dn42-router/host_vars/p2p-node.de/nginx.yml

---
nginx_csps:
  default:
    - name: default-src
      value: none
    - name: base-uri
      value: none
    - name: form-action
      value: none
    - name: frame-ancestors
      value: none
    - name: style-src
      value: self
    - name: style-src-elem
      value: self
    - name: img-src
      value: self
  leaflet:
    - name: default-src
      value: none
    - name: base-uri
      value: none
    - name: form-action
      value: none
    - name: frame-ancestors
      value: none
    - name: style-src
      value: self
    - name: style-src-elem
      value: self
    - name: script-src
      value: self
    - name: script-src-elem
      value: self
    - name: img-src
      value: self
      data: "https://*.tile.openstreetmap.org"
  allow_script:
    - name: default-src
      value: none
    - name: base-uri
      value: none
    - name: form-action
      value: none
    - name: frame-ancestors
      value: none
    - name: style-src
      value: self
    - name: style-src-elem
      value: self
    - name: script-src
      value: self
    - name: script-src-elem
      value: self
    - name: img-src
      value: self
  allow_form:
    - name: default-src
      value: none
    - name: base-uri
      value: none
    - name: form-action
      value: self
    - name: frame-ancestors
      value: none
    - name: style-src
      value: self
    - name: style-src-elem
      value: self
    - name: img-src
      value: self
  allow_inline:
    - name: default-src
      value: none
    - name: base-uri
      value: none
    - name: form-action
      value: none
    - name: frame-ancestors
      value: none
    - name: style-src
      value:
        - unsafe-inline
        - self
    - name: style-src-elem
      value:
        - unsafe-inline
        - self
    - name: img-src
      value: self
    - name: script-src
      value:
        - unsafe-inline
        - self

nginx_streams:
  - port: 43
    backend: 127.0.0.1:4343

nginx_sites:
  bgplookup:
    csp: allow_form
    locations:
      - path: /
        backend: http://127.0.0.1:8100
  monkic:
    csp: allow_inline
    locations:
      - path: /
        backend: http://127.0.0.1:8009
  archive:
    csp: allow_inline
    locations:
      - path: /
        backend: http://127.0.0.1:8009
  bandura_comm:
    csp: leaflet
    locations:
      - path: /
        backend: http://127.0.0.1:8009
  p2pnode:
    csp: default
    locations:
      - path: /
        backend: http://127.0.0.1:8009
  crxndocs:
    csp: default
    locations:
      - path: /
        backend: http://127.0.0.1:8009
    redirects:
      - from: ^/$
        to: /docs/
        mode: permanent
      - from: ^/docs/routing/bird/?$
        to: /docs/routing/
        mode: permanent
      - from: ^/docs/routing/babeld/?$
        to: /docs/routing/
        mode: permanent
      - from: ^/docs/home_network/$
        to: /docs/home-network/
        mode: permanent
      - from: ^/docs/additional/dn42_interconnection$
        to: /docs/additional/dn42-interconnection
        mode: permanent
      - from: ^/docs/getting-started/services/$
        to: /docs/services
        mode: permanent
      - from: ^/projects/bonobonet$
        to: /docs/services
        mode: permanent
      - from: ^/docs/routing/maxlen-filter$
        to: /docs/entitydb/maxlen
        mode: permanent
      - from: ^/docs/routing/compile-install$
        to: /docs/routing/babeld/compile-install
        mode: permanent
      - from: ^/docs/routing/babelweb2$
        to: /docs/routing/babeld/babelweb2
        mode: permanent
  mk16de:
    csp: default
    locations:
      - path: /
        backend: http://127.0.0.1:8009
      - path: /blog/widerstandsrechner.html
        csp: allow_inline
        backend: http://127.0.0.1:8009
      - path: /blog/kapazitaet_von_keramikkondensatoren.html
        csp: allow_inline
        backend: http://127.0.0.1:8009
      - path: /age-de.xml
        csp: allow_script
        backend: http://127.0.0.1:8009
    redirects:
      - from: "^/overlay-networks/beginner_tips/$"
        to: "/blog/dn42-beginner-tips/"
        mode: permanent
      - from: "^/overlay-networks/bgp-route-selection-de/$"
        to: "/blog/bgp-route-selection-de/"
        mode: permanent
      - from: "^/overlay-networks/bgp-route-selection-en/$"
        to: "/blog/bgp-route-selection-en/"
        mode: permanent
      - from: "^/overlay-networks/lab_de/$"
        to: "/blog/lab-de/"
        mode: permanent
      - from: "^/overlay-networks/lab_en/$"
        to: "/blog/lab-en/"
        mode: permanent
      - from: "^/overlay-networks/dn42-test-clearnet-access/$"
        to: "/blog/dn42-test-clearnet-access/"
        mode: permanent
      - from: "^/overlay-networks/dn42-grc-roa/$"
        to: "/blog/dn42-grc-roa/"
        mode: permanent
      - from: ^/blog/lwed-linux-commands/$
        to: /blog/lewd-linux-commands/
        mode: permanent
    custom_headers:
      - name: Onion-Location
        value: http://p2pkbqdgvabddixbbr2y7vrra4qxq3sejfep2qknfu4owh7e3i622dqd.onion$request_uri
      - name: X-I2P-Location
        value: http://e7uvwnpkzbn5zdwr76ujlhym4lk5pfkqhvfwivt3mszx7l4lpj7q.b32.i2p$request_uri

