I swear it should be the other way round (it looks to me like Nextcloud
is embedding the code iframe), but disabling CSP on Nextcloud worked and
I saw a comment on the Internet about it so lets give it a try.

This reverts commit 388c2272.

This reverts commit 2f132439.

This actually solved the issue (Collabora Online worked!) but this is
not a long-term solution, just a test.

This reverts commit cfba896a.

Here we go again.

This reverts commit 5fd00d28.

This reverts commit dda18375.

This time it's mixed content.

Trying to figure out and issue with Nextcloud and Collabora Online.
Should be reverted ASAP.

To make more uniform, use the same location on all hosts. Instead of
copying the same tasks over and over in the renew-certs playbook in the
homelab repo.

Those directories were used by hosts now served by ns4.

Access LAM on its own domain (from inside the network only).

- No more proxying in www.shore.co.il. I think about redoing it all with
  a subdomain per service. Also no more secrets, intead authenticate
  against the LDAP server or something.
- CI templates.
- Simpler self-signed SSL certificate generation.
- Set the hostname in CI.
- Use the www-redirect snippet in shore.co.il.

This reverts commit d4d48591. I'm
reverting most of it but amending or mending a few things that I'm going
to move to ns4.

Mainly ChaCha20. Also disable AESCCM (as per
https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
it's slow and uncommon).

Vouch uses the Host header for calculating the JWT but we can't override
that (proxying won't work with an incorrect header). So instead it to
each deployment so we don't have multiple proxies and can override the
Host header.

Using vouch.shore.co.il.

Use the CA certificate bundle and set the verification depth (for
intermediate certificates). Right now for Vouch.

Needed for the default (fallback) acme challenge access (with the
renew-certs playbooks from the homelab repo).

To have a common .gitlab-ci.yml.

The Docker resolver replies with a TTL of 600, too long. Refresh after
30 seconds.

By default the cerificate is valid for 30 days, reasonable. Also, using
-batch means the default values are used and the certificate is
generated without any input required.