Feat: mount /var/www/html to the nginx container and add config to protect against CVE-2019-11043

roles/podman_cleaninsights/tasks/main.yml

@@ -79,6 +79,10 @@
     podman_nginx_primary_hostname: "{{ podman_cleaninsights_web_hostname }}"
     podman_nginx_systemd_service_slice: cleaninsights.slice
     podman_nginx_systemd_service_requires: ["matomo"]
+    podman_nginx_additional_volumes:
+      - src: "/home/{{ podman_cleaninsights_podman_rootless_user }}/matomo"
+        dest: "/var/www/html"
+        options: "ro"
 
 - name: create nginx configuration file
   ansible.builtin.template: