Migrate Gitea to rootless Podman / SELinux

- Front git-over-SSH with host sshd and live key lookup
- Build and load custom SELinux policies oci_log and gitea_ssh

roles/proxy/handlers/main.yml

@@ -1,13 +1,3 @@
-- name: Enable nginx sites configuration
-  ansible.builtin.file:
-    src: "/etc/nginx/sites-available/{{ item.item.domain }}.conf"
-    dest: "/etc/nginx/sites-enabled/{{ item.item.domain }}.conf"
-    state: link
-    mode: "400"
-  loop: "{{ nginx_sites.results }}"
-  when: item.changed
-  listen: reload_nginx
-
 - name: Reload nginx
   ansible.builtin.service:
     name: nginx

roles/proxy/tasks/main.yml

@@ -43,7 +43,16 @@
   loop_control:
     label: "{{ item.domain }}"
   notify: reload_nginx
-  register: nginx_sites
+
+- name: Enable nginx sites configuration
+  ansible.builtin.file:
+    src: "/etc/nginx/sites-available/{{ item.domain }}.conf"
+    dest: "/etc/nginx/sites-enabled/{{ item.domain }}.conf"
+    state: "{{ item.enabled | default(true) | ternary('link', 'absent') }}"
+  loop: "{{ proxy.servers }}"
+  loop_control:
+    label: "{{ item.domain }}"
+  notify: reload_nginx
 
 - name: Generate self-signed certificate
   ansible.builtin.command: