Remove sapt-labr-prx02

host_vars/sapt-labr-prx01.yml

@@ -5,5 +5,3 @@ fqdn: sapt-labr-prx01.shrd.servers.sapti.me
 ansible_host: 192.168.17.10
 internal_ipv4: 10.2.18.10
 virt_type: kvm
-
-proxy_mode: global

host_vars/sapt-labr-prx02.yml

@@ -1,9 +0,0 @@
-# vim: ft=yaml.ansible
-# code: language=ansible
----
-fqdn: sapt-labr-prx02.shrd.servers.sapti.me
-ansible_host: 192.168.17.11
-internal_ipv4: 10.2.18.11
-virt_type: kvm
-
-proxy_mode: local

inventory.ini

@@ -18,7 +18,6 @@ sapt-labs-db01
 
 [proxy_shrd]
 sapt-labr-prx01
-sapt-labr-prx02
 
 [monitor_shrd]
 sapt-labr-mon01

roles/apps/templates/nginx/conf.d/ipfs.conf.j2

@@ -2,7 +2,7 @@
 server {
     listen 8080;
     server_name {{ apps_vars.ipfs.domain }};
-    resolver 127.0.1.1;
+    resolver 127.0.0.11;
 
     location / {
         proxy_pass http://ipfs:5001;
@@ -14,7 +14,7 @@ server {
 server {
     listen 8080;
     server_name ~^([\w-]+\.(ipfs|ipns)\.)?{{ apps_vars.ipfs.gateway_domain }}$;
-    resolver 127.0.1.1;
+    resolver 127.0.0.11;
 
     location / {
         proxy_pass http://ipfs:8080;

roles/apps/templates/nginx/conf.d/monerod.conf.j2

@@ -2,7 +2,7 @@
 server {
     listen 8080;
     server_name {{ apps_vars.monerod.domain }};
-    resolver 127.0.1.1;
+    resolver 127.0.0.11;
 
     location / {
         proxy_pass http://monerod:18089;

roles/apps/templates/nginx/conf.d/nextcloud.conf.j2

@@ -2,7 +2,7 @@
 server {
     listen 8080;
     server_name {{ apps_vars.nextcloud.domain }};
-    resolver 127.0.1.1;
+    resolver 127.0.0.11;
 
     location / {
         proxy_pass http://nextcloud:80;

roles/proxy/defaults/main.yml

@@ -2,7 +2,12 @@
 # code: language=ansible
 ---
 proxy_data_root: "{{ data_fs }}/proxy"
-proxy_caddy_version: '2.7.4'
+proxy_caddy_version: '2.7.6'
+
+proxy_trusted_subnets:
+  - 192.168.1.0/24
+  - 192.168.8.0/24
+  - 192.168.17.0/24
 
 proxy_vars:
   production:

roles/proxy/handlers/main.yml

@@ -4,5 +4,5 @@
 - name: Build custom Docker image for Caddy
   ansible.builtin.command:
     cmd: docker compose build
-    chdir: "{{ proxy_data_root }}/{{ proxy_mode }}"
+    chdir: "{{ proxy_data_root }}"
   warn: false

roles/proxy/tasks/main.yml

@@ -1,23 +1,16 @@
 # vim: ft=yaml.ansible
 # code: language=ansible
 ---
-- name: Create base folder
+- name: Create base folder for Caddy
   ansible.builtin.file:
     path: "{{ proxy_data_root }}"
     owner: root
     mode: u=rwx,g=rx,o=rx
     state: directory
 
-- name: Create folder for Caddy
-  ansible.builtin.file:
-    path: "{{ proxy_data_root }}/{{ proxy_mode }}"
-    owner: root
-    mode: u=rwx,go=
-    state: directory
-
 - name: Create build folder for Caddy
   ansible.builtin.file:
-    path: "{{ proxy_data_root }}/{{ proxy_mode }}/build"
+    path: "{{ proxy_data_root }}/build"
     owner: root
     mode: u=rwx,g=rx,o=rx
     state: directory
@@ -25,35 +18,35 @@
 - name: Copy Compose file for Caddy
   ansible.builtin.template:
     src: docker/docker-compose.yml.j2
-    dest: "{{ proxy_data_root }}/{{ proxy_mode }}/docker-compose.yml"
+    dest: "{{ proxy_data_root }}/docker-compose.yml"
     owner: root
     mode: u=rw,go=
 
 - name: Copy Dockerfile for Caddy
   ansible.builtin.template:
     src: docker/Dockerfile.j2
-    dest: "{{ proxy_data_root }}/{{ proxy_mode }}/build/Dockerfile"
+    dest: "{{ proxy_data_root }}/build/Dockerfile"
     owner: root
     mode: u=rw,g=r,o=r
   notify: Build custom Docker image for Caddy
 
 - name: Create data folder for Caddy
   ansible.builtin.file:
-    path: "{{ proxy_data_root }}/{{ proxy_mode }}/data"
+    path: "{{ proxy_data_root }}/data"
     owner: root
     mode: u=rwx,g=rx,o=rx
     state: directory
 
