From 29eb2e6cc469d9534c2586e98b782f1879bd8c76 Mon Sep 17 00:00:00 2001 From: Jan Tuomi Date: Mon, 6 Oct 2025 13:18:33 +0300 Subject: Refactor, add certbot to cron --- tasks/jail_ingress.yml | 20 +++++- templates/ingress/etc_crontab.j2 | 10 +++ .../ingress/usr_local_etc_nginx_nginx.conf.j2 | 77 ++++++++++++++++++++++ templates/usr_local_etc_nginx_nginx.conf.j2 | 77 ---------------------- 4 files changed, 106 insertions(+), 78 deletions(-) create mode 100644 templates/ingress/etc_crontab.j2 create mode 100644 templates/ingress/usr_local_etc_nginx_nginx.conf.j2 delete mode 100644 templates/usr_local_etc_nginx_nginx.conf.j2 diff --git a/tasks/jail_ingress.yml b/tasks/jail_ingress.yml index 53b8f67..d5cb2e7 100644 --- a/tasks/jail_ingress.yml +++ b/tasks/jail_ingress.yml @@ -40,7 +40,7 @@ # generated by certbot. Certbot will fail validation if nginx.conf is configured too early. - name: Configure nginx.conf template: - src: usr_local_etc_nginx_nginx.conf.j2 + src: ingress/usr_local_etc_nginx_nginx.conf.j2 dest: /usr/local/jails/containers/ingress/usr/local/etc/nginx/nginx.conf owner: root group: wheel @@ -64,3 +64,21 @@ service -j ingress nginx enable service -j ingress nginx onestart when: ingress_nginx_enabled.rc != 0 + +- name: Set up crontab + template: + src: ingress/etc_crontab.j2 + dest: /usr/local/jails/containers/ingress/etc/crontab + owner: root + group: wheel + mode: "0644" + vars: + # comma-separated list of sites + items: "{{ static_sites | selectattr('tls') | map(attribute='host') | join(',') }}" + register: jail_ingress_etc_crontab + +- name: Restart cron + service: + name: cron + state: restarted + when: jail_ingress_etc_crontab.changed diff --git a/templates/ingress/etc_crontab.j2 b/templates/ingress/etc_crontab.j2 new file mode 100644 index 0000000..7308565 --- /dev/null +++ b/templates/ingress/etc_crontab.j2 @@ -0,0 +1,10 @@ +# /etc/crontab - root's crontab for FreeBSD +# +# +SHELL=/bin/sh +PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin +# +#minute hour mday month wday who command + +# Update LetsEncrypt certificates every day at 2:00 AM +0 2 * * * root certbot certonly --nginx -n -m jan@jantuomi.fi --agree-tos -d {{ items }} diff --git a/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 new file mode 100644 index 0000000..cee7878 --- /dev/null +++ b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 @@ -0,0 +1,77 @@ +worker_processes auto; + +events { + worker_connections 1024; +} + +http { + include mime.types; + default_type application/octet-stream; + + sendfile on; + keepalive_timeout 65; + + server { + listen 80 default_server; + server_name _; + + location / { + return 404; + } + } + + {% for site in static_sites -%} + {% if site.tls -%} + server { + server_name {{ site.host }}; + root /usr/local/www/{{ site.site }}; + + listen 443 ssl; + listen [::]:443 ssl; + http2 on; + + index index.html; + + location / { + try_files $uri $uri.html $uri/ =404; + } + + # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7 + add_header Strict-Transport-Security "max-age=63072000" always; + + access_log /var/log/nginx/{{ site.site }}/access.log; + error_log /var/log/nginx/{{ site.site }}/error.log; + + ssl_certificate /usr/local/etc/letsencrypt/live/{{ site.host }}/fullchain.pem; + ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ site.host }}/privkey.pem; + include /usr/local/etc/letsencrypt/options-ssl-nginx.conf; + ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem; + } + {% endif -%} + + server { + listen 80; + server_name {{ site.host }}; + + return 301 https://$host$request_uri; + + access_log /var/log/nginx/{{ site.site }}/access.log; + error_log /var/log/nginx/{{ site.site }}/error.log; + } + + {% endfor -%} + {% for jail in jails -%} + server { + listen 80; + server_name {{ jail.name }}.jan.systems {{ jail.name }}.local.jan.systems; + + location / { + proxy_pass http://192.168.2.{{ jail.num }}; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + } + {% endfor %} +} diff --git a/templates/usr_local_etc_nginx_nginx.conf.j2 b/templates/usr_local_etc_nginx_nginx.conf.j2 deleted file mode 100644 index cee7878..0000000 --- a/templates/usr_local_etc_nginx_nginx.conf.j2 +++ /dev/null @@ -1,77 +0,0 @@ -worker_processes auto; - -events { - worker_connections 1024; -} - -http { - include mime.types; - default_type application/octet-stream; - - sendfile on; - keepalive_timeout 65; - - server { - listen 80 default_server; - server_name _; - - location / { - return 404; - } - } - - {% for site in static_sites -%} - {% if site.tls -%} - server { - server_name {{ site.host }}; - root /usr/local/www/{{ site.site }}; - - listen 443 ssl; - listen [::]:443 ssl; - http2 on; - - index index.html; - - location / { - try_files $uri $uri.html $uri/ =404; - } - - # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7 - add_header Strict-Transport-Security "max-age=63072000" always; - - access_log /var/log/nginx/{{ site.site }}/access.log; - error_log /var/log/nginx/{{ site.site }}/error.log; - - ssl_certificate /usr/local/etc/letsencrypt/live/{{ site.host }}/fullchain.pem; - ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ site.host }}/privkey.pem; - include /usr/local/etc/letsencrypt/options-ssl-nginx.conf; - ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem; - } - {% endif -%} - - server { - listen 80; - server_name {{ site.host }}; - - return 301 https://$host$request_uri; - - access_log /var/log/nginx/{{ site.site }}/access.log; - error_log /var/log/nginx/{{ site.site }}/error.log; - } - - {% endfor -%} - {% for jail in jails -%} - server { - listen 80; - server_name {{ jail.name }}.jan.systems {{ jail.name }}.local.jan.systems; - - location / { - proxy_pass http://192.168.2.{{ jail.num }}; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - } - } - {% endfor %} -} -- cgit v1.3