mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-07-18 06:24:25 +02:00
Shortened webserver to srv-web-
This commit is contained in:
parent
1f43536018
commit
66198ca1ec
@ -91,9 +91,9 @@ Now that you have defined the application settings, domain, and application ID,
|
|||||||
command: pkgmgr path cymais-my_service
|
command: pkgmgr path cymais-my_service
|
||||||
register: path_cymais_my_service_output
|
register: path_cymais_my_service_output
|
||||||
|
|
||||||
- name: "include role webserver-proxy-domain for {{ application_id }}"
|
- name: "include role srv-web-proxy-domain for {{ application_id }}"
|
||||||
include_role:
|
include_role:
|
||||||
name: webserver-proxy-domain
|
name: srv-web-proxy-domain
|
||||||
vars:
|
vars:
|
||||||
domain: "{{ domains | get_domain(application_id) }}"
|
domain: "{{ domains | get_domain(application_id) }}"
|
||||||
http_port: "{{ ports.localhost.http[application_id] }}"
|
http_port: "{{ ports.localhost.http[application_id] }}"
|
||||||
|
@ -24,19 +24,19 @@ For a complete list of role categories and detailed definitions, see:
|
|||||||
|
|
||||||
## Webserver & HTTP
|
## Webserver & HTTP
|
||||||
|
|
||||||
- **webserver-core**
|
- **srv-web-core**
|
||||||
Installs and configures the base Nginx server.
|
Installs and configures the base Nginx server.
|
||||||
|
|
||||||
- **webserver-tls-***
|
- **srv-web-tls-***
|
||||||
Manages TLS certificates and renewal (formerly “https”).
|
Manages TLS certificates and renewal (formerly “https”).
|
||||||
|
|
||||||
- **webserver-proxy-***
|
- **srv-web-proxy-***
|
||||||
Proxy and vhost orchestration roles (domain setup, OAuth2 proxy, etc.)
|
Proxy and vhost orchestration roles (domain setup, OAuth2 proxy, etc.)
|
||||||
|
|
||||||
- **webserver-injector-***
|
- **srv-web-injector-***
|
||||||
HTML response modifiers: CSS, JS, Matomo tracking, iframe notifier.
|
HTML response modifiers: CSS, JS, Matomo tracking, iframe notifier.
|
||||||
|
|
||||||
- **webserver-composer**
|
- **srv-web-composer**
|
||||||
Aggregates multiple sub-filters into one include for your vhost.
|
Aggregates multiple sub-filters into one include for your vhost.
|
||||||
|
|
||||||
- **web-service-***
|
- **web-service-***
|
||||||
@ -111,7 +111,7 @@ For a complete list of role categories and detailed definitions, see:
|
|||||||
---
|
---
|
||||||
|
|
||||||
> **Tip:** To find a role quickly, search for its prefix:
|
> **Tip:** To find a role quickly, search for its prefix:
|
||||||
> `core-`, `gen-`, `desk-`, `webserver-`, `web-service-`, `web-app-`,
|
> `core-`, `gen-`, `desk-`, `srv-web-`, `web-service-`, `web-app-`,
|
||||||
> `network-`, `service-`, `monitor-`, `alert-`, `maint-`, `cln-`,
|
> `network-`, `service-`, `monitor-`, `alert-`, `maint-`, `cln-`,
|
||||||
> `bkp-`, `update-`, `pkgmgr-`, `user-`.
|
> `bkp-`, `update-`, `pkgmgr-`, `user-`.
|
||||||
|
|
||||||
|
@ -21,4 +21,4 @@ galaxy_info:
|
|||||||
issue_tracker_url: "https://s.veen.world/cymaisissues"
|
issue_tracker_url: "https://s.veen.world/cymaisissues"
|
||||||
documentation: "https://s.veen.world/cymais"
|
documentation: "https://s.veen.world/cymais"
|
||||||
dependencies:
|
dependencies:
|
||||||
- webserver-core
|
- srv-web-core
|
@ -20,7 +20,7 @@ To offer a centralized, extensible system for managing containerized application
|
|||||||
- **Reset Logic:** Cleans previous Compose project files and data when `mode_reset` is enabled.
|
- **Reset Logic:** Cleans previous Compose project files and data when `mode_reset` is enabled.
|
||||||
- **Handlers for Runtime Control:** Automatically builds, sets up, or restarts containers based on handlers.
|
- **Handlers for Runtime Control:** Automatically builds, sets up, or restarts containers based on handlers.
|
||||||
- **Template-ready Service Files:** Predefined service base and health check templates.
|
- **Template-ready Service Files:** Predefined service base and health check templates.
|
||||||
- **Integration Support:** Compatible with `webserver-proxy-core` and other CyMaIS service roles.
|
- **Integration Support:** Compatible with `srv-web-proxy-core` and other CyMaIS service roles.
|
||||||
|
|
||||||
## Administration Tips
|
## Administration Tips
|
||||||
|
|
||||||
|
@ -25,5 +25,5 @@ galaxy_info:
|
|||||||
issue_tracker_url: https://s.veen.world/cymaisissues
|
issue_tracker_url: https://s.veen.world/cymaisissues
|
||||||
documentation: https://s.veen.world/cymais
|
documentation: https://s.veen.world/cymais
|
||||||
dependencies:
|
dependencies:
|
||||||
- webserver-proxy-core
|
- srv-web-proxy-core
|
||||||
- docker-container # Necessary for template use
|
- docker-container # Necessary for template use
|
@ -23,4 +23,4 @@ galaxy_info:
|
|||||||
issue_tracker_url: "https://s.veen.world/cymaisissues"
|
issue_tracker_url: "https://s.veen.world/cymaisissues"
|
||||||
documentation: "https://s.veen.world/cymais"
|
documentation: "https://s.veen.world/cymais"
|
||||||
dependencies:
|
dependencies:
|
||||||
- webserver-tls-renew
|
- srv-web-tls-renew
|
||||||
|
@ -1,10 +1,10 @@
|
|||||||
# Role: webserver-composer
|
# Role: srv-web-composer
|
||||||
|
|
||||||
This Ansible role composes and orchestrates all necessary HTTPS-layer tasks and HTML-content injections for your webserver domains. It integrates two key sub-roles into a unified workflow:
|
This Ansible role composes and orchestrates all necessary HTTPS-layer tasks and HTML-content injections for your webserver domains. It integrates two key sub-roles into a unified workflow:
|
||||||
|
|
||||||
1. **`webserver-injector-core`**
|
1. **`srv-web-injector-core`**
|
||||||
Injects global HTML snippets (CSS, Matomo tracking, iFrame notifier, custom JavaScript) into responses using Nginx `sub_filter`.
|
Injects global HTML snippets (CSS, Matomo tracking, iFrame notifier, custom JavaScript) into responses using Nginx `sub_filter`.
|
||||||
2. **`webserver-tls-core`**
|
2. **`srv-web-tls-core`**
|
||||||
Handles issuing, renewing, and managing TLS certificates via ACME/Certbot.
|
Handles issuing, renewing, and managing TLS certificates via ACME/Certbot.
|
||||||
|
|
||||||
By combining encryption setup with content enhancements, this role streamlines domain provisioning for secure, fully-featured HTTP/HTTPS delivery.
|
By combining encryption setup with content enhancements, this role streamlines domain provisioning for secure, fully-featured HTTP/HTTPS delivery.
|
||||||
@ -16,7 +16,7 @@ By combining encryption setup with content enhancements, this role streamlines d
|
|||||||
* **Content Injection**
|
* **Content Injection**
|
||||||
Adds global theming, analytics, and custom scripts before `</head>` and tracking noscript tags before `</body>`.
|
Adds global theming, analytics, and custom scripts before `</head>` and tracking noscript tags before `</body>`.
|
||||||
* **Certificate Management**
|
* **Certificate Management**
|
||||||
Automates cert issuance and renewal via `webserver-tls-core`.
|
Automates cert issuance and renewal via `srv-web-tls-core`.
|
||||||
* **Idempotent Workflow**
|
* **Idempotent Workflow**
|
||||||
Ensures each component runs only once per domain.
|
Ensures each component runs only once per domain.
|
||||||
* **Simplified Playbooks**
|
* **Simplified Playbooks**
|
@ -27,7 +27,7 @@ galaxy_info:
|
|||||||
- orchestration
|
- orchestration
|
||||||
repository: "https://github.com/kevinveenbirkenbach/cymais"
|
repository: "https://github.com/kevinveenbirkenbach/cymais"
|
||||||
issue_tracker_url: "https://github.com/kevinveenbirkenbach/cymais/issues"
|
issue_tracker_url: "https://github.com/kevinveenbirkenbach/cymais/issues"
|
||||||
documentation: "https://github.com/kevinveenbirkenbach/cymais/roles/webserver-composer"
|
documentation: "https://github.com/kevinveenbirkenbach/cymais/roles/srv-web-composer"
|
||||||
dependencies:
|
dependencies:
|
||||||
- webserver-injector-core
|
- srv-web-injector-core
|
||||||
- webserver-tls-core
|
- srv-web-tls-core
|
7
roles/srv-web-composer/tasks/main.yml
Normal file
7
roles/srv-web-composer/tasks/main.yml
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
- name: "include role srv-web-injector-core for {{domain}}"
|
||||||
|
include_role:
|
||||||
|
name: srv-web-injector-core
|
||||||
|
|
||||||
|
- name: "include role srv-web-tls-core for {{domain}}"
|
||||||
|
include_role:
|
||||||
|
name: srv-web-tls-core
|
@ -18,7 +18,7 @@ galaxy_info:
|
|||||||
- performance
|
- performance
|
||||||
repository: "https://github.com/kevinveenbirkenbach/cymais"
|
repository: "https://github.com/kevinveenbirkenbach/cymais"
|
||||||
issue_tracker_url: "https://github.com/kevinveenbirkenbach/cymais/issues"
|
issue_tracker_url: "https://github.com/kevinveenbirkenbach/cymais/issues"
|
||||||
documentation: "https://github.com/kevinveenbirkenbach/cymais/roles/webserver-core"
|
documentation: "https://github.com/kevinveenbirkenbach/cymais/roles/srv-web-core"
|
||||||
dependencies:
|
dependencies:
|
||||||
- mon-bot-webserver
|
- mon-bot-webserver
|
||||||
- mon-bot-csp
|
- mon-bot-csp
|
@ -1,21 +1,21 @@
|
|||||||
# Webserver HTTPS Provisioning 🚀
|
# Webserver HTTPS Provisioning 🚀
|
||||||
|
|
||||||
## Description
|
## Description
|
||||||
The **webserver-https** role extends a basic Nginx installation by wiring in everything you need to serve content over HTTPS:
|
The **srv-web-https** role extends a basic Nginx installation by wiring in everything you need to serve content over HTTPS:
|
||||||
|
|
||||||
1. Ensures your Nginx server is configured for SSL/TLS.
|
1. Ensures your Nginx server is configured for SSL/TLS.
|
||||||
2. Pulls in Let’s Encrypt ACME challenge handling.
|
2. Pulls in Let’s Encrypt ACME challenge handling.
|
||||||
3. Applies global cleanup of unused domain configs.
|
3. Applies global cleanup of unused domain configs.
|
||||||
|
|
||||||
This role is built on top of your existing `webserver-core` role, and it automates the end-to-end process of turning HTTP sites into secure HTTPS sites.
|
This role is built on top of your existing `srv-web-core` role, and it automates the end-to-end process of turning HTTP sites into secure HTTPS sites.
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## Overview
|
## Overview
|
||||||
|
|
||||||
When you apply **webserver-https**, it will:
|
When you apply **srv-web-https**, it will:
|
||||||
|
|
||||||
1. **Include** the `webserver-core` role to install and configure Nginx.
|
1. **Include** the `srv-web-core` role to install and configure Nginx.
|
||||||
2. **Clean up** any stale vHost files under `cln-domains`.
|
2. **Clean up** any stale vHost files under `cln-domains`.
|
||||||
3. **Deploy** the Let’s Encrypt challenge-and-redirect snippet from `network-letsencrypt`.
|
3. **Deploy** the Let’s Encrypt challenge-and-redirect snippet from `network-letsencrypt`.
|
||||||
4. **Reload** Nginx automatically when any template changes.
|
4. **Reload** Nginx automatically when any template changes.
|
||||||
@ -42,7 +42,7 @@ All tasks are idempotent—once your certificates are in place and your configur
|
|||||||
|
|
||||||
## Requirements
|
## Requirements
|
||||||
|
|
||||||
- A working `webserver-core` setup.
|
- A working `srv-web-core` setup.
|
||||||
- DNS managed via Cloudflare (for CAA record tasks) or equivalent ACME DNS flow.
|
- DNS managed via Cloudflare (for CAA record tasks) or equivalent ACME DNS flow.
