Signed-off-by: Florian Pritz <bluewind@xinu.at>

This is also the profile we use on our older boxes and apparently users
(see bug, also confirmed via IRC for setups using the settings in
ansible alreadt) are unable to access our sites.

https://bugs.archlinux.org/task/50771



Signed-off-by: Florian Pritz <bluewind@xinu.at>

Include link to mozilla's config generator (looks like the settings
came from there) and update ssl_session_* settings to their current
recommendation.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

devtools expects those to exist so create them automatically. No need
to have users do that themselves.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Sven-Hendrik Haase <svenstaro@gmail.com>

This fixes an issue with utf8 encoding in From headers that starts
appearing with perl 5.24. Dont't ask me why it worked before.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

A simple redirect breaks the syncrepo script because it doesn't follow
redirects. Copy the vhost for now and deduplicate it later.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

The settings don't hurt normal http connections if they are defined at
the top level.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

For some reason orion has a netmask of /8 which doesn't work in
hetzner's network since all traffic to other machines must pass through
a switch. Fix this by forcing a /32 netmask.

This change also requires us to set the gateway via the Peer option
because it would otherwise not be reachable.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

This allows to change it after deployment

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

This allows each host with nginx to easily get some kind of SSL cert
for testing purposes or services where the CN does not matter.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Config copied from nymeria.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Config copied from nymeria with improved indentation.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Reenable this when mailman is actually running on the same box

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Already used by the config, just missing.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

This is so that sudo doesn't ask for password since it seems to always use the last entry found.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>