diff options
| author | Jan Tuomi <jan@jantuomi.fi> | 2025-07-10 17:19:00 +0300 |
|---|---|---|
| committer | Jan Tuomi <jan@jantuomi.fi> | 2025-07-10 17:19:00 +0300 |
| commit | d1c9aa40ccb5910076d0ec94843efccf62ee006a (patch) | |
| tree | 1476503a2d2d76cf543ef0b6521e1f4aa3540806 | |
| parent | 95466bf02741b67134ccb34163659a7a9c299c43 (diff) | |
Run certbot
| -rw-r--r-- | playbook.yml | 4 | ||||
| -rw-r--r-- | tasks/general.yml | 1 | ||||
| -rw-r--r-- | tasks/network.yml | 5 | ||||
| -rw-r--r-- | templates/etc_periodic.conf.j2 | 1 | ||||
| -rw-r--r-- | templates/usr_local_etc_nginx_nginx.conf.j2 | 30 |
5 files changed, 36 insertions, 5 deletions
diff --git a/playbook.yml b/playbook.yml index df8393b..975d792 100644 --- a/playbook.yml +++ b/playbook.yml @@ -28,6 +28,10 @@ jails: - { name: nginx_test, ip: "192.168.2.1" } - { name: postgres, ip: "192.168.2.2" } + static_sites: + - { site: "jan.systems", host: "jan.systems", tls: false } + - { site: "jan.systems", host: "pursotin.jan.systems", tls: true } + - { site: "jan.systems", host: "local.jan.systems", tls: false } tasks: - name: Run general tasks diff --git a/tasks/general.yml b/tasks/general.yml index 902d6c4..3c55117 100644 --- a/tasks/general.yml +++ b/tasks/general.yml @@ -8,6 +8,7 @@ - dma - jq - curl + - py311-certbot - name: Set up periodic.conf template: diff --git a/tasks/network.yml b/tasks/network.yml index d582d0c..ed57a13 100644 --- a/tasks/network.yml +++ b/tasks/network.yml @@ -76,6 +76,11 @@ mode: "0644" register: nginx_conf +- name: Generate LetsEncrypt certs + shell: certbot certonly --standalone -n -m jan@jantuomi.fi --agree-tos -d {{ item }} + loop: "{{ static_sites | selectattr('tls') | map(attribute='host') }}" + when: nginx_conf.changed + - name: Copy over jan.systems HTML ansible.posix.synchronize: src: "{{ jan_systems_html_dir.rstrip('/') + '/' }}" diff --git a/templates/etc_periodic.conf.j2 b/templates/etc_periodic.conf.j2 index 22602c2..0e70471 100644 --- a/templates/etc_periodic.conf.j2 +++ b/templates/etc_periodic.conf.j2 @@ -1 +1,2 @@ daily_status_smart_enable="YES" +weekly_certbot_enable="YES" diff --git a/templates/usr_local_etc_nginx_nginx.conf.j2 b/templates/usr_local_etc_nginx_nginx.conf.j2 index 692f5a2..fcdaf02 100644 --- a/templates/usr_local_etc_nginx_nginx.conf.j2 +++ b/templates/usr_local_etc_nginx_nginx.conf.j2 @@ -20,21 +20,41 @@ http { } } + {% for site in static_sites -%} + {% if site.tls -%} server { - listen 80; - server_name jan.systems pursotin.jan.systems local.jan.systems; + listen 443 ssl; + server_name {{ site.host }}; - root /usr/local/www/jan.systems; + root /usr/local/www/{{ site.site }}; index index.html; location / { try_files $uri $uri.html $uri/ =404; } - access_log /var/log/nginx/jan.systems/access.log; - error_log /var/log/nginx/jan.systems/error.log; + access_log /var/log/nginx/{{ site.site }}/access.log; + error_log /var/log/nginx/{{ site.site }}/error.log; + + ssl_certificate /usr/local/etc/letsencrypt/live/{{ site.host }}/fullchain.pem; + ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ site.host }}/privkey.pem; + include /usr/local/etc/letsencrypt/options-ssl-nginx.conf; + ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem; + } + + {% endif -%} + + server { + listen 80; + server_name {{ site.host }}; + + return 301 https://$host$request_uri; + + access_log /var/log/nginx/{{ site.site }}/access.log; + error_log /var/log/nginx/{{ site.site }}/error.log; } + {% endfor -%} {% for jail in jails -%} server { listen 80; |