rblundon
881e2e24a8
nginx-proxy (new role): - Shared nginx + certbot under /opt/nginx, replacing the copies that lived inside the Paperclip compose project - Apps publish via tasks_from: add_vhost (cert marker -> issue cert -> write vhost -> nginx -t -> reload); a vhost that fails nginx -t is rolled back - Certs issued one per domain via Cloudflare DNS challenge; domains registered as marker files in cert-domains/; optional LE staging - Stock nginx.conf plus conf.d (directory mounts, not single-file mounts); catch-all server drops unknown Host/SNI - Containers renamed to nginx and certbot hermes_docker (new role): - Official Hermes image, host networking, gateway and dashboard bound to loopback and published through nginx-proxy - Dashboard login via basic-auth provider, secrets from the vault - Main model set from hermes_model (fantasmic endpoint, key from vault); config.yaml overrides are merged from a 0600 staged file that is removed afterwards, so the key never appears in a command line - Data dir owner-only (HERMES_HOME_MODE=0700) paperclip-docker: - Remove nginx, certbot and docker-compose download tasks; deploy with community.docker.docker_compose_v2 (idempotent, remove_orphans) - Stop passing the Cloudflare token and certbot email to the Paperclip container via env_file - Bind Postgres to 127.0.0.1 (host networking exposed it on all interfaces); stop chowning pgdata, which the postgres image owns - Handler recreates the paperclip service so .env changes apply - Domain m-v.wdw-labs.cloud -> cranium-command.wdw-labs.cloud Playbooks: - Add day1_deploy_nginx_proxy.yml and day1_deploy_hermes_docker.yml - deploy_paperclip_stack.yml: run nginx-proxy before paperclip-docker, CLI-based container checks (no Docker SDK dependency) - Remove deploy-hermes.yml Host vars: add nginx_proxy_certbot_email and nginx_proxy_certbot_staging (staging stays on until the switch to real certs).
29 lines
1.2 KiB
Markdown
29 lines
1.2 KiB
Markdown
# nginx-proxy
|
|
|
|
Shared nginx + certbot (Cloudflare DNS challenge) under /opt/nginx. Apps publish
|
|
themselves with `tasks_from: add_vhost`; see the header of tasks/add_vhost.yml.
|
|
|
|
Layout on the host:
|
|
|
|
/opt/nginx/
|
|
docker-compose.yml .env (0600)
|
|
conf.d/ 00-global.conf + one <app>.conf per vhost -> /etc/nginx/conf.d
|
|
certs/ certbot state (live/, archive/, renewal/) -> /etc/letsencrypt, /etc/nginx/certs
|
|
cert-domains/ one empty file per domain (filename = domain)
|
|
scripts/ certbot-init.sh
|
|
|
|
Required variables: `nginx_proxy_certbot_email`, and `vault_cloudflare_api_token`
|
|
(or `nginx_proxy_cloudflare_api_token`).
|
|
|
|
Prerequisite (manual): a DNS record for each app domain pointing at this host.
|
|
|
|
Staging: set `nginx_proxy_certbot_staging: true` to test the DNS challenge without
|
|
using Let's Encrypt rate limits. Staging certs are skipped-as-existing afterwards, so
|
|
to move a domain to a real cert: `docker exec certbot certbot delete --cert-name <domain>`
|
|
and re-run its play.
|
|
|
|
Retire a domain: delete its cert-domains/ marker and conf.d/<app>.conf, reload nginx,
|
|
then `docker exec certbot certbot delete --cert-name <domain>`.
|
|
|
|
Pin nginx older than 1.25.1? Set `nginx_proxy_http2: false` (the template uses `http2 on;`).
|