vm-ansible/roles/webgateway/tasks/main.yaml

---
- name: "Install nginx via apt"
  apt:
    update_cache: yes
    state: present
    name:
     - nginx
     - python3-certbot
     - python3-certbot-nginx

- name: Allow http port via ufw
  community.general.ufw:
    rule: allow
    port: http

- name: Allow https port via ufw
  community.general.ufw:
    rule: allow
    port: https

- name: Copy default nginx config
  ansible.builtin.copy:
    src: nginx.conf
    dest: /etc/nginx/nginx.conf
    owner: root
    group: root
    mode: '0644'

- name: Enable and restart nginx daemon
  service:
    name: nginx
    state: restarted
    enabled: yes

- name: Generate certificate for all proxied domains
  command:
    cmd: certbot certonly --non-interactive --agree-tos -m tormakristof@tormakristof.eu --nginx -d {{item.domain}}
  with_items: "{{ proxy }}"

- name: Generate certificate for all static sites
  command:
    cmd: certbot certonly --non-interactive --agree-tos -m tormakristof@tormakristof.eu --nginx -d {{item.domain}}
  with_items: "{{ static }}"

- name: Generate certificate for all redirect sites
  command:
    cmd: certbot certonly --non-interactive --agree-tos -m tormakristof@tormakristof.eu --nginx -d {{item.domain}}
  with_items: "{{ redirect }}"

- name: "Generate certbot script"
  ansible.builtin.template:
    src: certbot.sh
    dest: /opt/certbot.sh
    owner: root
    group: root
    mode: '0700'

- name: Copy certbot-script.service to target
  copy:
    src: certbot-script.service
    dest: /usr/lib/systemd/system/certbot-script.service
    mode: 644
    owner: root

- name: Copy certbot.target to target
  copy:
    src: certbot.target
    dest: /usr/lib/systemd/system/certbot.target
    mode: 644
    owner: root

- name: Copy certbot.timer to target
  copy:
    src: certbot.timer
    dest: /usr/lib/systemd/system/certbot.timer
    mode: 644
    owner: root

- name: Enable certbot-script.service and reload systemd daemon
  when: ansible_service_mgr == "systemd"
  ansible.builtin.systemd:
    enabled: yes
    daemon_reload: yes
    name: certbot-script.service

- name: Enable certbot.target
  when: ansible_service_mgr == "systemd"
  ansible.builtin.systemd:
    enabled: yes
    name: certbot.target

- name: Enable certbot.timer
  when: ansible_service_mgr == "systemd"
  ansible.builtin.systemd:
    enabled: yes
    name: certbot.timer

- name: "Generate nginx configuration"
  ansible.builtin.template:
    src: nginx.conf
    dest: /etc/nginx/nginx.conf
    owner: root
    group: root
    mode: '0644'

- name: Validate nginx configuration
  command:
    cmd: nginx -t

- name: Reload nginx after configuration change
  service:
    name: nginx
    state: reloaded

- name: "Remove any existing static file directories"
  ansible.builtin.file:
    path: "{{ item.directory }}"
    state: absent
  with_items: "{{ static }}"

- name: "Checkout static websites from git"
  ansible.builtin.git:
    repo: "{{ item.repo }}"
    dest: "{{ item.directory }}"
  with_items: "{{ static }}"

- name: "Remove .git directory from static websites"
  ansible.builtin.file:
    path: "{{ item.directory }}/.git"
    state: absent
  with_items: "{{ static }}"

- name: "Install nginx exporter"
  apt:
    update_cache: yes
    state: present
    name:
     - prometheus-nginx-exporter

- name: Enable and restart exporter daemon
  service:
    name: prometheus-nginx-exporter
    state: restarted
    enabled: yes

- name: Allow nginx exporter via ufw
  community.general.ufw:
    rule: allow
    port: 9113
    proto: tcp
    src: 192.168.69.0/24
...