Matrix draft

README.md

@@ -152,7 +152,7 @@ Focuses on web server roles and applications, covering SSL certificates, Nginx c
 - **[Nginx-Https](./roles/nginx-https/)**: Enables HTTPS configuration for Nginx.
 - **[Nginx-Matomo-Tracking](./roles/nginx-matomo-tracking/)**: Integrates Matomo tracking with Nginx.
 - **[Nginx-Redirect](./roles/nginx-domain-redirect/)**: Manages URL redirects in Nginx.
-- **[Certbot Nginx](./roles/certbot-nginx/)**: Integrates Certbot with Nginx for SSL certificates.
+- **[Certbot Nginx](./roles/nginx-certbot/)**: Integrates Certbot with Nginx for SSL certificates.
 - **[Postfix](./roles/postfix/)**: Setup for the Postfix mail transfer agent.
 
 #### Docker and Containerization

group_vars/all

@@ -50,9 +50,10 @@ domain_mailu:                   "mail.{{top_domain}}"
 domain_mastodon:                "microblog.{{top_domain}}"
 domains_mastodon_alternates:    []
 domain_matomo:                  "matomo.{{top_domain}}"
+domain_matrix:                  "chat.{{top_domain}}"
 domain_mediawiki:               "wiki.{{top_domain}}"
 domain_nextcloud:               "cloud.{{top_domain}}"
-domain_pixelfed:               "pictures.{{top_domain}}"
+domain_pixelfed:                "pictures.{{top_domain}}"
 domains_pixelfed:               []
 domain_peertube:                "videos.{{top_domain}}"
 domains_peertube:               []
@@ -73,6 +74,7 @@ redirect_domain_mappings:
 - { source: "peertube.{{top_domain}}", target: "videos.{{top_domain}}" }
 - { source: "funkwhale.{{top_domain}}", target: "music.{{top_domain}}" }
 - { source: "pixelfed.{{top_domain}}", target: "pictures.{{top_domain}}" }
+- { source: "matrix.{{top_domain}}", target: "chat.{{top_domain}}" }
 
 nginx_configuration_directory:  "/etc/nginx/conf.d/"
 nginx_servers_directory:        "{{nginx_configuration_directory}}servers/"

playbook-servers.yml

@@ -200,6 +200,15 @@
         domains:  "{{domains_discourse}}"
         http_port: 8020
 
+- name: setup matrix
+  hosts: matrix
+  become: true
+  roles:
+   -  role: docker-matrix
+      vars:
+        domain:   "{{domain_matrix}}"
+        http_port: 8021
+
 - name: setup akaunting hosts
   hosts: akaunting
   become: true

roles/backup-docker-to-local/tasks/main.yml

@@ -4,6 +4,7 @@
       - lsof
       - python-pandas
     state: present
+  when: run_once_backup_docker_to_local is not defined
 
 - name: pull backup-docker-to-local.git
   git:
@@ -12,23 +13,26 @@
     update: yes
   register: git_result
   ignore_errors: true
+  when: run_once_backup_docker_to_local is not defined
 
 - name: Warn if repo is not reachable
   debug:
     msg: "Warning: Repository is not reachable."
-  when: git_result.failed
+  when: git_result is defined and git_result.failed is defined and run_once_cleanup_failed_docker_backups is not defined
 
 - name: configure backup-docker-to-local.service
   template: 
     src: backup-docker-to-local.service.j2
     dest: /etc/systemd/system/backup-docker-to-local.service
   notify: reload backup-docker-to-local.service
+  when: run_once_backup_docker_to_local is not defined
 
 - name: configure backup-docker-to-local.timer.tpl
   template: src=backup-docker-to-local.timer.j2 dest=/etc/systemd/system/backup-docker-to-local.timer
   register: backup_docker_to_local_timer
   changed_when: backup_docker_to_local_timer.changed or activate_all_timers | default(false) | bool
   notify: restart backup-docker-to-local.timer
+  when: run_once_backup_docker_to_local is not defined
 
 - name: create {{backup_docker_to_local_folder}}databases.csv
   copy:
@@ -36,3 +40,9 @@
     dest: "{{backup_docker_to_local_folder}}databases.csv"
     owner: root
     group: root
+  when: run_once_backup_docker_to_local is not defined
+
+- name: run the backup_docker_to_local tasks once
+  set_fact:
+    run_once_backup_docker_to_local: true
+  when: run_once_backup_docker_to_local is not defined

roles/backups-provider-user/tasks/main.yml

@@ -2,6 +2,7 @@
   user:
     name: backup
     create_home: yes
+  when: run_once_backups_provider_user is not defined
 