nginx_reverse_proxy:
  ############ test.mk16.de ############
  - name: archive
    hosts:
      - test.mk16.de
      - archive.bandura.i2p
      - archive.bandura.dn42
    port: 80
    site: archive
    gzip: true
  - name: archive-le-ssl
    hosts:
      - test.mk16.de
    port: 443
    ssl:
      certificate: /etc/letsencrypt/live/test.mk16.de/fullchain.pem
      key: /etc/letsencrypt/live/test.mk16.de/privkey.pem
      sts:
        time: 63072000
    site: archive
  - name: archive-le-ssl-le-dn42
    hosts:
      - archive.bandura.dn42
    port: 443
    ssl:
      certificate: /etc/letsencrypt/live/archive.bandura.dn42/fullchain.pem
      key: /etc/letsencrypt/live/archive.bandura.dn42/privkey.pem
      sts:
        time: 63072000
    site: archive

  ############ bandura_comm ############
  - name: bandura_comm
    hosts:
      - bandura-comm.mk16.de
      - bandura.dn42
    port: 80
    site: bandura_comm
    gzip: true
  - name: bandura_comm-le-ssl
    hosts:
      - bandura-comm.mk16.de
    port: 443
    ssl:
      certificate: /etc/letsencrypt/live/bandura-comm.mk16.de/fullchain.pem
      key: /etc/letsencrypt/live/bandura-comm.mk16.de/privkey.pem
      sts:
        time: 63072000
    site: bandura_comm
  - name: bandura_comm-le-ssl-le-dn42
    hosts:
      - bandura.dn42
    port: 443
    ssl:
      certificate: /etc/letsencrypt/live/bandura.dn42/fullchain.pem
      key: /etc/letsencrypt/live/bandura.dn42/privkey.pem
      sts:
        time: 63072000
    site: bandura_comm

