kosmos/chef
8
3
Fork 0
Code Issues 34 Pull Requests 3 Projects 2 Activity

Add IPv6 to all OpenResty sites

Browse Source 
Co-authored-by: Greg Karékinian <greg@karekinian.com>
This commit is contained in:
Râu Cao
2026-02-12 17:05:14 +04:00
parent 9f862a89cc
commit 0933e9caa0
27 changed files with 30 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
nodes/draco.kosmos.org.json
View File

@@ -12,6 +12,7 @@
}, },
"openresty": { "openresty": {
"listen_ip": "148.251.237.111", "listen_ip": "148.251.237.111",
"listen_ipv6": "2a01:4f8:202:804a::2",
"log_formats": { "log_formats": {
"json": "{\"ip\":\"$remote_addr\",\"time\":\"$time_local\",\"host\":\"$host\",\"method\":\"$request_method\",\"uri\":\"$uri\",\"status\":$status,\"size\":$body_bytes_sent,\"referer\":\"$http_referer\",\"upstream_addr\":\"$upstream_addr\",\"upstream_response_time\":\"$upstream_response_time\",\"ua\":\"$http_user_agent\"}" "json": "{\"ip\":\"$remote_addr\",\"time\":\"$time_local\",\"host\":\"$host\",\"method\":\"$request_method\",\"uri\":\"$uri\",\"status\":$status,\"size\":$body_bytes_sent,\"referer\":\"$http_referer\",\"upstream_addr\":\"$upstream_addr\",\"upstream_response_time\":\"$upstream_response_time\",\"ua\":\"$http_user_agent\"}"
} }

4
site-cookbooks/discourse/templates/nginx_conf.erb
View File

@@ -8,8 +8,8 @@ upstream _<%= @upstream_name %> {
<% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%> <% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%>
server { server {
server_name <%= @server_name %>; server_name <%= @server_name %>;
listen 443 ssl http2; listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2; listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
ssl_certificate <%= @ssl_cert %>; ssl_certificate <%= @ssl_cert %>;
ssl_certificate_key <%= @ssl_key %>; ssl_certificate_key <%= @ssl_key %>;

2
site-cookbooks/kosmos-akkounts/templates/nginx_conf_akkounts.erb
View File

@@ -11,7 +11,7 @@ proxy_cache_path <%= node[:openresty][:cache_dir] %>/akkounts levels=1:2
server { server {
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2; listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2; listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
server_name <%= @domain %>; server_name <%= @domain %>;
if ($host != $server_name) { if ($host != $server_name) {

2
site-cookbooks/kosmos-akkounts/templates/nginx_conf_akkounts_api.erb
View File

@@ -7,7 +7,7 @@ upstream _akkounts_api {
server { server {
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2; listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2; listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
server_name <%= @domain %>; server_name <%= @domain %>;
ssl_certificate <%= @ssl_cert %>; ssl_certificate <%= @ssl_cert %>;

2
site-cookbooks/kosmos-bitcoin/templates/nginx_conf_btcpayserver.erb
View File

@@ -49,7 +49,7 @@ server {
client_max_body_size 100M; client_max_body_size 100M;
server_name <%= @server_name %>; server_name <%= @server_name %>;
listen 443 ssl http2; listen 443 ssl http2;
listen [::]:443 ssl http2; listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
access_log <%= node[:nginx][:log_dir] %>/btcpayserver.access.log json; access_log <%= node[:nginx][:log_dir] %>/btcpayserver.access.log json;
error_log <%= node[:nginx][:log_dir] %>/btcpayserver.error.log warn; error_log <%= node[:nginx][:log_dir] %>/btcpayserver.error.log warn;

2
site-cookbooks/kosmos-bitcoin/templates/nginx_conf_lndhub.erb
View File

@@ -7,7 +7,7 @@ upstream _lndhub {
server { server {
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2; listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2; listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
server_name <%= @server_name %>; server_name <%= @server_name %>;
add_header Strict-Transport-Security "max-age=15768000"; add_header Strict-Transport-Security "max-age=15768000";

2
site-cookbooks/kosmos-btcpayserver/templates/nginx_conf_btcpayserver.erb
View File

@@ -49,7 +49,7 @@ server {
server_name <%= @server_name %>; server_name <%= @server_name %>;
<% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%> <% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%>
listen 443 ssl http2; listen 443 ssl http2;
listen [::]:443 ssl http2; listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
<% else -%> <% else -%>
listen 80; listen 80;
<% end -%> <% end -%>

