alexandre.pires
272ed647cf
- Updated host_vars for dev-02 to include login history settings and modified code server authentication. - Adjusted opencode server configurations and reduced resource allocation. - Introduced a new playbook for configuring nginx reverse proxy with TLS and OAuth2. - Enhanced linux_dev_station role defaults and tasks, including package updates and service configurations. - Removed unnecessary credential assertions in linux_dev_station tasks. - Created nginx_proxy role with tasks for certbot, nginx installation, and oauth2-proxy setup. - Added templates for nginx and oauth2-proxy configurations. - Updated terraform configuration to reflect new DNS records for ide and agent services. - Documented changes and configurations in linux_dev_station.md for clarity and future reference.
55 lines
2.5 KiB
YAML
55 lines
2.5 KiB
YAML
---
|
|
nginx_proxy_certbot_enabled: true
|
|
nginx_proxy_certbot_email: ""
|
|
nginx_proxy_certbot_cron_minute: "0"
|
|
nginx_proxy_certbot_cron_hour: "3"
|
|
nginx_proxy_certbot_credential_file: "/etc/letsencrypt/cloudns.ini"
|
|
nginx_proxy_certbot_credential_mode: "0600"
|
|
|
|
nginx_proxy_nginx_enabled: true
|
|
nginx_proxy_nginx_bind: "0.0.0.0"
|
|
nginx_proxy_nginx_port: 443
|
|
nginx_proxy_nginx_worker_connections: 1024
|
|
nginx_proxy_nginx_access_log: "/var/log/nginx/access.log"
|
|
nginx_proxy_nginx_error_log: "/var/log/nginx/error.log warn"
|
|
nginx_proxy_nginx_ssl_protocols: "TLSv1.2 TLSv1.3"
|
|
nginx_proxy_nginx_ssl_ciphers: ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
|
|
nginx_proxy_nginx_ssl_prefer_server_ciphers: "on"
|
|
nginx_proxy_nginx_hsts_max_age: "31536000"
|
|
nginx_proxy_nginx_hsts_include_subdomains: true
|
|
|
|
nginx_proxy_oauth2_proxy_enabled: true
|
|
nginx_proxy_oauth2_proxy_bind: "127.0.0.1"
|
|
nginx_proxy_oauth2_proxy_port: 4180
|
|
nginx_proxy_oauth2_proxy_version: "7.15.3"
|
|
nginx_proxy_oauth2_proxy_cookie_domain: ""
|
|
nginx_proxy_oauth2_proxy_cookie_name: "_oauth2_proxy"
|
|
nginx_proxy_oauth2_proxy_cookie_secret: "{{ lookup('env', 'OAUTH2_PROXY_COOKIE_SECRET', default='') }}"
|
|
nginx_proxy_oauth2_proxy_client_id: "{{ lookup('env', 'OAUTH2_PROXY_CLIENT_ID', default='') }}"
|
|
nginx_proxy_oauth2_proxy_client_secret: "{{ lookup('env', 'OAUTH2_PROXY_CLIENT_SECRET', default='') }}"
|
|
nginx_proxy_oauth2_proxy_redirect_urls: []
|
|
nginx_proxy_oauth2_proxy_provider: ""
|
|
nginx_proxy_oauth2_proxy_provider_url: ""
|
|
nginx_proxy_oauth2_proxy_scopes: "openid profile email"
|
|
nginx_proxy_oauth2_proxy_email_domains: []
|
|
nginx_proxy_oauth2_proxy_upstream: "static://200"
|
|
nginx_proxy_oauth2_proxy_skip_jwt: false
|
|
nginx_proxy_oauth2_proxy_set_basic_auth: false
|
|
nginx_proxy_oauth2_proxy_set_xauthrequest: true
|
|
nginx_proxy_oauth2_proxy_ssl_insecure_skip_verify: false
|
|
nginx_proxy_oauth2_proxy_proxy_prefix: "/oauth2"
|
|
nginx_proxy_oauth2_proxy_silent_login: false
|
|
nginx_proxy_oauth2_proxy_skip_provider_whoami: false
|
|
nginx_proxy_oauth2_proxy_cookie_refresh: "0s"
|
|
nginx_proxy_oauth2_proxy_cookie_expire: "168h"
|
|
nginx_proxy_oauth2_proxy_session_storage_type: "memory"
|
|
nginx_proxy_oauth2_proxy_request_logging: true
|
|
nginx_proxy_oauth2_proxy_log_file: "/var/log/oauth2-proxy.log"
|
|
nginx_proxy_oauth2_proxy_log_level: "info"
|
|
|
|
nginx_proxy_sites: []
|
|
|
|
nginx_proxy_cloudns_auth_id: "{{ lookup('env', 'CLOUDNS_AUTH_ID') }}"
|
|
nginx_proxy_cloudns_auth_password: "{{ lookup('env', 'CLOUDNS_PASSWORD') }}"
|
|
nginx_proxy_cloudns_nameserver: "109.201.133.111"
|