='none';";
+
+ location / {
+ index index.html;
+ try_files $uri $uri/ =404;
+ }
+}
diff --git a/services/quadrille-elsa.jean-cloud.net/LINKS. DO NOT EDIT b/services/quadrille-elsa.jean-cloud.net/LINKS. DO NOT EDIT
new file mode 100644
index 0000000..e69de29
diff --git a/services/quadrille-elsa.jean-cloud.net/deploy.sh b/services/quadrille-elsa.jean-cloud.net/deploy.sh
new file mode 120000
index 0000000..e8adfae
--- /dev/null
+++ b/services/quadrille-elsa.jean-cloud.net/deploy.sh
@@ -0,0 +1 @@
+../hugo/deploy.sh
\ No newline at end of file
diff --git a/services/quadrille-elsa.jean-cloud.net/deploy_http.sh b/services/quadrille-elsa.jean-cloud.net/deploy_http.sh
deleted file mode 100755
index d1297b6..0000000
--- a/services/quadrille-elsa.jean-cloud.net/deploy_http.sh
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-#. "$DATA_DIR/.env"
-#webdav_url="$(echo "$NC_SHARE_LINK" | sed 's#/s/.*#/public.php/webdav/#')"
-#webdav_user="$(echo "$NC_SHARE_LINK" |sed 's#.*/s/##')"
-#webdav_pass="$(rclone obscure "$NC_SHARE_PASSWORD")"
-
-#wget -qO- "https://github.com/zhaohuabing/hugo-theme-cleanwhite/archive/refs/tags/2.0.0.tar.gz" | tar xvz -C "$HTTP_DIR"
-
-git_update.sh -b main -d "$HTTP_DIR" "$GIT_SOURCE_REPO"
-
-#rclone sync --webdav-url="$webdav_url" --webdav-user="$webdav_user" --webdav-pass="$webdav_pass" --webdav-vendor=nextcloud :webdav: "$HTTP_DIR/$CLOUD_LOCAL_PATH"
-
-cd "$HTTP_DIR"
-hugo
diff --git a/services/quadrille-elsa.jean-cloud.net/deploy_user.sh b/services/quadrille-elsa.jean-cloud.net/deploy_user.sh
new file mode 120000
index 0000000..e723ae7
--- /dev/null
+++ b/services/quadrille-elsa.jean-cloud.net/deploy_user.sh
@@ -0,0 +1 @@
+../hugo/deploy_user.sh
\ No newline at end of file
diff --git a/services/quadrille-elsa.jean-cloud.net/nginx_server.conf b/services/quadrille-elsa.jean-cloud.net/nginx_server.conf
deleted file mode 100755
index 8167448..0000000
--- a/services/quadrille-elsa.jean-cloud.net/nginx_server.conf
+++ /dev/null
@@ -1,22 +0,0 @@
-server {
- listen 443 ssl http2;
- listen [::]:443 ssl http2;
- ssl_certificate $JC_CERT/fullchain.pem;
- ssl_certificate_key $JC_CERT/privkey.pem;
- server_name $JC_SERVICE;
- root $HTTP_DIR/public/;
-
- # Security headers
-# add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-# add_header Content-Security-Policy "default-src 'none';frame-ancestors 'none'; script-src 'self'; img-src 'self'; font-src 'self'; object-src 'none'; style-src 'self'; base-uri 'self'; form-action 'self';" always;
-# add_header X-Content-Type-Options "nosniff";
-# add_header X-Frame-Options SAMEORIGIN always;
-# add_header X-XSS-Protection "1; mode=block" always;
-# add_header Referrer-Policy "strict-origin-when-cross-origin";
- add_header Permissions-Policy "geolocation='none';midi='none';notifications='none';push='none';microphone='none';camera='none';magnetometer='none';gyroscope='none';speaker='self';vibrate='none';fullscreen='self';payment='none';";
-
- location / {
- index index.html;
- try_files $uri $uri/ =404;
- }
-}
diff --git a/services/quadrille-elsa.jean-cloud.net/nginx_server.conf b/services/quadrille-elsa.jean-cloud.net/nginx_server.conf
new file mode 120000
index 0000000..8b62669
--- /dev/null
+++ b/services/quadrille-elsa.jean-cloud.net/nginx_server.conf
@@ -0,0 +1 @@
+../hugo/nginx_server.conf
\ No newline at end of file
diff --git a/services/radiodemo.oma-radio.fr/deploy_http.sh b/services/radiodemo.oma-radio.fr/deploy_http.sh
deleted file mode 100755
index 0cb10cc..0000000
--- a/services/radiodemo.oma-radio.fr/deploy_http.sh
+++ /dev/null
@@ -1,5 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-git_update.sh -b main -d "$HTTP_DIR" -K "$DOCKER_DIR/.known_hosts" -i "$DATA_DIR/website" "$GIT_SOURCE_REPO"
-hugo_rclone.sh "$HTTP_DIR"
diff --git a/services/radiodemo.oma-radio.fr/deploy_user.sh b/services/radiodemo.oma-radio.fr/deploy_user.sh
new file mode 120000
index 0000000..e723ae7
--- /dev/null
+++ b/services/radiodemo.oma-radio.fr/deploy_user.sh
@@ -0,0 +1 @@
+../hugo/deploy_user.sh
\ No newline at end of file
diff --git a/services/radiodemo.oma-radio.fr/nginx_server.conf b/services/radiodemo.oma-radio.fr/nginx_server.conf
index 4af5081..032bdd5 100755
--- a/services/radiodemo.oma-radio.fr/nginx_server.conf
+++ b/services/radiodemo.oma-radio.fr/nginx_server.conf
@@ -19,4 +19,8 @@ server {
index index.html;
try_files $uri $uri/ =404;
}
+
+ location /manager {
+ return 301 $scheme://mux.$JC_SERVICE/manager;
+ }
}
diff --git a/services/redirection/nginx_server.conf b/services/redirection/nginx_server.conf
new file mode 100755
index 0000000..67e9a54
--- /dev/null
+++ b/services/redirection/nginx_server.conf
@@ -0,0 +1,20 @@
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+ ssl_certificate $JC_CERT/fullchain.pem;
+ ssl_certificate_key $JC_CERT/privkey.pem;
+ server_name $JC_SERVICE www.$JC_SERVICE;
+
+ # Security headers
+ add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+ add_header Content-Security-Policy "default-src 'none';frame-ancestors 'none'; script-src 'self'; img-src 'self'; font-src 'self'; object-src 'none'; style-src 'self'; base-uri 'self'; form-action 'self';" always;
+ add_header X-Content-Type-Options "nosniff";
+ add_header X-Frame-Options SAMEORIGIN always;
+ add_header X-XSS-Protection "1; mode=block" always;
+ add_header Referrer-Policy "strict-origin-when-cross-origin";
+ add_header Permissions-Policy "geolocation='none';midi='none';notifications='none';push='none';sync-xhr='https://mailer.jean-cloud.net';microphone='none';camera='none';magnetometer='none';gyroscope='none';speaker='self';vibrate='none';fullscreen='self';payment='none';";
+
+ location / {
+ return 301 $scheme://$DESTINATION$request_uri;
+ }
+}
diff --git a/services/rimarima.fr/.env b/services/rimarima.fr/.env
index ea9d2d0..9aadbff 100644
--- a/services/rimarima.fr/.env
+++ b/services/rimarima.fr/.env
@@ -1,2 +1 @@
GIT_SOURCE_REPO="https://git.jean-cloud.net/adrian/rimarima"
-CLOUD_LOCAL_PATH=content
diff --git a/services/rimarima.fr/LINKS. DO NOT EDIT b/services/rimarima.fr/LINKS. DO NOT EDIT
new file mode 100644
index 0000000..e69de29
diff --git a/services/rimarima.fr/deploy.sh b/services/rimarima.fr/deploy.sh
new file mode 120000
index 0000000..e8adfae
--- /dev/null
+++ b/services/rimarima.fr/deploy.sh
