From d1c9aa40ccb5910076d0ec94843efccf62ee006a Mon Sep 17 00:00:00 2001
From: Jan Tuomi <jan@jantuomi.fi>
Date: Thu, 10 Jul 2025 17:19:00 +0300
Subject: Run certbot

---
 playbook.yml                                |  4 ++++
 tasks/general.yml                           |  1 +
 tasks/network.yml                           |  5 +++++
 templates/etc_periodic.conf.j2              |  1 +
 templates/usr_local_etc_nginx_nginx.conf.j2 | 30 ++++++++++++++++++++++++-----
 5 files changed, 36 insertions(+), 5 deletions(-)

diff --git a/playbook.yml b/playbook.yml
index df8393b..975d792 100644
--- a/playbook.yml
+++ b/playbook.yml
@@ -28,6 +28,10 @@
     jails:
       - { name: nginx_test, ip: "192.168.2.1" }
       - { name: postgres, ip: "192.168.2.2" }
+    static_sites:
+      - { site: "jan.systems", host: "jan.systems", tls: false }
+      - { site: "jan.systems", host: "pursotin.jan.systems", tls: true }
+      - { site: "jan.systems", host: "local.jan.systems", tls: false }
 
   tasks:
     - name: Run general tasks
diff --git a/tasks/general.yml b/tasks/general.yml
index 902d6c4..3c55117 100644
--- a/tasks/general.yml
+++ b/tasks/general.yml
@@ -8,6 +8,7 @@
     - dma
     - jq
     - curl
+    - py311-certbot
 
 - name: Set up periodic.conf
   template:
diff --git a/tasks/network.yml b/tasks/network.yml
index d582d0c..ed57a13 100644
--- a/tasks/network.yml
+++ b/tasks/network.yml
@@ -76,6 +76,11 @@
     mode: "0644"
   register: nginx_conf
 
+- name: Generate LetsEncrypt certs
+  shell: certbot certonly --standalone -n -m jan@jantuomi.fi --agree-tos -d {{ item }}
+  loop: "{{ static_sites | selectattr('tls') | map(attribute='host') }}"
+  when: nginx_conf.changed
+
 - name: Copy over jan.systems HTML
   ansible.posix.synchronize:
     src: "{{ jan_systems_html_dir.rstrip('/') + '/' }}"
diff --git a/templates/etc_periodic.conf.j2 b/templates/etc_periodic.conf.j2
index 22602c2..0e70471 100644
--- a/templates/etc_periodic.conf.j2
+++ b/templates/etc_periodic.conf.j2
@@ -1 +1,2 @@
 daily_status_smart_enable="YES"
+weekly_certbot_enable="YES"
diff --git a/templates/usr_local_etc_nginx_nginx.conf.j2 b/templates/usr_local_etc_nginx_nginx.conf.j2
index 692f5a2..fcdaf02 100644
--- a/templates/usr_local_etc_nginx_nginx.conf.j2
+++ b/templates/usr_local_etc_nginx_nginx.conf.j2
@@ -20,21 +20,41 @@ http {
         }
     }
 
+    {% for site in static_sites -%}
+    {% if site.tls -%}
     server {
-        listen 80;
-        server_name jan.systems pursotin.jan.systems local.jan.systems;
+        listen 443 ssl;
+        server_name {{ site.host }};
 
-        root /usr/local/www/jan.systems;
+        root /usr/local/www/{{ site.site }};
         index index.html;
 
         location / {
             try_files $uri $uri.html $uri/ =404;
         }
 
-        access_log /var/log/nginx/jan.systems/access.log;
-        error_log /var/log/nginx/jan.systems/error.log;
+        access_log /var/log/nginx/{{ site.site }}/access.log;
+        error_log /var/log/nginx/{{ site.site }}/error.log;
+
+        ssl_certificate /usr/local/etc/letsencrypt/live/{{ site.host }}/fullchain.pem;
+        ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ site.host }}/privkey.pem;
+        include /usr/local/etc/letsencrypt/options-ssl-nginx.conf;
+        ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem;
+    }
+
+    {% endif -%}
+
+    server {
+        listen 80;
+        server_name {{ site.host }};
+
+        return 301 https://$host$request_uri;
+
+        access_log /var/log/nginx/{{ site.site }}/access.log;
+        error_log /var/log/nginx/{{ site.site }}/error.log;
     }
 
+    {% endfor -%}
     {% for jail in jails -%}
     server {
         listen 80;
-- 
cgit v1.3