First commit

roles/nginx/templates/vhosts/analyse.nintendojo.fr.conf.j2

@@ -0,0 +1,33 @@
+server {
+{% include './templates/header.conf.j2' %}
+	
+	root /srv/http/analyse.nintendojo.fr/;
+	index index.html index.htm index.php;
+	
+	location ~ ^/(status|ping|apc_info.php)$ {
+		access_log off;
+		fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+		include fastcgi_params;
+		fastcgi_pass unix:/var/run/php/php{{ php_version }}-fpm.sock;
+	}
+	
+	location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
+		expires 2w;
+		log_not_found off;
+	}
+	
+	location ~ \.htaccess$ {
+		deny all;
+	}
+	
+	location ~ ^/tmp {
+		deny all;
+	}
+	
+	location ~ \.php$ {
+		try_files $uri $uri/ =404;
+		fastcgi_pass unix:/var/run/php/php{{ php_version }}-fpm.sock;
+		include fastcgi_params;
+	}
+}
+

roles/nginx/templates/vhosts/blog.libertus.eu.conf.j2

@@ -0,0 +1,40 @@
+server {
+{% include './templates/header.conf.j2' %}
+	root /srv/http/blog.libertus.eu/;
+	index index.html index.htm index.php;
+	
+	## Optimisation des images
+	location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
+		expires 2w;
+		log_not_found off;
+	}
+	
+	## blocage équivalent HTTPS
+	location ~ (\.htaccess|\.inc)$ {
+		deny all;
+	}
+	
+	location ~ ^/(inc|plugins|db|cache)/ {
+		deny all;
+	}
+	
+	## Inter PHP en path_info
+	location ~ ^/(index).php(/.*)+ {
+		fastcgi_split_path_info ^(.+\.php)(/.*)$;
+		fastcgi_pass unix:/var/run/php/php{{ php_version }}-fpm.sock;
+		include fastcgi_params;
+	}
+	
+	## Inter PHP brute
+	location ~ \.php$ {
+		try_files $uri $uri/ =404;
+		fastcgi_pass unix:/var/run/php/php{{ php_version }}-fpm.sock;
+		include fastcgi_params;
+	}
+	
+	## redirection des zolies URLs vers index.php
+	location / {
+		try_files $uri $uri/ /index.php$uri?$args;
+	}
+}
+

roles/nginx/templates/vhosts/bt.mateu.be.conf.j2

@@ -0,0 +1,8 @@
+server {
+{% include './templates/header.conf.j2' %}
+	
+	location / {
+		proxy_pass http://127.0.0.1:9091;
+	}
+}
+

roles/nginx/templates/vhosts/btf.mateu.be.conf.j2

@@ -0,0 +1,12 @@
+server {
+{% include './templates/header.conf.j2' %}
+	location / {
+		root /var/lib/transmission-daemon/downloads/;
+		autoindex on;
+		allow 2a01:cb0c:8516:7f00::/64;
+		allow 83.167.52.81;
+		allow 2001:1b48:2:103::/64;
+		allow 2001:bc8:26c1:101::/64;
+		deny all;
+	}
+}

roles/nginx/templates/vhosts/coince.mateu.be.conf.j2

@@ -0,0 +1,22 @@
+server {
+{% include './templates/header.conf.j2' %}
+	root /srv/http/coince.mateu.be/;
+	index index.htm index.html index.php;
+
+	allow 2001:bc8:26c1:101:0:0:0:0/64;
+	allow 2001:bc8:26c1:105:0:0:0:0/64;
+	allow 2001:1b48:2:103::6d:2;
+	allow 83.167.52.81;
+	deny all;
+	
+	location ~ \.php$ {
+		try_files $uri $uri/ =404;
+		fastcgi_pass unix:/var/run/php/php{{ php_version }}-fpm.sock;
+		include fastcgi_params;
+	}
+	
+	location /var {
+		deny all;
+	}
+}
+

roles/nginx/templates/vhosts/fav.libertus.eu.conf.j2

@@ -0,0 +1,22 @@
+## Shaarli
+server {
+{% include './templates/header.conf.j2' %}
+	root /srv/http/fav.libertus.eu/;
+	index index.html index.htm index.php;
+	
+	location ^/(cache|data)/ {
+		deny all;
+	}
+	
+	location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
+                expires 2w;
+                log_not_found off;
+        }
+	
+	location ~ \.php$ {
+		try_files $uri $uri/ =404;
+		fastcgi_pass unix:/var/run/php/php{{ php_version }}-fpm.sock;
+		include fastcgi_params;
+	}
+}
+

