4 files changed, 70 insertions, 0 deletions
diff --git a/terraform/provision/rootfs/etc/nginx/conf.d/ssl.conf b/terraform/provision/rootfs/etc/nginx/conf.d/ssl.conf
new file mode 100644
index 0000000..bb96ec7
--- /dev/null
+++ b/terraform/provision/rootfs/etc/nginx/conf.d/ssl.conf
@@ -0,0 +1,15 @@
+# The configuration below can be obtained with the Mozilla SSL
+# Configuration Generator at
+# https://mozilla.github.io/server-side-tls/ssl-config-generator/
+
+ssl_certificate /etc/ssl/server.cert.pem;
+ssl_certificate_key /etc/ssl/private/server.key.pem;
+ssl_session_timeout 1d;
+ssl_session_cache shared:SSL:50m;
+ssl_session_tickets off;
+
+ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
+
+ssl_stapling on;
+ssl_stapling_verify on;
+ssl_trusted_certificate /etc/ssl/issuer.cert.pem;
diff --git a/terraform/provision/rootfs/etc/nginx/sites-enabled/default.conf b/terraform/provision/rootfs/etc/nginx/sites-enabled/default.conf
new file mode 100644
index 0000000..e10725d
--- /dev/null
+++ b/terraform/provision/rootfs/etc/nginx/sites-enabled/default.conf
@@ -0,0 +1,9 @@
+# Default catch-all configuration, applied when no other configuration matches
+server {
+       server_name _;
+       listen 80 default_server;
+       listen [::]:80 default_server;
+
+       # close the connection without sending a response
+       return 444;
+}
+\ No newline at end of file
diff --git a/terraform/provision/rootfs/etc/nginx/sites-enabled/git.conf b/terraform/provision/rootfs/etc/nginx/sites-enabled/git.conf
new file mode 100644
index 0000000..7210dbc
--- /dev/null
+++ b/terraform/provision/rootfs/etc/nginx/sites-enabled/git.conf
@@ -0,0 +1,33 @@
+server {
+    server_name git.*;
+    listen 80;
+    listen [::]:80;
+    listen 443 ssl;
+    listen [::]:443 ssl;
+
+    root /var/lib/git/www;
+
+    # requests that should to go to git-http-backend
+    location ~ ^.*/(HEAD|info/refs|objects/info/.*|git-(upload|receive)-pack)$ {
+        root /srv/git;							       
+        include fastcgi_params;
+	fastcgi_param SCRIPT_FILENAME /usr/lib/git-core/git-http-backend;
+	fastcgi_param GIT_PROJECT_ROOT /srv/git;
+        fastcgi_param GIT_HTTP_EXPORT_ALL "";
+        fastcgi_param PATH_INFO $uri;
+        fastcgi_pass unix:/run/fcgiwrap.socket;
+    }
+
+    location @cgit {
+	include fastcgi_params;
+	fastcgi_param SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi;
+        fastcgi_param CGIT_CONFIG /etc/cgitrc.d/crashbox;
+        fastcgi_param PATH_INFO $uri;
+        fastcgi_pass unix:/run/fcgiwrap.socket;
+    }
+
+    location / {
+        try_files $uri @cgit;
+    }
+
+}
diff --git a/terraform/provision/rootfs/etc/nginx/sites-enabled/ip.conf b/terraform/provision/rootfs/etc/nginx/sites-enabled/ip.conf
new file mode 100644
index 0000000..2f3ab1e
--- /dev/null
+++ b/terraform/provision/rootfs/etc/nginx/sites-enabled/ip.conf
@@ -0,0 +1,13 @@
+# Echo remote IP address
+# https://michael.lustfield.net/nginx/simple-ip-echo
+server {
+        server_name ip.*;
+        listen 80;
+        listen [::]:80;
+        listen 443 ssl;
+        listen [::]:443 ssl;
+        location = / {
+       	        default_type text/plain;
+	        echo $remote_addr;
+        }
+}
+\ No newline at end of file