 - name: Copy Caddyfile
   ansible.builtin.template:
-    src: caddy/{{ proxy_mode }}.Caddyfile.j2
+    src: caddy/Caddyfile.j2
-    dest: "{{ proxy_data_root }}/{{ proxy_mode }}/data/Caddyfile"
+    dest: "{{ proxy_data_root }}/data/Caddyfile"
     owner: root
     mode: u=rw,go=
 
 - name: Create subfolders for Caddy data
   ansible.builtin.file:
-    path: "{{ proxy_data_root }}/{{ proxy_mode }}/data/caddy-{{ item }}"
+    path: "{{ proxy_data_root }}/data/caddy-{{ item }}"
     owner: root
     mode: u=rwx,go=
     state: directory

roles/proxy/templates/caddy/Caddyfile.j2

@@ -0,0 +1,77 @@
+# code: language=ansible-jinja
+{
+    admin off
+}
+
+{% for env in ['production', 'staging'] %}
+# Environment: {{ env }}
+
+{{ proxy_vars[env].app01.apps_vars.ipfs.domain }} {
+    tls {{ tls_email }} {
+        dns njalla {{ njalla_api_token }}
+    }
+
+    header {
+        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+        -Server
+    }
+
+    @local {
+        remote_ip {{ proxy_trusted_subnets | join(' ') }}
+    }
+
+    handle @local {
+        reverse_proxy {{ proxy_vars[env].app01.internal_ipv4 }}:8080
+    }
+
+    respond 403
+}
+
+{{ proxy_vars[env].app01.apps_vars.ipfs.gateway_domain }},
+*.ipfs.{{ proxy_vars[env].app01.apps_vars.ipfs.gateway_domain }},
+*.ipns.{{ proxy_vars[env].app01.apps_vars.ipfs.gateway_domain }} {
+    tls {{ tls_email }} {
+        dns njalla {{ njalla_api_token }}
+    }
+
+    header {
+        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+        -Server
+    }
+
+    reverse_proxy {{ proxy_vars[env].app01.internal_ipv4 }}:8080
+}
+
+{{ proxy_vars[env].app01.apps_vars.monerod.domain }} {
+    tls {{ tls_email }} {
+        dns njalla {{ njalla_api_token }}
+    }
+
+    header {
+        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+        -Server
+    }
+
+    @local {
+        remote_ip {{ proxy_trusted_subnets | join(' ') }}
+    }
+
+    handle @local {
+        reverse_proxy {{ proxy_vars[env].app01.internal_ipv4 }}:8080
+    }
+
+    respond 403
+}
+
+{{ proxy_vars[env].app01.apps_vars.nextcloud.domain }} {
+    tls {{ tls_email }}
+
+    header {
+        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+        -Server
+    }
+
+    reverse_proxy {{ proxy_vars[env].app01.internal_ipv4 }}:8080
+}
+
+{% endfor %}

roles/proxy/templates/caddy/global.Caddyfile.j2

@@ -1,34 +0,0 @@
-# code: language=ansible-jinja
-{
-    admin off
-}
-{% for env in ['production', 'staging'] %}
-
-# Environment: {{ env }}
-
-{{ proxy_vars[env].app01.apps_vars.nextcloud.domain }} {
-    tls {{ tls_email }}
-
-    header {
-        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
-        -Server
-    }
-
-    reverse_proxy {{ proxy_vars[env].app01.internal_ipv4 }}:8080
-}
-
-{{ proxy_vars[env].app01.apps_vars.ipfs.gateway_domain }},
-*.ipfs.{{ proxy_vars[env].app01.apps_vars.ipfs.gateway_domain }},
-*.ipns.{{ proxy_vars[env].app01.apps_vars.ipfs.gateway_domain }} {
-    tls {{ tls_email }} {
-        dns njalla {{ njalla_api_token }}
-    }
-
-    header {
-        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
-        -Server
-    }
-
-    reverse_proxy {{ proxy_vars[env].app01.internal_ipv4 }}:8080
-}
-{% endfor %}

roles/proxy/templates/caddy/local.Caddyfile.j2

@@ -1,34 +0,0 @@
-# code: language=ansible-jinja
-{
-    admin off
-}
-{% for env in ['production', 'staging'] %}
-
-# Environment: {{ env }}
-
-{{ proxy_vars[env].app01.apps_vars.ipfs.domain }} {
-    tls {{ tls_email }} {
-        dns njalla {{ njalla_api_token }}
-    }
-
-    header {
-        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
-        -Server
-    }
-
-    reverse_proxy {{ proxy_vars[env].app01.internal_ipv4 }}:8080
-}
-
-{{ proxy_vars[env].app01.apps_vars.monerod.domain }} {
-    tls {{ tls_email }} {
-        dns njalla {{ njalla_api_token }}
-    }
-
-    header {
-        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
-        -Server
-    }
-
-    reverse_proxy {{ proxy_vars[env].app01.internal_ipv4 }}:8080
-}
-{% endfor %}

roles/proxy/templates/scripts/deploy.sh.j2

@@ -2,7 +2,7 @@
 # code: language=bash
 
 ARG="$1"
-PROXY_DIR="{{ proxy_data_root }}/{{ proxy_mode }}"
+PROXY_DIR="{{ proxy_data_root }}"
 
 case $ARG in
 start)