Mainly ChaCha20. Also disable AESCCM (as per
https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
it's slow and uncommon).

Vouch uses the Host header for calculating the JWT but we can't override
that (proxying won't work with an incorrect header). So instead it to
each deployment so we don't have multiple proxies and can override the
Host header.

Using vouch.shore.co.il.

Use the CA certificate bundle and set the verification depth (for
intermediate certificates). Right now for Vouch.

Needed for the default (fallback) acme challenge access (with the
renew-certs playbooks from the homelab repo).

To have a common .gitlab-ci.yml.

The Docker resolver replies with a TTL of 600, too long. Refresh after
30 seconds.

By default the cerificate is valid for 30 days, reasonable. Also, using
-batch means the default values are used and the certificate is
generated without any input required.

I'm moving some services to ns4, some will remain on host01. I'm
branching to have specific deployment for each host. So have a minimal
and generic master branch so common changes will be done there and I'll
rebase the other branches on top of it.

So the directory is always there (in case I'm going to delete the files
inside).

I really should have added those much earlier.

- Use common pre-commit snippet for Docker projects.
- Use GitLab CI template for pre-commit job.

In case the host isn't passed (or isn't known), redirect to
www.shore.co.il.

Now that I finished migrating all repos (FINALLY!!!).

No shell scripts to check.

It could lead to a case where the site is effectively offline.

Still, it will there in the image. That's fine with me.

- Replace file with configuration snippet.
- Allow some domains, disallow others.

We set it in the proxy anyway, don't send 2 Strict-Transport-Security
headers.