2
site-cookbooks/kosmos-ejabberd/templates/nginx_conf_upload_service.erb
View File

@@ -3,7 +3,7 @@
server { server {
listen 443 ssl http2; listen 443 ssl http2;
listen [::]:443 ssl http2; listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
server_name <%= @server_name %>; server_name <%= @server_name %>;
ssl_certificate <%= @ssl_cert %>; ssl_certificate <%= @ssl_cert %>;

2
site-cookbooks/kosmos-hubot/templates/default/nginx_conf_hubot.erb
View File

@@ -7,7 +7,7 @@ upstream _express_<%= @server_name.gsub(".", "_") %> {
server { server {
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2; listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2; listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
server_name <%= @server_name %>; server_name <%= @server_name %>;
add_header Strict-Transport-Security "max-age=15768000"; add_header Strict-Transport-Security "max-age=15768000";

2
site-cookbooks/kosmos-ipfs/templates/default/nginx_conf_ipfs.kosmos.org.erb
View File

@@ -12,7 +12,7 @@ upstream _ipfs_api {
server { server {
server_name <%= @server_name %>; server_name <%= @server_name %>;
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2; listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2; listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
access_log /var/log/nginx/<%= @server_name %>.access.log; access_log /var/log/nginx/<%= @server_name %>.access.log;
error_log /var/log/nginx/<%= @server_name %>.error.log; error_log /var/log/nginx/<%= @server_name %>.error.log;

2
site-cookbooks/kosmos-mastodon/templates/default/nginx_conf_mastodon.erb
View File

@@ -21,7 +21,7 @@ proxy_cache_path /var/cache/nginx/mastodon levels=1:2
server { server {
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2; listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2; listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
server_name <%= @server_name %>; server_name <%= @server_name %>;
include <%= @shared_config_path %>; include <%= @shared_config_path %>;

2
site-cookbooks/kosmos_assets/templates/nginx_conf_assets.erb
View File

@@ -3,7 +3,7 @@
server { server {
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2; listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2; listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
server_name <%= @domain %>; server_name <%= @domain %>;
root /var/www/<%= @domain %>/site; root /var/www/<%= @domain %>/site;

2
site-cookbooks/kosmos_discourse/templates/nginx_conf.erb
View File

@@ -9,7 +9,7 @@ upstream _discourse {
server { server {
server_name <%= @server_name %>; server_name <%= @server_name %>;
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2; listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2; listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
ssl_certificate <%= @ssl_cert %>; ssl_certificate <%= @ssl_cert %>;
ssl_certificate_key <%= @ssl_key %>; ssl_certificate_key <%= @ssl_key %>;

2
site-cookbooks/kosmos_drone/templates/nginx_conf.erb
View File

@@ -8,7 +8,7 @@ upstream _drone {
server { server {
server_name <%= @server_name %>; server_name <%= @server_name %>;
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2; listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2; listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
ssl_certificate <%= @ssl_cert %>; ssl_certificate <%= @ssl_cert %>;
ssl_certificate_key <%= @ssl_key %>; ssl_certificate_key <%= @ssl_key %>;

2
site-cookbooks/kosmos_garage/templates/nginx_conf_s3.erb
View File

@@ -4,7 +4,7 @@ upstream garage_s3 {
server { server {
listen <%= "#{node[:openresty][:listen_ip]}:" if node[:openresty][:listen_ip] %>443 ssl http2; listen <%= "#{node[:openresty][:listen_ip]}:" if node[:openresty][:listen_ip] %>443 ssl http2;
listen [::]:443 http2 ssl; listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
ssl_certificate <%= @ssl_cert %>; ssl_certificate <%= @ssl_cert %>;
ssl_certificate_key <%= @ssl_key %>; ssl_certificate_key <%= @ssl_key %>;

2
site-cookbooks/kosmos_garage/templates/nginx_conf_web.erb
View File

@@ -1,6 +1,6 @@
server { server {
listen <%= "#{node[:openresty][:listen_ip]}:" if node[:openresty][:listen_ip] %>443 ssl http2; listen <%= "#{node[:openresty][:listen_ip]}:" if node[:openresty][:listen_ip] %>443 ssl http2;
listen [::]:443 http2 ssl; listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
server_name <%= @server_name %>; server_name <%= @server_name %>;

2
site-cookbooks/kosmos_gitea/templates/default/nginx_conf_web.erb
View File

@@ -6,7 +6,7 @@ upstream _gitea_web {
server { server {
server_name <%= @server_name %>; server_name <%= @server_name %>;
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2; listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2; listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
ssl_certificate <%= @ssl_cert %>; ssl_certificate <%= @ssl_cert %>;
ssl_certificate_key <%= @ssl_key %>; ssl_certificate_key <%= @ssl_key %>;