|
||||||
- Variables:
|
- Variables:
|
||||||
- `certbot_webroot_path`
|
- `certbot_webroot_path`
|
@ -24,6 +24,6 @@ galaxy_info:
|
|||||||
issue_tracker_url: "https://s.veen.world/cymaisissues"
|
issue_tracker_url: "https://s.veen.world/cymaisissues"
|
||||||
|
|
||||||
dependencies:
|
dependencies:
|
||||||
- webserver-core
|
- srv-web-core
|
||||||
- cln-domains
|
- cln-domains
|
||||||
- network-letsencrypt
|
- network-letsencrypt
|
@ -1,19 +1,19 @@
|
|||||||
- name: "Activate Global CSS for {{domain}}"
|
- name: "Activate Global CSS for {{domain}}"
|
||||||
include_role:
|
include_role:
|
||||||
name: webserver-injector-css
|
name: srv-web-injector-css
|
||||||
when: applications | is_feature_enabled('css',application_id)
|
when: applications | is_feature_enabled('css',application_id)
|
||||||
|
|
||||||
- name: "Activate Global Matomo Tracking for {{domain}}"
|
- name: "Activate Global Matomo Tracking for {{domain}}"
|
||||||
include_role:
|
include_role:
|
||||||
name: webserver-injector-matomo
|
name: srv-web-injector-matomo
|
||||||
when: applications | is_feature_enabled('matomo',application_id)
|
when: applications | is_feature_enabled('matomo',application_id)
|
||||||
|
|
||||||
- name: "Activate Portfolio iFrame Notifier for {{ domain }}"
|
- name: "Activate Portfolio iFrame Notifier for {{ domain }}"
|
||||||
include_role:
|
include_role:
|
||||||
name: webserver-injector-iframe
|
name: srv-web-injector-iframe
|
||||||
when: applications | is_feature_enabled('portfolio_iframe', application_id)
|
when: applications | is_feature_enabled('portfolio_iframe', application_id)
|
||||||
|
|
||||||
- name: "Activate Javascript for {{ domain }}"
|
- name: "Activate Javascript for {{ domain }}"
|
||||||
include_role:
|
include_role:
|
||||||
name: webserver-injector-javascript
|
name: srv-web-injector-javascript
|
||||||
when: applications | is_feature_enabled('javascript', application_id)
|
when: applications | is_feature_enabled('javascript', application_id)
|
@ -10,24 +10,24 @@ sub_filter_types text/html;
|
|||||||
{% if modifier_iframe_enabled or modifier_css_enabled or modifier_matomo_enabled or modifier_javascript_enabled %}
|
{% if modifier_iframe_enabled or modifier_css_enabled or modifier_matomo_enabled or modifier_javascript_enabled %}
|
||||||
sub_filter '</head>' '
|
sub_filter '</head>' '
|
||||||
{%- if modifier_css_enabled -%}
|
{%- if modifier_css_enabled -%}
|
||||||
{%- include "roles/webserver-injector-css/templates/head_sub.j2" -%}
|
{%- include "roles/srv-web-injector-css/templates/head_sub.j2" -%}
|
||||||
{%- endif -%}
|
{%- endif -%}
|
||||||
{%- if modifier_matomo_enabled -%}
|
{%- if modifier_matomo_enabled -%}
|
||||||
{%- include "roles/webserver-injector-matomo/templates/head_sub.j2" -%}
|
{%- include "roles/srv-web-injector-matomo/templates/head_sub.j2" -%}
|
||||||
{%- endif -%}
|
{%- endif -%}
|
||||||
{%- if modifier_iframe_enabled -%}
|
{%- if modifier_iframe_enabled -%}
|
||||||
{%- include "roles/webserver-injector-iframe/templates/head_sub.j2" -%}
|
{%- include "roles/srv-web-injector-iframe/templates/head_sub.j2" -%}
|
||||||
{%- endif -%}
|
{%- endif -%}
|
||||||
{%- if modifier_javascript_enabled -%}
|
{%- if modifier_javascript_enabled -%}
|
||||||
{%- include "roles/webserver-injector-javascript/templates/head_sub.j2" -%}
|
{%- include "roles/srv-web-injector-javascript/templates/head_sub.j2" -%}
|
||||||
{%- endif -%}
|
{%- endif -%}
|
||||||
</head>';
|
</head>';
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|
||||||
{% if modifier_css_enabled | bool %}
|
{% if modifier_css_enabled | bool %}
|
||||||
{% include 'roles/webserver-injector-css/templates/location.conf.j2' %}
|
{% include 'roles/srv-web-injector-css/templates/location.conf.j2' %}
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|
||||||
{% if modifier_matomo_enabled %}
|
{% if modifier_matomo_enabled %}
|
||||||
{% include 'roles/webserver-injector-matomo/templates/matomo-tracking.conf.j2' %}
|
{% include 'roles/srv-web-injector-matomo/templates/matomo-tracking.conf.j2' %}
|
||||||
{% endif %}
|
{% endif %}
|
@ -26,4 +26,4 @@ galaxy_info:
|
|||||||
issue_tracker_url: https://s.veen.world/cymaisissues
|
issue_tracker_url: https://s.veen.world/cymaisissues
|
||||||
documentation: https://s.veen.world/cymais
|
documentation: https://s.veen.world/cymais
|
||||||
dependencies:
|
dependencies:
|
||||||
- webserver-core
|
- srv-web-core
|
@ -1,4 +1,4 @@
|
|||||||
# Load this role via webserver-injector-core for consistency
|
# Load this role via srv-web-injector-core for consistency
|
||||||
|
|
||||||
- name: Generate color palette with colorscheme-generator
|
- name: Generate color palette with colorscheme-generator
|
||||||
set_fact:
|
set_fact:
|
@ -25,4 +25,4 @@ galaxy_info:
|
|||||||
- security
|
- security
|
||||||
- postMessage
|
- postMessage
|
||||||
dependencies:
|
dependencies:
|
||||||
- webserver-core
|
- srv-web-core
|
@ -25,4 +25,4 @@ galaxy_info:
|
|||||||
issue_tracker_url: "https://s.veen.world/cymaisissues"
|
issue_tracker_url: "https://s.veen.world/cymaisissues"
|
||||||
|
|
||||||
dependencies:
|
dependencies:
|
||||||
- webserver-core
|
- srv-web-core
|
@ -1,3 +1,3 @@
|
|||||||
dependencies:
|
dependencies:
|
||||||
# - web-app-matomo Don't activate this otherwise the plays take super long
|
# - web-app-matomo Don't activate this otherwise the plays take super long
|
||||||
- webserver-core
|
- srv-web-core
|
@ -1,4 +1,4 @@
|
|||||||
# Load this role via webserver-injector-core for consistency
|
# Load this role via srv-web-injector-core for consistency
|
||||||
|
|
||||||
- name: "Relevant variables for role: {{ role_path | basename }}"
|
- name: "Relevant variables for role: {{ role_path | basename }}"
|
||||||
debug:
|
debug:
|
@ -16,7 +16,7 @@ The goal of this role is to deliver a **hassle-free, production-ready reverse pr
|
|||||||
|
|
||||||
## Features
|
## Features
|
||||||
|
|
||||||
- **Automatic TLS & HSTS** — integrates with the *webserver-https* role for certificate management.
|
- **Automatic TLS & HSTS** — integrates with the *srv-web-https* role for certificate management.
|
||||||
- **Flexible vHost templates** — *basic* and *ws_generic* flavours cover standard HTTP and WebSocket applications.
|
- **Flexible vHost templates** — *basic* and *ws_generic* flavours cover standard HTTP and WebSocket applications.
|
||||||
- **Security headers** — sensible defaults plus optional X-Frame-Options / CSP based on application settings.
|
- **Security headers** — sensible defaults plus optional X-Frame-Options / CSP based on application settings.
|
||||||
- **WebSocket & HTTP/2 aware** — upgrades, keep-alive tuning, and gzip already configured.
|
- **WebSocket & HTTP/2 aware** — upgrades, keep-alive tuning, and gzip already configured.
|
@ -25,4 +25,4 @@ galaxy_info:
|
|||||||
documentation: https://s.veen.world/cymais
|
documentation: https://s.veen.world/cymais
|
||||||
dependencies:
|
dependencies:
|
||||||
- docker
|
- docker
|
||||||
- webserver-https
|
- srv-web-https
|
@ -14,7 +14,7 @@ location {{location | default("/")}}
|
|||||||
proxy_set_header X-Forwarded-Port 443;
|
proxy_set_header X-Forwarded-Port 443;
|
||||||
proxy_set_header Accept-Encoding "";
|
proxy_set_header Accept-Encoding "";
|
||||||
|
|
||||||
{% include 'roles/webserver-proxy-core/templates/headers/content_security_policy.conf.j2' %}
|
{% include 'roles/srv-web-proxy-core/templates/headers/content_security_policy.conf.j2' %}
|
||||||
|
|
||||||
# WebSocket specific header
|
# WebSocket specific header
|
||||||
proxy_http_version 1.1;
|
proxy_http_version 1.1;
|
@ -6,7 +6,7 @@ server
|
|||||||
{% include 'roles/web-app-oauth2-proxy/templates/endpoint.conf.j2'%}
|
{% include 'roles/web-app-oauth2-proxy/templates/endpoint.conf.j2'%}
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|
||||||
{% include 'roles/webserver-injector-core/templates/global.includes.conf.j2'%}
|
{% include 'roles/srv-web-injector-core/templates/global.includes.conf.j2'%}
|
||||||
|
|
||||||
{% if nginx_docker_reverse_proxy_extra_configuration is defined %}
|
{% if nginx_docker_reverse_proxy_extra_configuration is defined %}
|
||||||
{# Additional Domain Specific Configuration #}
|
{# Additional Domain Specific Configuration #}
|
||||||
@ -22,38 +22,38 @@ server
|
|||||||
{# 1. Expose everything by default, then protect blacklisted paths #}
|
{# 1. Expose everything by default, then protect blacklisted paths #}
|
||||||
{% set oauth2_proxy_enabled = false %}
|
{% set oauth2_proxy_enabled = false %}
|
||||||
{% set location = "/" %}
|
{% set location = "/" %}
|
||||||
{% include 'roles/webserver-proxy-core/templates/location/proxy_basic.conf.j2' %}
|
{% include 'roles/srv-web-proxy-core/templates/location/proxy_basic.conf.j2' %}
|
||||||
|
|
||||||
{% for loc in acl.blacklist %}
|
{% for loc in acl.blacklist %}
|
||||||
{% set oauth2_proxy_enabled = true %}
|
{% set oauth2_proxy_enabled = true %}
|
||||||
{% set location = loc %}
|
{% set location = loc %}
|
||||||
{% include 'roles/webserver-proxy-core/templates/location/proxy_basic.conf.j2' %}
|
{% include 'roles/srv-web-proxy-core/templates/location/proxy_basic.conf.j2' %}
|
||||||
{% endfor %}
|
{% endfor %}
|
||||||
|
|
||||||
{% elif acl.whitelist is defined %}
|
{% elif acl.whitelist is defined %}
|
||||||
{# 2. Protect everything by default, then expose whitelisted paths #}
|
{# 2. Protect everything by default, then expose whitelisted paths #}
|
||||||
{% set oauth2_proxy_enabled = true %}
|
{% set oauth2_proxy_enabled = true %}
|
||||||
{% set location = "/" %}
|
{% set location = "/" %}
|
||||||
{% include 'roles/webserver-proxy-core/templates/location/proxy_basic.conf.j2' %}
|
{% include 'roles/srv-web-proxy-core/templates/location/proxy_basic.conf.j2' %}
|
||||||
|
|
||||||
{% for loc in acl.whitelist %}
|
{% for loc in acl.whitelist %}
|
||||||
{% set oauth2_proxy_enabled = false %}
|
{% set oauth2_proxy_enabled = false %}
|
||||||
{% set location = loc %}
|
{% set location = loc %}
|
||||||
{% include 'roles/webserver-proxy-core/templates/location/proxy_basic.conf.j2' %}
|
{% include 'roles/srv-web-proxy-core/templates/location/proxy_basic.conf.j2' %}
|
||||||
{% endfor %}
|
{% endfor %}
|
||||||
|
|
||||||
{% else %}
|
{% else %}
|
||||||
{# 3. OAuth2 enabled but no (or empty) ACL — protect all #}
|
{# 3. OAuth2 enabled but no (or empty) ACL — protect all #}
|
||||||
{% set oauth2_proxy_enabled = true %}
|
{% set oauth2_proxy_enabled = true %}
|
||||||
{% set location = "/" %}
|
{% set location = "/" %}
|
||||||
{% include 'roles/webserver-proxy-core/templates/location/proxy_basic.conf.j2' %}
|
{% include 'roles/srv-web-proxy-core/templates/location/proxy_basic.conf.j2' %}
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|
||||||
{% else %}
|
{% else %}
|
||||||
{# 4. OAuth2 completely disabled — expose all #}
|
{# 4. OAuth2 completely disabled — expose all #}
|
||||||
{% set oauth2_proxy_enabled = false %}
|
{% set oauth2_proxy_enabled = false %}
|
||||||
{% set location = "/" %}
|
{% set location = "/" %}
|
||||||
{% include 'roles/webserver-proxy-core/templates/location/proxy_basic.conf.j2' %}
|
{% include 'roles/srv-web-proxy-core/templates/location/proxy_basic.conf.j2' %}
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|
||||||
}
|
}
|
@ -7,7 +7,7 @@ server {
|
|||||||
server_name {{ domain }};
|
server_name {{ domain }};
|
||||||
|
|
||||||
{% include 'roles/network-letsencrypt/templates/ssl_header.j2' %}
|
{% include 'roles/network-letsencrypt/templates/ssl_header.j2' %}
|
||||||
{% include 'roles/webserver-injector-core/templates/global.includes.conf.j2' %}
|
{% include 'roles/srv-web-injector-core/templates/global.includes.conf.j2' %}
|
||||||
|
|
||||||
client_max_body_size {{ client_max_body_size | default('100m') }};
|
client_max_body_size {{ client_max_body_size | default('100m') }};
|
||||||
keepalive_timeout 70;
|
keepalive_timeout 70;
|
||||||
@ -24,7 +24,7 @@ server {
|
|||||||
|
|
||||||
add_header Strict-Transport-Security "max-age=31536000";
|
add_header Strict-Transport-Security "max-age=31536000";
|
||||||
|
|
||||||
{% include 'roles/webserver-proxy-core/templates/location/proxy_basic.conf.j2' %}
|
{% include 'roles/srv-web-proxy-core/templates/location/proxy_basic.conf.j2' %}
|
||||||
|
|
||||||
{% if ws_path is defined %}
|
{% if ws_path is defined %}
|
||||||
location {{ ws_path }} {
|
location {{ ws_path }} {
|
@ -6,11 +6,11 @@ This role bootstraps **per-domain Nginx configuration**: it requests TLS certifi
|
|||||||
|
|
||||||
## Overview
|
## Overview
|
||||||
|
|
||||||
A higher-level orchestration wrapper, *webserver-proxy-domain* ties together several lower-level roles:
|
A higher-level orchestration wrapper, *srv-web-proxy-domain* ties together several lower-level roles:
|
||||||
|
|
||||||
1. **`webserver-injector-core`** – applies global tweaks and includes.
|
1. **`srv-web-injector-core`** – applies global tweaks and includes.
|
||||||
2. **`webserver-tls-core`** – obtains Let’s Encrypt certificates.
|
2. **`srv-web-tls-core`** – obtains Let’s Encrypt certificates.
|
||||||
3. **Domain template deployment** – copies a Jinja2 vHost from *webserver-proxy-core*.
|
3. **Domain template deployment** – copies a Jinja2 vHost from *srv-web-proxy-core*.
|
||||||
4. **`web-app-oauth2-proxy`** *(optional)* – protects the site with OAuth2.
|
4. **`web-app-oauth2-proxy`** *(optional)* – protects the site with OAuth2.
|
||||||
|
|
||||||
The result is a complete, reproducible domain rollout in a single playbook task.