@@ -0,0 +1 @@
+../hugo/deploy.sh
\ No newline at end of file
diff --git a/services/rimarima.fr/deploy_http.sh b/services/rimarima.fr/deploy_http.sh
deleted file mode 100755
index 97b0ccf..0000000
--- a/services/rimarima.fr/deploy_http.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-set -a
-. "$SECRET_DIR/.env"
-set +a
-
-git_update.sh -d "$HTTP_DIR" -b main "$GIT_SOURCE_REPO"
-hugo_rclone.sh "$HTTP_DIR"
diff --git a/services/rimarima.fr/deploy_user.sh b/services/rimarima.fr/deploy_user.sh
new file mode 120000
index 0000000..e723ae7
--- /dev/null
+++ b/services/rimarima.fr/deploy_user.sh
@@ -0,0 +1 @@
+../hugo/deploy_user.sh
\ No newline at end of file
diff --git a/services/rimarima.fr/nginx_server.conf b/services/rimarima.fr/nginx_server.conf
deleted file mode 100755
index dba721b..0000000
--- a/services/rimarima.fr/nginx_server.conf
+++ /dev/null
@@ -1,22 +0,0 @@
-server {
- listen 443 ssl http2;
- listen [::]:443 ssl http2;
- ssl_certificate $JC_CERT/fullchain.pem;
- ssl_certificate_key $JC_CERT/privkey.pem;
- server_name $JC_SERVICE www.$JC_SERVICE;
- root $HTTP_DIR/public/;
-
- # Security headers
- add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
- add_header Content-Security-Policy "default-src 'none';frame-ancestors 'none'; script-src 'self'; img-src 'self'; font-src 'self'; object-src 'none'; style-src 'self'; base-uri 'self'; form-action 'self';" always;
- add_header X-Content-Type-Options "nosniff";
- add_header X-Frame-Options SAMEORIGIN always;
- add_header X-XSS-Protection "1; mode=block" always;
- add_header Referrer-Policy "strict-origin-when-cross-origin";
- add_header Permissions-Policy "geolocation='none';midi='none';notifications='none';push='none';microphone='none';camera='none';magnetometer='none';gyroscope='none';speaker='self';vibrate='none';fullscreen='self';payment='none';";
-
- location / {
- index index.html;
- try_files $uri $uri/ =404;
- }
-}
diff --git a/services/rimarima.fr/nginx_server.conf b/services/rimarima.fr/nginx_server.conf
new file mode 120000
index 0000000..8b62669
--- /dev/null
+++ b/services/rimarima.fr/nginx_server.conf
@@ -0,0 +1 @@
+../hugo/nginx_server.conf
\ No newline at end of file
diff --git a/services/rpnow.jean-cloud.net/docker-compose.yml b/services/rpnow.jean-cloud.net/docker-compose.yml
index ae04434..a88c3e1 100755
--- a/services/rpnow.jean-cloud.net/docker-compose.yml
+++ b/services/rpnow.jean-cloud.net/docker-compose.yml
@@ -3,9 +3,32 @@ services:
rpnow:
image: jeancloud/rpnow:1.0
volumes:
- - /data/rpnow.jean-cloud.org/:/var/local/rpnow
+ - $DATA_DIR:/var/local/rpnow
+ networks:
+ default:
+ ipv4_address: $NET.100
+ deploy:
+ resources:
+ limits:
+ cpus: '0.50'
+ memory: 100M
test_rpnow:
image: jeancloud/rpnow:dev
volumes:
- /data/test.rpnow.jean-cloud.org/:/var/local/rpnow
+ networks:
+ default:
+ ipv4_address: $NET.101
+ deploy:
+ resources:
+ limits:
+ cpus: '0.50'
+ memory: 100M
+
+networks:
+ default:
+ ipam:
+ config:
+ - subnet: $NET.0/24
+
diff --git a/services/rpnow.jean-cloud.net/nginx_server.conf b/services/rpnow.jean-cloud.net/nginx_server.conf
index 24c2399..7488527 100755
--- a/services/rpnow.jean-cloud.net/nginx_server.conf
+++ b/services/rpnow.jean-cloud.net/nginx_server.conf
@@ -3,7 +3,7 @@ server {
listen [::]:443 ssl http2;
ssl_certificate $JC_CERT/fullchain.pem;
ssl_certificate_key $JC_CERT/privkey.pem;
- server_name rpnow.jean-cloud.net www.rpnow.jean-cloud.net;
+ server_name $JC_SERVICE www.$JC_SERVICE;
location / {
client_max_body_size 2G;
@@ -14,7 +14,7 @@ server {
proxy_set_header Connection "upgrade";
proxy_read_timeout 86400;
proxy_redirect off;
- proxy_pass http://rpnow.rpnowjean-cloudnet.docker;
+ proxy_pass http://$NET.100;
}
}
@@ -34,7 +34,7 @@ server {
proxy_set_header Connection "upgrade";
proxy_read_timeout 86400;
proxy_redirect off;
- proxy_pass http://test_rpnow.rpnowjean-cloudnet.docker;
+ proxy_pass http://$NET.101;
}
}
diff --git a/services/services.csv b/services/services.csv
new file mode 100644
index 0000000..3d3384e
--- /dev/null
+++ b/services/services.csv
@@ -0,0 +1,45 @@
+# This is not real CSV. Do not put separator in a field, even escaped
+# UID ; username ; service name ; server name
+1;sftp.jean-cloud.net;sftp.jean-cloud.net;raku.jean-cloud.org
+2;benevoles31.karnaval.fr;benevoles31.karnaval.fr;max.jean-cloud.org
+3;builder.rimarima.fr;builder.rimarima.fr;raku.jean-cloud.org
+4;chahut.jean-cloud.net;chahut.jean-cloud.net;max.jean-cloud.org
+5;chiloe.eu;chiloe.eu;shlago.jean-cloud.org
+6;coldcms.chahut.jean-cloud.net;coldcms.chahut.jean-cloud.net;raku.jean-cloud.org
+7;collectif-arthadie.fr;collectif-arthadie.fr;vandamme.jean-cloud.org
+8;compagnienouvelle.fr;compagnienouvelle.fr;nougaro.jean-cloud.org
+9;copaines.jean-cloud.net;copaines.jean-cloud.net;max.jean-cloud.org
+11;deployer.jean-cloud.org;deployer.jean-cloud.org;shlago.jean-cloud.org
+12;dnscerts.jean-cloud.org;dnscerts.jean-cloud.org;max.jean-cloud.org
+13;etrevivant.net;etrevivant.net;shlago.jean-cloud.org
+14;feministesucl34.communistesliber;feministesucl34.communisteslibertaires.org;none
+15;feteducourt.jean-cloud.net;feteducourt.jean-cloud.net;shlago.jean-cloud.org
+16;feteducourt2020.jean-cloud.net;feteducourt2020.jean-cloud.net;shlago.jean-cloud.org
+17;git.jean-cloud.net;git.jean-cloud.net;vandamme.jean-cloud.org
+18;grapes.chahut.jean-cloud.net;grapes.chahut.jean-cloud.net;max.jean-cloud.org
+20;inurbe.fr;inurbe.fr;shlago.jean-cloud.org
+21;jean-cloud.net;jean-cloud.net;shlago.jean-cloud.org
+22;leida.fr;leida.fr;vandamme.jean-cloud.org
+23;lexicographe.jean-cloud.net;lexicographe.jean-cloud.net;shlago.jean-cloud.org
+24;metamorphosemagazine.fr;metamorphosemagazine.fr;shlago.jean-cloud.org
+25;mux.radiodemo.oma-radio.fr;mux.radiodemo.oma-radio.fr;raku.jean-cloud.org
+26;nc-backup.jean-cloud.net;nc-backup.jean-cloud.net;raku.jean-cloud.org
+27;ns.jean-cloud.org;ns.jean-cloud.org;shlago.jean-cloud.org
+28;ns1.jean-cloud.org;ns1.jean-cloud.org;tetede.jean-cloud.org
+29;nuage.jean-cloud.net;nuage.jean-cloud.net;vandamme.jean-cloud.org
+30;oma-radio.fr;oma-radio.fr;vandamme.jean-cloud.org
+31;pa1.studios.oma-radio.fr;pa1.studios.oma-radio.fr;tetede.jean-cloud.org
+32;paj.oma-radio.fr;paj.oma-radio.fr;nougaro.jean-cloud.org
+33;quadrille-elsa.jean-cloud.net;quadrille-elsa.jean-cloud.net;shlago.jean-cloud.org
