From c580bbfef9cfe359f27be131ca991150721da86d Mon Sep 17 00:00:00 2001 From: hogweed1 Date: Wed, 12 Aug 2026 00:22:00 +1000 Subject: [PATCH] some preps to make lbs. --- files/angie/lb1.guaranteedstruggle.host | 0 files/angie/lb1.guaranteedstruggle.host.conf | 400 +++++++++++++++++++ playbooks/software/angie.yml | 15 +- 3 files changed, 414 insertions(+), 1 deletion(-) delete mode 100644 files/angie/lb1.guaranteedstruggle.host create mode 100644 files/angie/lb1.guaranteedstruggle.host.conf diff --git a/files/angie/lb1.guaranteedstruggle.host b/files/angie/lb1.guaranteedstruggle.host deleted file mode 100644 index e69de29..0000000 diff --git a/files/angie/lb1.guaranteedstruggle.host.conf b/files/angie/lb1.guaranteedstruggle.host.conf new file mode 100644 index 0000000..8c4095f --- /dev/null +++ b/files/angie/lb1.guaranteedstruggle.host.conf @@ -0,0 +1,400 @@ + + +# server { +# listen 443 ssl http2 ; + +# server_name guaranteedstruggle.host; +# return 302 https://dashy.guaranteedstruggle.host; +# # ssl_certificate /etc/angie/ssl/guaranteedstruggle.host/fullchain.pem; # managed by Certbot +# # ssl_certificate_key /etc/angie/ssl/guaranteedstruggle.host/privkey.pem; # managed by Certbot + +# ssl_certificate /etc/angie/ssl/dashy.guaranteedstruggle.host/fullchain.pem; # managed by Certbot +# ssl_certificate_key /etc/angie/ssl/dashy.guaranteedstruggle.host/privkey.pem; # managed by Certbot +# } + + + + + + +server { + listen 443 ssl http2; + + server_name wikijs.guaranteedstruggle.host; + + location / { + proxy_pass http://192.168.0.143:3000/; + + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + ssl_certificate /etc/angie/ssl/wikijs.guaranteedstruggle.host/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/angie/ssl/wikijs.guaranteedstruggle.host/privkey.pem; # managed by Certbot + + + # для огромных таблиц линк громадный + # https://stackoverflow.com/questions/1067334/how-to-set-the-allowed-url-length-for-a-nginx-request-error-code-414-uri-too + client_max_body_size 124M; + client_body_buffer_size 2M; + + client_header_buffer_size 15120k; + large_client_header_buffers 16 15120k; +} +server { + listen 443 ssl http2; + + server_name keycloak.guaranteedstruggle.host; + + location / { + proxy_pass http://192.168.0.231:8080; + + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + ssl_certificate /etc/angie/ssl/keycloak.guaranteedstruggle.host/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/angie/ssl/keycloak.guaranteedstruggle.host/privkey.pem; # managed by Certbot +} + +upstream netbird_dashboard { + server 192.168.0.39:8080; + keepalive 10; +} +upstream netbird_server { + server 192.168.0.39:8081; +} + +server { + listen 80; + server_name noir-films.guaranteedstruggle.host; + + location / { + return 301 https://$host$request_uri; + } +} + +server { + listen 443 ssl; + server_name noir-films.guaranteedstruggle.host; + http2 on; + ssl_certificate /etc/angie/ssl/noir-films.guaranteedstruggle.host/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/angie/ssl/noir-films.guaranteedstruggle.host/privkey.pem; # managed by Certbot + + # Recommended SSL settings + ssl_protocols TLSv1.2 TLSv1.3; + ssl_prefer_server_ciphers off; + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384; + + # Required for long-lived gRPC connections + client_header_timeout 1d; + client_body_timeout 1d; + + # Common proxy headers + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Scheme $scheme; + proxy_set_header X-Forwarded-Proto https; + proxy_set_header X-Forwarded-Host $host; + grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + + # WebSocket connections (relay, signal, management) + location ~ ^/(relay|ws-proxy/) { + proxy_pass http://netbird_server; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "Upgrade"; + proxy_set_header Host $host; + proxy_read_timeout 1d; + } + + # Native gRPC (signal + management) + location ~ ^/(signalexchange\.SignalExchange|management\.ManagementService)/ { + grpc_pass grpc://netbird_server; + grpc_read_timeout 1d; + grpc_send_timeout 1d; + grpc_socket_keepalive on; + } + + # HTTP routes (API + OAuth2) + location ~ ^/(api|oauth2)/ { + proxy_pass http://netbird_server; + proxy_set_header Host $host; + } + + # Dashboard (catch-all) + location / { + proxy_pass