Add nginx config files for the rest

roles/apps/defaults/main.yml

@@ -14,7 +14,7 @@ apps_vars:
     version: 1.25.3-alpine-slim
 
   postfix:
-    domain: smtp.{{ apps_base_domain }}
+    hostname: smtp.{{ apps_base_domain }}
     backup: true
     sender: false
     extra_tasks: false
@@ -29,7 +29,7 @@ apps_vars:
     version: v0.23.0
 
   monerod:
-    domain: xmr.{{ apps_base_domain }}
+    domain: xmr.{{ apps_local_domain }}
     backup: false
     sender: false
     extra_tasks: false

roles/apps/tasks/configure_app.yml

@@ -24,4 +24,4 @@
 
 - name: Run extra configuration tasks for {{ app_name }}
   ansible.builtin.include_tasks: extra_tasks/{{ app_name }}.yml
-  when: app_vars.extra_tasks is defined and app_vars.extra_tasks
+  when: app_vars.extra_tasks

roles/apps/tasks/main.yml

@@ -20,7 +20,7 @@
   ansible.builtin.file:
     name: "{{ apps_data_root }}"
     owner: root
-    mode: u=rwx,go=
+    mode: u=rwx,g=rx,o=rx
     state: directory
 
 - name: Configure apps

roles/apps/templates/compose-files/ipfs.yml.j2

@@ -6,9 +6,9 @@ services:
     image: ipfs/kubo:{{ apps_vars.ipfs.version }}
     restart: always
     environment:
+      LOCAL_DOMAIN: {{ apps_vars.ipfs.domain }}
       IPFS_DOMAIN: {{ apps_vars.ipfs.gateway_domain }}
       IPFS_PROFILE: server
-      LOCAL_DOMAIN: {{ apps_vars.ipfs.domain }}
     networks:
       {{ apps_shared_docker_network }}:
         aliases:

roles/apps/templates/compose-files/postfix.yml.j2

@@ -7,7 +7,7 @@ services:
     restart: always
     environment:
       ALLOWED_SENDER_DOMAINS: "{{ apps_senders | join(' ') }}"
-      HOSTNAME: "{{ apps_vars.postfix.domain }}"
+      HOSTNAME: "{{ apps_vars.postfix.hostname }}"
       DKIM_AUTOGENERATE: "true"
     networks:
       - {{ apps_postfix_docker_network }}

roles/apps/templates/nginx/conf.d/ipfs.conf.j2

@@ -0,0 +1,24 @@
+# code: language=ansible-jinja
+server {
+    listen 8080;
+    server_name {{ apps_vars.ipfs.domain }};
+    resolver 127.0.1.1;
+
+    location / {
+        proxy_pass http://ipfs:5001;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto "https";
+    }
+}
+
+server {
+    listen 8080;
+    server_name ~^([\w-]+\.(ipfs|ipns)\.)?{{ apps_vars.ipfs.gateway_domain }}$;
+    resolver 127.0.1.1;
+
+    location / {
+        proxy_pass http://ipfs:8080;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto "https";
+    }
+}

roles/apps/templates/nginx/conf.d/monerod.conf.j2

@@ -0,0 +1,12 @@
+# code: language=ansible-jinja
+server {
+    listen 8080;
+    server_name {{ apps_vars.monerod.domain }};
+    resolver 127.0.1.1;
+
+    location / {
+        proxy_pass http://monerod:18089;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto "https";
+    }
+}

roles/apps/templates/nginx/conf.d/nextcloud.conf.j2

@@ -1,19 +1,16 @@
 # code: language=ansible-jinja
 server {
     listen 8080;
-    server_name {{ apps_vars.nextcloud.domain }}
+    server_name {{ apps_vars.nextcloud.domain }};
+    resolver 127.0.1.1;
 
     location / {
         proxy_pass http://nextcloud:80;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Proto "https";
     }
 
-    location = /.well-known/carddav {
-        return 301 $scheme://$host/remote.php/dav;
-    }
-
-    location = /.well-known/caldav {
-        return 301 $scheme://$host/remote.php/dav;
+    location ~^/\.well-known/(cal|card)dav$ {
+        return 301 https://$host/remote.php/dav;
     }
 }