mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-08-30 07:18:09 +02:00
Kevin Veen-Birkenbach
5aaf2d28dc
- Fixed incorrect filter usage in docker-compose handler (proper use of | path_join). - Improved LetsEncrypt template by joining paths with filenames instead of appending manually. - Enhanced sys-svc-msmtp task with an additional condition to only run if no-reply mailu_token exists. - Updated Keycloak meta to depend on Mailu (ensuring token generation before setup). - Refactored Keycloak import path variables to use path_join consistently. - Adjusted Mailu meta dependency to run after Matomo instead of Keycloak. See: https://chatgpt.com/share/68af13e6-edc0-800f-b76a-a5f427837173
Let’s Encrypt SSL for Nginx 🔐
Description
Automates obtaining, configuring, and renewing Let’s Encrypt SSL certificates for Nginx with Certbot. Keeps your sites secure with minimal fuss! 🌐
Overview
This Ansible role sets up the necessary Nginx configuration and Certbot integration to:
- Redirect HTTP traffic to HTTPS
- Serve the ACME challenge for certificate issuance
- Apply strong SSL/TLS defaults
- Schedule automatic renewals
It’s idempotent: configuration and certificate tasks only run when needed. ✅
Purpose
Ensure all your Nginx-hosted sites use free, trusted SSL certificates from Let’s Encrypt—all managed automatically via Ansible. 🎯
Features
- Automatic Certificate Issuance: Uses Certbot’s webroot plugin to request and install certificates. 📜
- Nginx Redirect: Creates a temporary HTTP → HTTPS redirect block. ↪️
- ACME‐Challenge Handling: Configures
/.well-known/acme-challenge/for Certbot validation. 🔍 - Secure SSL Defaults: Includes modern cipher suites, HSTS, OCSP stapling, and session settings. 🔒
- Auto‐Renewal: Leverages system scheduling (cron or systemd timer) to renew certs before expiration. 🔄
- One‐Time Setup: Tasks guarded by a “run once” fact to avoid re-applying unchanged templates. 🏃♂️