http://netbird_dashboard; + } +} + + +# For WebSocket +map $http_upgrade $connection_upgrade { + default upgrade; + '' close; +} +proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=cache1:16m max_size=1g inactive=720m use_temp_path=off; +server { + listen 443 ssl; + http2 on; + server_name valavala.ru; + + ssl_session_timeout 1d; + ssl_session_cache shared:ssl_session_cache:10m; + ssl_session_tickets off; + + # SSL protocol settings + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; + ssl_prefer_server_ciphers off; + #####ssl_stapling on; + ####ssl_stapling_verify on; + + + location / { + proxy_pass http://192.168.0.55:3033/; + + proxy_set_header Host $host; + proxy_http_version 1.1; + proxy_redirect off; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + # For WebSocket + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + + # Cache settings + proxy_cache cache1; + proxy_cache_lock on; + proxy_cache_use_stale updating; + proxy_force_ranges on; + add_header X-Cache $upstream_cache_status; + } + ssl_certificate /etc/angie/ssl/valavala.ru/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/angie/ssl/valavala.ru/privkey.pem; # managed by Certbot +} + + +server { + listen 443 ssl http2; + listen 8448 ssl http2; + + server_name matrix-server.guaranteedstruggle.host; + + location / { + proxy_pass http://192.168.0.180:8008/; + + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + + + # Установите лимит, соответствующий или превышающий Tuwunel + client_max_body_size 50M; + + # Для больших файлов также полезно увеличить тайм-ауты + proxy_read_timeout 300s; + proxy_connect_timeout 300s; + proxy_send_timeout 300s; + } + ssl_certificate /etc/angie/ssl/matrix-server.guaranteedstruggle.host/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/angie/ssl/matrix-server.guaranteedstruggle.host/privkey.pem; # managed by Certbot +} + + +server { + listen 443 ssl http2; + + server_name git.guaranteedstruggle.host; + ssl_certificate /etc/angie/ssl/git.guaranteedstruggle.host/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/angie/ssl/git.guaranteedstruggle.host/privkey.pem; # managed by Certbot + + + + location / { + # proxy_pass http://localhost:3000; + proxy_pass http://192.168.0.33:3000; + + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + +} + + +server { + listen 443 ssl ; # http2; + + server_name mail.guaranteedstruggle.host imap.guaranteedstruggle.host pop3.guaranteedstruggle.host; + #ssl_certificate /etc/angie/ssl/mail.guaranteedstruggle.host/fullchain.pem; # managed by Certbot + # ssl_certificate_key /etc/angie/ssl/mail.guaranteedstruggle.host/privkey.pem; # managed by Certbot + + location / { + #proxy_pass http://localhost:8880; + ####proxy_pass http://192.168.0.251:8080; + proxy_pass https://mail.guaranteedstruggle.host; + + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } +} + + + + + + + + +# # # # Map server names to a composite string containing certificate file, key file, and proxy pass URL +# # # map $http_host $host_config { +# # # nihil-unbound.guaranteedstruggle.host "/etc/angie/ssl/nihil-unbound.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/nihil-unbound.guaranteedstruggle.host/privkey.pem:http://default_backend"; +# # # blog.guaranteedstruggle.host "/etc/angie/ssl/blog.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/blog.guaranteedstruggle.host/privkey.pem:http://default_backend"; +# # # mail.guaranteedstruggle.host "/etc/angie/ssl/mail.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/mail.guaranteedstruggle.host/privkey.pem:http://default_backend"; +# # # pgadmin.guaranteedstruggle.host "/etc/angie/ssl/pgadmin.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/pgadmin.guaranteedstruggle.host/privkey.pem:http://pgadmin_on_swarm_cluster"; +# # # ceph-dashboard.guaranteedstruggle.host "/etc/angie/ssl/ceph-dashboard.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/ceph-dashboard.guaranteedstruggle.host/privkey.pem:http://192.168.0.71:8080"; +# # # k3s-rancher.guaranteedstruggle.host "/etc/angie/ssl/k3s-rancher.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/k3s-rancher.guaranteedstruggle.host/privkey.pem:https://192.168.0.30"; +# # # wiki.guaranteedstruggle.host "/etc/angie/ssl/wiki.