task 1-4

2026-09-18 20:07:04 +02:00
parent 958e22734f
commit 442ddf8816
88 changed files with 2501 additions and 0 deletions
@@ -0,0 +1,7 @@
+---
+profile: production
+exclude_paths:
+  - roles/geerlingguy.nginx/
+  - roles/geerlingguy.certbot/
+skip_list:
+  - var-naming[no-role-prefix]
@@ -0,0 +1,3 @@
+skip_list:
+  - 'yaml'
+  - 'role-name'
@@ -0,0 +1,4 @@
+# These are supported funding model platforms
+---
+github: geerlingguy
+patreon: geerlingguy
@@ -0,0 +1,79 @@
+---
+name: CI
+'on':
+  pull_request:
+  push:
+    branches:
+      - master
+  schedule:
+    - cron: "30 2 * * 0"
+
+defaults:
+  run:
+    working-directory: 'geerlingguy.certbot'
+
+jobs:
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the codebase.
+        uses: actions/checkout@v4
+        with:
+          path: 'geerlingguy.certbot'
+
+      - name: Set up Python 3.
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'  # Can't go to 3.14+ until Ansible 13.x
+
+      - name: Install test dependencies.
+        run: pip3 install yamllint
+
+      - name: Lint code.
+        run: |
+          yamllint .
+
+  molecule:
+    name: Molecule
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - distro: rockylinux9
+            playbook: converge.yml
+            experimental: false
+          - distro: ubuntu2404
+            playbook: converge.yml
+            experimental: false
+          - distro: debian12
+            playbook: converge.yml
+            experimental: false
+
+          - distro: rockylinux9
+            playbook: playbook-snap-install.yml
+            experimental: true
+
+    steps:
+      - name: Check out the codebase.
+        uses: actions/checkout@v4
+        with:
+          path: 'geerlingguy.certbot'
+
+      - name: Set up Python 3.
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'  # Can't go to 3.14+ until Ansible 13.x
+
+      - name: Install test dependencies.
+        run: pip3 install ansible molecule molecule-plugins[docker] docker
+
+      - name: Run Molecule tests.
+        run: molecule test
+        continue-on-error: ${{ matrix.experimental }}
+        env:
+          PY_COLORS: '1'
+          ANSIBLE_FORCE_COLOR: '1'
+          MOLECULE_DISTRO: ${{ matrix.distro }}
+          MOLECULE_PLAYBOOK: ${{ matrix.playbook }}
@@ -0,0 +1,40 @@
+---
+# This workflow requires a GALAXY_API_KEY secret present in the GitHub
+# repository or organization.
+#
+# See: https://github.com/marketplace/actions/publish-ansible-role-to-galaxy
+# See: https://github.com/ansible/galaxy/issues/46
+
+name: Release
+'on':
+  push:
+    tags:
+      - '*'
+
+defaults:
+  run:
+    working-directory: 'geerlingguy.certbot'
+
+jobs:
+
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the codebase.
+        uses: actions/checkout@v4
+        with:
+          path: 'geerlingguy.certbot'
+
+      - name: Set up Python 3.
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'  # Can't go to 3.14+ until Ansible 13.x
+
+      - name: Install Ansible.
+        run: pip3 install ansible-core
+
+      - name: Trigger a new import on Galaxy.
+        run: >-
+          ansible-galaxy role import --api-key ${{ secrets.GALAXY_API_KEY }}
+          $(echo ${{ github.repository }} | cut -d/ -f1) $(echo ${{ github.repository }} | cut -d/ -f2)
@@ -0,0 +1,34 @@
+---
+name: Close inactive issues
+'on':
+  schedule:
+    - cron: "55 12 * * 1"  # semi-random time
+
+jobs:
+  close-issues:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
+    steps:
+      - uses: actions/stale@v8
+        with:
+          days-before-stale: 120
+          days-before-close: 60
+          exempt-issue-labels: bug,pinned,security,planned
+          exempt-pr-labels: bug,pinned,security,planned
+          stale-issue-label: "stale"
+          stale-pr-label: "stale"
+          stale-issue-message: |
+            This issue has been marked 'stale' due to lack of recent activity. If there is no further activity, the issue will be closed in another 30 days. Thank you for your contribution!
+            
+            Please read [this blog post](https://www.jeffgeerling.com/blog/2020/enabling-stale-issue-bot-on-my-github-repositories) to see the reasons why I mark issues as stale.
+          close-issue-message: |
+            This issue has been closed due to inactivity. If you feel this is in error, please reopen the issue or file a new issue with the relevant details.
+          stale-pr-message: |
+            This pr has been marked 'stale' due to lack of recent activity. If there is no further activity, the issue will be closed in another 30 days. Thank you for your contribution!
+            
+            Please read [this blog post](https://www.jeffgeerling.com/blog/2020/enabling-stale-issue-bot-on-my-github-repositories) to see the reasons why I mark issues as stale.
+          close-pr-message: |
+            This pr has been closed due to inactivity. If you feel this is in error, please reopen the issue or file a new issue with the relevant details.
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
@@ -0,0 +1,5 @@
+*.retry
+*/__pycache__
+*.pyc
+.cache
+
@@ -0,0 +1,13 @@
+---
+extends: default
+
+rules:
+  line-length:
+    max: 180
+    level: warning
+  indentation:
+    spaces: 2
+    indent-sequences: consistent
+
+ignore: |
+  .github/workflows/stale.yml
@@ -0,0 +1,20 @@
+The MIT License (MIT)
+
+Copyright (c) 2017 Jeff Geerling
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
@@ -0,0 +1,165 @@
+# Ansible Role: Certbot (for Let's Encrypt)
+
+[![CI](https://github.com/geerlingguy/ansible-role-certbot/actions/workflows/ci.yml/badge.svg)](https://github.com/geerlingguy/ansible-role-certbot/actions/workflows/ci.yml)
+
+Installs and configures Certbot (for Let's Encrypt).
+
+## Requirements
+
+If installing from source, Git is required. You can install Git using the `geerlingguy.git` role.
+
+Generally, installing from source (see section `Source Installation from Git`) leads to a better experience using Certbot and Let's Encrypt, especially if you're using an older OS release.
+
+## Role Variables
+
+    certbot_install_method: package
+
+Controls how Certbot is installed. Available options are 'package', 'snap', and 'source'.
+
+    certbot_auto_renew: true
+    certbot_auto_renew_user: "{{ ansible_user | default(lookup('env', 'USER')) }}"
+    certbot_auto_renew_hour: "3"
+    certbot_auto_renew_minute: "30"
+    certbot_auto_renew_options: "--quiet"
+
+By default, this role configures a cron job to run under the provided user account at the given hour and minute, every day. The defaults run `certbot renew` (or `certbot-auto renew`) via cron every day at 03:30:00 by the user you use in your Ansible playbook. It's preferred that you set a custom user/hour/minute so the renewal is during a low-traffic period and done by a non-root user account.
+
+### Automatic Certificate Generation
+
+Currently the `standalone` and `webroot` method are supported for generating new certificates using this role.
+
+**For a complete example**: see the fully functional test playbook in [molecule/default/playbook-standalone-nginx-aws.yml](molecule/default/playbook-standalone-nginx-aws.yml).
+
+    certbot_create_if_missing: false
+
+Set `certbot_create_if_missing` to `yes` or `True` to let this role generate certs. 
+
+    certbot_create_method: standalone
+
+Set the method used for generating certs with the `certbot_create_method` variable — current allowed values are: `standalone` or `webroot`.
+
+    certbot_testmode: false
+
+Enable test mode to only run a test request without actually creating certificates.
+
+    certbot_hsts: false
+
+Enable (HTTP Strict Transport Security) for the certificate generation.
+
+    certbot_admin_email: email@example.com
+
+The email address used to agree to Let's Encrypt's TOS and subscribe to cert-related notifications. This should be customized and set to an email address that you or your organization regularly monitors.
+
+    certbot_certs: []
+      # - email: janedoe@example.com
+      #   webroot: "/var/www/html"
+      #   domains:
+      #     - example1.com
+      #     - example2.com
+      # - domains:
+      #     - example3.com
+
+A list of domains (and other data) for which certs should be generated. You can add an `email` key to any list item to override the `certbot_admin_email`. When using the `webroot` creation method, a `webroot` item has to be provided, specifying which directory to use for the authentication. Make sure your webserver correctly delivers contents from this directory.
+
+    certbot_create_command: "{{ certbot_script }} certonly --standalone --noninteractive --agree-tos --email {{ cert_item.email | default(certbot_admin_email) }} -d {{ cert_item.domains | join(',') }}"
+
+The `certbot_create_command` defines the command used to generate the cert. See the full default command inside `defaults/main.yml` for a full example—and you can easily add in extra arguments that are not in the default command with the `certbot_create_extra_args` variable.
+
+#### Standalone Certificate Generation
+
+    certbot_create_standalone_stop_services:
+      - nginx
+
+Services that should be stopped while `certbot` runs it's own standalone server on ports 80 and 443. If you're running Apache, set this to `apache2` (Ubuntu), or `httpd` (RHEL), or if you have Nginx on port 443 and something else on port 80 (e.g. Varnish, a Java app, or something else), add it to the list so it is stopped when the certificate is generated.
+
+These services will only be stopped the first time a new cert is generated.
+
+### Snap Installation
+
+Beginning in December 2020, the Certbot maintainers decided to recommend installing Certbot from Snap rather than maintain scripts like `certbot-auto`.
+
+Setting `certbot_install_method: snap` configures this role to install Certbot via Snap.
+
+This install method is currently experimental and may or may not work across all Linux distributions.
+
+#### Webroot Certificate Generation
+
+When using the `webroot` creation method, a `webroot` item has to be provided for every `certbot_certs` item, specifying which directory to use for the authentication. Also, make sure your webserver correctly delivers contents from this directory.
+
+### Source Installation from Git
+
+You can install Certbot from it's Git source repository if desired with `certbot_install_method: source`. This might be useful in several cases, but especially when older distributions don't have Certbot packages available (e.g. CentOS < 7, Ubuntu < 16.10 and Debian < 8).
+
+    certbot_repo: https://github.com/certbot/certbot.git
+    certbot_version: master
+    certbot_keep_updated: true
+
+Certbot Git repository options. If installing from source, the configured `certbot_repo` is cloned, respecting the `certbot_version` setting. If `certbot_keep_updated` is set to `yes`, the repository is updated every time this role runs.
+
+    certbot_dir: /opt/certbot
+
+The directory inside which Certbot will be cloned.
+
+### Wildcard Certificates
+
+Let's Encrypt supports [generating wildcard certificates](https://community.letsencrypt.org/t/acme-v2-and-wildcard-certificate-support-is-live/55579), but the process for generating and using them is slightly more involved. See comments in [this pull request](https://github.com/geerlingguy/ansible-role-certbot/pull/60#issuecomment-423919284) for an example of how to use this role to maintain wildcard certs.
