Rename reverse-proxy (role) > nginx

roles/nginx/reverse-proxy/handlers/main.yml

@@ -0,0 +1,10 @@
+---
+- name: Confirm Certbot plugin containment level
+  become: true
+  ansible.builtin.command:
+    cmd: snap set certbot trust-plugin-with-root=ok
+- name: Restart Nginx
+  become: true
+  ansible.builtin.systemd:
+    name: nginx.service
+    state: restarted

roles/nginx/reverse-proxy/tasks/main.yml

@@ -0,0 +1,77 @@
+---
+- name: Add an apt key by id from a keyserver
+  become: true
+  ansible.builtin.apt_key:
+    url: https://nginx.org/packages/keys/nginx_signing.key
+    state: present
+- name: Add Nginx repository into sources list
+  become: true
+  ansible.builtin.apt_repository:
+    repo: deb https://nginx.org/packages/debian/ {{ ansible_facts['lsb']['codename'] }} nginx
+    state: present
+- name: Add Nginx source repository into sources list
+  become: true
+  ansible.builtin.apt_repository:
+    repo: deb-src https://nginx.org/packages/debian/ {{ ansible_facts['lsb']['codename'] }} nginx
+    state: present
+- name: Install Nginx
+  become: true
+  ansible.builtin.apt:
+    name: nginx # Creates the "nginx" user as well
+    state: present
+- name: Remove default configuration
+  become: true
+  ansible.builtin.file:
+    path: /etc/nginx/conf.d/default.conf
+    state: absent
+  notify: Restart Nginx
+# ---------- CERTBOT INSTALLATION ---------- #
+# See the installation instructions here: https://certbot.eff.org/instructions?ws=nginx&os=debianbuster&tab=wildcard
+- name: Install Certbot
+  become: true
+  community.general.snap:
+    name: certbot
+    classic: true
+    state: present
+  notify: Confirm Certbot plugin containment level
+- name: Flush handlers # Makes sure that the handler runs
+  ansible.builtin.meta: flush_handlers
+- name: Install Certbot DNS Cloudflare plugin
+  become: true
+  community.general.snap:
+    name: certbot-dns-cloudflare
+    classic: true
+    state: present
+- name: Set cloudflare variable
+  ansible.builtin.set_fact:
+    cloudflare_credential_dir_path: "/root/.secrets/certbot"
+    cloudflare_credential_filename: cloudflare.ini
+- name: Create Certbot credential directory
+  become: true
+  ansible.builtin.file:
+    path: "{{ cloudflare_credential_dir_path }}"
+    state: directory
+    mode: '0700'
+- name: Place cloudflare credential in certbot user's file
+  become: true
+  ansible.builtin.template:
+    src: cloudflare.ini.j2
+    dest: "{{ cloudflare_credential_dir_path }}/{{ cloudflare_credential_filename }}"
+    mode: '0400'
+- name: Install the certificate script
+  become: true
+  ansible.builtin.template:
+    src: register_certbot_domain.sh.j2
+    dest: /usr/local/bin/register_certbot_domain.sh
+    mode: '0500'
+- name: Create the root certificate for my domain
+  become: true
+  ansible.builtin.command:
+    cmd: register_certbot_domain.sh kleinendorst.info
+    creates: /etc/letsencrypt/live/kleinendorst.info # The certificate directory
+# END ------ CERTBOT INSTALLATION ------ END #
+- name: Start Nginx
+  become: true
+  ansible.builtin.systemd:
+    name: nginx.service
+    state: started

roles/nginx/reverse-proxy/templates/cloudflare.ini.j2

@@ -0,0 +1,2 @@
+# Cloudflare API token used by Certbot
+dns_cloudflare_api_token = {{ dns_cloudflare_api_token }}

roles/nginx/reverse-proxy/templates/register_certbot_domain.sh.j2

@@ -0,0 +1,7 @@
+#!/bin/bash
+/snap/bin/certbot certonly \
+        --dns-cloudflare \
+        --dns-cloudflare-propagation-seconds 120 \
+        --dns-cloudflare-credentials '{{ cloudflare_credential_dir_path }}/{{ cloudflare_credential_filename }}' \
+        --agree-tos -m {{ administration_email }} \
+        -d $1

roles/nginx/reverse-proxy/vars/main/defaults.yml

@@ -0,0 +1,3 @@
+---
+nginx_user: nginx # Created automatically by the apt installation
+certbot_user: certbot

roles/nginx/reverse-proxy/vars/main/vault.yml

@@ -0,0 +1,9 @@
+$ANSIBLE_VAULT;1.1;AES256
+35613135623165306639373939396435656431326134336466636666393637333532623036303831
+6534646334633731313838323138303261663536376330640a376538653563353365336634346338
+34663031643265623838396239383164303865346332366361313839386533363530336361373930
+6438313861353563630a343738383365656531313137613361323636653635393232343738633433
+63356634323264623134313565386362663131313963373433306636383661373930323262353663
+64393433393639346166666433396363313465373032343239633939343830303465633564353130
+37333437643064346233633863346632393266633435396433396563653737386233346231303061
+37623138386233303764