rblundon
881e2e24a8
nginx-proxy (new role): - Shared nginx + certbot under /opt/nginx, replacing the copies that lived inside the Paperclip compose project - Apps publish via tasks_from: add_vhost (cert marker -> issue cert -> write vhost -> nginx -t -> reload); a vhost that fails nginx -t is rolled back - Certs issued one per domain via Cloudflare DNS challenge; domains registered as marker files in cert-domains/; optional LE staging - Stock nginx.conf plus conf.d (directory mounts, not single-file mounts); catch-all server drops unknown Host/SNI - Containers renamed to nginx and certbot hermes_docker (new role): - Official Hermes image, host networking, gateway and dashboard bound to loopback and published through nginx-proxy - Dashboard login via basic-auth provider, secrets from the vault - Main model set from hermes_model (fantasmic endpoint, key from vault); config.yaml overrides are merged from a 0600 staged file that is removed afterwards, so the key never appears in a command line - Data dir owner-only (HERMES_HOME_MODE=0700) paperclip-docker: - Remove nginx, certbot and docker-compose download tasks; deploy with community.docker.docker_compose_v2 (idempotent, remove_orphans) - Stop passing the Cloudflare token and certbot email to the Paperclip container via env_file - Bind Postgres to 127.0.0.1 (host networking exposed it on all interfaces); stop chowning pgdata, which the postgres image owns - Handler recreates the paperclip service so .env changes apply - Domain m-v.wdw-labs.cloud -> cranium-command.wdw-labs.cloud Playbooks: - Add day1_deploy_nginx_proxy.yml and day1_deploy_hermes_docker.yml - deploy_paperclip_stack.yml: run nginx-proxy before paperclip-docker, CLI-based container checks (no Docker SDK dependency) - Remove deploy-hermes.yml Host vars: add nginx_proxy_certbot_email and nginx_proxy_certbot_staging (staging stays on until the switch to real certs).
71 lines
1.9 KiB
YAML
71 lines
1.9 KiB
YAML
---
|
|
- name: Assert required variables
|
|
ansible.builtin.assert:
|
|
that:
|
|
- nginx_proxy_certbot_email | length > 0
|
|
- nginx_proxy_cloudflare_api_token | length > 0
|
|
fail_msg: >-
|
|
Set nginx_proxy_certbot_email, and make sure vault_cloudflare_api_token
|
|
(or nginx_proxy_cloudflare_api_token) is defined.
|
|
quiet: true
|
|
tags: [nginx-proxy, preflight]
|
|
|
|
- name: Create directories
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
mode: "0755"
|
|
loop:
|
|
- "{{ nginx_proxy_base_path }}"
|
|
- "{{ nginx_proxy_certs_dir }}"
|
|
- "{{ nginx_proxy_conf_dir }}"
|
|
- "{{ nginx_proxy_domains_dir }}"
|
|
- "{{ nginx_proxy_scripts_dir }}"
|
|
tags: [nginx-proxy]
|
|
|
|
- name: Install certbot script
|
|
ansible.builtin.copy:
|
|
src: certbot-init.sh
|
|
dest: "{{ nginx_proxy_scripts_dir }}/certbot-init.sh"
|
|
mode: "0755"
|
|
tags: [nginx-proxy]
|
|
|
|
- name: Template global nginx settings
|
|
ansible.builtin.template:
|
|
src: 00-global.conf.j2
|
|
dest: "{{ nginx_proxy_conf_dir }}/00-global.conf"
|
|
mode: "0644"
|
|
notify: Reload nginx
|
|
tags: [nginx-proxy]
|
|
|
|
- name: Template compose env file
|
|
ansible.builtin.template:
|
|
src: env.j2
|
|
dest: "{{ nginx_proxy_base_path }}/.env"
|
|
mode: "0600"
|
|
no_log: true
|
|
tags: [nginx-proxy]
|
|
|
|
- name: Template compose file
|
|
ansible.builtin.template:
|
|
src: docker-compose.yml.j2
|
|
dest: "{{ nginx_proxy_base_path }}/docker-compose.yml"
|
|
mode: "0644"
|
|
tags: [nginx-proxy]
|
|
|
|
- name: Deploy nginx and certbot
|
|
community.docker.docker_compose_v2:
|
|
project_src: "{{ nginx_proxy_base_path }}"
|
|
pull: "{{ nginx_proxy_pull_policy }}"
|
|
state: present
|
|
tags: [nginx-proxy]
|
|
|
|
- name: Verify nginx config is valid and the container is serving
|
|
ansible.builtin.command: "docker exec {{ nginx_proxy_nginx_container }} nginx -t"
|
|
register: nginx_proxy_test
|
|
until: nginx_proxy_test.rc == 0
|
|
retries: 6
|
|
delay: 5
|
|
changed_when: false
|
|
tags: [nginx-proxy, verify]
|