+34;radiodemo.oma-radio.fr;radiodemo.oma-radio.fr;raku.jean-cloud.org
+35;radionimaitre.oma-radio.fr;radionimaitre.oma-radio.fr;tetede.jean-cloud.org
+36;raplacgr.jean-cloud.net;raplacgr.jean-cloud.net;tetede.jean-cloud.org
+37;rimarima.fr;rimarima.fr;raku.jean-cloud.org
+38;rpnow.jean-cloud.net;rpnow.jean-cloud.net;vandamme.jean-cloud.org
+39;soundbase.radiodemo.oma-radio.fr;soundbase.radiodemo.oma-radio.fr;montbonnot.jean-cloud.org
+40;static.jean-cloud.net;static.jean-cloud.net;vandamme.jean-cloud.org
+41;velov.jean-cloud.net;velov.jean-cloud.net;shlago.jean-cloud.org
+42;wiki-cgr.jean-cloud.net;wiki-cgr.jean-cloud.net;vandamme.jean-cloud.org
+43;radio.karnaval.fr;radio.karnaval.fr;tetede.jean-cloud.org
+44;wordpress.abc.jean-cloud.net;wordpress.abc.jean-cloud.net;max.jean-cloud.org
+45;jean-cloud.org;jean-cloud.org;shlago.jean-cloud.org
diff --git a/services/services.txt b/services/services.txt
deleted file mode 100644
index 9c068f9..0000000
--- a/services/services.txt
+++ /dev/null
@@ -1,42 +0,0 @@
-sftp.jean-cloud.net raku.jean-cloud.org
-benevoles31.karnaval.fr max.jean-cloud.org
-builder.rimarima.fr raku.jean-cloud.org
-chahut.jean-cloud.net max.jean-cloud.org
-chiloe.eu shlago.jean-cloud.org
-coldcms.chahut.jean-cloud.net raku.jean-cloud.org
-collectif-arthadie.fr vandamme.jean-cloud.org
-compagnienouvelle.fr nougaro.jean-cloud.org
-copaines.jean-cloud.net max.jean-cloud.org
-deployer.jean-cloud.org shlago.jean-cloud.org
-dnscerts.jean-cloud.org max.jean-cloud.org
-etrevivant.net shlago.jean-cloud.org
-feministesucl34.communisteslibertaires.org none
-feteducourt.jean-cloud.net shlago.jean-cloud.org
-feteducourt2020.jean-cloud.net shlago.jean-cloud.org
-git.jean-cloud.net vandamme.jean-cloud.org
-grapes.chahut.jean-cloud.net max.jean-cloud.org
-gypsylyonfestival.com max.jean-cloud.org
-inurbe.fr shlago.jean-cloud.org
-jean-cloud.net shlago.jean-cloud.org
-leida.fr vandamme.jean-cloud.org
-lexicographe.jean-cloud.net shlago.jean-cloud.org
-metamorphosemagazine.fr shlago.jean-cloud.org
-mux.radiodemo.oma-radio.fr raku.jean-cloud.org
-nc-backup.jean-cloud.net raku.jean-cloud.org
-ns.jean-cloud.org shlago.jean-cloud.org
-ns1.jean-cloud.org tetede.jean-cloud.org
-nuage.jean-cloud.net vandamme.jean-cloud.org
-oma-radio.fr vandamme.jean-cloud.org
-pa1.studios.oma-radio.fr tetede.jean-cloud.org
-paj.oma-radio.fr nougaro.jean-cloud.org
-quadrille-elsa.jean-cloud.net shlago.jean-cloud.org
-radiodemo.oma-radio.fr raku.jean-cloud.org
-radionimaitre.oma-radio.fr tetede.jean-cloud.org
-raplacgr.jean-cloud.net tetede.jean-cloud.org
-rimarima.fr raku.jean-cloud.org
-rpnow.jean-cloud.net vandamme.jean-cloud.org
-soundbase.radiodemo.oma-radio.fr montbonnot.jean-cloud.org
-static.jean-cloud.net vandamme.jean-cloud.org
-velov.jean-cloud.net shlago.jean-cloud.org
-wiki-cgr.jean-cloud.net vandamme.jean-cloud.org
-radio.karnaval.fr tetede.jean-cloud.org
diff --git a/services/sftp.jean-cloud.net/docker-compose.yml b/services/sftp.jean-cloud.net/docker-compose.yml
index 0c01f9f..c8d4062 100644
--- a/services/sftp.jean-cloud.net/docker-compose.yml
+++ b/services/sftp.jean-cloud.net/docker-compose.yml
@@ -6,13 +6,12 @@ services:
- $DATA_DIR/ssh_host_ed25519_key:/etc/ssh/ssh_host_ed25519_key:ro
- $DATA_DIR/ssh_host_rsa_key:/etc/ssh/ssh_host_rsa_key:ro
- $DATA_DIR/users.conf:/etc/sftp/users.conf:ro
+ - $DOCKER_DIR/init.sh:/etc/sftp.d/init.sh:ro
- - $DATA_DIR/home/feministesucl34:/home/feministesucl34RO:ro
- - $DATA_DIR/home/leida:/home/leida
+ - $DATA_DIR/home:/home
+ - $DATA_DIR/home/feministesucl34:/home/feministesucl34RO
- $DATA_DIR/home/leida:/home/leidaRO
- - $DATA_DIR/home/chiloe:/home/chiloe
- $DATA_DIR/home/chiloe:/home/chiloeRO
- - $DATA_DIR/home/collectifarthadie:/home/collectifarthadieRO:ro
ports:
- '2929:22'
diff --git a/services/sftp.jean-cloud.net/init.sh b/services/sftp.jean-cloud.net/init.sh
new file mode 100755
index 0000000..e668f07
--- /dev/null
+++ b/services/sftp.jean-cloud.net/init.sh
@@ -0,0 +1,2 @@
+#!/bin/bash
+chmod o+x /home
diff --git a/services/soundbase.radiodemo.oma-radio.fr/.env b/services/soundbase.radiodemo.oma-radio.fr/.env
index 920997a..0605b79 100644
--- a/services/soundbase.radiodemo.oma-radio.fr/.env
+++ b/services/soundbase.radiodemo.oma-radio.fr/.env
@@ -7,15 +7,18 @@ TZ=Europe/Paris
OMA_DOCKER_VERSION=dev
WEBSOCKET_PORT=2004
TELECOM_SERVER_PORT=3494
+OMA_CONFIG_TelecommandeHost=mux.radiodemo.oma-radio.fr
+OMA_CONFIG_TelecommandePort=3494
MUX_SERVER_PORT=9004
RADIO_NAME_SIMPLE=radiodemo
OMA_CONFIG_NomRadio=radiodemo
OMA_CONFIG_LogLevel=8
RADIO_NAME_PRETTY="Radio Démo"
COMPOSE_NAME=soundbaseradiodemooma-radiofr
-DOCKER_INSTANCES_PREFIX=radiodemo-backoma-radiofr-
+DOCKER_INSTANCES_PREFIX=soundbaseradiodemooma-radiofr-
DOCKER_INSTANCES_SUFIX=-1
SOUNDBASE_DIR=/data/soundbase.radiodemo.oma-radio.fr/core/radioDemo
USE_SSL=true
MANAGER_WEBSITE_UPSTREAM=https://static.oma-radio.fr/single-manager/1.1.1
+PUBLIC_WEBSITE_UPSTREAM=https://static.oma-radio.fr/player-interface/1.1.1
RADIO_HOST=radiodemo.oma-radio.fr
diff --git a/services/soundbase.radiodemo.oma-radio.fr/docker-compose.yml b/services/soundbase.radiodemo.oma-radio.fr/docker-compose.yml
index 94425ff..8fdf6ae 100644
--- a/services/soundbase.radiodemo.oma-radio.fr/docker-compose.yml
+++ b/services/soundbase.radiodemo.oma-radio.fr/docker-compose.yml
@@ -6,7 +6,7 @@ services:
environment:
OMA_CONFIG_TelecommandeHost: $RADIO_HOST
OMA_CONFIG_TelecommandePort: $TELECOM_SERVER_PORT
- OMA_CONFIG_Client1Host: soundbase.radiodemo.osoundbase.radiodemo.oma-radio.fr
+ OMA_CONFIG_Client1Host: mux.radiodemo.oma-radio.fr
OMA_CONFIG_Client1Port: $MUX_SERVER_PORT
volumes:
- $SOUNDBASE_DIR:/app/soundBase
diff --git a/services/soundbase.radiodemo.oma-radio.fr/nginx_server.conf b/services/soundbase.radiodemo.oma-radio.fr/nginx_server.conf
index 834e508..1a63054 100644
--- a/services/soundbase.radiodemo.oma-radio.fr/nginx_server.conf
+++ b/services/soundbase.radiodemo.oma-radio.fr/nginx_server.conf
@@ -22,46 +22,22 @@ server {
root $SOUNDBASE_DIR/website;
index index.html;
- add_header Access-Control-Allow-Origin https://radio.karnaval.fr;
-
-
- location = /api { rewrite ^ /api/; }
- location ~ /api/pigeindex(/.*) {
+ location ~ /api(/.*) {
+ auth_basic "Entrez votre identifiant et mot de passe";
