homelab/roles/proxy/tasks/main.yml

108 lines
3.2 KiB
YAML
Raw Normal View History

2022-05-22 04:19:56 +00:00
- name: Install nginx
2023-05-04 03:42:55 +00:00
ansible.builtin.apt:
2022-05-22 04:19:56 +00:00
name: nginx
state: present
update_cache: true
- name: Start nginx and enable on boot
2023-05-04 03:42:55 +00:00
ansible.builtin.service:
name: nginx
state: started
enabled: true
- name: Check for cached dhparams.pem file
ansible.builtin.stat:
path: "{{ cached_dhparams_pem }}"
register: dhparams_file
- name: Copy cached dhparams.pem to /etc/ssl/
ansible.builtin.copy:
src: "{{ cached_dhparams_pem }}"
dest: /etc/ssl/dhparams.pem
mode: "600"
remote_src: true
when: dhparams_file.stat.exists
2022-08-27 22:56:12 +00:00
- name: Generate DH Parameters
2023-05-04 03:42:55 +00:00
community.crypto.openssl_dhparam:
2022-08-27 22:56:12 +00:00
path: /etc/ssl/dhparams.pem
size: 4096
2022-05-22 04:19:56 +00:00
- name: Install nginx base configuration
2023-05-04 03:42:55 +00:00
ansible.builtin.template:
2022-05-22 04:19:56 +00:00
src: nginx.conf.j2
dest: /etc/nginx/nginx.conf
mode: "644"
2022-05-22 04:19:56 +00:00
notify: reload_nginx
- name: Install nginx sites configuration
2023-05-04 03:42:55 +00:00
ansible.builtin.template:
2022-05-22 04:19:56 +00:00
src: server-nginx.conf.j2
dest: "/etc/nginx/sites-available/{{ item.domain }}.conf"
mode: "400"
loop: "{{ proxy.servers }}"
2022-05-22 04:19:56 +00:00
notify: reload_nginx
register: nginx_sites
2022-05-22 04:19:56 +00:00
- name: Generate self-signed certificate
2023-05-04 05:44:18 +00:00
ansible.builtin.command: 'openssl req -newkey rsa:4096 -x509 -sha256 -days 3650 -nodes \
2022-05-22 04:19:56 +00:00
-subj "/C=US/ST=Local/L=Local/O=Org/OU=IT/CN=example.com" \
-keyout /etc/ssl/private/nginx-selfsigned.key \
-out /etc/ssl/certs/nginx-selfsigned.crt'
args:
creates: /etc/ssl/certs/nginx-selfsigned.crt
when: proxy.production is not defined or not proxy.production
2022-05-22 04:19:56 +00:00
notify: reload_nginx
- name: Install LE's certbot
2023-05-04 03:42:55 +00:00
ansible.builtin.apt:
name: ['certbot', 'python3-certbot-dns-cloudflare']
state: present
when: proxy.production is defined and proxy.production
- name: Install Cloudflare API token
2023-05-04 03:42:55 +00:00
ansible.builtin.template:
src: cloudflare.ini.j2
dest: /root/.cloudflare.ini
mode: "400"
when: proxy.production is defined and proxy.production and proxy.dns_cloudflare is defined
- name: Create nginx post renewal hook directory
2023-05-04 03:42:55 +00:00
ansible.builtin.file:
path: /etc/letsencrypt/renewal-hooks/post
state: directory
mode: "500"
when: proxy.production is defined and proxy.production
- name: Install nginx post renewal hook
2023-05-04 03:42:55 +00:00
ansible.builtin.copy:
src: reload-nginx.sh
dest: /etc/letsencrypt/renewal-hooks/post/reload-nginx.sh
mode: '0755'
when: proxy.production is defined and proxy.production
- name: Run Cloudflare DNS-01 challenges on wildcard domains
2023-05-04 03:42:55 +00:00
ansible.builtin.shell: '/usr/bin/certbot certonly \
--non-interactive \
--agree-tos \
--email "{{ proxy.dns_cloudflare.email }}" \
--dns-cloudflare \
--dns-cloudflare-credentials /root/.cloudflare.ini \
-d "*.{{ item }}" \
-d "{{ item }}" \
{{ proxy.dns_cloudflare.opts | default("") }}'
args:
creates: "/etc/letsencrypt/live/{{ item }}/fullchain.pem"
loop: "{{ proxy.dns_cloudflare.wildcard_domains }}"
when: proxy.production is defined and proxy.production and proxy.dns_cloudflare is defined
notify: reload_nginx
2022-05-27 20:29:27 +00:00
- name: Add HTTP and HTTPS firewall rule
2023-05-04 03:42:55 +00:00
community.general.ufw:
2022-05-27 20:29:27 +00:00
rule: allow
port: "{{ item }}"
proto: tcp
loop:
- "80"
- "443"