 - name: create .ssh directory
   file:
@@ -10,6 +11,7 @@
     owner: backup
     group: backup
     mode: '0700'
+  when: run_once_backups_provider_user is not defined
 
 - name: create /home/backup/.ssh/authorized_keys
   template:
@@ -18,6 +20,7 @@
     owner: backup
     group: backup
     mode: '0644'
+  when: run_once_backups_provider_user is not defined
 
 - name: create /home/backup/ssh-wrapper.sh
   copy:
@@ -26,6 +29,7 @@
     owner: backup
     group: backup
     mode: '0700'
+  when: run_once_backups_provider_user is not defined
 
 - name: grant backup sudo rights
   copy:
@@ -35,3 +39,9 @@
     owner: root
     group: root
   notify: sshd restart
+  when: run_once_backups_provider_user is not defined
+  
+- name: run the backups_provider_user tasks once
+  set_fact:
+    run_once_backups_provider_user: true
+  when: run_once_backups_provider_user is not defined

roles/cleanup-backups-service/tasks/main.yml

@@ -4,20 +4,29 @@
       - lsof
       - python-psutil
     state: present
+  when: run_once_cleanup_backups_service is not defined
 
 - name: "create {{docker_cleanup_backups}}"
   file:
     path: "{{docker_cleanup_backups}}"
     state: directory
     mode: 0755
+  when: run_once_cleanup_backups_service is not defined
 
 - name: create cleanup-backups.py
   copy: 
     src:  "cleanup-backups.py"
     dest: "{{docker_cleanup_backups}}cleanup-backups.py"
+  when: run_once_cleanup_backups_service is not defined
 
 - name: create cleanup-backups.service
   template: 
     src:  "cleanup-backups.service.j2"
     dest: "/etc/systemd/system/cleanup-backups.service"
   notify: reload cleanup-backups.service
+  when: run_once_cleanup_backups_service is not defined
+
+- name: run the cleanup_backups_service tasks once
+  set_fact:
+    run_once_cleanup_backups_service: true
+  when: run_once_cleanup_backups_service is not defined

roles/cleanup-backups-timer/handlers/main.yml

@@ -4,3 +4,9 @@
     state: restarted
     enabled: yes
     daemon_reload: yes
+  when: run_once_cleanup_backup_timer is not defined
+
+- name: run the cleanup_backup_timer tasks once
+  set_fact:
+    run_once_cleanup_backup_timer: true
+  when: run_once_cleanup_backup_timer is not defined

roles/cleanup-backups-timer/tasks/main.yml

@@ -5,3 +5,9 @@
   register: cleanup_backups_timer
   changed_when: cleanup_backups_timer.changed or activate_all_timers | default(false) | bool
   notify: restart cleanup-backups.timer
+  when: run_once_cleanup_backups_timer is not defined
+
+- name: run the cleanup_backups_timer tasks once
+  set_fact:
+    run_once_cleanup_backups_timer: true
+  when: run_once_cleanup_backups_timer is not defined

roles/cleanup-failed-docker-backups/tasks/main.yml

@@ -5,14 +5,21 @@
     update: yes
   register: git_result
   ignore_errors: true
+  when: run_once_cleanup_failed_docker_backups is not defined
 
 - name: Warn if repo is not reachable
   debug:
     msg: "Warning: Repository is not reachable."
-  when: git_result.failed
+  when: git_result is defined and git_result.failed is defined and run_once_cleanup_failed_docker_backups is not defined
 
 - name: configure cleanup-failed-docker-backups.service
   template: 
     src: cleanup-failed-docker-backups.service.j2
     dest: /etc/systemd/system/cleanup-failed-docker-backups.service
   notify: reload cleanup-failed-docker-backups.service daemon
+  when: run_once_cleanup_failed_docker_backups is not defined
+
+- name: run the cleanup_failed_docker_backups tasks once
+  set_fact:
+    run_once_cleanup_failed_docker_backups: true
+  when: run_once_cleanup_failed_docker_backups is not defined

roles/docker-discourse/templates/app.yml.j2

@@ -99,6 +99,16 @@ hooks:
         cd: $home/plugins
         cmd:
           - git clone https://github.com/discourse/docker_manager.git
+          - git clone https://github.com/discourse/discourse-activity-pub.git
+          - git clone https://github.com/discourse/discourse-calendar.git
+          - git clone https://github.com/discourse/discourse-akismet.git
+          - git clone https://github.com/discourse/discourse-cakeday.git
+          - git clone https://github.com/discourse/discourse-solved.git
+          - git clone https://github.com/discourse/discourse-voting.git
+          - git clone https://github.com/gdpelican/retort.git
+          - git clone https://github.com/discourse/discourse-oauth2-basic.git
+          - git clone https://github.com/discourse/discourse-openid-connect.git
+          - git clone https://github.com/jonmbake/discourse-ldap-auth
 
 ## Any custom commands to run after building
 run:

roles/docker-funkwhale/templates/docker-compose.yml.j2

@@ -6,7 +6,7 @@ services:
     env_file: .env
     environment:
       - "POSTGRES_HOST_AUTH_METHOD=trust"
-    image: postgres:15-alpine
+    image: postgres:alpine
     volumes:
       - database:/var/lib/postgresql/data
 

roles/docker-listmonk/templates/docker-compose.yml.j2

@@ -1,7 +1,3 @@
-# NOTE: This docker-compose.yml is meant to be just an example guideline
-# on how you can achieve the same. It is not intented to run out of the box
-# and you must edit the below configurations to suit your needs.
-
 version: "3.7"
 
 x-application-defaults: &application-defaults
@@ -15,7 +11,7 @@ x-application-defaults: &application-defaults
     - TZ=Etc/UTC
 
 x-database-defaults: &database-defaults
-  image: postgres:13-alpine
+  image: postgres:alpine
   ports:
     - "9432:5432"
   networks:

roles/docker-mastodon/templates/docker-compose.yml.j2

@@ -2,7 +2,7 @@ version: '3'
 services:
   database:
     restart: always
-    image: postgres:14-alpine
+    image: postgres:alpine
     shm_size: 256mb
     networks:
       - internal_network

roles/docker-matrix/handlers/main.yml

@@ -0,0 +1,8 @@
+---
+- name: recreate matrix
+  command:
+    cmd: docker-compose up -d --force-recreate
+    chdir: "{{docker_compose_instance_directory}}"
+  environment:
+    COMPOSE_HTTP_TIMEOUT: 600
+    DOCKER_CLIENT_TIMEOUT: 600

roles/docker-matrix/meta/main.yml

@@ -0,0 +1,2 @@
+dependencies:
+- nginx-docker-reverse-proxy

roles/docker-matrix/tasks/main.yml

@@ -0,0 +1,33 @@
+---
+- name: "include tasks nginx-docker-proxy-domain.yml"
+  include_tasks: nginx-docker-proxy-domain.yml
+
+- name: "create {{docker_compose_instance_directory}}"
+  file:
+    path: "{{docker_compose_instance_directory}}"
+    state: directory
+    mode: 0755
+
+- name: add homeserver.yaml
+  template: 
+    src:  "homeserver.yaml.j2" 
+    dest: "{{docker_compose_instance_directory}}homeserver.yaml"
+  notify: recreate matrix
+
+- name: add log.config
+  template: 
+    src:  "log.config.j2" 
+    dest: "{{docker_compose_instance_directory}}{{domain}}.log.config"
+  notify: recreate matrix
+
+# https://github.com/matrix-org/synapse/issues/6303
+- name: set correct folder permissions
+  command:
+    cmd: "docker run --rm --mount type=volume,src=matrix_data,dst=/data -e SYNAPSE_SERVER_NAME={{domain}} -e SYNAPSE_REPORT_STATS=no --entrypoint /bin/sh matrixdotorg/synapse:latest -c 'chown -vR 991:991 /data'"
+    chdir: "{{path_docker_compose_instances}}baserow/"
+
+- name: add docker-compose.yml
+  template: 
+    src:  "docker-compose.yml.j2" 
+    dest: "{{docker_compose_instance_directory}}docker-compose.yml"
+  notify: recreate matrix

roles/docker-matrix/templates/docker-compose.yml.j2

@@ -0,0 +1,45 @@
+version: '3.1'
+
+services:
+  
+  application:
+    image: matrixdotorg/synapse:latest
+    restart: unless-stopped
+    logging:
+      driver: journald
+    volumes:
+      - data:/data
+      - ./homeserver.yaml:/data/homeserver.yaml:ro
+      - ./{{domain}}.log.config:/data/{{domain}}.log.config:ro
+    environment:
+      - SYNAPSE_SERVER_NAME={{domain}}
+      - SYNAPSE_REPORT_STATS=no
+    ports:
+      - "127.0.0.1:{{http_port}}:8008"
+    depends_on:
+      - database
+
+  database:
+    logging:
+        driver: journald
+    image: postgres:alpine
+    restart: unless-stopped
+    volumes:
+      - database:/var/lib/postgresql/data
+    environment:
+      - POSTGRES_DB=matrix
+      - POSTGRES_USER=matrix
+      - POSTGRES_PASSWORD={{matrix_database_password}}
+      - POSTGRES_INITDB_ARGS='--encoding=UTF-8 --lc-collate=C --lc-ctype=C'
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U matrix"]
+      interval: 10s
+      timeout: 5s
+      retries: 6
+
+volumes:
+  database:
+  data:
+networks:
+  default:
+    driver: bridge

