--- - name: "Install nginx via apt" apt: update_cache: yes state: present name: - nginx - python3-certbot - python3-certbot-nginx - name: Allow http port via ufw community.general.ufw: rule: allow port: http - name: Allow https port via ufw community.general.ufw: rule: allow port: https - name: Copy default nginx config ansible.builtin.copy: src: nginx.conf dest: /etc/nginx/nginx.conf owner: root group: root mode: '0644' - name: Enable and restart nginx daemon service: name: nginx state: restarted enabled: yes - name: Generate certificate for all proxied domains command: cmd: certbot certonly --non-interactive --agree-tos -m tormakristof@tormakristof.eu --nginx -d {{item.domain}} with_items: "{{ proxy }}" - name: Generate certificate for all static sites command: cmd: certbot certonly --non-interactive --agree-tos -m tormakristof@tormakristof.eu --nginx -d {{item.domain}} with_items: "{{ static }}" - name: Generate certificate for all redirect sites command: cmd: certbot certonly --non-interactive --agree-tos -m tormakristof@tormakristof.eu --nginx -d {{item.domain}} with_items: "{{ redirect }}" - name: "Generate certbot script" ansible.builtin.template: src: certbot.sh dest: /etc/cron.weekly/certbot owner: root group: root mode: '0700' - name: "Generate nginx configuration" ansible.builtin.template: src: nginx.conf dest: /etc/nginx/nginx.conf owner: root group: root mode: '0644' - name: Validate nginx configuration command: cmd: nginx -t - name: Reload nginx after configuration change service: name: nginx state: reloaded - name: "Remove any existing static file directories" ansible.builtin.file: path: "{{ item.directory }}" state: absent with_items: "{{ static }}" - name: "Checkout static websites from git" ansible.builtin.git: repo: "{{ item.repo }}" dest: "{{ item.directory }}" with_items: "{{ static }}" - name: "Remove .git directory from static websites" ansible.builtin.file: path: "{{ item.directory }}/.git" state: absent with_items: "{{ static }}" - name: "Install nginx exporter" apt: update_cache: yes state: present name: - prometheus-nginx-exporter - name: Enable and restart exporter daemon service: name: prometheus-nginx-exporter state: restarted enabled: yes - name: Allow nginx exporter via ufw community.general.ufw: rule: allow port: 9113 proto: tcp src: 192.168.69.0/24 ...