ConfigLMM 0.2.0 → 0.4.0

data/Plugins/Apps/Matrix/log.config

@@ -0,0 +1,30 @@
+version: 1
+
+formatters:
+  precise:
+
+    format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
+
+handlers:
+
+  console:
+    class: logging.StreamHandler
+    formatter: precise
+
+loggers:
+    # This is just here so we can leave `loggers` in the config regardless of whether
+    # we configure other loggers below (avoid empty yaml dict error).
+    _placeholder:
+        level: "INFO"
+
+    synapse.storage.SQL:
+        # beware: increasing this to DEBUG will make synapse log sensitive
+        # information such as access tokens.
+        level: INFO
+
+root:
+    level: INFO
+    handlers: [console]
+
+
+disable_existing_loggers: false

data/Plugins/Apps/Nextcloud/Nextcloud.conf.erb

@@ -1,9 +1,11 @@
 
-
-
 upstream nextcloud
 {
+<% if config['Server'] %>
+    server <%= config['Server'] %>;
+<% else %>
     server unix:/run/php-fpm/nextcloud.sock;
+<% end %>
 }
 
 server
@@ -12,13 +14,22 @@ server
         listen       <%= config['Port'] %>;
         listen  [::]:<%= config['Port'] %>;
     <% else %>
-        listen       <%= config['Port'] %> ssl;
-        listen  [::]:<%= config['Port'] %> ssl;
-        http2 on;
+        <% if config['NginxVersion'] >= 1.25 %>
+            listen <%= config['Port'] %> ssl;
+            listen [::]:<%= config['Port'] %> ssl;
+            http2 on;
+            http3 on;
+            quic_retry on;
+            add_header Alt-Svc 'h3=":<%= config['Port'] %>"; ma=86400';
+        <% else %>
+            listen <%= config['Port'] %> ssl http2;
+            listen [::]:<%= config['Port'] %> ssl http2;
+        <% end %>
+
         include config-lmm/ssl.conf;
     <% end %>
 
-    <%= config['Domain'] %>;
+    server_name <%= config['Domain'] %>;
 
     access_log  /var/log/nginx/nextcloud.access.log;
     error_log   /var/log/nginx/nextcloud.error.log;
@@ -133,17 +144,23 @@ server
         fastcgi_max_temp_file_size 0;
     }
 
+    # Rule borrowed from `.htaccess`
+    location /remote {
+        return 301 /remote.php$request_uri;
+    }
+
     # Serve static files
     location ~ \.(?:css|js|mjs|svg|gif|png|jpg|ico|wasm|tflite|map|ogg|flac)$ {
         try_files $uri /index.php$request_uri;
         # HTTP response headers borrowed from Nextcloud `.htaccess`
-        add_header Cache-Control                     "public, max-age=15778463$assetImmutable";
         add_header Referrer-Policy                   "no-referrer"       always;
         add_header X-Content-Type-Options            "nosniff"           always;
         add_header X-Frame-Options                   "SAMEORIGIN"        always;
         add_header X-Permitted-Cross-Domain-Policies "none"              always;
         add_header X-Robots-Tag                      "noindex, nofollow" always;
         add_header X-XSS-Protection                  "1; mode=block"     always;
+        add_header Cache-Control                     "public, max-age=15778463$assetImmutable";
+        add_header X-XSS-Protection                  "1; mode=block"     always;
         access_log off;     # Optional: Don't log access to assets
     }
 
@@ -153,9 +170,30 @@ server
         access_log off;     # Optional: Don't log access to assets
     }
 
