eletrotupi / tcc/ ansible/roles/nginx/tasks/main.ymlc941890054e469bdf624c967e653c5c48b4fb80f
3.3 KB | 118 lines Raw
1
---
2
# roles/nginx/tasks/main.yml
3
# Publishes the vhost, two-phase around the ACME certificate
4
#
5
#   deploy.yml (this role) will HTTP-only block, then obtain cert via the wrapper then
6
#   HTTPS block. The certificate itself is managed by the `uacme` role; if the
7
#   account is not registered yet, this role leaves the HTTP block in place and
8
#   tells you the one manual command to run
9
10
- name: Install nginx
11
  community.general.apk:
12
    name: nginx
13
    state: present
14
    update_cache: true
15
  tags: [packages, nginx]
16
17
- name: Remove the default nginx server block
18
  ansible.builtin.file:
19
    path: "{{ nginx_conf_dir }}/default.conf"
20
    state: absent
21
  notify: reload nginx
22
  tags: [nginx]
23
24
- name: Ensure the ACME webroot exists
25
  ansible.builtin.file:
26
    path: "{{ nginx_well_known_root }}/.well-known"
27
    state: directory
28
    owner: root
29
    group: root
30
    mode: "0755"
31
  tags: [nginx]
32
33
- name: Ensure /srv/static exists for the thesis PDF
34
  ansible.builtin.file:
35
    path: "{{ nginx_static_root }}"
36
    state: directory
37
    owner: "{{ deploy_user }}"
38
    group: nginx
39
    mode: "0750"
40
  tags: [nginx]
41
42
- name: Ensure nginx is enabled and running
43
  ansible.builtin.service:
44
    name: nginx
45
    enabled: true
46
    state: started
47
  tags: [nginx]
48
49
- name: Install the logs UI htpasswd file
50
  ansible.builtin.copy:
51
    dest: "{{ nginx_logs_htpasswd_file }}"
52
    content: "{{ nginx_logs_htpasswd }}\n"
53
    owner: root
54
    # nginx workers run unprivileged and must be able to read this
55
    group: nginx
56
    mode: "0640"
57
  notify: reload nginx
58
  tags: [nginx]
59
60
- name: Check whether the certificate exists
61
  ansible.builtin.stat:
62
    path: "{{ nginx_cert_dir }}/{{ vhosts[0] }}/cert.pem"
63
  register: nginx_cert
64
  tags: [nginx]
65
66
- name: Deploy the HTTP-only server block
67
  ansible.builtin.template:
68
    src: site.http.j2
69
    dest: "{{ nginx_conf_dir }}/{{ vhosts[0] }}.conf"
70
    mode: "0644"
71
  notify: reload nginx
72
  when: not nginx_cert.stat.exists
73
  tags: [nginx]
74
75
- name: Flush handlers so the HTTP block is live before requesting a certificate
76
  ansible.builtin.meta: flush_handlers
77
  tags: [nginx]
78
79
- name: Obtain the certificate via the acme wrapper
80
  ansible.builtin.command:
81
    cmd: "{{ nginx_acme_wrapper }} {{ vhosts[0] }}"
82
    creates: "{{ nginx_cert_dir }}/{{ vhosts[0] }}/cert.pem"
83
  when: not nginx_cert.stat.exists
84
  register: nginx_acme
85
  changed_when: nginx_acme.rc == 0
86
  failed_when: false
87
  tags: [nginx]
88
89
- name: Re-check whether the certificate now exists
90
  ansible.builtin.stat:
91
    path: "{{ nginx_cert_dir }}/{{ vhosts[0] }}/cert.pem"
92
  register: nginx_cert_after
93
  tags: [nginx]
94
95
- name: Deploy the HTTPS server block
96
  ansible.builtin.template:
97
    src: site.https.j2
98
    dest: "{{ nginx_conf_dir }}/{{ vhosts[0] }}.conf"
99
    mode: "0644"
100
  notify: reload nginx
101
  when: nginx_cert_after.stat.exists
102
  tags: [nginx]
103
104
- name: Validate the nginx configuration
105
  ansible.builtin.command:
106
    cmd: nginx -t
107
  changed_when: false
108
  tags: [nginx]
109
110
- name: Explain the manual step when no certificate is available yet
111
  ansible.builtin.debug:
112
    msg: |-
113
      No TLS certificate for {{ vhosts[0] }} yet. If uacme is not registered,
114
      run this once by hand and then re-run deploy.yml:
115
116
        doas -u acme uacme -v -h /usr/share/uacme/uacme.sh new {{ vhosts[0] }}
117
  when: not nginx_cert_after.stat.exists
118
  tags: [nginx]