README.md

@@ -152,7 +152,7 @@ Focuses on web server roles and applications, covering SSL certificates, Nginx c
 - **[Nginx-Https](./roles/nginx-https/)**: Enables HTTPS configuration for Nginx.
 - **[Nginx-Matomo-Tracking](./roles/nginx-matomo-tracking/)**: Integrates Matomo tracking with Nginx.
 - **[Nginx-Redirect](./roles/nginx-domain-redirect/)**: Manages URL redirects in Nginx.
-- **[Certbot Nginx](./roles/nginx-certbot/)**: Integrates Certbot with Nginx for SSL certificates.
+- **[Certbot Nginx](./roles/certbot-nginx/)**: Integrates Certbot with Nginx for SSL certificates.
 - **[Postfix](./roles/postfix/)**: Setup for the Postfix mail transfer agent.
 
 #### Docker and Containerization

group_vars/all

@@ -50,10 +50,9 @@ domain_mailu:                   "mail.{{top_domain}}"
 domain_mastodon:                "microblog.{{top_domain}}"
 domains_mastodon_alternates:    []
 domain_matomo:                  "matomo.{{top_domain}}"
-domain_matrix:                  "chat.{{top_domain}}"
 domain_mediawiki:               "wiki.{{top_domain}}"
 domain_nextcloud:               "cloud.{{top_domain}}"
-domain_pixelfed:                "pictures.{{top_domain}}"
+domain_pixelfed:               "pictures.{{top_domain}}"
 domains_pixelfed:               []
 domain_peertube:                "videos.{{top_domain}}"
 domains_peertube:               []
@@ -74,7 +73,6 @@ redirect_domain_mappings:
 - { source: "peertube.{{top_domain}}", target: "videos.{{top_domain}}" }
 - { source: "funkwhale.{{top_domain}}", target: "music.{{top_domain}}" }
 - { source: "pixelfed.{{top_domain}}", target: "pictures.{{top_domain}}" }
-- { source: "matrix.{{top_domain}}", target: "chat.{{top_domain}}" }
 
 nginx_configuration_directory:  "/etc/nginx/conf.d/"
 nginx_servers_directory:        "{{nginx_configuration_directory}}servers/"

playbook-servers.yml

@@ -200,15 +200,6 @@
         domains:  "{{domains_discourse}}"
         http_port: 8020
 
-- name: setup matrix
-  hosts: matrix
-  become: true
-  roles:
-   -  role: docker-matrix
-      vars:
-        domain:   "{{domain_matrix}}"
-        http_port: 8021
-
 - name: setup akaunting hosts
   hosts: akaunting
   become: true

roles/backup-docker-to-local/tasks/main.yml

@@ -4,7 +4,6 @@
       - lsof
       - python-pandas
     state: present
-  when: run_once_backup_docker_to_local is not defined
 
 - name: pull backup-docker-to-local.git
   git:
@@ -13,26 +12,23 @@
     update: yes
   register: git_result
   ignore_errors: true
-  when: run_once_backup_docker_to_local is not defined
 
 - name: Warn if repo is not reachable
   debug:
     msg: "Warning: Repository is not reachable."
-  when: git_result is defined and git_result.failed is defined and run_once_cleanup_failed_docker_backups is not defined
+  when: git_result.failed
 
 - name: configure backup-docker-to-local.service
   template: 
     src: backup-docker-to-local.service.j2
     dest: /etc/systemd/system/backup-docker-to-local.service
   notify: reload backup-docker-to-local.service
-  when: run_once_backup_docker_to_local is not defined
 
 - name: configure backup-docker-to-local.timer.tpl
   template: src=backup-docker-to-local.timer.j2 dest=/etc/systemd/system/backup-docker-to-local.timer
   register: backup_docker_to_local_timer
   changed_when: backup_docker_to_local_timer.changed or activate_all_timers | default(false) | bool
   notify: restart backup-docker-to-local.timer
-  when: run_once_backup_docker_to_local is not defined
 
 - name: create {{backup_docker_to_local_folder}}databases.csv
   copy:
@@ -40,9 +36,3 @@
     dest: "{{backup_docker_to_local_folder}}databases.csv"
     owner: root
     group: root
-  when: run_once_backup_docker_to_local is not defined
-
-- name: run the backup_docker_to_local tasks once
-  set_fact:
-    run_once_backup_docker_to_local: true
-  when: run_once_backup_docker_to_local is not defined

roles/backups-provider-user/tasks/main.yml

@@ -2,7 +2,6 @@
   user:
     name: backup
     create_home: yes
-  when: run_once_backups_provider_user is not defined
 
 - name: create .ssh directory
   file:
@@ -11,7 +10,6 @@
     owner: backup
     group: backup
     mode: '0700'
-  when: run_once_backups_provider_user is not defined
 
 - name: create /home/backup/.ssh/authorized_keys
   template:
@@ -20,7 +18,6 @@
     owner: backup
     group: backup
     mode: '0644'
-  when: run_once_backups_provider_user is not defined
 
 - name: create /home/backup/ssh-wrapper.sh
   copy:
@@ -29,7 +26,6 @@
     owner: backup
     group: backup
     mode: '0700'
-  when: run_once_backups_provider_user is not defined
 
 - name: grant backup sudo rights
   copy:
@@ -39,9 +35,3 @@
     owner: root
     group: root
   notify: sshd restart
-  when: run_once_backups_provider_user is not defined
-  
-- name: run the backups_provider_user tasks once
-  set_fact:
-    run_once_backups_provider_user: true
-  when: run_once_backups_provider_user is not defined

roles/certbot-nginx/tasks/main.yml

@@ -2,14 +2,12 @@
   pacman:
     name: [certbot,certbot-nginx]
     state: present
-  when: run_once_nginx_certbot is not defined
 
 - name: configure certbot.service.tpl
   template: 
     src:  certbot.service.j2
     dest: /etc/systemd/system/certbot.service
   notify: reload certbot service
-  when: run_once_nginx_certbot is not defined
 
 - name: configure certbot.timer.tpl
   template:
@@ -18,9 +16,3 @@
   register: certbot_timer
   changed_when: certbot_timer.changed or activate_all_timers | default(false) | bool
   notify: restart certbot timer
-  when: run_once_nginx_certbot is not defined
-
-- name: run the nginx_certbot tasks once
-  set_fact:
-    run_once_nginx_certbot: true
-  when: run_once_nginx_certbot is not defined

roles/cleanup-backups-service/tasks/main.yml

@@ -4,29 +4,20 @@
       - lsof
       - python-psutil
     state: present
-  when: run_once_cleanup_backups_service is not defined
 
 - name: "create {{docker_cleanup_backups}}"
   file:
     path: "{{docker_cleanup_backups}}"
     state: directory
     mode: 0755
-  when: run_once_cleanup_backups_service is not defined
 
 - name: create cleanup-backups.py
   copy: 
     src:  "cleanup-backups.py"
     dest: "{{docker_cleanup_backups}}cleanup-backups.py"
-  when: run_once_cleanup_backups_service is not defined
 
 - name: create cleanup-backups.service
   template: 
     src:  "cleanup-backups.service.j2"
     dest: "/etc/systemd/system/cleanup-backups.service"
   notify: reload cleanup-backups.service
-  when: run_once_cleanup_backups_service is not defined
-
-- name: run the cleanup_backups_service tasks once
-  set_fact:
-    run_once_cleanup_backups_service: true
-  when: run_once_cleanup_backups_service is not defined

roles/cleanup-backups-timer/handlers/main.yml

@@ -4,9 +4,3 @@
     state: restarted
     enabled: yes
     daemon_reload: yes
-  when: run_once_cleanup_backup_timer is not defined
-
-- name: run the cleanup_backup_timer tasks once
-  set_fact:
-    run_once_cleanup_backup_timer: true
-  when: run_once_cleanup_backup_timer is not defined

roles/cleanup-backups-timer/tasks/main.yml

@@ -5,9 +5,3 @@
   register: cleanup_backups_timer
   changed_when: cleanup_backups_timer.changed or activate_all_timers | default(false) | bool
   notify: restart cleanup-backups.timer
-  when: run_once_cleanup_backups_timer is not defined
-
-- name: run the cleanup_backups_timer tasks once
-  set_fact:
-    run_once_cleanup_backups_timer: true
-  when: run_once_cleanup_backups_timer is not defined

roles/cleanup-failed-docker-backups/tasks/main.yml

@@ -5,21 +5,14 @@
     update: yes
   register: git_result
   ignore_errors: true
-  when: run_once_cleanup_failed_docker_backups is not defined
 
 - name: Warn if repo is not reachable
   debug:
     msg: "Warning: Repository is not reachable."
-  when: git_result is defined and git_result.failed is defined and run_once_cleanup_failed_docker_backups is not defined
+  when: git_result.failed
 