-    # Rule borrowed from `.htaccess`
-    location /remote {
-        return 301 /remote.php$request_uri;
+    location /wapps/ {
+        alias /var/lib/nextcloud/apps/;
+
+        # Serve static files
+        location ~ \.(?:css|js|mjs|svg|gif|png|jpg|ico|wasm|tflite|map|ogg|flac)$ {
+            try_files $uri /index.php$request_uri;
+            # HTTP response headers borrowed from Nextcloud `.htaccess`
+            add_header Referrer-Policy                   "no-referrer"       always;
+            add_header X-Content-Type-Options            "nosniff"           always;
+            add_header X-Frame-Options                   "SAMEORIGIN"        always;
+            add_header X-Permitted-Cross-Domain-Policies "none"              always;
+            add_header X-Robots-Tag                      "noindex, nofollow" always;
+            add_header X-XSS-Protection                  "1; mode=block"     always;
+            add_header Cache-Control                     "public, max-age=15778463$assetImmutable";
+            add_header X-XSS-Protection                  "1; mode=block"     always;
+            access_log off;     # Optional: Don't log access to assets
+        }
+
+        location ~ \.woff2?$ {
+            try_files $uri /index.php$request_uri;
+            expires 7d;         # Cache-Control policy borrowed from `.htaccess`
+            access_log off;     # Optional: Don't log access to assets
+        }
+
     }
 
     location / {

data/Plugins/Apps/Nextcloud/Nextcloud.lmm.rb

@@ -3,6 +3,10 @@ module ConfigLMM
     module LMM
         class Nextcloud < Framework::NginxApp
 
+            USER = 'nextcloud'
+            HOME_DIR = '/var/lib/nextcloud'
+            PACKAGE_NAME = 'Nextcloud'
+
             def actionNextcloudBuild(id, target, state, context, options)
                 writeNginxConfig(__dir__, 'Nextcloud', id, target, state, context, options)
             end
@@ -12,10 +16,88 @@ module ConfigLMM
             end
 
