mirror of
				https://github.com/kevinveenbirkenbach/computer-playbook.git
				synced 2025-10-31 02:10:05 +00:00 
			
		
		
		
	Shortened webserver to srv-web-
This commit is contained in:
		| @@ -91,9 +91,9 @@ Now that you have defined the application settings, domain, and application ID, | ||||
|       command: pkgmgr path cymais-my_service | ||||
|       register: path_cymais_my_service_output | ||||
|  | ||||
|     - name: "include role webserver-proxy-domain for {{ application_id }}" | ||||
|     - name: "include role srv-web-proxy-domain for {{ application_id }}" | ||||
|       include_role: | ||||
|         name: webserver-proxy-domain | ||||
|         name: srv-web-proxy-domain | ||||
|       vars: | ||||
|         domain: "{{ domains | get_domain(application_id) }}" | ||||
|         http_port: "{{ ports.localhost.http[application_id] }}" | ||||
|   | ||||
| @@ -24,19 +24,19 @@ For a complete list of role categories and detailed definitions, see: | ||||
|  | ||||
| ## Webserver & HTTP | ||||
|  | ||||
| - **webserver-core**   | ||||
| - **srv-web-core**   | ||||
|   Installs and configures the base Nginx server. | ||||
|  | ||||
| - **webserver-tls-***   | ||||
| - **srv-web-tls-***   | ||||
|   Manages TLS certificates and renewal (formerly “https”). | ||||
|  | ||||
| - **webserver-proxy-***   | ||||
| - **srv-web-proxy-***   | ||||
|   Proxy and vhost orchestration roles (domain setup, OAuth2 proxy, etc.) | ||||
|  | ||||
| - **webserver-injector-***   | ||||
| - **srv-web-injector-***   | ||||
|   HTML response modifiers: CSS, JS, Matomo tracking, iframe notifier. | ||||
|  | ||||
| - **webserver-composer**   | ||||
| - **srv-web-composer**   | ||||
|   Aggregates multiple sub-filters into one include for your vhost. | ||||
|  | ||||
| - **web-service-***   | ||||
| @@ -111,7 +111,7 @@ For a complete list of role categories and detailed definitions, see: | ||||
| --- | ||||
|  | ||||
| > **Tip:** To find a role quickly, search for its prefix:   | ||||
| > `core-`, `gen-`, `desk-`, `webserver-`, `web-service-`, `web-app-`,   | ||||
| > `core-`, `gen-`, `desk-`, `srv-web-`, `web-service-`, `web-app-`,   | ||||
| > `network-`, `service-`, `monitor-`, `alert-`, `maint-`, `cln-`,   | ||||
| > `bkp-`, `update-`, `pkgmgr-`, `user-`. | ||||
|  | ||||
|   | ||||
| @@ -21,4 +21,4 @@ galaxy_info: | ||||
|   issue_tracker_url: "https://s.veen.world/cymaisissues" | ||||
|   documentation: "https://s.veen.world/cymais" | ||||
| dependencies: | ||||
|   - webserver-core | ||||
|   - srv-web-core | ||||
| @@ -20,7 +20,7 @@ To offer a centralized, extensible system for managing containerized application | ||||
| - **Reset Logic:** Cleans previous Compose project files and data when `mode_reset` is enabled. | ||||
| - **Handlers for Runtime Control:** Automatically builds, sets up, or restarts containers based on handlers. | ||||
| - **Template-ready Service Files:** Predefined service base and health check templates. | ||||
| - **Integration Support:** Compatible with `webserver-proxy-core` and other CyMaIS service roles. | ||||
| - **Integration Support:** Compatible with `srv-web-proxy-core` and other CyMaIS service roles. | ||||
|  | ||||
| ## Administration Tips | ||||
|  | ||||
|   | ||||
| @@ -25,5 +25,5 @@ galaxy_info: | ||||
|   issue_tracker_url: https://s.veen.world/cymaisissues | ||||
|   documentation: https://s.veen.world/cymais | ||||
| dependencies: | ||||
|   - webserver-proxy-core | ||||
|   - srv-web-proxy-core | ||||
|   - docker-container # Necessary for template use | ||||
| @@ -23,4 +23,4 @@ galaxy_info: | ||||
|   issue_tracker_url: "https://s.veen.world/cymaisissues" | ||||
|   documentation: "https://s.veen.world/cymais" | ||||
| dependencies: | ||||
|   - webserver-tls-renew | ||||
|   - srv-web-tls-renew | ||||
|   | ||||
| @@ -1,10 +1,10 @@ | ||||
| # Role: webserver-composer | ||||
| # Role: srv-web-composer | ||||
| 
 | ||||
| This Ansible role composes and orchestrates all necessary HTTPS-layer tasks and HTML-content injections for your webserver domains. It integrates two key sub-roles into a unified workflow: | ||||
| 
 | ||||
| 1. **`webserver-injector-core`** | ||||
| 1. **`srv-web-injector-core`** | ||||
|    Injects global HTML snippets (CSS, Matomo tracking, iFrame notifier, custom JavaScript) into responses using Nginx `sub_filter`. | ||||
| 2. **`webserver-tls-core`** | ||||
| 2. **`srv-web-tls-core`** | ||||
|    Handles issuing, renewing, and managing TLS certificates via ACME/Certbot. | ||||
| 
 | ||||
| By combining encryption setup with content enhancements, this role streamlines domain provisioning for secure, fully-featured HTTP/HTTPS delivery. | ||||
| @@ -16,7 +16,7 @@ By combining encryption setup with content enhancements, this role streamlines d | ||||
| * **Content Injection** | ||||
|   Adds global theming, analytics, and custom scripts before `</head>` and tracking noscript tags before `</body>`. | ||||
| * **Certificate Management** | ||||
|   Automates cert issuance and renewal via `webserver-tls-core`. | ||||
|   Automates cert issuance and renewal via `srv-web-tls-core`. | ||||
| * **Idempotent Workflow** | ||||
|   Ensures each component runs only once per domain. | ||||
| * **Simplified Playbooks** | ||||
| @@ -27,7 +27,7 @@ galaxy_info: | ||||
|     - orchestration | ||||
|   repository: "https://github.com/kevinveenbirkenbach/cymais" | ||||
|   issue_tracker_url: "https://github.com/kevinveenbirkenbach/cymais/issues" | ||||
|   documentation: "https://github.com/kevinveenbirkenbach/cymais/roles/webserver-composer" | ||||
|   documentation: "https://github.com/kevinveenbirkenbach/cymais/roles/srv-web-composer" | ||||
| dependencies: | ||||
|   - webserver-injector-core | ||||
|   - webserver-tls-core | ||||
|   - srv-web-injector-core | ||||
|   - srv-web-tls-core | ||||
							
