Create generic rule for simple nginx reverse proxy

.vscode/settings.json

@@ -2,5 +2,6 @@
     "ansible.python.interpreterPath": "/home/thomas/python_venv/bin/python",
     "files.associations": {
         "*.yml": "ansible"
-    }
+    },
+    "ansible.validation.lint.arguments": "-x name[template]"
 }

roles/actual/handlers/main.yml

@@ -1,9 +1,4 @@
 ---
-- name: Restart Nginx
-  become: true
-  ansible.builtin.systemd:
-    name: nginx.service
-    state: restarted
 - name: Restart ufw
   become: true
   ansible.builtin.systemd:

roles/actual/tasks/main.yml

@@ -47,25 +47,9 @@
         state: started
         enabled: true
         scope: user
-- name: Install certificate for actual.kleinendorst.info
+- name: Include simple-reverse-proxy role
-  become: true
+  ansible.builtin.include_role:
-  ansible.builtin.command:
+    name: simple-reverse-proxy
-    cmd: register_certbot_domain.sh actual.kleinendorst.info
+  vars:
-    creates: /etc/letsencrypt/live/actual.kleinendorst.info # The certificate directory
+    simple_reverse_proxy_internal_port: 5006
-- name: Set Nginx configuration
+    simple_reverse_proxy_internal_subdomain: actual
-  become: true
-  ansible.builtin.template:
-    src: actual.conf.j2
-    dest: /etc/nginx/conf.d/actual.conf
-    mode: '0644'
-  notify: Restart Nginx
-# - name: Allow https through firewall
-#   become: true
-#   community.general.ufw:
-#     rule: allow
-#     port: https
-#     proto: tcp
-#   notify: Restart ufw
-- name: Debug
-  ansible.builtin.debug:
-    msg: "Don't forget to manually add a DNS record for actual.kleinendorst.info pointing to: {{ ansible_facts['default_ipv4']['address'] }}."

roles/actual/templates/actual.conf.j2

@@ -1,25 +0,0 @@
-# Template comes from the actual documentation: https://actualbudget.org/docs/config/reverse-proxies/#nginx
-# It was however modified in some ways because the referenced files weren't created.
-server {
-  listen 443 ssl;
-  listen [::]:443 ssl;
-  server_name actual.kleinendorst.info;
-
-  client_max_body_size 20M; # The budgets can become quite large and need to be uploaded
-
-  # SSL via Let's Encrypt
-  ssl_certificate /etc/letsencrypt/live/actual.kleinendorst.info/fullchain.pem; # managed by Certbot
-  ssl_certificate_key /etc/letsencrypt/live/actual.kleinendorst.info/privkey.pem; # managed by Certbot
-  ssl_protocols       TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
-  ssl_ciphers         HIGH:!aNULL:!MD5;
-
-  location / {
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header Host $host;
-
-    set $upstream_address 127.0.0.1;
-    set $upstream_port 5006;
-    set $upstream_proto http;
-    proxy_pass $upstream_proto://$upstream_address:$upstream_port;
-  }
-}

roles/simple-reverse-proxy/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Restart Nginx
+  become: true
+  ansible.builtin.systemd:
+    name: nginx.service
+    state: restarted

roles/simple-reverse-proxy/tasks/main.yml

@@ -0,0 +1,25 @@
+---
+- name: "Install certificate for {{ simple_reverse_proxy_internal_subdomain }}.kleinendorst.info"
+  become: true
+  ansible.builtin.command:
+    cmd: "register_certbot_domain.sh {{ simple_reverse_proxy_internal_subdomain }}.kleinendorst.info"
+    creates: "/etc/letsencrypt/live/{{ simple_reverse_proxy_internal_subdomain }}.kleinendorst.info" # The certificate directory
+- name: Set Nginx configuration
+  become: true
+  ansible.builtin.template:
+    src: nginx-configuration.conf.j2
+    dest: "/etc/nginx/conf.d/{{ simple_reverse_proxy_internal_subdomain }}.conf"
+    mode: '0644'
+  notify: Restart Nginx
+# - name: Allow https through firewall
+#   become: true
+#   community.general.ufw:
+#     rule: allow
+#     port: https
+#     proto: tcp
+#   notify: Restart ufw
+- name: Debug
+  ansible.builtin.debug:
+    msg: >-
+      Don't forget to manually add a DNS record for {{ simple_reverse_proxy_internal_subdomain }}.kleinendorst.info
+      pointing to: {{ ansible_facts['default_ipv4']['address'] }}.

roles/simple-reverse-proxy/templates/nginx-configuration.conf.j2

@@ -0,0 +1,23 @@
+server {
+  listen 443 ssl;
+  listen [::]:443 ssl;
+  server_name {{ simple_reverse_proxy_internal_subdomain }}.kleinendorst.info;
+
+  client_max_body_size 20M;
+
+  # SSL via Let's Encrypt
+  ssl_certificate       /etc/letsencrypt/live/{{ simple_reverse_proxy_internal_subdomain }}.kleinendorst.info/fullchain.pem; # managed by Certbot
+  ssl_certificate_key   /etc/letsencrypt/live/{{ simple_reverse_proxy_internal_subdomain }}.kleinendorst.info/privkey.pem; # managed by Certbot
+  ssl_protocols         TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
+  ssl_ciphers           HIGH:!aNULL:!MD5;
+
+  location / {
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header Host $host;
+
+    set $upstream_address 127.0.0.1;
+    set $upstream_port {{ simple_reverse_proxy_internal_port }};
+    set $upstream_proto http;
+    proxy_pass $upstream_proto://$upstream_address:$upstream_port;
+  }
+}