+ auth_basic_user_file $SOUNDBASE_DIR/users.htpasswd;
include uwsgi_params;
- uwsgi_param PATH_INFO "/pigeindex$1";
+ uwsgi_param PATH_INFO "$1";
uwsgi_param SCRIPT_NAME /api;
uwsgi_pass unix:/tmp/uwsgi/$JC_SERVICE/uwsgi-api.sock;
client_max_body_size 0;
- uwsgi_connect_timeout 6000;
- uwsgi_send_timeout 6000;
- uwsgi_read_timeout 6000;
+ proxy_connect_timeout 6000;
+ proxy_send_timeout 60000;
+ proxy_read_timeout 6000;
send_timeout 6000;
# kill cache
add_header Last-Modified $date_gmt;
add_header Cache-Control 'private no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
-
- if_modified_since off;
- expires off;
- etag off;
-
- }
- location ~ /api(/.*) {
- auth_basic "Entrez votre identifiant et mot de passe";
- auth_basic_user_file $SOUNDBASE_DIR/users.htpasswd;
- include uwsgi_params;
- uwsgi_param PATH_INFO "$1";
- uwsgi_param SCRIPT_NAME /api;
- uwsgi_pass unix:/tmp/uwsgi/$JC_SERVICE/uwsgi-api.sock;
- client_max_body_size 0;
- proxy_connect_timeout 6000;
- proxy_send_timeout 60000;
- proxy_read_timeout 6000;
- send_timeout 6000;
- # kill cache
- add_header Last-Modified $date_gmt;
- add_header Cache-Control 'private no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
- add_header Access-Control-Allow-Origin https://radio.karnaval.fr;
if_modified_since off;
expires off;
etag off;
@@ -71,10 +47,6 @@ server {
alias $SOUNDBASE_DIR/pige;
try_files $uri $uri/ =404;
}
- location /pigeMp3{
- alias $SOUNDBASE_DIR/pigeMp3;
- try_files $uri $uri/ =404;
- }
location /png {
alias $SOUNDBASE_DIR/png;
try_files $uri $uri/ =404;
@@ -92,98 +64,52 @@ server {
try_files $uri $uri/ =404;
}
location /txt {
- # kill cache
- add_header Last-Modified $date_gmt;
- add_header Cache-Control 'private no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
- add_header Access-Control-Allow-Origin https://radio.karnaval.fr;
- if_modified_since off;
- expires off;
- etag off;
alias $SOUNDBASE_DIR/txt;
try_files $uri $uri/ =404;
}
location /wavM {
- # kill cache
- add_header Last-Modified $date_gmt;
- add_header Cache-Control 'private no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
- if_modified_since off;
- expires off;
- etag off;
+ auth_basic "Entrez votre identifiant et mot de passe";
+ auth_basic_user_file $SOUNDBASE_DIR/users.htpasswd;
alias $SOUNDBASE_DIR/wavM;
try_files $uri $uri/ =404;
}
location /import {
- # kill cache
- add_header Last-Modified $date_gmt;
- add_header Cache-Control 'private no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
- if_modified_since off;
- expires off;
- etag off;
+ auth_basic "Entrez votre identifiant et mot de passe";
+ auth_basic_user_file $SOUNDBASE_DIR/users.htpasswd;
alias $SOUNDBASE_DIR/import;
try_files $uri $uri/ =404;
}
location /export {
- # kill cache
- add_header Last-Modified $date_gmt;
- add_header Cache-Control 'private no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
- if_modified_since off;
- expires off;
- etag off;
+ auth_basic "Entrez votre identifiant et mot de passe";
+ auth_basic_user_file $SOUNDBASE_DIR/users.htpasswd;
alias $SOUNDBASE_DIR/export;
try_files $uri $uri/ =404;
}
location /wav {
- # kill cache
- add_header Last-Modified $date_gmt;
- add_header Cache-Control 'private no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
- if_modified_since off;
- expires off;
- etag off;
+ auth_basic "Entrez votre identifiant et mot de passe";
+ auth_basic_user_file $SOUNDBASE_DIR/users.htpasswd;
alias $SOUNDBASE_DIR/wav;
try_files $uri $uri/ =404;
}
- location /fiches {
- alias $SOUNDBASE_DIR/fiches;
+ location /fic {
+ alias $SOUNDBASE_DIR/fic;
try_files $uri $uri/ =404;
- # kill cache
- add_header Last-Modified $date_gmt;
- add_header Cache-Control 'private no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
- add_header Access-Control-Allow-Origin https://radio.karnaval.fr;
- if_modified_since off;
- expires off;
- etag off;
-
}
location /prg {
- # kill cache
- add_header Last-Modified $date_gmt;
- add_header Cache-Control 'private no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
- if_modified_since off;
- expires off;
- etag off;
+ auth_basic "Entrez votre identifiant et mot de passe";
+ auth_basic_user_file $SOUNDBASE_DIR/users.htpasswd;
alias $SOUNDBASE_DIR/prg;
try_files $uri $uri/ =404;
}
- location /listes {
- # kill cache
- add_header Last-Modified $date_gmt;
- add_header Cache-Control 'private no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
- if_modified_since off;
- expires off;
- etag off;
- alias $SOUNDBASE_DIR/listes;
+ location /lst {
+ auth_basic "Entrez votre identifiant et mot de passe";
+ auth_basic_user_file $SOUNDBASE_DIR/users.htpasswd;
+ alias $SOUNDBASE_DIR/lst;
try_files $uri $uri/ =404;
}
location /statique {
alias $SOUNDBASE_DIR/statique;
try_files $uri $uri/ =404;
- # kill cache
- add_header Last-Modified $date_gmt;
- add_header Cache-Control 'private no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
- add_header Access-Control-Allow-Origin https://radio.karnaval.fr;
- if_modified_since off;
- expires off;
- etag off;
}
# Admin interface
diff --git a/services/velov.jean-cloud.net/deploy_http.sh b/services/velov.jean-cloud.net/deploy_user.sh
similarity index 100%
rename from services/velov.jean-cloud.net/deploy_http.sh
rename to services/velov.jean-cloud.net/deploy_user.sh
diff --git a/services/velov.jean-cloud.net/docker-compose.yml b/services/velov.jean-cloud.net/docker-compose.yml
index b86ffc9..77a3f0f 100755
--- a/services/velov.jean-cloud.net/docker-compose.yml
+++ b/services/velov.jean-cloud.net/docker-compose.yml
@@ -7,7 +7,7 @@ services:
restart: unless-stopped
networks:
default:
- ipv4_address: 172.29.13.100
+ ipv4_address: $NET.100
deploy:
resources:
limits:
@@ -18,5 +18,5 @@ networks:
default:
ipam:
config:
- - subnet: 172.29.13.0/24
+ - subnet: $NET.0/24
diff --git a/services/velov.jean-cloud.net/nginx_server.conf b/services/velov.jean-cloud.net/nginx_server.conf
index a2024a1..28d01f8 100755
--- a/services/velov.jean-cloud.net/nginx_server.conf
+++ b/services/velov.jean-cloud.net/nginx_server.conf
@@ -14,7 +14,7 @@ server {
location ~ \.php$ {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
- fastcgi_pass 172.29.13.100:9000;
+ fastcgi_pass $NET.100:9000;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME /usr/src/app/$fastcgi_script_name;
