101 lines
2.1 KiB
YAML
101 lines
2.1 KiB
YAML
---
|
|
- name: "Install nginx via apt"
|
|
apt:
|
|
update_cache: yes
|
|
state: present
|
|
name:
|
|
- nginx
|
|
- python3-certbot
|
|
- python3-certbot-nginx
|
|
|
|
- name: Allow http port via ufw
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: http
|
|
|
|
- name: Allow https port via ufw
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: https
|
|
|
|
- name: Enable and restart nginx daemon
|
|
service:
|
|
name: nginx
|
|
state: restarted
|
|
enabled: yes
|
|
|
|
- name: Generate certificate for all proxied domains
|
|
command:
|
|
cmd: certbot certonly --nginx -d {{item.domain}}
|
|
with_items: "{{ proxy }}"
|
|
|
|
- name: Generate certificate for all static sites
|
|
command:
|
|
cmd: certbot certonly --nginx -d {{item.domain}}
|
|
with_items: "{{ static }}"
|
|
|
|
- name: "Generate certbot script"
|
|
ansible.builtin.template:
|
|
src: certbot.sh
|
|
dest: /opt/certbot.sh
|
|
owner: root
|
|
group: root
|
|
mode: '0700'
|
|
|
|
- name: Copy certbot-script.service to target
|
|
copy:
|
|
src: certbot-script.service
|
|
dest: /usr/lib/systemd/system/certbot-script.service
|
|
mode: 644
|
|
owner: root
|
|
|
|
- name: Copy certbot.target to target
|
|
copy:
|
|
src: certbot.target
|
|
dest: /usr/lib/systemd/system/certbot.target
|
|
mode: 644
|
|
owner: root
|
|
|
|
- name: Copy certbot.timer to target
|
|
copy:
|
|
src: certbot.timer
|
|
dest: /usr/lib/systemd/system/certbot.timer
|
|
mode: 644
|
|
owner: root
|
|
|
|
- name: Enable certbot-script.service and reload systemd daemon
|
|
when: ansible_service_mgr == "systemd"
|
|
ansible.builtin.systemd:
|
|
enabled: yes
|
|
daemon_reload: yes
|
|
name: certbot-script.service
|
|
|
|
- name: Enable certbot.target
|
|
when: ansible_service_mgr == "systemd"
|
|
ansible.builtin.systemd:
|
|
enabled: yes
|
|
name: certbot.target
|
|
|
|
- name: Enable certbot.timer
|
|
when: ansible_service_mgr == "systemd"
|
|
ansible.builtin.systemd:
|
|
enabled: yes
|
|
name: certbot.timer
|
|
|
|
- name: "Generate nginx configuration"
|
|
ansible.builtin.template:
|
|
src: nginx.conf
|
|
dest: /etc/nginx/nginx.conf
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
|
|
- name: Validate nginx configuration
|
|
command:
|
|
cmd: nginx -t
|
|
|
|
- name: Reload nginx after configuration change
|
|
service:
|
|
name: nginx
|
|
state: reloaded
|