Skip to content
This repository was archived by the owner on Nov 9, 2023. It is now read-only.

Commit 7a5c4e7

Browse files
lberrymagelberrymage
committed
ansible: Add reposerver setup
1 parent 00194de commit 7a5c4e7

File tree

3 files changed

+190
-0
lines changed

3 files changed

+190
-0
lines changed

‎ansible/main.yaml

+59
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,43 @@
100100
enabled: yes
101101
state: started
102102

103+
- name: Set up reposerver
104+
hosts: repos
105+
become: yes
106+
tasks:
107+
- name: Create application user
108+
ansible.builtin.user:
109+
name: reposerver
110+
create_home: false
111+
password: '!'
112+
shell: /usr/sbin/nologin
113+
umask: 0077
114+
- name: Install application
115+
ansible.builtin.copy:
116+
src: ./reposerver
117+
dest: /opt/reposerver/
118+
mode: 755
119+
- name: Allow nginx to read static files
120+
community.general.sefcontext:
121+
target: '/srv/staging.store.accrescent.app(/.*)?'
122+
setype: httpd_sys_content_t
123+
- name: Create static file directory
124+
ansible.builtin.file:
125+
path: /srv/staging.store.accrescent.app
126+
state: directory
127+
owner: reposerver
128+
group: reposerver
129+
mode: 0755
130+
- name: Install systemd service
131+
ansible.builtin.copy:
132+
src: ./reposerver.service
133+
dest: /usr/lib/systemd/system/reposerver.service
134+
- name: Enable and start systemd service
135+
ansible.builtin.systemd:
136+
name: reposerver
137+
enabled: yes
138+
state: started
139+
103140
- name: Set up nginx
104141
hosts: all
105142
become: yes
@@ -135,3 +172,25 @@
135172
ansible.builtin.systemd:
136173
name: nginx
137174
state: reloaded
175+
176+
- name: Set up nginx for reposerver
177+
hosts: repos
178+
become: yes
179+
tasks:
180+
- name: Allow nginx proxying
181+
ansible.posix.seboolean:
182+
name: httpd_can_network_connect
183+
persistent: yes
184+
state: yes
185+
- name: Install root config
186+
ansible.builtin.copy:
187+
src: nginx/reposerver.conf
188+
dest: /etc/nginx/nginx.conf
189+
- name: Install security config
190+
ansible.builtin.copy:
191+
src: nginx/security.conf
192+
dest: /etc/nginx/security.conf
193+
- name: Reload nginx
194+
ansible.builtin.systemd:
195+
name: nginx
196+
state: reloaded

‎ansible/nginx/reposerver.conf

+95
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
worker_processes auto;
2+
worker_rlimit_nofile 16384;
3+
4+
events {
5+
worker_connections 4096;
6+
}
7+
8+
http {
9+
include mime.types;
10+
default_type application/octet-stream;
11+
12+
charset utf-8;
13+
14+
sendfile on;
15+
sendfile_max_chunk 512k;
16+
tcp_nopush on;
17+
keepalive_timeout 3m;
18+
server_tokens off;
19+
msie_padding off;
20+
21+
client_max_body_size 1k;
22+
client_body_buffer_size 1k;
23+
client_header_buffer_size 1k;
24+
large_client_header_buffers 4 4k;
25+
http2_recv_buffer_size 128k;
26+
27+
client_body_timeout 30s;
28+
client_header_timeout 30s;
29+
send_timeout 30s;
30+
31+
http2_max_concurrent_streams 32;
32+
33+
ssl_protocols TLSv1.2 TLSv1.3;
34+
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256;
35+
ssl_prefer_server_ciphers on;
36+
ssl_conf_command Options PrioritizeChaCha;
37+
38+
ssl_certificate /etc/letsencrypt/live/staging.store.accrescent.app/fullchain.pem;
39+
ssl_certificate_key /etc/letsencrypt/live/staging.store.accrescent.app/privkey.pem;
40+
41+
ssl_session_cache shared:SSL:10m;
42+
ssl_session_timeout 1d;
43+
ssl_buffer_size 4k;
44+
45+
log_format main '$remote_addr - $remote_user [$time_local] '
46+
'"$request_method $scheme://$host$request_uri $server_protocol" $status $body_bytes_sent '
47+
'"$http_referer" "$http_user_agent"';
48+
access_log syslog:server=unix:/dev/log,nohostname main;
49+
error_log syslog:server=unix:/dev/log,nohostname;
50+
log_not_found off;
51+
52+
gzip_proxied any;
53+
gzip_vary on;
54+
55+
if_modified_since before;
56+
57+
aio threads;
58+
aio_write on;
59+
60+
upstream backend {
61+
server [::1]:8080 max_conns=1024 fail_timeout=1s;
62+
}
63+
64+
server {
65+
listen 80;
66+
listen [::]:80;
67+
server_name staging.store.accrescent.app;
68+
69+
root /var/empty;
70+
71+
return 301 https://$host$request_uri;
72+
}
73+
74+
server {
75+
listen 443 ssl http2;
76+
listen [::]:443 ssl http2;
77+
server_name staging.store.accrescent.app;
78+
79+
include security.conf;
80+
gzip_static on;
81+
82+
location /.well-known/acme-challenge/ {
83+
root /srv/certbot;
84+
}
85+
86+
location /api/apps {
87+
client_max_body_size 128M;
88+
proxy_pass http://backend;
89+
}
90+
91+
location / {
92+
root /srv/staging.store.accrescent.app;
93+
}
94+
}
95+
}

‎ansible/reposerver.service

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
[Unit]
2+
Description=Accrescent repo server
3+
4+
[Service]
5+
Environment="GIN_MODE=release"
6+
ExecStart=/opt/reposerver/reposerver
7+
WorkingDirectory=/srv/staging.store.accrescent.app
8+
9+
CapabilityBoundingSet=
10+
LockPersonality=yes
11+
MemoryDenyWriteExecute=yes
12+
NoNewPrivileges=yes
13+
PrivateDevices=yes
14+
PrivateTmp=yes
15+
PrivateUsers=yes
16+
ProtectClock=yes
17+
ProtectControlGroups=yes
18+
ProtectHome=yes
19+
ProtectHostname=yes
20+
ProtectKernelLogs=yes
21+
ProtectKernelModules=yes
22+
ProtectKernelTunables=yes
23+
ProtectProc=invisible
24+
ProtectSystem=strict
25+
ReadWritePaths=/srv/staging.store.accrescent.app
26+
RemoveIPC=yes
27+
RestrictAddressFamilies=AF_INET AF_INET6
28+
RestrictNamespaces=yes
29+
RestrictRealtime=yes
30+
RestrictSUIDSGID=yes
31+
SystemCallArchitectures=native
32+
UMask=0022
33+
User=reposerver
34+
35+
[Install]
36+
WantedBy=multi-user.target

0 commit comments

Comments
 (0)