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/wiki.guaranteedstruggle.host/privkey.pem:http://wikijs_on_swarm_cluster"; +# # # # portainer.guaranteedstruggle.host "/etc/angie/ssl/portainer.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/portainer.guaranteedstruggle.host/privkey.pem:https://swarm-node1.guaranteedstruggle.host:9443"; +# # # kroki.guaranteedstruggle.host "/etc/angie/ssl/kroki.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/kroki.guaranteedstruggle.host/privkey.pem:http://swarm-node1.guaranteedstruggle.host:8008"; +# # # guaranteedstruggle.host "/etc/angie/ssl/guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/guaranteedstruggle.host/privkey.pem:http://192.168.0.105"; +# # # default "/etc/angie/ssl/default/fullchain.pem:/etc/angie/ssl/default/privkey.pem:http://default_backend"; +# # # } + + +# # # # Extract SSL certificate file +# # # map $http_host $ssl_certificate_file { +# # # kroki.guaranteedstruggle.host "/etc/angie/ssl/asdf/fullchain.pem" +# # # default "/etc/angie/ssl/$http_host/fullchain.pem" +# # # } + + +# # # # Extract SSL certificate file +# # # map $host_config $ssl_certificate_file { +# # # "~^(?[^:]+):" "$certificate_file"; +# # # default "/etc/angie/ssl/default/fullchain.pem"; +# # # } + +# # # # Extract SSL certificate key file +# # # map $host_config $ssl_certificate_key_file { +# # # "~:[^:]+:(?[^:]+)$" "$key_file"; +# # # default "/etc/angie/ssl/default/privkey.pem"; +# # # } + +# # # # Extract proxy pass URL +# # # map $host_config $proxy_pass_url { +# # # "~:[^:]+:[^:]+:(?.*)$" "$proxy_url"; +# # # default "http://default_backend"; +# # # } + + +# server { +# listen 443 ssl http2; + +# server_name harbor.guaranteedstruggle.host; +# ssl_certificate /etc/angie/ssl/harbor.guaranteedstruggle.host/fullchain.pem; # managed by Certbot +# ssl_certificate_key /etc/angie/ssl/harbor.guaranteedstruggle.host/privkey.pem; # managed by Certbot + + +# location / { +# proxy_pass http://localhost:8880; + +# proxy_set_header Host $host; +# proxy_set_header X-Real-IP $remote_addr; +# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; +# proxy_set_header X-Forwarded-Proto $scheme; +# } +# } + + + + + +server { + listen 80; # http2; + + server_name mail.guaranteedstruggle.host imap.guaranteedstruggle.host pop3.guaranteedstruggle.host; + #ssl_certificate /etc/angie/ssl/mail.guaranteedstruggle.host/fullchain.pem; # managed by Certbot + # ssl_certificate_key /etc/angie/ssl/mail.guaranteedstruggle.host/privkey.pem; # managed by Certbot + + location / { + #proxy_pass http://localhost:8880; + ####proxy_pass http://192.168.0.251:8080; + proxy_pass http://192.168.0.251:8080; + + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } +} +server { + listen 80 default_server; + #default_server; + #listen [::]:80 default_server; + + server_name _; + return 302 https://$host$request_uri; + +} + + +server { + listen 8080; + server_name localhost; + #access_log /var/log/angie/host.access.log main; + + location / { + root /usr/share/angie/html; + index index.html index.htm; + } + + location /status/ { + api /status/; + allow all; + deny all; + } + + + location /console/ { + + allow all; + deny all; + + auto_redirect on; + + alias /usr/share/angie-console-light/html/; + index index.html; + + + location /console/api/ { + api /status/; + } + + location /console/api/config/ { + #auth_basic ; + #auth_basic_user_file conf/htpasswd; + api /config/; + } + } + + error_page 500 502 503 504 /50x.html; + location = /50x.html { + root /usr/share/angie/html; + } + +} \ No newline at end of file diff --git a/playbooks/software/angie.yml b/playbooks/software/angie.yml index b1f889f..788b559 100644 --- a/playbooks/software/angie.yml +++ b/playbooks/software/angie.yml @@ -41,4 +41,17 @@ name: - angie - angie-console-light - state: present \ No newline at end of file + state: present + + + + - name: Копировать конфиг Angie только если есть персональный файл + ansible.builtin.copy: + src: "files/angie.{{ inventory_hostname }}.conf" + dest: /etc/angie/http.d/default.conf + owner: root + group: root + mode: '0644' + # Проверяем, существует ли файл на мастер-ноде. Если нет — таска просто скипнется + when: query('ansible.builtin.fileglob', 'files/angie.' ~ inventory_hostname ~ '.conf') | length > 0 + notify: Restart Angie \ No newline at end of file