roles/docker-matrix/templates/homeserver.yaml.j2

@@ -0,0 +1,28 @@
+server_name: "{{domain}}"
+pid_file: /data/homeserver.pid
+listeners:
+  - port: 8008
+    tls: false
+    type: http
+    x_forwarded: true
+    resources:
+      - names: [client, federation]
+        compress: false
+database:
+  name: psycopg2
+  args:
+    user: matrix
+    password: {{matrix_database_password}}
+    database: matrix
+    host: database
+    cp_min: 5
+    cp_max: 10
+log_config:                     "/data/{{domain}}.log.config"
+media_store_path:               /data/media_store
+registration_shared_secret:     "{{matrix_registration_shared_secret}}"
+report_stats:                   true
+macaroon_secret_key:            "{{matrix_macaroon_secret_key}}"
+form_secret:                    "{{matrix_form_secret}}"
+signing_key_path:               "/data/{{domain}}.signing.key"
+trusted_key_servers:
+  - server_name: "matrix.org"

roles/docker-matrix/templates/log.config.j2

@@ -0,0 +1,25 @@
+version: 1
+
+formatters:
+  precise:
+    format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
+
+handlers:
+  file:
+    class: logging.handlers.RotatingFileHandler
+    formatter: precise
+    filename: /data/{{ domain }}.homeserver.log
+    maxBytes: 10485760
+    backupCount: 3
+  console:
+    class: logging.StreamHandler
+    formatter: precise
+
+loggers:
+  synapse:
+    level: INFO
+    handlers: [file, console]
+
+root:
+  level: INFO
+  handlers: [file, console]

roles/docker-matrix/vars/main.yml

@@ -0,0 +1,2 @@
+---
+docker_compose_instance_directory: "{{path_docker_compose_instances}}matrix/"

roles/docker-mybb/templates/docker-compose.yml.j2

@@ -34,10 +34,15 @@ services:
       POSTGRES_DB: mybb
       POSTGRES_PASSWORD: "{{mybb_database_password}}"
       POSTGRES_USER: mybb
-    image: postgres:14-alpine
+    image: postgres:alpine
     volumes:
     - database:/var/lib/postgresql/data:rw
     restart: always
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U mybb"]
+      interval: 10s
+      timeout: 5s
+      retries: 6
 volumes:
   database:
   data:

roles/docker-peertube/templates/docker-compose.yml.j2

@@ -17,14 +17,19 @@ services:
       - redis
     restart: "always"
   database:
-    image: postgres:13-alpine
+    image: postgres:alpine
     env_file:
       - .env
     volumes:
       - database:/var/lib/postgresql/data
     restart: "always"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U peertube"]
+      interval: 10s
+      timeout: 5s
+      retries: 6
   redis:
-    image: redis:6-alpine
+    image: redis:alpine
     volumes:
       - redis:/data
     restart: "always"

roles/docker/tasks/main.yml

@@ -5,6 +5,7 @@
     name: ['docker','docker-compose']
     state: present
   notify: docker restart
+  when: run_once_docker is not defined
 
 - name: "create {{path_docker_compose_instances}}"
   file:
@@ -13,6 +14,7 @@
     mode: 0700
     owner: administrator
     group: administrator
+  when: run_once_docker is not defined
 
 - name: "create {{path_docker_volumes}}"
   file:
@@ -21,6 +23,13 @@
     mode: 0700
     owner: administrator
     group: administrator
+  when: run_once_docker is not defined
 
 - name: flush docker service
   meta: flush_handlers
+  when: run_once_docker is not defined
+
+- name: run the docker tasks once
+  set_fact:
+    run_once_docker: true
+  when: run_once_docker is not defined

roles/git/tasks/main.yml

@@ -1,2 +1,8 @@
 - name: install git
   pacman: name=git state=present
+  when: run_once_git is not defined
+
+- name: run the git tasks once
+  set_fact:
+    run_once_git: true
+  when: run_once_git is not defined

roles/heal-docker/tasks/main.yml

@@ -3,17 +3,20 @@
     path: "{{heal_docker}}"
     state: directory
     mode: 0755
+  when: run_once_heal_docker is not defined
 
 - name: create heal-docker.py
   copy:
     src: heal-docker.py
     dest: "{{heal_docker}}heal-docker.py"
+  when: run_once_heal_docker is not defined
 