roles/nginx/templates/vhosts/forum.nintendojo.fr.conf.j2

@@ -0,0 +1,38 @@
+server {
+{% include './templates/header.conf.j2' %}
+	root /srv/http/forum.nintendojo.fr/;
+	index index.html index.htm index.php;
+	
+	client_max_body_size 10M;
+	
+	location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
+		expires 2w;
+		log_not_found off;
+	}
+	
+	location ~ \.htaccess$ {
+		deny all;
+	}
+	
+	location ~ ^/(files|store|cache|images/avatars/upload)/ {
+		deny all;
+	}
+	
+	location ~ ^/(config|common)\.php$ {
+		deny all;
+	}
+
+	location ~ /(app).php(/.*)+ {
+		fastcgi_split_path_info ^(.+\.php)(/.*)$;
+		fastcgi_pass unix:/var/run/php/php{{ php_version }}-fpm.sock;
+		fastcgi_read_timeout 60;
+		include fastcgi_params;
+	}
+	
+	location ~ \.php$ {
+		try_files $uri $uri/ =404;
+		fastcgi_pass unix:/var/run/php/php{{ php_version }}-fpm.sock;
+		include fastcgi_params;
+	}
+}
+

roles/nginx/templates/vhosts/m.nintendojo.fr.conf.j2

@@ -0,0 +1,61 @@
+map $http_upgrade $connection_upgrade {
+	default upgrade;
+	''      close;
+}
+
+server {
+{% include './templates/header.conf.j2' %}
+	keepalive_timeout    70;
+	sendfile             on;
+	client_max_body_size 0;
+	large_client_header_buffers 4 32k;
+
+	# Referrer-Policy, même si Chrome ne comprendra pas
+	add_header Referrer-Policy "same-origin";
+
+	location / {
+		try_files $uri @proxy;
+	}
+
+	location @proxy {
+		proxy_pass http://localhost:3000;
+		
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto https;
+		
+		proxy_set_header Proxy "";
+		proxy_pass_header Server;
+		
+		proxy_buffering off;
+		proxy_redirect off;
+		
+		proxy_http_version 1.1;
+		proxy_set_header Upgrade $http_upgrade;
+		proxy_set_header Connection $connection_upgrade;
+		
+		tcp_nodelay on;
+	}
+
+	location /api/v1/streaming {
+		proxy_pass http://localhost:4000;
+		
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto https;
+		
+		proxy_set_header Proxy "";
+		
+		proxy_buffering off;
+		proxy_redirect off;
+		
+		proxy_http_version 1.1;
+		proxy_set_header Upgrade $http_upgrade;
+		proxy_set_header Connection $connection_upgrade;
+		
+		tcp_nodelay on;
+	}
+}
+

roles/nginx/templates/vhosts/mail.libertus.eu.conf.j2

@@ -0,0 +1,40 @@
+server {
+{% include './templates/header.conf.j2' %}
+	root /srv/http/mail.libertus.eu/;
+	index index.html index.htm index.php;
+
+	client_max_body_size 512M;
+	
+	location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
+		expires 2w;
+		log_not_found off;
+	}
+	
+	## Dossiers et fichiers interdits d'accès
+	location ~ (README|INSTALL|LICENSE|SQL|bin|CHANGELOG|\.htaccess|\.inc)$ {
+		deny all;
+	}
+	location ~ ^/(config|logs|temp) {
+		deny all;
+	}
+	location ~ ^/program/js {
+		#autorise le dossier program/js
+	}
+	location ~ ^/program/.*\.gif$ {
+		#autorise les gifs du dossier program
+	}
+	location ~ ^/program {
+		deny all;
+	}
+	
+	location = /favicon.ico {
+		rewrite ^(.*)$ skins/default/images/favicon.ico;
+	}
+	
+	location ~ \.php$ {
+		try_files $uri $uri/ =404;
+		fastcgi_pass unix:/var/run/php/php{{ php_version }}-fpm.sock;
+		include fastcgi_params;
+	}
+}
+

