From b62b37542bf759df8c52975e5bccb4ec38cf5584 Mon Sep 17 00:00:00 2001 From: Jan Novak Date: Thu, 9 Jul 2026 00:05:49 +0200 Subject: [PATCH] servers/shadow: open GitLab SSH port, add docker-dev/czechultimate nginx routes Forward tcp/33022 (FORWARD, LIBVIRT_INP/OUT, PREROUTING DNAT to 192.168.123.21) so the GitLab remote is reachable, add nginx vhosts for docker-dev-22 and czechultimate.cz, and route fuj-management through the k8s gateway. Also record saint's eno0 interface config. Co-Authored-By: Claude Sonnet 5 --- servers/saint/etc/ifcfg-eno0 | 22 ++++ servers/shadow/iptables/rules.v4 | 4 + .../nginx/21_docker_hrajfrisbee.cz.conf | 113 +++++++++++++----- .../nginx/22_docker-dev_hrajfrisbee.cz.conf | 35 ++++++ .../shadow/nginx/nginx-sites-enabled-default | 30 +++++ servers/shadow/nginx/nginx.conf | 1 + 6 files changed, 177 insertions(+), 28 deletions(-) create mode 100644 servers/saint/etc/ifcfg-eno0 create mode 100644 servers/shadow/nginx/22_docker-dev_hrajfrisbee.cz.conf diff --git a/servers/saint/etc/ifcfg-eno0 b/servers/saint/etc/ifcfg-eno0 new file mode 100644 index 0000000..adb55fc --- /dev/null +++ b/servers/saint/etc/ifcfg-eno0 @@ -0,0 +1,22 @@ +TYPE="Ethernet" +BOOTPROTO="none" +DEFROUTE="yes" +IPV4_FAILURE_FATAL="no" +IPV6INIT="yes" +IPV6_AUTOCONF="yes" +IPV6_DEFROUTE="yes" +IPV6_FAILURE_FATAL="no" +NAME="eno1" +UUID="2f881122-85e5-4078-8cec-cf4a7e465321" +DEVICE="eno1" +ONBOOT="yes" +IPADDR="87.236.197.83" +PREFIX="23" +GATEWAY="87.236.196.1" +DNS1="87.236.198.210" +#DNS1="87.236.198.211" +DNS2="89.187.142.8" +IPV6_PEERDNS="yes" +IPV6_PEERROUTES="yes" +IPV6_PRIVACY="no" +ZONE=public \ No newline at end of file diff --git a/servers/shadow/iptables/rules.v4 b/servers/shadow/iptables/rules.v4 index 562e6c4..4434eec 100644 --- a/servers/shadow/iptables/rules.v4 +++ b/servers/shadow/iptables/rules.v4 @@ -49,6 +49,7 @@ COMMIT -A FORWARD -i eno1 -p udp -m udp --dport 5353 -j ACCEPT -A FORWARD -i eno1 -p udp -m udp --dport 51820 -j ACCEPT -A FORWARD -i eno1 -p udp -m udp --dport 1194 -j ACCEPT +-A FORWARD -i eno1 -p tcp -m tcp --dport 33022 -j ACCEPT -A FORWARD -j DOCKER-USER -A FORWARD -j DOCKER-ISOLATION-STAGE-1 -A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT @@ -92,12 +93,14 @@ COMMIT -A LIBVIRT_INP -p tcp -m tcp --dport 53 -j ACCEPT -A LIBVIRT_INP -p udp -m udp --dport 5353 -j ACCEPT -A LIBVIRT_INP -p tcp -m tcp --dport 5353 -j ACCEPT +-A LIBVIRT_INP -p tcp -m tcp --dport 33022 -j ACCEPT -A LIBVIRT_INP -p udp -m udp --dport 67 -j ACCEPT -A LIBVIRT_INP -p tcp -m tcp --dport 67 -j ACCEPT -A LIBVIRT_OUT -p udp -m udp --dport 53 -j ACCEPT -A LIBVIRT_OUT -p tcp -m tcp --dport 53 -j ACCEPT -A LIBVIRT_OUT -p udp -m udp --dport 5353 -j ACCEPT -A LIBVIRT_OUT -p tcp -m tcp --dport 5353 -j ACCEPT +-A LIBVIRT_OUT -p tcp -m tcp --dport 33022 -j ACCEPT -A LIBVIRT_OUT -p udp -m udp --dport 68 -j ACCEPT -A LIBVIRT_OUT -p tcp -m tcp --dport 68 -j ACCEPT -A f2b-sshd -j RETURN @@ -118,6 +121,7 @@ COMMIT -A PREROUTING -i eno1 -p udp -m udp --dport 51820 -j DNAT --to-destination 192.168.123.101:51820 -A PREROUTING -i eno1 -p udp -m udp --dport 1194 -j DNAT --to-destination 192.168.123.101:1194 -A PREROUTING -i eno1 -p tcp -m tcp --dport 21080 -j DNAT --to-destination 192.168.123.141:80 +-A PREROUTING -i eno1 -p tcp -m tcp --dport 33022 -j DNAT --to-destination 192.168.123.21:33022 -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER -A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE diff --git a/servers/shadow/nginx/21_docker_hrajfrisbee.cz.conf b/servers/shadow/nginx/21_docker_hrajfrisbee.cz.conf index 7ba3dd7..76fe26f 100644 --- a/servers/shadow/nginx/21_docker_hrajfrisbee.cz.conf +++ b/servers/shadow/nginx/21_docker_hrajfrisbee.cz.conf @@ -36,12 +36,6 @@ server { # ---------------- # api-sync.psmf.hrajfrisbee.cz server { - # if ($host = api-sync.psmf.hrajfrisbee.cz) { - # return 301 https://$host$request_uri; - # } # managed by Certbot - - - listen 80; client_max_body_size 15m; proxy_read_timeout 600; server_name api-sync.psmf.hrajfrisbee.cz @@ -49,19 +43,12 @@ server { location / { proxy_pass http://192.168.123.21:8003; } -} -server { - if ($host = api.psmf.hrajfrisbee.cz) { - return 301 https://$host$request_uri; - } # managed by Certbot - - - server_name - api.psmf.hrajfrisbee.cz - ; - listen 80; - return 404; # managed by Certbot + listen 8443 ssl; # managed by Certbot + ssl_certificate /etc/letsencrypt/live/api-sync.psmf.hrajfrisbee.cz/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/letsencrypt/live/api-sync.psmf.hrajfrisbee.cz/privkey.pem; # managed by Certbot + include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot } @@ -75,6 +62,10 @@ server { gitlab.hrajfrisbee.cz ; + # let certbot http-01 land + location /.well-known/acme-challenge/ { root /var/www/html; } + + location / { proxy_pass http://192.168.123.21:80; proxy_set_header X-Real-IP $remote_addr; @@ -92,16 +83,17 @@ server { } - #listen 443 ssl; # managed by Certbot - #ssl_certificate /etc/letsencrypt/live/gitlab.hrajfrisbee.cz/fullchain.pem; # managed by Certbot - #ssl_certificate_key /etc/letsencrypt/live/gitlab.hrajfrisbee.cz/privkey.pem; # managed by Certbot - #include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot - #ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot + listen 8443 ssl; # managed by Certbot + ssl_certificate /etc/letsencrypt/live/gitlab.hrajfrisbee.cz/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/letsencrypt/live/gitlab.hrajfrisbee.cz/privkey.pem; # managed by Certbot + include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot if ($scheme != "https") { return 301 https://$host$request_uri; } # managed by Certbot + } server { @@ -123,14 +115,79 @@ server { } - #listen 443 ssl; # managed by Certbot - #ssl_certificate /etc/letsencrypt/live/registry.gitlab.hrajfrisbee.cz/fullchain.pem; # managed by Certbot - #ssl_certificate_key /etc/letsencrypt/live/registry.gitlab.hrajfrisbee.cz/privkey.pem; # managed by Certbot - #include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot - #ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot + listen 8443 ssl; # managed by Certbot + ssl_certificate /etc/letsencrypt/live/registry.gitlab.hrajfrisbee.cz/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/letsencrypt/live/registry.gitlab.hrajfrisbee.cz/privkey.pem; # managed by Certbot + include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot if ($scheme != "https") { return 301 https://$host$request_uri; } # managed by Certbot } + + +server { + if ($host = api-sync.psmf.hrajfrisbee.cz) { + return 301 https://$host$request_uri; + } # managed by Certbot + + + listen 80; + server_name + api-sync.psmf.hrajfrisbee.cz + ; + return 404; # managed by Certbot + + +} + + +server { + if ($host = registry.gitlab.hrajfrisbee.cz) { + return 301 https://$host$request_uri; + } # managed