+
+Michael Porter also has a walkthrough of [Creating A Let’s Encrypt Wildcard Cert With Ansible](https://www.michaelpporter.com/2018/09/creating-a-wildcard-cert-with-ansible/), specifically with Cloudflare.
+
+## Dependencies
+
+None.
+
+## Example Playbook
+
+    - hosts: servers
+    
+      vars:
+        certbot_auto_renew_user: your_username_here
+        certbot_auto_renew_minute: "20"
+        certbot_auto_renew_hour: "5"
+    
+      roles:
+        - geerlingguy.certbot
+
+See other examples in the `tests/` directory.
+
+### Manually creating certificates with certbot
+
+_Note: You can have this role automatically generate certificates; see the "Automatic Certificate Generation" documentation above._
+
+You can manually create certificates using the `certbot` (or `certbot-auto`) script (use `letsencrypt` on Ubuntu 16.04, or use `/opt/certbot/certbot-auto` if installing from source/Git. Here are some example commands to configure certificates with Certbot:
+
+    # Automatically add certs for all Apache virtualhosts (use with caution!).
+    certbot --apache
+
+    # Generate certs, but don't modify Apache configuration (safer).
+    certbot --apache certonly
+
+If you want to fully automate the process of adding a new certificate, but don't want to use this role's built in functionality, you can do so using the command line options to register, accept the terms of service, and then generate a cert using the standalone server:
+
+  1. Make sure any services listening on ports 80 and 443 (Apache, Nginx, Varnish, etc.) are stopped.
+  2. Register with something like `certbot register --agree-tos --email [your-email@example.com]`
+    - Note: You won't need to do this step in the future, when generating additional certs on the same server.
+  3. Generate a cert for a domain whose DNS points to this server: `certbot certonly --noninteractive --standalone -d example.com -d www.example.com`
+  4. Re-start whatever was listening on ports 80 and 443 before.
+  5. Update your webserver's virtualhost TLS configuration to point at the new certificate (`fullchain.pem`) and private key (`privkey.pem`) Certbot just generated for the domain you passed in the `certbot` command.
+  6. Reload or restart your webserver so it uses the new HTTPS virtualhost configuration.
+
+### Certbot certificate auto-renewal
+
+By default, this role adds a cron job that will renew all installed certificates once per day at the hour and minute of your choosing.
+
+You can test the auto-renewal (without actually renewing the cert) with the command:
+
+    /opt/certbot/certbot-auto renew --dry-run
+
+See full documentation and options on the [Certbot website](https://certbot.eff.org/).
+
+## License
+
+MIT / BSD
+
+## Author Information
+
+This role was created in 2016 by [Jeff Geerling](https://www.jeffgeerling.com/), author of [Ansible for DevOps](https://www.ansiblefordevops.com/).
@@ -0,0 +1,70 @@
+---
+# Certbot auto-renew cron job configuration (for certificate renewals).
+certbot_auto_renew: true
+certbot_auto_renew_user: "{{ ansible_user | default(lookup('env', 'USER')) }}"
+certbot_auto_renew_hour: "3"
+certbot_auto_renew_minute: "30"
+certbot_auto_renew_options: "--quiet"
+
+certbot_testmode: false
+certbot_hsts: false
+
+
+# Parameters used when creating new Certbot certs.
+certbot_create_if_missing: false
+certbot_create_method: standalone
+certbot_create_extra_args: ""
+certbot_admin_email: email@example.com
+certbot_expand: false
+
+# Default webroot, overwritten by individual per-cert webroot directories
+certbot_webroot: /var/www/letsencrypt
+
+certbot_certs: []
+# - name: example.com
+#   email: janedoe@example.com
+#   webroot: "/var/www/html/"
+#   domains:
+#     - example1.com
+#     - example2.com
+# - domains:
+#     - example3.com
+
+certbot_create_command: >-
+  {{ certbot_script }} certonly --{{ certbot_create_method  }}
+  {{ '--hsts' if certbot_hsts else '' }}
+  {{ '--test-cert' if certbot_testmode else '' }}
+  --noninteractive --agree-tos
+  --email {{ cert_item.email | default(certbot_admin_email) }}
+  {{ '--expand' if certbot_expand else '' }}
+  {{ '--webroot-path ' if certbot_create_method == 'webroot'  else '' }}
+  {{ cert_item.webroot | default(certbot_webroot) if certbot_create_method == 'webroot' else '' }}
+  {{ certbot_create_extra_args }}
+  --cert-name {{ cert_item_name }}
+  -d {{ cert_item.domains | join(',') }}
+  {{ '--expand' if certbot_expand else '' }}
+  {{ '--pre-hook /etc/letsencrypt/renewal-hooks/pre/stop_services'
+    if certbot_create_standalone_stop_services and certbot_create_method == 'standalone'
+  else '' }}
+  {{ '--post-hook /etc/letsencrypt/renewal-hooks/post/start_services'
+    if certbot_create_standalone_stop_services and certbot_create_method == 'standalone'
+  else '' }}
+  {{ "--deploy-hook '" ~ cert_item.deploy_hook ~ "'"
+    if 'deploy_hook' in cert_item
+  else '' }}
+
+certbot_create_standalone_stop_services:
+  - nginx
+  # - apache
+  # - varnish
+
+# Available options: 'package', 'snap', 'source'.
+certbot_install_method: 'package'
+
+# Source install configuration.
+certbot_repo: https://github.com/certbot/certbot.git
+certbot_version: master
+certbot_keep_updated: true
+
+# Where to put Certbot when installing from source.
+certbot_dir: /opt/certbot
@@ -0,0 +1,2 @@
+install_date: Fri 18 Sep 15:31:24 2026
+version: 5.5.0
@@ -0,0 +1,30 @@
+---
+dependencies: []
+
+galaxy_info:
+  role_name: certbot
+  author: geerlingguy
+  description: "Installs and configures Certbot (for Let's Encrypt)."
+  company: "Midwestern Mac, LLC"
+  license: "license (BSD, MIT)"
+  min_ansible_version: 2.10
+  platforms:
+    - name: Fedora
+      versions:
+        - all
+    - name: Ubuntu
+      versions:
+        - all
+    - name: Debian
+      versions:
+        - all
+  galaxy_tags:
+    - networking
+    - system
+    - web
+    - certbot
+    - letsencrypt
+    - encryption
+    - certificates
+    - ssl
+    - https
@@ -0,0 +1,28 @@
+---
+- name: Converge
+  hosts: all
+  # become: true
+
+  vars:
+    certbot_auto_renew_user: root
+
+  pre_tasks:
+    - name: Update apt cache.
+      apt: update_cache=yes cache_valid_time=600
+      when: ansible_facts.os_family == 'Debian'
+      changed_when: false
+
+    - name: Install dependencies (RedHat).
+      yum:
+        name:
+          - cronie
+          - epel-release
+        state: present
+      when: ansible_facts.os_family == 'RedHat'
+
+    - name: Install cron (Debian).
+      apt: name=cron state=present
+      when: ansible_facts.os_family == 'Debian'
+
+  roles:
+    - geerlingguy.certbot
@@ -0,0 +1,21 @@
+---
+role_name_check: 1
+dependency:
+  name: galaxy
+  options:
+    ignore-errors: true
+driver:
+  name: docker
+platforms:
+  - name: instance
+    image: "geerlingguy/docker-${MOLECULE_DISTRO:-rockylinux9}-ansible:latest"
+    command: ${MOLECULE_DOCKER_COMMAND:-""}
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
+    privileged: true
+    pre_build_image: true
+provisioner:
+  name: ansible
+  playbooks:
+    converge: ${MOLECULE_PLAYBOOK:-converge.yml}
@@ -0,0 +1,26 @@
+---
+- name: Converge
+  hosts: all
+  #become: true
+
+  vars:
+    certbot_install_method: 'snap'
+    certbot_auto_renew_user: root
+
+  pre_tasks:
+    - name: Update apt cache.
+      apt: update_cache=yes cache_valid_time=600
+      when: ansible_facts.os_family == 'Debian'
+      changed_when: false
+
+    - name: Install cron (RedHat).
+      yum: name=cronie state=present
+      when: ansible_facts.os_family == 'RedHat'
+
+    - name: Install cron (Debian).
+      apt: name=cron state=present
+      when: ansible_facts.os_family == 'Debian'
+
+  roles:
+    - geerlingguy.git
+    - geerlingguy.certbot
@@ -0,0 +1,26 @@
+---
+- name: Converge
+  hosts: all
+  #become: true
+
+  vars:
+    certbot_install_method: 'source'
+    certbot_auto_renew_user: root
+
+  pre_tasks:
+    - name: Update apt cache.
+      apt: update_cache=yes cache_valid_time=600
+      when: ansible_facts.os_family == 'Debian'
+      changed_when: false
+
+    - name: Install cron (RedHat).
+      yum: name=cronie state=present
+      when: ansible_facts.os_family == 'RedHat'
+
+    - name: Install cron (Debian).
+      apt: name=cron state=present
+      when: ansible_facts.os_family == 'Debian'
+
+  roles:
+    - geerlingguy.git
+    - geerlingguy.certbot
@@ -0,0 +1,181 @@
+---
+# To run:
+#   1. Ensure Ansible and Boto are installed (pip install ansible boto).
+#   2. Ensure you have AWS credentials stored where Boto can find them, and they
+#      are under the profile 'mm'.
+#   3. Ensure you have a pubkey available at ~/.ssh/id_rsa.pub.
+#   3. Run the playbook: ansible-playbook test-standalone-nginx-aws.yml
+
+# Play 1: Provision EC2 instance and A record.
+- hosts: localhost
+  connection: local
+  gather_facts: false
+
+  tasks:
+    - name: Configure EC2 Security Group.
+      ec2_group:
+        profile: mm
+        name: certbot_test_http
+        description: HTTP security group for Certbot testing.
+        region: "us-east-1"
+        state: present
+        rules:
+          - proto: tcp
+            from_port: 80
+            to_port: 80
+            cidr_ip: 0.0.0.0/0
+          - proto: tcp
+            from_port: 443
+            to_port: 443
+            cidr_ip: 0.0.0.0/0
+          - proto: tcp
+            from_port: 22
+            to_port: 22
+            cidr_ip: 0.0.0.0/0
+        rules_egress: []
+
+    - name: Add EC2 Key Pair.
+      ec2_key:
+        profile: mm
+        region: "us-east-1"
+        name: certbot_test
+        key_material: "{{ item }}"
+      with_file:
+        - ~/.ssh/id_rsa.pub
+
+    - name: Provision EC2 instance.
