diff options
-rw-r--r-- | inventory/host_vars/ele-media.yml | 2 | ||||
-rw-r--r-- | roles/elevate/media/handlers/main.yml | 5 | ||||
-rw-r--r-- | roles/elevate/media/tasks/main.yml | 11 | ||||
-rw-r--r-- | roles/elevate/media/tasks/nginx.yml | 75 | ||||
-rw-r--r-- | roles/nginx/defaults/main.yml | 2 | ||||
-rw-r--r-- | roles/nginx/tasks/main.yml | 2 |
6 files changed, 13 insertions, 84 deletions
diff --git a/inventory/host_vars/ele-media.yml b/inventory/host_vars/ele-media.yml index 2ecfe431..3ff032b9 100644 --- a/inventory/host_vars/ele-media.yml +++ b/inventory/host_vars/ele-media.yml @@ -25,6 +25,8 @@ admin_user_host: ssh_allowusers_host: "{{ admin_user_host | map(attribute='name') | list }}" +nginx_pkg_variant: nginx + mysql_root_password: "{{ vault_mysql_root_password }}" diff --git a/roles/elevate/media/handlers/main.yml b/roles/elevate/media/handlers/main.yml index d5997632..a4f722af 100644 --- a/roles/elevate/media/handlers/main.yml +++ b/roles/elevate/media/handlers/main.yml @@ -16,8 +16,3 @@ service: name: smbd state: restarted - -- name: restart nginx - service: - name: nginx - state: restarted diff --git a/roles/elevate/media/tasks/main.yml b/roles/elevate/media/tasks/main.yml index 78d75ae2..77d53d23 100644 --- a/roles/elevate/media/tasks/main.yml +++ b/roles/elevate/media/tasks/main.yml @@ -20,8 +20,15 @@ - name: install and configure nextcloud import_tasks: nextcloud.yml -- name: configure nginx - import_tasks: nginx.yml +- name: install and configure nginx + import_role: + name: nginx + vars: + nginx_vhosts: + nextcloud: + content: "{{ lookup('template', 'nextcloud-nginx.conf.j2') }}" + acme: true + hostnames: "{{ nextcloud_hostnames }}" - name: install dstat script template: diff --git a/roles/elevate/media/tasks/nginx.yml b/roles/elevate/media/tasks/nginx.yml deleted file mode 100644 index 435cc751..00000000 --- a/roles/elevate/media/tasks/nginx.yml +++ /dev/null @@ -1,75 +0,0 @@ ---- -## TODO: most of these steps could probably be moved to generic role - -- name: remove nginx default config - file: - name: /etc/nginx/sites-enabled/default - state: absent - notify: restart nginx - -- name: install nginx config snippets - loop: - - ssl - - hsts - copy: - src: "{{ global_files_dir }}/common/nginx-snippets/{{ item }}.conf" - dest: /etc/nginx/snippets/ - notify: restart nginx - -- name: generate Diffie-Hellman parameters - openssl_dhparam: - path: /etc/ssl/dhparams.pem - size: 2048 - notify: restart nginx - -- name: install nginx config - template: - src: nextcloud-nginx.conf.j2 - dest: /etc/nginx/sites-available/nextcloud - notify: restart nginx - -- name: check if acme certs already exist - loop: "{{ nextcloud_hostnames }}" - stat: - path: "/var/lib/acme/live/{{ item }}" - register: acme_cert_stat - -- name: set acmecert_missing_hostnames variable - set_fact: - acmecert_missing_hostnames: "{{ acme_cert_stat.results | acme_cert_nonexistent(nextcloud_hostnames) }}" - -- name: link nonexistent hostnames to self-signed interim cert - when: acmecert_missing_hostnames | length > 0 - block: - - name: get id of existing selfsigned interim certificate - command: cat /var/lib/acme/.selfsigned-interim-cert - changed_when: false - check_mode: false - register: selfsigned_interim_cert_id - - - name: set selfsigned_interim_cert_id variable - set_fact: - selfsigned_interim_cert_id: "{{ selfsigned_interim_cert_id.stdout }}" - - - name: link to snakeoil cert for nonexistent hostnames - loop: "{{ acmecert_missing_hostnames }}" - file: - src: "../certs/{{ selfsigned_interim_cert_id }}" - dest: "/var/lib/acme/live/{{ item }}" - state: link - -- name: enable vhost config using acme cert - file: - src: ../sites-available/nextcloud - dest: /etc/nginx/sites-enabled/nextcloud - state: link - -- name: make sure nginx config has been (re)loaded - meta: flush_handlers - -- name: get certificate using acmetool - import_role: - name: acmetool/cert - vars: - acmetool_cert_name: "{{ nextcloud_hostnames[0] }}" - acmetool_cert_hostnames: "{{ nextcloud_hostnames }}" diff --git a/roles/nginx/defaults/main.yml b/roles/nginx/defaults/main.yml index 0a7930e3..73b10a11 100644 --- a/roles/nginx/defaults/main.yml +++ b/roles/nginx/defaults/main.yml @@ -1,5 +1,5 @@ --- -nginx_pkg_name: nginx-light +nginx_pkg_variant: nginx-light # nginx_vhosts: # example: diff --git a/roles/nginx/tasks/main.yml b/roles/nginx/tasks/main.yml index 42700db6..fd63954e 100644 --- a/roles/nginx/tasks/main.yml +++ b/roles/nginx/tasks/main.yml @@ -1,7 +1,7 @@ --- - name: install nginx apt: - name: "{{ nginx_pkg_name }}" + name: "{{ nginx_pkg_variant }}" state: present - name: remove nginx default config |