chaos-at-home/ch-http-proxy.yml


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81

---
- name: Basic Setup
  hosts: ch-http-proxy
  roles:
  - role: apt-repo/base
  - role: core/base
  - role: core/sshd
  - role: core/zsh
  - role: apt-repo/spreadspace
  - role: acmetool/base
  - role: nginx/base
  - role: nginx/vhost
    nginx_vhost:
      name: webmail
      template: generic-proxy-no-buffering-with-acme
      acme: yes
      hostnames:
      - webmail.chaos-at-home.org
      client_max_body_size: "200M"
      proxy_pass: "https://{{ network_zones.lan.prefix | ipaddr(network_zones.lan.offsets['ch-prometheus-old']) | ipaddr('address') }}/"
    acmetool_cert_config:
      request:
        challenge:
          http-self-test: false
  - role: nginx/vhost
    nginx_vhost:
      name: webdav
      template: generic-proxy-no-buffering-with-acme
      acme: yes
      hostnames:
      - webdav.chaos-at-home.org
      proxy_pass: "https://{{ network_zones.lan.prefix | ipaddr(network_zones.lan.offsets['ch-prometheus-old']) | ipaddr('address') }}/"
    acmetool_cert_config:
      request:
        challenge:
          http-self-test: false
  - role: nginx/vhost
    nginx_vhost:
      name: imap
      acme: no
      content: |
        server {
          listen 80;
          listen [::]:80;

          server_name imap.chaos-at-home.org;

          location /.well-known/acme-challenge/ {
            proxy_pass http://{{ network_services.imap.addr }};
          }

          location / {
            return 303 https://webmail.chaos-at-home.org;
          }
        }

  # post_tasks:
  # - name: install systemd service unit for service-ip
  #   copy:
  #     dest: /etc/systemd/system/http-service-ip.service
  #     content: |
  #       [Unit]
  #       Description=Assign HTTP Sevice IP
  #       After=network.target

  #       [Service]
  #       Type=oneshot
  #       ExecStart=/usr/sbin/ip addr add dev {{ network.primary.name }} {{ network_services.http.addr }}/32
  #       ExecStop=/usr/sbin/ip addr del dev {{ network.primary.name }} {{ network_services.http.addr }}/32
  #       RemainAfterExit=yes

  #       [Install]
  #       WantedBy=multi-user.target
  #   register: service_ip_systemd_unit

  # - name: make sure service-ip systemd unit is enabeld and started
  #   systemd:
  #     daemon_reload: yes
  #     name: http-service-ip.service
  #     state: "{{ (service_ip_systemd_unit is changed) | ternary('restarted', 'started') }}"
  #     enabled: yes