diff options
| author | Jan Tuomi <jan@jantuomi.fi> | 2025-10-06 00:06:54 +0300 |
|---|---|---|
| committer | Jan Tuomi <jan@jantuomi.fi> | 2025-10-06 00:06:54 +0300 |
| commit | ae9be6373428471dd4c95f64741b990638c272c0 (patch) | |
| tree | 66211764ac0d8c5484e119b7b3f23ad56ebc5ea4 /tasks/jail_ingress.yml | |
| parent | ffe2c8d0accb5c33c98408dfb1039d7387ddffd1 (diff) | |
Work on networking
Diffstat (limited to 'tasks/jail_ingress.yml')
| -rw-r--r-- | tasks/jail_ingress.yml | 53 |
1 files changed, 42 insertions, 11 deletions
diff --git a/tasks/jail_ingress.yml b/tasks/jail_ingress.yml index 1a87722..d6db2f5 100644 --- a/tasks/jail_ingress.yml +++ b/tasks/jail_ingress.yml @@ -2,17 +2,9 @@ loop: - { jail: ingress, package: nginx } - { jail: ingress, package: py311-certbot } + - { jail: ingress, package: py311-certbot-nginx } include_tasks: pkg_jail_install.yml -- name: Configure nginx.conf - template: - src: usr_local_etc_nginx_nginx.conf.j2 - dest: /usr/local/jails/containers/ingress/usr/local/etc/nginx/nginx.conf - owner: root - group: wheel - mode: "0644" - register: nginx_conf - - name: Create static sites log dir file: path: /usr/local/jails/containers/ingress/var/log/nginx/{{ item }} @@ -41,9 +33,19 @@ loop: "{{ static_sites | map(attribute='site') | unique }}" #- name: Generate LetsEncrypt certs -# shell: jexec ingress certbot certonly --standalone -n -m jan@jantuomi.fi --agree-tos -d {{ item }} +# shell: jexec ingress certbot certonly --nginx -n -m jan@jantuomi.fi --agree-tos -d {{ item }} # loop: "{{ static_sites | selectattr('tls') | map(attribute='host') }}" -# when: nginx_conf.changed + +# It's important to run this after generating certs, because nginx.conf refers to files +# generated by certbot. Certbot will fail validation if nginx.conf is configured too early. +- name: Configure nginx.conf + template: + src: usr_local_etc_nginx_nginx.conf.j2 + dest: /usr/local/jails/containers/ingress/usr/local/etc/nginx/nginx.conf + owner: root + group: wheel + mode: "0644" + register: nginx_conf - name: Copy over static HTML ansible.posix.synchronize: @@ -62,3 +64,32 @@ service -j ingress nginx enable service -j ingress nginx onestart when: ingress_nginx_enabled.rc != 0 + +- name: Configure hetzner-ddns + template: + src: usr_local_etc_rc.d_hetzner_ddns.j2 + dest: /usr/local/jails/containers/ingress/usr/local/etc/rc.d/hetzner_ddns + owner: root + group: wheel + mode: "0755" + +- name: Install hetzner-ddns script + template: + src: usr_local_bin_hetzner_ddns.sh.j2 + dest: /usr/local/jails/containers/ingress/usr/local/bin/hetzner_ddns.sh + owner: root + group: wheel + mode: "0755" + +- name: Set up hetzner_auth + template: + src: usr_local_etc_hetzner_auth.j2 + dest: /usr/local/jails/containers/ingress/usr/local/etc/hetzner_auth + owner: root + group: wheel + mode: "0600" + +- name: Restart hetzner-ddns + shell: | + service -j ingress hetzner_ddns enable + service -j ingress hetzner_ddns restart |