by Certbot + + + server_name + registry.gitlab.hrajfrisbee.cz + ; + listen 80; + return 404; # managed by Certbot +} + + +server { + if ($host = gitlab.hrajfrisbee.cz) { + return 301 https://$host$request_uri; + } # managed by Certbot + + + server_name + gitlab.hrajfrisbee.cz + ; + listen 80; + return 404; # managed by Certbot +} + +# ---------------- +# legacy sites +# ---------------- + +server { + server_name + vegtral.cz www.vegtral.cz + ; + + location / { + proxy_pass http://192.168.123.21:8080; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header X-Forwarded-Proto https; + proxy_set_header X-Forwarded-Ssl on; + + client_max_body_size 3000M; + client_body_buffer_size 200000k; + } +} diff --git a/servers/shadow/nginx/22_docker-dev_hrajfrisbee.cz.conf b/servers/shadow/nginx/22_docker-dev_hrajfrisbee.cz.conf new file mode 100644 index 0000000..430015c --- /dev/null +++ b/servers/shadow/nginx/22_docker-dev_hrajfrisbee.cz.conf @@ -0,0 +1,35 @@ +# ---------------- +# api-sync-dev.psmf.hrajfrisbee.cz +server { + client_max_body_size 15m; proxy_read_timeout 600; + server_name + api-sync-dev.psmf.hrajfrisbee.cz + ; + location / { + proxy_pass http://192.168.123.22:8003; + } + + listen 8443 ssl; # managed by Certbot + ssl_certificate /etc/letsencrypt/live/api-sync-dev.psmf.hrajfrisbee.cz/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/letsencrypt/live/api-sync-dev.psmf.hrajfrisbee.cz/privkey.pem; # managed by Certbot + include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot + +} + + + +server { + if ($host = api-sync-dev.psmf.hrajfrisbee.cz) { + return 301 https://$host$request_uri; + } # managed by Certbot + + + listen 80; + server_name + api-sync-dev.psmf.hrajfrisbee.cz + ; + return 404; # managed by Certbot + + +} \ No newline at end of file diff --git a/servers/shadow/nginx/nginx-sites-enabled-default b/servers/shadow/nginx/nginx-sites-enabled-default index 1f3a390..032330d 100644 --- a/servers/shadow/nginx/nginx-sites-enabled-default +++ b/servers/shadow/nginx/nginx-sites-enabled-default @@ -388,4 +388,34 @@ server { listen 80 ; server_name fuj-management.home.hrajfrisbee.cz; return 404; # managed by Certbot +} + +server { + server_name czechultimate.cz; + + # let certbot http-01 land + location /.well-known/acme-challenge/ { root /var/www/html; } + + location / { return 301 https://www.czechultimate.cz$request_uri; } + + listen 8443 ssl; # managed by Certbot + ssl_certificate /etc/letsencrypt/live/czechultimate.cz/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/letsencrypt/live/czechultimate.cz/privkey.pem; # managed by Certbot + include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot + +} + + +server { + if ($host = czechultimate.cz) { + return 301 https://$host$request_uri; + } # managed by Certbot + + + listen 80; + server_name czechultimate.cz; + return 404; # managed by Certbot + + } \ No newline at end of file diff --git a/servers/shadow/nginx/nginx.conf b/servers/shadow/nginx/nginx.conf index 2dcc709..d45146b 100644 --- a/servers/shadow/nginx/nginx.conf +++ b/servers/shadow/nginx/nginx.conf @@ -66,6 +66,7 @@ stream { # Passthrough to K8s ghost.lab.home.hrajfrisbee.cz k8s_gatewayapi; fujarna.lab.home.hrajfrisbee.cz k8s_gatewayapi; + fuj-management.lab.home.hrajfrisbee.cz k8s_gatewayapi; operator-test.lab.home.hrajfrisbee.cz k8s_gatewayapi; ~^.+\.lab\.home\.hrajfrisbee\.cz$ k8s_ingress;