382 Commits (a4662660d2ca70cdadf496e1047fc50204937faf)

Author	SHA1	Message	Date
Slavi Pantaleev	86c36523df	Replace ExecStopPost with ExecStop ... Reverts b1b4ba501f, 90c9801c56, a3c84f78ca, .. I haven't really traced it (yet), but on some servers, I'm observing `ansible-playbook ... --tags=start` completing very slowly, waiting to stop services. I can't reproduce this on all Matrix servers I manage. I suspect that either the systemd version is to blame or that some specific service is not responding well to some `docker kill/rm` command. `ExecStop` seems to work great in all cases and it's what we've been using for a very long time, so I'm reverting to that.	3 years ago
GoliathLabs	33851f1dfa	Updated: nginx to 1.21.6-alpine	3 years ago
Wm Salt Hale	3aa8c1f62c	only enable openssl if necessary	3 years ago
GoliathLabs	b608c3d342	Updated: worker_processes to auto	3 years ago
GoliathLabs	8a66db850e	Updated: Certbot to v1.22.0	3 years ago
Slavi Pantaleev	29bc22a085	Add matrix_nginx_proxy_container_additional_networks ... Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1498	3 years ago
Slavi Pantaleev	27a4871aea	Fix variable name typo	3 years ago
Slavi Pantaleev	3b9d5b13e9	Add support for not serving Dendrite federation APIs on the client port ... Seems like Dendrite encourages serving both the Client and Federation API at the same port. Coming from Synapse and how things are done there, we have separate ports. Using separate ports probably makes matrix-corporal (etc.) integration easier, so separating the APIs by default probably makes sense.	3 years ago
Slavi Pantaleev	ecc237bbad	Initial work on getting nginx reverse proxying working with Dendrite	3 years ago
rakshazi	5788a16a2e	added matrix-client-cinny	3 years ago
Slavi Pantaleev	b1b4ba501f	Replace ExecStop with ExecStopPost ... ExecStopPost should allow us to clean up (docker kill + docker rm) even if the ExecStart (docker run ..) command failed, and not just after a graceful service stop was initiated. Source: https://www.freedesktop.org/software/systemd/man/systemd.service.html#ExecStopPost=	3 years ago
Slavi Pantaleev	8515ac55e6	Upgrade nginx (1.21.4 -> 1.21.5)	3 years ago
Slavi Pantaleev	948c411106	Remove sudo requirement for generating SSL certificates ... Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1492	3 years ago
Slavi Pantaleev	afd7f03bb5	Minor comment changes	3 years ago
Slavi Pantaleev	fa704f104b	Add support for using custom ACME CA servers (other than Let's Encrypt') ... Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1468	3 years ago
Slavi Pantaleev	3a9fe48deb	Make matrix-nginx-proxy's X-Forwarded-For header customizable ... Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1393	3 years ago
Slavi Pantaleev	3b27ce2ff6	Merge pull request #1404 from aaronraimist/v3 ... Allow workers to serve new v3 APIs	3 years ago
Aaron Raimist	f8fe68b385	Allow workers to serve new v3 APIs ... 1f196f59cb	3 years ago
Slavi Pantaleev	b4fb819481	Merge pull request #1403 from borisrunakov/rename-matrix-ma1sd-default-port ... remove default from variable name	3 years ago
boris runakov	394ecb0acc	remove default from variable name	3 years ago
boris runakov	d3a9ec98de	refactoring	3 years ago
boris runakov	1ec67f49b0	replaced 8008 where possible	3 years ago
Slavi Pantaleev	994c0e504c	Ensure some matrix-nginx-proxy variables are defined ... Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/1397	3 years ago
b	07496069c8	rellocating variables for consistency	3 years ago
b	7756cc4c8e	replace port 8048 with matrix_synapse_container_default_federation_port	3 years ago
JokerGermany	c0656448f7	Port 80 for IPv6	3 years ago
sakkiii	cd26af2f6f	Certbot Update (v1.20.0 -> v1.21.0)	3 years ago
sakkiii	7a4f49c457	Nginx Minio Update (1.21.3 -> 1.21.4)	3 years ago
Slavi Pantaleev	735c966ab6	Disable systemd services when stopping to uninstall them ... Until now, we were leaving services "enabled" (symlinks in /etc/systemd/system/multi-user.target.wants/). We clean these up now. Broken symlinks may still exist in older installations that enabled/disabled services. We're not taking care to fix these up. It's just a cosmetic defect anyway.	3 years ago
b	6eaa8ac65a	add server_name to matrix-synapsel.conf only if matrix_nginx_proxy_enabled	3 years ago
b	dcda17595a	change port 8090 to matrix_ma1sd_default_port	3 years ago
Slavi Pantaleev	06bcdcf9d2	Merge pull request #1311 from HarHarLinks/master ... add auto proxy synapse worker metrics	3 years ago
