anpassungen nginx

.gitignore

@@ -0,0 +1,40 @@
+# IGNORE ALLES standardmäßig (Repo-Root ist /)
+ /*
+
+# Gitignore selbst muss rein
+!/.gitignore
+
+# ---- WHITELIST: NGINX ----
+!/etc/
+!/etc/nginx/
+!/etc/nginx/sites-available/
+!/etc/nginx/sites-available/reverse-proxy.conf
+
+# ---- WHITELIST: Docker Compose Files ----
+!/opt/
+!/opt/gitea/
+!/opt/gitea/docker-compose.yml
+
+!/opt/monitoring/
+!/opt/monitoring/docker-compose.yml
+
+!/opt/nextcloud/
+!/opt/nextcloud/docker-compose.yml
+
+!/opt/vaultwarden/
+!/opt/vaultwarden/docker-compose.yml
+
+# ---- WHITELIST: systemd units ----
+!/usr/
+!/usr/lib/
+!/usr/lib/systemd/
+!/usr/lib/systemd/system/
+!/usr/lib/systemd/system/wg-quick@.service
+
+!/etc/systemd/
+!/etc/systemd/system/
+!/etc/systemd/system/monitoring.service
+!/etc/systemd/system/proxmox-vm.service
+!/etc/systemd/system/nextcloud.service
+!/etc/systemd/system/gitea.service
+!/etc/systemd/system/vaultwarden.service

etc/nginx/sites-available/reverse-proxy.conf

@@ -0,0 +1,156 @@
+# -----------------------------
+# Proxmox (nur via VPN)
+# -----------------------------
+server {
+    listen 443 ssl http2;
+    server_name proxmox.cutemeli.com;
+
+    ssl_certificate     /etc/ssl/certs/proxmox.pem;
+    ssl_certificate_key /etc/ssl/private/proxmox.key;
+
+    allow 127.0.0.1;
+    allow 10.10.0.0/24;
+    allow 172.17.0.0/16;
+    allow 172.18.0.0/16;
+    allow 172.19.0.0/16;
+    deny all;
+
+    location / {
+        proxy_pass https://127.0.0.1:8006;
+        proxy_ssl_verify off;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
+# -----------------------------
+# Git
+# -----------------------------
+server {
+    listen 443 ssl http2;
+    server_name git.cutemeli.com;
+
+    ssl_certificate     /etc/ssl/certs/git.pem;
+    ssl_certificate_key /etc/ssl/private/git.key;
+
+    #allow 10.10.0.0/24;
+    #allow 127.0.0.1;
+    #deny all;
+
+    client_max_body_size 5g;
+
+    location / {
+        proxy_pass http://127.0.0.1:3001;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+
+        proxy_read_timeout 3600;
+        proxy_redirect off;
+    }
+}
+
+# -----------------------------
+# Nextcloud
+# -----------------------------
+server {
+    listen 443 ssl http2;
+    server_name share.cutemeli.com;
+
+    ssl_certificate     /etc/ssl/certs/share.pem;
+    ssl_certificate_key /etc/ssl/private/share.key;
+
+    client_max_body_size 2G;
+
+    location / {
+        proxy_pass http://127.0.0.1:8080;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+
+        proxy_read_timeout 3600;
+        proxy_redirect off;
+    }
+
+    # Pflicht für DAV / Kalender / Kontakte
+    location = /.well-known/carddav {
+        return 301 /remote.php/dav;
+    }
+    location = /.well-known/caldav {
+        return 301 /remote.php/dav;
+    }
+
+    # Optional für Federation, Talk, etc.
+    location ^~ /.well-known {
+        proxy_pass http://127.0.0.1:8080;
+    }
+}
+
+# -----------------------------
+# Monitoring (nur via VPN)
+# -----------------------------
+server {
+    listen 443 ssl http2;
+    server_name monitor.cutemeli.com;
+
+    ssl_certificate     /etc/ssl/certs/monitor.pem;
+    ssl_certificate_key /etc/ssl/private/monitor.key;
+
+    allow 10.10.0.0/24;
+    allow 127.0.0.1;
+    deny all;
+
+    location / {
+        proxy_pass http://127.0.0.1:8082;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+    }
+}                         
+# -----------------------------
+# Vaultwarden
+# -----------------------------
+server {
+    listen 443 ssl http2;
+    server_name vault.cutemeli.com;
+
+    ssl_certificate     /etc/ssl/certs/vault.pem;
+    ssl_certificate_key /etc/ssl/private/vault.key;
+
+    location / {
+        proxy_pass http://127.0.0.1:8081;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+    }
+
+    # Für WebSocket Sync mit Browser Extensions
+    location /notifications/hub {
+        proxy_pass http://127.0.0.1:8081;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    location /notifications/hub/negotiate {
+        proxy_pass http://127.0.0.1:8081;
+    }
+}
+
+# -----------------------------
+# Redirect HTTP -> HTTPS
+# -----------------------------
+server {
+    listen 80;
+    listen [::]:80;
+    server_name git.cutemeli.com proxmox.cutemeli.com share.cutemeli.com monitor.cutemeli.com vault.cutemeli.com;
+    return 301 https://$host$request_uri;
+}
+
+
+
+
+

etc/systemd/system/gitea.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Gitea (Docker Compose)
+Requires=docker.service
+After=docker.service network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+WorkingDirectory=/opt/gitea
+ExecStart=/usr/bin/docker compose up -d
+ExecStop=/usr/bin/docker compose down
+RemainAfterExit=yes
+TimeoutStartSec=0
+
+[Install]
+WantedBy=multi-user.target

etc/systemd/system/monitoring.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=Monitoring Stack (Icinga)
+Requires=docker.service
+After=docker.service
+
+[Service]
+Type=oneshot
+WorkingDirectory=/opt/monitoring
+RemainAfterExit=yes
+ExecStart=/usr/bin/docker compose up -d
+ExecStop=/usr/bin/docker compose down
+TimeoutStartSec=0
+
+[Install]
+WantedBy=multi-user.target

etc/systemd/system/nextcloud.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=Nextcloud Docker Compose Service
+Requires=docker.service
+After=docker.service network.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+WorkingDirectory=/opt/nextcloud
+ExecStart=/usr/bin/docker compose up -d
+ExecStop=/usr/bin/docker compose down
+ExecReload=/usr/bin/docker compose restart
+
+[Install]
+WantedBy=multi-user.target

etc/systemd/system/proxmox-vm.service

@@ -0,0 +1,21 @@
+[Unit]
+Description=Proxmox VM (QEMU)
+After=network.target
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/qemu-system-x86_64 \
+  -enable-kvm \
+  -cpu host \
+  -m 4096 \
+  -smp 4 \
+  -drive file=/root/proxmox-disk.qcow2,format=qcow2 \
+  -boot order=c \
+  -nographic \
+  -netdev user,id=net0,hostfwd=tcp::2222-:22,hostfwd=tcp::8006-:8006 \
+  -device virtio-net-pci,netdev=net0
+Restart=always
+
+[Install]
+WantedBy=multi-user.target
+

etc/systemd/system/vaultwarden.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=Vaultwarden (Bitwarden in Rust)
+After=docker.service
+Requires=docker.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+WorkingDirectory=/opt/vaultwarden
+ExecStart=/usr/bin/docker compose up -d
+ExecStop=/usr/bin/docker compose down
+TimeoutStartSec=0
+
+[Install]
+WantedBy=multi-user.target

opt/gitea/docker-compose.yml

@@ -0,0 +1,45 @@
+services:
+  db:
+    image: postgres:16
+    container_name: gitea-db
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: gitea
+      POSTGRES_PASSWORD: "oC^Kg66uG%^8aZ6KfSJM"
+      POSTGRES_DB: gitea
+    volumes:
+      - gitea_db:/var/lib/postgresql/data
+    networks:
+      - gitea
+
+  gitea:
+    image: gitea/gitea:latest
+    container_name: gitea
+    restart: unless-stopped
+    depends_on:
+      - db
+    environment:
+      USER_UID: "1000"
+      USER_GID: "1000"
+      GITEA__database__DB_TYPE: postgres
+      GITEA__database__HOST: db:5432
+      GITEA__database__NAME: gitea
+      GITEA__database__USER: gitea
+      GITEA__database__PASSWD: "oC^Kg66uG%^8aZ6KfSJM"
+      GITEA__service__DISABLE_REGISTRATION: "true"
+      GITEA__service__SHOW_REGISTRATION_BUTTON: "false"
+    volumes:
+      - gitea_data:/data
+    ports:
+      - "127.0.0.1:3001:3000"
+      - "2223:22"
+    networks:
+      - gitea
+
+volumes:
+  gitea_db:
+  gitea_data:
+
+networks:
+  gitea:
+    driver: bridge