+      ec2:
+        profile: mm
+        key_name: certbot_test
+        instance_tags:
+          Name: "certbot-standalone-nginx-test"
+        group: ['default', 'certbot_test_http']
+        instance_type: t2.micro
+        # CentOS Linux 7 x86_64 HVM EBS
+        image: ami-02e98f78
+        region: "us-east-1"
+        wait: true
+        wait_timeout: 500
+        exact_count: 1
+        count_tag:
+          Name: "certbot-standalone-nginx-test"
+      register: created_instance
+
+    - name: Add A record for the new EC2 instance IP in Route53.
+      route53:
+        profile: mm
+        command: create
+        zone: servercheck.in
+        record: certbot-test.servercheck.in
+        type: A
+        ttl: 300
+        value: "{{ created_instance.tagged_instances.0.public_ip }}"
+        wait: true
+        overwrite: true
+
+    - name: Add EC2 instance to inventory groups.
+      add_host:
+        name: "certbot-test.servercheck.in"
+        groups: "aws,aws_nginx"
+        ansible_ssh_user: centos
+        host_key_checking: false
+      when: created_instance.tagged_instances.0.id is defined
+
+# Play 2: Configure EC2 instance with Certbot and Nginx.
+- hosts: aws_nginx
+  gather_facts: true
+  become: true
+
+  vars:
+    certbot_admin_email: https@servercheck.in
+    certbot_create_if_missing: true
+    certbot_create_standalone_stop_services: []
+    certbot_certs:
+      - name: certbot-test.servercheck.in
+        domains:
+          - certbot-test.servercheck.in
+    nginx_vhosts:
+      - listen: "443 ssl http2"
+        server_name: "certbot-test.servercheck.in"
+        root: "/usr/share/nginx/html"
+        index: "index.html index.htm"
+        state: "present"
+        template: "{{ nginx_vhost_template }}"
+        filename: "certbot_test.conf"
+        extra_parameters: |
+          ssl_certificate     /etc/letsencrypt/live/certbot-test.servercheck.in/fullchain.pem;
+          ssl_certificate_key /etc/letsencrypt/live/certbot-test.servercheck.in/privkey.pem;
+          ssl_protocols       TLSv1.1 TLSv1.2;
+          ssl_ciphers         HIGH:!aNULL:!MD5;
+
+  pre_tasks:
+    - name: Update apt cache.
+      apt: update_cache=true cache_valid_time=600
+      when: ansible_facts.os_family == 'Debian'
+      changed_when: false
+
+    - name: Install dependencies (RedHat).
+      yum: name={{ item }} state=present
+      when: ansible_facts.os_family == 'RedHat'
+      with_items:
+        - cronie
+        - epel-release
+
+    - name: Install cron (Debian).
+      apt: name=cron state=present
+      when: ansible_facts.os_family == 'Debian'
+
+  roles:
+    - geerlingguy.certbot
+    - geerlingguy.nginx
+
+  tasks:
+    - name: Flush handlers in case any configs have changed.
+      meta: flush_handlers
+
+    - name: Test secure connection to SSL domain.
+      uri:
+        url: https://certbot-test.servercheck.in/
+        status_code: 200
+      delegate_to: localhost
+      become: false
+
+# Play 3: Tear down EC2 instance and A record.
+- hosts: localhost
+  connection: local
+  gather_facts: false
+
+  tasks:
+    - name: Destroy EC2 instance.
+      ec2:
+        profile: mm
+        instance_ids: ["{{ created_instance.tagged_instances.0.id }}"]
+        region: "us-east-1"
+        state: absent
+        wait: true
+        wait_timeout: 500
+
+    - name: Delete Security Group.
+      ec2_group:
+        profile: mm
+        name: certbot_test_http
+        region: "us-east-1"
+        state: absent
+
+    - name: Delete Key Pair.
+      ec2_key:
+        profile: mm
+        name: certbot_test
+        region: "us-east-1"
+        state: absent
+
+    - name: Delete Route53 record.
+      route53:
+        profile: mm
+        state: delete
+        zone: servercheck.in
+        record: certbot-test.servercheck.in
+        type: A
+        ttl: 300
+        # See: https://github.com/ansible/ansible/pull/32297
+        value: []
@@ -0,0 +1,3 @@
+---
+- src: geerlingguy.git
+- src: geerlingguy.nginx
@@ -0,0 +1,63 @@
+---
+- name: Determine certificate name
+  set_fact:
+    cert_item_name: "{{ cert_item.name | default(cert_item.domains | first | replace('*.', '')) }}"
+
+- name: Check if certificate already exists.
+  stat:
+    path: /etc/letsencrypt/live/{{ cert_item_name }}/cert.pem
+  register: letsencrypt_cert
+
+- name: Ensure pre and post hook folders exist.
+  file:
+    path: /etc/letsencrypt/renewal-hooks/{{ item }}
+    state: directory
+    mode: 0755
+    owner: root
+    group: root
+  with_items:
+    - pre
+    - post
+
+- name: Create pre hook to stop services.
+  template:
+    src: stop_services.j2
+    dest: /etc/letsencrypt/renewal-hooks/pre/stop_services
+    owner: root
+    group: root
+    mode: 0750
+  when:
+    - certbot_create_standalone_stop_services is defined
+    - certbot_create_standalone_stop_services is truthy
+
+- name: Create post hook to start services.
+  template:
+    src: start_services.j2
+    dest: /etc/letsencrypt/renewal-hooks/post/start_services
+    owner: root
+    group: root
+    mode: 0750
+  when:
+    - certbot_create_standalone_stop_services is defined
+    - certbot_create_standalone_stop_services is truthy
+
+- name: Check if domains have changed
+  block:
+    - name: Register certificate domains
+      shell: "{{ certbot_script }} certificates --cert-name {{ cert_item_name }} | grep -E '(Domains|Identifiers)' | cut -d':' -f2"
+      changed_when: false
+      register: letsencrypt_cert_domains_dirty
+
+    - name: Cleanup domain list
+      set_fact:
+        letsencrypt_cert_domains: "{{ letsencrypt_cert_domains_dirty.stdout | trim | split(' ') | map('trim') | select('!=', '') | list | sort }}"
+
+    - name: Determine if domains have changed
+      set_fact:
+        letsencrypt_cert_domains_changed: "{{ letsencrypt_cert_domains != (cert_item.domains | map('trim') | select('!=', '') | list | sort) }}"
+
+  when: letsencrypt_cert.stat.exists
+
+- name: Generate new certificate if one doesn't exist.
+  command: "{{ certbot_create_command }}"
+  when: not letsencrypt_cert.stat.exists or letsencrypt_cert_domains_changed | default(false)
@@ -0,0 +1,35 @@
+---
+- name: Determine certificate name
+  set_fact:
+    cert_item_name: "{{ cert_item.name | default(cert_item.domains | first | replace('*.', '')) }}"
+
+- name: Check if certificate already exists.
+  stat:
+    path: /etc/letsencrypt/live/{{ cert_item_name }}/cert.pem
+  register: letsencrypt_cert
+
+- name: Create webroot directory if it doesn't exist yet
+  file:
+    path: "{{ cert_item.webroot | default(certbot_webroot) }}"
+    state: directory
+
+- name: Check if domains have changed
+  block:
+    - name: Register certificate domains
+      shell: "{{ certbot_script }} certificates --cert-name {{ cert_item_name }} | grep -E '(Domains|Identifiers)' | cut -d':' -f2"
+      changed_when: false
+      register: letsencrypt_cert_domains_dirty
+
+    - name: Cleanup domain list
+      set_fact:
+        letsencrypt_cert_domains: "{{ letsencrypt_cert_domains_dirty.stdout | trim | split(' ') | map('trim') | select('!=', '') | list | sort }}"
+
+    - name: Determine if domains have changed
+      set_fact:
+        letsencrypt_cert_domains_changed: "{{ letsencrypt_cert_domains != (cert_item.domains | map('trim') | select('!=', '') | list | sort) }}"
+
+  when: letsencrypt_cert.stat.exists
+
+- name: Generate new certificate if one doesn't exist.
+  command: "{{ certbot_create_command }}"
+  when: not letsencrypt_cert.stat.exists or letsencrypt_cert_domains_changed | default(false)
@@ -0,0 +1,8 @@
+---
+- name: Load a variable file based on the OS type, or a default if not found.
+  include_vars: "{{ item }}"
+  with_first_found:
+    - "{{ ansible_facts.distribution }}-{{ ansible_facts.distribution_version }}.yml"
+    - "{{ ansible_facts.distribution }}.yml"
+    - "{{ ansible_facts.os_family }}.yml"
+    - "default.yml"
@@ -0,0 +1,17 @@
+---
+- name: Clone Certbot into configured directory.
+  git:
+    repo: "{{ certbot_repo }}"
+    dest: "{{ certbot_dir }}"
+    version: "{{ certbot_version }}"
+    update: "{{ certbot_keep_updated }}"
+    force: true
+
+- name: Set Certbot script variable.
+  set_fact:
+    certbot_script: "{{ certbot_dir }}/certbot-auto"
+
+- name: Ensure certbot-auto is executable.
+  file:
+    path: "{{ certbot_script }}"
+    mode: 0755
@@ -0,0 +1,9 @@
+---
+- name: Install Certbot.
+  package:
+    name: "{{ certbot_package }}"
+    state: present
+
+- name: Set Certbot script variable.
+  set_fact:
+    certbot_script: "{{ certbot_package }}"
@@ -0,0 +1,41 @@
+---
+- name: Ensure snapd is installed.
+  package:
+    name: snapd
+    state: present
+  register: snapd_install
+
+- name: Ensure snapd is enabled.
+  systemd:
+    name: snapd.socket
+    enabled: true
+    state: started
+
+- name: Enable classic snap support.
+  file:
+    src: /var/lib/snapd/snap
+    dest: /snap
+    state: link
+  when: ansible_facts.os_family != "Debian"
+
+- name: Update snap after install.
+  shell: snap install core; snap refresh core
+  changed_when: true
+  failed_when: false
+  when: snapd_install is changed
+
+- name: Install certbot via snap.
+  snap:
+    name: certbot
+    classic: true
+
+- name: Symlink certbot into place.
+  file:
+    src: /snap/bin/certbot
+    dest: /usr/bin/certbot
+    state: link
+  ignore_errors: "{{ ansible_check_mode }}"
+
+- name: Set Certbot script variable.
