From bc98352d3e331003db625be96139b3c1f95f63b2 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Wed, 9 Aug 2023 14:38:23 +0200
Subject: nginx/vhost: major change in certifcate/tls handling (WIP)

---
 roles/apps/etherpad-lite/tasks/main.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'roles/apps/etherpad-lite/tasks/main.yml')

diff --git a/roles/apps/etherpad-lite/tasks/main.yml b/roles/apps/etherpad-lite/tasks/main.yml
index 072a6c09..495a0387 100644
--- a/roles/apps/etherpad-lite/tasks/main.yml
+++ b/roles/apps/etherpad-lite/tasks/main.yml
@@ -114,7 +114,8 @@
     nginx_vhost:
       name: "etherpad-lite-{{ item.key }}"
       content: "{{ lookup('template', 'nginx-vhost.conf.j2') }}"
-      acme: true
+      tls:
+        certificate_provider: "{{ acme_client }}"
       hostnames: "{{ item.value.hostnames }}"
   include_role:
     name: nginx/vhost
-- 
cgit v1.2.3


From 55631d04f68bd4657ee5fb994a1fdfe32329af54 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Mon, 14 Aug 2023 23:35:00 +0200
Subject: etherpad-lite: move to generic nginx-vhost template

---
 roles/apps/collabora/code/tasks/nginx-vhost.yml    |  1 +
 roles/apps/etherpad-lite/tasks/main.yml            | 14 +---
 roles/apps/etherpad-lite/tasks/nginx-vhost.yml     | 16 ++++
 .../etherpad-lite/templates/nginx-vhost.conf.j2    | 88 ++++++++--------------
 4 files changed, 53 insertions(+), 66 deletions(-)
 create mode 100644 roles/apps/etherpad-lite/tasks/nginx-vhost.yml

(limited to 'roles/apps/etherpad-lite/tasks/main.yml')

diff --git a/roles/apps/collabora/code/tasks/nginx-vhost.yml b/roles/apps/collabora/code/tasks/nginx-vhost.yml
index 218b4a94..afd8f1e0 100644
--- a/roles/apps/collabora/code/tasks/nginx-vhost.yml
+++ b/roles/apps/collabora/code/tasks/nginx-vhost.yml
@@ -1,3 +1,4 @@
+---
 - name: render nginx-vhost custom config
   set_fact:
     collabora_code_nginx_vhost_custom: "{{ lookup('template', 'nginx-vhost.conf.j2') }}"
diff --git a/roles/apps/etherpad-lite/tasks/main.yml b/roles/apps/etherpad-lite/tasks/main.yml
index 495a0387..a3b167a8 100644
--- a/roles/apps/etherpad-lite/tasks/main.yml
+++ b/roles/apps/etherpad-lite/tasks/main.yml
@@ -108,14 +108,8 @@
   include_role:
     name: kubernetes/standalone/pod
 