								
								
									
										7
									
								
								roles/srv-web-composer/tasks/main.yml
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										7
									
								
								roles/srv-web-composer/tasks/main.yml
									
									
									
									
									
										Normal file
									
								
							| @@ -0,0 +1,7 @@ | ||||
| - name: "include role srv-web-injector-core for {{domain}}" | ||||
|   include_role:  | ||||
|     name: srv-web-injector-core | ||||
|  | ||||
| - name: "include role srv-web-tls-core for {{domain}}" | ||||
|   include_role:  | ||||
|     name: srv-web-tls-core | ||||
| @@ -18,7 +18,7 @@ galaxy_info: | ||||
|     - performance | ||||
|   repository: "https://github.com/kevinveenbirkenbach/cymais" | ||||
|   issue_tracker_url: "https://github.com/kevinveenbirkenbach/cymais/issues" | ||||
|   documentation: "https://github.com/kevinveenbirkenbach/cymais/roles/webserver-core" | ||||
|   documentation: "https://github.com/kevinveenbirkenbach/cymais/roles/srv-web-core" | ||||
| dependencies: | ||||
|   - mon-bot-webserver | ||||
|   - mon-bot-csp | ||||
| @@ -1,21 +1,21 @@ | ||||
| # Webserver HTTPS Provisioning 🚀 | ||||
| 
 | ||||
| ## Description | ||||
| The **webserver-https** role extends a basic Nginx installation by wiring in everything you need to serve content over HTTPS: | ||||
| The **srv-web-https** role extends a basic Nginx installation by wiring in everything you need to serve content over HTTPS: | ||||
| 
 | ||||
| 1. Ensures your Nginx server is configured for SSL/TLS. | ||||
| 2. Pulls in Let’s Encrypt ACME challenge handling. | ||||
| 3. Applies global cleanup of unused domain configs. | ||||
| 
 | ||||
| This role is built on top of your existing `webserver-core` role, and it automates the end-to-end process of turning HTTP sites into secure HTTPS sites. | ||||
| This role is built on top of your existing `srv-web-core` role, and it automates the end-to-end process of turning HTTP sites into secure HTTPS sites. | ||||
| 
 | ||||
| --- | ||||
| 
 | ||||
| ## Overview | ||||
| 
 | ||||
| When you apply **webserver-https**, it will: | ||||
| When you apply **srv-web-https**, it will: | ||||
| 
 | ||||
| 1. **Include** the `webserver-core` role to install and configure Nginx.   | ||||
| 1. **Include** the `srv-web-core` role to install and configure Nginx.   | ||||
| 2. **Clean up** any stale vHost files under `cln-domains`.   | ||||
| 3. **Deploy** the Let’s Encrypt challenge-and-redirect snippet from `network-letsencrypt`.   | ||||
| 4. **Reload** Nginx automatically when any template changes. | ||||
| @@ -42,7 +42,7 @@ All tasks are idempotent—once your certificates are in place and your configur | ||||
| 
 | ||||
| ## Requirements | ||||
| 
 | ||||
| - A working `webserver-core` setup. | ||||
| - A working `srv-web-core` setup. | ||||
| - DNS managed via Cloudflare (for CAA record tasks) or equivalent ACME DNS flow. | ||||
| - Variables: | ||||
|   - `certbot_webroot_path`   | ||||
| @@ -24,6 +24,6 @@ galaxy_info: | ||||
|   issue_tracker_url: "https://s.veen.world/cymaisissues" | ||||
| 
 | ||||
| dependencies: | ||||
|   - webserver-core | ||||
|   - srv-web-core | ||||
|   - cln-domains | ||||
|   - network-letsencrypt | ||||
| @@ -1,19 +1,19 @@ | ||||
| - name: "Activate Global CSS for {{domain}}" | ||||
|   include_role: | ||||
|     name: webserver-injector-css | ||||
|     name: srv-web-injector-css | ||||
|   when: applications | is_feature_enabled('css',application_id) | ||||
| 
 | ||||
| - name: "Activate Global Matomo Tracking for {{domain}}" | ||||
|   include_role: | ||||
|     name: webserver-injector-matomo | ||||
|     name: srv-web-injector-matomo | ||||
|   when: applications | is_feature_enabled('matomo',application_id) | ||||
| 
 | ||||
| - name: "Activate Portfolio iFrame Notifier for {{ domain }}" | ||||
|   include_role: | ||||
|     name: webserver-injector-iframe | ||||
|     name: srv-web-injector-iframe | ||||
|   when: applications | is_feature_enabled('portfolio_iframe', application_id) | ||||
| 
 | ||||
| - name: "Activate Javascript for {{ domain }}" | ||||
|   include_role: | ||||
|     name: webserver-injector-javascript | ||||
|     name: srv-web-injector-javascript | ||||
|   when: applications | is_feature_enabled('javascript', application_id) | ||||
| @@ -10,24 +10,24 @@ sub_filter_types text/html; | ||||
| {% if modifier_iframe_enabled or modifier_css_enabled or modifier_matomo_enabled or modifier_javascript_enabled %} | ||||
| sub_filter '</head>' '  | ||||
|         {%- if modifier_css_enabled -%} | ||||
|           {%- include "roles/webserver-injector-css/templates/head_sub.j2" -%} | ||||
|           {%- include "roles/srv-web-injector-css/templates/head_sub.j2" -%} | ||||
|         {%- endif -%} | ||||
|         {%- if modifier_matomo_enabled -%} | ||||
|           {%- include "roles/webserver-injector-matomo/templates/head_sub.j2" -%} | ||||
|           {%- include "roles/srv-web-injector-matomo/templates/head_sub.j2" -%} | ||||
|         {%- endif -%} | ||||
|         {%- if modifier_iframe_enabled -%} | ||||
|           {%- include "roles/webserver-injector-iframe/templates/head_sub.j2" -%} | ||||
|           {%- include "roles/srv-web-injector-iframe/templates/head_sub.j2" -%} | ||||
|         {%- endif -%} | ||||
|         {%- if modifier_javascript_enabled -%} | ||||
|           {%- include "roles/webserver-injector-javascript/templates/head_sub.j2" -%} | ||||
