From f64cadd81fbaebeb8496f3cd9053764fec06a64e Mon Sep 17 00:00:00 2001
From: Patrick Spek <p.spek@tyil.nl>
Date: Mon, 18 Apr 2022 08:53:56 +0200
Subject: Various fixes to make the webserver playbook work

---
 .../share/sites.d/https/church.scriptkitties       | 62 ++++++++++++++++++++++
 1 file changed, 62 insertions(+)
 create mode 100644 playbooks.d/webserver/share/sites.d/https/church.scriptkitties

(limited to 'playbooks.d/webserver/share/sites.d/https/church.scriptkitties')

diff --git a/playbooks.d/webserver/share/sites.d/https/church.scriptkitties b/playbooks.d/webserver/share/sites.d/https/church.scriptkitties
new file mode 100644
index 0000000..de07ad6
--- /dev/null
+++ b/playbooks.d/webserver/share/sites.d/https/church.scriptkitties
@@ -0,0 +1,62 @@
+server {
+	listen 443 ssl http2;
+	listen [::]:443 ssl http2;
+
+	server_name scriptkitties.church;
+
+	ssl_certificate /etc/letsencrypt/live/scriptkitties.church/fullchain.pem;
+	ssl_certificate_key /etc/letsencrypt/live/scriptkitties.church/privkey.pem;
+
+	include /etc/nginx/snippets.d/certbot.conf;
+	include /etc/nginx/snippets.d/ssl.conf;
+	include mime.types;
+
+	root /var/www/church.scriptkitties;
+	index index.php;
+
+	autoindex off;
+	fastcgi_param HTTPS on;
+	client_max_body_size 10m;
+	client_body_buffer_size 128k;
+
+	location / {
+		try_files $uri /index.php?pagename=$uri&$args;
+	}
+
+	location ^~ /.well-known/ {
+		allow all;
+		rewrite ^ /index.php?pagename=$uri;
+	}
+
+	location ~* \.(jpg|jpeg|gif|png|ico|css|js|htm|html|ttf|woff|svg)$ {
+		expires 30d;
+		try_files $uri /index.php?pagename=$uri&$args;
+	}
+
+	location ~* \.php$ {
+		try_files $uri =404;
+
+		fastcgi_split_path_info ^(.+\.php)(/.+)$;
+
+		fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
+
+		include /etc/nginx/snippets.d/fcgi.conf;
+		fastcgi_index index.php;
+		fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+
+		fastcgi_buffers 16 16k;
+		fastcgi_buffer_size 32k;
+	}
+
+	location ~* \.(tpl|md|tgz|log|out)$ {
+		deny all;
+	}
+
+	location ~ /\. {
+		deny all;
+	}
+
+	location ^~ /bin {
+		deny all;
+	}
+}
-- 
cgit v1.1