 - name: configure cleanup-failed-docker-backups.service
   template: 
     src: cleanup-failed-docker-backups.service.j2
     dest: /etc/systemd/system/cleanup-failed-docker-backups.service
   notify: reload cleanup-failed-docker-backups.service daemon
-  when: run_once_cleanup_failed_docker_backups is not defined
-
-- name: run the cleanup_failed_docker_backups tasks once
-  set_fact:
-    run_once_cleanup_failed_docker_backups: true
-  when: run_once_cleanup_failed_docker_backups is not defined

roles/docker-discourse/templates/app.yml.j2

@@ -99,16 +99,6 @@ hooks:
         cd: $home/plugins
         cmd:
           - git clone https://github.com/discourse/docker_manager.git
-          - git clone https://github.com/discourse/discourse-activity-pub.git
-          - git clone https://github.com/discourse/discourse-calendar.git
-          - git clone https://github.com/discourse/discourse-akismet.git
-          - git clone https://github.com/discourse/discourse-cakeday.git
-          - git clone https://github.com/discourse/discourse-solved.git
-          - git clone https://github.com/discourse/discourse-voting.git
-          - git clone https://github.com/gdpelican/retort.git
-          - git clone https://github.com/discourse/discourse-oauth2-basic.git
-          - git clone https://github.com/discourse/discourse-openid-connect.git
-          - git clone https://github.com/jonmbake/discourse-ldap-auth
 
 ## Any custom commands to run after building
 run:

roles/docker-funkwhale/templates/docker-compose.yml.j2

@@ -6,7 +6,7 @@ services:
     env_file: .env
     environment:
       - "POSTGRES_HOST_AUTH_METHOD=trust"
-    image: postgres:alpine
+    image: postgres:15-alpine
     volumes:
       - database:/var/lib/postgresql/data
 

roles/docker-listmonk/templates/docker-compose.yml.j2

@@ -1,3 +1,7 @@
+# NOTE: This docker-compose.yml is meant to be just an example guideline
+# on how you can achieve the same. It is not intented to run out of the box
+# and you must edit the below configurations to suit your needs.
+
 version: "3.7"
 
 x-application-defaults: &application-defaults
@@ -11,7 +15,7 @@ x-application-defaults: &application-defaults
     - TZ=Etc/UTC
 
 x-database-defaults: &database-defaults
-  image: postgres:alpine
+  image: postgres:13-alpine
   ports:
     - "9432:5432"
   networks:

roles/docker-mastodon/templates/docker-compose.yml.j2

@@ -2,7 +2,7 @@ version: '3'
 services:
   database:
     restart: always
-    image: postgres:alpine
+    image: postgres:14-alpine
     shm_size: 256mb
     networks:
       - internal_network

roles/docker-matrix/handlers/main.yml

@@ -1,8 +0,0 @@
----
-- name: recreate matrix
-  command:
-    cmd: docker-compose up -d --force-recreate
-    chdir: "{{docker_compose_instance_directory}}"
-  environment:
-    COMPOSE_HTTP_TIMEOUT: 600
-    DOCKER_CLIENT_TIMEOUT: 600

roles/docker-matrix/meta/main.yml

@@ -1,2 +0,0 @@
-dependencies:
-- nginx-docker-reverse-proxy

roles/docker-matrix/tasks/main.yml

@@ -1,33 +0,0 @@
----
-- name: "include tasks nginx-docker-proxy-domain.yml"
-  include_tasks: nginx-docker-proxy-domain.yml
-
-- name: "create {{docker_compose_instance_directory}}"
-  file:
-    path: "{{docker_compose_instance_directory}}"
-    state: directory
-    mode: 0755
-
-- name: add homeserver.yaml
-  template: 
-    src:  "homeserver.yaml.j2" 
-    dest: "{{docker_compose_instance_directory}}homeserver.yaml"
-  notify: recreate matrix
-
-- name: add log.config
-  template: 
-    src:  "log.config.j2" 
-    dest: "{{docker_compose_instance_directory}}{{domain}}.log.config"
-  notify: recreate matrix
-
-# https://github.com/matrix-org/synapse/issues/6303
-- name: set correct folder permissions
-  command:
-    cmd: "docker run --rm --mount type=volume,src=matrix_data,dst=/data -e SYNAPSE_SERVER_NAME={{domain}} -e SYNAPSE_REPORT_STATS=no --entrypoint /bin/sh matrixdotorg/synapse:latest -c 'chown -vR 991:991 /data'"
-    chdir: "{{path_docker_compose_instances}}baserow/"
-
-- name: add docker-compose.yml
-  template: 
-    src:  "docker-compose.yml.j2" 
-    dest: "{{docker_compose_instance_directory}}docker-compose.yml"
-  notify: recreate matrix