Kim Brose	5f6bbafa17	fix space before tab in indent	3 years ago
HarHarLinks	7b33fc8e19	fixup! auto-generate prometheus.yml for workers metrics	3 years ago
HarHarLinks	ce41674e61	auto-generate prometheus.yml for workers metrics	3 years ago
HarHarLinks	4209c4208c	add own variable for worker metrics ... https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/1311#issuecomment-945718866	3 years ago
Slavi Pantaleev	2bf052369d	Upgrade certbot (v1.19.0 -> v1.20.0)	3 years ago
Kim Brose	1ba7760ea4	add how to generate htpasswd ... for matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_key resolves #1308	3 years ago
HarHarLinks	d9fa2f7ed4	add auto proxy synapse worker metrics ... when matrix_nginx_proxy_proxy_synapse_metrics is enabled	3 years ago
Slavi Pantaleev	31396f0615	Merge pull request #1295 from nogweii/feat-support-upstream-https-forwarded ... Support trusting the upstream server when it says the protocol is HTTPS	3 years ago
Aaron Raimist	a676b5358c	Fix hydrogen OCSP typo ... From 6f80292745	3 years ago
Colin Shea	2578ca4cee	rename matrix_nginx_proxy_x_forwarded_header_value -> matrix_nginx_proxy_x_forwarded_proto_value	3 years ago
Colin Shea	d0cd67044e	replace $scheme with X-Forwarded-Proto when enabled	3 years ago
sakkiii	3055b3996e	Updates Certbot -> v1.19.0, nginx ->1.21.3-alpine	3 years ago
sakkiii	ae6caf158a	Added variable matrix_nginx_proxy_request_timeout (#1265) ... * add timeout param for nginx proxy default value matrix_nginx_proxy_request_timeout is 60s * default matrix_nginx_proxy_request_timeout - 60s * few more variables for request timeout * Update nginx.conf.j2 * Update nginx.conf.j2	3 years ago
Slavi Pantaleev	a911207854	Revert "nginx update v1.21.2" ... This reverts commit 732051b8fc. There's no such container image published yet.	3 years ago
sakkiii	732051b8fc	nginx update v1.21.2 ... http://nginx.org/en/CHANGES	3 years ago
sakkiii	f5a7e6d78b	Certbot update v1.18.0	3 years ago
Michael Collins	4d57a41b3f	remove matrix_awx_enabled from these	3 years ago
Michael Collins	2e30802b87	use group variables instead	3 years ago
Michael Collins	8238d65e5f	simplify template conditional	3 years ago
Michael Collins	bfb61e776e	GMH v0.5.7... maybe!	3 years ago
Slavi Pantaleev	4105ba854b	Merge pull request #1147 from datenkollektiv-net/allow-custom-federation-fqn ... Make federation domain customizable	3 years ago
JokerGermany	9345d840be	root path for the base domain is wrong (#1189) ... * root path for the base domain * Fix path when running in a container Co-authored-by: Slavi Pantaleev <slavi@devture.com>	3 years ago
sakkiii	7a51268dfc	Upgrade certbot & nginx ... Upgrade certbot (v1.16.0 -> v1.17.0) nginx (1.21.0 -> 1.21.1)	3 years ago
Slavi Pantaleev	6294e58304	Fix Content-Security-Policy for Element ... Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1154 According to https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy, having both a header and the `<meta>`-tag provided by Element itself is not a problem. The 2 CSP policies get combined.	3 years ago
oxmie	5df4d68829	Make federation domain customizable	3 years ago
sakkiii	0217644b48	Content-Security-Policy For Element Web ... https://github.com/vector-im/element-web#configuration-best-practices	4 years ago
Slavi Pantaleev	963f38ee7b	Upgrade certbot (v1.14.0 -> v1.16.0)	4 years ago
pushytoxin	bee14550ab	Fix local/bin scripts autocompletion by adding rx perms to everyone ... It's mildly annoying when trying to execute these scripts while logged in as a regular user, as the missing execute permissions will hinder autocompletion even when trying to use with sudo. These shell scripts don't contain secrets, but may fail when ran by a regular user. The failure is due to the lack of access to the /matrix directory, and does not result in any damage.	4 years ago
Slavi Pantaleev	4880dcceb0	Fix OCSP-stapling-related errors due to missing resolver ... Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/1057	4 years ago
rakshazi	4ddd8bbb84	Updated nginx-proxy (1.20.0 -> 1.21.0)	4 years ago
Slavi Pantaleev	1ed0857019	Fix syntax error ... Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/1024	4 years ago
sakkiii	4a4a7f136e	changes added to hydrogen client	4 years ago
sakkiii	25e67b51d1	Merge branch 'spantaleev:master' into master	4 years ago
sakkiii	3436f9c10a	rename to matrix_nginx_proxy_hsts_preload_enabled	4 years ago
sakkiii	7cc5328ede	Comments & Ref	4 years ago
sakkiii	df2d91970d	matrix_nginx_proxy_xss_protection	4 years ago
