nginx_ssl_cert_name: "{{ domain.name }}"
ansible_copySSLCertificate_DomainName: "{{ domain.name }}"
certbot_auto_renew_user: root
certbot_create_if_missing: true
certbot_cert_name: "{{domain.name}}"
certbot_certs:
  - email: "{{user.mail}}"
    domains:
    - "{{domain.name}}"
    - www.{{domain.name}}
    - git.{{domain.name}}
    - supysonic.{{domain.name}}
    - syno.{{domain.name}}
    - file.{{domain.name}}
    - hass.{{domain.name}}
    - ww.{{domain.name}}
    - vault.{{domain.name}}
    - drone.{{domain.name}}

nginx_server_tokens: "off"
nginx_server_resolver: "192.168.1.40 192.168.1.10 ipv6=off"
nginx_realIP_Proxy: 192.168.1.40/24
nginx_upstreams:
    - name: Nextcloud-PHP-handler
      servers:
        - unix:/run/nextcloud/nextcloud.sock
    - name: archMirrorUp
      servers:
        - localhost:7001
        - localhost:7002 backup
        - localhost:7003 backup
nginx_extra_http_options: |
  proxy_connect_timeout 600s;
  proxy_send_timeout 600s;
  proxy_read_timeout 600s;
  fastcgi_send_timeout 600s;
  fastcgi_read_timeout 600s;
nginx_vhosts:
    - listen: "80 default_server"
      server_name: "*.ducamps.win ducamps.win"
      filename: "redirect80.conf"
      state: "present"
      template: "{{ nginx_vhost_template }}"
      extra_parameters: |
        return 301 https://$host;
    - listen: "443 ssl"
      server_name: "www.{{domain.name}}"
      root: "/usr/share/nginx/html/"
      error_page: "404              /404/404.html"
      filename: "default.conf"
      state: "present"
      template: "{{ nginx_vhost_template }}"
      extra_parameters: |
        include /etc/nginx/conf.d/{{domain.name}}.ssl;
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/share/nginx/html;
        }
        location / {
           rewrite ^/.well-known/carddav /radicale/$remote_user/carddav/ redirect;
           rewrite ^/.well-known/caldav /radicale/$remote_user/caldav/ redirect;
 
           index index.php index.html index.htm ;
           default_type text/html;

        }
        location =/ {
             rewrite ^ /welcome;
        }
        location /radicale/ 
        { 
            # The trailing / is important!
            proxy_pass        http://localhost:5232/; # The / is important!
            proxy_set_header  X-Script-Name /radicale;
            proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_pass_header Authorization;
        }


        location ~ \.php$ {
           # try_files $uri =404;
            fastcgi_split_path_info ^(.+\.php)(/.+)$;
            fastcgi_pass unix:/run/php-fpm/php-fpm.sock;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_read_timeout 800;
            fastcgi_index index.php;
            include fastcgi_params;
        }
        include /etc/nginx/conf.d/*.default;
    - listen: "443 ssl"
      server_name: "git.{{domain.name}}"
      filename: "gitea.conf"
      state: "present"
      access_log: /var/log/nginx/gitea.access.log
      error_log: /var/log/nginx/gitea.error.log
      template: "{{ nginx_vhost_template }}"
      extra_parameters: |
        include /etc/nginx/conf.d/{{domain.name}}.ssl;
        location / {
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-Host $host:$server_port;
          proxy_set_header X-Forwarded-Server $host;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
          proxy_pass http://localhost:3000;
        }
      