|           {%- include "roles/srv-web-injector-javascript/templates/head_sub.j2" -%} | ||||
|         {%- endif -%} | ||||
|       </head>'; | ||||
| {% endif %} | ||||
| 
 | ||||
| {% if modifier_css_enabled | bool %} | ||||
| {% include 'roles/webserver-injector-css/templates/location.conf.j2' %} | ||||
| {% include 'roles/srv-web-injector-css/templates/location.conf.j2' %} | ||||
| {% endif %} | ||||
| 
 | ||||
| {% if modifier_matomo_enabled %} | ||||
| {% include 'roles/webserver-injector-matomo/templates/matomo-tracking.conf.j2' %} | ||||
| {% include 'roles/srv-web-injector-matomo/templates/matomo-tracking.conf.j2' %} | ||||
| {% endif %} | ||||
| @@ -26,4 +26,4 @@ galaxy_info: | ||||
|   issue_tracker_url: https://s.veen.world/cymaisissues | ||||
|   documentation: https://s.veen.world/cymais | ||||
| dependencies: | ||||
|   - webserver-core | ||||
|   - srv-web-core | ||||
| @@ -1,4 +1,4 @@ | ||||
| # Load this role via webserver-injector-core for consistency | ||||
| # Load this role via srv-web-injector-core for consistency | ||||
| 
 | ||||
| - name: Generate color palette with colorscheme-generator | ||||
|   set_fact: | ||||
| @@ -25,4 +25,4 @@ galaxy_info: | ||||
|     - security | ||||
|     - postMessage | ||||
| dependencies: | ||||
|   - webserver-core | ||||
|   - srv-web-core | ||||
| @@ -25,4 +25,4 @@ galaxy_info: | ||||
|   issue_tracker_url: "https://s.veen.world/cymaisissues" | ||||
| 
 | ||||
| dependencies: | ||||
|   - webserver-core | ||||
|   - srv-web-core | ||||
| @@ -1,3 +1,3 @@ | ||||
| dependencies: | ||||
|   # - web-app-matomo Don't activate this otherwise the plays take super long | ||||
|   - webserver-core | ||||
|   - srv-web-core | ||||
| @@ -1,4 +1,4 @@ | ||||
| # Load this role via webserver-injector-core for consistency | ||||
| # Load this role via srv-web-injector-core for consistency | ||||
| 
 | ||||
| - name: "Relevant variables for role: {{ role_path | basename }}" | ||||
|   debug: | ||||
| @@ -16,7 +16,7 @@ The goal of this role is to deliver a **hassle-free, production-ready reverse pr | ||||
| 
 | ||||
| ## Features | ||||
| 
 | ||||
| - **Automatic TLS & HSTS** — integrates with the *webserver-https* role for certificate management.   | ||||
| - **Automatic TLS & HSTS** — integrates with the *srv-web-https* role for certificate management.   | ||||
| - **Flexible vHost templates** — *basic* and *ws_generic* flavours cover standard HTTP and WebSocket applications.   | ||||
| - **Security headers** — sensible defaults plus optional X-Frame-Options / CSP based on application settings.   | ||||
| - **WebSocket & HTTP/2 aware** — upgrades, keep-alive tuning, and gzip already configured.   | ||||
| @@ -25,4 +25,4 @@ galaxy_info: | ||||
|   documentation: https://s.veen.world/cymais | ||||
| dependencies: | ||||
|   - docker | ||||
|   - webserver-https | ||||
|   - srv-web-https | ||||
| @@ -14,7 +14,7 @@ location {{location | default("/")}} | ||||
|   proxy_set_header X-Forwarded-Port 443; | ||||
|   proxy_set_header Accept-Encoding ""; | ||||
| 
 | ||||
|   {% include 'roles/webserver-proxy-core/templates/headers/content_security_policy.conf.j2' %} | ||||
|   {% include 'roles/srv-web-proxy-core/templates/headers/content_security_policy.conf.j2' %} | ||||
| 
 | ||||
|   # WebSocket specific header | ||||
|   proxy_http_version 1.1; | ||||
| @@ -6,7 +6,7 @@ server | ||||
|     {% include 'roles/web-app-oauth2-proxy/templates/endpoint.conf.j2'%} | ||||
|   {% endif %} | ||||
| 
 | ||||
|   {% include 'roles/webserver-injector-core/templates/global.includes.conf.j2'%} | ||||
|   {% include 'roles/srv-web-injector-core/templates/global.includes.conf.j2'%} | ||||
|    | ||||
|   {% if nginx_docker_reverse_proxy_extra_configuration is defined %} | ||||
|     {# Additional Domain Specific Configuration #} | ||||
| @@ -22,38 +22,38 @@ server | ||||
|       {# 1. Expose everything by default, then protect blacklisted paths #} | ||||
|       {% set oauth2_proxy_enabled = false %} | ||||
|       {% set location = "/" %} | ||||
|       {% include 'roles/webserver-proxy-core/templates/location/proxy_basic.conf.j2' %} | ||||
|       {% include 'roles/srv-web-proxy-core/templates/location/proxy_basic.conf.j2' %} | ||||
| 
 | ||||
|       {% for loc in acl.blacklist %} | ||||
|         {% set oauth2_proxy_enabled = true %} | ||||
|         {% set location = loc %} | ||||
|         {% include 'roles/webserver-proxy-core/templates/location/proxy_basic.conf.j2' %} | ||||
|         {% include 'roles/srv-web-proxy-core/templates/location/proxy_basic.conf.j2' %} | ||||
|       {% endfor %} | ||||
| 
 | ||||
|     {% elif acl.whitelist is defined %} | ||||
|       {# 2. Protect everything by default, then expose whitelisted paths #} | ||||
|       {% set oauth2_proxy_enabled = true %} | ||||
|       {% set location = "/" %} | ||||
|       {% include 'roles/webserver-proxy-core/templates/location/proxy_basic.conf.j2' %} | ||||
|       {% include 'roles/srv-web-proxy-core/templates/location/proxy_basic.conf.j2' %} | ||||
| 
 | ||||
|       {% for loc in acl.whitelist %} | ||||
|         {% set oauth2_proxy_enabled = false %} | ||||
|         {% set location = loc %} | ||||
|         {% include 'roles/webserver-proxy-core/templates/location/proxy_basic.conf.j2' %} | ||||
|         {% include 'roles/srv-web-proxy-core/templates/location/proxy_basic.conf.j2' %} | ||||
|       {% endfor %} | ||||
| 
 | ||||
|     {% else %} | ||||
|       {# 3. OAuth2 enabled but no (or empty) ACL — protect all #} | ||||
|       {% set oauth2_proxy_enabled = true %} | ||||
|       {% set location = "/" %} | ||||
|       {% include 'roles/webserver-proxy-core/templates/location/proxy_basic.conf.j2' %} | ||||
|       {% include 'roles/srv-web-proxy-core/templates/location/proxy_basic.conf.j2' %} | ||||
|     {% endif %} | ||||
| 
 | ||||
|   {% else %} | ||||
|     {# 4. OAuth2 completely disabled — expose all #} | ||||
|     {% set oauth2_proxy_enabled = false %} | ||||
|     {% set location = "/" %} | ||||
|     {% include 'roles/webserver-proxy-core/templates/location/proxy_basic.conf.j2' %} | ||||
|     {% include 'roles/srv-web-proxy-core/templates/location/proxy_basic.conf.j2' %} | ||||
|   {% endif %} | ||||
| 
 | ||||
| } | ||||
| @@ -7,7 +7,7 @@ server { | ||||
|   server_name {{ domain }}; | ||||
| 
 | ||||
|   {% include 'roles/network-letsencrypt/templates/ssl_header.j2' %} | ||||
|   {% include 'roles/webserver-injector-core/templates/global.includes.conf.j2' %} | ||||
|   {% include 'roles/srv-web-injector-core/templates/global.includes.conf.j2' %} | ||||
| 
 | ||||
|   client_max_body_size {{ client_max_body_size | default('100m') }}; | ||||
|   keepalive_timeout    70; | ||||
| @@ -24,7 +24,7 @@ server { | ||||
| 
 | ||||
|   add_header Strict-Transport-Security "max-age=31536000"; | ||||
| 
 | ||||
|   {% include 'roles/webserver-proxy-core/templates/location/proxy_basic.conf.j2' %} | ||||
|   {% include 'roles/srv-web-proxy-core/templates/location/proxy_basic.conf.j2' %} | ||||
| 
 | ||||
|   {% if ws_path is defined %} | ||||
|     location {{ ws_path }} { | ||||
| @@ -6,11 +6,11 @@ This role bootstraps **per-domain Nginx configuration**: it requests TLS certifi | ||||
| 
 | ||||
| ## Overview | ||||
| 
 | ||||
| A higher-level orchestration wrapper, *webserver-proxy-domain* ties together several lower-level roles: | ||||
| A higher-level orchestration wrapper, *srv-web-proxy-domain* ties together several lower-level roles: | ||||
| 
 | ||||
| 1. **`webserver-injector-core`** – applies global tweaks and includes.   | ||||
| 2. **`webserver-tls-core`** – obtains Let’s Encrypt certificates.   | ||||
| 3. **Domain template deployment** – copies a Jinja2 vHost from *webserver-proxy-core*.   | ||||
| 1. **`srv-web-injector-core`** – applies global tweaks and includes.   | ||||
| 2. **`srv-web-tls-core`** – obtains Let’s Encrypt certificates.   | ||||
| 3. **Domain template deployment** – copies a Jinja2 vHost from *srv-web-proxy-core*.   | ||||
| 4. **`web-app-oauth2-proxy`** *(optional)* – protects the site with OAuth2. | ||||
| 
 | ||||
| The result is a complete, reproducible domain rollout in a single playbook task. | ||||
| @@ -2,4 +2,4 @@ | ||||
| vhost_flavour:        "basic"               # valid: basic | ws_generic | ||||
| 
 | ||||
| # build the full template path from the flavour | ||||
| vhost_template_src:   "roles/webserver-proxy-core/templates/vhost/{{ vhost_flavour }}.conf.j2" | ||||
| vhost_template_src:   "roles/srv-web-proxy-core/templates/vhost/{{ vhost_flavour }}.conf.j2" | ||||
| @@ -24,4 +24,4 @@ galaxy_info: | ||||
|   issue_tracker_url: https://s.veen.world/cymaisissues | ||||
|   documentation: https://s.veen.world/cymais | ||||
| dependencies: | ||||
|   - webserver-core | ||||
|   - srv-web-core | ||||
| @@ -1,6 +1,6 @@ | ||||
| - name: "include role for {{domain}} to receive certificates and do the modification routines" | ||||
|   include_role: | ||||
|     name: webserver-composer | ||||
|     name: srv-web-composer | ||||
|      | ||||
| - name: "copy nginx domain configuration to {{ configuration_destination }}" | ||||
|   template: | ||||
| @@ -21,7 +21,7 @@ This Ansible role simplifies the deployment of **Let's Encrypt certificates** in | ||||
| 
 | ||||
| ### **1️⃣ Main Tasks** | ||||
| 1. **Add Deployment Script**   | ||||
|    - Copies `webserver-proxy-tls-deploy.sh` to the administrator scripts directory. | ||||
|    - Copies `srv-web-proxy-tls-deploy.sh` to the administrator scripts directory. | ||||
|     | ||||
| 2. **Create Certificate Directory**   | ||||
|    - Ensures `cert_mount_directory` exists with proper permissions. | ||||
| @@ -34,14 +34,14 @@ This Ansible role simplifies the deployment of **Let's Encrypt certificates** in | ||||
| 
 | ||||
| ### **2️⃣ Handlers** | ||||
| - **Restart Nginx Service**   | ||||
|   - Restarts `webserver-proxy-tls-deploy` whenever a certificate update occurs. | ||||
|   - Restarts `srv-web-proxy-tls-deploy` whenever a certificate update occurs. | ||||
| 
 | ||||
| --- | ||||
| 
 | ||||
| ## **🔧 Deploying Certificates into Docker Containers** | ||||
| The role **automates copying certificates** into Docker Compose setups. | ||||
| 
 | ||||
| ### **1️⃣ Deployment Script (`webserver-proxy-tls-deploy.sh`)** | ||||
| ### **1️⃣ Deployment Script (`srv-web-proxy-tls-deploy.sh`)** | ||||
| This script: | ||||
| - **Copies certificates** to the correct container directory. | ||||
| - **Reloads Nginx** inside all running containers. | ||||
| @@ -49,7 +49,7 @@ This script: | ||||
| 
 | ||||
| **Usage:** | ||||
| ```sh | ||||
| sh webserver-proxy-tls-deploy.sh primary_domain /path/to/docker/compose | ||||
| sh srv-web-proxy-tls-deploy.sh primary_domain /path/to/docker/compose | ||||
| ``` | ||||
| 
 | ||||
| --- | ||||
							