+  set_fact:
+    certbot_script: /usr/bin/certbot
@@ -0,0 +1,33 @@
+---
+- import_tasks: include-vars.yml
+
+- import_tasks: setup-RedHat.yml
+  when: ansible_facts.os_family == 'RedHat'
+
+- import_tasks: install-with-package.yml
+  when: certbot_install_method == 'package'
+
+- import_tasks: install-with-snap.yml
+  when: certbot_install_method == 'snap'
+
+- import_tasks: install-from-source.yml
+  when: certbot_install_method == 'source'
+
+- include_tasks: create-cert-standalone.yml
+  with_items: "{{ certbot_certs }}"
+  when:
+    - certbot_create_if_missing
+    - certbot_create_method == 'standalone'
+  loop_control:
+    loop_var: cert_item
+
+- include_tasks: create-cert-webroot.yml
+  with_items: "{{ certbot_certs }}"
+  when:
+    - certbot_create_if_missing
+    - certbot_create_method == 'webroot'
+  loop_control:
+    loop_var: cert_item
+
+- import_tasks: renew-cron.yml
+  when: certbot_auto_renew
@@ -0,0 +1,8 @@
+---
+- name: Add cron job for certbot renewal (if configured).
+  cron:
+    name: Certbot automatic renewal.
+    job: "{{ certbot_script }} renew {{ certbot_auto_renew_options }}"
+    minute: "{{ certbot_auto_renew_minute }}"
+    hour: "{{ certbot_auto_renew_hour }}"
+    user: "{{ certbot_auto_renew_user }}"
@@ -0,0 +1,12 @@
+---
+# See: https://github.com/geerlingguy/ansible-role-certbot/issues/107
+- name: Ensure dnf-plugins are installed on Rocky/AlmaLinux.
+  yum:
+    name: dnf-plugins-core
+    state: present
+
+- name: Enable DNF module for Rocky/AlmaLinux.
+  shell: |
+    dnf config-manager --set-enabled crb
+  changed_when: false
+  when: ansible_distribution != 'Fedora'
@@ -0,0 +1,15 @@
+#!/bin/bash
+# {{ ansible_managed }}
+
+{% for item in certbot_create_standalone_stop_services %}
+echo "starting service {{ item }}"
+{% if ansible_facts.service_mgr == 'systemd' %}
+systemctl start {{ item }}
+{% elif ansible_facts.service_mgr == 'upstart' %}
+initctl start {{ item }}
+{% elif ansible_facts.service_mgr == 'openrc' %}
+rc-service {{ item }} start
+{% else %}
+service {{ item }} start
+{% endif %}
+{% endfor %}
@@ -0,0 +1,15 @@
+#!/bin/bash
+# {{ ansible_managed }}
+
+{% for item in certbot_create_standalone_stop_services %}
+echo "stopping service {{ item }}"
+{% if ansible_facts.service_mgr == 'systemd' %}
+systemctl stop {{ item }}
+{% elif ansible_facts.service_mgr == 'upstart' %}
+initctl stop {{ item }}
+{% elif ansible_facts.service_mgr == 'openrc' %}
+rc-service {{ item }} stop
+{% else %}
+service {{ item }} stop
+{% endif %}
+{% endfor %}
@@ -0,0 +1,2 @@
+---
+certbot_package: letsencrypt
@@ -0,0 +1,2 @@
+---
+certbot_package: certbot
@@ -0,0 +1,3 @@
+skip_list:
+  - 'yaml'
+  - 'role-name'
@@ -0,0 +1,4 @@
+# These are supported funding model platforms
+---
+github: geerlingguy
+patreon: geerlingguy
@@ -0,0 +1,67 @@
+---
+name: CI
+'on':
+  pull_request:
+  push:
+    branches:
+      - master
+  schedule:
+    - cron: "0 6 * * 3"
+
+defaults:
+  run:
+    working-directory: 'geerlingguy.nginx'
+
+jobs:
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the codebase.
+        uses: actions/checkout@v4
+        with:
+          path: 'geerlingguy.nginx'
+
+      - name: Set up Python 3.
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'  # Can't go to 3.14+ until Ansible 13.x
+
+      - name: Install test dependencies.
+        run: pip3 install yamllint
+
+      - name: Lint code.
+        run: |
+          yamllint .
+
+  molecule:
+    name: Molecule
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        distro:
+          - rockylinux9
+          - ubuntu2204
+          - debian12
+
+    steps:
+      - name: Check out the codebase.
+        uses: actions/checkout@v4
+        with:
+          path: 'geerlingguy.nginx'
+
+      - name: Set up Python 3.
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'  # Can't go to 3.14+ until Ansible 13.x
+
+      - name: Install test dependencies.
+        run: pip3 install ansible molecule molecule-plugins[docker] docker
+
+      - name: Run Molecule tests.
+        run: molecule test
+        env:
+          PY_COLORS: '1'
+          ANSIBLE_FORCE_COLOR: '1'
+          MOLECULE_DISTRO: ${{ matrix.distro }}
@@ -0,0 +1,40 @@
+---
+# This workflow requires a GALAXY_API_KEY secret present in the GitHub
+# repository or organization.
+#
+# See: https://github.com/marketplace/actions/publish-ansible-role-to-galaxy
+# See: https://github.com/ansible/galaxy/issues/46
+
+name: Release
+'on':
+  push:
+    tags:
+      - '*'
+
+defaults:
+  run:
+    working-directory: 'geerlingguy.nginx'
+
+jobs:
+
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the codebase.
+        uses: actions/checkout@v4
+        with:
+          path: 'geerlingguy.nginx'
+
+      - name: Set up Python 3.
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'  # Can't go to 3.14+ until Ansible 13.x
+
+      - name: Install Ansible.
+        run: pip3 install ansible-core
+
+      - name: Trigger a new import on Galaxy.
+        run: >-
+          ansible-galaxy role import --api-key ${{ secrets.GALAXY_API_KEY }}
+          $(echo ${{ github.repository }} | cut -d/ -f1) $(echo ${{ github.repository }} | cut -d/ -f2)
@@ -0,0 +1,34 @@
+---
+name: Close inactive issues
+'on':
+  schedule:
+    - cron: "55 18 * * 6"  # semi-random time
+
+jobs:
+  close-issues:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
+    steps:
+      - uses: actions/stale@v8
+        with:
+          days-before-stale: 120
+          days-before-close: 60
+          exempt-issue-labels: bug,pinned,security,planned
+          exempt-pr-labels: bug,pinned,security,planned
+          stale-issue-label: "stale"
+          stale-pr-label: "stale"
+          stale-issue-message: |
+            This issue has been marked 'stale' due to lack of recent activity. If there is no further activity, the issue will be closed in another 30 days. Thank you for your contribution!
+            
+            Please read [this blog post](https://www.jeffgeerling.com/blog/2020/enabling-stale-issue-bot-on-my-github-repositories) to see the reasons why I mark issues as stale.
+          close-issue-message: |
+            This issue has been closed due to inactivity. If you feel this is in error, please reopen the issue or file a new issue with the relevant details.
+          stale-pr-message: |
+            This pr has been marked 'stale' due to lack of recent activity. If there is no further activity, the issue will be closed in another 30 days. Thank you for your contribution!
+            
+            Please read [this blog post](https://www.jeffgeerling.com/blog/2020/enabling-stale-issue-bot-on-my-github-repositories) to see the reasons why I mark issues as stale.
+          close-pr-message: |
+            This pr has been closed due to inactivity. If you feel this is in error, please reopen the issue or file a new issue with the relevant details.
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
@@ -0,0 +1,7 @@
+*.retry
+*/__pycache__
+*.pyc
+.cache
+
+venv/
+.vscode/
@@ -0,0 +1,10 @@
+---
+extends: default
+
+rules:
+  line-length:
+    max: 120
+    level: warning
+
+ignore: |
+  .github/workflows/stale.yml
@@ -0,0 +1,20 @@
+The MIT License (MIT)
+
+Copyright (c) 2017 Jeff Geerling
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
@@ -0,0 +1,250 @@
+# Ansible Role: Nginx
+
+[![CI](https://github.com/geerlingguy/ansible-role-nginx/actions/workflows/ci.yml/badge.svg)](https://github.com/geerlingguy/ansible-role-nginx/actions/workflows/ci.yml)
+
+**Note:** Please consider using the official [NGINX Ansible role](https://github.com/nginxinc/ansible-role-nginx) from NGINX, Inc.
+
+Installs Nginx on RedHat/CentOS, Debian/Ubuntu, Archlinux, FreeBSD or OpenBSD servers.
+
+This role installs and configures the latest version of Nginx from the Nginx yum repository (on RedHat-based systems), apt (on Debian-based systems), pacman (Archlinux), pkgng (on FreeBSD systems) or pkg_add (on OpenBSD systems). You will likely need to do extra setup work after this role has installed Nginx, like adding your own [virtualhost].conf file inside `/etc/nginx/conf.d/`, describing the location and options to use for your particular website.
+
+## Requirements
+
+None.
+
+## Role Variables
+
+Available variables are listed below, along with default values (see `defaults/main.yml`):
+
+
+    nginx_listen_ipv6: true
+
+Whether or not to listen on IPv6 (applied to all vhosts managed by this role).
+
+    nginx_vhosts: []
+
+A list of vhost definitions (server blocks) for Nginx virtual hosts. Each entry will create a separate config file named by `server_name`. If left empty, you will need to supply your own virtual host configuration. See the commented example in `defaults/main.yml` for available server options. If you have a large number of customizations required for your server definition(s), you're likely better off managing the vhost configuration file yourself, leaving this variable set to `[]`.
+
+    nginx_vhosts:
+      - listen: "443 ssl http2"
+        server_name: "example.com"
+        server_name_redirect: "www.example.com"
+        root: "/var/www/example.com"
+        index: "index.php index.html index.htm"
+        error_page: ""
+        access_log: ""
+        error_log: ""
+        state: "present"
+        template: "{{ nginx_vhost_template }}"
+        filename: "example.com.conf"
+        extra_parameters: |
+          location ~ \.php$ {
+              fastcgi_split_path_info ^(.+\.php)(/.+)$;
+              fastcgi_pass unix:/var/run/php5-fpm.sock;
+              fastcgi_index index.php;
+              fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+              include fastcgi_params;
+          }
+          ssl_certificate     /etc/ssl/certs/ssl-cert-snakeoil.pem;
+          ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
+          ssl_protocols       TLSv1.1 TLSv1.2;
+          ssl_ciphers         HIGH:!aNULL:!MD5;
+
+An example of a fully-populated nginx_vhosts entry, using a `|` to declare a block of syntax for the `extra_parameters`.
+
+Please take note of the indentation in the above block. The first line should be a normal 2-space indent. All other lines should be indented normally relative to that line. In the generated file, the entire block will be 4-space indented. This style will ensure the config file is indented correctly.
+
+      - listen: "80"
+        server_name: "example.com www.example.com"
+        return: "301 https://example.com$request_uri"
+        filename: "example.com.80.conf"
+
+An example of a secondary vhost which will redirect to the one shown above.