 - name: create heal-docker.service
   template: 
     src: heal-docker.service.j2 
     dest: /etc/systemd/system/heal-docker.service
   notify: reload heal-docker.service
+  when: run_once_heal_docker is not defined
 
 - name: create heal-docker.timer
   template:
@@ -22,3 +25,9 @@
   register: heal_docker_timer
   changed_when: heal_docker_timer.changed or activate_all_timers | default(false) | bool
   notify: restart heal-docker.timer
+  when: run_once_heal_docker is not defined
+
+- name: run the heal_docker tasks once
+  set_fact:
+    run_once_heal_docker: true
+  when: run_once_heal_docker is not defined

roles/health-docker-container/tasks/main.yml

@@ -3,15 +3,18 @@
     path: "{{health_docker_container_folder}}"
     state: directory
     mode: 0755
+  when: run_once_health_docker_container is not defined
 
 - name: create health-docker-container.sh
   copy:
     src: health-docker-container.sh
     dest: "{{health_docker_container_folder}}health-docker-container.sh"
+  when: run_once_health_docker_container is not defined
 
 - name: create health-docker-container.service
   template: src=health-docker-container.service.j2 dest=/etc/systemd/system/health-docker-container.service
   notify: reload health-docker-container.service
+  when: run_once_health_docker_container is not defined
 
 - name: create health-docker-container.timer
   template:
@@ -20,3 +23,9 @@
   register: health_docker_container_timer
   changed_when: health_docker_container_timer.changed or activate_all_timers | default(false) | bool
   notify: restart health-docker-container.timer
+  when: run_once_health_docker_container is not defined
+
+- name: run the health_docker_container tasks once
+  set_fact:
+    run_once_health_docker_container: true
+  when: run_once_health_docker_container is not defined

roles/health-docker-volumes/tasks/main.yml

@@ -3,15 +3,18 @@
     path: "{{health_docker_volumes_folder}}"
     state: directory
     mode: 0755
+  when: run_once_health_docker_volumes is not defined
 
 - name: create health-docker-volumes.sh
   copy:
     src: health-docker-volumes.sh
     dest: "{{health_docker_volumes_folder}}health-docker-volumes.sh"
+  when: run_once_health_docker_volumes is not defined
 
 - name: create health-docker-volumes.service
   template: src=health-docker-volumes.service.j2 dest=/etc/systemd/system/health-docker-volumes.service
   notify: reload health-docker-volumes.service
+  when: run_once_health_docker_volumes is not defined
 
 - name: create health-docker-volumes.timer
   template:
@@ -20,3 +23,9 @@
   register: health_docker_volumes_timer
   changed_when: health_docker_volumes_timer.changed or activate_all_timers | default(false) | bool
   notify: restart health-docker-volumes.timer
+  when: run_once_health_docker_volumes is not defined
+
+- name: run the health_docker_volumes tasks once
+  set_fact:
+    run_once_health_docker_volumes: true
+  when: run_once_health_docker_volumes is not defined

roles/health-nginx/files/health-nginx.py

@@ -1,58 +0,0 @@
-import os
-import requests
-import sys
-import re
-
-# Set up argument parser
-parser = argparse.ArgumentParser(description='Check if domains of nginx configuration files respond with the correct status code.')
-parser.add_argument('config_path', help='Path to the nginx configuration directory')
-args = parser.parse_args()
-
-# Use the provided argument for the config path
-config_path = args.config_path
-
-# Initialize the error counter
-error_counter = 0
-
-# Regex pattern to match domain.tld or subdomain.domain.tld
-pattern = re.compile(r"^(?:[\w-]+\.)?[\w-]+\.[\w-]+\.conf$")
-
-# Iterate over each file in the configuration directory
-for filename in os.listdir(config_path):
-    if filename.endswith('.conf') and pattern.match(filename):
-        # Extract the domain and subdomain from the filename
-        name = filename.replace('.conf', '')
-        parts = name.split('.')
-        
-        # Prepare the URL and expected status codes
-        url = f"https://{name}"
-        
-        # Default: Expect status code 200 for a domain
-        expected_statuses = [200]
-        
-        # Determine expected status codes based on subdomain
-        if len(parts) == 3:
-            if parts[0] == 'listmonk':
-                expected_statuses = [401]
-            elif parts[0] == 'www':
-                expected_statuses = [200,301]
-            elif parts[0] == 's':
-                expected_statuses = [403]
-
-        try:
-            # Send a HEAD request to get only the response header
-            response = requests.head(url, allow_redirects=True)
-
-            # Check if the status code matches the expected statuses
-            if response.status_code in expected_statuses:
-                print(f"{name}: ok")
-            else:
-                print(f"{name}: error")
-                error_counter += 1
-        except requests.RequestException as e:
-            # Handle exceptions for requests like connection errors
-            print(f"{name}: error due to {e}")
-            error_counter += 1
-
-# Exit the script with the number of errors as the exit code
-sys.exit(error_counter)

roles/health-nginx/tasks/main.yml

@@ -2,23 +2,27 @@
   pacman:
     name: python-requests
     state: present
+  when: run_once_health_nginx is not defined
 