								
								
									
										7
									
								
								roles/srv-web-proxy-tls-deploy/handlers/main.yml
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										7
									
								
								roles/srv-web-proxy-tls-deploy/handlers/main.yml
									
									
									
									
									
										Normal file
									
								
							| @@ -0,0 +1,7 @@ | ||||
| --- | ||||
| - name: "restart srv-web-proxy-tls-deploy.cymais.service" | ||||
|   systemd: | ||||
|     name:           srv-web-proxy-tls-deploy.{{application_id}}.cymais.service | ||||
|     state:          restarted | ||||
|     enabled:        yes | ||||
|     daemon_reload:  yes | ||||
| @@ -1,9 +1,9 @@ | ||||
| - name: add webserver-proxy-tls-deploy.sh | ||||
| - name: add srv-web-proxy-tls-deploy.sh | ||||
|   copy:  | ||||
|     src: "webserver-proxy-tls-deploy.sh"  | ||||
|     src: "srv-web-proxy-tls-deploy.sh"  | ||||
|     dest: "{{nginx_docker_cert_deploy_script}}" | ||||
|   when: run_once_nginx_docker_cert_deploy is not defined | ||||
|   notify: restart webserver-proxy-tls-deploy.cymais.service | ||||
|   notify: restart srv-web-proxy-tls-deploy.cymais.service | ||||
| 
 | ||||
| - name: run the nginx_docker_cert_deploy tasks once | ||||
|   set_fact: | ||||
| @@ -15,18 +15,18 @@ | ||||
|     path:     "{{cert_mount_directory}}" | ||||
|     state:    directory | ||||
|     mode:     0755 | ||||
|   notify: restart webserver-proxy-tls-deploy.cymais.service | ||||
|   notify: restart srv-web-proxy-tls-deploy.cymais.service | ||||
| 
 | ||||
| - name: configure webserver-proxy-tls-deploy.cymais.service | ||||
| - name: configure srv-web-proxy-tls-deploy.cymais.service | ||||
|   template:  | ||||
|     src:  "webserver-proxy-tls-deploy.service.j2" | ||||
|     dest: "/etc/systemd/system/webserver-proxy-tls-deploy.{{application_id}}.cymais.service" | ||||
|   notify: restart webserver-proxy-tls-deploy.cymais.service | ||||
|     src:  "srv-web-proxy-tls-deploy.service.j2" | ||||
|     dest: "/etc/systemd/system/srv-web-proxy-tls-deploy.{{application_id}}.cymais.service" | ||||
|   notify: restart srv-web-proxy-tls-deploy.cymais.service | ||||
| 
 | ||||
| - name: "include role for gen-timer for {{service_name}}" | ||||
|   include_role: | ||||
|     name: gen-timer | ||||
|   vars: | ||||
|     on_calendar:  "{{on_calendar_deploy_certificates}}" | ||||
|     service_name: "webserver-proxy-tls-deploy.{{application_id}}" | ||||
|     service_name: "srv-web-proxy-tls-deploy.{{application_id}}" | ||||
|     persistent:   "true" | ||||
| @@ -4,4 +4,4 @@ OnFailure=alert-compose.cymais@%n.service | ||||
| 
 | ||||
| [Service] | ||||
| Type=oneshot | ||||
| ExecStart=/usr/bin/bash {{path_administrator_scripts}}/webserver-proxy-tls-deploy.sh {{ssl_cert_folder}} {{docker_compose.directories.instance}} | ||||
| ExecStart=/usr/bin/bash {{path_administrator_scripts}}/srv-web-proxy-tls-deploy.sh {{ssl_cert_folder}} {{docker_compose.directories.instance}} | ||||
| @@ -1 +1 @@ | ||||
| nginx_docker_cert_deploy_script:  "{{path_administrator_scripts}}webserver-proxy-tls-deploy.sh" | ||||
| nginx_docker_cert_deploy_script:  "{{path_administrator_scripts}}srv-web-proxy-tls-deploy.sh" | ||||
| @@ -28,4 +28,4 @@ galaxy_info: | ||||
|   issue_tracker_url: "https://s.veen.world/cymaisissues" | ||||
|   documentation: "https://s.veen.world/cymais" | ||||
| dependencies: | ||||
|   - webserver-https | ||||
|   - srv-web-https | ||||
| @@ -1,6 +1,6 @@ | ||||
| - name: "reload certbot service" | ||||
|   systemd: | ||||
|     name: webserver-tls-renew.cymais.service | ||||
|     name: srv-web-tls-renew.cymais.service | ||||
|     state: reloaded | ||||
|     enabled: yes | ||||
|     daemon_reload: yes | ||||
| @@ -28,6 +28,6 @@ galaxy_info: | ||||
|   documentation: "https://s.veen.world/cymais" | ||||
| dependencies: | ||||
|   - gen-certbot | ||||
|   - webserver-core | ||||
|   - srv-web-core | ||||
|   - alert-compose | ||||
|   - cln-certs | ||||
| @@ -5,10 +5,10 @@ | ||||
|     state: present | ||||
|   when: run_once_nginx_certbot is not defined | ||||
| 
 | ||||
| - name: configure webserver-tls-renew.cymais.service | ||||
| - name: configure srv-web-tls-renew.cymais.service | ||||
|   template:  | ||||
|     src:  webserver-tls-renew.service.j2 | ||||
|     dest: /etc/systemd/system/webserver-tls-renew.cymais.service | ||||
