From a8c67a2e5c97db49b86d4d9002a87d5d3e5d92d0 Mon Sep 17 00:00:00 2001
From: Kazuhiro MUSASHI <simoom634@yahoo.co.jp>
Date: Sun, 4 Jun 2023 21:56:04 +0900
Subject: [PATCH] Add `consul-template` config for `gotosocial`.

---
 consul-template.d/conf/gotosocial.conf      | 15 ++++++
 consul-template.d/templates/gotosocial.tmpl | 58 +++++++++++++++++++++
 2 files changed, 73 insertions(+)
 create mode 100644 consul-template.d/conf/gotosocial.conf
 create mode 100644 consul-template.d/templates/gotosocial.tmpl

diff --git a/consul-template.d/conf/gotosocial.conf b/consul-template.d/conf/gotosocial.conf
new file mode 100644
index 0000000..8bc7715
--- /dev/null
+++ b/consul-template.d/conf/gotosocial.conf
@@ -0,0 +1,15 @@
+consul {
+  address = "localhost:8500"
+
+  retry {
+    enabled  = true
+    attempts = 12
+    backoff  = "250ms"
+  }
+}
+template {
+  source = "/etc/consul-template.d/templates/gotosocial.tmpl"
+  destination = "/etc/nginx/sites-enabled/gotosocial"
+  perms       = 0660
+  command     = "systemctl reload nginx"
+}
diff --git a/consul-template.d/templates/gotosocial.tmpl b/consul-template.d/templates/gotosocial.tmpl
new file mode 100644
index 0000000..480a0c4
--- /dev/null
+++ b/consul-template.d/templates/gotosocial.tmpl
@@ -0,0 +1,58 @@
+server {
+  listen 443 ssl http2;
+  server_name social.kazu634.com;
+
+  ssl_certificate /etc/lego/.lego/certificates/_.kazu634.com.crt;
+  ssl_certificate_key /etc/lego/.lego/certificates/_.kazu634.com.key;
+  ssl_dhparam /etc/lego/dhparams_4096.pem;
+
+  ssl_session_timeout 1d;
+  ssl_session_cache   shared:SSL:3m;
+  ssl_buffer_size     4k;
+  ssl_session_tickets off;
+
+  ssl_protocols TLSv1.3 TLSv1.2;
+  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+
+  ssl_stapling on;
+  ssl_stapling_verify on;
+
+  resolver 8.8.4.4 8.8.8.8 valid=300s;
+  resolver_timeout 10s;
+
+  # Enable HSTS (HTTP Strict Transport Security)
+  add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
+
+  access_log   /var/log/nginx/social.access.log   json;
+  error_log    /var/log/nginx/social.error.log;
+
+  send_timeout 180;
+  proxy_connect_timeout 600;
+  proxy_read_timeout    600;
+  proxy_send_timeout    600;
+
+  client_max_body_size 1024m;
+
+  proxy_set_header Host $host;
+  proxy_set_header Upgrade $http_upgrade;
+  proxy_set_header Connection "upgrade";
+  proxy_set_header X-Forwarded-For $remote_addr;
+  proxy_set_header X-Forwarded-Proto $scheme;
+
+  proxy_set_header X-Real-IP $remote_addr;
+  proxy_set_header X-Forwarded-Host $host;
+  proxy_set_header X-Forwarded-Server $host;
+  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+  location / {
+    proxy_pass http://social/;
+  }
+}
+
+upstream social {
+{{ range service "gotosocial" }}
+  server {{ .Address }}:{{ .Port }};
+{{else}}
+  server 127.0.0.1:60000;
+{{ end }}
+}