From ecf68bd0cf48e31b2ef409e0d747d621c9343fa8 Mon Sep 17 00:00:00 2001
From: Mark Janssen -- Sig-I/O Automatisering <mark@sig-io.nl>
Date: Thu, 18 Jul 2024 22:00:48 +0200
Subject: [PATCH] nginx role for git + music

---
 bitlair.yaml                        |  1 +
 git.yaml                            |  7 ++--
 group_vars/git.yaml                 | 10 +++++
 group_vars/music.yaml               |  2 +
 roles/mqtt-internal/tasks/main.yaml | 58 ++++++++++++++---------------
 roles/nginx/defaults/main.yaml      |  1 +
 roles/nginx/templates/site.conf.j2  |  2 +
 snippets/forgejo-nginx.j2           |  3 ++
 8 files changed, 51 insertions(+), 33 deletions(-)
 create mode 100644 snippets/forgejo-nginx.j2

diff --git a/bitlair.yaml b/bitlair.yaml
index be65660..1eed26c 100644
--- a/bitlair.yaml
+++ b/bitlair.yaml
@@ -26,6 +26,7 @@
 - hosts: git
   roles:
     - { role: "acme", tags: [ "acme" ] }
+    - { role: "nginx", tags: [ "nginx" ] }
     - { role: "git-server", tags: [ "git-server" ] }
 
 - hosts: monitoring
diff --git a/git.yaml b/git.yaml
index 2161a4c..0ae1811 100644
--- a/git.yaml
+++ b/git.yaml
@@ -2,6 +2,7 @@
 
 - hosts: git
   roles:
-    - common
-    - acme
-    - git-server
+    - { role: "common", tags: [ "common" ] }
+    - { role: "acme", tags: [ "acme" ] }
+    - { role: "nginx", tags: [ "nginx" ] }
+    - { role: "git-server", tags: [ "git-server" ] }
diff --git a/group_vars/git.yaml b/group_vars/git.yaml
index ed549a9..dd039b3 100644
--- a/group_vars/git.yaml
+++ b/group_vars/git.yaml
@@ -1,5 +1,15 @@
+---
+
 acme_domains:
   - "{{ git_server_domain }}"
 git_server_domain: git.bitlair.nl
 git_server_title: Gitlair
 git_server_bootstrap_cert: no
+
+nginx_client_max_body_size: 4G
+
+nginx_sites:
+  - server_name: "git.bitlair.nl"
+    localproxy: "9001"
+    snippets: 
+      - "forgejo-nginx.j2"
diff --git a/group_vars/music.yaml b/group_vars/music.yaml
index ee9235b..8acdf4e 100644
--- a/group_vars/music.yaml
+++ b/group_vars/music.yaml
@@ -5,6 +5,8 @@ root_access:
   - foobar
   - polyfloyd
 
+nginx_client_max_body_size: 512M
+
 music_domain: music.bitlair.nl
 acme_san_domains:
   - [ music.bitlair.nl ]
diff --git a/roles/mqtt-internal/tasks/main.yaml b/roles/mqtt-internal/tasks/main.yaml
index 371671c..89f9064 100644
--- a/roles/mqtt-internal/tasks/main.yaml
+++ b/roles/mqtt-internal/tasks/main.yaml
@@ -1,34 +1,32 @@
 ---
-- name: mqtt-internal
-  tags: mqtt_internal
-  block:
-    - name: Install dependencies
-      ansible.builtin.apt:
-        name:
-          - mosquitto
-          - avahi-daemon
 
-    - name: Install bambulab cafile
-      # openssl s_client -showcerts -connect <ip>:8883 </dev/null | sed -n -e '/-.BEGIN/,/-.END/ p'
-      ansible.builtin.copy:
-        dest: "{{ mqtt_bambulab_cafile }}"
-        content: "{{ lookup('passwordstore', 'bambulab subkey=cafile') }}"
+- name: Install dependencies
+  ansible.builtin.apt:
+    name:
+      - mosquitto
+      - avahi-daemon
 
-    - name: Configure Mosquitto
-      ansible.builtin.template:
-        src: "{{ item }}"
-        dest: "/etc/mosquitto/conf.d/{{ item }}"
-        owner: root
-        group: root
-        mode: 0644
-      notify: restart mosquitto
-      with_items:
-        - bambulab.conf
-        - internal.conf
-        - public-bridge.conf
+- name: Install bambulab cafile
+  # openssl s_client -showcerts -connect <ip>:8883 </dev/null | sed -n -e '/-.BEGIN/,/-.END/ p'
+  ansible.builtin.copy:
+    dest: "{{ mqtt_bambulab_cafile }}"
+    content: "{{ lookup('passwordstore', 'bambulab subkey=cafile') }}"
 
-    - name: Start mosquitto
-      ansible.builtin.systemd:
-        name: mosquitto
-        state: started
-        enabled: yes
+- name: Configure Mosquitto
+  ansible.builtin.template:
+    src: "{{ item }}"
+    dest: "/etc/mosquitto/conf.d/{{ item }}"
+    owner: root
+    group: root
+    mode: 0644
+  notify: restart mosquitto
+  with_items:
+    - bambulab.conf
+    - internal.conf
+    - public-bridge.conf
+
+- name: Start mosquitto
+  ansible.builtin.systemd:
+    name: mosquitto
+    state: started
+    enabled: yes
diff --git a/roles/nginx/defaults/main.yaml b/roles/nginx/defaults/main.yaml
index b9e4710..b6fd46e 100644
--- a/roles/nginx/defaults/main.yaml
+++ b/roles/nginx/defaults/main.yaml
@@ -13,4 +13,5 @@ nginx_tls_session_timeout:  "1h"
 nginx_ssl_stapling:         "on"
 nginx_ssl_stapling_verify:  "on"
 nginx_wk_acme:              "/var/lib/dehydrated/acme-challenges"
+nginx_client_max_body_size: "32m"
 
diff --git a/roles/nginx/templates/site.conf.j2 b/roles/nginx/templates/site.conf.j2
index f0fec0c..6a4dfb7 100644
--- a/roles/nginx/templates/site.conf.j2
+++ b/roles/nginx/templates/site.conf.j2
@@ -10,6 +10,8 @@ server {
     ssl_certificate        /var/lib/dehydrated/certs/{{ site.server_name }}/fullchain.pem;
     ssl_certificate_key    /var/lib/dehydrated/certs/{{ site.server_name }}/privkey.pem;
 
+    client_max_body_size {{ nginx_client_max_body_size }};
+
     location ~ /\.ht {
         deny all;
     }
diff --git a/snippets/forgejo-nginx.j2 b/snippets/forgejo-nginx.j2
new file mode 100644
index 0000000..20d5d89
--- /dev/null
+++ b/snippets/forgejo-nginx.j2
@@ -0,0 +1,3 @@
+location ~* \.keys$ {
+    deny all;
+}