From abf70f777258de8c75aa4a758f0074ed07f3043f Mon Sep 17 00:00:00 2001 From: Olaf Schoenwald Date: Sat, 12 Sep 2020 10:52:25 +0200 Subject: [PATCH 1/7] Adds example for Caddy2 Caddyfile --- .DS_Store | Bin 0 -> 6148 bytes examples/caddy2/Caddyfile | 126 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 126 insertions(+) create mode 100644 .DS_Store create mode 100644 examples/caddy2/Caddyfile diff --git a/.DS_Store b/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..7ca3f0dd3376c60b62a895fce41d817aca687d8c GIT binary patch literal 6148 zcmeHK%Wl&^6ur~B)JcoT0;yekgT$hWQbCCjLQ2y_5Q&#Cf(4+|uHDp*kRH)J>e2&x46M_Tyb|wAiD!^UF?NWw=*M-oVK0hC9gekvNKnepT%+byX?5n1Ao%5T|J7U%n2et z5#+%0;qvN55P9*W9gia~730{l!!#>qrC-~f&2Aqw_pF?Ia50Xn3HCa z(mjReA$8~>aK%y)OCZnK5CP>!%BtY!Ju6tgK0?TYU#BS+O;~&z#zUWHpnB0w1>fAd z=tAiEYX!6dOA7G)!9wELQn-*Pwhm Date: Sat, 12 Sep 2020 11:04:16 +0200 Subject: [PATCH 2/7] Comment in host-cars --- examples/host-vars.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/examples/host-vars.yml b/examples/host-vars.yml index 64d12097..e4e08bda 100644 --- a/examples/host-vars.yml +++ b/examples/host-vars.yml @@ -4,6 +4,9 @@ # Note: this playbook does not touch the server referenced here. # Installation happens on another server ("matrix."). # +# Plesae remember, if you've deployed the wrong URL, you have to run the Uninstalling step, +# cause you can't change the Domain after deployment. +# # Example value: example.com matrix_domain: YOUR_BARE_DOMAIN_NAME_HERE From a49718632a9cd56372bf3d5aad20f9805b409210 Mon Sep 17 00:00:00 2001 From: 0hlov3 <36544727+0hlov3@users.noreply.github.com> Date: Sat, 12 Sep 2020 23:26:11 +0200 Subject: [PATCH 3/7] Delete .DS_Store Removes DS-Store --- .DS_Store | Bin 6148 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 .DS_Store diff --git a/.DS_Store b/.DS_Store deleted file mode 100644 index 7ca3f0dd3376c60b62a895fce41d817aca687d8c..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 6148 zcmeHK%Wl&^6ur~B)JcoT0;yekgT$hWQbCCjLQ2y_5Q&#Cf(4+|uHDp*kRH)J>e2&x46M_Tyb|wAiD!^UF?NWw=*M-oVK0hC9gekvNKnepT%+byX?5n1Ao%5T|J7U%n2et z5#+%0;qvN55P9*W9gia~730{l!!#>qrC-~f&2Aqw_pF?Ia50Xn3HCa z(mjReA$8~>aK%y)OCZnK5CP>!%BtY!Ju6tgK0?TYU#BS+O;~&z#zUWHpnB0w1>fAd z=tAiEYX!6dOA7G)!9wELQn-*Pwhm Date: Sat, 12 Sep 2020 23:26:27 +0200 Subject: [PATCH 4/7] Removes DS_Store --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index 32ab139f..d6068088 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,4 @@ !/inventory/host_vars/.gitkeep !/inventory/scripts /roles/*/files/scratchpad +.DS_Store From c366e2636009a9668611b8d2a61e1ec1038ad2a5 Mon Sep 17 00:00:00 2001 From: 0hlov3 Date: Sun, 13 Sep 2020 03:11:37 +0200 Subject: [PATCH 5/7] Updates exempes/caddy2/Caddyfile to SSL Grade A+ --- examples/caddy2/Caddyfile | 68 ++++++++++++++++++++++++++++----------- 1 file changed, 49 insertions(+), 19 deletions(-) diff --git a/examples/caddy2/Caddyfile b/examples/caddy2/Caddyfile index 09b3367e..0abb25af 100644 --- a/examples/caddy2/Caddyfile +++ b/examples/caddy2/Caddyfile @@ -27,13 +27,17 @@ matrix.DOMAIN.tld { } header { - Access-Control-Allow-Origin * - Strict-Transport-Security "mag=age=31536000;" - X-Frame-Options "DENY" + # Enable HTTP Strict Transport Security (HSTS) to force clients to always connect via HTTPS + Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" + # Enable cross-site filter (XSS) and tell browser to block detected attacks + X-XSS-Protection "1; mode=block" + # Prevent some browsers from MIME-sniffing a response away from the declared Content-Type + X-Content-Type-Options "nosniff" + # Disallow the site to be rendered within a frame (clickjacking protection) + X-Frame-Options "DENY" + # X-Robots-Tag + X-Robots-Tag "noindex, noarchive, nofollow" 167,9 79% - Strict-Transport-Security "mag=age=31536000;" - X-Frame-Options "DENY" - X-XSS-Protection "1; mode=block" } # Cache @@ -78,23 +82,36 @@ matrix.DOMAIN.tld { } } -:8448 { - handle { - encode zstd gzip +matrix.DOMAIN.tld:8448 { + handle { + encode zstd gzip - reverse_proxy localhost:8448 { - header_up X-Forwarded-Port {http.request.port} - header_up X-Forwarded-Proto {http.request.scheme} - header_up X-Forwarded-TlsProto {tls_protocol} - header_up X-Forwarded-TlsCipher {tls_cipher} - header_up X-Forwarded-HttpsProto {proto} - } - } + reverse_proxy 127.0.0.1:8048 { + header_up X-Forwarded-Port {http.request.port} + header_up X-Forwarded-Proto {http.request.scheme} + header_up X-Forwarded-TlsProto {tls_protocol} + header_up X-Forwarded-TlsCipher {tls_cipher} + header_up X-Forwarded-HttpsProto {proto} + } + } } dimension.DOMAIN.tld { - tls {$CADDY_TLS} + tls {$CADDY_TLS} + + header { + # Enable HTTP Strict Transport Security (HSTS) to force clients to always connect via HTTPS + Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" + # Enable cross-site filter (XSS) and tell browser to block detected attacks + X-XSS-Protection "1; mode=block" + # Prevent some browsers from MIME-sniffing a response away from the declared Content-Type + X-Content-Type-Options "nosniff" + # Disallow the site to be rendered within a frame (clickjacking protection) + X-Frame-Options "DENY" + # X-Robots-Tag + X-Robots-Tag "noindex, noarchive, nofollow" + } handle { encode zstd gzip @@ -111,7 +128,20 @@ dimension.DOMAIN.tld { element.DOMAIN.tld { - tls {$CADDY_TLS} + tls {$CADDY_TLS} + + header { + # Enable HTTP Strict Transport Security (HSTS) to force clients to always connect via HTTPS + Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" + # Enable cross-site filter (XSS) and tell browser to block detected attacks + X-XSS-Protection "1; mode=block" + # Prevent some browsers from MIME-sniffing a response away from the declared Content-Type + X-Content-Type-Options "nosniff" + # Disallow the site to be rendered within a frame (clickjacking protection) + X-Frame-Options "DENY" + # X-Robots-Tag + X-Robots-Tag "noindex, noarchive, nofollow" + } handle { encode zstd gzip From c19abe4a76cdb2d9285f63d2cbf43005658fefe7 Mon Sep 17 00:00:00 2001 From: 0hlov3 Date: Sun, 13 Sep 2020 04:19:19 +0200 Subject: [PATCH 6/7] Changes matrix_dimension_integrations_ui_url from /riot to /element https://dimension.t2bot.io/ --- roles/matrix-dimension/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-dimension/defaults/main.yml b/roles/matrix-dimension/defaults/main.yml index 770f5bcb..33e7212c 100644 --- a/roles/matrix-dimension/defaults/main.yml +++ b/roles/matrix-dimension/defaults/main.yml @@ -27,7 +27,7 @@ matrix_dimension_container_http_host_bind_port: '' # A list of extra arguments to pass to the container matrix_dimension_container_extra_arguments: [] -matrix_dimension_integrations_ui_url: "https://{{ matrix_server_fqn_dimension }}/riot" +matrix_dimension_integrations_ui_url: "https://{{ matrix_server_fqn_dimension }}/element" matrix_dimension_integrations_rest_url: "https://{{ matrix_server_fqn_dimension }}/api/v1/scalar" matrix_dimension_integrations_widgets_urls: ["https://{{ matrix_server_fqn_dimension }}/widgets"] matrix_dimension_integrations_jitsi_widget_url: "https://{{ matrix_server_fqn_dimension }}/widgets/jitsi" From 6fefbc248abbc8e2d1666d4a26b8caa8e3229dcb Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Sun, 13 Sep 2020 09:51:04 +0300 Subject: [PATCH 7/7] Fix typo and wording --- examples/host-vars.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/examples/host-vars.yml b/examples/host-vars.yml index e4e08bda..409f344a 100644 --- a/examples/host-vars.yml +++ b/examples/host-vars.yml @@ -4,8 +4,8 @@ # Note: this playbook does not touch the server referenced here. # Installation happens on another server ("matrix."). # -# Plesae remember, if you've deployed the wrong URL, you have to run the Uninstalling step, -# cause you can't change the Domain after deployment. +# If you've deployed using the wrong domain, you'll have to run the Uninstalling step, +# because you can't change the Domain after deployment. # # Example value: example.com matrix_domain: YOUR_BARE_DOMAIN_NAME_HERE