mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-08-15 08:30:46 +02:00
Kevin Veen-Birkenbach
c729edb525
- Standardize async/poll usage with 'ASYNC_ENABLED | bool' - Add async/poll parameters to Cloudflare, Nginx, Mailu, MIG, Nextcloud, and OpenLDAP tasks - Update async configuration in 'group_vars/all/00_general.yml' to ensure boolean evaluation - Allow CAA, cache, and DNS tasks to run asynchronously when enabled https://chatgpt.com/share/689cd8cc-7fbc-800f-bd06-a667561573bf
Let’s Encrypt SSL for Nginx 🔐
Description
Automates obtaining, configuring, and renewing Let’s Encrypt SSL certificates for Nginx with Certbot. Keeps your sites secure with minimal fuss! 🌐
Overview
This Ansible role sets up the necessary Nginx configuration and Certbot integration to:
- Redirect HTTP traffic to HTTPS
- Serve the ACME challenge for certificate issuance
- Apply strong SSL/TLS defaults
- Schedule automatic renewals
It’s idempotent: configuration and certificate tasks only run when needed. ✅
Purpose
Ensure all your Nginx-hosted sites use free, trusted SSL certificates from Let’s Encrypt—all managed automatically via Ansible. 🎯
Features
- Automatic Certificate Issuance: Uses Certbot’s webroot plugin to request and install certificates. 📜
- Nginx Redirect: Creates a temporary HTTP → HTTPS redirect block. ↪️
- ACME‐Challenge Handling: Configures
/.well-known/acme-challenge/for Certbot validation. 🔍 - Secure SSL Defaults: Includes modern cipher suites, HSTS, OCSP stapling, and session settings. 🔒
- Auto‐Renewal: Leverages system scheduling (cron or systemd timer) to renew certs before expiration. 🔄
- One‐Time Setup: Tasks guarded by a “run once” fact to avoid re-applying unchanged templates. 🏃♂️