    - listen: "443 ssl"
      server_name: "syno.{{domain.name}}"
      filename: "syno.conf"
      state: "present"
      template: "{{ nginx_vhost_template }}"
      access_log: /var/log/nginx/syno.access.log
      error_log: /var/log/nginx/syno.error.log
      extra_parameters: |
        include /etc/nginx/conf.d/{{domain.name}}.ssl;
        location / {
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-Host $host:$server_port;
          proxy_set_header X-Forwarded-Server $host;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
          proxy_pass http://192.168.1.10:5000;
        }   
    - listen: "443 ssl"
      server_name: "supysonic.{{domain.name}}"
      filename: "supysonic.conf"
      state: "present"
      template: "{{ nginx_vhost_template }}"
      access_log: /var/log/nginx/supysonic.access.log
      error_log: /var/log/nginx/supysonic.error.log
      extra_parameters: |
        include /etc/nginx/conf.d/{{domain.name}}.ssl;
        location / { 
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-Host $host:$server_port;
          proxy_set_header X-Forwarded-Server $host;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
          proxy_pass http://localhost:8001;
        }
    - listen: "443 ssl"
      server_name: "file.{{domain.name}}"
      filename: "nextcloud.conf"
      state: "present"
      template: "{{ nginx_vhost_template }}"
      access_log: /var/log/nginx/nextcloud.access.log
      error_log: /var/log/nginx/nextcloud.error.log
      extra_parameters: |
        include /etc/nginx/conf.d/{{domain.name}}.ssl;
        add_header X-Content-Type-Options nosniff;
        add_header X-XSS-Protection "1; mode=block";
        add_header X-Robots-Tag none;
        add_header X-Download-Options noopen;
        add_header X-Permitted-Cross-Domain-Policies none;

        # Path to the root of your installation
        root /usr/share/webapps/nextcloud/;

        location = /robots.txt {
            allow all;
            log_not_found off;
            access_log off;
        }
      
        # The following 2 rules are only needed for the user_webfinger app.
        # Uncomment it if you're planning to use this app.
        #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
        #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json
        # last;
      
        location = /.well-known/carddav {
          return 301 $scheme://$host/remote.php/dav;
        }
        location = /.well-known/caldav {
          return 301 $scheme://$host/remote.php/dav;
        }
      
        # set max upload size
        client_max_body_size 512M;
        fastcgi_buffers 64 4K;
      
        # Enable gzip but do not remove ETag headers
        gzip on;
        gzip_vary on;
        gzip_comp_level 4;
        gzip_min_length 256;
        gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
        gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
      
        # Uncomment if your server is build with the ngx_pagespeed module
        # This module is currently not supported.
        #pagespeed off;
      
        location / {
            rewrite ^ /index.php$request_uri;
        }
      
        location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
            deny all;
        }
        location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
            deny all;
        }
      
        location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+|.+\/richdocumentscode\/proxy)\.php(?:$|\/) {
            fastcgi_split_path_info ^(.+?\.php)(/.*)$;
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_param PATH_INFO $fastcgi_path_info;
            #fastcgi_param HTTPS on;
            #Avoid sending the security headers twice
            fastcgi_param modHeadersAvailable true;
            fastcgi_param front_controller_active true;
            fastcgi_pass Nextcloud-PHP-handler;
            fastcgi_intercept_errors on;
            fastcgi_request_buffering off;
        }
      
        location ~ ^/(?:updater|ocs-provider)(?:$|/) {
            try_files $uri/ =404;
            index index.php;
        }
      
        # Adding the cache control header for js and css files
        # Make sure it is BELOW the PHP block
        location ~ \.(?:css|js|woff|svg|gif)$ {
            try_files $uri /index.php$request_uri;
            add_header Cache-Control "public, max-age=15778463";
            # Add headers to serve security related headers (It is intended to
            # have those duplicated to the ones above)
            # Before enabling Strict-Transport-Security headers please read into
            # this topic first.
            # add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
            #
            # WARNING: Only add the preload option once you read about
            # the consequences in https://hstspreload.org/. This option
            # will add the domain to a hardcoded list that is shipped
            # in all major browsers and getting removed from this list
            # could take several months.
            add_header X-Content-Type-Options nosniff;
            add_header X-XSS-Protection "1; mode=block";
            add_header X-Robots-Tag none;
            add_header X-Download-Options noopen;
            add_header X-Permitted-Cross-Domain-Policies none;
            # Optional: Don't log access to assets
            access_log off;
        }
      
