post home assistant update

2024-05-22 08:48:51 -04:00
parent 5940c16d91
commit eb934c32e2
37 changed files with 1077 additions and 731 deletions
--- a/nginx/README.md
+++ b/nginx/README.md
@@ -5,8 +5,9 @@
 Check vars.yaml to edit your servers.

 ```bash
-ansible-playbook -i ansible/inventory.yaml nginx/nginx.yaml
+# Run certbot first to ensure certs exist
 ansible-playbook -i ansible/inventory.yaml nginx/certbot.yaml
+ansible-playbook -i ansible/inventory.yaml nginx/nginx.yaml
 ```

 ## Restricted Addresses
--- a/nginx/_generate_certs.yaml
+++ b/nginx/_generate_certs.yaml
@@ -1,8 +0,0 @@
- name: Generate placeholder letsencrypt certs for domains if needed
-  block:
-  - name: check if fullchain already exists
-    stat: path=/etc/letsencrypt/live/{{ item.external }}/fullchain.pem
-    register: p
-  - name: Generate self signed cert
-    shell: openssl req -x509 -newkey rsa:4096 -keyout /etc/letsencrypt/live/{{ item.external }}/privkey.pem -out /etc/letsencrypt/live/{{ item.external }}/fullchain.pem -sha256 -days 3650 -nodes -subj "/C=US/ST=Ohio/L=Columbus/O=ducoterra/OU=ducoterra/CN={{ item.external }}"
-    when: not p.stat.exists
--- a/nginx/certbot.yaml
+++ b/nginx/certbot.yaml
@@ -16,9 +16,12 @@
    ansible.builtin.systemd_service:
      state: stopped
      name: nginx
-  - name: Get certs for all terminate domains
-    ansible.builtin.shell: /usr/bin/certbot certonly --standalone -d '{{ item.external_domain }}' -n
-    loop: "{{ terminate_ssl }}"
+  - name: Get certs for all reeseapps domains
+    ansible.builtin.shell: /usr/bin/certbot certonly --standalone -d '{{ item.external.domain }}' -n
+    loop: "{{ reeseapps }}"
+  - name: Get certs for all reeseseal domains
+    ansible.builtin.shell: /usr/bin/certbot certonly --dns-route53 -d '{{ item.external.domain }}' -n
+    loop: "{{ reeseseal }}"
  - name: Start nginx service
    ansible.builtin.systemd_service:
      state: started
--- a/nginx/https.conf
+++ b/nginx/https.conf
@@ -6,20 +6,17 @@ map $http_upgrade $connection_upgrade {
 server {

    listen 127.0.0.1:443 ssl http2;
+    # listen 127.0.0.1:443 ssl;      # for nginx v1.25.1+

    server_name {{ item.external.domain }};

    access_log /var/log/nginx/{{ item.external.domain }}-access.log compression;

-    # listen 443 ssl http2;      # for nginx versions below v1.25.1
-    # listen [::]:443 ssl http2; # for nginx versions below v1.25.1 - comment to disable IPv6
-	
    # http2 on;                                 # uncomment to enable HTTP/2        - supported on nginx v1.25.1+
    # http3 on;                                 # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
    # quic_retry on;                            # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
    # add_header Alt-Svc 'h3=":443"; ma=86400'; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
-    # listen 8443 quic reuseport;       # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - please remove "reuseport" if there is already another quic listener on port 443 with enabled reuseport
-    # listen [::]:8443 quic reuseport;  # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - please remove "reuseport" if there is already another quic listener on port 443 with enabled reuseport - keep comment to disable IPv6
+    # listen 443 quic reuseport;       # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - please remove "reuseport" if there is already another quic listener on port 443 with enabled reuseport

    location / {
        resolver 1.1.1.1;
@@ -53,4 +50,14 @@ server {
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
    ssl_prefer_server_ciphers on;
+
+    # Optional settings:
+
+    # OCSP stapling
+    # ssl_stapling on;
+    # ssl_stapling_verify on;
+    # ssl_trusted_certificate /etc/letsencrypt/live/<your-nc-domain>/chain.pem;
+
+    # replace with the IP address of your resolver
+    # resolver 127.0.0.1; # needed for oscp stapling: e.g. use 94.140.15.15 for adguard / 1.1.1.1 for cloudflared or 8.8.8.8 for google - you can use the same nameserver as listed in your /etc/resolv.conf file
 }
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -5,14 +5,14 @@ worker_processes 8;
 events {}

 stream {
-    log_format basic '$remote_addr $restricted_domain [$time_local] '
+    log_format basic '$remote_addr $domain [$time_local] '
                 '$protocol $status $bytes_sent $bytes_received '
                 '$session_time';

    include /etc/nginx/stream.d/*.conf;