|     src:  srv-web-tls-renew.service.j2 | ||||
|     dest: /etc/systemd/system/srv-web-tls-renew.cymais.service | ||||
|   notify: reload certbot service | ||||
|   when: run_once_nginx_certbot is not defined | ||||
| 
 | ||||
| @@ -3,9 +3,9 @@ | ||||
|   include_role:  | ||||
|     name: service-rdbms-central | ||||
|  | ||||
| - name: "include role webserver-proxy-domain for {{application_id}}" | ||||
| - name: "include role srv-web-proxy-domain for {{application_id}}" | ||||
|   include_role: | ||||
|     name: webserver-proxy-domain | ||||
|     name: srv-web-proxy-domain | ||||
|   vars: | ||||
|     domain:   "{{ domains | get_domain(application_id) }}" | ||||
|     http_port:   "{{ ports.localhost.http[application_id] }}" | ||||
|   | ||||
| @@ -5,7 +5,7 @@ | ||||
|  | ||||
| - name: "include role for {{application_id}} to receive certs & do modification routines" | ||||
|   include_role: | ||||
|     name: webserver-composer | ||||
|     name: srv-web-composer | ||||
|   vars: | ||||
|     domain: "{{ item }}" | ||||
|     http_port:   "{{ ports.localhost.http[application_id] }}" | ||||
| @@ -15,7 +15,7 @@ | ||||
|      | ||||
| - name: configure {{domains | get_domain(application_id)}}.conf | ||||
|   template:  | ||||
|     src: roles/webserver-proxy-core/templates/vhost/basic.conf.j2  | ||||
|     src: roles/srv-web-proxy-core/templates/vhost/basic.conf.j2  | ||||
|     dest: "{{nginx.directories.http.servers}}{{domains | get_domain(application_id)}}.conf" | ||||
|   notify: restart nginx | ||||
|  | ||||
|   | ||||
| @@ -3,9 +3,9 @@ | ||||
|   include_role:  | ||||
|     name: service-rdbms-central | ||||
|  | ||||
| - name: "include role webserver-proxy-domain for {{application_id}}" | ||||
| - name: "include role srv-web-proxy-domain for {{application_id}}" | ||||
|   include_role: | ||||
|     name: webserver-proxy-domain | ||||
|     name: srv-web-proxy-domain | ||||
|   vars: | ||||
|     domain:   "{{ domains | get_domain(application_id) }}" | ||||
|     http_port:   "{{ ports.localhost.http[application_id] }}" | ||||
| @@ -35,7 +35,7 @@ By default, BigBlueButton is deployed with best-practice hardening, modular secr | ||||
| ## System Requirements | ||||
|  | ||||
| - Arch Linux with Docker, Compose, and Nginx roles pre-installed | ||||
| - DNS and reverse proxy configuration using `webserver-proxy-core` | ||||
| - DNS and reverse proxy configuration using `srv-web-proxy-core` | ||||
| - Functional email system for Greenlight SMTP | ||||
|  | ||||
| ## Important Resources | ||||
|   | ||||
| @@ -17,9 +17,9 @@ | ||||
|     database_username:  "postgres" | ||||
|     database_name:      ""                              # Multiple databases | ||||
|  | ||||
| - name: "include role webserver-proxy-domain for {{application_id}}" | ||||
| - name: "include role srv-web-proxy-domain for {{application_id}}" | ||||
|   include_role: | ||||
|     name: webserver-proxy-domain | ||||
|     name: srv-web-proxy-domain | ||||
|  | ||||
| - name: pull docker repository | ||||
|   git: | ||||
|   | ||||
| @@ -2,9 +2,9 @@ | ||||
|   include_role:  | ||||
|     name: docker-compose | ||||
|  | ||||
| - name: "include role webserver-proxy-domain for {{application_id}}" | ||||
| - name: "include role srv-web-proxy-domain for {{application_id}}" | ||||
|   include_role: | ||||
|     name: webserver-proxy-domain | ||||
|     name: srv-web-proxy-domain | ||||
|   vars: | ||||
|     domain: "{{ item.domain }}" | ||||
|     http_port: "{{ item.http_port }}" | ||||
|   | ||||
| @@ -3,13 +3,13 @@ server { | ||||
|  | ||||
|   {% include 'roles/network-letsencrypt/templates/ssl_header.j2' %} | ||||
|  | ||||
|   {% include 'roles/webserver-injector-core/templates/global.includes.conf.j2'%} | ||||
|   {% include 'roles/srv-web-injector-core/templates/global.includes.conf.j2'%} | ||||
|    | ||||
|   {% include 'roles/webserver-proxy-core/templates/headers/content_security_policy.conf.j2' %} | ||||
|   {% include 'roles/srv-web-proxy-core/templates/headers/content_security_policy.conf.j2' %} | ||||
|  | ||||
|   {% include 'roles/webserver-proxy-core/templates/location/proxy_basic.conf.j2' %} | ||||
|   {% include 'roles/srv-web-proxy-core/templates/location/proxy_basic.conf.j2' %} | ||||
|  | ||||
|   {% set location = '^~ /cool/' %} | ||||
|    | ||||
