From d5c1dfe04c37b4669bf70ffb60a8516f8a95251c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=A1clav=20Uruba?= Date: Sun, 10 Sep 2023 22:58:50 +0200 Subject: [PATCH] add certbot, nginx-host tasks --- urubamba/playbook-setup.yml | 2 + urubamba/playbook-update.yml | 1 + urubamba/roles/certbot/meta/main.yml | 3 + urubamba/roles/certbot/tasks/main.yml | 12 +++ urubamba/roles/nginx-host/handlers/main.yml | 5 + urubamba/roles/nginx-host/tasks/main.yml | 28 ++++++ .../nginx-host/templates/virtual-host.j2 | 93 +++++++++++++++++++ urubamba/roles/nginx/handlers/main.yml | 5 + urubamba/roles/nginx/tasks/main.yml | 4 + urubamba/roles/snap/tasks/main.yml | 5 + 10 files changed, 158 insertions(+) create mode 100644 urubamba/roles/certbot/meta/main.yml create mode 100644 urubamba/roles/certbot/tasks/main.yml create mode 100644 urubamba/roles/nginx-host/handlers/main.yml create mode 100644 urubamba/roles/nginx-host/tasks/main.yml create mode 100644 urubamba/roles/nginx-host/templates/virtual-host.j2 create mode 100644 urubamba/roles/nginx/handlers/main.yml create mode 100644 urubamba/roles/snap/tasks/main.yml diff --git a/urubamba/playbook-setup.yml b/urubamba/playbook-setup.yml index ef7b2c5..f0e6dd4 100644 --- a/urubamba/playbook-setup.yml +++ b/urubamba/playbook-setup.yml @@ -1,3 +1,4 @@ +--- - name: Server setup hosts: all roles: @@ -10,3 +11,4 @@ - tmux - fail2ban - nginx + - certbot diff --git a/urubamba/playbook-update.yml b/urubamba/playbook-update.yml index 6cd44cc..245a339 100644 --- a/urubamba/playbook-update.yml +++ b/urubamba/playbook-update.yml @@ -1,3 +1,4 @@ +--- - name: Server update hosts: all tasks: diff --git a/urubamba/roles/certbot/meta/main.yml b/urubamba/roles/certbot/meta/main.yml new file mode 100644 index 0000000..8ff31b2 --- /dev/null +++ b/urubamba/roles/certbot/meta/main.yml @@ -0,0 +1,3 @@ +--- +dependencies: + - role: snap diff --git a/urubamba/roles/certbot/tasks/main.yml b/urubamba/roles/certbot/tasks/main.yml new file mode 100644 index 0000000..e120148 --- /dev/null +++ b/urubamba/roles/certbot/tasks/main.yml @@ -0,0 +1,12 @@ +--- +- name: Install certbot + community.general.snap: + name: certbot + classic: true +- name: Symlink the executable + ansible.builtin.file: + src: /snap/bin/certbot + dest: /usr/bin/certbot + owner: root + group: root + state: link diff --git a/urubamba/roles/nginx-host/handlers/main.yml b/urubamba/roles/nginx-host/handlers/main.yml new file mode 100644 index 0000000..0f31453 --- /dev/null +++ b/urubamba/roles/nginx-host/handlers/main.yml @@ -0,0 +1,5 @@ +--- +- name: Reload nginx + ansible.builtin.service: + name: nginx + state: reloaded diff --git a/urubamba/roles/nginx-host/tasks/main.yml b/urubamba/roles/nginx-host/tasks/main.yml new file mode 100644 index 0000000..e11ccad --- /dev/null +++ b/urubamba/roles/nginx-host/tasks/main.yml @@ -0,0 +1,28 @@ +--- +- name: Ensure virtual host variables are defined + ansible.builtin.assert: + that: + - server_name is defined + - server_root is defined +- name: Configure virtual host + ansible.builtin.template: + src: virtual-host.j2 + dest: /etc/nginx/sites-available/{{ server_name }} + owner: root + group: root +- name: Symlink the virtual host + ansible.builtin.file: + src: /etc/nginx/sites-available/{{ server_name }} + dest: /etc/nginx/sites-enabled/{{ server_name }} + owner: root + group: root + state: link +- name: Create the document root + ansible.builtin.file: + path: '{{ server_root }}' + state: directory + mode: '0755' + owner: www-data + group: www-data +#- name: Enable HTTPS + diff --git a/urubamba/roles/nginx-host/templates/virtual-host.j2 