add web gateway stuff

roles/webgateway/templates/certbot.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+# {{ansible_managed}}
+{% for proxysite in proxy %}
+certbot renew --nginx --cert-name {{proxysite.domain}}
+{% endfor %}
+{% for staticsite in static %}
+certbot renew --nginx --cert-name {{staticsite.domain}}
+{% endfor %}

roles/webgateway/templates/nginx.conf

@@ -0,0 +1,90 @@
+# {{ansible_managed}}
+user www-data;
+worker_processes auto;
+pid /run/nginx.pid;
+include /etc/nginx/modules-enabled/*.conf;
+
+events {
+        worker_connections 768;
+        multi_accept on;
+}
+
+http {
+
+        sendfile on;
+        tcp_nopush on;
+        tcp_nodelay on;
+        keepalive_timeout 65;
+        types_hash_max_size 2048;
+
+        server_names_hash_bucket_size 64;
+
+        include /etc/nginx/mime.types;
+        default_type application/octet-stream;
+
+        ssl_protocols TLSv1.2 TLSv1.3;
+        ssl_prefer_server_ciphers on;
+
+        access_log /var/log/nginx/access.log;
+        error_log /var/log/nginx/error.log;
+
+        gzip on;
+
+        gzip_vary on;
+        gzip_proxied any;
+        gzip_comp_level 6;
+        gzip_buffers 16 8k;
+        gzip_http_version 1.1;
+        gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+
+        proxy_redirect  off;
+        proxy_set_header    Host    $host;
+        proxy_set_header    X-Real-IP   $remote_addr;
+        proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header    Upgrade $http_upgrade;
+		proxy_set_header    Connection $http_connection;
+        client_max_body_size    10m;
+        client_body_buffer_size 128k;
+        proxy_connect_timeout   90;
+        proxy_send_timeout      90;
+        proxy_read_timeout      90;
+        proxy_buffers           32 4k;
+
+        server {
+
+            listen 80 default_server http2;
+            listen [::]:80 default_server http2 ipv6only=on;
+            server_name _;
+            return 301 https://$host$request_uri;
+        }
+
+        {% for proxysite in proxy %}
+        server {
+            listen 443 ssl http2;
+            listen [::]:443 ssl http2 ipv6only=on;
+            server_name {{proxysite.domain}};
+            ssl_certificate /etc/letsencrypt/live/{{proxysite.domain}}/fullchain.pem;
+            ssl_certificate_key /etc/letsencrypt/live/{{proxysite.domain}}/privkey.pem;
+            location /{
+                proxy_pass  https://{{proxysite.ip}};
+                proxy_ssl_verify    off;
+            }
+        }
+
+        {% endfor %}
+
+        {% for staticsite in static %}
+        server {
+            listen 443 ssl http2;
+            listen [::]:443 ssl http2 ipv6only=on;
+            server_name {{staticsite.domain}};
+            ssl_certificate /etc/letsencrypt/live/{{proxysite.domain}}/fullchain.pem;
+            ssl_certificate_key /etc/letsencrypt/live/{{proxysite.domain}}/privkey.pem;
+            root    {{staticsite.directory}};
+            location /{
+                try_files $uri $uri/ =404;
+            }
+        }
+
+        {% endfor %}
+}