roles/docker-matrix/templates/docker-compose.yml.j2

@@ -1,45 +0,0 @@
-version: '3.1'
-
-services:
-  
-  application:
-    image: matrixdotorg/synapse:latest
-    restart: unless-stopped
-    logging:
-      driver: journald
-    volumes:
-      - data:/data
-      - ./homeserver.yaml:/data/homeserver.yaml:ro
-      - ./{{domain}}.log.config:/data/{{domain}}.log.config:ro
-    environment:
-      - SYNAPSE_SERVER_NAME={{domain}}
-      - SYNAPSE_REPORT_STATS=no
-    ports:
-      - "127.0.0.1:{{http_port}}:8008"
-    depends_on:
-      - database
-
-  database:
-    logging:
-        driver: journald
-    image: postgres:alpine
-    restart: unless-stopped
-    volumes:
-      - database:/var/lib/postgresql/data
-    environment:
-      - POSTGRES_DB=matrix
-      - POSTGRES_USER=matrix
-      - POSTGRES_PASSWORD={{matrix_database_password}}
-      - POSTGRES_INITDB_ARGS='--encoding=UTF-8 --lc-collate=C --lc-ctype=C'
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U matrix"]
-      interval: 10s
-      timeout: 5s
-      retries: 6
-
-volumes:
-  database:
-  data:
-networks:
-  default:
-    driver: bridge

roles/docker-matrix/templates/homeserver.yaml.j2

@@ -1,28 +0,0 @@
-server_name: "{{domain}}"
-pid_file: /data/homeserver.pid
-listeners:
-  - port: 8008
-    tls: false
-    type: http
-    x_forwarded: true
-    resources:
-      - names: [client, federation]
-        compress: false
-database:
-  name: psycopg2
-  args:
-    user: matrix
-    password: {{matrix_database_password}}
-    database: matrix
-    host: database
-    cp_min: 5
-    cp_max: 10
-log_config:                     "/data/{{domain}}.log.config"
-media_store_path:               /data/media_store
-registration_shared_secret:     "{{matrix_registration_shared_secret}}"
-report_stats:                   true
-macaroon_secret_key:            "{{matrix_macaroon_secret_key}}"
-form_secret:                    "{{matrix_form_secret}}"
-signing_key_path:               "/data/{{domain}}.signing.key"
-trusted_key_servers:
-  - server_name: "matrix.org"

roles/docker-matrix/templates/log.config.j2

@@ -1,25 +0,0 @@
-version: 1
-
-formatters:
-  precise:
-    format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
-
-handlers:
-  file:
-    class: logging.handlers.RotatingFileHandler
-    formatter: precise
-    filename: /data/{{ domain }}.homeserver.log
-    maxBytes: 10485760
-    backupCount: 3
-  console:
-    class: logging.StreamHandler
-    formatter: precise
-
-loggers:
-  synapse:
-    level: INFO
-    handlers: [file, console]
-
-root:
-  level: INFO
-  handlers: [file, console]

roles/docker-matrix/vars/main.yml

@@ -1,2 +0,0 @@
----
-docker_compose_instance_directory: "{{path_docker_compose_instances}}matrix/"

roles/docker-mybb/templates/docker-compose.yml.j2

@@ -34,15 +34,10 @@ services:
       POSTGRES_DB: mybb
       POSTGRES_PASSWORD: "{{mybb_database_password}}"
       POSTGRES_USER: mybb
-    image: postgres:alpine
+    image: postgres:14-alpine
     volumes:
     - database:/var/lib/postgresql/data:rw
     restart: always
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U mybb"]
-      interval: 10s
-      timeout: 5s
-      retries: 6
 volumes:
   database:
   data:

roles/docker-peertube/templates/docker-compose.yml.j2

@@ -17,19 +17,14 @@ services:
       - redis
     restart: "always"
   database:
-    image: postgres:alpine
+    image: postgres:13-alpine
     env_file:
       - .env
     volumes:
       - database:/var/lib/postgresql/data
     restart: "always"
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U peertube"]
-      interval: 10s
-      timeout: 5s
-      retries: 6
   redis:
-    image: redis:alpine
+    image: redis:6-alpine
     volumes:
       - redis:/data
     restart: "always"

roles/docker/tasks/main.yml

@@ -5,7 +5,6 @@
     name: ['docker','docker-compose']
     state: present
   notify: docker restart
-  when: run_once_docker is not defined
 
 - name: "create {{path_docker_compose_instances}}"
   file:
@@ -14,7 +13,6 @@
     mode: 0700
     owner: administrator
     group: administrator
-  when: run_once_docker is not defined
 
 - name: "create {{path_docker_volumes}}"
   file:
@@ -23,13 +21,6 @@
     mode: 0700
     owner: administrator
     group: administrator
-  when: run_once_docker is not defined
 
