Refactor ingress routing

5 files changed, 42 insertions, 137 deletions

diff --git a/playbook.yml b/playbook.yml
index 52fcef9..94ca4cb 100644
--- a/playbook.yml
+++ b/playbook.yml
@@ -19,26 +19,25 @@
     lan_ipv4_gateway: 192.168.0.1
     lan_search_domain: local.jan.systems
     jail_userland_version: 14.3-RELEASE
-    jail_ingress_ip: "192.168.2.1"
     jails:
-      - { name: ingress, num: 1, tls: false }
-      - { name: postgres, num: 2, tls: false }
-      - { name: irc_thelounge, num: 3, tls: false }
-      - { name: taulubot, num: 4, tls: false }
-      - { name: homepage, num: 5, tls: false }
-      - { name: hommabot, num: 6, tls: false }
-      - { name: aggro, num: 7, tls: true, host: aggro.jan.systems }
-      - { name: diddle, num: 8, tls: true, host: diddle.jan.systems }
-      #- { name: gallery_sakari, num: 9, tls: false }
-      #- { name: gallery_leo, num: 10, tls: false }
-      - { name: spliit, num: 11, tls: true, host: spliit.jan.systems }
-      #- { name: stirling-pdf, num: 12, tls: false }
-      - { name: ente, num: 13, tls: false }
-      - { name: freshrss, num: 14, tls: true, host: freshrss.jan.systems }
-    static_sites:
-      - { site: "homepage", host: "jan.systems", tls: true }
-    static_site_dirs:
-      homepage: "{{ jan_systems_html_dir }}"
+      - { num: 1, name: ingress }
+      - { num: 2, name: postgres }
+      - { num: 3, name: irc_thelounge }
+      - { num: 4, name: taulubot }
+      - { num: 5, name: homepage }
+      - { num: 6, name: hommabot }
+      - { num: 7, name: aggro }
+      - { num: 8, name: diddle }
+      - { num: 11, name: spliit }
+      - { num: 13, name: ente }
+      - { num: 14, name: freshrss }
+    ingress_routes:
+      - { host: jan.systems, jail: homepage }
+      - { host: jantuomi.fi, redirect: jan.systems }
+      - { host: aggro.jan.systems, jail: aggro }
+      - { host: diddle.jan.systems, jail: diddle }
+      - { host: spliit.jan.systems, jail: spliit }
+      - { host: freshrss.jan.systems, jail: freshrss }
 
   tasks:
     - name: Run general tasks
@@ -77,6 +76,6 @@
       tags: [jail_hommabot]
       import_tasks: tasks/jail_hommabot.yml
 
-    - name: Run jail homepage tasks
+    - name: Run homepage jail tasks
       tags: [jail_homepage]
       import_tasks: tasks/jail_homepage.yml
diff --git a/tasks/jail_ingress.yml b/tasks/jail_ingress.yml
index ff6e7d3..ab95a71 100644
--- a/tasks/jail_ingress.yml
+++ b/tasks/jail_ingress.yml
@@ -5,36 +5,9 @@
     - { jail: ingress, package: py311-certbot-nginx }
   include_tasks: pkg_jail_install.yml
 
-- name: Create static sites log dir
-  file:
-    path: /usr/local/jails/containers/ingress/var/log/nginx/{{ item }}
-    state: directory
-    owner: root
-    group: wheel
-    mode: "0755"
-  loop: "{{ static_sites | map(attribute='site') | unique }}"
-
-- name: Create access.log for static sites
-  file:
-    path: /usr/local/jails/containers/ingress/var/log/nginx/{{ item }}/access.log
-    state: touch
-    owner: root
-    group: wheel
-    mode: "0644"
-  loop: "{{ static_sites | map(attribute='site') | unique }}"
-
-- name: Create error.log for static sites
-  file:
-    path: /usr/local/jails/containers/ingress/var/log/nginx/{{ item }}/error.log
-    state: touch
-    owner: root
-    group: wheel
-    mode: "0644"
-  loop: "{{ static_sites | map(attribute='site') | unique }}"
-
 - name: Generate LetsEncrypt certs
   shell: jexec ingress certbot certonly --nginx -n -m jan@jantuomi.fi --agree-tos -d {{ item }}
-  loop: "{{ static_sites | selectattr('tls') | map(attribute='host') }}"
+  loop: "{{ ingress_routes | map(attribute='host') | unique }}"
 
 # It's important to run this after generating certs, because nginx.conf refers to files
 # generated by certbot. Certbot will fail validation if nginx.conf is configured too early.
@@ -47,12 +20,6 @@
     mode: "0644"
   register: nginx_conf
 
-- name: Copy over static HTML
-  ansible.posix.synchronize:
-    src: "{{ item.value.rstrip('/') + '/' }}"
-    dest: /usr/local/jails/containers/ingress/usr/local/www/{{ item.key }}
-  loop: "{{ static_site_dirs | dict2items }}"
-
 - name: Check if nginx is enabled
   shell: service -j ingress nginx status
   changed_when: false
@@ -89,9 +56,7 @@
     group: wheel
     mode: "0644"
   vars:
-    # comma-separated list of sites
-    items_list: "{{ static_sites + jails }}"
-    items: "{{ items_list | selectattr('tls') | map(attribute='host') }}"
+    tls_hosts: "{{ ingress_routes | map(attribute='host') | unique }}"
   register: jail_ingress_etc_crontab
 
