ITS Add yxorp TLS-SNI support

templates/web.ssl.its.yml

@@ -0,0 +1,60 @@
+run:
+  - exec:
+     cmd:
+       - "mkdir -p /shared/ssl/"
+  - replace:
+     filename: "/etc/nginx/conf.d/discourse.conf"
+     from: /server.+{/
+     to: |
+       server {
+         listen 80;
+         return 301 https://$$ENV_DISCOURSE_HOSTNAME$request_uri;
+       }
+       server {
+  - replace:
+     filename: "/etc/nginx/conf.d/discourse.conf"
+     from: /listen 80;\s+gzip on;/m
+     to: |
+       listen 443 ssl http2;
+       # ITS: Stuff for yxorp TLS-SNI support
+       listen 444 ssl proxy_protocol;
+       set_real_ip_from 2a01:4f8:10b:331f:0:ff:fe00:5;
+       real_ip_header proxy_protocol;
+       SSL_TEMPLATE_SSL_BLOCK
+  - replace:
+     filename: "/etc/nginx/conf.d/discourse.conf"
+     from: /listen 80;\s+listen \[::\]:80;\s+gzip on;/m
+     to: |
+       listen 443 ssl http2;
+       listen [::]:443 ssl http2;
+       SSL_TEMPLATE_SSL_BLOCK
+  - replace:
+     hook: ssl
+     filename: "/etc/nginx/conf.d/discourse.conf"
+     from: /SSL_TEMPLATE_SSL_BLOCK/
+     to: |
+
+       ssl_protocols TLSv1.2 TLSv1.3;
+       ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+       ssl_prefer_server_ciphers off;
+
+       ssl_certificate /shared/ssl/ssl.crt;
+       ssl_certificate_key /shared/ssl/ssl.key;
+
+       ssl_session_tickets off;
+       ssl_session_timeout 1d;
+       ssl_session_cache shared:SSL:1m;
+
+       gzip on;
+
+       add_header Strict-Transport-Security 'max-age=31536000'; # remember the certificate for a year and automatically connect to HTTPS for this domain
+
+       if ($http_host != $$ENV_DISCOURSE_HOSTNAME) {
+          rewrite (.*) https://$$ENV_DISCOURSE_HOSTNAME$1 permanent;
+       }
+  - replace:
+     filename: "/etc/nginx/conf.d/discourse.conf"
+     from: "location @discourse {"
+     to: |
+       location @discourse {
+       add_header Strict-Transport-Security 'max-age=31536000'; # remember the certificate for a year and automatically connect to HTTPS for this domain