+
+*Note: The `filename` defaults to the first domain in `server_name`, if you have two vhosts with the same domain, eg. a redirect, you need to manually set the `filename` so the second one doesn't override the first one*
+
+    nginx_remove_default_vhost: false
+
+Whether to remove the 'default' virtualhost configuration supplied by Nginx. Useful if you want the base `/` URL to be directed at one of your own virtual hosts configured in a separate .conf file.
+
+    nginx_upstreams: []
+
+If you are configuring Nginx as a load balancer, you can define one or more upstream sets using this variable. In addition to defining at least one upstream, you would need to configure one of your server blocks to proxy requests through the defined upstream (e.g. `proxy_pass http://myapp1;`). See the commented example in `defaults/main.yml` for more information.
+
+    nginx_user: "nginx"
+
+The user under which Nginx will run. Defaults to `nginx` for RedHat, `www-data` for Debian and `www` on FreeBSD and OpenBSD.
+
+    nginx_worker_processes: "{{ ansible_processor_vcpus|default(ansible_processor_count) }}"
+    nginx_worker_connections: "1024"
+    nginx_multi_accept: "off"
+
+`nginx_worker_processes` should be set to the number of cores present on your machine (if the default is incorrect, find this number with `grep processor /proc/cpuinfo | wc -l`). `nginx_worker_connections` is the number of connections per process. Set this higher to handle more simultaneous connections (and remember that a connection will be used for as long as the keepalive timeout duration for every client!). You can set `nginx_multi_accept` to `on` if you want Nginx to accept all connections immediately.
+
+    nginx_error_log: "/var/log/nginx/error.log warn"
+    nginx_access_log: "/var/log/nginx/access.log main buffer=16k flush=2m"
+
+Configuration of the default error and access logs. Set to `off` to disable a log entirely.
+
+    nginx_sendfile: "on"
+    nginx_tcp_nopush: "on"
+    nginx_tcp_nodelay: "on"
+
+TCP connection options. See [this blog post](https://t37.net/nginx-optimization-understanding-sendfile-tcp_nodelay-and-tcp_nopush.html) for more information on these directives.
+
+    nginx_keepalive_timeout: "65"
+    nginx_keepalive_requests: "100"
+
+Nginx keepalive settings. Timeout should be set higher (10s+) if you have more polling-style traffic (AJAX-powered sites especially), or lower (<10s) if you have a site where most users visit a few pages and don't send any further requests.
+
+    nginx_server_tokens: "on"
+
+Nginx server_tokens settings. Controls whether nginx responds with it's version in HTTP headers. Set to `"off"` to disable.
+
+    nginx_client_max_body_size: "64m"
+
+This value determines the largest file upload possible, as uploads are passed through Nginx before hitting a backend like `php-fpm`. If you get an error like `client intended to send too large body`, it means this value is set too low.
+
+    nginx_server_names_hash_bucket_size: "64"
+
+If you have many server names, or have very long server names, you might get an Nginx error on startup requiring this value to be increased.
+
+    nginx_proxy_cache_path: ""
+
+Set as the `proxy_cache_path` directive in the `nginx.conf` file. By default, this will not be configured (if left as an empty string), but if you wish to use Nginx as a reverse proxy, you can set this to a valid value (e.g. `"/var/cache/nginx keys_zone=cache:32m"`) to use Nginx's cache (further proxy configuration can be done in individual server configurations).
+
+    nginx_extra_http_options: ""
+
+Extra lines to be inserted in the top-level `http` block in `nginx.conf`. The value should be defined literally (as you would insert it directly in the `nginx.conf`, adhering to the Nginx configuration syntax - such as `;` for line termination, etc.), for example:
+
+    nginx_extra_http_options: |
+      proxy_buffering    off;
+      proxy_set_header   X-Real-IP $remote_addr;
+      proxy_set_header   X-Scheme $scheme;
+      proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header   Host $http_host;
+
+See the template in `templates/nginx.conf.j2` for more details on the placement.
+
+    nginx_extra_conf_options: ""
+
+Extra lines to be inserted in the top of `nginx.conf`. The value should be defined literally (as you would insert it directly in the `nginx.conf`, adhering to the Nginx configuration syntax - such as `;` for line termination, etc.), for example:
+
+    nginx_extra_conf_options: |
+      worker_rlimit_nofile 8192;
+
+See the template in `templates/nginx.conf.j2` for more details on the placement.
+
+    nginx_log_format: |-
+      '$remote_addr - $remote_user [$time_local] "$request" '
+      '$status $body_bytes_sent "$http_referer" '
+      '"$http_user_agent" "$http_x_forwarded_for"'
+
+Configures Nginx's [`log_format`](http://nginx.org/en/docs/http/ngx_http_log_module.html#log_format). options.
+
+    nginx_default_release: ""
+
+(For Debian/Ubuntu only) Allows you to set a different repository for the installation of Nginx. As an example, if you are running Debian's wheezy release, and want to get a newer version of Nginx, you can install the `wheezy-backports` repository and set that value here, and Ansible will use that as the `-t` option while installing Nginx.
+
+    nginx_ppa_use: false
+    nginx_ppa_version: stable
+
+(For Ubuntu only) Allows you to use the official Nginx PPA instead of the system's package. You can set the version to `stable` or `development`.
+
+    nginx_yum_repo_enabled: true
+
+(For RedHat/CentOS only) Set this to `false` to disable the installation of the `nginx` yum repository. This could be necessary if you want the default OS stable packages, or if you use Satellite.
+
+    nginx_zypper_repo_enabled: true
+
+(For Suse only) Set this to `false` to disable the installation of the `nginx` zypper repository. This could be necessary if you want the default OS stable packages, or if you use Suse Manager.
+
+    nginx_service_state: started
+    nginx_service_enabled: yes
+
+By default, this role will ensure Nginx is running and enabled at boot after Nginx is configured. You can use these variables to override this behavior if installing in a container or further control over the service state is required.
+
+## Overriding configuration templates
+
+If you can't customize via variables because an option isn't exposed, you can override the template used to generate the virtualhost configuration files or the `nginx.conf` file.
+
+```yaml
+nginx_conf_template: "nginx.conf.j2"
+nginx_vhost_template: "vhost.j2"
+```
+
+If necessary you can also set the template on a per vhost basis.
+
+```yaml
+nginx_vhosts:
+  - listen: "80 default_server"
+    server_name: "site1.example.com"
+    root: "/var/www/site1.example.com"
+    index: "index.php index.html index.htm"
+    template: "{{ playbook_dir }}/templates/site1.example.com.vhost.j2"
+  - server_name: "site2.example.com"
+    root: "/var/www/site2.example.com"
+    index: "index.php index.html index.htm"
+    template: "{{ playbook_dir }}/templates/site2.example.com.vhost.j2"
+```
+
+You can either copy and modify the provided template, or extend it with [Jinja2 template inheritance](http://jinja.pocoo.org/docs/2.9/templates/#template-inheritance) and override the specific template block you need to change.
+
+### Example: Configure gzip in nginx configuration
+
+Set the `nginx_conf_template` to point to a template file in your playbook directory.
+
+```yaml
+nginx_conf_template: "{{ playbook_dir }}/templates/nginx.conf.j2"
+```
+
+Create the child template in the path you configured above and extend `geerlingguy.nginx` template file relative to your `playbook.yml`.
+
+```
+{% extends 'roles/geerlingguy.nginx/templates/nginx.conf.j2' %}
+
+{% block http_gzip %}
+    gzip on;
+    gzip_proxied any;
+    gzip_static on;
+    gzip_http_version 1.0;
+    gzip_disable "MSIE [1-6]\.";
+    gzip_vary on;
+    gzip_comp_level 6;
+    gzip_types
+        text/plain
+        text/css
+        text/xml
+        text/javascript
+        application/javascript
+        application/x-javascript
+        application/json
+        application/xml
+        application/xml+rss
+        application/xhtml+xml
+        application/x-font-ttf
+        application/x-font-opentype
+        image/svg+xml
+        image/x-icon;
+    gzip_buffers 16 8k;
+    gzip_min_length 512;
+{% endblock %}
+```
+
+## Dependencies
+
+None.
+
+## Example Playbook
+
+    - hosts: server
+      roles:
+        - { role: geerlingguy.nginx }
+
+## License
+
+MIT / BSD
+
+## Author Information
+
+This role was created in 2014 by [Jeff Geerling](https://www.jeffgeerling.com/), author of [Ansible for DevOps](https://www.ansiblefordevops.com/).
@@ -0,0 +1,96 @@
+---
+# Used only for Debian/Ubuntu installation, as the -t option for apt.
+nginx_default_release: ""
+
+# Used only for Redhat installation, enables source Nginx repo.
+nginx_yum_repo_enabled: true
+
+# Used only for Suse installation, enables source Nginx repo.
+nginx_zypper_repo_enabled: true
+
+# Use the official Nginx PPA for Ubuntu, and the version to use if so.
+nginx_ppa_use: false
+nginx_ppa_version: stable
+
+# The name of the nginx package to install.
+nginx_package_name: "nginx"
+
+nginx_service_state: started
+nginx_service_enabled: true
+
+nginx_conf_template: "nginx.conf.j2"
+nginx_vhost_template: "vhost.j2"
+
+nginx_worker_processes: >-
+  "{{ ansible_facts.processor_vcpus | default(ansible_facts.processor_count) }}"
+nginx_worker_connections: "1024"
+nginx_multi_accept: "off"
+
+nginx_error_log: "/var/log/nginx/error.log warn"
+nginx_access_log: "/var/log/nginx/access.log main buffer=16k flush=2m"
+
+nginx_sendfile: "on"
+nginx_tcp_nopush: "on"
+nginx_tcp_nodelay: "on"
+
+nginx_keepalive_timeout: "75"
+nginx_keepalive_requests: "600"
+
+nginx_server_tokens: "on"
+
+nginx_client_max_body_size: "64m"
+
+nginx_server_names_hash_bucket_size: "64"
+
+nginx_proxy_cache_path: ""
+
+nginx_extra_conf_options: ""
+# Example extra main options, used within the main nginx's context:
+#   nginx_extra_conf_options: |
+#     env VARIABLE;
+#     include /etc/nginx/main.d/*.conf;
+
+nginx_extra_http_options: ""
+# Example extra http options, printed inside the main server http config:
+#    nginx_extra_http_options: |
+#      proxy_buffering    off;
+#      proxy_set_header   X-Real-IP $remote_addr;
+#      proxy_set_header   X-Scheme $scheme;
+#      proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+#      proxy_set_header   Host $http_host;
+
+nginx_remove_default_vhost: false
+
+# Listen on IPv6 (default: true)
+nginx_listen_ipv6: true
+
+nginx_vhosts: []
+# Example vhost below, showing all available options:
+# - listen: "80" # default: "80"
+#   server_name: "example.com" # default: N/A
+#   root: "/var/www/example.com" # default: N/A
+#   index: "index.html index.htm" # default: "index.html index.htm"
+#   filename: "example.com.conf" # Can be used to set the vhost filename.
