mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-08-30 23:38:13 +02:00
Kevin Veen-Birkenbach
f36c7831b1
- Added new filter plugin 'timeout_start_sec_for_domains' to calculate TimeoutStartSec based on number of domains. - Updated sys-ctl-hlth-csp and sys-ctl-hlth-webserver tasks to use the filter. - Removed obsolete systemctl.service.j2 in sys-ctl-hlth-csp. - Adjusted variable naming (CURRENT_PLAY_DOMAINS_ALL etc.) in multiple roles. - Updated srv-letsencrypt and sys-svc-certs to use uppercase vars. - Switched pretix role to sys-stk-full-stateful and removed leftover javascript.js. - Added unittests for the new filter under tests/unit/filter_plugins. See conversation: https://chatgpt.com/share/68b1ae9a-1ac0-800f-b49d-2915386a1a23
Let’s Encrypt SSL for Nginx 🔐
Description
Automates obtaining, configuring, and renewing Let’s Encrypt SSL certificates for Nginx with Certbot. Keeps your sites secure with minimal fuss! 🌐
Overview
This Ansible role sets up the necessary Nginx configuration and Certbot integration to:
- Redirect HTTP traffic to HTTPS
- Serve the ACME challenge for certificate issuance
- Apply strong SSL/TLS defaults
- Schedule automatic renewals
It’s idempotent: configuration and certificate tasks only run when needed. ✅
Purpose
Ensure all your Nginx-hosted sites use free, trusted SSL certificates from Let’s Encrypt—all managed automatically via Ansible. 🎯
Features
- Automatic Certificate Issuance: Uses Certbot’s webroot plugin to request and install certificates. 📜
- Nginx Redirect: Creates a temporary HTTP → HTTPS redirect block. ↪️
- ACME‐Challenge Handling: Configures
/.well-known/acme-challenge/for Certbot validation. 🔍 - Secure SSL Defaults: Includes modern cipher suites, HSTS, OCSP stapling, and session settings. 🔒
- Auto‐Renewal: Leverages system scheduling (cron or systemd timer) to renew certs before expiration. 🔄
- One‐Time Setup: Tasks guarded by a “run once” fact to avoid re-applying unchanged templates. 🏃♂️