 - name: flush docker service
   meta: flush_handlers
-  when: run_once_docker is not defined
-
-- name: run the docker tasks once
-  set_fact:
-    run_once_docker: true
-  when: run_once_docker is not defined

roles/git/tasks/main.yml

@@ -1,8 +1,2 @@
 - name: install git
   pacman: name=git state=present
-  when: run_once_git is not defined
-
-- name: run the git tasks once
-  set_fact:
-    run_once_git: true
-  when: run_once_git is not defined

roles/heal-docker/tasks/main.yml

@@ -3,20 +3,17 @@
     path: "{{heal_docker}}"
     state: directory
     mode: 0755
-  when: run_once_heal_docker is not defined
 
 - name: create heal-docker.py
   copy:
     src: heal-docker.py
     dest: "{{heal_docker}}heal-docker.py"
-  when: run_once_heal_docker is not defined
 
 - name: create heal-docker.service
   template: 
     src: heal-docker.service.j2 
     dest: /etc/systemd/system/heal-docker.service
   notify: reload heal-docker.service
-  when: run_once_heal_docker is not defined
 
 - name: create heal-docker.timer
   template:
@@ -25,9 +22,3 @@
   register: heal_docker_timer
   changed_when: heal_docker_timer.changed or activate_all_timers | default(false) | bool
   notify: restart heal-docker.timer
-  when: run_once_heal_docker is not defined
-
-- name: run the heal_docker tasks once
-  set_fact:
-    run_once_heal_docker: true
-  when: run_once_heal_docker is not defined

roles/health-docker-container/tasks/main.yml

@@ -3,18 +3,15 @@
     path: "{{health_docker_container_folder}}"
     state: directory
     mode: 0755
-  when: run_once_health_docker_container is not defined
 
 - name: create health-docker-container.sh
   copy:
     src: health-docker-container.sh
     dest: "{{health_docker_container_folder}}health-docker-container.sh"
-  when: run_once_health_docker_container is not defined
 
 - name: create health-docker-container.service
   template: src=health-docker-container.service.j2 dest=/etc/systemd/system/health-docker-container.service
   notify: reload health-docker-container.service
-  when: run_once_health_docker_container is not defined
 
 - name: create health-docker-container.timer
   template:
@@ -23,9 +20,3 @@
   register: health_docker_container_timer
   changed_when: health_docker_container_timer.changed or activate_all_timers | default(false) | bool
   notify: restart health-docker-container.timer
-  when: run_once_health_docker_container is not defined
-
-- name: run the health_docker_container tasks once
-  set_fact:
-    run_once_health_docker_container: true
-  when: run_once_health_docker_container is not defined

roles/health-docker-volumes/tasks/main.yml

@@ -3,18 +3,15 @@
     path: "{{health_docker_volumes_folder}}"
     state: directory
     mode: 0755
-  when: run_once_health_docker_volumes is not defined
 
 - name: create health-docker-volumes.sh
   copy:
     src: health-docker-volumes.sh
     dest: "{{health_docker_volumes_folder}}health-docker-volumes.sh"
-  when: run_once_health_docker_volumes is not defined
 
 - name: create health-docker-volumes.service
   template: src=health-docker-volumes.service.j2 dest=/etc/systemd/system/health-docker-volumes.service
   notify: reload health-docker-volumes.service
-  when: run_once_health_docker_volumes is not defined
 
 - name: create health-docker-volumes.timer
   template:
@@ -23,9 +20,3 @@
   register: health_docker_volumes_timer
   changed_when: health_docker_volumes_timer.changed or activate_all_timers | default(false) | bool
   notify: restart health-docker-volumes.timer
-  when: run_once_health_docker_volumes is not defined
-
-- name: run the health_docker_volumes tasks once
-  set_fact:
-    run_once_health_docker_volumes: true
-  when: run_once_health_docker_volumes is not defined