             def actionNextcloudDeploy(id, target, activeState, context, options)
-                if !target['Location'] || target['Location'] == '@me'
+                if target['Location'] && target['Location'] != '@me'
+                    uri = Addressable::URI.parse(target['Location'])
+                    raise Framework::PluginProcessError.new("#{id}: Unknown Protocol: #{uri.scheme}!") if uri.scheme != 'ssh'
+                    self.class.sshStart(uri) do |ssh|
+                        Framework::LinuxApp.ensurePackages([PHP_FPM::PHPFPM_PACKAGE], ssh)
+                        Framework::LinuxApp.ensureServiceAutoStartOverSSH(PHP_FPM::PHPFPM_SERVICE, ssh)
+                        distroInfo = Framework::LinuxApp.ensurePackages([PACKAGE_NAME], ssh)
+                        addUserCmd = "#{distroInfo['CreateServiceUser']} --home-dir '#{HOME_DIR}' --create-home --comment 'Nextcloud' #{USER}"
+                        self.class.sshExec!(ssh, addUserCmd, true)
+                        self.class.sshExec!(ssh, "mkdir -p /var/log/php/ /var/lib/nextcloud/apps/ /var/lib/nextcloud/data/")
+                        self.class.sshExec!(ssh, "touch /var/log/php/nextcloud.errors.log")
+                        self.class.sshExec!(ssh, "touch /var/log/php/nextcloud.mail.log")
+                        self.class.sshExec!(ssh, "chown #{USER}:#{USER} /var/log/php/nextcloud.errors.log")
+                        self.class.sshExec!(ssh, "chown #{USER}:#{USER} /var/log/php/nextcloud.mail.log")
+                        PHP_FPM::fixConfigFileOverSSH(distroInfo, ssh)
+
+                        webappsDir = PHP_FPM::webappsDir(distroInfo)
+                        configDir = webappsDir + 'nextcloud/config/'
+                        if !self.class.remoteFilePresent?(configDir + 'config.php', ssh)
+                            self.class.uploadNotPresent(__dir__ + '/config.php', configDir, ssh)
+                            self.class.sshExec!(ssh, "sed -i \"s|'instanceid' .*|'instanceid' => '#{SecureRandom.alphanumeric(10)}',|\" #{configDir}config.php")
+                            self.class.sshExec!(ssh, "touch #{configDir}CAN_INSTALL")
+                            self.class.sshExec!(ssh, "sed -i 's|/usr/share/webapps/|#{webappsDir}|' #{configDir}config.php")
+                        end
+                        self.class.sshExec!(ssh, "chown -R nextcloud:nextcloud #{configDir}")
+                        self.class.sshExec!(ssh, "chown -R nextcloud:nextcloud /var/lib/nextcloud/")
+
+                        target['Database'] ||= {}
+                        if !target['Database']['Type'] || target['Database']['Type'] == 'pgsql'
+                            PostgreSQL.createRemoteUserAndDBOverSSH(target['Database'], USER, nil, ssh)
+                        end
+
+                        target['User'] = USER unless target['User']
+                        name = 'nextcloud'
+                        self.updateRemoteFile(ssh, PHP_FPM.configDir(distroInfo) + name + '.conf', options, false, ';') do |configLines|
+                            PHP_FPM.writeConfig(name, target, distroInfo, configLines)
+                        end
+
+                        Framework::LinuxApp.startServiceOverSSH(PHP_FPM::PHPFPM_SERVICE, ssh)
+
+                        self.class.ensurePackage(ssh)
+                        self.class.prepareNginxConfig(target, ssh)
+                        self.writeNginxConfig(__dir__, 'Nextcloud', id, target, state, context, options)
+                        distroInfo = Framework::LinuxApp.currentDistroInfo(ssh)
+                        webappsDir = PHP_FPM::webappsDir(distroInfo)
+                        nginxFile = options['output'] + '/nginx/servers-lmm/Nextcloud.conf'
+                        `sed -i 's|root .*|root #{webappsDir}nextcloud;|' #{nginxFile}`
+                        deployNginxConfig(id, target, activeState, context, options)
+                        Framework::LinuxApp.startService(NGINX_PACKAGE, ssh)
+                        self.class.reload(ssh)
+                    end
+                else
                     deployNginxConfig(id, target, activeState, context, options)
                     activeState['Location'] = '@me'
                 end
+                activeState['Status'] = State::STATUS_DEPLOYED
+            end
+
+            def cleanup(configs, state, context, options)
+                cleanupType(:Nextcloud, configs, state, context, options) do |item, id, state, context, options, ssh|
+                    self.cleanupNginxConfig('Nextcloud', id, state, context, options, ssh)
+                    self.class.reload(ssh, options[:dry])
+                    distroInfo = Framework::LinuxApp.currentDistroInfo(ssh)
+                    rm(PHP_FPM.configDir(distroInfo) + 'nextcloud.conf', options[:dry], ssh)
+                    Framework::LinuxApp.reloadService(PHP_FPM::PHPFPM_SERVICE, ssh, options[:dry])
+                    Framework::LinuxApp.removePackage(PACKAGE_NAME, ssh, options[:dry])
+                    state.item(id)['Status'] = State::STATUS_DELETED unless options[:dry]
+                    if options[:destroy]
+                        rm(PHP_FPM::webappsDir(distroInfo) + 'nextcloud', options[:dry], ssh)
+                        item['Database'] ||= {}
+                        if !item['Database']['Type'] || item['Database']['Type'] == 'pgsql'
+                            PostgreSQL.dropUserAndDB(item['Database'], USER, ssh, options[:dry])
+                        end
+                        Framework::LinuxApp.deleteUserAndGroup(USER, ssh, options[:dry])
+                        rm('/var/log/php/nextcloud.access.log', options[:dry], ssh)
+                        rm('/var/log/php/nextcloud.errors.log', options[:dry], ssh)
+                        rm('/var/log/php/nextcloud.mail.log', options[:dry], ssh)
+                        rm('/var/log/nginx/nextcloud.access.log', options[:dry], ssh)
+                        rm('/var/log/nginx/nextcloud.error.log', options[:dry], ssh)
+                        state.item(id)['Status'] = State::STATUS_DESTROYED unless options[:dry]
+                    end
+                end
             end
 
         end

data/Plugins/Apps/Nextcloud/config.php

@@ -0,0 +1,18 @@
+<?php
+
+$CONFIG = [
+    'instanceid' => '',
+    'datadirectory' => '/var/lib/nextcloud/data/',
+    'apps_paths' => [
+        [
+            'path'=> '/usr/share/webapps/nextcloud/apps',
+            'url' => '/apps',
+            'writable' => false,
+        ],
+        [
+            'path'=> '/var/lib/nextcloud/apps',
+            'url' => '/wapps',
+            'writable' => true,
+        ],
+    ]
+];

