From 6ebb99e14842422dbf5595c9138cd3f66023a08a Mon Sep 17 00:00:00 2001 From: Andrew Tomaka Date: Fri, 23 Dec 2022 00:08:11 -0500 Subject: [PATCH] Add nginx proxy server --- hosts | 4 +- roles/docker/tasks/main.yml | 19 +++++++++ roles/firewall/tasks/main.yml | 8 ++++ roles/nginx-proxy-manager/files/default.conf | 42 +++++++++++++++++++ .../files/docker-compose.yml | 13 ++++++ .../nginx-proxy-manager/files/production.conf | 33 +++++++++++++++ roles/nginx-proxy-manager/tasks/main.yml | 37 ++++++++++++++++ site.yml | 6 +++ 8 files changed, 160 insertions(+), 2 deletions(-) create mode 100644 roles/docker/tasks/main.yml create mode 100644 roles/nginx-proxy-manager/files/default.conf create mode 100644 roles/nginx-proxy-manager/files/docker-compose.yml create mode 100644 roles/nginx-proxy-manager/files/production.conf create mode 100644 roles/nginx-proxy-manager/tasks/main.yml diff --git a/hosts b/hosts index 77588da..e920187 100644 --- a/hosts +++ b/hosts @@ -7,7 +7,7 @@ dns: dns_2: ansible_host: 192.168.1.4 sync_target: 192.168.1.3 -nginx: +proxy: hosts: - nginx_1: + proxy_1: ansible_host: 192.168.1.12 diff --git a/roles/docker/tasks/main.yml b/roles/docker/tasks/main.yml new file mode 100644 index 0000000..7e6ec80 --- /dev/null +++ b/roles/docker/tasks/main.yml @@ -0,0 +1,19 @@ +--- +- name: Add apt key for docker + apt_key: + url: https://download.docker.com/linux/ubuntu/gpg + state: present + +- name: Add docker repository into sources list + apt_repository: + repo: deb https://download.docker.com/linux/ubuntu jammy stable + state: present + +- name: Install docker packages + apt: + name: + - docker-ce + - docker-ce-cli + - containerd.io + - docker-compose-plugin + state: present diff --git a/roles/firewall/tasks/main.yml b/roles/firewall/tasks/main.yml index 5ba553d..55a0e33 100644 --- a/roles/firewall/tasks/main.yml +++ b/roles/firewall/tasks/main.yml @@ -41,6 +41,14 @@ jump: ACCEPT notify: Persist iptables +- name: Allow admin web (nginx proxy) + iptables: + chain: INPUT + protocol: tcp + destination_port: 81 + jump: ACCEPT + notify: Persist iptables + - name: Allow dns iptables: chain: INPUT diff --git a/roles/nginx-proxy-manager/files/default.conf b/roles/nginx-proxy-manager/files/default.conf new file mode 100644 index 0000000..e2b5d81 --- /dev/null +++ b/roles/nginx-proxy-manager/files/default.conf @@ -0,0 +1,42 @@ +# "You are not configured" page, which is the default if another default doesn't exist +server { + listen 80; + listen [::]:80; + + set $forward_scheme "http"; + set $server "127.0.0.1"; + set $port "80"; + + server_name localhost-nginx-proxy-manager; + access_log /data/logs/fallback_access.log standard; + error_log /data/logs/fallback_error.log warn; + include conf.d/include/assets.conf; + include conf.d/include/block-exploits.conf; + include conf.d/include/letsencrypt-acme-challenge.conf; + + location / { + return 444; + index index.html; + root /var/www/html; + } + return 444; +} + +# First 443 Host, which is the default if another default doesn't exist +server { + listen 443 ssl; + listen [::]:443 ssl; + + set $forward_scheme "https"; + set $server "127.0.0.1"; + set $port "443"; + + server_name localhost; + access_log /data/logs/fallback_access.log standard; + error_log /dev/null crit; + ssl_certificate /data/nginx/dummycert.pem; + ssl_certificate_key /data/nginx/dummykey.pem; + include conf.d/include/ssl-ciphers.conf; + + return 444; +} diff --git a/roles/nginx-proxy-manager/files/docker-compose.yml b/roles/nginx-proxy-manager/files/docker-compose.yml new file mode 100644 index 0000000..1c64e1b --- /dev/null +++ b/roles/nginx-proxy-manager/files/docker-compose.yml @@ -0,0 +1,13 @@ +version: "3" +services: + app: + image: 'jc21/nginx-proxy-manager:latest' + restart: unless-stopped + ports: + - 80:80 # Public HTTP Port + - 443:443 # Public HTTPS Port + - 81:81 # Admin Web Port + volumes: + - ./data:/data + - ./letsencrypt:/etc/letsencrypt + - ./default.conf:/etc/nginx/conf.d/default.conf diff --git a/roles/nginx-proxy-manager/files/production.conf b/roles/nginx-proxy-manager/files/production.conf new file mode 100644 index 0000000..53bd8ba --- /dev/null +++ b/roles/nginx-proxy-manager/files/production.conf @@ -0,0 +1,33 @@ +# Admin Interface +server { + listen 81; + listen [::]:81; + + server_name nginxproxymanager; + root /app/frontend; + access_log /dev/null; + + location /api { + return 302 /api/; + } + + location /api/ { + add_header X-Served-By $host; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-Scheme $scheme; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-For $remote_addr; + proxy_pass http://127.0.0.1:3000/; + + proxy_read_timeout 15m; + proxy_send_timeout 15m; + } + + location / { + index index.html; + if ($request_uri ~ ^/(.*)\.html$) { + return 302 /$1; + } + try_files $uri $uri.html $uri/ /index.html; + } +} diff --git a/roles/nginx-proxy-manager/tasks/main.yml b/roles/nginx-proxy-manager/tasks/main.yml new file mode 100644 index 0000000..14c32e0 --- /dev/null +++ b/roles/nginx-proxy-manager/tasks/main.yml @@ -0,0 +1,37 @@ +--- +- name: Create npm user + user: + name: npm + groups: docker + shell: /bin/bash + state: present + +- name: Create npm directory + become: yes + become_user: npm + file: + path: /home/npm/npm + state: directory + +- name: Put npm docker-compose in place + copy: + src: files/docker-compose.yml + dest: /home/npm/npm/docker-compose.yml + mode: 0600 + owner: npm + group: npm + +- name: Put default npm config in place + copy: + src: files/default.conf + dest: /home/npm/npm/default.conf + mode: 0644 + owner: npm + group: npm + +- name: Start npm + become: yes + become_user: npm + command: + chdir: /home/npm/npm + cmd: docker compose up -d diff --git a/site.yml b/site.yml index a984fae..f95045b 100644 --- a/site.yml +++ b/site.yml @@ -18,3 +18,9 @@ roles: - role: pihole tags: pihole +- hosts: proxy + become: yes + roles: + - role: docker + - role: nginx-proxy-manager + tags: npm