diff --git a/proxy_resources/etc/nginx/sites-available/git.domain b/proxy_resources/etc/nginx/sites-available/git.domain index e7a20e9..fd42dc9 100755 --- a/proxy_resources/etc/nginx/sites-available/git.domain +++ b/proxy_resources/etc/nginx/sites-available/git.domain @@ -14,7 +14,7 @@ server { include proxy_params; } - listen [::]:443 ssl ipv6only=on; + listen [::]:443 ssl; listen 443 ssl; ssl_certificate /etc/letsencrypt/live/{{ domain_name }}/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/{{ domain_name }}/privkey.pem; diff --git a/proxy_resources/etc/wireguard/wg0.conf b/proxy_resources/etc/wireguard/wg0.conf index 3175663..8f709ae 100755 --- a/proxy_resources/etc/wireguard/wg0.conf +++ b/proxy_resources/etc/wireguard/wg0.conf @@ -42,6 +42,11 @@ AllowedIPs = 10.0.0.3/32 #PublicKey = {{ minecraft_service_pubkey }} #AllowedIPs = 10.0.0.7/32 +# Connection to backend server for cockpit +[Peer] +PublicKey = {{ cockpit_backend_pubkey }} +AllowedIPs = 10.0.0.199/32 + # User Key for Phone/Desktop/Laptop use #[Peer] #PublicKey = {{ user_pubkey }} diff --git a/server-setup.yml b/server-setup.yml index 4f96800..771f01e 100755 --- a/server-setup.yml +++ b/server-setup.yml @@ -211,6 +211,7 @@ ansible.builtin.user: name: "{{ item }}" state: present + shell: /bin/bash groups: docker append: yes loop: "{{ available_servicedirs }}" @@ -236,6 +237,13 @@ mode: '1700' loop: "{{ available_servicedirs }}" + - name: Ensure service users upon login start in their respective service directory + become: yes + ansible.builtin.lineinfile: + path: "/home/{{ item }}/.profile" + line: "cd {{ services_directory }}/{{ item }}" + loop: "{{ available_servicedirs }}" + - name: Reset doas configuration back to default become: yes template: diff --git a/serversecrets.example b/serversecrets.example index 27149e1..e10df5c 100755 --- a/serversecrets.example +++ b/serversecrets.example @@ -31,6 +31,7 @@ searxng_service_privkey: *** nextcloud_service_privkey: *** chat_service_privkey: *** minecraft_service_privkey: *** +cockpit_backend_privkey: *** user_privkey: *** # VPN Client Public Keys @@ -41,6 +42,7 @@ searxng_service_pubkey: *** nextcloud_service_pubkey: *** chat_service_pubkey: *** minecraft_service_pubkey: *** +cockpit_backend_pubkey: *** user_pubkey: *** # USB Encryption Key