roles/nginx/templates/vhosts/o.libertus.eu.conf.j2

@@ -0,0 +1,82 @@
+server {
+{% include './templates/header.conf.j2' %}
+	
+	add_header X-Content-Type-Options nosniff;
+	add_header X-XSS-Protection "1; mode=block";
+	add_header X-Robots-Tag none;
+	add_header X-Download-Options noopen;
+	add_header X-Permitted-Cross-Domain-Policies none;
+	
+	fastcgi_hide_header X-Powered-By;
+	
+	root /srv/http/o.libertus.eu/;
+
+	location = /robots.txt {
+		allow all;
+		log_not_found off;
+		access_log off;
+	}
+	
+	location = /.well-known/carddav {
+		return 301 $scheme://$host/remote.php/dav;
+	}
+	
+	location /.well-known/caldav {
+		return 301 $scheme://$host/remote.php/dav;
+	}
+	
+	client_max_body_size 1000M;
+	fastcgi_buffers 64 4k;
+	
+	# Avoid E-Tag error on text file
+	gzip on;
+	gzip_vary on;
+	gzip_comp_level 4;
+	gzip_min_length 256;
+	gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
+	gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
+
+	location / {
+		rewrite ^ /index.php$request_uri;
+	}
+	
+	location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
+		deny all;
+	}
+
+	location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
+		deny all;
+	}
+	
+	location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\.php(?:$|/) {
+		fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+		fastcgi_param modHeadersAvailable true;
+		fastcgi_param front_controller_active true;
+		fastcgi_intercept_errors on;
+		fastcgi_request_buffering off;
+		fastcgi_pass unix:/var/run/php/php{{ php_version }}-fpm-oc.sock;
+		include fastcgi_params;
+	}
+
+	location ~ ^/(?:updater|ocs-provider)(?:$|/) {
+		try_files $uri/ =404;
+		index index.php;
+	}
+	
+	location ~* \.(?:css|js|woff|svg|gif)$ {
+		try_files $uri /index.php$request_uri;
+		add_header Cache-Control "public, max-age=15778463";
+		add_header X-Content-Type-Options nosniff;
+		add_header X-XSS-Protection "1; mode=block";
+		add_header X-Robots-Tag none;
+		add_header X-Download-Options noopen;
+		add_header X-Permitted-Cross-Domain-Policies none;
+		access_log off;
+	}
+	
+	location ~* \.(?:png|html|ttf|ico|jpg|jpeg)$ {
+		try_files $uri /index.php$request_uri;
+		access_log off;
+	}
+}
+

roles/nginx/templates/vhosts/r.mateu.be.conf.j2

@@ -0,0 +1,25 @@
+server {
+	listen *:443 ssl http2;
+	listen [::]:443 ssl http2;
+
+	server_name r.mateu.be perso.nintendojo.fr perso.libertus.eu;
+	access_log /var/log/nginx/r.mateu.be.access.log combined_port;
+	error_log /var/log/nginx/r.mateu.be.error.log;
+	ssl_certificate /etc/x509/r.mateu.be/fullchain.cer;
+	ssl_certificate_key /etc/x509/r.mateu.be/r.mateu.be.key;
+
+	root /srv/http/r.mateu.be/;
+
+	location / {
+		autoindex on;
+	}
+
+	location ~ ^/~mortal/(.*)$ {
+		return 301 https://r.mateu.be/$1;
+	}
+
+	location ~ ^/~clement\.veret/(.*)$ {
+		return 301 https://r.mateu.be/$1;
+	}
+}
+

roles/nginx/templates/vhosts/rss.libertus.eu.conf.j2

@@ -0,0 +1,20 @@
+server {
+{% include './templates/header.conf.j2' %}
+	root /srv/http/rss.libertus.eu/;
+	index index.html index.htm index.php;
+	
+	location ~ \.(js|css|png|jpg|jpeg|gif|svg|svgz)$ {
+		expires 2w;
+		log_not_found off;
+	}
+	
+	location ~ /\.git {
+		deny all;
+	}
+	
+	location ~ \.php$ {
+		try_files $uri $uri/ =404;
+		fastcgi_pass unix:/var/run/php/php{{ php_version }}-fpm.sock;
+		include fastcgi_params;
+	}
+}