|   {% include 'roles/webserver-proxy-core/templates/location/proxy_basic.conf.j2' %} | ||||
|   {% include 'roles/srv-web-proxy-core/templates/location/proxy_basic.conf.j2' %} | ||||
| } | ||||
| @@ -3,9 +3,9 @@ | ||||
|   include_role:  | ||||
|     name: service-rdbms-central | ||||
|  | ||||
| - name: "include role webserver-proxy-domain for {{application_id}}" | ||||
| - name: "include role srv-web-proxy-domain for {{application_id}}" | ||||
|   include_role: | ||||
|     name: webserver-proxy-domain | ||||
|     name: srv-web-proxy-domain | ||||
|   vars: | ||||
|     domain:   "{{ domains | get_domain(application_id) }}" | ||||
|     http_port:   "{{ ports.localhost.http[application_id] }}" | ||||
|   | ||||
| @@ -12,9 +12,9 @@ | ||||
|     name: service-rdbms-central | ||||
|   when: run_once_docker_discourse is not defined | ||||
|  | ||||
| - name: "include role webserver-proxy-domain for {{application_id}}" | ||||
| - name: "include role srv-web-proxy-domain for {{application_id}}" | ||||
|   include_role: | ||||
|     name: webserver-proxy-domain | ||||
|     name: srv-web-proxy-domain | ||||
|   vars: | ||||
|     domain:   "{{ domains | get_domain(application_id) }}" | ||||
|     http_port:   "{{ ports.localhost.http[application_id] }}" | ||||
|   | ||||
| @@ -1,8 +1,8 @@ | ||||
| --- | ||||
|  | ||||
| - name: "include role webserver-proxy-domain for {{application_id}}" | ||||
| - name: "include role srv-web-proxy-domain for {{application_id}}" | ||||
|   include_role: | ||||
|     name: webserver-proxy-domain | ||||
|     name: srv-web-proxy-domain | ||||
|   vars: | ||||
|     domain:   "{{ domains | get_domain(application_id) }}" | ||||
|     http_port:   "{{ ports.localhost.http[application_id] }}" | ||||
|   | ||||
| @@ -5,7 +5,7 @@ | ||||
|  | ||||
| - name: "Include setup for domain '{{ domain }}'" | ||||
|   include_role:  | ||||
|     name: webserver-proxy-domain | ||||
|     name: srv-web-proxy-domain | ||||
|   vars: | ||||
|     ws_path:              "/ws" | ||||
|     ws_port:              "{{ ports.localhost.websocket[application_id] }}" | ||||
|   | ||||
| @@ -14,9 +14,9 @@ | ||||
|   notify: docker compose up | ||||
|   when: applications | is_feature_enabled('ldap',application_id) | ||||
|  | ||||
| - name: "include role webserver-proxy-domain for {{application_id}}" | ||||
| - name: "include role srv-web-proxy-domain for {{application_id}}" | ||||
|   include_role: | ||||
|     name: webserver-proxy-domain | ||||
|     name: srv-web-proxy-domain | ||||
|   vars: | ||||
|     domain:   "{{ domains | get_domain(application_id) }}" | ||||
|     http_port:   "{{ ports.localhost.http[application_id] }}" | ||||
|   | ||||
| @@ -3,9 +3,9 @@ | ||||
|   include_role:  | ||||
|     name: service-rdbms-central | ||||
|  | ||||
| - name: "include role webserver-proxy-domain for {{application_id}}" | ||||
| - name: "include role srv-web-proxy-domain for {{application_id}}" | ||||
|   include_role: | ||||
|     name: webserver-proxy-domain | ||||
|     name: srv-web-proxy-domain | ||||
|   vars: | ||||
|     domain:   "{{ domains | get_domain(application_id) }}" | ||||
|     http_port:   "{{ ports.localhost.http[application_id] }}" | ||||
|   | ||||
| @@ -9,7 +9,7 @@ This Ansible role deploys and configures [FusionDirectory](https://www.fusiondir | ||||
| - Loads and templating of FusionDirectory-specific variables   | ||||
| - Generates a `.env` file for the container environment   | ||||
| - Deploys the FusionDirectory container via Docker Compose   | ||||
| - Configures NGINX (via the `webserver-proxy-domain` role) to expose the service   | ||||
| - Configures NGINX (via the `srv-web-proxy-domain` role) to expose the service   | ||||
| - Integrates with your central LDAP server for authentication   | ||||
|  | ||||
| ## Features | ||||
|   | ||||
| @@ -2,9 +2,9 @@ | ||||
|   include_role:  | ||||
|     name: docker-compose | ||||
|  | ||||
| - name: "include role webserver-proxy-domain for {{application_id}}" | ||||
| - name: "include role srv-web-proxy-domain for {{application_id}}" | ||||
|   include_role: | ||||
|     name: webserver-proxy-domain | ||||
|     name: srv-web-proxy-domain | ||||
|   vars: | ||||
|     domain:   "{{ domains | get_domain(application_id) }}" | ||||
|     http_port:   "{{ ports.localhost.http[application_id] }}" | ||||