2
site-cookbooks/kosmos_liquor-cabinet/templates/nginx_conf_liquor-cabinet.erb
View File

@@ -12,7 +12,7 @@ upstream _<%= @app_name %> {
server { server {
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2; listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2; listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
server_name <%= @server_name %>; server_name <%= @server_name %>;
access_log <%= node[:nginx][:log_dir] %>/<%= @app_name %>.access.log; # TODO json_liquor_cabinet; access_log <%= node[:nginx][:log_dir] %>/<%= @app_name %>.access.log; # TODO json_liquor_cabinet;

1
site-cookbooks/kosmos_openresty/attributes/default.rb Normal file
View File

@@ -0,0 +1 @@
node.default["openresty"]["listen_ipv6"] = "::"

2
site-cookbooks/kosmos_rsk/templates/nginx_conf_rskj.erb
View File

@@ -6,7 +6,7 @@ upstream _<%= @upstream_name %> {
server { server {
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2; listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2; listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
server_name <%= @domain %>; server_name <%= @domain %>;

2
site-cookbooks/kosmos_strfry/templates/nginx_conf_strfry.erb
View File

@@ -13,7 +13,7 @@ upstream _substr {
server { server {
server_name <%= @domain %>; server_name <%= @domain %>;
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2; listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2; listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
access_log "/var/log/nginx/<%= @domain %>.access.log"; access_log "/var/log/nginx/<%= @domain %>.access.log";
error_log "/var/log/nginx/<%= @domain %>.error.log"; error_log "/var/log/nginx/<%= @domain %>.error.log";

2
site-cookbooks/kosmos_website/templates/nginx_conf_redirect.erb
View File

@@ -3,7 +3,7 @@
server { server {
server_name <%= @domain %>; server_name <%= @domain %>;
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2; listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2; listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
access_log <%= node[:openresty][:log_dir] %>/<%= @domain %>.access.log; access_log <%= node[:openresty][:log_dir] %>/<%= @domain %>.access.log;
error_log <%= node[:openresty][:log_dir] %>/<%= @domain %>.error.log warn; error_log <%= node[:openresty][:log_dir] %>/<%= @domain %>.error.log warn;

2
site-cookbooks/kosmos_website/templates/nginx_conf_simple.erb
View File

@@ -3,7 +3,7 @@
server { server {
server_name <%= @domain %>; server_name <%= @domain %>;
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2; listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2; listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
root /var/www/<%= @domain %>/public; root /var/www/<%= @domain %>/public;

3
site-cookbooks/kosmos_website/templates/nginx_conf_website.erb
View File

@@ -3,6 +3,7 @@
server { server {
server_name _; server_name _;
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>80 default_server; listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>80 default_server;
listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:80 default_server;
location / { location / {
return 301 https://<%= @domain %>; return 301 https://<%= @domain %>;
@@ -12,7 +13,7 @@ server {
server { server {
server_name <%= @domain %>; server_name <%= @domain %>;
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2 default_server; listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2 default_server;
listen [::]:443 ssl http2 default_server; listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2 default_server;
if ($host != $server_name) { if ($host != $server_name) {
return 307 $scheme://$server_name; return 307 $scheme://$server_name;

4
site-cookbooks/kredits-github/templates/default/nginx_conf.erb
View File

@@ -5,8 +5,8 @@ upstream _<%= @app_name %> {
<% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%> <% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%>
server { server {
listen 443 ssl http2; listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2; listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
server_name <%= @server_name %>; server_name <%= @server_name %>;
access_log <%= node[:nginx][:log_dir] %>/<%= @app_name %>.access.log json; access_log <%= node[:nginx][:log_dir] %>/<%= @app_name %>.access.log json;

2
site-cookbooks/openresty

Submodule site-cookbooks/openresty updated: bc916b981c...b31d6b0b01

2
site-cookbooks/remotestorage_discourse/templates/nginx_conf.erb
View File

@@ -8,7 +8,7 @@ upstream _rs_discourse {
server { server {
server_name <%= @server_name %>; server_name <%= @server_name %>;
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2; listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2; listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
ssl_certificate <%= @ssl_cert %>; ssl_certificate <%= @ssl_cert %>;
ssl_certificate_key <%= @ssl_key %>; ssl_certificate_key <%= @ssl_key %>;