diff --git a/services/wiki-cgr.jean-cloud.net/docker-compose.yml b/services/wiki-cgr.jean-cloud.net/docker-compose.yml
new file mode 100755
index 0000000..bc5839e
--- /dev/null
+++ b/services/wiki-cgr.jean-cloud.net/docker-compose.yml
@@ -0,0 +1,55 @@
+# Check that before updating
+# https://www.mediawiki.net/wiki/Extension:VisualEditor#Setting_up_VisualEditor
+version: '3'
+services:
+ mediawiki:
+ image: mediawiki:1.35
+ restart: unless-stopped
+ volumes:
+ - $DATA_DIR/images:/var/www/html/images
+ - $DATA_DIR/extensions-1.32:/var/www/html/extensions
+ - $DATA_DIR/LocalSettings.php:/var/www/html/LocalSettings.php
+ - $DATA_DIR/mylogo.png:/var/www/html/resources/assets/mylogo.png
+ networks:
+ default:
+ ipv4_address: $NET.100
+ deploy:
+ resources:
+ limits:
+ cpus: '0.50'
+ memory: 100M
+
+ parsoid:
+ image: thenets/parsoid:0.9
+ restart: unless-stopped
+ environment:
+ - PARSOID_DOMAIN_wiki_cgr=http://wiki-cgr.jean-cloud.net/api.php
+ networks:
+ default:
+ ipv4_address: $NET.101
+ deploy:
+ resources:
+ limits:
+ cpus: '0.50'
+ memory: 100M
+
+
+ db:
+ image: mariadb:10.4
+ volumes:
+ - $DATA_DIR/db:/var/lib/mysql
+ networks:
+ default:
+ ipv4_address: $NET.102
+ deploy:
+ resources:
+ limits:
+ cpus: '0.50'
+ memory: 300M
+
+networks:
+ default:
+ ipam:
+ config:
+ - subnet: $NET.0/24
+
diff --git a/services/wiki-cgr.jean-cloud.net/nginx_server.conf b/services/wiki-cgr.jean-cloud.net/nginx_server.conf
new file mode 100755
index 0000000..b690e7c
--- /dev/null
+++ b/services/wiki-cgr.jean-cloud.net/nginx_server.conf
@@ -0,0 +1,32 @@
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+ ssl_certificate $JC_CERT/fullchain.pem;
+ ssl_certificate_key $JC_CERT/privkey.pem;
+ server_name $JC_SERVICE www.$JC_SERVICE;
+ location / {
+ auth_basic "Cette page est protégée par un mot de passe";
+ auth_basic_user_file $DATA_DIR/pass.txt;
+
+ client_max_body_size 2G;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header Host $http_host;
+ proxy_pass http://$NET.100;
+ proxy_redirect off;
+ }
+}
+
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+ ssl_certificate $JC_CERT/fullchain.pem;
+ ssl_certificate_key $JC_CERT/privkey.pem;
+ server_name parsoid-wiki-cgr.jean-cloud.net www.parsoid-wiki-cgr.jean-cloud.net;
+ location / {
+ client_max_body_size 2G;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header Host $http_host;
+ proxy_pass http://$NET.101:8000;
+ proxy_redirect off;
+ }
+}
diff --git a/services/wordpress.abc.jean-cloud.net/LINKS. DO NOT EDIT b/services/wordpress.abc.jean-cloud.net/LINKS. DO NOT EDIT
new file mode 120000
index 0000000..90f441f
--- /dev/null
+++ b/services/wordpress.abc.jean-cloud.net/LINKS. DO NOT EDIT
@@ -0,0 +1 @@
+../wordpress6/LINKS. DO NOT EDIT
\ No newline at end of file
diff --git a/services/wordpress.abc.jean-cloud.net/docker-compose.yml b/services/wordpress.abc.jean-cloud.net/docker-compose.yml
new file mode 120000
index 0000000..92b63e9
--- /dev/null
+++ b/services/wordpress.abc.jean-cloud.net/docker-compose.yml
@@ -0,0 +1 @@
+../wordpress6/docker-compose.yml
\ No newline at end of file
diff --git a/services/wordpress.abc.jean-cloud.net/nginx_server.conf b/services/wordpress.abc.jean-cloud.net/nginx_server.conf
new file mode 120000
index 0000000..482e9d5
--- /dev/null
+++ b/services/wordpress.abc.jean-cloud.net/nginx_server.conf
@@ -0,0 +1 @@
+../wordpress6/nginx_server.conf
\ No newline at end of file
diff --git a/services/wordpress.feministesucl34.jean-cloud.net/docker-compose.yml b/services/wordpress.feministesucl34.jean-cloud.net/docker-compose.yml
deleted file mode 100644
index 908fcb4..0000000
--- a/services/wordpress.feministesucl34.jean-cloud.net/docker-compose.yml
+++ /dev/null
@@ -1,49 +0,0 @@
-version: '3.1'
-
-services:
-
- wp:
- image: wordpress:5.8-apache
- restart: unless-stopped
- env_file: $DATA_DIR/env
- environment:
- WORDPRESS_DB_HOST: db
- WORDPRESS_DB_USER: wpdbuser
- WORDPRESS_DB_NAME: wpdb
- #WORDPRESS_CONFIG_EXTRA: "define( 'WP_HOME', 'https://feministesucl34.jean-cloud.net/wordpress' ); define( 'WP_SITEURL', 'https://feministesucl34.jean-cloud.net/wordpress' );"
- volumes:
- - $DATA_DIR/wordpress:/var/www/html
- - $DATA_DIR/static:/var/www/html/static
- networks:
- default:
- ipv4_address: 172.29.9.100
- deploy:
- resources:
- limits:
- cpus: '0.50'
- memory: 100M
- db:
- image: mariadb:10.4
- restart: unless-stopped
- env_file: $DATA_DIR/env
- environment:
- MYSQL_DATABASE: wpdb
- MYSQL_USER: wpdbuser
- MYSQL_RANDOM_ROOT_PASSWORD: 'yes'
- volumes:
- - $DATA_DIR/db:/var/lib/mysql
- networks:
- default:
- ipv4_address: 172.29.9.101
- deploy:
- resources:
- limits:
- cpus: '0.50'
- memory: 100M
-
-networks:
- default:
- ipam:
- config:
- - subnet: 172.29.9.0/24
-
diff --git a/services/wordpress.feministesucl34.jean-cloud.net/nginx_server.conf b/services/wordpress.feministesucl34.jean-cloud.net/nginx_server.conf
deleted file mode 100755
index 411a805..0000000
--- a/services/wordpress.feministesucl34.jean-cloud.net/nginx_server.conf
+++ /dev/null
@@ -1,32 +0,0 @@
-server {
- listen 443 ssl http2;
- listen [::]:443 ssl http2;
- ssl_certificate $JC_CERTS/fullchain.pem;
- ssl_certificate_key $JC_CERTS/privkey.pem;
- server_name wordpress.feministesucl34.jean-cloud.net www.wordpress.feministesucl34.jean-cloud.net;
- location / {
- client_max_body_size 2G;
- #proxy_set_header X-Real-IP $remote_addr;
- proxy_set_header Host $http_host;
- proxy_set_header X-Forwarded-Proto https;
- proxy_pass http://172.29.9.100;
- proxy_redirect off;
- }
-}
-
-server {
- listen 443 ssl http2;
- listen [::]:443 ssl http2;
- ssl_certificate $JC_CERTS/fullchain.pem;
- ssl_certificate_key $JC_CERTS/privkey.pem;
- server_name feministesucl34.jean-cloud.net www.feministesucl34.jean-cloud.net;
-
- location = /wp-login.php {
- return 301 https://wordpress.feministesucl34.jean-cloud.net/wp-login.php;
- }
-
- location / {
- root /data/feministesucl34.jean-cloud.net/static;
- try_files $uri $uri/ =404;
- }
-}
diff --git a/services/wordpress6/LINKS. DO NOT EDIT b/services/wordpress6/LINKS. DO NOT EDIT
new file mode 100644
index 0000000..e69de29
diff --git a/services/wordpress6/docker-compose.yml b/services/wordpress6/docker-compose.yml
new file mode 100644
index 0000000..67ad2c9
