Now installs a LE SSL cert via certbot by default + configurable base path for user's home
All checks were successful
Ansible Lint |Total|New|Outstanding|Fixed|Trend
|:-:|:-:|:-:|:-:|:-:
|4834|36|4798|40|:+1:
Reference build: <a href="https://jenkins.evolix.org/job/gitea/job/ansible-roles/job/mattermost/1//ansiblelint">Evolix » ansible-roles » mattermost #1</a>
gitea/ansible-roles/pipeline/head This commit looks good
All checks were successful
Ansible Lint |Total|New|Outstanding|Fixed|Trend
|:-:|:-:|:-:|:-:|:-:
|4834|36|4798|40|:+1:
Reference build: <a href="https://jenkins.evolix.org/job/gitea/job/ansible-roles/job/mattermost/1//ansiblelint">Evolix » ansible-roles » mattermost #1</a>
gitea/ansible-roles/pipeline/head This commit looks good
This commit is contained in:
parent
5122d7128a
commit
be33260c47
|
@ -4,6 +4,8 @@ system_dep: "['git', 'nginx', 'postgresql', 'python3-psycopg2', 'certbot', 'acl'
|
|||
version: '7.8.1'
|
||||
download_url: "https://releases.mattermost.com/{{ version }}/mattermost-team-{{ version }}-linux-amd64.tar.gz"
|
||||
domains: ['example.domain.org']
|
||||
certbot_admin_email: 'mgauthier@evolix.ca'
|
||||
home_base: '/home'
|
||||
mm_port: '8065'
|
||||
db_host: '127.0.0.1'
|
||||
db_name: "{{ service }}"
|
||||
|
|
|
@ -4,11 +4,13 @@
|
|||
- name: Install main system dependencies
|
||||
apt:
|
||||
name: "{{ system_dep }}"
|
||||
update_cache: yes
|
||||
|
||||
- name: Add UNIX account
|
||||
user:
|
||||
name: "{{ service }}"
|
||||
shell: /bin/bash
|
||||
home: "{{ home_base }}/{{ service }}"
|
||||
|
||||
- name: Add PostgreSQL user
|
||||
postgresql_user:
|
||||
|
@ -51,41 +53,55 @@
|
|||
- name: Start mattermost systemd unit
|
||||
service:
|
||||
name: "mattermost@{{ service }}"
|
||||
state: started
|
||||
state: restarted
|
||||
|
||||
#~ - name: Check if SSL certificate is present and register result
|
||||
#~ stat:
|
||||
#~ path: "/etc/letsencrypt/live/{{ domains |first }}/fullchain.pem"
|
||||
#~ register: ssl
|
||||
- name: Template nginx snippet for Let's Encrypt/Certbot
|
||||
template:
|
||||
src: "letsencrypt.conf.j2"
|
||||
dest: "/etc/nginx/snippets/letsencrypt.conf"
|
||||
|
||||
#~ - name: Generate certificate only if required (first time)
|
||||
#~ block:
|
||||
#~ - name: Template vhost without SSL for successfull LE challengce
|
||||
#~ template:
|
||||
#~ src: "vhost.conf.j2"
|
||||
#~ dest: "/etc/nginx/sites-available/{{ service }}.conf"
|
||||
#~ - name: Enable temporary nginx vhost for mattermost
|
||||
#~ file:
|
||||
#~ src: "/etc/nginx/sites-available/{{ service }}.conf"
|
||||
#~ dest: "/etc/nginx/sites-enabled/{{ service }}.conf"
|
||||
#~ state: link
|
||||
#~ - name: Reload nginx conf
|
||||
#~ service:
|
||||
#~ name: nginx
|
||||
#~ state: reloaded
|
||||
#~ - name: Make sure /var/lib/letsencrypt exists and has correct permissions
|
||||
#~ file:
|
||||
#~ path: /var/lib/letsencrypt
|
||||
#~ state: directory
|
||||
#~ mode: '0755'
|
||||
#~ - name: Generate certificate with certbot
|
||||
#~ shell: certbot certonly --webroot --webroot-path /var/lib/letsencrypt -d {{ domains |first }}
|
||||
#~ when: ssl.stat.exists == true
|
||||
- name: Check if SSL certificate is present and register result
|
||||
stat:
|
||||
path: "/etc/letsencrypt/live/{{ domains |first }}/fullchain.pem"
|
||||
register: ssl
|
||||
|
||||
#~ - name: (Re)check if SSL certificate is present and register result
|
||||
#~ stat:
|
||||
#~ path: "/etc/letsencrypt/live/{{ domains |first }}/fullchain.pem"
|
||||
#~ register: ssl
|
||||
- name: Generate certificate only if required (first time)
|
||||
block:
|
||||
- name: Template vhost without SSL for successfull LE challengce
|
||||
template:
|
||||
src: "vhost.conf.j2"
|
||||
dest: "/etc/nginx/sites-available/{{ service }}.conf"
|
||||
- name: Enable temporary nginx vhost for mattermost
|
||||
file:
|
||||
src: "/etc/nginx/sites-available/{{ service }}.conf"
|
||||
dest: "/etc/nginx/sites-enabled/{{ service }}.conf"
|
||||
state: link
|
||||
- name: Reload nginx conf
|
||||
service:
|
||||
name: nginx
|
||||
state: reloaded
|
||||
- name: Make sure /var/lib/letsencrypt exists and has correct permissions
|
||||
file:
|
||||
path: /var/lib/letsencrypt
|
||||
state: directory
|
||||
mode: '0755'
