In variant 1, sys-stk-front-base loads web-opt-rdr-domains for the
redirect set; its `include_tasks` loop sets `domain` from each
`item.source`. Ansible's include_tasks vars precedence (22) outranks the
task-level `vars:` block (17) on the subsequent "Deploy NGINX config"
task in sys-stk-front-proxy, so role-specific proxy.conf.j2 templates
that reference `{{ domain }}` directly render with the leaked redirect
source instead of the deployed app's domain. nginx then has no server
block for the intended SNI → sys-ctl-hlth-webserver fails with
TLSV1_UNRECOGNIZED_NAME and the deploy aborts at sys-service-terminator.
The generic vhost template `sys-svc-proxy/templates/vhost/basic.conf.j2`
already carries the canonical workaround (lines 1-2):
{% set application_id = front_proxy_application_id | default(application_id) %}
{% set domain = front_proxy_domain | default(domain) %}
Apply the same rebind to the role-specific proxy.conf.j2 of web-svc-html
(both rebinds missing) and web-svc-file (application_id rebind already
present, domain rebind missing). `front_proxy_domain` is set_fact-frozen
at the start of sys-stk-front-proxy from the outer load_app context and
verified correct in the run log (line 390447, html job in variant 1).
Unblocks 4/5 cluster-2 jobs on run 26362676803:
* web-svc-html (77602110571) — direct
* web-svc-file (77602110558) — direct
* web-svc-asset (77602110556) — variant-1 bundle [asset, file]
* web-svc-legal (77602110552) — variant-1 bundle [legal, html]
web-svc-xmpp (77602110559) has a separate failure mode (HTTP 404, not
SNI mismatch) and is not addressed here.
Static check only (per operator request).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
with explicit per-application TLS resolution.
Key changes:
- Introduce sys-front-tls-layer as the single TLS abstraction
- Centralize certificate paths via TLS_CERT_FILE / TLS_KEY_FILE / TLS_CA_FILE
- Replace sys-svc-letsencrypt SSL templates with generic TLS layer includes
- Add tls_* Jinja filters (enabled, mode, protocol, port, websocket)
- Resolve TLS mode per application (letsencrypt | self_signed | off)
- Remove implicit defaults and WEB_* globals to fail fast on misconfiguration
- Support self-signed certificates with SAN awareness
- Make TLS behavior explicit and consistent across all roles
This decouples application logic from certificate providers and
allows switching TLS flavor without touching app roles.
https://chatgpt.com/share/69727c61-8e68-800f-a267-473a7e627978
Unify reverse proxy handling across apps via sys-stk-front-proxy and cleanly separate internal docker nginx configs from external vhosts.
Changes:
- docker-compose: use with_first_found for optional env and docker-compose.override files so roles can provide either a template or a static file without noisy 'Could not find or access' failures.
- sys-stk-front-proxy: remove front_proxy_domain_conf_src and switch nginx vhost rendering to with_first_found over app-specific proxy.conf.j2 and the generic roles/sys-svc-proxy vhost flavour; keep health-check and handler logic unchanged.
- web-app-nextcloud: migrate to sys-stk-full-stateful (front proxy + DB + docker), move internal nginx config to docker.conf.j2 under the volume path, and rename host.conf.j2 to proxy.conf.j2 for the external vhost.
- web-app-magento: rename nginx.conf.j2 to docker.conf.j2 and update the runtime template task accordingly to make the intent (internal nginx) explicit.
- web-app-matrix: rename nginx.conf.j2 to synapse.conf.j2 and adjust the webserver task to use the new template name for the synapse vhost.
- web-app-bridgy-fed & web-app-flowise: pass domain and http_port explicitly when including sys-stk-front-proxy so the front stack has all required context.
- web-svc-cdn/file/html: replace direct sys-stk-front-base + sys-util-csp-cert + nginx.conf.j2 handling with sys-stk-front-proxy and proxy.conf.j2, relying on the shared front-stack for TLS/CSP/vHost wiring.
- web-svc-collabora: drop the direct nginx.conf.j2 vhost generation and rename it to proxy.conf.j2 so it is picked up by sys-stk-front-proxy like other services.
- web-opt-rdr-domains: rename redirect.domain.nginx.conf.j2 to redirect-domain.conf.j2 and adjust the task for clearer and more consistent naming.
Context: see ChatGPT refactor discussion on 2025-11-30 (proxy unification, Collabora/Nextcloud/CDN stacks, CSP/header handling): https://chatgpt.com/share/692c64ea-a488-800f-ad42-7f7692a3742f
kevinveenbirkenbachandClaude Opus 4.7