kevinveenbirkenbachandClaude Opus 4.7
16bdbf03d7
Three classes of drift cleaned up across 85 .md files:
- Em-dashes: replaced ` — ` with the contextually correct separator
(colon for `term: explanation`, period to split clauses across
sentences/source lines, parentheses for asides, semicolon for
tight-linked continuations). Two intentional exceptions remain
in `docs/contributing/documentation.md` (the rule literal) and
inside a fenced ```sh block in `docs/contributing/actions/debugging/ci.md`.
- SPOT self-labels: rewrote "This is the SPOT for X" to describe
the subject directly ("This directory holds X" / "This file
describes X"). Cross-references to other artefacts' canonical
role remain unchanged.
- Heading-emoji position: moved leading-emoji headings (`# 🧩 Title`)
to trailing position (`# Title 🧩`) per the headline rule that
emojis MUST come after the title text.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2.0 KiB
Webserver HTTPS Provisioning
Description
The sys-svc-webserver-https role extends a basic NGINX installation by wiring in everything you need to serve content over HTTPS:
- Ensures your NGINX server is configured for SSL/TLS.
- Pulls in Let’s Encrypt ACME challenge handling.
- Applies global cleanup of unused domain configs.
This role is built on top of your existing sys-svc-webserver-core role, and it automates the end-to-end process of turning HTTP sites into secure HTTPS sites.
Overview
When you apply sys-svc-webserver-https, it will:
- Include the
sys-svc-webserver-corerole to install and configure NGINX. - Clean up any stale vHost files under
sys-svc-cln-domains. - Deploy the Let’s Encrypt challenge-and-redirect snippet from
sys-svc-letsencrypt. - Reload NGINX automatically when any template changes.
All tasks are idempotent. Once your certificates are in place and your configuration is set, Ansible will skip unchanged steps on subsequent runs.
Features
-
🔒 Automatic HTTPS Redirect
Sets up port 80 → 443 redirect and serves/.well-known/acme-challenge/for Certbot. -
🔑 Let’s Encrypt Integration
Pulls in challenge configuration and CAA-record management for automatic certificate issuance and renewal. -
🧹 Domain Cleanup
Removes obsolete or orphaned server blocks before enabling HTTPS. -
🚦 Handler-Safe
Triggers an NGINX reload only when necessary, minimizing service interruptions.
License
This role is released under the Infinito.Nexus Community License (Non-Commercial). See https://s.infinito.nexus/license for details.
Credits
Developed and maintained by Kevin Veen-Birkenbach. Learn more at veen.world. Part of the Infinito.Nexus Project. Licensed under the Infinito.Nexus Community License (Non-Commercial).