    # Map all SSL parsed server names to hosts
-    map $ssl_preread_server_name $unrestricted_domain {
+    map $ssl_preread_server_name $domain {

        "" 127.0.0.1:443;

@@ -22,26 +22,11 @@ stream {
        {% endfor %}

        # For each domain we want to terminate, forward to internal http server
-        {% for domain in terminate_ssl %}
-        {% if not domain.restricted %}
+        {% for domain in reeseapps %}
        {{ domain.external.domain }} 127.0.0.1:443;
-        {% endif %}
        {% endfor %}

-        default {{ nginx.defaults.domain }}:443;
-    }
-
-    map $ssl_preread_server_name $restricted_domain {
-
-        "" 127.0.0.1:443;
-
-        # For each domain we need to stream to a remote server, forward to internal domain
-        {% for domain in stream_ssl %}
-        {{ domain.external.domain }} {{ domain.internal.domain }}:{{ domain.internal.port }};
-        {% endfor %}
-
-        # For each domain we want to terminate, forward to internal http server
-        {% for domain in terminate_ssl %}
+        {% for domain in reeseseal %}
        {{ domain.external.domain }} 127.0.0.1:443;
        {% endfor %}

@@ -53,17 +38,7 @@ stream {
        access_log /var/log/nginx/stream-access-443.log basic;
        listen {{ ansible_default_ipv4.address }}:443;
        resolver 1.1.1.1;
-        proxy_pass $restricted_domain;
-        ssl_preread on;
-        proxy_socket_keepalive on;
-    }
-
-    # Forward 444 (restricted) traffic
-    server {
-        access_log /var/log/nginx/stream-access-444.log basic;
-        listen {{ ansible_default_ipv4.address }}:444;
-        resolver 1.1.1.1;
-        proxy_pass $unrestricted_domain;
+        proxy_pass $domain;
        ssl_preread on;
        proxy_socket_keepalive on;
    }
--- a/nginx/nginx.yaml
+++ b/nginx/nginx.yaml
@@ -55,14 +55,22 @@
      mode: '0644'
    with_fileglob:
    - http.d/*
-  - name: Template all http configurations
+  - name: Template all reeseapps http configurations
    template:
      src: https.conf
      dest: /etc/nginx/http.d/{{ item.external.domain }}.conf
      owner: root
      group: root
      mode: '0644'
-    with_items: "{{ terminate_ssl }}"
+    with_items: "{{ reeseapps }}"
+  - name: Template all reeseseal http configurations
+    template:
+      src: https.conf
+      dest: /etc/nginx/http.d/{{ item.external.domain }}.conf
+      owner: root
+      group: root
+      mode: '0644'
+    with_items: "{{ reeseseal }}"
  - name: Reload nginx service
    ansible.builtin.systemd_service:
      state: restarted
--- a/nginx/vars.yaml
+++ b/nginx/vars.yaml
@@ -1,89 +1,3 @@
-terminate_ssl:
-  - external:
-      domain: octoprint.reeseapps.com
-      port: 443
-    internal:
-      domain: replicator.reeselink.com
-      port: 443
-      protocol: https
-    restricted: true
-  - external:
-      domain: truenas.reeseapps.com
-      port: 443
-    internal:
-      domain: driveripper.reeselink.com
-      port: 8443
-      protocol: https
-    restricted: false
-  - external:
-      domain: pihole-yellow.reeseapps.com
-      port: 443
-    internal:
-      domain: yellow.reeselink.com
-      port: 8081
-      protocol: http
-    restricted: true
-  - external:
-      domain: pihole-orange.reeseapps.com
-      port: 443
-    internal:
-      domain: orange.reeselink.com
-      port: 8081
-      protocol: http
-    restricted: true
-  - external:
-      domain: yellow.reeseapps.com
-      port: 443
-    internal:
-      domain: yellow.reeselink.com
-      port: 9090
-      protocol: https
-    restricted: true
-  - external:
-      domain: orange.reeseapps.com