-- name: configure nginx vhost
+- name: install nginx vhost config
   loop: "{{ etherpad_lite_instances | dict2items }}"
-  vars:
-    nginx_vhost:
-      name: "etherpad-lite-{{ item.key }}"
-      content: "{{ lookup('template', 'nginx-vhost.conf.j2') }}"
-      tls:
-        certificate_provider: "{{ acme_client }}"
-      hostnames: "{{ item.value.hostnames }}"
-  include_role:
-    name: nginx/vhost
+  loop_control:
+    label: "{{ item.key }}"
+  include_tasks: nginx-vhost.yml
diff --git a/roles/apps/etherpad-lite/tasks/nginx-vhost.yml b/roles/apps/etherpad-lite/tasks/nginx-vhost.yml
new file mode 100644
index 00000000..91c8b54d
--- /dev/null
+++ b/roles/apps/etherpad-lite/tasks/nginx-vhost.yml
@@ -0,0 +1,16 @@
+---
+- name: render nginx-vhost custom config
+  set_fact:
+    etherpad_lite_nginx_vhost_custom: "{{ lookup('template', 'nginx-vhost.conf.j2') }}"
+
+- name: configure nginx vhost
+  vars:
+    nginx_vhost:
+      name: "etherpad-lite-{{ item.key }}"
+      template: generic
+      tls:
+        certificate_provider: "{{ acme_client }}"
+      hostnames: "{{ item.value.hostnames }}"
+      custom: "{{ etherpad_lite_nginx_vhost_custom }}"
+  include_role:
+    name: nginx/vhost
diff --git a/roles/apps/etherpad-lite/templates/nginx-vhost.conf.j2 b/roles/apps/etherpad-lite/templates/nginx-vhost.conf.j2
index c572a7eb..209a81c0 100644
--- a/roles/apps/etherpad-lite/templates/nginx-vhost.conf.j2
+++ b/roles/apps/etherpad-lite/templates/nginx-vhost.conf.j2
@@ -1,57 +1,33 @@
-server {
-    listen 80;
-    listen [::]:80;
-    server_name {{ item.value.hostnames | join(' ') }};
-
-    include snippets/{{ acme_client }}.conf;
-
-    location / {
-        return 301 https://$host$request_uri;
-    }
-}
-
-server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
-    server_name {{ item.value.hostnames | join(' ') }};
-
-    include snippets/{{ acme_client }}.conf;
-    include snippets/tls.conf;
-    ssl_certificate     {{ x509_certificate_path_fullchain }};
-    ssl_certificate_key {{ x509_certificate_path_key }};
-    include snippets/hsts.conf;
-
-    location / {
-        rewrite ^/$ / break;
-        rewrite ^/locales/(.*) /locales/$1 break;
-        rewrite ^/locales.json /locales.json break;
-        rewrite ^/admin(.*) /admin$1 break;
-        rewrite ^/p/(.*) /p/$1 break;
-        rewrite ^/static/(.*) /static/$1 break;
-        rewrite ^/pluginfw/(.*) /pluginfw/$1 break;
-        rewrite ^/javascripts/(.*) /javascripts/$1 break;
-        rewrite ^/socket.io/(.*) /socket.io/$1 break;
-        rewrite ^/ep/(.*) /ep/$1 break;
-        rewrite ^/minified/(.*) /minified/$1 break;
-        rewrite ^/api/(.*) /api/$1 break;
-        rewrite ^/ro/(.*) /ro/$1 break;
-        rewrite ^/error/(.*) /error/$1 break;
-        rewrite ^/jserror(.*) /jserror$1 break;
-        rewrite ^/redirect(.*) /redirect$1 break;
-        rewrite /favicon.ico /favicon.ico break;
-        rewrite /robots.txt /robots.txt break;
-        rewrite /(.*) /p/$1;
-
-        include snippets/proxy-nobuff.conf;
-
-        proxy_set_header Host $host;
-        include snippets/proxy-forward-headers.conf;
-        proxy_pass_header Server;
-
-        # for websockets
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection $connection_upgrade;
-
-        proxy_pass http://127.0.0.1:{{ item.value.port }};
-    }
+location / {
+    rewrite ^/$ / break;
+    rewrite ^/locales/(.*) /locales/$1 break;
+    rewrite ^/locales.json /locales.json break;
+    rewrite ^/admin(.*) /admin$1 break;
+    rewrite ^/p/(.*) /p/$1 break;
+    rewrite ^/static/(.*) /static/$1 break;
+    rewrite ^/pluginfw/(.*) /pluginfw/$1 break;
+    rewrite ^/javascripts/(.*) /javascripts/$1 break;
+    rewrite ^/socket.io/(.*) /socket.io/$1 break;
+    rewrite ^/ep/(.*) /ep/$1 break;
+    rewrite ^/minified/(.*) /minified/$1 break;
+    rewrite ^/api/(.*) /api/$1 break;
+    rewrite ^/ro/(.*) /ro/$1 break;
+    rewrite ^/error/(.*) /error/$1 break;
+    rewrite ^/jserror(.*) /jserror$1 break;
+    rewrite ^/redirect(.*) /redirect$1 break;
+    rewrite /favicon.ico /favicon.ico break;
+    rewrite /robots.txt /robots.txt break;
+    rewrite /(.*) /p/$1;
+
+    include snippets/proxy-nobuff.conf;
+
+    proxy_set_header Host $host;
+    include snippets/proxy-forward-headers.conf;
+    proxy_pass_header Server;
+
+    # for websockets
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $connection_upgrade;
+
+    proxy_pass http://127.0.0.1:{{ item.value.port }};
 }
-- 
cgit v1.2.3