data/Plugins/Apps/Nginx/conf.d/configlmm.conf

@@ -0,0 +1,71 @@
+
+server_tokens off;
+
+tcp_nopush     on;
+
+# Needed for OCSP stapling
+resolver 127.0.0.53;
+
+
+# types_hash_max_size 4096;
+# types_hash_bucket_size 64;
+# proxy_headers_hash_max_size 512;
+# proxy_headers_hash_bucket_size 128;
+
+
+gzip  on;
+gzip_vary on;
+gzip_proxied any;
+gzip_comp_level 6;
+gzip_min_length 256;
+
+# do not remove ETag headers
+gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
+
+gzip_types application/atom+xml text/javascript text/xml application/xml+rss application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
+
+
+charset utf-8;
+charset_types text/css text/plain text/xml text/javascript text/vnd.wap.wml application/json application/javascript application/xml application/xml+rss application/rss+xm image/svg+xml;
+proxy_intercept_errors on;
+fastcgi_intercept_errors on;
+
+map '' $WithHost {
+    default '';
+}
+
+map "$WithHost" $ProxyHost {
+    default $host;
+    ~. $WithHost;
+}
+
+map $http_accept $errorExtension
+{
+    default                    html;
+    ~application/json          json;
+    ~application/activity+json json;
+}
+
+map $http_upgrade $connectionUpgrade
+{
+    default upgrade;
+    ''      '';
+}
+
+# Set the `immutable` cache control options only for assets with a cache busting `v` argument
+map $arg_v $assetImmutable
+{
+    "" "";
+    default ", immutable";
+}
+
+root /srv/www/root;
+
+ssl_certificate "/etc/letsencrypt/live/Wildcard/fullchain.pem";
+ssl_certificate_key "/etc/letsencrypt/live/Wildcard/privkey.pem";
+ssl_trusted_certificate "/etc/letsencrypt/live/Wildcard/chain.pem";
+
+# Load modular configuration files from the /etc/nginx/servers directory.
+# See http://nginx.org/en/docs/ngx_core_module.html#include
+# for more information.
+include servers-lmm/*.conf;

data/Plugins/Apps/Nginx/config-lmm/errors.conf

@@ -1,7 +1,13 @@
 
 # add one directive for each http status code
 error_page 301 /_errors_/HTTP301.$errorExtension;
-error_page 302 /_errors_/HTTP302.$errorExtension;
+
+# Looks like enabling custom 302 can be problematic
+# due to apps using multiple Set-Cookie headers
+# for example this breaks BookStack
+# so lets not use it by default
+#error_page 302 /_errors_/HTTP302.$errorExtension;
+
 error_page 303 /_errors_/HTTP303.$errorExtension;
 error_page 307 /_errors_/HTTP307.$errorExtension;
 error_page 308 /_errors_/HTTP308.$errorExtension;
@@ -23,9 +29,9 @@ error_page 533 /_errors_/HTTP533.$errorExtension;
 location /_errors_/ {
     include config-lmm/public.conf;
 
-    alias /srv/http/errors/;
+    add_header Location $upstream_http_location;
+    add_header Set-Cookie $upstream_http_set_cookie;
+
+    alias /srv/www/errors/;
     internal;
 }
-
-add_header Location $upstream_http_location;
-add_header Set-Cookie $upstream_http_set_cookie;

data/Plugins/Apps/Nginx/config-lmm/proxy.conf

@@ -1,7 +1,7 @@
 
 proxy_http_version 1.1;
 
-proxy_set_header Host $host;
+proxy_set_header Host $ProxyHost;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Forwarded-Proto $scheme;
@@ -13,3 +13,7 @@ proxy_set_header Connection $connectionUpgrade;
 
