Xor290/ansible-mln
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: update

Browse Source
This commit is contained in:
Xor290
2026-08-08 12:04:57 +02:00
parent 56aef1fa9b
commit 8e36acd812
76 changed files with 12710 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
monitoring/security/nginx/nginx-fixed.conf
+74
View File
@@ -0,0 +1,74 @@
worker_processes auto;
events {
worker_connections 1024;
}
http {
# Main HTTPS server
server {
listen 0.0.0.0:80 default_server;
listen [::]:80 default_server;
return 301 https://$host$request_uri;
}
server {
listen 0.0.0.0:443 ssl default_server;
listen [::]:443 ssl default_server;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
# Wazuh (root)
location / {
proxy_pass https://wazuh.dashboard:5601/;
proxy_ssl_verify off;
proxy_http_version 1.1;
proxy_set_header Host wazuh.dashboard:5601;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_read_timeout 300s;
proxy_hide_header Content-Security-Policy;
}
# Dozzle
location /dozzle {
proxy_pass http://dozzle:8080;
proxy_http_version 1.1;
proxy_buffering off;
proxy_cache off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_redirect ~^http://dozzle:8080/(.*)$ /dozzle/$1;
proxy_redirect ~^/$/ /dozzle/;
proxy_read_timeout 3600s;
}
# Beszel
location /beszel {
proxy_pass http://beszel:8090;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_redirect ~^http://beszel:8090/(.*)$ /beszel/$1;
proxy_redirect ~^/$/ /beszel/;
sub_filter 'href="/' 'href="/beszel/';
sub_filter 'src="/' 'src="/beszel/';
sub_filter 'url(/' 'url(/beszel/';
sub_filter_once off;
proxy_read_timeout 3600s;
}
}
}
monitoring/security/nginx/nginx-simple.conf
+83
View File
@@ -0,0 +1,83 @@
worker_processes auto;
events {
worker_connections 1024;
}
http {
resolver 127.0.0.11 valid=10s ipv6=off;
upstream wazuh_backend {
server wazuh.dashboard:5601;
}
upstream dozzle_backend {
server dozzle:8080;
}
upstream beszel_backend {
server beszel:8090;
}
# Redirect HTTP to HTTPS
server {
listen 80;
return 301 https://$host$request_uri;
}
# Main HTTPS server
server {
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
# Root redirects to /wazuh
location = / {
return 301 https://$host/wazuh;
}
# Wazuh
location /wazuh/ {
proxy_pass https://wazuh_backend/;
proxy_ssl_verify off;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_read_timeout 300s;
}
# Dozzle
location /dozzle/ {
proxy_pass http://dozzle_backend/;
proxy_http_version 1.1;
proxy_buffering off;
proxy_cache off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 3600s;
}
# Beszel
location /beszel/ {
proxy_pass http://beszel_backend/;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 3600s;
}
}
}
monitoring/security/nginx/nginx.conf
Executable
+95
View File
@@ -0,0 +1,95 @@
worker_processes auto;
events {
worker_connections 1024;
}
http {
resolver 127.0.0.11 valid=10s ipv6=off;
# ── Dozzle (8080) ───────────────────────────────────────
server {
listen 8080 ssl;
server_name _;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
access_log /var/log/nginx/dozzle_access.log;
error_log /var/log/nginx/dozzle_error.log;
location / {
proxy_pass http://dozzle:8080;
proxy_http_version 1.1;
proxy_buffering off;
proxy_cache off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 3600s;
}
}
# ── Beszel (8090) ───────────────────────────────────────
server {
listen 8090 ssl;
server_name _;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
access_log /var/log/nginx/beszel_access.log;
error_log /var/log/nginx/beszel_error.log;
location / {
proxy_pass http://beszel:8090;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 3600s;
}
}
# ── Wazuh (443) ──────────────────────────────────────────
server {
listen 443 ssl default_server;
server_name _;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
access_log /var/log/nginx/wazuh_access.log;
error_log /var/log/nginx/wazuh_error.log;
location / {
proxy_pass https://wazuh.dashboard:5601;
proxy_ssl_verify off;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_read_timeout 300s;
}
}
# ── HTTP Redirect to HTTPS ───────────────────────────────
server {
listen 80;
server_name _;
return 301 https://$host$request_uri;
}
}