|   | ||||
| @@ -3,9 +3,9 @@ | ||||
|   include_role:  | ||||
|     name: service-rdbms-central | ||||
|  | ||||
| - name: "include role webserver-proxy-domain for {{application_id}}" | ||||
| - name: "include role srv-web-proxy-domain for {{application_id}}" | ||||
|   include_role: | ||||
|     name: webserver-proxy-domain | ||||
|     name: srv-web-proxy-domain | ||||
|   vars: | ||||
|     domain:   "{{ domains | get_domain(application_id) }}" | ||||
|     http_port:   "{{ ports.localhost.http[application_id] }}" | ||||
|   | ||||
| @@ -3,9 +3,9 @@ | ||||
|   include_role:  | ||||
|     name: service-rdbms-central | ||||
|  | ||||
| - name: "include role webserver-proxy-domain for {{application_id}}" | ||||
| - name: "include role srv-web-proxy-domain for {{application_id}}" | ||||
|   include_role: | ||||
|     name: webserver-proxy-domain | ||||
|     name: srv-web-proxy-domain | ||||
|   vars: | ||||
|     domain:   "{{ domains | get_domain(application_id) }}" | ||||
|     http_port:   "{{ ports.localhost.http[application_id] }}" | ||||
|   | ||||
| @@ -1,2 +1,2 @@ | ||||
| dependencies: | ||||
| - webserver-proxy-core | ||||
| - srv-web-proxy-core | ||||
|   | ||||
| @@ -1,6 +1,6 @@ | ||||
| - name: "include role webserver-proxy-domain for {{application_id}}" | ||||
| - name: "include role srv-web-proxy-domain for {{application_id}}" | ||||
|   include_role: | ||||
|     name: webserver-proxy-domain | ||||
|     name: srv-web-proxy-domain | ||||
|   vars: | ||||
|     domain:   "{{ domains | get_domain(application_id) }}" | ||||
|     http_port:   "{{ ports.localhost.http[application_id] }}" | ||||
|   | ||||
| @@ -3,9 +3,9 @@ | ||||
|   include_role:  | ||||
|     name: service-rdbms-central | ||||
|  | ||||
| - name: "include role webserver-proxy-domain for {{application_id}}" | ||||
| - name: "include role srv-web-proxy-domain for {{application_id}}" | ||||
|   include_role: | ||||
|     name: webserver-proxy-domain | ||||
|     name: srv-web-proxy-domain | ||||
|   vars: | ||||
|     domain:   "{{ domains | get_domain(application_id) }}" | ||||
|     http_port:   "{{ ports.localhost.http[application_id] }}" | ||||
|   | ||||
| @@ -3,9 +3,9 @@ | ||||
|   include_role:  | ||||
|     name: service-rdbms-central | ||||
|  | ||||
| - name: "include role webserver-proxy-domain for {{application_id}}" | ||||
| - name: "include role srv-web-proxy-domain for {{application_id}}" | ||||
|   include_role: | ||||
|     name: webserver-proxy-domain | ||||
|     name: srv-web-proxy-domain | ||||
|   vars: | ||||
|     domain:   "{{ domains | get_domain(application_id) }}" | ||||
|     http_port:   "{{ ports.localhost.http[application_id] }}" | ||||
|   | ||||
| @@ -2,9 +2,9 @@ | ||||
|   include_role:  | ||||
|     name: docker-compose | ||||
|  | ||||
| - name: "include role webserver-proxy-domain for {{application_id}}" | ||||
| - name: "include role srv-web-proxy-domain for {{application_id}}" | ||||
|   include_role: | ||||
|     name: webserver-proxy-domain | ||||
|     name: srv-web-proxy-domain | ||||
|   vars: | ||||
|     domain:   "{{ domains | get_domain(application_id) }}" | ||||
|     http_port:   "{{ ports.localhost.http[application_id] }}" | ||||
|   | ||||
| @@ -13,9 +13,9 @@ | ||||
|  | ||||
|  | ||||
|  | ||||
| - name: "include role webserver-proxy-domain for {{application_id}}" | ||||
| - name: "include role srv-web-proxy-domain for {{application_id}}" | ||||
|   include_role: | ||||
|     name: webserver-proxy-domain | ||||
|     name: srv-web-proxy-domain | ||||
|   vars: | ||||
|     domain:   "{{ domains | get_domain(application_id) }}" | ||||
|     http_port:   "{{ ports.localhost.http[application_id] }}" | ||||
|   | ||||
| @@ -12,9 +12,9 @@ | ||||
|       "" | ||||
|       {% endif %} | ||||
|  | ||||
| - name: "include role webserver-proxy-domain for {{application_id}}" | ||||
| - name: "include role srv-web-proxy-domain for {{application_id}}" | ||||
|   include_role: | ||||
|     name: webserver-proxy-domain | ||||
|     name: srv-web-proxy-domain | ||||
|   vars: | ||||
|     domain:   "{{ domains | get_domain(application_id) }}" | ||||
|     http_port:   "{{ ports.localhost.http[application_id] }}" | ||||
|   | ||||
Some files were not shown because too many files have changed in this diff Show More
		Reference in New Issue
	
	Block a user