tune nginx, varia

ansible/roles/nginx/tasks/main.yml

@@ -28,9 +28,9 @@
     - wo-bisch-web.css
     - wo-bisch-web-custom.css
 
-- name: Allow apache to read files in /root/.acme.sh/wo-bisch.ch
+- name: Allow apache to read files in /root/.acme.sh/{{ letsEncryptDomain }}
   sefcontext:
-    target: '/root/.acme.sh/mail2.nbit.ch(/.*)?'
+    target: '/root/.acme.sh/{{ letsEncryptDomain }}(/.*)?'
     setype: httpd_sys_content_t
     state: present
   notify:

ansible/roles/nginx/templates/nginx.conf.j2

@@ -26,6 +26,14 @@ http {
     include             /etc/nginx/mime.types;
     default_type        application/octet-stream;
 
+    # GZip Settings
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 10240;
+    gzip_proxied expired no-cache no-store private auth;
+    gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml application/javascript;
+    gzip_disable "MSIE [1-6]\.";
+
     server {
         listen       80 default_server;
         listen       [::]:80 default_server;
@@ -46,6 +54,12 @@ http {
             proxy_pass http://127.0.0.1:8080;
         }
 
+        location /static {
+            autoindex off;
+            root {{ document_root }}/;
+            expires 30d;
+        }
+
         location / { try_files $uri @wo-bisch; }
         location @wo-bisch {
             proxy_pass http://127.0.0.1:4000;
@@ -53,8 +67,8 @@ http {
 
         listen [::]:443 ssl ipv6only=on; 
         listen 443 ssl; 
-        ssl_certificate /root/.acme.sh/wo-bisch.ch/fullchain.cer;
-        ssl_certificate_key /root/.acme.sh/wo-bisch.ch/wo-bisch.ch.key;
+        ssl_certificate /root/.acme.sh/{{ letsEncryptDomain }}/fullchain.cer;
+        ssl_certificate_key /root/.acme.sh/{{ letsEncryptDomain }}/{{ letsEncryptDomain }}.key;
     }
 
 }