|
The result is a complete, reproducible domain rollout in a single playbook task.
|
@ -2,4 +2,4 @@
|
|||||||
vhost_flavour: "basic" # valid: basic | ws_generic
|
vhost_flavour: "basic" # valid: basic | ws_generic
|
||||||
|
|
||||||
# build the full template path from the flavour
|
# build the full template path from the flavour
|
||||||
vhost_template_src: "roles/webserver-proxy-core/templates/vhost/{{ vhost_flavour }}.conf.j2"
|
vhost_template_src: "roles/srv-web-proxy-core/templates/vhost/{{ vhost_flavour }}.conf.j2"
|
@ -24,4 +24,4 @@ galaxy_info:
|
|||||||
issue_tracker_url: https://s.veen.world/cymaisissues
|
issue_tracker_url: https://s.veen.world/cymaisissues
|
||||||
documentation: https://s.veen.world/cymais
|
documentation: https://s.veen.world/cymais
|
||||||
dependencies:
|
dependencies:
|
||||||
- webserver-core
|
- srv-web-core
|
@ -1,6 +1,6 @@
|
|||||||
- name: "include role for {{domain}} to receive certificates and do the modification routines"
|
- name: "include role for {{domain}} to receive certificates and do the modification routines"
|
||||||
include_role:
|
include_role:
|
||||||
name: webserver-composer
|
name: srv-web-composer
|
||||||
|
|
||||||
- name: "copy nginx domain configuration to {{ configuration_destination }}"
|
- name: "copy nginx domain configuration to {{ configuration_destination }}"
|
||||||
template:
|
template:
|
@ -21,7 +21,7 @@ This Ansible role simplifies the deployment of **Let's Encrypt certificates** in
|
|||||||
|
|
||||||
### **1️⃣ Main Tasks**
|
### **1️⃣ Main Tasks**
|
||||||
1. **Add Deployment Script**
|
1. **Add Deployment Script**
|
||||||
- Copies `webserver-proxy-tls-deploy.sh` to the administrator scripts directory.
|
- Copies `srv-web-proxy-tls-deploy.sh` to the administrator scripts directory.
|
||||||
|
|
||||||
2. **Create Certificate Directory**
|
2. **Create Certificate Directory**
|
||||||
- Ensures `cert_mount_directory` exists with proper permissions.
|
- Ensures `cert_mount_directory` exists with proper permissions.
|
||||||
@ -34,14 +34,14 @@ This Ansible role simplifies the deployment of **Let's Encrypt certificates** in
|
|||||||
|
|
||||||
### **2️⃣ Handlers**
|
### **2️⃣ Handlers**
|
||||||
- **Restart Nginx Service**
|
- **Restart Nginx Service**
|
||||||
- Restarts `webserver-proxy-tls-deploy` whenever a certificate update occurs.
|
- Restarts `srv-web-proxy-tls-deploy` whenever a certificate update occurs.
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## **🔧 Deploying Certificates into Docker Containers**
|
## **🔧 Deploying Certificates into Docker Containers**
|
||||||
The role **automates copying certificates** into Docker Compose setups.
|
The role **automates copying certificates** into Docker Compose setups.
|
||||||
|
|
||||||
### **1️⃣ Deployment Script (`webserver-proxy-tls-deploy.sh`)**
|
### **1️⃣ Deployment Script (`srv-web-proxy-tls-deploy.sh`)**
|
||||||
This script:
|
This script:
|
||||||
- **Copies certificates** to the correct container directory.
|
- **Copies certificates** to the correct container directory.
|
||||||
- **Reloads Nginx** inside all running containers.
|
- **Reloads Nginx** inside all running containers.
|
||||||
@ -49,7 +49,7 @@ This script:
|
|||||||
|
|
||||||
**Usage:**
|
**Usage:**
|
||||||
```sh
|
```sh
|
||||||
sh webserver-proxy-tls-deploy.sh primary_domain /path/to/docker/compose
|
sh srv-web-proxy-tls-deploy.sh primary_domain /path/to/docker/compose
|
||||||
```
|
```
|
||||||
|
|
||||||
---
|
---
|
7
roles/srv-web-proxy-tls-deploy/handlers/main.yml
Normal file
7
roles/srv-web-proxy-tls-deploy/handlers/main.yml
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
- name: "restart srv-web-proxy-tls-deploy.cymais.service"
|
||||||
|
systemd:
|
||||||
|
name: srv-web-proxy-tls-deploy.{{application_id}}.cymais.service
|
||||||
|
state: restarted
|
||||||
|
enabled: yes
|
||||||
|
daemon_reload: yes
|
@ -1,9 +1,9 @@
|
|||||||
- name: add webserver-proxy-tls-deploy.sh
|
- name: add srv-web-proxy-tls-deploy.sh
|
||||||
copy:
|
copy:
|
||||||
src: "webserver-proxy-tls-deploy.sh"
|
src: "srv-web-proxy-tls-deploy.sh"
|
||||||
dest: "{{nginx_docker_cert_deploy_script}}"
|
dest: "{{nginx_docker_cert_deploy_script}}"
|
||||||
when: run_once_nginx_docker_cert_deploy is not defined
|
when: run_once_nginx_docker_cert_deploy is not defined
|
||||||
notify: restart webserver-proxy-tls-deploy.cymais.service
|
notify: restart srv-web-proxy-tls-deploy.cymais.service
|
||||||
|
|
||||||
- name: run the nginx_docker_cert_deploy tasks once
|
- name: run the nginx_docker_cert_deploy tasks once
|
||||||
set_fact:
|
set_fact:
|
||||||
@ -15,18 +15,18 @@
|
|||||||
path: "{{cert_mount_directory}}"
|
path: "{{cert_mount_directory}}"
|
||||||
state: directory
|
state: directory
|
||||||
mode: 0755
|
mode: 0755
|
||||||
notify: restart webserver-proxy-tls-deploy.cymais.service
|
notify: restart srv-web-proxy-tls-deploy.cymais.service
|
||||||
|
|
||||||
- name: configure webserver-proxy-tls-deploy.cymais.service
|
- name: configure srv-web-proxy-tls-deploy.cymais.service
|
||||||
template:
|
template:
|
||||||
src: "webserver-proxy-tls-deploy.service.j2"
|
src: "srv-web-proxy-tls-deploy.service.j2"
|
||||||
dest: "/etc/systemd/system/webserver-proxy-tls-deploy.{{application_id}}.cymais.service"
|
dest: "/etc/systemd/system/srv-web-proxy-tls-deploy.{{application_id}}.cymais.service"
|
||||||
notify: restart webserver-proxy-tls-deploy.cymais.service
|
notify: restart srv-web-proxy-tls-deploy.cymais.service
|
||||||
|
|
||||||
- name: "include role for gen-timer for {{service_name}}"
|
- name: "include role for gen-timer for {{service_name}}"
|
||||||
include_role:
|
include_role:
|
||||||
name: gen-timer
|
name: gen-timer
|
||||||
vars:
|
vars:
|
||||||
on_calendar: "{{on_calendar_deploy_certificates}}"
|
on_calendar: "{{on_calendar_deploy_certificates}}"
|
||||||
service_name: "webserver-proxy-tls-deploy.{{application_id}}"
|
service_name: "srv-web-proxy-tls-deploy.{{application_id}}"
|
||||||
persistent: "true"
|
persistent: "true"
