mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
c55f508e05
The cosmos generator linked a consumer to its provider only through an '<role>' in group_names reference or an explicit provides: name. A hard dependency has neither -- pinning the provider on unconditionally is exactly what removes the Jinja reference the generator was reading -- so web-svc-asset's bond to web-svc-file vanished from the diagram the moment it became binding. Match a service key against the provider's own primary key from the registry, in both directions. Services the role turns off drew a solid 1:1 edge, claiming a mandatory relationship for something that carries nothing at deploy time. They now render as a red 0..0 edge; edge merging gained a real precedence so a provider consumed through two keys stays live when only one is off. Named colour, not hex: a '#' opens an entity code in the mermaid lexer and turns the whole diagram into a parse error on GitHub. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
58 lines
3.0 KiB
Markdown
58 lines
3.0 KiB
Markdown
# NGINX Certbot Automation
|
|
|
|
## Description
|
|
|
|
This role automates the setup of an automatic [Let's Encrypt](https://letsencrypt.org/) certificate renewal system for NGINX using [Certbot](https://certbot.eff.org/). It ensures that SSL/TLS certificates are renewed seamlessly in the background and that NGINX reloads automatically after successful renewals.
|
|
|
|
## Overview
|
|
|
|
Optimized for Archlinux systems, this role installs the `certbot-NGINX` package, configures a dedicated `systemd` service for certificate renewal, and integrates with a `sys-timer` to schedule periodic renewals. After a renewal, NGINX is reloaded to apply the updated certificates immediately.
|
|
|
|
### Key Features
|
|
|
|
- **Automatic Renewal:** Schedules unattended certificate renewals using sys-timers.
|
|
- **Seamless NGINX Reload:** Reloads the NGINX service automatically after successful renewals.
|
|
- **Systemd Integration:** Manages renewal operations reliably with `systemd` and `sys-ctl-alm-compose`.
|
|
- **Quiet and Safe Operation:** Uses `--quiet` and `--agree-tos` flags to ensure non-interactive renewals.
|
|
|
|
## Cosmos
|
|
|
|
The diagram places NGINX Certbot Automation in the Infinito.Nexus cosmos: the components it deploys (capabilities), the central services it consumes (dependencies), and its outward reach (federation and bridged external networks).
|
|
|
|
```mermaid
|
|
flowchart LR
|
|
subgraph deps [Dependencies]
|
|
dep_sys_ctl_cln_certs["sys-ctl-cln-certs 💻 ⚙️"]
|
|
end
|
|
subgraph role [sys-ctl-mtn-cert-renew 💻]
|
|
svc_cert_renew["cert-renew"]
|
|
end
|
|
dep_sys_ctl_cln_certs -- "1:1" --> svc_cert_renew
|
|
```
|
|
|
|
Solid `1:1` edges are fixed relationships; dashed `0..1` edges are conditional (enabled only in matching deployments); red `0..0` edges are turned off in this role. Node markers show the role's deploy modes (💻 host, 🐳 compose, 🐝 swarm); ❌ marks a service that is explicitly turned off, and ⚙️ an Ansible role dependency declared in `meta/main.yml`.
|
|
|
|
## Purpose
|
|
|
|
The NGINX Certbot Automation role ensures that Let's Encrypt SSL/TLS certificates stay valid without manual intervention. It enhances the security and reliability of web services by automating certificate lifecycle management.
|
|
|
|
## Features
|
|
|
|
- **Certbot-NGINX Package Installation:** Installs required certbot plugins for NGINX.
|
|
- **Custom Systemd Service:** Configures a lightweight, dedicated renewal service.
|
|
- **Timer Setup:** Uses sys-timer to run certbot renewals periodically.
|
|
- **Failure Notification:** Integrated with `sys-ctl-alm-compose` for alerting on failures.
|
|
|
|
## Learn More
|
|
|
|
- [Certbot Official Website](https://certbot.eff.org/)
|
|
- [Let's Encrypt](https://letsencrypt.org/)
|
|
- [Systemd (Wikipedia)](https://en.wikipedia.org/wiki/Systemd)
|
|
- [HTTPS (Wikipedia)](https://en.wikipedia.org/wiki/HTTPS)
|
|
|
|
## Credits
|
|
|
|
Implemented by **[Kevin Veen-Birkenbach](https://www.veen.world)**.
|
|
Part of the [Infinito.Nexus Project](https://s.infinito.nexus/code) and maintained by [Kevin Veen-Birkenbach](https://www.veen.world).
|
|
Licensed under the [Infinito.Nexus Community License (Non-Commercial)](https://s.infinito.nexus/license).
|