 # proxy_set_header Proxy "";
 proxy_pass_header Server;
+
+proxy_ssl_protocols TLSv1.2 TLSv1.3;
+
+proxy_connect_timeout 2s;

data/Plugins/Apps/Nginx/main.conf.erb

@@ -0,0 +1,31 @@
+
+server {
+    listen       80 default_server;
+    listen  [::]:80 default_server;
+    server_name _;
+
+    include config-lmm/errors.conf;
+
+    deny all;
+}
+
+server {
+    <% if config['NginxVersion'] >= 1.25 %>
+        listen 443 default_server ssl reuseport;
+        listen [::]:443 default_server ssl reuseport;
+        http2 on;
+    <% else %>
+        listen 443 default_server ssl reuseport http2;
+        listen [::]:443 default_server ssl reuseport http2;
+    <% end %>
+
+    server_name _;
+
+    deny all;
+
+    ssl_early_data on;
+
+    include config-lmm/errors.conf;
+    include config-lmm/security.conf;
+    include config-lmm/ssl.conf;
+}

data/Plugins/Apps/Nginx/nginx.conf

@@ -1,90 +1,25 @@
 
-load_module "/usr/lib/nginx/modules/ngx_http_passenger_module.so";
-#load_module "/usr/lib/nginx/modules/ngx_http_stub_status_module.so";
-
-#user http;
 worker_processes  4;
 
-#error_log  logs/error.log;
-#error_log  logs/error.log  notice;
-#error_log  logs/error.log  info;
 error_log    /var/log/nginx/error.log info;
 
-#pid        logs/nginx.pid;
-
-
 events {
     worker_connections  1024;
+    use epoll;
 }
 
-
 http {
     include       mime.types;
     default_type  application/octet-stream;
-    server_tokens off;
-
-    types_hash_max_size 4096;
-    types_hash_bucket_size 64;
-    proxy_headers_hash_max_size 512;
-    proxy_headers_hash_bucket_size 128;
-
-    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
-    #                  '$status $body_bytes_sent "$http_referer" '
-    #                  '"$http_user_agent" "$http_x_forwarded_for"';
-
-    #access_log  logs/access.log  main;
 
     sendfile       on;
-    tcp_nopush     on;
-    resolver 127.0.0.53;
-
-    gzip  on;
-    gzip_vary on;
-    gzip_proxied any;
-    gzip_comp_level 6;
-    gzip_min_length 256;
-
-    # do not remove ETag headers
-    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
-
-    gzip_types application/atom+xml text/javascript text/xml application/xml+rss application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
-
-
-    charset utf-8;
-    charset_types text/css text/plain text/xml text/javascript text/vnd.wap.wml application/json application/javascript application/xml application/xml+rss application/rss+xm image/svg+xml;
-    proxy_intercept_errors on;
-    fastcgi_intercept_errors on;
-
-    map $http_accept $errorExtension
-    {
-        default                    html;
-        ~application/json          json;
-        ~application/activity+json json;
-    }
-
-    map $http_upgrade $connectionUpgrade
-    {
-        default upgrade;
-        ''      '';
-    }
-
-    # Set the `immutable` cache control options only for assets with a cache busting `v` argument
-    map $arg_v $assetImmutable
-    {
-        "" "";
-        default ", immutable";
-    }
-
-    passenger_ruby /usr/bin/ruby;
-    passenger_root /usr/lib/passenger;
 
-    root /srv/http/root;
+    include conf.d/*.conf;
 
     include /etc/nginx/main.conf;
 
     # Load modular configuration files from the /etc/nginx/servers directory.
     # See http://nginx.org/en/docs/ngx_core_module.html#include
     # for more information.
-    include /etc/nginx/servers/*.conf;
-    include /etc/nginx/servers-lmm/*.conf;
+    include vhosts.d/*.conf;
 }

data/Plugins/Apps/Nginx/nginx.lmm.rb

@@ -2,19 +2,20 @@
 module ConfigLMM
     module LMM
         class Nginx < Framework::NginxApp
-
-            CONFIG_DIR = '/etc/nginx/'
-            HTTP_DIR = '/srv/http/'
+            CERTBOT_PACKAGE = 'CertBotNginx'
+            ERROR_PAGES_REPO = 'https://github.com/HttpErrorPages/HttpErrorPages.git'
 