--- /dev/null
+++ b/services/wordpress6/docker-compose.yml
@@ -0,0 +1,43 @@
+version: '3'
+
+services:
+
+ wp:
+ image: wordpress:6-apache
+ restart: unless-stopped
+ env_file: $DATA_DIR/wordpress.env
+ environment:
+ TZ: Europe/Paris
+ volumes:
+ - $DATA_DIR/wordpress:/var/www/html
+ networks:
+ default:
+ ipv4_address: $NET.100
+ deploy:
+ resources:
+ limits:
+ cpus: '0.50'
+ memory: 100M
+ db:
+ image: mariadb:11
+ restart: unless-stopped
+ env_file: $DATA_DIR/wordpress.env
+ environment:
+ TZ: Europe/Paris
+ volumes:
+ - $DATA_DIR/db:/var/lib/mysql
+ networks:
+ default:
+ ipv4_address: $NET.101
+ deploy:
+ resources:
+ limits:
+ cpus: '0.50'
+ memory: 300M #init is very hugry
+
+networks:
+ default:
+ ipam:
+ config:
+ - subnet: $NET.0/24
+
diff --git a/services/wordpress6/nginx_server.conf b/services/wordpress6/nginx_server.conf
new file mode 100755
index 0000000..c34c4a1
--- /dev/null
+++ b/services/wordpress6/nginx_server.conf
@@ -0,0 +1,17 @@
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+ ssl_certificate $JC_CERT/fullchain.pem;
+ ssl_certificate_key $JC_CERT/privkey.pem;
+ server_name $JC_SERVICE www.$JC_SERVICE;
+ location / {
+ auth_basic "Cette page est protégée par un mot de passe";
+ auth_basic_user_file $DATA_DIR/pass.txt;
+ client_max_body_size 2G;
+ #proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header Host $http_host;
+ proxy_set_header X-Forwarded-Proto https;
+ proxy_pass http://$NET.100;
+ proxy_redirect off;
+ }
+}
diff --git a/sites-enabled.vandamme/collectif-arthadie.fr b/sites-enabled.vandamme/collectif-arthadie.fr
new file mode 100644
index 0000000..87ef11b
--- /dev/null
+++ b/sites-enabled.vandamme/collectif-arthadie.fr
@@ -0,0 +1,28 @@
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+ ssl_certificate /etc/letsencrypt/live/collectif-arthadie.fr/fullchain.pem;
+ ssl_certificate_key /etc/letsencrypt/live/collectif-arthadie.fr/privkey.pem;
+ server_name wordpress.collectif-arthadie.fr www.wordpress.collectif-arthadie.fr;
+ location / {
+ client_max_body_size 2G;
+ #proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header Host $http_host;
+ proxy_set_header X-Forwarded-Proto https;
+ proxy_pass http://wp.collectif-arthadiefr.docker;
+ proxy_redirect off;
+ }
+}
+
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+ ssl_certificate /etc/letsencrypt/live/collectif-arthadie.fr/fullchain.pem;
+ ssl_certificate_key /etc/letsencrypt/live/collectif-arthadie.fr/privkey.pem;
+ server_name collectif-arthadie.fr www.collectif-arthadie.fr;
+
+ location / {
+ root /data/collectif-arthadie.fr/static;
+ try_files $uri $uri/ =404;
+ }
+}
diff --git a/sites-enabled.vandamme/cousinades.jean-cloud.net b/sites-enabled.vandamme/cousinades.jean-cloud.net
new file mode 100644
index 0000000..cdf4522
--- /dev/null
+++ b/sites-enabled.vandamme/cousinades.jean-cloud.net
@@ -0,0 +1,25 @@
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+ ssl_certificate /etc/letsencrypt/live/cousinades.jean-cloud.net/fullchain.pem;
+ ssl_certificate_key /etc/letsencrypt/live/cousinades.jean-cloud.net/privkey.pem;
+ server_name cousinades.jean-cloud.net www.cousinades.jean-cloud.net;
+
+ index index.php;
+ root /data/cousinades.jean-cloud.net/public;
+
+ location / {
+ #auth_basic "Restricted";
+ #auth_basic_user_file /data/cousinades.jean-cloud.net/private/passwords.txt;
+ try_files $uri $uri/ =404;
+ }
+
+ location ~ \.php$ {
+ fastcgi_split_path_info ^(.+\.php)(/.+)$;
+ fastcgi_pass app.cousinadesjean-cloudnet.docker:9000;
+ fastcgi_index index.php;
+ include fastcgi_params;
+ fastcgi_param SCRIPT_FILENAME /usr/src/app/$fastcgi_script_name;
+ fastcgi_param PATH_INFO $fastcgi_path_info;
+ }
+}
diff --git a/sites-enabled.vandamme/git.jean-cloud.net b/sites-enabled.vandamme/git.jean-cloud.net
new file mode 100644
index 0000000..be7bd77
--- /dev/null
+++ b/sites-enabled.vandamme/git.jean-cloud.net
@@ -0,0 +1,12 @@
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+ ssl_certificate /etc/letsencrypt/live/git.jean-cloud.net/fullchain.pem;
+ ssl_certificate_key /etc/letsencrypt/live/git.jean-cloud.net/privkey.pem;
+ server_name git.jean-cloud.net www.git.jean-cloud.net;
+ location / {
+ client_max_body_size 5G;
+ proxy_pass http://gitea.gitjean-cloudnet.docker:3000;
+ }
+}
+
diff --git a/sites-enabled.vandamme/inurbe.fr b/sites-enabled.vandamme/inurbe.fr
new file mode 100644
index 0000000..c34693d
--- /dev/null
+++ b/sites-enabled.vandamme/inurbe.fr
@@ -0,0 +1,17 @@
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+ ssl_certificate /etc/letsencrypt/live/inurbe.fr/fullchain.pem;
+ ssl_certificate_key /etc/letsencrypt/live/inurbe.fr/privkey.pem;
+ server_name inurbe.fr www.inurbe.fr;
+
+location /.git {
+ deny all;
+ return 404;
+}
+
+ location / {
+ root /data/inurbe.fr;
+ try_files $uri $uri/ =404;
+ }
+}
diff --git a/sites-enabled.vandamme/leida.fr b/sites-enabled.vandamme/leida.fr
new file mode 100644
index 0000000..1466b7e
--- /dev/null
+++ b/sites-enabled.vandamme/leida.fr
@@ -0,0 +1,15 @@
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+ ssl_certificate /etc/letsencrypt/live/leida.fr/fullchain.pem;
+ ssl_certificate_key /etc/letsencrypt/live/leida.fr/privkey.pem;
+ server_name leida.fr www.leida.fr;
+ location / {
+ root /data/leida.fr/public;
+ index index.htm index.html;
+ try_files $uri $uri/ =404;
+ }
+ location ~ .php {
+ deny all;
+ }
+}
diff --git a/sites-enabled.vandamme/nuage.jean-cloud.net b/sites-enabled.vandamme/nuage.jean-cloud.net
new file mode 100644
index 0000000..934d27b
--- /dev/null
+++ b/sites-enabled.vandamme/nuage.jean-cloud.net
@@ -0,0 +1,220 @@
+# inspired from
+# https://docs.nextcloud.com/server/latest/admin_manual/installation/nginx.html?highlight=nginx
+# 2021 05 25
+
+server {
+
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+ ssl_certificate /data/dnscerts.jean-cloud.org/certs/live/nuage.jean-cloud.net/fullchain.pem;
+ ssl_certificate_key /data/dnscerts.jean-cloud.org/certs/live/nuage.jean-cloud.net/privkey.pem;
+ server_name nuage.jean-cloud.net www.nuage.jean-cloud.net;
+
+ root /data/nuage.jean-cloud.net/app;
+
+ limit_req zone=defaultlimit burst=500 nodelay;
+
+ location = /robots.txt {
+ allow all;
+ log_not_found off;
+ access_log off;
+ }
+
+
+ location = /.well-known/carddav {