roles/health-nginx/files/health-nginx.py

@@ -0,0 +1,58 @@
+import os
+import requests
+import sys
+import re
+
+# Set up argument parser
+parser = argparse.ArgumentParser(description='Check if domains of nginx configuration files respond with the correct status code.')
+parser.add_argument('config_path', help='Path to the nginx configuration directory')
+args = parser.parse_args()
+
+# Use the provided argument for the config path
+config_path = args.config_path
+
+# Initialize the error counter
+error_counter = 0
+
+# Regex pattern to match domain.tld or subdomain.domain.tld
+pattern = re.compile(r"^(?:[\w-]+\.)?[\w-]+\.[\w-]+\.conf$")
+
+# Iterate over each file in the configuration directory
+for filename in os.listdir(config_path):
+    if filename.endswith('.conf') and pattern.match(filename):
+        # Extract the domain and subdomain from the filename
+        name = filename.replace('.conf', '')
+        parts = name.split('.')
+        
+        # Prepare the URL and expected status codes
+        url = f"https://{name}"
+        
+        # Default: Expect status code 200 for a domain
+        expected_statuses = [200]
+        
+        # Determine expected status codes based on subdomain
+        if len(parts) == 3:
+            if parts[0] == 'listmonk':
+                expected_statuses = [401]
+            elif parts[0] == 'www':
+                expected_statuses = [200,301]
+            elif parts[0] == 's':
+                expected_statuses = [403]
+
+        try:
+            # Send a HEAD request to get only the response header
+            response = requests.head(url, allow_redirects=True)
+
+            # Check if the status code matches the expected statuses
+            if response.status_code in expected_statuses:
+                print(f"{name}: ok")
+            else:
+                print(f"{name}: error")
+                error_counter += 1
+        except requests.RequestException as e:
+            # Handle exceptions for requests like connection errors
+            print(f"{name}: error due to {e}")
+            error_counter += 1
+
+# Exit the script with the number of errors as the exit code
+sys.exit(error_counter)

roles/health-nginx/tasks/main.yml

@@ -2,27 +2,23 @@
   pacman:
     name: python-requests
     state: present
-  when: run_once_health_nginx is not defined
 
 - name: "create {{ health_nginx_folder }}"
   file:
     path: "{{ health_nginx_folder }}"
     state: directory
     mode: 0755
-  when: run_once_health_nginx is not defined
 
 - name: create health-nginx.py
-  template:
-    src: health-nginx.py.j2
+  copy:
+    src: health-nginx.py
     dest: "{{ health_nginx_folder }}health-nginx.py"
-  when: run_once_health_nginx is not defined
 
 - name: create health-nginx.service
   template: 
     src: health-nginx.service.j2
     dest: /etc/systemd/system/health-nginx.service
   notify: reload health-nginx.service
-  when: run_once_health_nginx is not defined
 
 - name: create health-nginx.timer
   template:
@@ -31,10 +27,3 @@
   register: health_nginx_timer
   changed_when: health_nginx_timer.changed or activate_all_timers | default(false) | bool
   notify: restart health-nginx.timer
-  when: run_once_health_nginx is not defined
-
-- name: run the health_nginx tasks once
-  set_fact:
-    run_once_health_nginx: true
-  when: run_once_health_nginx is not defined
-

roles/health-nginx/templates/health-nginx.py.j2

@@ -1,60 +0,0 @@
-import os
-import requests
-import sys
-import re
-
-# file in which fqdn server configs are deposit
-config_path = '{{nginx_servers_directory}}'
-
-# Initialize the error counter
-error_counter = 0
-
-# Regex pattern to match domain.tld or *.domain.tld
-pattern = re.compile(r"^(?:[\w-]+\.)*[\w-]+\.[\w-]+\.conf$")
-
-# Iterate over each file in the configuration directory
-for filename in os.listdir(config_path):
-    if filename.endswith('.conf') and pattern.match(filename):
-        # Extract the domain and subdomain from the filename
-        domain = filename.replace('.conf', '')
-        parts = domain.split('.')
-        
-        # Prepare the URL and expected status codes
-        url = f"https://{domain}"
-        
-        # Default: Expect status code 200 or 302 for a domain
-        expected_statuses = [200,302]
-        
-        redirected_domains = [domain['source'] for domain in {{redirect_domain_mappings}}]
-        redirected_domains.append("{{domain_mailu}}")
-
-        # Determine expected status codes based on the domain
-        if domain == '{{domain_listmonk}}':
-            expected_statuses = [401]
-{% if nginx_matomo_tracking | bool %}
-        elif parts[0] == 'www' or domain in redirected_domains:
-            expected_statuses = [301]
-{% endif %}
-        elif domain == '{{domain_yourls}}':
-            expected_statuses = [403]
-
-        try:
-            # Send a HEAD request to get only the response header
-            response = requests.head(url)
-
-            # Check if the status code matches the expected statuses
-            if response.status_code in expected_statuses:
-                print(f"{domain}: OK")
-            else:
-                print(f"{domain}: ERROR: Expected {expected_statuses}. Got {response.status_code}.")
-                error_counter += 1
-        except requests.RequestException as e:
-            # Handle exceptions for requests like connection errors
-            print(f"{domain}: error due to {e}")
-            error_counter += 1
-
-if error_counter > 0:
-    print(f"Warning: {error_counter} domains responded with an unexpected https status code.")
-
-# Exit the script with the number of errors as the exit code
-sys.exit(error_counter)

