add valid cert to internal communication

roles/webgateway/files/prometheus-nginx-exporter

@@ -0,0 +1,14 @@
+ARGS="-nginx.scrape-uri http://127.0.0.1:8888/stub_status"
+
+# Prometheus-nginx-exporter supports the following options:
+#  -nginx.plus
+#        Start the exporter for NGINX Plus. By default, the exporter is started
+#        for NGINX.
+#  -nginx.scrape-uri string
+#        A URI for scraping NGINX or NGINX Plus metrics.
+#        For NGINX, the stub_status page must be available through the URI.
+#        For NGINX Plus -- the API. (default "http://127.0.0.1:8080/stub_status")
+#  -web.listen-address string
+#        An address to listen on for web interface and telemetry. (default ":9113")
+#  -web.telemetry-path string
+#        A path under which to expose metrics. (default "/metrics"

roles/webgateway/tasks/main.yaml

@@ -97,6 +97,14 @@
     name:
      - prometheus-nginx-exporter
 
+- name: Copy default nginx config
+  ansible.builtin.copy:
+    src: prometheus-nginx-exporter
+    dest: /etc/default/prometheus-nginx-exporter
+    owner: root
+    group: root
+    mode: '0644'
+
 - name: Enable and restart exporter daemon
   service:
     name: prometheus-nginx-exporter

roles/webgateway/templates/nginx.conf

@@ -66,7 +66,7 @@ http {
             return 301 https://$host$request_uri;
         }
 
-        {%- for proxysite in proxy %}
+        {%- for proxysite in proxy -%}
         server {
             listen 443 ssl http2;
             listen [::]:443 ssl http2;
@@ -90,9 +90,9 @@ http {
             }
         }
 
-        {%- endfor %}
+        {%- endfor -%}
 
-        {%- for staticsite in static %}
+        {%- for staticsite in static -%}
         server {
             listen 443 ssl http2;
             listen [::]:443 ssl http2;
@@ -105,9 +105,9 @@ http {
             }
         }
 
-        {%- endfor %}
+        {%- endfor -%}
 
-        {%- for redirectsite in redirect %}
+        {%- for redirectsite in redirect -%}
         server {
             listen 443 ssl http2;
             listen [::]:443 ssl http2;
@@ -117,7 +117,7 @@ http {
             return 301 {{ redirectsite.destination }};
         }
 
-        {%- endfor %}
+        {%- endfor -%}
 
         server {
             listen 443 ssl http2;

roles/webgateway/vars/main.yaml

@@ -11,11 +11,10 @@ proxy:
   - {domain: fs.tormakristof.eu, ip: adfs.intra.tormakris.dev, bigrequests: false}
   - {domain: certauth.fs.tormakristof.eu, ip: adfs.intra.tormakris.dev, bigrequests: false}
   - {domain: grafana.tormakristof.eu, ip: monitoring.intra.tormakris.dev, bigrequests: false}
-  - {domain: yt.tormakristof.eu, ip: ytmirror.intra.tormakris.dev, bigrequests: true}
+  - {domain: yt.tormakristof.eu, ip: ytmirror.intra.tormakris.dev, bigrequests: false}
   - {domain: mastodon.tormakristof.eu, ip: mastodon.intra.tormakris.dev, bigrequests: true}
   - {domain: speedtest.tormakristof.eu, ip: librespeed.intra.tormakris.dev, bigrequests: true}
 
-
 static:
   []