From 4f7ade67395adff30ecfd14fdc69fc52d8bba244 Mon Sep 17 00:00:00 2001
From: Kazuhiro MUSASHI <simoom634@yahoo.co.jp>
Date: Tue, 14 Feb 2023 23:48:51 +0900
Subject: [PATCH] Add `consul-template` config for `drone`.

---
 consul-template.d/conf/drone.conf      | 15 +++++++
 consul-template.d/templates/drone.tmpl | 54 ++++++++++++++++++++++++++
 2 files changed, 69 insertions(+)
 create mode 100644 consul-template.d/conf/drone.conf
 create mode 100644 consul-template.d/templates/drone.tmpl

diff --git a/consul-template.d/conf/drone.conf b/consul-template.d/conf/drone.conf
new file mode 100644
index 0000000..89d416b
--- /dev/null
+++ b/consul-template.d/conf/drone.conf
@@ -0,0 +1,15 @@
+consul {
+  address = "localhost:8500"
+
+  retry {
+    enabled  = true
+    attempts = 12
+    backoff  = "250ms"
+  }
+}
+template {
+  source = "/etc/consul-template.d/templates/drone.tmpl"
+  destination = "/etc/nginx/sites-enabled/drone"
+  perms       = 0660
+  command     = "systemctl reload nginx"
+}
diff --git a/consul-template.d/templates/drone.tmpl b/consul-template.d/templates/drone.tmpl
new file mode 100644
index 0000000..d6de894
--- /dev/null
+++ b/consul-template.d/templates/drone.tmpl
@@ -0,0 +1,54 @@
+server {
+  listen 443 ssl http2;
+  server_name drone.kazu634.com;
+
+  ssl_certificate /etc/lego/.lego/certificates/_.kazu634.com.crt;
+  ssl_certificate_key /etc/lego/.lego/certificates/_.kazu634.com.key;
+  ssl_dhparam /etc/lego/dhparams_4096.pem;
+
+  ssl_session_timeout 1d;
+  ssl_session_cache   shared:SSL:3m;
+  ssl_buffer_size     4k;
+  ssl_session_tickets off;
+
+  ssl_protocols TLSv1.3 TLSv1.2;
+  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+
+  ssl_stapling on;
+  ssl_stapling_verify on;
+
+  resolver 8.8.4.4 8.8.8.8 valid=300s;
+  resolver_timeout 10s;
+
+  # Enable HSTS (HTTP Strict Transport Security)
+  add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
+
+  access_log   /var/log/nginx/drone.access.log   ltsv;
+  error_log    /var/log/nginx/drone.error.log;
+
+  proxy_set_header Host $host;
+  proxy_set_header X-Real-IP $remote_addr;
+  proxy_set_header X-Forwarded-Host $host;
+  proxy_set_header X-Forwarded-Server $host;
+  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+  send_timeout 180;
+  proxy_connect_timeout 600;
+  proxy_read_timeout    600;
+  proxy_send_timeout    600;
+
+  client_max_body_size 1024m;
+
+
+  location / {
+    proxy_pass http://drone/;
+  }
+}
+
+upstream drone {
+{{ range service "drone" }}
+  server {{ .Address }}:{{ .Port }};
+{{else}}
+  server 127.0.0.1:60000;
+{{ end }}
+}