roles/health-nginx/templates/health-nginx.service.j2

@@ -4,4 +4,4 @@ OnFailure=systemd-notifier@%n.service
 
 [Service]
 Type=oneshot
-ExecStart=/usr/bin/python3 {{ health_nginx_folder }}health-nginx.py
+ExecStart=/usr/bin/python3 {{ health_nginx_folder }}health-nginx.py {{nginx_servers_directory}}

roles/letsencrypt/meta/main.yml

@@ -1,2 +1,2 @@
 dependencies:
-- nginx-certbot
+- certbot-nginx

roles/letsencrypt/tasks/main.yml

@@ -1,13 +1,6 @@
 - name: create nginx letsencrypt config file
   template: src=letsencrypt.conf.j2 dest={{nginx_servers_directory}}letsencrypt.conf
   notify: restart nginx
-  when: run_once_letsencrypt is not defined
 
 - name: flush nginx service
   meta: flush_handlers
-  when: run_once_letsencrypt is not defined
-
-- name: run the letsencrypt logic just once
-  set_fact:
-    run_once_letsencrypt: true
-  when: run_once_letsencrypt is not defined

roles/nginx-www-redirect/tasks/main.yml

@@ -7,17 +7,20 @@
 
 - name: Filter domain names and remove .conf extension and path
   set_fact:
-    filtered_domains: "{{ conf_files.files | map(attribute='path') | map('regex_search', domain_regex) | select('string') | map('regex_replace', path_regex, '') | map('regex_replace', '.conf$', '') | list }}"
+    filtered_domains: "{{ conf_files.files | map(attribute='path') | map('regex_search', domain_regex) | select('string') | map('regex_replace', '^{{nginx_servers_directory}}', '') | map('regex_replace', '.conf$', '') | list }}"
   vars:
-    domain_regex: "^{{ nginx_servers_directory }}(?!www\\.)[^/]+\\.conf$"
-    path_regex: "^{{ nginx_servers_directory }}"
+    domain_regex: '^{{nginx_servers_directory}}(?!www\.)[^/]+\.conf$'
 
 - name: The domains for which a www. redirect will be implemented
   debug:
     var: filtered_domains
 
+- name: Prepare redirect domain mappings
+  set_fact:
+    redirect_domain_mappings: "{{ filtered_domains | map('regex_replace', '^(.*)$', '{ source: \"www.\\1\", target: \"\\1\" }') | map('from_yaml') | list }}"
+
 - name: Include nginx-domain-redirect role with dynamic domain mappings
   include_role:
     name: nginx-domain-redirect
   vars:
-    domain_mappings: "{{ filtered_domains | map('regex_replace', '^(.*)$', '{ source: \"www.\\1\", target: \"\\1\" }') | map('from_yaml') | list }}"
+    domain_mappings: "{{ redirect_domain_mappings }}"

roles/nginx/tasks/main.yml

@@ -2,7 +2,6 @@
 - name: install nginx
   pacman: name=nginx state=present
   notify: restart nginx
-  when: run_once_nginx is not defined
 
 - name: Ensure nginx configuration directories are present
   file:
@@ -13,18 +12,10 @@
     - "{{nginx_servers_directory}}"
     - "{{nginx_maps_directory}}"
     - "{{nginx_upstreams_directory}}"
-  when: run_once_nginx is not defined
 
 - name: create nginx config file
   template: src=nginx.conf.j2 dest=/etc/nginx/nginx.conf
   notify: restart nginx
-  when: run_once_nginx is not defined
 
 - name: flush nginx service
   meta: flush_handlers
-  when: run_once_nginx is not defined
-
-- name: run the nginx tasks once
-  set_fact:
-    run_once_nginx: true
-  when: run_once_nginx is not defined

roles/python-pip/tasks/main.yml

@@ -3,9 +3,3 @@
   pacman:
     name: python-pip
     state: present
-  when: run_once_python_pip is not defined
-
-- name: run the python_pip tasks once
-  set_fact:
-    run_once_python_pip: true
-  when: run_once_python_pip is not defined

roles/sshd/tasks/main.yml

@@ -6,9 +6,3 @@
     group: root
     mode: '0644'
   notify: sshd restart
-  when: run_once_sshd is not defined
-
-- name: run the sshd tasks once
-  set_fact:
-    run_once_sshd: true
-  when: run_once_sshd is not defined

roles/sudo/tasks/main.yml

@@ -2,9 +2,3 @@
   package:
     name:   sudo
     state:  present
-  when: run_once_sudo is not defined
-
-- name: run the sudo tasks once
-  set_fact:
-    run_once_sudo: true
-  when: run_once_sudo is not defined

roles/systemd-notifier-email/tasks/main.yml

@@ -1,28 +1,18 @@
 - name: install smtp-forwarder
   pacman: name=smtp-forwarder state=present
-  when: run_once_systemd_notifier_email is not defined
 
