vm-ansible/roles/webgateway/tasks/main.yaml
Kristóf Torma 4e1833bbbf
Some checks reported errors
continuous-integration/drone/push Build was killed
add valid cert to internal communication
2023-03-05 18:26:08 +01:00

121 lines
2.7 KiB
YAML

---
- name: "Install nginx via apt"
apt:
update_cache: yes
state: present
name:
- nginx
- python3-certbot
- python3-certbot-nginx
- name: Allow http port via ufw
community.general.ufw:
rule: allow
port: http
- name: Allow https port via ufw
community.general.ufw:
rule: allow
port: https
- name: Copy default nginx config
ansible.builtin.copy:
src: nginx.conf
dest: /etc/nginx/nginx.conf
owner: root
group: root
mode: '0644'
- name: Enable and restart nginx daemon
service:
name: nginx
state: restarted
enabled: yes
- name: Generate certificate for all proxied domains
command:
cmd: certbot certonly --non-interactive --agree-tos -m tormakristof@tormakristof.eu --nginx -d {{item.domain}}
with_items: "{{ proxy }}"
- name: Generate certificate for all static sites
command:
cmd: certbot certonly --non-interactive --agree-tos -m tormakristof@tormakristof.eu --nginx -d {{item.domain}}
with_items: "{{ static }}"
- name: Generate certificate for all redirect sites
command:
cmd: certbot certonly --non-interactive --agree-tos -m tormakristof@tormakristof.eu --nginx -d {{item.domain}}
with_items: "{{ redirect }}"
- name: "Generate certbot script"
ansible.builtin.template:
src: certbot.sh
dest: /etc/cron.weekly/certbot
owner: root
group: root
mode: '0700'
- name: "Generate nginx configuration"
ansible.builtin.template:
src: nginx.conf
dest: /etc/nginx/nginx.conf
owner: root
group: root
mode: '0644'
- name: Validate nginx configuration
command:
cmd: nginx -t
- name: Reload nginx after configuration change
service:
name: nginx
state: reloaded
- name: "Remove any existing static file directories"
ansible.builtin.file:
path: "{{ item.directory }}"
state: absent
with_items: "{{ static }}"
- name: "Checkout static websites from git"
ansible.builtin.git:
repo: "{{ item.repo }}"
dest: "{{ item.directory }}"
with_items: "{{ static }}"
- name: "Remove .git directory from static websites"
ansible.builtin.file:
path: "{{ item.directory }}/.git"
state: absent
with_items: "{{ static }}"
- name: "Install nginx exporter"
apt:
update_cache: yes
state: present
name:
- prometheus-nginx-exporter
- name: Copy default nginx config
ansible.builtin.copy:
src: prometheus-nginx-exporter
dest: /etc/default/prometheus-nginx-exporter
owner: root
group: root
mode: '0644'
- name: Enable and restart exporter daemon
service:
name: prometheus-nginx-exporter
state: restarted
enabled: yes
- name: Allow nginx exporter via ufw
community.general.ufw:
rule: allow
port: 9113
proto: tcp
src: 192.168.69.0/24
...