+#
+#   # Properties that are only added if defined:
+#   server_name_redirect: "www.example.com" # default: N/A
+#   error_page: ""
+#   access_log: ""
+#   error_log: ""
+#   extra_parameters: "" # Can be used to add extra config blocks (multiline).
+#   template: "" # Can be used to override the `nginx_vhost_template` per host.
+#   state: "absent" # To remove the vhost configuration.
+
+nginx_upstreams: []
+# - name: myapp1
+#   strategy: "ip_hash" # "least_conn", etc.
+#   keepalive: 16 # optional
+#   servers:
+#     - "srv1.example.com"
+#     - "srv2.example.com weight=3"
+#     - "srv3.example.com"
+
+nginx_log_format: |-
+  '$remote_addr - $remote_user [$time_local] "$request" '
+  '$status $body_bytes_sent "$http_referer" '
+  '"$http_user_agent" "$http_x_forwarded_for"'
@@ -0,0 +1,11 @@
+---
+- name: restart nginx
+  service: name=nginx state=restarted
+
+- name: validate nginx configuration
+  command: nginx -t -c /etc/nginx/nginx.conf
+  changed_when: false
+
+- name: reload nginx
+  service: name=nginx state=reloaded
+  when: nginx_service_state == "started"
@@ -0,0 +1,2 @@
+install_date: Fri 18 Sep 15:31:24 2026
+version: 3.3.1
@@ -0,0 +1,41 @@
+---
+dependencies: []
+
+galaxy_info:
+  role_name: nginx
+  author: geerlingguy
+  description: Nginx installation for Linux, FreeBSD and OpenBSD.
+  company: "Midwestern Mac, LLC"
+  license: "license (BSD, MIT)"
+  min_ansible_version: 2.10
+  platforms:
+    - name: Debian
+      versions:
+        - all
+    - name: Ubuntu
+      versions:
+        - trusty
+        - xenial
+        - focal
+    - name: Archlinux
+      versions:
+        - all
+    - name: FreeBSD
+      versions:
+        - 10.3
+        - 10.2
+        - 10.1
+        - 10.0
+        - 9.3
+    - name: OpenBSD
+      versions:
+        - 5.9
+        - 6.0
+  galaxy_tags:
+    - development
+    - web
+    - nginx
+    - reverse
+    - proxy
+    - load
+    - balancer
@@ -0,0 +1,19 @@
+---
+- name: Converge
+  hosts: all
+
+  vars:
+    nginx_use_ppa: true
+    nginx_remove_default_vhost: true
+    nginx_vhosts:
+      - server_name: "test.dev"
+        root: "/var/www/test"
+
+  pre_tasks:
+    - name: Update apt cache.
+      apt: update_cache=yes cache_valid_time=600
+      when: ansible_facts.os_family == 'Debian'
+      changed_when: false
+
+  roles:
+    - role: geerlingguy.nginx
@@ -0,0 +1,21 @@
+---
+role_name_check: 1
+dependency:
+  name: galaxy
+  options:
+    ignore-errors: true
+driver:
+  name: docker
+platforms:
+  - name: instance
+    image: "geerlingguy/docker-${MOLECULE_DISTRO:-rockylinux9}-ansible:latest"
+    command: ${MOLECULE_DOCKER_COMMAND:-""}
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
+    privileged: true
+    pre_build_image: true
+provisioner:
+  name: ansible
+  playbooks:
+    converge: ${MOLECULE_PLAYBOOK:-converge.yml}
@@ -0,0 +1,52 @@
+---
+# Variable setup.
+- name: Include OS-specific variables.
+  include_vars: "{{ ansible_facts.os_family }}.yml"
+
+- name: Define nginx_user.
+  set_fact:
+    nginx_user: "{{ __nginx_user }}"
+  when: nginx_user is not defined
+
+# Setup/install tasks.
+- include_tasks: setup-RedHat.yml
+  when: ansible_facts.os_family == 'RedHat' or ansible_facts.os_family == 'Rocky' or ansible_facts.os_family == 'AlmaLinux'
+
+- include_tasks: setup-Ubuntu.yml
+  when: ansible_facts.distribution == 'Ubuntu'
+
+- include_tasks: setup-Debian.yml
+  when: ansible_facts.os_family == 'Debian'
+
+- include_tasks: setup-FreeBSD.yml
+  when: ansible_facts.os_family == 'FreeBSD'
+
+- include_tasks: setup-OpenBSD.yml
+  when: ansible_facts.os_family == 'OpenBSD'
+
+- include_tasks: setup-Archlinux.yml
+  when: ansible_facts.os_family == 'Archlinux'
+
+- include_tasks: setup-Suse.yml
+  when: ansible_facts.os_family == 'Suse'
+
+# Vhost configuration.
+- import_tasks: vhosts.yml
+
+# Nginx setup.
+- name: Copy nginx configuration in place.
+  template:
+    src: "{{ nginx_conf_template }}"
+    dest: "{{ nginx_conf_file_path }}"
+    owner: root
+    group: "{{ root_group }}"
+    mode: 0644
+    validate: nginx -t -c %s
+  notify:
+    - reload nginx
+
+- name: Ensure nginx service is running as configured.
+  service:
+    name: nginx
+    state: "{{ nginx_service_state }}"
+    enabled: "{{ nginx_service_enabled }}"
@@ -0,0 +1,5 @@
+---
+- name: Ensure nginx is installed.
+  pacman:
+    name: "{{ nginx_package_name }}"
+    state: present
@@ -0,0 +1,10 @@
+---
+- name: Update apt cache.
+  apt: update_cache=yes cache_valid_time=86400
+  changed_when: false
+
+- name: Ensure nginx is installed.
+  apt:
+    name: "{{ nginx_package_name }}"
+    state: present
+    default_release: "{{ nginx_default_release }}"
@@ -0,0 +1,17 @@
+---
+- name: Update pkg cache.
+  command: pkg update -f
+  environment:
+    ASSUME_ALWAYS_YES: "yes"
+  tags: ['skip_ansible_lint']
+
+- name: Ensure nginx is installed.
+  pkgng:
+    name: "{{ nginx_package_name }}"
+    state: present
+
+- name: Create logs directory.
+  file:
+    path: /var/log/nginx
+    state: directory
+    mode: 0755
@@ -0,0 +1,11 @@
+---
+- name: Ensure nginx is installed.
+  openbsd_pkg:
+    name: "{{ nginx_package_name }}"
+    state: present
+
+- name: Create logs directory.
+  file:
+    path: /var/log/nginx
+    state: directory
+    mode: 0755
@@ -0,0 +1,14 @@
+---
+- name: Enable nginx repo.
+  template:
+    src: nginx.repo.j2
+    dest: /etc/yum.repos.d/nginx.repo
+    owner: root
+    group: "{{ root_group }}"
+    mode: 0644
+  when: nginx_yum_repo_enabled | bool
+
+- name: Ensure nginx is installed.
+  package:
+    name: "{{ nginx_package_name }}"
+    state: present
@@ -0,0 +1,14 @@
+---
+- name: Enable nginx repo.
+  zypper_repository:
+    name: nginx
+    repo: http://nginx.org/packages/sles/{{ ansible_facts.distribution_major_version }}
+    state: present
+    disable_gpg_check: true
+    autorefresh: true
+  when: nginx_zypper_repo_enabled | bool
+
+- name: Ensure nginx is installed.
+  package:
+    name: "{{ nginx_package_name }}"
+    state: present
@@ -0,0 +1,20 @@
+---
+- name: Ensure dirmngr is installed (gnupg dependency).
+  apt:
+    name: dirmngr
+    state: present
+
+- name: Add PPA for Nginx (if configured).
+  apt_repository:
+    repo: 'ppa:nginx/{{ nginx_ppa_version }}'
+    state: present
+    update_cache: true
+  register: nginx_ppa_added
+  when: nginx_ppa_use | bool
+
+- name: Ensure nginx will reinstall if the PPA was just added.
+  apt:
+    name: "{{ nginx_package_name }}"
+    state: absent
+  when: nginx_ppa_added is changed
+  tags: ['skip_ansible_lint']
@@ -0,0 +1,44 @@
+---
+- name: Remove default nginx vhost config file (if configured).
+  file:
+    path: "{{ nginx_default_vhost_path }}"
+    state: absent
+  when: nginx_remove_default_vhost | bool
+  notify: restart nginx
+
+- name: Ensure nginx_vhost_path exists.
+  file:
+    path: "{{ nginx_vhost_path }}"
+    state: directory
+    mode: 0755
+  notify: reload nginx
+
+- name: Add managed vhost config files.
+  template:
+    src: "{{ item.template|default(nginx_vhost_template) }}"
+    dest: "{{ nginx_vhost_path }}/{{ item.filename|default(item.server_name.split(' ')[0] ~ '.conf') }}"
+    force: true
+    owner: root
+    group: "{{ root_group }}"
+    mode: 0644
+  when: item.state|default('present') != 'absent'
+  with_items: "{{ nginx_vhosts }}"
+  notify: reload nginx
+  tags:
+    - skip_ansible_lint
+
+- name: Remove managed vhost config files.
+  file:
+    path: "{{ nginx_vhost_path }}/{{ item.filename|default(item.server_name.split(' ')[0] ~ '.conf') }}"
+    state: absent
+  when: item.state|default('present') == 'absent'
+  with_items: "{{ nginx_vhosts }}"
+  notify: reload nginx
+  tags:
+    - skip_ansible_lint
+
+- name: Remove legacy vhosts.conf file.