+ return 301 $scheme://$host/remote.php/dav;
+ }
+ location = /.well-known/caldav {
+ return 301 $scheme://$host/remote.php/dav;
+ }
+
+
+ # set max upload size
+ client_max_body_size 10G;
+ fastcgi_buffers 64 4K;
+
+ # Enable gzip but do not remove ETag headers
+ gzip on;
+ gzip_vary on;
+ gzip_comp_level 4;
+ gzip_min_length 256;
+ gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
+ gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
+
+ # Uncomment if your server is build with the ngx_pagespeed module
+ # This module is currently not supported.
+ #pagespeed off;
+
+
+ # Add headers to serve security related headers
+ # Before enabling Strict-Transport-Security headers please read into this
+ # topic first.
+ # add_header Strict-Transport-Security "max-age=15768000;
+ # includeSubDomains; preload;";
+ #
+ # WARNING: Only add the preload option once you read about
+ # the consequences in https://hstspreload.org/. This option
+ # will add the domain to a hardcoded list that is shipped
+ # in all major browsers and getting removed from this list
+ # could take several months.
+ add_header X-Content-Type-Options nosniff;
+ add_header X-XSS-Protection "1; mode=block";
+ add_header X-Robots-Tag none;
+ add_header X-Download-Options noopen;
+ add_header X-Permitted-Cross-Domain-Policies none;
+ add_header Referrer-Policy no-referrer;
+ add_header Strict-Transport-Security "max-age=15552000; includeSubDomains";
+ add_header X-Frame-Options "SAMEORIGIN";
+
+ # Remove X-Powered-By, which is an information leak
+ fastcgi_hide_header X-Powered-By;
+
+
+ # Specify how to handle directories -- specifying `/index.php$request_uri`
+ # here as the fallback means that Nginx always exhibits the desired behaviour
+ # when a client requests a path that corresponds to a directory that exists
+ # on the server. In particular, if that directory contains an index.php file,
+ # that file is correctly served; if it doesn't, then the request is passed to
+ # the front-end controller. This consistent behaviour means that we don't need
+ # to specify custom rules for certain paths (e.g. images and other assets,
+ # `/updater`, `/ocm-provider`, `/ocs-provider`), and thus
+ # `try_files $uri $uri/ /index.php$request_uri`
+ # always provides the desired behaviour.
+ index index.php index.html /index.php$request_uri;
+
+ # Rule borrowed from `.htaccess` to handle Microsoft DAV clients
+ location = / {
+ if ( $http_user_agent ~ ^DavClnt ) {
+ return 302 /remote.php/webdav/$is_args$args;
+ }
+ }
+
+ location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
+ return 404;
+ }
+ location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
+ return 404;
+ }
+
+ location ~ \.php(?:$|/) {
+ fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+ set $path_info $fastcgi_path_info;
+
+ try_files $fastcgi_script_name =404;
+
+ include fastcgi_params;
+ fastcgi_param SCRIPT_FILENAME /var/www/html/$fastcgi_script_name;
+ fastcgi_param PATH_INFO $fastcgi_path_info;
+
+ # TODO is it needed? Is it buggy?
+ fastcgi_param HTTPS on;
+ fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice
+ fastcgi_param front_controller_active true;
+ #fastcgi_pass 172.16.11.100:9000;
+ fastcgi_pass nextcloud.nuagejean-cloudnet.docker:9000;
+
+ fastcgi_intercept_errors on;
+ fastcgi_request_buffering off;
+ }
+
+
+ # Make sure it is BELOW the PHP block
+ location ~ \.(?:css|js|svg|gif)$ {
+ try_files $uri /index.php$request_uri;
+ expires 6M; # Cache-Control policy borrowed from `.htaccess`
+ access_log off; # Optional: Don't log access to assets
+ }
+
+ location ~ \.woff2?$ {
+ try_files $uri /index.php$request_uri;
+ expires 7d; # Cache-Control policy borrowed from `.htaccess`
+ access_log off; # Optional: Don't log access to assets
+ }
+
+ # Rule borrowed from `.htaccess`
+ location /remote {
+ return 301 /remote.php$request_uri;
+ }
+
+ location / {
+ try_files $uri $uri/ /index.php$request_uri;
+ }
+}
+
+
+map $http_upgrade $connection_upgrade {
+ default upgrade;
+ '' close;
+}
+
+
+proxy_cache_path /var/www/cache levels=1:2 keys_zone=my-cache:8m max_size=1000m inactive=600m;
+proxy_temp_path /var/www/cache/tmp;
+
+server {
+ listen 443 ssl;
+ large_client_header_buffers 32 64k;
+ root /usr/share/nginx/www;
+ index index.html index.htm;
+ ssl_certificate /data/dnscerts.jean-cloud.org/certs/live/nuage.jean-cloud.net/fullchain.pem;
+ ssl_certificate_key /data/dnscerts.jean-cloud.org/certs/live/nuage.jean-cloud.net/privkey.pem;
+ server_name calc.nuage.jean-cloud.net;
+
+ location ~* (\.(css|png|gif|svg|ico|txt)|static/.*\.js(on)?|manifest\.(appcache|webapp|json)|browserconfig\.xml)$ {
+ root /data/proxy/nuage.jean-cloud.net/ethercalc/;
+ expires 24h;
+ add_header Cache-Control public;
+ }
+
+ location ~* "(?:[.]|/_/[^/]+/)(?:html|csv|csv\.json)$" {
+ proxy_pass http://ethercalc.nuagejean-cloudnet.docker:8000;
+ proxy_cache_use_stale error timeout http_500 http_502 http_503 http_504;
+ proxy_http_version 1.1;
+ proxy_set_header Upgrade $http_upgrade;
+ proxy_read_timeout 31536000;
+ proxy_buffers 32 64k;
+ proxy_buffer_size 128k;
+ add_header Strict-Transport-Security max-age=31536000;
+ include /data/proxy/nuage.jean-cloud.net/nginx_cors.conf;
+ }
+ location / {
+ gzip on;
+ gzip_min_length 1000;
+ gzip_proxied any;
+ proxy_pass http://ethercalc.nuagejean-cloudnet.docker:8000;
+ proxy_http_version 1.1;
+ proxy_set_header Upgrade $http_upgrade;
+ proxy_read_timeout 31536000;
+ proxy_set_header Connection $connection_upgrade;
+ # prevents 502 bad gateway error
+ proxy_buffers 32 64k;
+ proxy_buffer_size 128k;
+ add_header Strict-Transport-Security max-age=31536000;
+ include /data/proxy/nuage.jean-cloud.net/nginx_cors.conf;
+ }
+}
+
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+ ssl_certificate /data/dnscerts.jean-cloud.org/certs/live/nuage.jean-cloud.net/fullchain.pem;
+ ssl_certificate_key /data/dnscerts.jean-cloud.org/certs/live/nuage.jean-cloud.net/privkey.pem;
+ server_name pad.nuage.jean-cloud.net;
+
+ location / {
+ proxy_pass http://etherpad.nuagejean-cloudnet.docker:9001;
+ proxy_buffering off; # be careful, this line doesn't override any proxy_buffering on set in a conf.d/file.conf
+ proxy_set_header Host $host;
+ proxy_pass_header Server;
+
+ # Note you might want to pass these headers etc too.
