Merge branch 'master' of git.oopen.de:install/mattermost

README.install

@@ -82,22 +82,14 @@ EOF
 
 
 # ---
-# 0.1) Requirements MySQL Database Service
+# 0.1) PostgeSQL Database Service (MySQL is not onger supported for mattermost
 # ---
 
-# Install MySQL Database Service
+# Install / Create PostgreSQL database
 #
-cd /tmp
+# see:
-
-# See at 'https://dev.mysql.com/downloads/repo/apt/' which is the 
-# actual version of the apt-repository
 #
-mysql_apt_version=0.8.29-1
+#     README.postgresql
-wget https://dev.mysql.com/get/mysql-apt-config_${mysql_apt_version}_all.deb
-dpkg -i mysql-apt-config_${mysql_apt_version}_all.deb
-
-apt-get update
-apt-get install mysql-server
 
 
 # ---

README.postgresql

@@ -6,12 +6,13 @@
 psql_db_host="localhost"
 psql_db_port="5432"
 psql_db_name="mattermost"
-psql_db_user="mmuser"
+#psql_db_user="mmuser"
+psql_db_user="mattermost"
 psql_db_password='YK-m-yoi9T-p.7fm'
 
 POSTGRES_DSN="postgres://${psql_db_user}:${psql_db_password}@${psql_db_host}:${psql_db_port}/${psql_db_name}?sslmode=disable\u0026connect_timeout=10"
 
-pg_hba_file="/etc/postgresql/15/main/pg_hba.conf"
+pg_hba_file="/etc/postgresql/17/main/pg_hba.conf"
 
 
 DEBIAN_FRONTEND=noninteractive apt install -y --allow-unauthenticated postgresql

install-mattermost.sh

@@ -1287,21 +1287,18 @@ server {
 }
 
 server {
-   listen 443 ssl http2;
+   listen 443 ssl;
-   listen [::]:443 ssl http2;
+   listen [::]:443 ssl;
+   http2 on;
 
    server_name ${FQHN_HOSTNAME};
 
-   http2_push_preload on; # Enable HTTP/2 Server Push
-
    # Include location directive for Let's Encrypt ACME Challenge
    #
    # Needed for (automated) updating certificate
    #
    include snippets/letsencrypt-acme-challenge.conf;
 
-   ssl on;
-
    ssl_certificate /var/lib/dehydrated/certs/${FQHN_HOSTNAME}/fullchain.pem;
    ssl_certificate_key /var/lib/dehydrated/certs/${FQHN_HOSTNAME}/privkey.pem;
    ssl_trusted_certificate /var/lib/dehydrated/certs/${FQHN_HOSTNAME}/chain.pem;
@@ -1325,24 +1322,33 @@ server {
    # ECDHE better than DHE (faster)  ECDHE & DHE GCM better than CBC (attacks on AES)
    # Everything better than SHA1 (deprecated)
    #
-   ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
+   ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1:secp384r1;
-   ssl_prefer_server_ciphers on;
+   ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
+   ssl_prefer_server_ciphers off;
 
    # Eable session resumption to improve https performance
    ssl_session_cache shared:SSL:50m;
    ssl_session_timeout 10m;
    ssl_session_tickets off;
 
+   resolver 127.0.0.53:53 valid=300s;
+   resolver_timeout 5s;
+
    # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
    #
    add_header Strict-Transport-Security max-age=15768000;
-
-   # OCSP Stapling ---
-   # fetch OCSP records from URL in ssl_certificate and cache them
-   ssl_stapling on;
-   ssl_stapling_verify on;
-
    add_header X-Early-Data \$tls1_3_early_data;
+   add_header X-Frame-Options SAMEORIGIN;
+
+   # OCSP Stapling deaktiviert: Let's Encrypt hat seinen OCSP-Dienst am
+   # 06.08.2025 endgültig abgeschaltet und stellt Widerrufsinformationen
+   # nur noch über CRLs bereit. Neu ausgestellte Zertifikate enthalten
+   # daher keine OCSP-Responder-URL mehr (siehe fehlende "OCSP - URI"
+   # in der Authority Information Access Extension).
+   # Quelle: https://letsencrypt.org/2025/08/06/ocsp-service-has-reached-end-of-life
+   ssl_stapling off;
+   ssl_stapling_verify off;
+
 
    location ~ /api/v[0-9]+/(users/)?websocket\$ {
       proxy_set_header Upgrade \$http_upgrade;
@@ -1352,7 +1358,6 @@ server {
       proxy_set_header X-Real-IP \$remote_addr;
       proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
       proxy_set_header X-Forwarded-Proto \$scheme;
-      proxy_set_header X-Frame-Options SAMEORIGIN;
       proxy_buffers 256 16k;
       proxy_buffer_size 16k;
       client_body_timeout 60;
@@ -1372,7 +1377,6 @@ server {
       proxy_set_header X-Real-IP \$remote_addr;
       proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
       proxy_set_header X-Forwarded-Proto \$scheme;
-      proxy_set_header X-Frame-Options SAMEORIGIN;
       proxy_buffers 256 16k;
       proxy_buffer_size 16k;
       proxy_read_timeout 600s;