+  file:
+    path: "{{ nginx_vhost_path }}/vhosts.conf"
+    state: absent
+  notify: reload nginx
@@ -0,0 +1,81 @@
+user  {{ nginx_user }};
+
+error_log  {{ nginx_error_log }};
+pid        {{ nginx_pidfile }};
+
+{% block worker %}
+worker_processes  {{ nginx_worker_processes }};
+{% endblock %}
+
+{% if nginx_extra_conf_options %}
+{{ nginx_extra_conf_options }}
+{% endif %}
+
+{% block events %}
+events {
+    worker_connections  {{ nginx_worker_connections }};
+    multi_accept {{ nginx_multi_accept }};
+}
+{% endblock %}
+
+http {
+    {% block http_begin %}{% endblock %}
+
+{% block http_basic %}
+    include       {{ nginx_mime_file_path }};
+    default_type  application/octet-stream;
+
+    server_names_hash_bucket_size {{ nginx_server_names_hash_bucket_size }};
+
+    client_max_body_size {{ nginx_client_max_body_size }};
+
+    log_format  main  {{ nginx_log_format|indent(23) }};
+
+    access_log  {{ nginx_access_log }};
+
+    sendfile        {{ nginx_sendfile }};
+    tcp_nopush      {{ nginx_tcp_nopush }};
+    tcp_nodelay     {{ nginx_tcp_nodelay }};
+
+    keepalive_timeout  {{ nginx_keepalive_timeout }};
+    keepalive_requests {{ nginx_keepalive_requests }};
+
+    server_tokens {{ nginx_server_tokens }};
+{% if nginx_proxy_cache_path %}
+    proxy_cache_path {{ nginx_proxy_cache_path }};
+{% endif %}
+{% endblock %}
+
+{% block http_gzip %}
+    # gzip on;
+{% endblock %}
+
+{% if nginx_extra_http_options %}
+    {{ nginx_extra_http_options|indent(4, False) }}
+{% endif %}
+
+{% block http_upstream %}
+{% for upstream in nginx_upstreams %}
+    upstream {{ upstream.name }} {
+{% if upstream.strategy is defined %}
+        {{ upstream.strategy }};
+{% endif %}
+{% for server in upstream.servers %}
+        server {{ server }};
+{% endfor %}
+{% if upstream.keepalive is defined %}
+        keepalive {{ upstream.keepalive }};
+{% endif %}
+    }
+{% endfor %}
+{% endblock %}
+
+{% block http_includes %}
+    include {{ nginx_conf_path }}/*.conf;
+{% if nginx_conf_path != nginx_vhost_path %}
+    include {{ nginx_vhost_path }}/*;
+{% endif %}
+{% endblock %}
+
+    {% block http_end %}{% endblock %}
+}
@@ -0,0 +1,5 @@
+[nginx]
+name=nginx repo
+baseurl=http://nginx.org/packages/centos/{{ ansible_facts.distribution_major_version }}/$basearch/
+gpgcheck=0
+enabled=1
@@ -0,0 +1,53 @@
+{% block server_redirect %}
+{% if item.server_name_redirect is defined %}
+server {
+    listen       {{ item.listen | default('80') }};
+{% if nginx_listen_ipv6 %}
+    listen       [::]:{{item.listen | default('80') }};
+{% endif %}
+    server_name  {{ item.server_name_redirect }};
+    return       301 $scheme://{{ item.server_name.split(' ')[0] }}$request_uri;
+}
+{% endif %}
+{% endblock %}
+
+server {
+    {% block server_begin %}{% endblock %}
+
+    {% block server_basic -%}
+    listen {{ item.listen | default('80') }};
+{% if nginx_listen_ipv6 %}
+    listen       [::]:{{item.listen | default('80') }};
+{% endif %}
+
+{% if item.server_name is defined %}
+    server_name {{ item.server_name }};
+{% endif %}
+
+{% if item.root is defined %}
+    root {{ item.root }};
+{% endif %}
+
+    index {{ item.index | default('index.html index.htm') }};
+
+{% if item.error_page is defined %}
+    error_page {{ item.error_page }};
+{% endif %}
+{% if item.access_log is defined %}
+    access_log {{ item.access_log }};
+{% endif %}
+{% if item.error_log is defined %}
+    error_log {{ item.error_log }} error;
+{% endif %}
+
+{% if item.return is defined %}
+    return {{ item.return }};
+{% endif %}
+    {% endblock %}
+
+    {% block server_end %}{% endblock %}
+
+{% if item.extra_parameters is defined %}
+    {{ item.extra_parameters|indent(4) }}
+{% endif %}
+}
@@ -0,0 +1,9 @@
+---
+root_group: root
+nginx_conf_path: /etc/nginx/conf.d
+nginx_conf_file_path: /etc/nginx/nginx.conf
+nginx_mime_file_path: /etc/nginx/mime.types
+nginx_pidfile: /var/run/nginx.pid
+nginx_vhost_path: /etc/nginx/conf.d
+nginx_default_vhost_path: /etc/nginx/conf.d/default.conf
+__nginx_user: "nginx"
@@ -0,0 +1,9 @@
+---
+root_group: root
+nginx_conf_path: /etc/nginx/conf.d
+nginx_conf_file_path: /etc/nginx/nginx.conf
+nginx_mime_file_path: /etc/nginx/mime.types
+nginx_pidfile: /run/nginx.pid
+nginx_vhost_path: /etc/nginx/sites-enabled
+nginx_default_vhost_path: /etc/nginx/sites-enabled/default
+__nginx_user: "http"
@@ -0,0 +1,9 @@
+---
+root_group: root
+nginx_conf_path: /etc/nginx/conf.d
+nginx_conf_file_path: /etc/nginx/nginx.conf
+nginx_mime_file_path: /etc/nginx/mime.types
+nginx_pidfile: /run/nginx.pid
+nginx_vhost_path: /etc/nginx/sites-enabled
+nginx_default_vhost_path: /etc/nginx/sites-enabled/default
+__nginx_user: "www-data"
@@ -0,0 +1,9 @@
+---
+root_group: wheel
+nginx_conf_path: /usr/local/etc/nginx/conf.d
+nginx_conf_file_path: /usr/local/etc/nginx/nginx.conf
+nginx_mime_file_path: /usr/local/etc/nginx/mime.types
+nginx_pidfile: /var/run/nginx.pid
+nginx_vhost_path: /usr/local/etc/nginx/sites-enabled
+nginx_default_vhost_path: /usr/local/etc/nginx/sites-enabled/default
+__nginx_user: "www"
@@ -0,0 +1,10 @@
+---
+root_group: wheel
+nginx_conf_path: /etc/nginx/conf.d
+nginx_conf_file_path: /etc/nginx/nginx.conf
+nginx_mime_file_path: /etc/nginx/mime.types
+nginx_pidfile: /var/run/nginx.pid
+nginx_vhost_path: /etc/nginx/sites-enabled
+nginx_default_vhost_path: /etc/nginx/sites-enabled/default
+nginx_package_name: "nginx--"
+__nginx_user: "www"
@@ -0,0 +1,9 @@
+---
+root_group: root
+nginx_conf_path: /etc/nginx/conf.d
+nginx_conf_file_path: /etc/nginx/nginx.conf
+nginx_mime_file_path: /etc/nginx/mime.types
+nginx_pidfile: /var/run/nginx.pid
+nginx_vhost_path: /etc/nginx/conf.d
+nginx_default_vhost_path: /etc/nginx/conf.d/default.conf
+__nginx_user: "nginx"
@@ -0,0 +1,9 @@
+---
+root_group: root
+nginx_conf_path: /etc/nginx/conf.d
+nginx_conf_file_path: /etc/nginx/nginx.conf
+nginx_mime_file_path: /etc/nginx/mime.types
+nginx_pidfile: /var/run/nginx.pid
+nginx_vhost_path: /etc/nginx/conf.d
+nginx_default_vhost_path: /etc/nginx/conf.d/default.conf
+__nginx_user: "nginx"
@@ -0,0 +1,9 @@
+---
+root_group: root
+nginx_conf_path: /etc/nginx/conf.d
+nginx_conf_file_path: /etc/nginx/nginx.conf
+nginx_mime_file_path: /etc/nginx/mime.types
+nginx_pidfile: /var/run/nginx.pid
+nginx_vhost_path: /etc/nginx/conf.d
+nginx_default_vhost_path: /etc/nginx/conf.d/default.conf
+__nginx_user: "nginx"
@@ -0,0 +1,7 @@
+inventory/host_vars/*/secrets.yml
+inventory/host_vars/*/sops-poc-key.yml
+*.retry
+.vault-pass
+.env
+roles/geerlingguy.*
+.env
@@ -0,0 +1,8 @@
+[defaults]
+inventory = inventory/hosts.yml
+roles_path = roles
+host_key_checking = True
+interpreter_python = auto_silent
+
+[ssh_connection]
+pipelining = True
@@ -0,0 +1,13 @@
+---
+all:
+  children:
+    ci:
+      hosts:
+        ci1:
+          ansible_host: ci.poc.mehl.mx
+    target:
+      hosts:
+        target1:
+          ansible_host: prd.poc.mehl.mx
+  vars:
+    ansible_user: root
@@ -0,0 +1,6 @@
+---
+roles:
+  - name: geerlingguy.nginx
+    version: "3.3.1"
+  - name: geerlingguy.certbot
+    version: "5.5.0"
@@ -0,0 +1,60 @@
+---
+# Install Docker CE (rootful) from the official Docker apt repository.
+# ponytail: rootful Docker only for this PoC; rootless is explicitly deferred (see plan.md).
+
+- name: Gather OS release facts
+  ansible.builtin.setup:
+    gather_subset:
+      - distribution
+
+- name: Install prerequisite packages
+  ansible.builtin.apt:
+    name:
+      - ca-certificates
+      - curl
+      - gnupg
+    state: present
+    update_cache: true
+
+- name: Create keyrings directory
+  ansible.builtin.file:
+    path: /etc/apt/keyrings
+    state: directory
+    mode: "0755"
+
+- name: Download Docker GPG key
+  ansible.builtin.get_url:
+    url: "https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }}/gpg"
+    dest: /etc/apt/keyrings/docker.asc
+    mode: "0644"
+    force: false
+
+- name: Add Docker apt repository
+  ansible.builtin.deb822_repository:
+    name: docker
+    types: deb
+    uris: "https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }}"
+    suites: "{{ ansible_facts['distribution_release'] }}"
+    components: stable
+    architectures: "{{ 'amd64' if ansible_facts['architecture'] == 'x86_64' else ansible_facts['architecture'] }}"
+    signed_by: /etc/apt/keyrings/docker.asc
+    state: present
+
+- name: Update apt cache after adding Docker repository
+  ansible.builtin.apt:
+    update_cache: true
+
+- name: Install Docker packages
+  ansible.builtin.apt:
+    name:
+      - docker-ce
+      - docker-ce-cli
+      - containerd.io
+      - docker-compose-plugin
+    state: present
+
+- name: Ensure Docker service is enabled and running
+  ansible.builtin.systemd_service:
+    name: docker
+    enabled: true
+    state: started
@@ -0,0 +1,5 @@
+---
+woodpecker_domain: "ci.poc.mehl.mx"
+zot_domain: "registry.ci.poc.mehl.mx"
+zot_port: 5000
+letsencrypt_email: "dqdpoq@dwqiofiw.de"
@@ -0,0 +1,5 @@
+---
+- name: Restart nginx
+  ansible.builtin.systemd_service:
+    name: nginx
+    state: restarted
@@ -0,0 +1,32 @@
+---
+# Two-phase TLS setup: nginx first serves plain HTTP (for the certbot
+# webroot challenge), then certbot obtains real certs, then the TLS
+# vhosts (proxying to Woodpecker and Zot) are deployed and nginx reloaded.