|
@ -4,4 +4,4 @@ OnFailure=alert-compose.cymais@%n.service
|
|||||||
|
|
||||||
[Service]
|
[Service]
|
||||||
Type=oneshot
|
Type=oneshot
|
||||||
ExecStart=/usr/bin/bash {{path_administrator_scripts}}/webserver-proxy-tls-deploy.sh {{ssl_cert_folder}} {{docker_compose.directories.instance}}
|
ExecStart=/usr/bin/bash {{path_administrator_scripts}}/srv-web-proxy-tls-deploy.sh {{ssl_cert_folder}} {{docker_compose.directories.instance}}
|
@ -1 +1 @@
|
|||||||
nginx_docker_cert_deploy_script: "{{path_administrator_scripts}}webserver-proxy-tls-deploy.sh"
|
nginx_docker_cert_deploy_script: "{{path_administrator_scripts}}srv-web-proxy-tls-deploy.sh"
|
@ -28,4 +28,4 @@ galaxy_info:
|
|||||||
issue_tracker_url: "https://s.veen.world/cymaisissues"
|
issue_tracker_url: "https://s.veen.world/cymaisissues"
|
||||||
documentation: "https://s.veen.world/cymais"
|
documentation: "https://s.veen.world/cymais"
|
||||||
dependencies:
|
dependencies:
|
||||||
- webserver-https
|
- srv-web-https
|
@ -1,6 +1,6 @@
|
|||||||
- name: "reload certbot service"
|
- name: "reload certbot service"
|
||||||
systemd:
|
systemd:
|
||||||
name: webserver-tls-renew.cymais.service
|
name: srv-web-tls-renew.cymais.service
|
||||||
state: reloaded
|
state: reloaded
|
||||||
enabled: yes
|
enabled: yes
|
||||||
daemon_reload: yes
|
daemon_reload: yes
|
@ -28,6 +28,6 @@ galaxy_info:
|
|||||||
documentation: "https://s.veen.world/cymais"
|
documentation: "https://s.veen.world/cymais"
|
||||||
dependencies:
|
dependencies:
|
||||||
- gen-certbot
|
- gen-certbot
|
||||||
- webserver-core
|
- srv-web-core
|
||||||
- alert-compose
|
- alert-compose
|
||||||
- cln-certs
|
- cln-certs
|
@ -5,10 +5,10 @@
|
|||||||
state: present
|
state: present
|
||||||
when: run_once_nginx_certbot is not defined
|
when: run_once_nginx_certbot is not defined
|
||||||
|
|
||||||
- name: configure webserver-tls-renew.cymais.service
|
- name: configure srv-web-tls-renew.cymais.service
|
||||||
template:
|
template:
|
||||||
src: webserver-tls-renew.service.j2
|
src: srv-web-tls-renew.service.j2
|
||||||
dest: /etc/systemd/system/webserver-tls-renew.cymais.service
|
dest: /etc/systemd/system/srv-web-tls-renew.cymais.service
|
||||||
notify: reload certbot service
|
notify: reload certbot service
|
||||||
when: run_once_nginx_certbot is not defined
|
when: run_once_nginx_certbot is not defined
|
||||||
|
|
@ -3,9 +3,9 @@
|
|||||||
include_role:
|
include_role:
|
||||||
name: service-rdbms-central
|
name: service-rdbms-central
|
||||||
|
|
||||||
- name: "include role webserver-proxy-domain for {{application_id}}"
|
- name: "include role srv-web-proxy-domain for {{application_id}}"
|
||||||
include_role:
|
include_role:
|
||||||
name: webserver-proxy-domain
|
name: srv-web-proxy-domain
|
||||||
vars:
|
vars:
|
||||||
domain: "{{ domains | get_domain(application_id) }}"
|
domain: "{{ domains | get_domain(application_id) }}"
|
||||||
http_port: "{{ ports.localhost.http[application_id] }}"
|
http_port: "{{ ports.localhost.http[application_id] }}"
|
||||||
|
@ -5,7 +5,7 @@
|
|||||||
|
|
||||||
- name: "include role for {{application_id}} to receive certs & do modification routines"
|
- name: "include role for {{application_id}} to receive certs & do modification routines"
|
||||||
include_role:
|
include_role:
|
||||||
name: webserver-composer
|
name: srv-web-composer
|
||||||
vars:
|
vars:
|
||||||
domain: "{{ item }}"
|
domain: "{{ item }}"
|
||||||
http_port: "{{ ports.localhost.http[application_id] }}"
|
http_port: "{{ ports.localhost.http[application_id] }}"
|
||||||
@ -15,7 +15,7 @@
|
|||||||
|
|
||||||
- name: configure {{domains | get_domain(application_id)}}.conf
|
- name: configure {{domains | get_domain(application_id)}}.conf
|
||||||
template:
|
template:
|
||||||
src: roles/webserver-proxy-core/templates/vhost/basic.conf.j2
|
src: roles/srv-web-proxy-core/templates/vhost/basic.conf.j2
|
||||||
dest: "{{nginx.directories.http.servers}}{{domains | get_domain(application_id)}}.conf"
|
dest: "{{nginx.directories.http.servers}}{{domains | get_domain(application_id)}}.conf"
|
||||||
notify: restart nginx
|
notify: restart nginx
|
||||||
|
|
||||||
|
@ -3,9 +3,9 @@
|
|||||||
include_role:
|
include_role:
|
||||||
name: service-rdbms-central
|
name: service-rdbms-central
|
||||||
|
|
||||||
- name: "include role webserver-proxy-domain for {{application_id}}"
|
- name: "include role srv-web-proxy-domain for {{application_id}}"
|
||||||
include_role:
|
include_role:
|
||||||
name: webserver-proxy-domain
|
name: srv-web-proxy-domain
|
||||||
vars:
|
vars:
|
||||||
domain: "{{ domains | get_domain(application_id) }}"
|
domain: "{{ domains | get_domain(application_id) }}"
|
||||||
http_port: "{{ ports.localhost.http[application_id] }}"
|
http_port: "{{ ports.localhost.http[application_id] }}"
|
@ -35,7 +35,7 @@ By default, BigBlueButton is deployed with best-practice hardening, modular secr
|
|||||||
## System Requirements
|
## System Requirements
|
||||||
|
|
||||||
- Arch Linux with Docker, Compose, and Nginx roles pre-installed
|
- Arch Linux with Docker, Compose, and Nginx roles pre-installed
|
||||||
- DNS and reverse proxy configuration using `webserver-proxy-core`
|
- DNS and reverse proxy configuration using `srv-web-proxy-core`
|
||||||
- Functional email system for Greenlight SMTP
|
- Functional email system for Greenlight SMTP
|
||||||
|
|
||||||
## Important Resources
|
## Important Resources
|
||||||
|
@ -17,9 +17,9 @@
|
|||||||
database_username: "postgres"
|
database_username: "postgres"
|
||||||
database_name: "" # Multiple databases
|
database_name: "" # Multiple databases
|
||||||
|
|
||||||
- name: "include role webserver-proxy-domain for {{application_id}}"
|
- name: "include role srv-web-proxy-domain for {{application_id}}"
|
||||||
include_role:
|
include_role:
|
||||||
name: webserver-proxy-domain
|
name: srv-web-proxy-domain
|
||||||
|
|
||||||
- name: pull docker repository
|
- name: pull docker repository
|
||||||
git:
|
git:
|
||||||
|
@ -2,9 +2,9 @@
|
|||||||
include_role:
|
include_role:
|
||||||
name: docker-compose
|
name: docker-compose
|
||||||
|
|
||||||
- name: "include role webserver-proxy-domain for {{application_id}}"
|
- name: "include role srv-web-proxy-domain for {{application_id}}"
|
||||||
include_role:
|
include_role:
|
||||||
name: webserver-proxy-domain
|
name: srv-web-proxy-domain
|
||||||
vars:
|
vars:
|
||||||
domain: "{{ item.domain }}"
|
domain: "{{ item.domain }}"
|
||||||
http_port: "{{ item.http_port }}"
|
http_port: "{{ item.http_port }}"
|
||||||
|
@ -3,13 +3,13 @@ server {
|
|||||||
|
|
||||||
{% include 'roles/network-letsencrypt/templates/ssl_header.j2' %}
|
{% include 'roles/network-letsencrypt/templates/ssl_header.j2' %}
|
||||||
|
|
||||||
{% include 'roles/webserver-injector-core/templates/global.includes.conf.j2'%}
|
{% include 'roles/srv-web-injector-core/templates/global.includes.conf.j2'%}
|
||||||
|
|
||||||
{% include 'roles/webserver-proxy-core/templates/headers/content_security_policy.conf.j2' %}
|
{% include 'roles/srv-web-proxy-core/templates/headers/content_security_policy.conf.j2' %}
|
||||||
|
|
||||||
{% include 'roles/webserver-proxy-core/templates/location/proxy_basic.conf.j2' %}
|
{% include 'roles/srv-web-proxy-core/templates/location/proxy_basic.conf.j2' %}
|
||||||
|
|
||||||
{% set location = '^~ /cool/' %}
|
{% set location = '^~ /cool/' %}
|
||||||
|
|
||||||
{% include 'roles/webserver-proxy-core/templates/location/proxy_basic.conf.j2' %}
|
{% include 'roles/srv-web-proxy-core/templates/location/proxy_basic.conf.j2' %}
|
||||||
}
|
}
|
@ -3,9 +3,9 @@
|
|||||||
include_role:
|
include_role:
|
||||||
name: service-rdbms-central
|
name: service-rdbms-central
|
||||||
|
|
||||||
- name: "include role webserver-proxy-domain for {{application_id}}"
|
- name: "include role srv-web-proxy-domain for {{application_id}}"
|
||||||
include_role:
|
include_role:
|
||||||
name: webserver-proxy-domain
|
name: srv-web-proxy-domain
|
||||||
vars:
|
vars:
|
||||||
domain: "{{ domains | get_domain(application_id) }}"
|
domain: "{{ domains | get_domain(application_id) }}"
|
||||||
http_port: "{{ ports.localhost.http[application_id] }}"
|
http_port: "{{ ports.localhost.http[application_id] }}"
|
||||||
|
@ -12,9 +12,9 @@
|
|||||||
name: service-rdbms-central
|
name: service-rdbms-central
|
||||||
when: run_once_docker_discourse is not defined
|
when: run_once_docker_discourse is not defined
|
||||||
|
|
||||||
- name: "include role webserver-proxy-domain for {{application_id}}"
|
- name: "include role srv-web-proxy-domain for {{application_id}}"
|
||||||
include_role:
|
include_role:
|
||||||
name: webserver-proxy-domain
|
name: srv-web-proxy-domain
|
||||||
vars:
|
vars:
|
||||||
domain: "{{ domains | get_domain(application_id) }}"
|
domain: "{{ domains | get_domain(application_id) }}"
|
||||||
http_port: "{{ ports.localhost.http[application_id] }}"
|
http_port: "{{ ports.localhost.http[application_id] }}"
|
||||||
|
@ -1,8 +1,8 @@
|
|||||||
---
|
---
|
||||||
|
|
||||||
- name: "include role webserver-proxy-domain for {{application_id}}"
|
- name: "include role srv-web-proxy-domain for {{application_id}}"
|
||||||
include_role:
|
include_role:
|
||||||
name: webserver-proxy-domain
|
name: srv-web-proxy-domain
|
||||||
vars:
|
vars:
|
||||||
domain: "{{ domains | get_domain(application_id) }}"
|
domain: "{{ domains | get_domain(application_id) }}"
|
||||||
http_port: "{{ ports.localhost.http[application_id] }}"
|
http_port: "{{ ports.localhost.http[application_id] }}"
|
||||||
|
@ -5,7 +5,7 @@
|
|||||||
|
|
||||||
- name: "Include setup for domain '{{ domain }}'"
|
- name: "Include setup for domain '{{ domain }}'"
|
||||||
include_role:
|
include_role:
|
||||||
name: webserver-proxy-domain
|
name: srv-web-proxy-domain
|
||||||
vars:
|
vars:
|
||||||
ws_path: "/ws"
|
ws_path: "/ws"
|
||||||
ws_port: "{{ ports.localhost.websocket[application_id] }}"
|
ws_port: "{{ ports.localhost.websocket[application_id] }}"
|
||||||
|
@ -14,9 +14,9 @@
|
|||||||
notify: docker compose up
|
notify: docker compose up
|
||||||
when: applications | is_feature_enabled('ldap',application_id)
|
when: applications | is_feature_enabled('ldap',application_id)
|
||||||
|
|
||||||
- name: "include role webserver-proxy-domain for {{application_id}}"
|
- name: "include role srv-web-proxy-domain for {{application_id}}"
|
||||||
include_role:
|
include_role:
|
||||||
name: webserver-proxy-domain
|
name: srv-web-proxy-domain
|
||||||
vars:
|
vars:
|
||||||
domain: "{{ domains | get_domain(application_id) }}"
|
domain: "{{ domains | get_domain(application_id) }}"
|
||||||
http_port: "{{ ports.localhost.http[application_id] }}"
|
http_port: "{{ ports.localhost.http[application_id] }}"
|
||||||
|
@ -3,9 +3,9 @@
|
|||||||
include_role:
|
include_role:
|
||||||
name: service-rdbms-central
|
name: service-rdbms-central
|
||||||
|
|
||||||
- name: "include role webserver-proxy-domain for {{application_id}}"
|
- name: "include role srv-web-proxy-domain for {{application_id}}"
|
||||||
include_role:
|
include_role:
|
||||||
name: webserver-proxy-domain
|
name: srv-web-proxy-domain
|
||||||
vars:
|
vars:
|
||||||
domain: "{{ domains | get_domain(application_id) }}"
|
domain: "{{ domains | get_domain(application_id) }}"
|
||||||
http_port: "{{ ports.localhost.http[application_id] }}"
|
http_port: "{{ ports.localhost.http[application_id] }}"
|
||||||
|
@ -9,7 +9,7 @@ This Ansible role deploys and configures [FusionDirectory](https://www.fusiondir
|
|||||||
- Loads and templating of FusionDirectory-specific variables
|
- Loads and templating of FusionDirectory-specific variables
|
||||||
- Generates a `.env` file for the container environment
|
- Generates a `.env` file for the container environment
|
||||||
- Deploys the FusionDirectory container via Docker Compose
|
- Deploys the FusionDirectory container via Docker Compose
|
||||||
- Configures NGINX (via the `webserver-proxy-domain` role) to expose the service
|
- Configures NGINX (via the `srv-web-proxy-domain` role) to expose the service
|
||||||