        location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ {
            try_files $uri /index.php$request_uri;
            # Optional: Don't log access to other assets
            access_log off;
        }
    - listen: "443 ssl"
      server_name: "hass.{{domain.name}}"
      filename: "hass.conf"
      state: "present"
      template: "{{ nginx_vhost_template }}"
      access_log: /var/log/nginx/hass.access.log
      error_log: /var/log/nginx/hass.error.log
      extra_parameters: |
        include /etc/nginx/conf.d/{{domain.name}}.ssl;
        location / { 
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-Host $host:$server_port;
          proxy_set_header X-Forwarded-Server $host;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
          proxy_pass http://localhost:8123;
        }
        location /api/websocket {
          proxy_pass http://localhost:8123/api/websocket;
          proxy_set_header Host $host;
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "upgrade";
        }
    - listen: "443 ssl"
      server_name: "ww.{{domain.name}}"
      filename: "chisel.conf"
      state: "present"
      template: "{{ nginx_vhost_template }}"
      access_log: /var/log/nginx/chisel.access.log
      error_log: /var/log/nginx/chisel.error.log
      extra_parameters: |
        include /etc/nginx/conf.d/{{domain.name}}.ssl;
        location / { 
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "upgrade";
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-Host $host:$server_port;
          proxy_set_header X-Forwarded-Server $host;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
          proxy_pass http://localhost:9090;
        }
    - listen: "443 ssl"
      server_name: "vault.{{domain.name}}"
      filename: "vault.conf"
      state: present
      template: "{{ nginx_vhost_template }}"
      access_log: /var/log/nginx/vault.access.log
      error_log: /var/log/nginx/vault.error.log
      extra_parameters: |
        client_max_body_size 128M;
  
        location / {
          proxy_pass http://localhost:8081;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $scheme;
           }
           
           location /notifications/hub {
             proxy_pass http://localhost:3012;
             proxy_set_header Upgrade $http_upgrade;
             proxy_set_header Connection "upgrade";
           }
           
           location /notifications/hub/negotiate {
             proxy_pass http://localhost:8081;
           }

    - listen: "443 ssl"
      server_name: "drone.{{domain.name}}"
      filename: "drone.conf"
      state: "present"
      template: "{{ nginx_vhost_template }}"
      access_log: /var/log/nginx/drone.access.log
      error_log: /var/log/nginx/drone.error.log
      extra_parameters: |
        include /etc/nginx/conf.d/{{domain.name}}.ssl;
        location / { 
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-Host $host:$server_port;
          proxy_set_header X-Forwarded-Server $host;
          proxy_set_header X-Forwarded-Proto $scheme;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

          add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
          proxy_pass http://localhost:3001;
        }
        location /api/websocket {
          proxy_pass http://localhost:8123/api/websocket;
          proxy_set_header Host $host;
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "upgrade";
        }
    - listen: 80
      server_name: "arch.{{domain.name}}"
      filename: "archMirror.conf"
      template: "{{ nginx_vhost_template }}"
      root: "{{arch_mirror_location}}"
      access_log: /var/log/nginx/archmirror.access.log
      error_log: /var/log/nginx/archmirror.error.log
      extra_parameters: |
        autoindex   on;

        # Requests for package db, signature files and files db should redirect upstream without caching
        location ~ \.(db|sig|files)$ {
            proxy_pass http://archMirrorUp$request_uri;
        }

        # Requests for actual packages should be served directly from cache if available.
        #   If not available, retrieve and save the package from an upstream mirror.
        location ~ \.tar\.(xz|zst)$ {
            try_files $uri @pkg_mirror;
        }

        # Retrieve package from upstream mirrors and cache for future requests
        location @pkg_mirror {
            proxy_store    on;
            proxy_redirect off;
            proxy_store_access  user:rw group:rw all:r;
            proxy_next_upstream error timeout http_404;
            proxy_pass          http://archMirrorUp$request_uri;
        }
    - listen:  "127.0.0.1:7001"
      server_name: "_"
      filename: "archMirrorUpstream1.conf"
      template: "{{ nginx_vhost_template }}"
      extra_parameters: |
        location / {
          proxy_pass       http://archlinux.mailtunnel.eu$request_uri;
        }
    - listen:  "127.0.0.1:7002"
      server_name: "_"
      filename: "archMirrorUpstream2.conf"
      template: "{{ nginx_vhost_template }}"
      extra_parameters: |
        location / {
          proxy_pass       http://mirror.cyberbits.eu/archlinux$request_uri;
        }
    - listen:  "127.0.0.1:7003"
      server_name: "_"
      filename: "archMirrorUpstream3.conf"
      template: "{{ nginx_vhost_template }}"
      extra_parameters: |
        location / {
          proxy_pass       http://mirrors.niyawe.de/archlinux$request_uri;
        }