eletrotupi / tcc/ ansible/roles/nginx/tasks/main.ymlc8bab449d13fa00dadc0138ef8f83f18104eb593
3.1 KB | 111 lines Raw
1
---
2
# roles/nginx/tasks/main.yml
3
# Publishes the vhost, two-phase around the ACME certificate
4
#
5
#   deploy.yml (this role) will HTTP-only block, then obtain cert via the wrapper then
6
#   HTTPS block. The certificate itself is managed by the `uacme` role; if the
7
#   account is not registered yet, this role leaves the HTTP block in place and
8
#   tells you the one manual command to run
9
10
- name: Install nginx
11
  community.general.apk:
12
    name: nginx
13
    state: present
14
    update_cache: true
15
  tags: [packages, nginx]
16
17
- name: Remove the default nginx server block
18
  ansible.builtin.file:
19
    path: "{{ nginx_conf_dir }}/default.conf"
20
    state: absent
21
  notify: reload nginx
22
  tags: [nginx]
23
24
- name: Ensure the ACME webroot exists
25
  ansible.builtin.file:
26
    path: "{{ nginx_well_known_root }}/.well-known"
27
    state: directory
28
    owner: root
29
    group: root
30
    mode: "0755"
31
  tags: [nginx]
32
33
- name: Ensure /srv/static exists for the thesis PDF
34
  ansible.builtin.file:
35
    path: "{{ nginx_static_root }}"
36
    state: directory
37
    owner: "{{ deploy_user }}"
38
    group: nginx
39
    mode: "0750"
40
  tags: [nginx]
41
42
- name: Ensure nginx is enabled and running
43
  ansible.builtin.service:
44
    name: nginx
45
    enabled: true
46
    state: started
47
  tags: [nginx]
48
49
- name: Install the logs UI htpasswd file
50
  ansible.builtin.copy:
51
    dest: "{{ nginx_logs_htpasswd_file }}"
52
    content: "{{ nginx_logs_htpasswd }}\n"
53
    owner: root
54
    group: root
55
    mode: "0640"
56
  notify: reload nginx
57
  tags: [nginx]
58
59
- name: Check whether the certificate exists
60
  ansible.builtin.stat:
61
    path: "{{ nginx_cert_dir }}/{{ vhosts[0] }}/cert.pem"
62
  register: nginx_cert
63
  tags: [nginx]
64
65
- name: Deploy the HTTP-only server block
66
  ansible.builtin.template:
67
    src: site.http.j2
68
    dest: "{{ nginx_conf_dir }}/{{ vhosts[0] }}.conf"
69
    mode: "0644"
70
  notify: reload nginx
71
  when: not nginx_cert.stat.exists
72
  tags: [nginx]
73
74
- name: Flush handlers so the HTTP block is live before requesting a certificate
75
  ansible.builtin.meta: flush_handlers
76
  tags: [nginx]
77
78
- name: Obtain the certificate via the acme wrapper
79
  ansible.builtin.command:
80
    cmd: "{{ nginx_acme_wrapper }} {{ vhosts[0] }}"
81
    creates: "{{ nginx_cert_dir }}/{{ vhosts[0] }}/cert.pem"
82
  when: not nginx_cert.stat.exists
83
  register: nginx_acme
84
  changed_when: nginx_acme.rc == 0
85
  failed_when: false
86
  tags: [nginx]
87
88
- name: Re-check whether the certificate now exists
89
  ansible.builtin.stat:
90
    path: "{{ nginx_cert_dir }}/{{ vhosts[0] }}/cert.pem"
91
  register: nginx_cert_after
92
  tags: [nginx]
93
94
- name: Deploy the HTTPS server block
95
  ansible.builtin.template:
96
    src: site.https.j2
97
    dest: "{{ nginx_conf_dir }}/{{ vhosts[0] }}.conf"
98
    mode: "0644"
99
  notify: reload nginx
100
  when: nginx_cert_after.stat.exists
101
  tags: [nginx]
102
103
- name: Explain the manual step when no certificate is available yet
104
  ansible.builtin.debug:
105
    msg: |-
106
      No TLS certificate for {{ vhosts[0] }} yet. If uacme is not registered,
107
      run this once by hand and then re-run deploy.yml:
108
109
        doas -u acme uacme -v -h /usr/share/uacme/uacme.sh new {{ vhosts[0] }}
110
  when: not nginx_cert_after.stat.exists
111
  tags: [nginx]