nginx.yml (5281B)
1 --- 2 - name: Check for an existing TLS certificate 3 ansible.builtin.stat: 4 path: "/etc/letsencrypt/live/backend.{{ regional_currency_domain }}/fullchain.pem" 5 register: regional_currency_tls_certificate 6 7 - name: Check whether the TLS certificate covers the main domain 8 ansible.builtin.command: 9 argv: 10 - openssl 11 - x509 12 - -noout 13 - -checkhost 14 - "{{ regional_currency_domain }}" 15 - -in 16 - >- 17 /etc/letsencrypt/live/backend.{{ regional_currency_domain 18 }}/fullchain.pem 19 register: regional_currency_tls_certificate_covers_domain 20 changed_when: false 21 failed_when: false 22 when: 23 - regional_currency_enable_tls 24 - regional_currency_enable_landing_page 25 - regional_currency_tls_certificate.stat.exists 26 27 - name: Select the initial nginx protocol 28 ansible.builtin.set_fact: 29 regional_currency_nginx_tls_active: "{{ regional_currency_enable_tls and regional_currency_tls_certificate.stat.exists }}" 30 31 - name: Create the regional-currency landing page directory 32 ansible.builtin.file: 33 path: /var/www/regional-currency 34 state: directory 35 owner: root 36 group: root 37 mode: "0755" 38 when: regional_currency_enable_landing_page 39 40 - name: Install the regional-currency landing page 41 ansible.builtin.template: 42 src: landing-page.html.j2 43 dest: /var/www/regional-currency/index.html 44 owner: root 45 group: root 46 mode: "0644" 47 when: regional_currency_enable_landing_page 48 49 - name: Install LibEuFin bank rate-limit zones 50 ansible.builtin.template: 51 src: nginx-rate-limits.conf.j2 52 dest: /etc/nginx/conf.d/regional-currency-rate-limits.conf 53 owner: root 54 group: root 55 mode: "0644" 56 notify: Reload nginx 57 58 - name: Install the LibEuFin bank proxy settings 59 ansible.builtin.template: 60 src: nginx-bank-proxy.conf.j2 61 dest: /etc/nginx/snippets/regional-currency-bank-proxy.conf 62 owner: root 63 group: root 64 mode: "0644" 65 notify: Reload nginx 66 67 - name: Install nginx virtual hosts 68 ansible.builtin.template: 69 src: "nginx-{{ item }}.conf.j2" 70 dest: "/etc/nginx/sites-available/{{ item }}.{{ regional_currency_domain }}" 71 owner: root 72 group: root 73 mode: "0644" 74 loop: 75 - backend 76 - bank 77 - exchange 78 - landing 79 when: item != "landing" or regional_currency_enable_landing_page 80 notify: Reload nginx 81 82 - name: Enable nginx virtual hosts 83 ansible.builtin.file: 84 src: "/etc/nginx/sites-available/{{ item }}.{{ regional_currency_domain }}" 85 dest: "/etc/nginx/sites-enabled/{{ item }}.{{ regional_currency_domain }}" 86 state: link 87 loop: 88 - backend 89 - bank 90 - exchange 91 - landing 92 when: item != "landing" or regional_currency_enable_landing_page 93 notify: Reload nginx 94 95 - name: Disable the regional-currency landing page virtual host 96 ansible.builtin.file: 97 path: "{{ item }}" 98 state: absent 99 loop: 100 - "/etc/nginx/sites-enabled/landing.{{ regional_currency_domain }}" 101 - "/etc/nginx/sites-available/landing.{{ regional_currency_domain }}" 102 when: not regional_currency_enable_landing_page 103 notify: Reload nginx 104 105 - name: Remove the disabled regional-currency landing page 106 ansible.builtin.file: 107 path: /var/www/regional-currency 108 state: absent 109 when: not regional_currency_enable_landing_page 110 111 - name: Enable and start nginx 112 ansible.builtin.service: 113 name: nginx 114 enabled: true 115 state: started 116 117 - name: Activate the initial HTTP configuration 118 ansible.builtin.meta: flush_handlers 119 120 - name: Obtain the Let's Encrypt certificate 121 ansible.builtin.command: 122 argv: 123 - certbot 124 - certonly 125 - --nginx 126 - --non-interactive 127 - --agree-tos 128 - --email 129 - "{{ regional_currency_tls_email }}" 130 - --cert-name 131 - "backend.{{ regional_currency_domain }}" 132 - --expand 133 - --domains 134 - >- 135 {{ 136 ( 137 [ 138 'backend.' ~ regional_currency_domain, 139 'bank.' ~ regional_currency_domain, 140 'exchange.' ~ regional_currency_domain 141 ] 142 + ( 143 [regional_currency_domain] 144 if regional_currency_enable_landing_page 145 else [] 146 ) 147 ) | join(',') 148 }} 149 changed_when: true 150 when: 151 - regional_currency_enable_tls 152 - >- 153 not regional_currency_tls_certificate.stat.exists 154 or ( 155 regional_currency_enable_landing_page 156 and ( 157 regional_currency_tls_certificate_covers_domain.rc | default(1) 158 ) != 0 159 ) 160 161 - name: Enable TLS in nginx configuration 162 ansible.builtin.set_fact: 163 regional_currency_nginx_tls_active: true 164 when: regional_currency_enable_tls 165 166 - name: Install TLS-enabled nginx virtual hosts 167 ansible.builtin.template: 168 src: "nginx-{{ item }}.conf.j2" 169 dest: "/etc/nginx/sites-available/{{ item }}.{{ regional_currency_domain }}" 170 owner: root 171 group: root 172 mode: "0644" 173 loop: 174 - backend 175 - bank 176 - exchange 177 - landing 178 when: 179 - regional_currency_enable_tls 180 - item != "landing" or regional_currency_enable_landing_page 181 notify: Reload nginx 182 183 - name: Validate nginx configuration 184 ansible.builtin.command: nginx -t 185 changed_when: false 186 187 - name: Activate the final nginx configuration 188 ansible.builtin.meta: flush_handlers