b/urubamba/roles/nginx-host/templates/virtual-host.j2 new file mode 100644 index 0000000..8490055 --- /dev/null +++ b/urubamba/roles/nginx-host/templates/virtual-host.j2 @@ -0,0 +1,93 @@ +# {{ ansible_managed }} + +## +# You should look at the following URL's in order to grasp a solid understanding +# of Nginx configuration files in order to fully unleash the power of Nginx. +# https://www.nginx.com/resources/wiki/start/ +# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/ +# https://wiki.debian.org/Nginx/DirectoryStructure +# +# In most cases, administrators will remove this file from sites-enabled/ and +# leave it as reference inside of sites-available where it will continue to be +# updated by the nginx packaging team. +# +# This file will automatically load configuration files provided by other +# applications, such as Drupal or Wordpress. These applications will be made +# available underneath a path with that package name, such as /drupal8. +# +# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples. +## + +# Default server configuration +# +server { + listen 80 default_server; + listen [::]:80 default_server; + + # SSL configuration + # + # listen 443 ssl default_server; + # listen [::]:443 ssl default_server; + # + # Note: You should disable gzip for SSL traffic. + # See: https://bugs.debian.org/773332 + # + # Read up on ssl_ciphers to ensure a secure configuration. + # See: https://bugs.debian.org/765782 + # + # Self signed certs generated by the ssl-cert package + # Don't use them in a production server! + # + # include snippets/snakeoil.conf; + + root {{ server_root }}; + + # Add index.php to the list if you are using PHP + index index.html index.htm index.nginx-debian.html; + + server_name {{ server_name }}; + + location / { + # First attempt to serve request as file, then + # as directory, then fall back to displaying a 404. + try_files $uri $uri/ =404; + } + + # pass PHP scripts to FastCGI server + # + #location ~ \.php$ { + # include snippets/fastcgi-php.conf; + # + # # With php-fpm (or other unix sockets): + # fastcgi_pass unix:/run/php/php7.4-fpm.sock; + # # With php-cgi (or other tcp sockets): + # fastcgi_pass 127.0.0.1:9000; + #} + + # deny access to .htaccess files, if Apache's document root + # concurs with nginx's one + # + #location ~ /\.ht { + # deny all; + #} +} + + +# Virtual Host configuration for example.com +# +# You can move that to a different file under sites-available/ and symlink that +# to sites-enabled/ to enable it. +# +#server { +# listen 80; +# listen [::]:80; +# +# server_name example.com; +# +# root /var/www/example.com; +# index index.html; +# +# location / { +# try_files $uri $uri/ =404; +# } +#} diff --git a/urubamba/roles/nginx/handlers/main.yml b/urubamba/roles/nginx/handlers/main.yml new file mode 100644 index 0000000..0f31453 --- /dev/null +++ b/urubamba/roles/nginx/handlers/main.yml @@ -0,0 +1,5 @@ +--- +- name: Reload nginx + ansible.builtin.service: + name: nginx + state: reloaded diff --git a/urubamba/roles/nginx/tasks/main.yml b/urubamba/roles/nginx/tasks/main.yml index 431f089..814615b 100644 --- a/urubamba/roles/nginx/tasks/main.yml +++ b/urubamba/roles/nginx/tasks/main.yml @@ -7,3 +7,7 @@ community.general.ufw: rule: allow name: Nginx Full +- name: Start nginx + ansible.builtin.service: + name: nginx + state: started diff --git a/urubamba/roles/snap/tasks/main.yml b/urubamba/roles/snap/tasks/main.yml new file mode 100644 index 0000000..f94568a --- /dev/null +++ b/urubamba/roles/snap/tasks/main.yml @@ -0,0 +1,5 @@ +--- +- name: Install snap + ansible.builtin.package: + name: snapd + state: present