From: Christian Heller <c.heller@plomlompom.de>
Date: Sun, 2 Dec 2018 00:31:25 +0000 (+0100)
Subject: Add etc files for web server.
X-Git-Url: https://plomlompom.com/repos/ledger?a=commitdiff_plain;h=500ec90dee8ba3b3eec0bbd6804bd23c874238c1;p=config

Add etc files for web server.
---

diff --git a/all_new_2018/linkable_etc_files/web/etc/iptables/rules.v4 b/all_new_2018/linkable_etc_files/web/etc/iptables/rules.v4
new file mode 100644
index 0000000..9b714c6
--- /dev/null
+++ b/all_new_2018/linkable_etc_files/web/etc/iptables/rules.v4
@@ -0,0 +1,18 @@
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT ACCEPT [0:0]
+# otherwise self-referential connections to local host will fail
+-A INPUT -i lo -j ACCEPT
+# tolerate any inbound connections requested by our server, no matter the port
+-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+# this enables ping etc.
+-A INPUT -p icmp -j ACCEPT
+# SSH
+-A INPUT -p tcp --dport 22 -j ACCEPT
+# HTTP
+-A INPUT -p tcp --dport 80 -j ACCEPT
+# HTTPS
+-A INPUT -p tcp --dport 443 -j ACCEPT
+COMMIT
+# this last line is here because iptables-restore ignores the final command if no newline follows it
\ No newline at end of file
diff --git a/all_new_2018/linkable_etc_files/web/etc/nginx/nginx.conf b/all_new_2018/linkable_etc_files/web/etc/nginx/nginx.conf
new file mode 100644
index 0000000..1072651
--- /dev/null
+++ b/all_new_2018/linkable_etc_files/web/etc/nginx/nginx.conf
@@ -0,0 +1,44 @@
+# system integration
+user www-data;
+worker_processes auto;
+pid /run/nginx.pid;
+
+# is expected even if empty
+events {
+}
+
+http {
+        # define content-type headers
+        types {
+            text/html                             html htm shtml;
+            #text/css                              css;
+            #text/xml                              xml;
+            #text/plain                            txt sh rst md;
+            #application/xhtml+xml                 xhtml;
+            #application/pdf                       pdf;
+            #image/jpeg                            jpg jpeg;
+            #image/png                             png;
+        }
+        default_type application/octet_stream;
+        charset utf-8;
+
+        # logging deactivated due to DSGVO
+	#access_log /var/log/nginx/access.log;
+	#error_log /var/log/nginx/error.log;
+
+        # HTTP server: only enforce HTTPS 
+        server {
+                listen 80;
+                return 301 https://$host$request_uri;
+        }
+
+	# HTTPS server
+        server {
+                listen 443 ssl;
+                server_name web20181130.plomlompom.com;
+                ssl_certificate /etc/letsencrypt/live/web20181130.plomlompom.com/fullchain.pem;
+                ssl_certificate_key /etc/letsencrypt/live/web20181130.plomlompom.com/privkey.pem;
+                root /var/www/html/;
+		index index.html index.htm index.nginx-debian.html;
+        }
+}