opt/monitoring/docker-compose.yml

@@ -0,0 +1,63 @@
+services:
+  db:
+    image: mariadb:11
+    container_name: icinga-db
+    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
+    environment:
+      MARIADB_ROOT_PASSWORD: change-me-root
+      MARIADB_DATABASE: icinga
+      MARIADB_USER: icinga
+      MARIADB_PASSWORD: change-me-icinga
+    volumes:
+      - ./data/db:/var/lib/mysql
+    networks:
+      - monitoring
+    restart: unless-stopped
+
+  redis:
+    image: redis:7-alpine
+    container_name: icinga-redis
+    command: ["redis-server", "--port", "6380"]
+    networks:
+      - monitoring
+    restart: unless-stopped
+
+  icinga2:
+    image: icinga/icinga2:2.14
+    container_name: icinga2
+    environment:
+      ICINGA2_FEATURE_GRAPHITE: "0"
+    volumes:
+      - ./data/icinga2/etc:/etc/icinga2
+      - ./data/icinga2/var:/var/lib/icinga2
+      - ./data/icinga2/log:/var/log/icinga2
+      - ./data/icinga2/cache:/var/cache/icinga2
+    networks:
+      - monitoring
+    restart: unless-stopped
+
+  icingaweb2:
+    image: icinga/icingaweb2:2.12
+    container_name: icingaweb2
+    depends_on:
+      - db
+      - icinga2
+    environment:
+      # Web Setup läuft über UI, DB-Zugang ist trotzdem nötig:
+      ICINGAWEB2_DB_TYPE: mysql
+      ICINGAWEB2_DB_HOST: db
+      ICINGAWEB2_DB_NAME: icinga
+      ICINGAWEB2_DB_USERNAME: icinga
+      ICINGAWEB2_DB_PASSWORD: change-me-icinga
+    volumes:
+      - ./data/icingaweb2/config:/etc/icingaweb2
+      - ./data/icingaweb2/data:/var/lib/icingaweb2
+    ports:
+      - "8082:8080"   # intern 8080 -> außen 8081 (für Nginx Proxy)
+    networks:
+      - monitoring
+    restart: unless-stopped
+
+networks:
+  monitoring:
+    name: monitoring

opt/nextcloud/docker-compose.yml

@@ -0,0 +1,34 @@
+version: '3.8'
+
+services:
+  db:
+    image: mariadb:10.11
+    container_name: nextcloud-db
+    restart: always
+    environment:
+      MYSQL_ROOT_PASSWORD: supersecurepassword
+      MYSQL_DATABASE: nextcloud
+      MYSQL_USER: nextcloud
+      MYSQL_PASSWORD: nextcloudpass
+    volumes:
+      - db_data:/var/lib/mysql
+
+  app:
+    image: nextcloud:31
+    container_name: nextcloud-app
+    restart: always
+    ports:
+      - "8080:80"
+    volumes:
+      - nextcloud_data:/var/www/html
+    environment:
+      MYSQL_HOST: db
+      MYSQL_DATABASE: nextcloud
+      MYSQL_USER: nextcloud
+      MYSQL_PASSWORD: nextcloudpass
+    depends_on:
+      - db
+
+volumes:
+  db_data:
+  nextcloud_data:

opt/vaultwarden/docker-compose.yml

@@ -0,0 +1,17 @@
+version: "3"
+
+services:
+  vaultwarden:
+    image: vaultwarden/server:latest
+    container_name: vaultwarden
+    restart: unless-stopped
+    volumes:
+      - /opt/vaultwarden/data:/data
+    environment:
+      - DOMAIN=https://vault.cutemeli.com
+      - ADMIN_TOKEN=Av3sM@NN5JyRk#ChqwxaberYYJfkpX
+      - WEBSOCKET_ENABLED=true
+      - SIGNUPS_ALLOWED=false
+      - LOG_FILE=/data/vaultwarden.log
+    ports:
+      - "127.0.0.1:8081:80"

