testing

.gitignore

@@ -1,13 +1,3 @@
 .vagrant
 .playbook
-/*.yml
-/*.yaml
-!backup.yml
-!moxie.yml
-!docker.yml
-!dockerbox.yml
-!hypervisor.yml
-!minecraft.yml
-!proxy.yml
-!unifi.yml
 /environments/

README.md

@@ -1,25 +1,39 @@
-# Project Moxie
+# Homelab
+This repository contains Ansible to automate Debian GNU/Linux servers, deploying
+server technologies that are either useful in a personal capacity or provide
+educational value on automating enterprise infrastructure.
 
-Project Moxie is a personal IT homelab project written in Ansible and executed by Jenkins. It is a growing collection of infrastructure as code (IaC) I write out of curiosity and for reference purposes, keeping a handful of beneficial projects managed and secured.
+Development is accomplished using Vagrant to allow easy reproducibility in an
+isolated virtual environment that be ran on your local machine.
 
 ## Quick Start
-
+These steps assume a basic understanding of GNU/Linux, Hypervisors, Vagrant, and Ansible.
-To configure a local virtual machine for testing, follow these simple steps.
 
 ### Prerequisites
-
+- [Vagrant](https://developer.hashicorp.com/vagrant/docs/installation)
-Vagrant and VirtualBox are used to develop Project Moxie. You will need to install these before continuing.
+- [Supported hypervisor](https://developer.hashicorp.com/vagrant/docs/providers)
+- Ansible
 
 ### Installation
 
 1. Clone this repository
    ```
-   git clone https://github.com/krislamo/moxie
+   git clone https://git.krislamo.org/kris/homelab
+   ```
+   OR download from the mirror on GitHub:
+   ```
+   git clone https://github.com/krislamo/homelab
    ```
-2. Set the `PLAYBOOK` environmental variable to a development playbook name in the `dev/` directory
 
-   The following `PLAYBOOK` names are available: `dockerbox`, `hypervisor`, `minecraft`, `bitwarden`, `nextcloud`, `nginx`
+2. Find available playbooks for development
+   ```
+   cd homelab
+   ```
+   ```
+   find dev -maxdepth 1 -name "*.yml" -exec basename {} .yml \;
+   ```
 
+3. Set the `PLAYBOOK` environmental variable to a value listed in the last step, e.g.,
    ```
    export PLAYBOOK=dockerbox
    ```
@@ -29,11 +43,10 @@ Vagrant and VirtualBox are used to develop Project Moxie. You will need to insta
    ```
 
 #### Copyright and License
-Copyright (C) 2020-2021  Kris Lamoureux
+Copyright (C) 2020-2022  Kris Lamoureux
 
 [![License: GPL v3](https://img.shields.io/badge/License-GPLv3-blue.svg)](https://www.gnu.org/licenses/gpl-3.0)
 
-
 This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, version 3 of the License.
 
 This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.

roles/gitea/defaults/main.yml

@@ -5,7 +5,7 @@ gitea_webport: "3000"
 gitea_ssh: "127.0.0.1:{{ gitea_sshport }}"
 gitea_web: "127.0.0.1:{{ gitea_webport }}"
 gitea_volume: "{{ gitea_name }}"
-gitea_rooturl: "http://{{ gitea_domain }}"
+gitea_rooturl: "https://{{ gitea_domain }}"
 gitea_signup: true
 
 # database settings

roles/proxy/tasks/main.yml

@@ -10,6 +10,11 @@
     state: started
     enabled: true
 
+- name: Generate DH Parameters
+  openssl_dhparam:
+    path: /etc/ssl/dhparams.pem
+    size: 4096
+
 - name: Install nginx base configuration
   template:
     src: nginx.conf.j2

roles/proxy/templates/nginx.conf.j2

@@ -21,6 +21,14 @@ http {
   keepalive_timeout 65;
   server_names_hash_bucket_size 128;
 
+  ssl_protocols TLSv1.2 TLSv1.3;
+  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+  ssl_prefer_server_ciphers off;
+  ssl_dhparam /etc/ssl/dhparams.pem;
+  ssl_session_cache shared:SSL:10m;
+  ssl_session_timeout 1d;
+  ssl_session_tickets off;
+
   include           /etc/nginx/conf.d/*.conf;
   include           /etc/nginx/sites-enabled/*;
 }

roles/proxy/templates/server-nginx.conf.j2

@@ -1,12 +1,13 @@
 server {
-    listen 80;
+  listen 80;
-
+  listen [::]:80;
-    server_name {{ item.domain }};
+  server_name {{ item.domain }};
-    return 301 https://{{ item.domain }}$request_uri;
+  return 301 https://{{ item.domain }}$request_uri;
 }
 
 server {
-  listen              443 ssl;
+  listen              443      ssl http2;
+  listen              [::]:443 ssl http2;
   server_name         {{ item.domain }};
   access_log          /var/log/nginx/{{ item.domain }}.log main;
 {% if proxy.production is defined and proxy.production and proxy.dns_cloudflare.wildcard_domains is defined and item.tls.cert is not defined %}
@@ -26,6 +27,12 @@ server {
 {% else %}
   ssl_certificate     /etc/ssl/certs/nginx-selfsigned.crt;
   ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;
+{% endif %}
+{% if item.hsts is defined %}
+  add_header Strict-Transport-Security "max-age={{ item.hsts }}" always;
+{% endif %}
+{% if item.client_max_body_size is defined %}
+  client_max_body_size {{ item.client_max_body_size }};
 {% endif %}
   location / {
 {% if item.restrict is defined and item.restrict  %}
@@ -39,6 +46,12 @@ server {
     proxy_pass {{ item.proxy_pass }};
 {% if item.proxy_ssl_verify is defined and item.proxy_ssl_verify is false %}
     proxy_ssl_verify off;
+{% endif %}
+{% if item.websockets is defined and item.websockets %}
+    proxy_http_version 1.1;
+    proxy_set_header Connection $http_connection;
+    proxy_set_header Origin http://$host;
+    proxy_set_header Upgrade $http_upgrade;
 {% endif %}
   }
 }