 - name: "create {{ health_nginx_folder }}"
   file:
     path: "{{ health_nginx_folder }}"
     state: directory
     mode: 0755
+  when: run_once_health_nginx is not defined
 
 - name: create health-nginx.py
-  copy:
-    src: health-nginx.py
+  template:
+    src: health-nginx.py.j2
     dest: "{{ health_nginx_folder }}health-nginx.py"
+  when: run_once_health_nginx is not defined
 
 - name: create health-nginx.service
   template: 
     src: health-nginx.service.j2
     dest: /etc/systemd/system/health-nginx.service
   notify: reload health-nginx.service
+  when: run_once_health_nginx is not defined
 
 - name: create health-nginx.timer
   template:
@@ -27,3 +31,10 @@
   register: health_nginx_timer
   changed_when: health_nginx_timer.changed or activate_all_timers | default(false) | bool
   notify: restart health-nginx.timer
+  when: run_once_health_nginx is not defined
+
+- name: run the health_nginx tasks once
+  set_fact:
+    run_once_health_nginx: true
+  when: run_once_health_nginx is not defined
+

roles/health-nginx/templates/health-nginx.py.j2

@@ -0,0 +1,60 @@
+import os
+import requests
+import sys
+import re
+
+# file in which fqdn server configs are deposit
+config_path = '{{nginx_servers_directory}}'
+
+# Initialize the error counter
+error_counter = 0
+
+# Regex pattern to match domain.tld or *.domain.tld
+pattern = re.compile(r"^(?:[\w-]+\.)*[\w-]+\.[\w-]+\.conf$")
+
+# Iterate over each file in the configuration directory
+for filename in os.listdir(config_path):
+    if filename.endswith('.conf') and pattern.match(filename):
+        # Extract the domain and subdomain from the filename
+        domain = filename.replace('.conf', '')
+        parts = domain.split('.')
+        
+        # Prepare the URL and expected status codes
+        url = f"https://{domain}"
+        
+        # Default: Expect status code 200 or 302 for a domain
+        expected_statuses = [200,302]
+        
+        redirected_domains = [domain['source'] for domain in {{redirect_domain_mappings}}]
+        redirected_domains.append("{{domain_mailu}}")
+
+        # Determine expected status codes based on the domain
+        if domain == '{{domain_listmonk}}':
+            expected_statuses = [401]
+{% if nginx_matomo_tracking | bool %}
+        elif parts[0] == 'www' or domain in redirected_domains:
+            expected_statuses = [301]
+{% endif %}
+        elif domain == '{{domain_yourls}}':
+            expected_statuses = [403]
+
+        try:
+            # Send a HEAD request to get only the response header
+            response = requests.head(url)
+
+            # Check if the status code matches the expected statuses
+            if response.status_code in expected_statuses:
+                print(f"{domain}: OK")
+            else:
+                print(f"{domain}: ERROR: Expected {expected_statuses}. Got {response.status_code}.")
+                error_counter += 1
+        except requests.RequestException as e:
+            # Handle exceptions for requests like connection errors
+            print(f"{domain}: error due to {e}")
+            error_counter += 1
+
+if error_counter > 0:
+    print(f"Warning: {error_counter} domains responded with an unexpected https status code.")
+
+# Exit the script with the number of errors as the exit code
+sys.exit(error_counter)

roles/health-nginx/templates/health-nginx.service.j2

@@ -4,4 +4,4 @@ OnFailure=systemd-notifier@%n.service
 
 [Service]
 Type=oneshot
-ExecStart=/usr/bin/python3 {{ health_nginx_folder }}health-nginx.py {{nginx_servers_directory}}
+ExecStart=/usr/bin/python3 {{ health_nginx_folder }}health-nginx.py

roles/letsencrypt/meta/main.yml

@@ -1,2 +1,2 @@
 dependencies:
-- certbot-nginx
+- nginx-certbot

roles/letsencrypt/tasks/main.yml

@@ -1,6 +1,13 @@
 - name: create nginx letsencrypt config file
   template: src=letsencrypt.conf.j2 dest={{nginx_servers_directory}}letsencrypt.conf
   notify: restart nginx
+  when: run_once_letsencrypt is not defined
 
