kacerr/home-kubernetes
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

servers/shadow: open GitLab SSH port, add docker-dev/czechultimate nginx routes

Browse Source 
Forward tcp/33022 (FORWARD, LIBVIRT_INP/OUT, PREROUTING DNAT to
192.168.123.21) so the GitLab remote is reachable, add nginx vhosts
for docker-dev-22 and czechultimate.cz, and route fuj-management
through the k8s gateway. Also record saint's eno0 interface config.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Jan Novak
2026-07-09 00:05:49 +02:00
parent 4b39834f10
commit b62b37542b
6 changed files with 177 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

113
servers/shadow/nginx/21_docker_hrajfrisbee.cz.conf
View File

@@ -36,12 +36,6 @@ server {
# ----------------
# api-sync.psmf.hrajfrisbee.cz
server {
# if ($host = api-sync.psmf.hrajfrisbee.cz) {
# return 301 https://$host$request_uri;
# } # managed by Certbot
listen 80;
client_max_body_size 15m; proxy_read_timeout 600;
server_name
api-sync.psmf.hrajfrisbee.cz
@@ -49,19 +43,12 @@ server {
location / {
proxy_pass http://192.168.123.21:8003;
}
}
server {
if ($host = api.psmf.hrajfrisbee.cz) {
return 301 https://$host$request_uri;
} # managed by Certbot
server_name
api.psmf.hrajfrisbee.cz
;
listen 80;
return 404; # managed by Certbot
listen 8443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/api-sync.psmf.hrajfrisbee.cz/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/api-sync.psmf.hrajfrisbee.cz/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
@@ -75,6 +62,10 @@ server {
gitlab.hrajfrisbee.cz
;
# let certbot http-01 land
location /.well-known/acme-challenge/ { root /var/www/html; }
location / {
proxy_pass http://192.168.123.21:80;
proxy_set_header X-Real-IP $remote_addr;
@@ -92,16 +83,17 @@ server {
}
#listen 443 ssl; # managed by Certbot
#ssl_certificate /etc/letsencrypt/live/gitlab.hrajfrisbee.cz/fullchain.pem; # managed by Certbot
#ssl_certificate_key /etc/letsencrypt/live/gitlab.hrajfrisbee.cz/privkey.pem; # managed by Certbot
#include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
#ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
listen 8443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/gitlab.hrajfrisbee.cz/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/gitlab.hrajfrisbee.cz/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
if ($scheme != "https") {
return 301 https://$host$request_uri;
} # managed by Certbot
}
server {
@@ -123,14 +115,79 @@ server {
}
#listen 443 ssl; # managed by Certbot
#ssl_certificate /etc/letsencrypt/live/registry.gitlab.hrajfrisbee.cz/fullchain.pem; # managed by Certbot
#ssl_certificate_key /etc/letsencrypt/live/registry.gitlab.hrajfrisbee.cz/privkey.pem; # managed by Certbot
#include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
#ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
listen 8443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/registry.gitlab.hrajfrisbee.cz/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/registry.gitlab.hrajfrisbee.cz/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
if ($scheme != "https") {
return 301 https://$host$request_uri;
} # managed by Certbot
}
server {
if ($host = api-sync.psmf.hrajfrisbee.cz) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80;
server_name
api-sync.psmf.hrajfrisbee.cz
;
return 404; # managed by Certbot
}
server {
if ($host = registry.gitlab.hrajfrisbee.cz) {
return 301 https://$host$request_uri;
} # managed by Certbot
server_name
registry.gitlab.hrajfrisbee.cz
;
listen 80;
return 404; # managed by Certbot
}
server {
if ($host = gitlab.hrajfrisbee.cz) {
return 301 https://$host$request_uri;
} # managed by Certbot
server_name
gitlab.hrajfrisbee.cz
;
listen 80;
return 404; # managed by Certbot
}
# ----------------
# legacy sites
# ----------------
server {
server_name
vegtral.cz www.vegtral.cz
;
location / {
proxy_pass http://192.168.123.21:8080;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Ssl on;
client_max_body_size 3000M;
client_body_buffer_size 200000k;
}
}