|
||||
- name: Generate certificate with certbot
|
||||
shell: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --agree-tos --email {{ certbot_admin_email }} -d {{ domains |first }}
|
||||
- name: Create the ssl dir if needed
|
||||
file:
|
||||
path: /etc/nginx/ssl
|
||||
state: directory
|
||||
mode: '0750'
|
||||
- name: Template ssl bloc for nginx vhost
|
||||
template:
|
||||
src: "ssl.conf.j2"
|
||||
dest: "/etc/nginx/ssl/{{ domains |first }}.conf"
|
||||
when: ssl.stat.exists != true
|
||||
|
||||
- name: (Re)check if SSL certificate is present and register result
|
||||
stat:
|
||||
path: "/etc/letsencrypt/live/{{ domains |first }}/fullchain.pem"
|
||||
register: ssl
|
||||
|
||||
- name: (Re)template conf file for nginx vhost with SSL
|
||||
template:
|
||||
|
|
5
webapps/mattermost/templates/letsencrypt.conf.j2
Normal file
5
webapps/mattermost/templates/letsencrypt.conf.j2
Normal file
|
@ -0,0 +1,5 @@
|
|||
location ~ /.well-known/acme-challenge {
|
||||
alias /var/lib/letsencrypt/;
|
||||
try_files $uri =404;
|
||||
allow all;
|
||||
}
|
|
@ -7,8 +7,8 @@ Requires=postgresql.service
|
|||
[Service]
|
||||
Type=notify
|
||||
Restart=always
|
||||
WorkingDirectory=/home/%i/mattermost
|
||||
ExecStart=/home/%i/mattermost/bin/mattermost
|
||||
WorkingDirectory={{ home_base }}/%i/mattermost
|
||||
ExecStart=/{{ home_base }}/%i/mattermost/bin/mattermost
|
||||
TimeoutStartSec=3600
|
||||
LimitNOFILE=49152
|
||||
RestartSec=10
|
||||
|
|
22
webapps/mattermost/templates/ssl.conf.j2
Normal file
22
webapps/mattermost/templates/ssl.conf.j2
Normal file
|
@ -0,0 +1,22 @@
|
|||
##
|
||||
# Certificates
|
||||
# you need a certificate to run in production. see https://letsencrypt.org/
|
||||
##
|
||||
ssl_certificate /etc/letsencrypt/live/{{ domains | first }}/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/{{ domains | first }}/privkey.pem;
|
||||
|
||||
##
|
||||
# Security hardening (as of Nov 15, 2020)
|
||||
# based on Mozilla Guideline v5.6
|
||||
##
|
||||
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256; # add ECDHE-RSA-AES256-SHA if you want compatibility with Android 4
|
||||
ssl_session_timeout 1d; # defaults to 5m
|
||||
ssl_session_cache shared:SSL:10m; # estimated to 40k sessions
|
||||
ssl_session_tickets off;
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
# HSTS (https://hstspreload.org), requires to be copied in 'location' sections that have add_header directives
|
||||
#add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
|
|
@ -3,18 +3,31 @@ upstream backend_{{ service }} {
|
|||
keepalive 32;
|
||||
}
|
||||
|
||||
#proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=mattermost_cache:10m max_size=3g inactive=120m use_temp_path=off;
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
#listen 443 ssl;
|
||||
#listen [::]:443 ssl;
|
||||
server_name {{ domains | first }};
|
||||
|
||||
# For certbot
|
||||
include /etc/nginx/snippets/letsencrypt.conf;
|
||||
|
||||
{% if ssl.stat.exists %}
|
||||
location / { return 301 https://$host$request_uri; }
|
||||
{% endif %}
|
||||
}
|
||||
|
||||
{% if ssl.stat.exists %}
|
||||
server {
|
||||
listen 443 ssl;
|
||||
listen [::]:443 ssl;
|
||||
|
||||
server_name {{ domains | first }};
|
||||
|
||||
#ssl_certificate /etc/ssl/certs/mattermost.example.com.pem;
|
||||
#ssl_certificate_key /etc/ssl/private/mattermost.example.com.pem;
|
||||
access_log /var/log/nginx/{{ service }}.access.log;
|
||||
error_log /var/log/nginx/{{ service }}.error.log;
|
||||
|
||||
include /etc/nginx/snippets/letsencrypt.conf;
|
||||
include /etc/nginx/ssl/{{ domains | first }}.conf;
|
||||
|
||||
location ~ /api/v[0-9]+/(users/)?websocket$ {
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
|
@ -47,6 +60,7 @@ server {
|
|||
proxy_buffers 256 16k;
|
||||
proxy_buffer_size 16k;
|
||||
proxy_read_timeout 600s;
|
||||
#proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=mattermost_cache:10m max_size=3g inactive=120m use_temp_path=off;
|
||||
#proxy_cache mattermost_cache;
|
||||
#proxy_cache_revalidate on;
|
||||
#proxy_cache_min_uses 2;
|
||||
|
@ -56,3 +70,4 @@ server {
|
|||
proxy_pass http://backend_{{ service }};
|
||||
}
|
||||
}
|
||||
{% endif %}
|
||||
|
|
Loading…
Reference in a new issue