 - name: flush nginx service
   meta: flush_handlers
+  when: run_once_letsencrypt is not defined
+
+- name: run the letsencrypt logic just once
+  set_fact:
+    run_once_letsencrypt: true
+  when: run_once_letsencrypt is not defined

roles/nginx-certbot/tasks/main.yml

@@ -2,12 +2,14 @@
   pacman:
     name: [certbot,certbot-nginx]
     state: present
+  when: run_once_nginx_certbot is not defined
 
 - name: configure certbot.service.tpl
   template: 
     src:  certbot.service.j2
     dest: /etc/systemd/system/certbot.service
   notify: reload certbot service
+  when: run_once_nginx_certbot is not defined
 
 - name: configure certbot.timer.tpl
   template:
@@ -16,3 +18,9 @@
   register: certbot_timer
   changed_when: certbot_timer.changed or activate_all_timers | default(false) | bool
   notify: restart certbot timer
+  when: run_once_nginx_certbot is not defined
+
+- name: run the nginx_certbot tasks once
+  set_fact:
+    run_once_nginx_certbot: true
+  when: run_once_nginx_certbot is not defined

roles/nginx-www-redirect/tasks/main.yml

@@ -7,20 +7,17 @@
 
 - name: Filter domain names and remove .conf extension and path
   set_fact:
-    filtered_domains: "{{ conf_files.files | map(attribute='path') | map('regex_search', domain_regex) | select('string') | map('regex_replace', '^{{nginx_servers_directory}}', '') | map('regex_replace', '.conf$', '') | list }}"
+    filtered_domains: "{{ conf_files.files | map(attribute='path') | map('regex_search', domain_regex) | select('string') | map('regex_replace', path_regex, '') | map('regex_replace', '.conf$', '') | list }}"
   vars:
-    domain_regex: '^{{nginx_servers_directory}}(?!www\.)[^/]+\.conf$'
+    domain_regex: "^{{ nginx_servers_directory }}(?!www\\.)[^/]+\\.conf$"
+    path_regex: "^{{ nginx_servers_directory }}"
 
 - name: The domains for which a www. redirect will be implemented
   debug:
     var: filtered_domains
 
-- name: Prepare redirect domain mappings
-  set_fact:
-    redirect_domain_mappings: "{{ filtered_domains | map('regex_replace', '^(.*)$', '{ source: \"www.\\1\", target: \"\\1\" }') | map('from_yaml') | list }}"
-
 - name: Include nginx-domain-redirect role with dynamic domain mappings
   include_role:
     name: nginx-domain-redirect
   vars:
-    domain_mappings: "{{ redirect_domain_mappings }}"
+    domain_mappings: "{{ filtered_domains | map('regex_replace', '^(.*)$', '{ source: \"www.\\1\", target: \"\\1\" }') | map('from_yaml') | list }}"

roles/nginx/tasks/main.yml

@@ -2,6 +2,7 @@
 - name: install nginx
   pacman: name=nginx state=present
   notify: restart nginx
+  when: run_once_nginx is not defined
 
 - name: Ensure nginx configuration directories are present
   file:
@@ -12,10 +13,18 @@
     - "{{nginx_servers_directory}}"
     - "{{nginx_maps_directory}}"
     - "{{nginx_upstreams_directory}}"
+  when: run_once_nginx is not defined
 
 - name: create nginx config file
   template: src=nginx.conf.j2 dest=/etc/nginx/nginx.conf
   notify: restart nginx
+  when: run_once_nginx is not defined
 
 - name: flush nginx service
   meta: flush_handlers
+  when: run_once_nginx is not defined
+
+- name: run the nginx tasks once
+  set_fact:
+    run_once_nginx: true
+  when: run_once_nginx is not defined

roles/python-pip/tasks/main.yml

@@ -3,3 +3,9 @@
   pacman:
     name: python-pip
     state: present
+  when: run_once_python_pip is not defined
+
+- name: run the python_pip tasks once
+  set_fact:
+    run_once_python_pip: true
+  when: run_once_python_pip is not defined

roles/sshd/tasks/main.yml

@@ -6,3 +6,9 @@
     group: root
     mode: '0644'
   notify: sshd restart
+  when: run_once_sshd is not defined
+
+- name: run the sshd tasks once
+  set_fact:
+    run_once_sshd: true
+  when: run_once_sshd is not defined

roles/sudo/tasks/main.yml

@@ -2,3 +2,9 @@
   package:
     name:   sudo
     state:  present
+  when: run_once_sudo is not defined
+
+- name: run the sudo tasks once
+  set_fact:
+    run_once_sudo: true
+  when: run_once_sudo is not defined

roles/systemd-notifier-email/tasks/main.yml

@@ -1,18 +1,28 @@
 - name: install smtp-forwarder
   pacman: name=smtp-forwarder state=present
+  when: run_once_systemd_notifier_email is not defined
 