-      port: 443
-    internal:
-      domain: orange.reeselink.com
-      port: 9090
-      protocol: https
-    restricted: true
-  - external:
-      domain: node1.reeseapps.com
-      port: 443
-    internal:
-      domain: node1.reeselink.com
-      port: 9090
-      protocol: https
-    restricted: true
-  - external:
-      domain: node2.reeseapps.com
-      port: 443
-    internal:
-      domain: node2.reeselink.com
-      port: 9090
-      protocol: https
-    restricted: true
-  - external:
-      domain: node3.reeseapps.com
-      port: 443
-    internal:
-      domain: node3.reeselink.com
-      port: 9090
-      protocol: https
-    restricted: true
-stream_ssl:
-  - external:
-      domain: nextcloud-aio.reeseapps.com
-      port: 443
-    internal:
-      domain: nextcloud-aio.reeselink.com
-      port: 443
-  - external:
-      domain: containers.reeseapps.com
-      port: 443
-    internal:
-      domain: node1.reeselink.com
-      port: 6443
 nextcloud:
  domain: nextcloud-aio.reeseapps.com
 nginx:
@@ -94,3 +8,113 @@ iperf:
 unifi_external:
  domain: unifi-server1.reeselink.com
 internal_ip: 10.1.0.0/16
+
+reeseapps:
+  - external:
+      domain: truenas.reeseapps.com
+      port: 443
+    internal:
+      domain: driveripper.reeselink.com
+      port: 8443
+      protocol: https
+  - external:
+      domain: nextcloud-aio.reeseapps.com
+      port: 443
+    internal:
+      domain: nextcloud-aio.reeselink.com
+      port: 11000
+      protocol: http
+  - external:
+      domain: homeassistant.reeseapps.com
+      port: 443
+    internal:
+      domain: homeassistant.reeselink.com
+      port: 8123
+      protocol: https
+
+reeseseal:
+  - external:
+      domain: cr10se.reeseseal.com
+      port: 443
+    internal:
+      domain: cr10se.reeselink.com
+      port: 80
+      protocol: http
+  - external:
+      domain: hue.reeseseal.com
+      port: 443
+    internal:
+      domain: nginx.reeselink.com
+      port: 80
+      protocol: http
+  - external:
+      domain: nextcloud-aio.reeseseal.com
+      port: 443
+    internal:
+      domain: nextcloud-aio.reeselink.com
+      port: 11000
+      protocol: http
+  - external:
+      domain: octoprint.reeseseal.com
+      port: 443
+    internal:
+      domain: replicator.reeselink.com
+      port: 443
+      protocol: https
+  - external:
+      domain: pihole-yellow.reeseseal.com
+      port: 443
+    internal:
+      domain: yellow.reeselink.com
+      port: 8081
+      protocol: http
+  - external:
+      domain: pihole-orange.reeseseal.com
+      port: 443
+    internal:
+      domain: orange.reeselink.com
+      port: 8081
+      protocol: http
+  - external:
+      domain: yellow.reeseseal.com
+      port: 443
+    internal:
+      domain: yellow.reeselink.com
+      port: 9090
+      protocol: https
+  - external:
+      domain: orange.reeseseal.com
+      port: 443
+    internal:
+      domain: orange.reeselink.com
+      port: 9090
+      protocol: https
+  - external:
+      domain: node1.reeseseal.com
+      port: 443
+    internal:
+      domain: node1.reeselink.com
+      port: 9090
+      protocol: https
+  - external:
+      domain: node2.reeseseal.com
+      port: 443
+    internal:
+      domain: node2.reeselink.com
+      port: 9090
+      protocol: https
+  - external:
+      domain: node3.reeseseal.com
+      port: 443
+    internal:
+      domain: node3.reeselink.com
+      port: 9090
+      protocol: https
+
+stream_ssl:
+  - external:
+      domain: containers.reeseapps.com
+      port: 443
+    internal:
+      domain: node1.reeselink.com
+      port: 6443