 - name: Restart cron
diff --git a/templates/etc_pf.conf.j2 b/templates/etc_pf.conf.j2
index a439702..ceae731 100644
--- a/templates/etc_pf.conf.j2
+++ b/templates/etc_pf.conf.j2
@@ -1,6 +1,5 @@
 lan_if = "lan0"
 wan_if = "wan0"
-jail_ingress_ip = "{{ jail_ingress_ip }}"
 
 # Default policy
 set skip on lo
diff --git a/templates/ingress/etc_crontab.j2 b/templates/ingress/etc_crontab.j2
index 8fd559e..46d6b93 100644
--- a/templates/ingress/etc_crontab.j2
+++ b/templates/ingress/etc_crontab.j2
@@ -7,8 +7,8 @@ PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
 #minute hour    mday    month   wday    who     command
 
 # Update LetsEncrypt certificates every day after 2:00 AM
-{% for item in items %}
-{{ loop.index0 }}       2       *       *       *       root    certbot certonly --nginx -n -m jan@jantuomi.fi --agree-tos -d {{ item }}
+{% for host in tls_hosts %}
+{{ loop.index0 }}       2       *       *       *       root    certbot certonly --nginx -n -m jan@jantuomi.fi --agree-tos -d {{ host }}
 {% endfor %}
 
 # Update dynamic DNS (Hetzner)
diff --git a/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2
index 04c43db..5df15d2 100644
--- a/templates/ingress/usr_local_etc_nginx_nginx.conf.j2
+++ b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2
@@ -20,109 +20,51 @@ http {
         }
     }
 
-    {% for site in static_sites -%}
-    {% if site.tls -%}
+    {% for route in ingress_routes -%}
+    {% if route.jail is defined -%}
+    {% for jail in jails if jail.name == route.jail -%}
     server {
-        server_name {{ site.host }};
-        root /usr/local/www/{{ site.site }};
+        server_name {{ route.host }};
+        http2 on;
 
         listen 443 ssl;
         listen [::]:443 ssl;
-        http2 on;
-
-        index index.html;
-
-        location / {
-            try_files $uri $uri.html $uri/ =404;
-        }
 
         # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7
         add_header Strict-Transport-Security "max-age=63072000" always;
 
-        access_log /var/log/nginx/{{ site.site }}/access.log;
-        error_log /var/log/nginx/{{ site.site }}/error.log;
-
-        ssl_certificate /usr/local/etc/letsencrypt/live/{{ site.host }}/fullchain.pem;
-        ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ site.host }}/privkey.pem;
+        ssl_certificate /usr/local/etc/letsencrypt/live/{{ route.host }}/fullchain.pem;
+        ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ route.host }}/privkey.pem;
         include /usr/local/etc/letsencrypt/options-ssl-nginx.conf;
         ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem;
-    }
-
-    server {
-        listen 80;
-        server_name {{ site.host }};
-
-        return 301 https://$host$request_uri;
-
-        access_log /var/log/nginx/{{ site.site }}/access.log;
-        error_log /var/log/nginx/{{ site.site }}/error.log;
-    }
-    {% else %}
-    server {
-        server_name {{ site.host }};
-        root /usr/local/www/{{ site.site }};
-
-        listen 80;
-        http2 on;
-
-        index index.html;
 
         location / {
-            try_files $uri $uri.html $uri/ =404;
+            proxy_pass http://192.168.2.{{ jail.num }};
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
         }
-
-        access_log /var/log/nginx/{{ site.site }}/access.log;
-        error_log /var/log/nginx/{{ site.site }}/error.log;
     }
-    {% endif -%}
-
-    {# TODO: parameterize this properly -#}
-    server {
-        server_name jantuomi.fi;
-        http2 on;
-
-        listen 443 ssl;
-        listen [::]:443 ssl;
-
-        # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7
-        add_header Strict-Transport-Security "max-age=63072000" always;
-
-        ssl_certificate /usr/local/etc/letsencrypt/live/jantuomi.fi/fullchain.pem;
-        ssl_certificate_key /usr/local/etc/letsencrypt/live/jantuomi.fi/privkey.pem;
-        include /usr/local/etc/letsencrypt/options-ssl-nginx.conf;
-        ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem;
-
-        return 307 https://jan.systems$request_uri;
-    }
-
-    {% endfor -%}
-    {% for jail in jails -%}
+    {% endfor %}
+    {% elif route.redirect is defined -%}
     server {
-        server_name {{ jail.name }}.jan.systems;
+        server_name {{ route.host }};
         http2 on;
 
-        {% if "tls" in jail and jail.tls -%}
         listen 443 ssl;
         listen [::]:443 ssl;
 
         # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7
         add_header Strict-Transport-Security "max-age=63072000" always;
 
-        ssl_certificate /usr/local/etc/letsencrypt/live/{{ jail.name }}.jan.systems/fullchain.pem;
-        ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ jail.name }}.jan.systems/privkey.pem;
+        ssl_certificate /usr/local/etc/letsencrypt/live/{{ route.host }}/fullchain.pem;
+        ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ route.host }}/privkey.pem;
         include /usr/local/etc/letsencrypt/options-ssl-nginx.conf;
         ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem;
-        {% else %}
-        listen 80;
-        {% endif %}
 
-        location / {
-            proxy_pass http://192.168.2.{{ jail.num }};
-            proxy_set_header Host $host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-        }
+        return 307 https://{{ route.redirect }}$request_uri;
     }
+    {% endif %}
     {% endfor %}
 }