vm-ansible/roles/webserver/tasks/main.yaml

---
- name: Allow https port via ufw
  community.general.ufw:
    rule: allow
    port: https
    src: {{ item }}
  with_items: "{{ webgw_allowedranges }}"

- name: "Install Nginx via apt"
  ansible.builtin.apt:
    update_cache: yes
    state: present
    name:
     - nginx
     - python3-certbot
     - python3-certbot-dns-cloudflare

- name: Copy default nginx config
  ansible.builtin.copy:
    src: nginx.conf
    dest: /etc/nginx/nginx.conf
    owner: root
    group: root
    mode: '0644'

- name: Enable and restart nginx daemon
  ansible.builtin.service:
    name: nginx
    state: restarted
    enabled: yes

- name: "Get Cloudflare token from local environment variable"
  ansible.builtin.set_fact:
    cloudflare_token: "{{ lookup('env', 'CLOUDFLARE_TOKEN') }}"
  delegate_to: localhost

- name: "Render Cloudflare Certbot plugin configuration"
  ansible.builtin.template:
    src: cf-creds.ini
    dest: /root/cf-creds.ini
    owner: root
    group: root
    mode: 0600

- name: Generate certificate for all server instances
  ansible.builtin.shell:
    cmd: certbot certonly --non-interactive --agree-tos -m iam@tormakristof.eu --dns-cloudflare --dns-cloudflare-credentials /root/cf-creds.ini -d {{item.domain}}
  with_items: "{{ webserver }}"

- name: "Generate certbot script"
  ansible.builtin.template:
    src: certbot.sh
    dest: /etc/cron.weekly/certbot
    owner: root
    group: root
    mode: '0700'

- name: "Generate nginx configuration"
  ansible.builtin.template:
    src: nginx.conf
    dest: /etc/nginx/nginx.conf
    owner: root
    group: root
    mode: '0644'

- name: Reload nginx daemon
  ansible.builtin.service:
    name: nginx
    state: reloaded

- name: "Install nginx exporter"
  ansible.builtin.apt:
    update_cache: yes
    state: present
    name:
     - prometheus-nginx-exporter

- name: Allow nginx exporter via ufw
  community.general.ufw:
    rule: allow
    port: 9113
    proto: tcp
    src: 192.168.69.0/24

- name: Copy nginx exporter config
  ansible.builtin.copy:
    src: prometheus-nginx-exporter
    dest: /etc/default/prometheus-nginx-exporter
    owner: root
    group: root
    mode: '0644'

- name: Enable and restart exporter daemon
  ansible.builtin.service:
    name: prometheus-nginx-exporter
    state: restarted
    enabled: yes
...