+ #proxy_set_header X-Real-IP $remote_addr; # https://nginx.org/en/docs/http/ngx_http_proxy_module.html
+ #proxy_set_header X-Forwarded-For $remote_addr; # EP logs to show the actual remote IP
+ proxy_set_header X-Forwarded-Proto $scheme; # for EP to set secure cookie flag when https is used
+ proxy_http_version 1.1; # recommended with keepalive connections
+
+ # WebSocket proxying - from https://nginx.org/en/docs/http/websocket.html
+ proxy_set_header Upgrade $http_upgrade;
+ proxy_set_header Connection $connection_upgrade;
+ }
+}
diff --git a/sites-enabled.vandamme/oma-radio.fr b/sites-enabled.vandamme/oma-radio.fr
new file mode 100644
index 0000000..694532b
--- /dev/null
+++ b/sites-enabled.vandamme/oma-radio.fr
@@ -0,0 +1,13 @@
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+ ssl_certificate /etc/letsencrypt/live/oma-radio.fr/fullchain.pem;
+ ssl_certificate_key /etc/letsencrypt/live/oma-radio.fr/privkey.pem;
+ server_name oma-radio.fr www.oma-radio.fr;
+ root /data/oma-radio.fr;
+
+ location / {
+ index index.html;
+ try_files $uri $uri/ =404;
+ }
+}
diff --git a/sites-enabled.vandamme/proxy b/sites-enabled.vandamme/proxy
new file mode 100644
index 0000000..a9979c0
--- /dev/null
+++ b/sites-enabled.vandamme/proxy
@@ -0,0 +1,17 @@
+server{
+ listen 80 default_server;
+ listen [::]:80 default_server;
+ location '/.well-known/acme-challenge' {
+ root /var/www/letsencrypt;
+ default_type "text/plain";
+ try_files $uri $uri/ =404;
+ }
+
+ location / {
+ return 301 https://$host$request_uri;
+ }
+
+ location = /basic_status {
+ stub_status;
+ }
+}
diff --git a/sites-enabled.vandamme/rpnow.jean-cloud.net b/sites-enabled.vandamme/rpnow.jean-cloud.net
new file mode 100644
index 0000000..d8d0fc9
--- /dev/null
+++ b/sites-enabled.vandamme/rpnow.jean-cloud.net
@@ -0,0 +1,40 @@
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+ ssl_certificate /etc/letsencrypt/live/rpnow.jean-cloud.net/fullchain.pem;
+ ssl_certificate_key /etc/letsencrypt/live/rpnow.jean-cloud.net/privkey.pem;
+ server_name rpnow.jean-cloud.net www.rpnow.jean-cloud.net;
+
+ location / {
+ client_max_body_size 2G;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header Host $http_host;
+ proxy_http_version 1.1;
+ proxy_set_header Upgrade $http_upgrade;
+ proxy_set_header Connection "upgrade";
+ proxy_read_timeout 86400;
+ proxy_redirect off;
+ proxy_pass http://rpnow.rpnowjean-cloudnet.docker;
+ }
+}
+
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+ ssl_certificate /etc/letsencrypt/live/rpnow.jean-cloud.net/fullchain.pem;
+ ssl_certificate_key /etc/letsencrypt/live/rpnow.jean-cloud.net/privkey.pem;
+ server_name test.rpnow.jean-cloud.net www.test.rpnow.jean-cloud.net;
+
+ location / {
+ client_max_body_size 2G;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header Host $http_host;
+ proxy_http_version 1.1;
+ proxy_set_header Upgrade $http_upgrade;
+ proxy_set_header Connection "upgrade";
+ proxy_read_timeout 86400;
+ proxy_redirect off;
+ proxy_pass http://test_rpnow.rpnowjean-cloudnet.docker;
+ }
+}
+
diff --git a/sites-enabled.vandamme/static.jean-cloud.net b/sites-enabled.vandamme/static.jean-cloud.net
new file mode 100644
index 0000000..a8d3a08
--- /dev/null
+++ b/sites-enabled.vandamme/static.jean-cloud.net
@@ -0,0 +1,15 @@
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+ ssl_certificate /etc/letsencrypt/live/static.jean-cloud.net/fullchain.pem;
+ ssl_certificate_key /etc/letsencrypt/live/static.jean-cloud.net/privkey.pem;
+ server_name static.oma-radio.fr www.static.oma-radio.fr static.jean-cloud.net www.static.jean-cloud.net;
+ root /data/static.jean-cloud.net/public/;
+
+ location / {
+ add_header 'Access-Control-Allow-Origin' '*';
+ add_header 'Access-Control-Allow-Methods' 'GET';
+ index index.html;
+ try_files $uri $uri/ =404;
+ }
+}
diff --git a/sites-enabled.vandamme/wiki-cgr.jean-cloud.net b/sites-enabled.vandamme/wiki-cgr.jean-cloud.net
new file mode 100644
index 0000000..1ba64f2
--- /dev/null
+++ b/sites-enabled.vandamme/wiki-cgr.jean-cloud.net
@@ -0,0 +1,30 @@
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+ ssl_certificate /etc/letsencrypt/live/wiki-cgr.jean-cloud.net/fullchain.pem;
+ ssl_certificate_key /etc/letsencrypt/live/wiki-cgr.jean-cloud.net/privkey.pem;
+ server_name wiki-cgr.jean-cloud.net www.wiki-cgr.jean-cloud.net;
+ location / {
+ client_max_body_size 2G;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header Host $http_host;
+ proxy_pass http://mediawiki.wiki-cgrjean-cloudnet.docker;
+ proxy_redirect off;
+ }
+}
+
+# Is the parsoid mutualisable on all wikis ?
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+ ssl_certificate /etc/letsencrypt/live/wiki-cgr.jean-cloud.net/fullchain.pem;
+ ssl_certificate_key /etc/letsencrypt/live/wiki-cgr.jean-cloud.net/privkey.pem;
+ server_name parsoid-wiki-cgr.jean-cloud.net www.parsoid-wiki-cgr.jean-cloud.net;
+ location / {
+ client_max_body_size 2G;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header Host $http_host;
+ proxy_pass http://parsoid.wiki-cgrjean-cloudnet.docker;
+ proxy_redirect off;
+ }
+}