 - name: configure msmtprc.conf.j2
   template: src=msmtprc.conf.j2 dest=/root/.msmtprc
-  when: run_once_systemd_notifier_email is not defined
 
 - name: "create {{systemd_notifier_email_folder}}"
   file:
     path: "{{systemd_notifier_email_folder}}"
     state: directory
     mode: 0755
-  when: run_once_systemd_notifier_email is not defined
 
 - name: configure systemd-notifier-email.sh
   template: src=systemd-notifier-email.sh.j2 dest={{systemd_notifier_email_folder}}systemd-notifier-email.sh
-  when: run_once_systemd_notifier_email is not defined
 
 - name: configure systemd-notifier-email.service
   template: src=systemd-notifier-email@.service.j2 dest=/etc/systemd/system/systemd-notifier-email@.service
   notify: restart systemd-notifier-email service
-  when: run_once_systemd_notifier_email is not defined
-
-- name: run the systemd_notifier_email tasks once
-  set_fact:
-    run_once_systemd_notifier_email: true
-  when: run_once_systemd_notifier_email is not defined

roles/systemd-notifier-telegram/tasks/main.yml

@@ -2,29 +2,20 @@
   pacman: 
     name: curl
     state: present
-  when: run_once_systemd_notifier_telegram is not defined
 
 - name: Create a directory with a subdirectory
   ansible.builtin.file:
     path: "{{systemd_telegram_folder}}"
     state: directory
     mode: '0755'
-  when: run_once_systemd_notifier_telegram is not defined
 
 - name: configure systemd-notifier-telegram.sh
   template: 
     src: systemd-notifier-telegram.sh.j2 
     dest: "{{ systemd_telegram_script }}"
-  when: run_once_systemd_notifier_telegram is not defined  
 
 - name: configure systemd-notifier-telegram.service
   template: 
     src: systemd-notifier-telegram@.service.j2 
     dest: "/etc/systemd/system/systemd-notifier-telegram@.service"
   notify: "restart systemd-notifier-telegram service"
-  when: run_once_systemd_notifier_telegram is not defined
-
-- name: run the systemd_notifier_telegram tasks once
-  set_fact:
-    run_once_systemd_notifier_telegram: true
-  when: run_once_systemd_notifier_telegram is not defined

roles/systemd-notifier/handlers/main.yml

@@ -2,9 +2,3 @@
   systemd:
     name: systemd-notifier.service
     daemon_reload: yes
-  when: run_once_systemd_notifier_service is not defined
-
-- name: run the systemd_notifier_service tasks once
-  set_fact:
-    run_once_systemd_notifier_service: true
-  when: run_once_systemd_notifier_service is not defined

roles/systemd-notifier/tasks/main.yml

@@ -4,9 +4,3 @@
     src: systemd-notifier@.service.j2 
     dest: "/etc/systemd/system/systemd-notifier@.service"
   notify: "restart systemd-notifier service"
-  when: run_once_systemd_notifier_service is not defined
-
-- name: run the systemd_notifier_service tasks once
-  set_fact:
-    run_once_systemd_notifier_service: true
-  when: run_once_systemd_notifier_service is not defined

roles/user-administrator/tasks/main.yml

@@ -7,7 +7,6 @@
     generate_ssh_key: yes
     ssh_key_type: rsa
     ssh_key_bits: 8192
-  when: run_once_user_administrator is not defined
     
 - name: "create {{path_administrator_scripts}}"
   file:
@@ -16,7 +15,6 @@
     owner: administrator
     group: administrator
     mode: 0700
-  when: run_once_user_administrator is not defined
     
 - name: create {{path_administrator_home}}.ssh/authorized_keys
   copy:
@@ -25,7 +23,6 @@
     owner: administrator
     group: administrator
     mode: '0644'
-  when: run_once_user_administrator is not defined
 
 - name: grant administrator sudo rights with password
   copy:
@@ -35,7 +32,6 @@
     owner: root
     group: root
   notify: sshd restart
-  when: run_once_user_administrator is not defined
 
 - name: "create {{path_administrator_home}}volumes/"
   file:
@@ -44,9 +40,3 @@
     owner: administrator
     group: administrator
     mode: 0700
-  when: run_once_user_administrator is not defined
-
-- name: run the user_administrator tasks once
-  set_fact:
-    run_once_user_administrator: true
-  when: run_once_user_administrator is not defined