roles/nginx/templates/vhosts/sonarr.mateu.be.conf.j2

@@ -0,0 +1,8 @@
+server {
+{% include './templates/header.conf.j2' %}
+	
+	location / {
+		proxy_pass http://localhost:8989;
+	}
+}
+

roles/nginx/templates/vhosts/www.intendo.fr.conf.j2

@@ -0,0 +1,14 @@
+server {
+	listen *:443 ssl http2;
+	listen [::]:443 ssl http2;
+	ssl_certificate /etc/x509/intendo.fr/fullchain.cer;
+	ssl_certificate_key /etc/x509/intendo.fr/intendo.fr.key;
+	server_name intendo.fr www.intendo.fr;
+	access_log /var/log/intendo.fr.access.log combined_port;
+	error_log /var/log/intendo.fr.error.log;
+	
+	location / {
+		return 302 https://www.nintendojo.fr$request_uri;
+	}
+}
+

roles/nginx/templates/vhosts/www.nintendojo.fr.conf.j2

@@ -0,0 +1,83 @@
+## WP NintendojoFR
+server {
+	listen *:443 ssl http2;
+	listen [::]:443 ssl http2;
+	server_name nintendojo.fr www.nintendojo.fr;
+	access_log /var/log/nginx/nintendojo.fr.access.log combined_port;
+	error_log /var/log/nginx/nintendojo.fr.error.log;
+	ssl_certificate /etc/x509/www.nintendojo.fr/fullchain.cer;
+	ssl_certificate_key /etc/x509/www.nintendojo.fr/www.nintendojo.fr.key;
+
+	root /srv/http/www.nintendojo.fr/;
+	index index.html index.htm index.php;
+
+	client_max_body_size 2G;
+
+	# couper les fichiers cachés
+	location ~* /(?:uploads|files)/.*\.php$ {
+		deny all;
+	}
+
+	# couper les fichiers textes du captcha
+	location ~* /wp-content/uploads/wpcf7_captcha/.*\.txt$ {
+		deny all;
+	}
+
+	# Images de la v6
+	location ~ ^/images/(.*)$ {
+		expires 2w;
+		alias /srv/http/archives.nintendojo.fr/v6/images/$1;
+	}
+
+	# Images de la v6.7
+	location ~ ^/public/(.*)$ {
+		expires 2w;
+		alias /srv/http/archives.nintendojo.fr/$1;
+	}
+
+	# Zolie tweet
+	location /tweet {
+		rewrite ^/tweet/([0-9]+)$ /index.php/tweet/?id=$1 last;
+		rewrite ^/tweet/embed/([0-9]+)$ /index.php/tweetembed/?id=$1 last;
+		return 403;
+	}
+
+	# Zolie wallpapers
+	location /wallpapers {
+		rewrite ^/wallpapers$ /index.php/wallpapers last;
+		rewrite ^/wallpapers/([0-9]+) /index.php/wallpapers/?id=$1 last;
+		location ~ ^/wallpapers/files(.*)(/.*\.jpg)$ {
+			expires 1w;
+			alias /srv/http/www.nintendojo.fr/wp-content/plugins/dojomurpapier/files$2;
+		}
+	}
+
+	# Optimisation des images
+	location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
+		expires 1w;
+		log_not_found off;
+	}
+
+	# Interprétation PHP
+	location ~ ^/(index).php(/.*)+ {
+		fastcgi_split_path_info ^(.+\.php)(/.*)$;
+		fastcgi_cache wpdojo;
+		fastcgi_cache_key $request_method$host$request_uri;
+		fastcgi_cache_valid any 15m;
+		fastcgi_ignore_headers Cache-Control Expires Set-Cookie;
+		fastcgi_pass unix:/var/run/php/php{{ php_version }}-fpm.sock;
+		fastcgi_read_timeout 60;
+		include fastcgi_params;
+	}
+
+	location ~ \.php$ {
+		try_files $uri $uri/ =404;
+		fastcgi_pass unix:/var/run/php/php{{ php_version }}-fpm.sock;
+		fastcgi_read_timeout 60;
+		include fastcgi_params;
+	}
+
+	location / {
+		try_files $uri $uri/ /index.php$uri?$args;
+	}
+}