+
+- name: Ensure certbot webroot directory exists
+  ansible.builtin.file:
+    path: "{{ certbot_webroot }}"
+    state: directory
+    mode: "0755"
+
+- name: Include geerlingguy.nginx role (HTTP-only vhosts for ACME challenge)
+  ansible.builtin.include_role:
+    name: geerlingguy.nginx
+
+- name: Include geerlingguy.certbot role (obtain certificates)
+  ansible.builtin.include_role:
+    name: geerlingguy.certbot
+
+- name: Deploy TLS vhost for Woodpecker
+  ansible.builtin.template:
+    src: woodpecker.conf.j2
+    dest: "/etc/nginx/sites-enabled/{{ woodpecker_domain }}.conf"
+    mode: "0644"
+  notify: Restart nginx
+
+- name: Deploy TLS vhost for Zot
+  ansible.builtin.template:
+    src: zot.conf.j2
+    dest: "/etc/nginx/sites-enabled/{{ zot_domain }}.conf"
+    mode: "0644"
+  notify: Restart nginx
@@ -0,0 +1,36 @@
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name {{ woodpecker_domain }};
+
+    ssl_certificate /etc/letsencrypt/live/{{ woodpecker_domain }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ woodpecker_domain }}/privkey.pem;
+
+    client_max_body_size 64m;
+
+    location / {
+        proxy_pass http://127.0.0.1:8000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Required for Woodpecker's websocket-based log streaming.
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name {{ woodpecker_domain }};
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/letsencrypt;
+    }
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
@@ -0,0 +1,36 @@
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name {{ zot_domain }};
+
+    ssl_certificate /etc/letsencrypt/live/{{ zot_domain }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ zot_domain }}/privkey.pem;
+
+    # Large blob/layer uploads for container images and OCI artifacts.
+    client_max_body_size 0;
+
+    location / {
+        proxy_pass http://127.0.0.1:{{ zot_port }};
+        proxy_http_version 1.1;
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        # Ensure a well-formed Content-Length reaches Zot instead of
+        # chunked transfer encoding, which Zot rejects on blob uploads.
+        proxy_request_buffering on;
+    }
+}
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name {{ zot_domain }};
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/letsencrypt;
+    }
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
@@ -0,0 +1,35 @@
+---
+# HTTP-only vhosts, used for the initial certbot webroot challenge and
+# permanently for redirecting to HTTPS afterwards.
+nginx_vhosts:
+  - server_name: "{{ woodpecker_domain }}"
+    filename: "{{ woodpecker_domain }}.conf"
+    root: "/var/www/letsencrypt"
+    extra_parameters: |
+      location /.well-known/acme-challenge/ {
+        root /var/www/letsencrypt;
+      }
+      location / {
+        return 301 https://$host$request_uri;
+      }
+
+  - server_name: "{{ zot_domain }}"
+    filename: "{{ zot_domain }}.conf"
+    root: "/var/www/letsencrypt"
+    extra_parameters: |
+      location /.well-known/acme-challenge/ {
+        root /var/www/letsencrypt;
+      }
+      location / {
+        return 301 https://$host$request_uri;
+      }
+
+certbot_create_if_missing: true
+certbot_create_method: webroot
+certbot_webroot: /var/www/letsencrypt
+certbot_admin_email: "{{ letsencrypt_email }}"
+certbot_certs:
+  - domains:
+      - "{{ woodpecker_domain }}"
+  - domains:
+      - "{{ zot_domain }}"
@@ -0,0 +1,5 @@
+---
+woodpecker_version: "v3.18.1"
+woodpecker_host: "https://ci.poc.mehl.mx"
+woodpecker_gitea_url: "https://src.mehl.mx"
+woodpecker_admin_user: "mxmehl"
@@ -0,0 +1,6 @@
+---
+- name: Restart woodpecker
+  ansible.builtin.command:
+    cmd: docker compose up -d --force-recreate
+    chdir: /opt/woodpecker
+  changed_when: true
@@ -0,0 +1,29 @@
+---
+# ponytail: UID/GID 1000 is hardcoded to match the woodpecker-server/agent
+# images' built-in "woodpecker" user (checked via /etc/passwd in the image).
+# If a future image version changes this UID, ownership here must follow.
+
+- name: Create woodpecker directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: "0755"
+    owner: "1000"
+    group: "1000"
+  loop:
+    - /opt/woodpecker
+    - /opt/woodpecker/server-data
+    - /opt/woodpecker/agent-config
+
+- name: Deploy woodpecker compose file
+  ansible.builtin.template:
+    src: compose.yaml.j2
+    dest: /opt/woodpecker/compose.yaml
+    mode: "0600"
+  notify: Restart woodpecker
+
+- name: Start woodpecker via docker compose
+  ansible.builtin.command:
+    cmd: docker compose up -d
+    chdir: /opt/woodpecker
+  changed_when: true
@@ -0,0 +1,34 @@
+services:
+  woodpecker-server:
+    image: woodpeckerci/woodpecker-server:{{ woodpecker_version }}
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:8000:8000"
+    volumes:
+      - /opt/woodpecker/server-data:/var/lib/woodpecker/
+    environment:
+      - WOODPECKER_OPEN=false
+      - WOODPECKER_HOST={{ woodpecker_host }}
+      - WOODPECKER_GITEA=true
+      - WOODPECKER_GITEA_URL={{ woodpecker_gitea_url }}
+      - WOODPECKER_GITEA_CLIENT={{ woodpecker_gitea_client }}
+      - WOODPECKER_GITEA_SECRET={{ woodpecker_gitea_secret }}
+      - WOODPECKER_AGENT_SECRET={{ woodpecker_agent_secret }}
+      - WOODPECKER_ADMIN={{ woodpecker_admin_user }}
+      # ponytail: only this specific plugin image is allow-listed for
+      # privileged mode (needed to build images), not privileged mode in
+      # general - keep this list as narrow as possible.
+      - WOODPECKER_PLUGINS_PRIVILEGED=woodpeckerci/plugin-docker-buildx
+
+  woodpecker-agent:
+    image: woodpeckerci/woodpecker-agent:{{ woodpecker_version }}
+    command: agent
+    restart: unless-stopped
+    depends_on:
+      - woodpecker-server
+    volumes:
+      - /opt/woodpecker/agent-config:/etc/woodpecker
+      - /var/run/docker.sock:/var/run/docker.sock
+    environment:
+      - WOODPECKER_SERVER=woodpecker-server:9000
+      - WOODPECKER_AGENT_SECRET={{ woodpecker_agent_secret }}
@@ -0,0 +1,8 @@
+---
+zot_version: "v2.1.6"
+zot_port: 5000
+zot_admin_user: zotadmin
+# ponytail: PoC-only default password, overridden via inventory/vault for real use.
+zot_admin_password: "changeme-poc-only"
+zot_retention_keep_count: 10
+zot_retention_keep_within: "720h"
@@ -0,0 +1,6 @@
+---
+- name: Restart zot
+  ansible.builtin.command:
+    cmd: docker compose up -d --force-recreate
+    chdir: /opt/zot
+  changed_when: true
@@ -0,0 +1,52 @@
+---
+# Deploy Zot OCI registry via Docker Compose, with htpasswd basic auth
+# and a simple retention policy.
+# ponytail: single zot instance, no TLS termination here (assumed behind
+# plain HTTP for the PoC); add a reverse proxy with TLS before any real use.
+
+- name: Create zot directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: "0755"
+  loop:
+    - /opt/zot
+    - /opt/zot/data
+    - /opt/zot/auth
+
+- name: Ensure apache2-utils (htpasswd) is installed
+  ansible.builtin.apt:
+    name: apache2-utils
+    state: present
+
+- name: Check if htpasswd file already exists
+  ansible.builtin.stat:
+    path: /opt/zot/auth/htpasswd
+  register: zot_htpasswd_stat
+
+- name: Generate htpasswd file for zot user
+  ansible.builtin.command:
+    cmd: >-
+      htpasswd -cbB /opt/zot/auth/htpasswd
+      {{ zot_admin_user }} {{ zot_admin_password }}
+  when: not zot_htpasswd_stat.stat.exists
+  changed_when: true
+
+- name: Deploy zot configuration
+  ansible.builtin.template:
+    src: config.json.j2
+    dest: /opt/zot/config.json
+    mode: "0644"
+  notify: Restart zot
+
+- name: Deploy zot compose file
+  ansible.builtin.template:
+    src: compose.yaml.j2
+    dest: /opt/zot/compose.yaml
+    mode: "0644"
+
+- name: Start zot via docker compose
+  ansible.builtin.command:
+    cmd: docker compose up -d
+    chdir: /opt/zot
+  changed_when: true
@@ -0,0 +1,11 @@
+services:
+  zot:
+    image: ghcr.io/project-zot/zot-linux-amd64:{{ zot_version }}
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:{{ zot_port }}:5000"
+    volumes:
+      - /opt/zot/config.json:/etc/zot/config.json:ro
+      - /opt/zot/auth/htpasswd:/etc/zot/htpasswd:ro
+      - /opt/zot/data:/var/lib/registry
+    command: serve /etc/zot/config.json
@@ -0,0 +1,42 @@
+{
+  "distSpecVersion": "1.1.1",
+  "storage": {
+    "rootDirectory": "/var/lib/registry",
+    "retention": {
+      "dryRun": false,
+      "delay": "24h",
+      "policies": [
+        {
+          "repositories": ["**"],
+          "deleteReferrers": false,
+          "deleteUntagged": true,
+          "keepTags": [
+            {
+              "mostRecentlyPushedCount": {{ zot_retention_keep_count }},
+              "pushedWithin": "{{ zot_retention_keep_within }}"
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "http": {
+    "address": "0.0.0.0",
+    "port": "5000",
+    "auth": {
+      "htpasswd": {
+        "path": "/etc/zot/htpasswd"
+      }
+    },
+    "accessControl": {
+      "repositories": {
+        "**": {
+          "defaultPolicy": ["read", "create", "update", "delete"]
+        }
+      }
+    }
+  },
+  "log": {
+    "level": "info"
+  }
+}
@@ -0,0 +1,24 @@
+---
+- name: Provision all hosts with Docker
+  hosts: ci:target
+  become: true
+  roles:
+    - docker
+
+- name: Provision ci host with Zot registry
+  hosts: ci
+  become: true
+  roles:
+    - zot
+
+- name: Provision ci host with reverse proxy and TLS
+  hosts: ci
+  become: true
+  roles:
+    - reverse_proxy
+
+- name: Provision ci host with Woodpecker CI
+  hosts: ci
+  become: true
+  roles:
+    - woodpecker