From 95b73daa36b23565a8566f71f9b202d3459b685f Mon Sep 17 00:00:00 2001 From: Sam Chudnick Date: Sun, 25 Jun 2023 09:52:36 -0400 Subject: Initial Commit --- data/home_assistant/configuration.yaml | 16 +++++++++++++ data/home_assistant/home_assistant.conf.j2 | 38 ++++++++++++++++++++++++++++++ 2 files changed, 54 insertions(+) create mode 100644 data/home_assistant/configuration.yaml create mode 100644 data/home_assistant/home_assistant.conf.j2 (limited to 'data/home_assistant') diff --git a/data/home_assistant/configuration.yaml b/data/home_assistant/configuration.yaml new file mode 100644 index 0000000..3723739 --- /dev/null +++ b/data/home_assistant/configuration.yaml @@ -0,0 +1,16 @@ +default_config: + +homeassistant: + currency: USD + country: US + external_url: "https://homeassistant.chudnick.com" + auth_providers: + - type: trusted_networks + trusted_networks: + - 192.168.30.0/24 + allow_bypass_login: true + - type: homeassistant + +http: + use_x_forwarded_for: true + trusted_proxies: 172.25.22.0/24 diff --git a/data/home_assistant/home_assistant.conf.j2 b/data/home_assistant/home_assistant.conf.j2 new file mode 100644 index 0000000..9f6be24 --- /dev/null +++ b/data/home_assistant/home_assistant.conf.j2 @@ -0,0 +1,38 @@ +server { + listen 443 ssl; + server_name {{ home_assistant_server_name }}; + + ssl_certificate /etc/letsencrypt/live/chudnick.com/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/chudnick.com/privkey.pem; + add_header Strict-Transport-Security "max-age=31536000" always; + ssl_stapling on; + ssl_stapling_verify on; + + # Security / XSS Mitigation Headers + add_header X-Frame-Options "SAMEORIGIN"; + add_header X-XSS-Protection "1; mode=block"; + add_header X-Content-Type-Options "nosniff"; + add_header 'Access-Control-Allow-Origin' 'https://chudnick.com' always; + + # authelia + include /etc/nginx/snippets/authelia-location.conf; + + + location / { + #authelia + include /etc/nginx/snippets/proxy.conf; + include /etc/nginx/snippets/authelia-authrequest.conf; + + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + proxy_pass http://127.0.0.1:{{ home_assistant_external_port }}/; + } + +} + +server { + listen 80; + listen [::]:80; + server_name {{ home_assistant_server_name }}; + return 301 https://$host$request_uri; +} -- cgit v1.2.3