feat: forward tcp traffic easily

2025-12-15 22:14:46 +01:00
parent bd2e806aa1
commit ebeb6d5c6b
8 changed files with 287 additions and 2 deletions
@@ -0,0 +1,41 @@
+# HTTPS vhost with Let's Encrypt (Certbot) for {{ server_name }}
+# Managed by Ansible - DO NOT EDIT MANUALLY
+
+server {
+    listen 80;
+    server_name {{ server_name }};
+
+    # Certbot webroot for ACME challenges
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    # Redirect to HTTPS
+    location / {
+        return 301 https://$server_name$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name {{ server_name }};
+
+    # Let's Encrypt certificates (managed by Certbot)
+    ssl_certificate /etc/letsencrypt/live/{{ server_name }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ server_name }}/privkey.pem;
+
+    # SSL configuration
+    ssl_protocols {{ nginx_ssl_protocols }};
+    ssl_prefer_server_ciphers {{ 'on' if nginx_ssl_prefer_server_ciphers else 'off' }};
+
+{% if nginx_log_backend == 'journald' %}
+    access_log syslog:server=unix:/dev/log,nohostname,tag=nginx_{{ server_name | replace('.', '_') }};
+    error_log syslog:server=unix:/dev/log,nohostname,tag=nginx_{{ server_name | replace('.', '_') }};
+{% else %}
+    access_log /var/log/nginx/{{ server_name }}_access.log main;
+    error_log /var/log/nginx/{{ server_name }}_error.log;
+{% endif %}
+
+    # Service-specific configuration included below
+    {{ vhost_config | default('') }}
+}