root/.bashrc

@@ -0,0 +1,106 @@
+# ~/.bashrc: executed by bash(1) for non-login shells.
+# see /usr/share/doc/bash/examples/startup-files (in the package bash-doc)
+# for examples
+
+# If not running interactively, don't do anything
+[ -z "$PS1" ] && return
+
+# don't put duplicate lines in the history. See bash(1) for more options
+# ... or force ignoredups and ignorespace
+HISTCONTROL=ignoredups:ignorespace
+
+# append to the history file, don't overwrite it
+shopt -s histappend
+
+# for setting history length see HISTSIZE and HISTFILESIZE in bash(1)
+HISTSIZE=1000
+HISTFILESIZE=2000
+
+# check the window size after each command and, if necessary,
+# update the values of LINES and COLUMNS.
+shopt -s checkwinsize
+
+# make less more friendly for non-text input files, see lesspipe(1)
+[ -x /usr/bin/lesspipe ] && eval "$(SHELL=/bin/sh lesspipe)"
+
+# set variable identifying the chroot you work in (used in the prompt below)
+if [ -z "$debian_chroot" ] && [ -r /etc/debian_chroot ]; then
+    debian_chroot=$(cat /etc/debian_chroot)
+fi
+
+# set a fancy prompt (non-color, unless we know we "want" color)
+case "$TERM" in
+    xterm-color) color_prompt=yes;;
+esac
+
+# uncomment for a colored prompt, if the terminal has the capability; turned
+# off by default to not distract the user: the focus in a terminal window
+# should be on the output of commands, not on the prompt
+#force_color_prompt=yes
+
+if [ -n "$force_color_prompt" ]; then
+    if [ -x /usr/bin/tput ] && tput setaf 1 >&/dev/null; then
+	# We have color support; assume it's compliant with Ecma-48
+	# (ISO/IEC-6429). (Lack of such support is extremely rare, and such
+	# a case would tend to support setf rather than setaf.)
+	color_prompt=yes
+    else
+	color_prompt=
+    fi
+fi
+
+if [ "$color_prompt" = yes ]; then
+    PS1='${debian_chroot:+($debian_chroot)}\[\033[01;32m\]\u@\h\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\]\$ '
+else
+    PS1='${debian_chroot:+($debian_chroot)}\u@\h:\w\$ '
+fi
+unset color_prompt force_color_prompt
+
+# If this is an xterm set the title to user@host:dir
+case "$TERM" in
+xterm*|rxvt*)
+    PS1="\[\e]0;${debian_chroot:+($debian_chroot)}\u@\h: \w\a\]$PS1"
+    ;;
+*)
+    ;;
+esac
+
+# enable color support of ls and also add handy aliases
+if [ -x /usr/bin/dircolors ]; then
+    test -r ~/.dircolors && eval "$(dircolors -b ~/.dircolors)" || eval "$(dircolors -b)"
+    alias ls='ls --color=auto'
+    #alias dir='dir --color=auto'
+    #alias vdir='vdir --color=auto'
+
+    alias grep='grep --color=auto'
+    alias fgrep='fgrep --color=auto'
+    alias egrep='egrep --color=auto'
+fi
+
+# some more ls aliases
+alias ll='ls -alF'
+alias la='ls -A'
+alias l='ls -CF'
+
+# Alias definitions.
+# You may want to put all your additions into a separate file like
+# ~/.bash_aliases, instead of adding them here directly.
+# See /usr/share/doc/bash-doc/examples in the bash-doc package.
+
+if [ -f ~/.bash_aliases ]; then
+    . ~/.bash_aliases
+fi
+
+# enable programmable completion features (you don't need to enable
+# this, if it's already enabled in /etc/bash.bashrc and /etc/profile
+# sources /etc/bash.bashrc).
+#if [ -f /etc/bash_completion ] && ! shopt -oq posix; then
+#    . /etc/bash_completion
+#fi
+alias proxmox='qemu-system-x86_64   -enable-kvm   -cpu host   -m 4096   -smp 4   -drive file=proxmox-disk.qcow2,format=qcow2   -boot order=c   -nographic   -netdev user,id=net0,hostfwd=tcp::443-:8006,hostfwd=tcp::2222-:22   -device virtio-net-pci,netdev=net0'
+. "/root/.acme.sh/acme.sh.env"
+alias cfg='git --git-dir=/root/.cfg --work-tree=/'
+alias cfg='git --git-dir=/root/.cfg --work-tree=/'
+alias update='sudo apt update && apt upgrade'
+alias pull='cfg pull'
+alias push='cfg add * && cfg commit -m "updated from server" && cfg push'

root/.profile

@@ -0,0 +1,11 @@
+# ~/.profile: executed by Bourne-compatible login shells.
+
+if [ "$BASH" ]; then
+  if [ -f ~/.bashrc ]; then
+    . ~/.bashrc
+  fi
+fi
+
+mesg n 2> /dev/null || true
+
+[ ! -s ~/.plesk_banner ] || . ~/.plesk_banner

usr/lib/systemd/system/wg-quick@.service

@@ -0,0 +1,22 @@
+[Unit]
+Description=WireGuard via wg-quick(8) for %I
+After=network-online.target nss-lookup.target
+Wants=network-online.target nss-lookup.target
+PartOf=wg-quick.target
+Documentation=man:wg-quick(8)
+Documentation=man:wg(8)
+Documentation=https://www.wireguard.com/
+Documentation=https://www.wireguard.com/quickstart/
+Documentation=https://git.zx2c4.com/wireguard-tools/about/src/man/wg-quick.8
+Documentation=https://git.zx2c4.com/wireguard-tools/about/src/man/wg.8
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/bin/wg-quick up %i
+ExecStop=/usr/bin/wg-quick down %i
+ExecReload=/bin/bash -c 'exec /usr/bin/wg syncconf %i <(exec /usr/bin/wg-quick strip %i)'
+Environment=WG_ENDPOINT_RESOLUTION_RETRIES=infinity
+
+[Install]
+WantedBy=multi-user.target