Slavi Pantaleev	6f80292745	Add OCSP stapling support and other SSL optimizations to Hydrogen vhost ... Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/1061 and https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/1057	4 years ago
Slavi Pantaleev	d0de21ab34	Delete Hydrogen nginx configuration file when disabled	4 years ago
Aaron Raimist	04548f8df2	Merge branch 'master' into hydrogen	4 years ago
Aaron Raimist	9437f78c9e	Build using custom config.json, add CSP, update to 0.1.53	4 years ago
sakkiii	e9b878b9e9	Optimize SSL session	4 years ago
Slavi Pantaleev	e6afa05f7b	Enable OCSP stapling for the federation port ... Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/1057 Not sure if this is beneficial though.	4 years ago
Slavi Pantaleev	57a6a98a50	Fix incorrect SSL certificate path ... Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/1057	4 years ago
Slavi Pantaleev	b9c4e8ce16	Merge pull request #1057 from sakkiii/ssl_staple ... Enable OCSP Stapling	4 years ago
sakkiii	d31b55b2a7	SSL-enabled block only	4 years ago
Slavi Pantaleev	e4dd933cf0	Make missing /_synapse/admin correctly return 404 responses ... Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1058 We may try to capture such calls and return a friendlier response (HTML or JSON) saying "The Synapse Admin API is not enabled", but that may not be desirable. For now, we stick to what "upstream" recommends: "simply don't proxy these APIs", which should lead to the same kind of 404 that we have now. See here: 6660912226/docs/reverse_proxy.md (synapse-administration-endpoints)	4 years ago
sakkiii	2c3da6599b	Added warning	4 years ago
sakkiii	0dd4459799	matrix_nginx_proxy_ocsp_stapling_enabled variable added	4 years ago
sakkiii	c05021640d	Enable OCSP Stapling	4 years ago
Aaron Raimist	ca361af616	Add Hydrogen	4 years ago
sakkiii	29cf6a0087	Merge branch 'spantaleev:master' into master	4 years ago
sakkiii	bb0810302d	Merge branch 'spantaleev:master' into master	4 years ago
Béla Becker	b10655ebb1	Jitsi XMPP Websocket support ... Jitsi-meet enabled websockets by default, claiming better reliability. Matrix-nginx-proxy configuration has been set up according to the Prosody documentation: https://prosody.im/doc/websocket	4 years ago
Dan Arnfield	cfaa3e598a	Update nginx (1.19.10 -> 1.20.0)	4 years ago
sakkiii	40fe6bd5c1	variable matrix_nginx_proxy_hsts_preload_enable added	4 years ago
Slavi Pantaleev	389dc26615	Fix Synapse generic worker balancing ... Potentially fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1022	4 years ago
sakkiii	5b4fdf9b87	Merge branch 'master' of https://github.com/sakkiii/matrix-docker-ansible-deploy	4 years ago
sakkiii	0ccf0fbf1c	HSTS preload + X-XSS enables ... **HSTS Preloading:** In its strongest and recommended form, the [HSTS policy](https://www.chromium.org/hsts) includes all subdomains, and indicates a willingness to be “preloaded” into browsers: `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload` **X-Xss-Protection:** `1; mode=block` which tells the browser to block the response if it detects an attack rather than sanitising the script.	4 years ago
sakkiii	3564635f0f	Merge branch 'master' into master	4 years ago
sakkiii	29bba5161b	Element More security headers ... More Production ready nginx headers for Matrix client element.	4 years ago
Slavi Pantaleev	d691cc0920	Move variable definition a bit	4 years ago
Slavi Pantaleev	e00ef04b57	Add opt-out-of-FLoC headers by default	4 years ago
Slavi Pantaleev	4a1739f604	Merge pull request #1007 from teutat3s/fix/nginx-dont-send-version ... Don't expose nginx version with each response	4 years ago
teutat3s	2bf7c26cfa	Don't expose nginx version with each response	4 years ago
sakkiii	1958d0792d	Update matrix-client-element.conf.j2	4 years ago
sakkiii	b6d45c5fd8	Merge branch 'master' of https://github.com/sakkiii/matrix-docker-ansible-deploy	4 years ago
sakkiii	05042f5ff1	Improve security grafana ... - duplicate X-Content-Type-Options - X-Frame-Options header - Referrer-Policy [Might consider adding variable] - Secure flag with cookies - matrix_grafana_content_security_policy variable for [Content Security Policy](https://grafana.com/docs/grafana/latest/administration/configuration/#content_security_policy)	4 years ago
sakkiii	5dc642ace1	Nginx element web: XSS protection & nosniff header ... X-XSS-Protection: 1; mode=block; header, for basic XSS protection in legacy browsers. X-Content-Type-Options: nosniff header, to disable MIME sniffing	4 years ago