 - name: configure msmtprc.conf.j2
   template: src=msmtprc.conf.j2 dest=/root/.msmtprc
+  when: run_once_systemd_notifier_email is not defined
 
 - name: "create {{systemd_notifier_email_folder}}"
   file:
     path: "{{systemd_notifier_email_folder}}"
     state: directory
     mode: 0755
+  when: run_once_systemd_notifier_email is not defined
 
 - name: configure systemd-notifier-email.sh
   template: src=systemd-notifier-email.sh.j2 dest={{systemd_notifier_email_folder}}systemd-notifier-email.sh
+  when: run_once_systemd_notifier_email is not defined
 
 - name: configure systemd-notifier-email.service
   template: src=systemd-notifier-email@.service.j2 dest=/etc/systemd/system/systemd-notifier-email@.service
   notify: restart systemd-notifier-email service
+  when: run_once_systemd_notifier_email is not defined
+
+- name: run the systemd_notifier_email tasks once
+  set_fact:
+    run_once_systemd_notifier_email: true
+  when: run_once_systemd_notifier_email is not defined

roles/systemd-notifier-telegram/tasks/main.yml

@@ -2,20 +2,29 @@
   pacman: 
     name: curl
     state: present
+  when: run_once_systemd_notifier_telegram is not defined
 
 - name: Create a directory with a subdirectory
   ansible.builtin.file:
     path: "{{systemd_telegram_folder}}"
     state: directory
     mode: '0755'
+  when: run_once_systemd_notifier_telegram is not defined
 
 - name: configure systemd-notifier-telegram.sh
   template: 
     src: systemd-notifier-telegram.sh.j2 
     dest: "{{ systemd_telegram_script }}"
+  when: run_once_systemd_notifier_telegram is not defined  
 
 - name: configure systemd-notifier-telegram.service
   template: 
     src: systemd-notifier-telegram@.service.j2 
     dest: "/etc/systemd/system/systemd-notifier-telegram@.service"
   notify: "restart systemd-notifier-telegram service"
+  when: run_once_systemd_notifier_telegram is not defined
+
+- name: run the systemd_notifier_telegram tasks once
+  set_fact:
+    run_once_systemd_notifier_telegram: true
+  when: run_once_systemd_notifier_telegram is not defined

roles/systemd-notifier/handlers/main.yml

@@ -2,3 +2,9 @@
   systemd:
     name: systemd-notifier.service
     daemon_reload: yes
+  when: run_once_systemd_notifier_service is not defined
+
+- name: run the systemd_notifier_service tasks once
+  set_fact:
+    run_once_systemd_notifier_service: true
+  when: run_once_systemd_notifier_service is not defined

roles/systemd-notifier/tasks/main.yml

@@ -4,3 +4,9 @@
     src: systemd-notifier@.service.j2 
     dest: "/etc/systemd/system/systemd-notifier@.service"
   notify: "restart systemd-notifier service"
+  when: run_once_systemd_notifier_service is not defined
+
+- name: run the systemd_notifier_service tasks once
+  set_fact:
+    run_once_systemd_notifier_service: true
+  when: run_once_systemd_notifier_service is not defined

roles/user-administrator/tasks/main.yml

@@ -7,6 +7,7 @@
     generate_ssh_key: yes
     ssh_key_type: rsa
     ssh_key_bits: 8192
+  when: run_once_user_administrator is not defined
     
 - name: "create {{path_administrator_scripts}}"
   file:
@@ -15,6 +16,7 @@
     owner: administrator
     group: administrator
     mode: 0700
+  when: run_once_user_administrator is not defined
     
 - name: create {{path_administrator_home}}.ssh/authorized_keys
   copy:
@@ -23,6 +25,7 @@
     owner: administrator
     group: administrator
     mode: '0644'
+  when: run_once_user_administrator is not defined
 
 - name: grant administrator sudo rights with password
   copy:
@@ -32,6 +35,7 @@
     owner: root
     group: root
   notify: sshd restart
+  when: run_once_user_administrator is not defined
 
 - name: "create {{path_administrator_home}}volumes/"
   file:
@@ -40,3 +44,9 @@
     owner: administrator
     group: administrator
     mode: 0700
+  when: run_once_user_administrator is not defined
+
+- name: run the user_administrator tasks once
+  set_fact:
+    run_once_user_administrator: true
+  when: run_once_user_administrator is not defined