- Integrates with your central LDAP server for authentication
|
- Integrates with your central LDAP server for authentication
|
||||||
|
|
||||||
## Features
|
## Features
|
||||||
|
@ -2,9 +2,9 @@
|
|||||||
include_role:
|
include_role:
|
||||||
name: docker-compose
|
name: docker-compose
|
||||||
|
|
||||||
- name: "include role webserver-proxy-domain for {{application_id}}"
|
- name: "include role srv-web-proxy-domain for {{application_id}}"
|
||||||
include_role:
|
include_role:
|
||||||
name: webserver-proxy-domain
|
name: srv-web-proxy-domain
|
||||||
vars:
|
vars:
|
||||||
domain: "{{ domains | get_domain(application_id) }}"
|
domain: "{{ domains | get_domain(application_id) }}"
|
||||||
http_port: "{{ ports.localhost.http[application_id] }}"
|
http_port: "{{ ports.localhost.http[application_id] }}"
|
||||||
|
@ -3,9 +3,9 @@
|
|||||||
include_role:
|
include_role:
|
||||||
name: service-rdbms-central
|
name: service-rdbms-central
|
||||||
|
|
||||||
- name: "include role webserver-proxy-domain for {{application_id}}"
|
- name: "include role srv-web-proxy-domain for {{application_id}}"
|
||||||
include_role:
|
include_role:
|
||||||
name: webserver-proxy-domain
|
name: srv-web-proxy-domain
|
||||||
vars:
|
vars:
|
||||||
domain: "{{ domains | get_domain(application_id) }}"
|
domain: "{{ domains | get_domain(application_id) }}"
|
||||||
http_port: "{{ ports.localhost.http[application_id] }}"
|
http_port: "{{ ports.localhost.http[application_id] }}"
|
||||||
|
@ -3,9 +3,9 @@
|
|||||||
include_role:
|
include_role:
|
||||||
name: service-rdbms-central
|
name: service-rdbms-central
|
||||||
|
|
||||||
- name: "include role webserver-proxy-domain for {{application_id}}"
|
- name: "include role srv-web-proxy-domain for {{application_id}}"
|
||||||
include_role:
|
include_role:
|
||||||
name: webserver-proxy-domain
|
name: srv-web-proxy-domain
|
||||||
vars:
|
vars:
|
||||||
domain: "{{ domains | get_domain(application_id) }}"
|
domain: "{{ domains | get_domain(application_id) }}"
|
||||||
http_port: "{{ ports.localhost.http[application_id] }}"
|
http_port: "{{ ports.localhost.http[application_id] }}"
|
||||||
|
@ -1,2 +1,2 @@
|
|||||||
dependencies:
|
dependencies:
|
||||||
- webserver-proxy-core
|
- srv-web-proxy-core
|
||||||
|
@ -1,6 +1,6 @@
|
|||||||
- name: "include role webserver-proxy-domain for {{application_id}}"
|
- name: "include role srv-web-proxy-domain for {{application_id}}"
|
||||||
include_role:
|
include_role:
|
||||||
name: webserver-proxy-domain
|
name: srv-web-proxy-domain
|
||||||
vars:
|
vars:
|
||||||
domain: "{{ domains | get_domain(application_id) }}"
|
domain: "{{ domains | get_domain(application_id) }}"
|
||||||
http_port: "{{ ports.localhost.http[application_id] }}"
|
http_port: "{{ ports.localhost.http[application_id] }}"
|
||||||
|
@ -3,9 +3,9 @@
|
|||||||
include_role:
|
include_role:
|
||||||
name: service-rdbms-central
|
name: service-rdbms-central
|
||||||
|
|
||||||
- name: "include role webserver-proxy-domain for {{application_id}}"
|
- name: "include role srv-web-proxy-domain for {{application_id}}"
|
||||||
include_role:
|
include_role:
|
||||||
name: webserver-proxy-domain
|
name: srv-web-proxy-domain
|
||||||
vars:
|
vars:
|
||||||
domain: "{{ domains | get_domain(application_id) }}"
|
domain: "{{ domains | get_domain(application_id) }}"
|
||||||
http_port: "{{ ports.localhost.http[application_id] }}"
|
http_port: "{{ ports.localhost.http[application_id] }}"
|
||||||
|
@ -3,9 +3,9 @@
|
|||||||
include_role:
|
include_role:
|
||||||
name: service-rdbms-central
|
name: service-rdbms-central
|
||||||
|
|
||||||
- name: "include role webserver-proxy-domain for {{application_id}}"
|
- name: "include role srv-web-proxy-domain for {{application_id}}"
|
||||||
include_role:
|
include_role:
|
||||||
name: webserver-proxy-domain
|
name: srv-web-proxy-domain
|
||||||
vars:
|
vars:
|
||||||
domain: "{{ domains | get_domain(application_id) }}"
|
domain: "{{ domains | get_domain(application_id) }}"
|
||||||
http_port: "{{ ports.localhost.http[application_id] }}"
|
http_port: "{{ ports.localhost.http[application_id] }}"
|
||||||
|
@ -2,9 +2,9 @@
|
|||||||
include_role:
|
include_role:
|
||||||
name: docker-compose
|
name: docker-compose
|
||||||
|
|
||||||
- name: "include role webserver-proxy-domain for {{application_id}}"
|
- name: "include role srv-web-proxy-domain for {{application_id}}"
|
||||||
include_role:
|
include_role:
|
||||||
name: webserver-proxy-domain
|
name: srv-web-proxy-domain
|
||||||
vars:
|
vars:
|
||||||
domain: "{{ domains | get_domain(application_id) }}"
|
domain: "{{ domains | get_domain(application_id) }}"
|
||||||
http_port: "{{ ports.localhost.http[application_id] }}"
|
http_port: "{{ ports.localhost.http[application_id] }}"
|
||||||
|
@ -13,9 +13,9 @@
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
- name: "include role webserver-proxy-domain for {{application_id}}"
|
- name: "include role srv-web-proxy-domain for {{application_id}}"
|
||||||
include_role:
|
include_role:
|
||||||
name: webserver-proxy-domain
|
name: srv-web-proxy-domain
|
||||||
vars:
|
vars:
|
||||||
domain: "{{ domains | get_domain(application_id) }}"
|
domain: "{{ domains | get_domain(application_id) }}"
|
||||||
http_port: "{{ ports.localhost.http[application_id] }}"
|
http_port: "{{ ports.localhost.http[application_id] }}"
|
||||||
|
@ -12,9 +12,9 @@
|
|||||||
""
|
""
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|
||||||
- name: "include role webserver-proxy-domain for {{application_id}}"
|
- name: "include role srv-web-proxy-domain for {{application_id}}"
|
||||||
include_role:
|
include_role:
|
||||||
name: webserver-proxy-domain
|
name: srv-web-proxy-domain
|
||||||
vars:
|
vars:
|
||||||
domain: "{{ domains | get_domain(application_id) }}"
|
domain: "{{ domains | get_domain(application_id) }}"
|
||||||
http_port: "{{ ports.localhost.http[application_id] }}"
|
http_port: "{{ ports.localhost.http[application_id] }}"
|
||||||
|
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user