  ############ mk16.de ############
  - name: mk16de
    hosts:
      - mk16.de
      - mk16de.bandura.i2p
      - mk16de.bandura.dn42
      - rrllz7nkoeaydqzc5tqdexbfpkvensi26nqg3ly3cxrm5qt6m5sq.b32.i2p
    port: 80
    site: mk16de
    gzip: true
  - name: mk16de-le-ssl
    hosts:
      - mk16.de
    port: 443
    ssl:
      certificate: /etc/letsencrypt/live/mk16.de/fullchain.pem
      key: /etc/letsencrypt/live/mk16.de/privkey.pem
      sts:
        time: 63072000
    site: mk16de
  - name: mk16de-le-ssl-le-dn42
    hosts:
      - homepage.bandura.dn42
    port: 443
    site: mk16de
    ssl:
      certificate: /etc/letsencrypt/live/homepage.bandura.dn42/fullchain.pem
      key: /etc/letsencrypt/live/homepage.bandura.dn42/privkey.pem
      sts:
        time: 63072000

  ############ monkic.mk16.de ############
  - name: monkic
    hosts:
      - monkic.mk16.de
      - monkic.bandura.i2p
      - monkic.bandura.dn42
    port: 80
    site: monkic
    gzip: true
  - name: monkic-le-ssl
    hosts:
      - monkic.mk16.de
    port: 443
    ssl:
      certificate: /etc/letsencrypt/live/monkic.mk16.de/fullchain.pem
      key: /etc/letsencrypt/live/monkic.mk16.de/privkey.pem
      sts:
        time: 63072000
    site: monkic
  - name: monkic-le-ssl-le-dn42
    hosts:
      - monkic.bandura.dn42
    port: 443
    ssl:
      certificate: /etc/letsencrypt/live/monkic.bandura.dn42/fullchain.pem
      key: /etc/letsencrypt/live/monkic.bandura.dn42/privkey.pem
      sts:
        time: 63072000
    site: monkic

  ############ myip.dn42 ############
  - name: myip
    hosts:
      - myip.dn42
      - v4.myip.dn42
      - v6.myip.dn42
      - 172.20.0.81
      - [fd42:d42:d42:81::1]
    port: 80
    csp: default
    gzip: true
    locations:
      - path: /
        backend: http://127.0.0.1:8009

  ############ crxn.de ############
  - name: crxndocs
    hosts:
      - docs.crxn
      - [fd92:58b6:2b2::abe3]
      - crxn.de
      - crxn-docs.bandura.crxn
    port: 80
    site: crxndocs
    gzip: true
  - name: crxndocs-le-ssl
    hosts:
      - crxn.de
    port: 443
    ssl:
      certificate: /etc/letsencrypt/live/crxn.de/fullchain.pem
      key: /etc/letsencrypt/live/crxn.de/privkey.pem
      sts:
        time: 63072000
    site: crxndocs

  ############ p2p-node.de ############
  - name: p2pnode
    hosts:
      - p2p-node.de
    port: 80
    site: p2pnode
    gzip: true
  - name: p2pnode-le-ssl
    hosts:
      - p2p-node.de
    port: 443
    ssl:
      certificate: /etc/letsencrypt/live/p2p-node.de/fullchain.pem
      key: /etc/letsencrypt/live/p2p-node.de/privkey.pem
      sts:
        time: 63072000
    site: p2pnode

############ dn42-bgplookup.mk16.de ############
  - name: bgplookup
    hosts:
      - bgplookup.bandura.dn42
      - dn42-bgplookup.mk16.de
    port: 80
    site: bgplookup
    gzip: true
  - name: bgplookup-le-ssl
    hosts:
      - dn42-bgplookup.mk16.de
    port: 443
    ssl:
      certificate: /etc/letsencrypt/live/dn42-bgplookup.mk16.de/fullchain.pem
      key: /etc/letsencrypt/live/dn42-bgplookup.mk16.de/privkey.pem
      sts:
        time: 63072000
    site: bgplookup
  - name: bgplookup-le-dn42-le-ssl
    hosts:
      - bgplookup.bandura.dn42
    port: 443
    ssl:
      certificate: /etc/letsencrypt/live/bgplookup.bandura.dn42/fullchain.pem
      key: /etc/letsencrypt/live/bgplookup.bandura.dn42/privkey.pem
      sts:
        time: 63072000
    site: bgplookup