             def actionNginxBuild(id, target, activeState, context, options)
+
                 dir = options['output'] + '/nginx/'
-                mkdir(dir, options[:dry])
+                mkdir(dir + 'conf.d', options[:dry])
+                mkdir(dir + 'servers-lmm', options[:dry])
                 copy(__dir__ + '/config-lmm', dir, options[:dry])
-                # TODO, maybe evaluate them as template?
                 copy(__dir__ + '/nginx.conf', dir, options[:dry])
-                copy(__dir__ + '/main.conf', dir, options[:dry])
-                mkdir(options['output'] + HTTP_DIR + 'root', options[:dry])
-                mkdir(options['output'] + HTTP_DIR + 'errors', options[:dry])
+                copy(__dir__ + '/conf.d/configlmm.conf', dir + 'conf.d/', options[:dry])
+
+                mkdir(options['output'] + WWW_DIR + 'root', options[:dry])
+                mkdir(options['output'] + WWW_DIR + 'errors', options[:dry])
             end
 
             # TODO
@@ -25,13 +26,68 @@ module ConfigLMM
             def actionNginxDeploy(id, target, activeState, context, options)
                 dir = options['output'] + '/nginx/'
 
-                if !target['Location'] || target['Location'] == '@me'
+                if target['Location'] && target['Location'] != '@me'
+                    uri = Addressable::URI.parse(target['Location'])
+                    raise Framework::PluginProcessError.new("Unknown Protocol: #{uri.scheme}!") if uri.scheme != 'ssh'
+                    self.class.sshStart(uri) do |ssh|
+                        Framework::LinuxApp.ensurePackages([CERTBOT_PACKAGE], ssh)
+                        self.class.prepareNginxConfig(target, ssh)
+
+                        self.class.sshExec!(ssh, "mkdir -p #{CONFIG_DIR}conf.d")
+                        self.class.sshExec!(ssh, "mkdir -p #{WWW_DIR}root")
+                        self.class.sshExec!(ssh, "mkdir -p #{WWW_DIR}errors")
+                        ssh.scp.upload!(dir + 'nginx.conf', CONFIG_DIR + 'nginx.conf')
+                        ssh.scp.upload!(dir + 'conf.d/configlmm.conf', CONFIG_DIR + 'conf.d/configlmm.conf')
+                        resolverIP = self.class.sshExec!(ssh, "cat /etc/resolv.conf | grep 'nameserver' | grep -v ':' | head -n 1 | cut -d ' ' -f 2").strip
+                        self.class.sshExec!(ssh, "sed -i 's|^resolver .*|resolver #{resolverIP};|' /etc/nginx/conf.d/configlmm.conf")
+
+                        self.class.uploadFolder(dir + 'config-lmm', CONFIG_DIR, ssh)
+                        self.class.uploadFolder(dir + 'servers-lmm', CONFIG_DIR, ssh)
+
+                        template = ERB.new(File.read(__dir__ + '/main.conf.erb'))
+                        renderTemplate(template, target, dir + 'main.conf', options)
+                        ssh.scp.upload!(dir + 'main.conf', CONFIG_DIR + 'main.conf')
+
+                        if !self.class.remoteFilePresent?(WWW_DIR + 'errors/HTTP500.html', ssh)
+                            errorPages = File.expand_path(REPOS_CACHE + '/HttpErrorPages')
+                            if !File.exist?(errorPages)
+                                mkdir(File.expand_path(REPOS_CACHE), false)
+                                begin
+                                    Framework::LinuxApp.ensurePackages(['git', 'Yarn'], '@me')
+                                rescue RuntimeError => error
+                                    prompt.say(error, :color => :red)
+                                end
+                                `cd #{REPOS_CACHE} && git clone --quiet #{ERROR_PAGES_REPO} > /dev/null`
+                            end
+                            `cd #{errorPages} && yarn install --silent`
+                            `cd #{errorPages} && yarn run static config-dist.json > /dev/null`
+                            `cd #{errorPages} && cp -R dist errors`
+                            self.class.uploadFolder(errorPages + '/errors', WWW_DIR, ssh)
+                        end
+
+                        Framework::LinuxApp.createCertificateOverSSH(ssh)
+                    end
+                else
+                    self.class.prepareNginxConfig(target, nil)
+
                     copy(dir + '/config-lmm', CONFIG_DIR, options[:dry])
-                    copyNotPresent(dir + '/nginx.conf', CONFIG_DIR, options[:dry])
-                    copyNotPresent(dir + '/main.conf', CONFIG_DIR, options[:dry])
-                    copyNotPresent(dir + '/servers-lmm', CONFIG_DIR, options['dry'])
-                    mkdir(HTTP_DIR + 'root', options[:dry])
-                    mkdir(HTTP_DIR + 'errors', options[:dry])
+                    copy(dir + '/nginx.conf', CONFIG_DIR, options[:dry])
+
+                    copy(dir + '/servers-lmm', CONFIG_DIR, options['dry'])
+                    mkdir(WWW_DIR + 'root', options[:dry])
+                    mkdir(WWW_DIR + 'errors', options[:dry])
+
+                    template = ERB.new(File.read(__dir__ + '/main.conf.erb'))
+                    renderTemplate(template, target, dir + 'main.conf', options)
+                    copy(dir + '/main.conf', CONFIG_DIR, options[:dry])
+
+                    dir = "/etc/letsencrypt/live/Wildcard/"
+                    `mkdir -p #{dir}`
+                    if !File.exist?(dir + 'fullchain.pem')
+                        `openssl req -x509 -noenc -days 90 -newkey rsa:2048 -keyout #{dir}privkey.pem -out #{dir}fullchain.pem -subj "/C=US/O=ConfigLMM/CN=Wildcard"`
+                         `cp #{dir}fullchain.pem #{dir}chain.pem`
+                    end
+
                 end
                 # Consider:
                 # * Deploy on current host
@@ -42,18 +98,23 @@ module ConfigLMM
             end
 
