0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 10:59:59 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 5 c55f508e05 feat(readme): draw mandatory and disabled service relations

The cosmos generator linked a consumer to its provider only through an
'<role>' in group_names reference or an explicit provides: name. A hard
dependency has neither -- pinning the provider on unconditionally is
exactly what removes the Jinja reference the generator was reading -- so
web-svc-asset's bond to web-svc-file vanished from the diagram the moment
it became binding. Match a service key against the provider's own primary
key from the registry, in both directions.

Services the role turns off drew a solid 1:1 edge, claiming a mandatory
relationship for something that carries nothing at deploy time. They now
render as a red 0..0 edge; edge merging gained a real precedence so a
provider consumed through two keys stays live when only one is off.

Named colour, not hex: a '#' opens an entity code in the mermaid lexer and
turns the whole diagram into a parse error on GitHub.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-17 18:02:31 +02:00

3.1 KiB

Raw Permalink Blame History

NGINX HTTPS Certificate Retrieval

Description

This role automates the retrieval of Let's Encrypt SSL/TLS certificates using Certbot for domains served via NGINX. It supports both single-domain and wildcard certificates, and can use either the DNS or webroot ACME challenge methods.

Overview

Designed for Archlinux systems, this role handles issuing certificates per domain and optionally cleans up redundant certificates if wildcard certificates are used. It intelligently decides whether to issue a standard or wildcard certificate based on the domain structure and your configuration.

Key Features

Single Domain and Wildcard Support: Handles both individual domains and wildcard domains (*.example.com).
DNS and Webroot Challenges: Dynamically selects the correct ACME challenge method.
Certificate Renewal Logic: Skips renewal if the certificate is still valid.
Optional Cleanup: Deletes redundant domain certificates when wildcard certificates are used.
Non-Interactive Operation: Fully automated using --non-interactive and --agree-tos.

Cosmos

The diagram places NGINX HTTPS Certificate Retrieval in the Infinito.Nexus cosmos: the components it deploys (capabilities), the central services it consumes (dependencies), and its outward reach (federation and bridged external networks).

flowchart LR
    subgraph role [sys-svc-certs 💻]
        svc_svc_certs["svc-certs"]
    end

Solid 1:1 edges are fixed relationships; dashed 0..1 edges are conditional (enabled only in matching deployments); red 0..0 edges are turned off in this role. Node markers show the role's deploy modes (💻 host, 🐳 compose, 🐝 swarm); ❌ marks a service that is explicitly turned off, and ⚙️ an Ansible role dependency declared in meta/main.yml.

Purpose

The NGINX HTTPS Certificate Retrieval role ensures that your NGINX-served domains have valid, automatically issued SSL/TLS certificates, improving web security without manual intervention.

Features

ACME Challenge Selection: Supports DNS plugins or webroot method automatically.
Wildcard Certificate Management: Issues wildcard certificates when configured, saving effort for subdomain-heavy deployments.
Safe Cleanup: Ensures that no unused certificates are left behind.
Flexible Control: Supports for MODE_CLEANUP for cert cleanup operations.

Learn More

Credits

Implemented by Kevin Veen-Birkenbach. Part of the Infinito.Nexus Project and maintained by Kevin Veen-Birkenbach. Licensed under the Infinito.Nexus Community License (Non-Commercial).

3.1 KiB Raw Permalink Blame History