             def actionNginxProxyBuild(id, target, activeState, context, options)
-                updateTargetConfig(target)
-
-                template = ERB.new(File.read(__dir__ + '/proxy.conf.erb'))
-                renderTemplate(template, target, options['output'] + '/nginx/servers-lmm/' + target['Name'] + '.conf', options)
-
+                target['ConfigName'] = target['Name']
+                writeNginxConfig(__dir__, 'proxy', id, target, activeState, context, options)
                 actionNginxBuild(id, target, activeState, context, options)
             end
 
             def actionNginxProxyDeploy(id, target, activeState, context, options)
-                if !target['Location'] || target['Location'] == '@me'
-                    deployNginxConfig(id, target, activeState, context, options)
-                    activeState['Location'] = '@me'
+                raise Framework::PluginProcessError.new('Proxy field must be set!') unless target['Proxy']
+
+                target['ConfigName'] = target['Name']
+                if target['Location'] && target['Location'] != '@me'
+                    uri = Addressable::URI.parse(target['Location'])
+                    raise Framework::PluginProcessError.new("#{id}: Unknown Protocol: #{uri.scheme}!") if uri.scheme != 'ssh'
+                    self.class.sshStart(uri) do |ssh|
+                        useNginxProxy(__dir__, 'proxy', id, target, activeState, state, context, options, ssh)
+                    end
+                else
+                    useNginxProxy(__dir__, 'proxy', id, target, activeState, state, context, options, ssh)
                 end
             end
 

data/Plugins/Apps/Nginx/proxy.conf.erb

@@ -6,9 +6,18 @@ server {
         listen       <%= config['Port'] %>;
         listen  [::]:<%= config['Port'] %>;
     <% else %>
-        listen       <%= config['Port'] %> ssl;
-        listen  [::]:<%= config['Port'] %> ssl;
-        http2 on;
+        <% if config['NginxVersion'] >= 1.25 %>
+            listen <%= config['Port'] %> ssl;
+            listen [::]:<%= config['Port'] %> ssl;
+            http2 on;
+            http3 on;
+            quic_retry on;
+            add_header Alt-Svc 'h3=":<%= config['Port'] %>"; ma=86400';
+        <% else %>
+            listen <%= config['Port'] %> ssl http2;
+            listen [::]:<%= config['Port'] %> ssl http2;
+        <% end %>
+
         include config-lmm/ssl.conf;
     <% end %>
 
@@ -18,6 +27,7 @@ server {
     error_log   /var/log/nginx/<%= config['Name'].downcase %>.error.log;
 
     include config-lmm/errors.conf;
+    include config-lmm/security.conf;
 
     <% if config['Private'] %>
         include config-lmm/private.conf;