task 1-4

roles/reverse_proxy/tasks/main.yml

@@ -0,0 +1,32 @@
+---
+# Two-phase TLS setup: nginx first serves plain HTTP (for the certbot
+# webroot challenge), then certbot obtains real certs, then the TLS
+# vhosts (proxying to Woodpecker and Zot) are deployed and nginx reloaded.
+
+- name: Ensure certbot webroot directory exists
+  ansible.builtin.file:
+    path: "{{ certbot_webroot }}"
+    state: directory
+    mode: "0755"
+
+- name: Include geerlingguy.nginx role (HTTP-only vhosts for ACME challenge)
+  ansible.builtin.include_role:
+    name: geerlingguy.nginx
+
+- name: Include geerlingguy.certbot role (obtain certificates)
+  ansible.builtin.include_role:
+    name: geerlingguy.certbot
+
+- name: Deploy TLS vhost for Woodpecker
+  ansible.builtin.template:
+    src: woodpecker.conf.j2
+    dest: "/etc/nginx/sites-enabled/{{ woodpecker_domain }}.conf"
+    mode: "0644"
+  notify: Restart nginx
+
+- name: Deploy TLS vhost for Zot
+  ansible.builtin.template:
+    src: zot.conf.j2
+    dest: "/etc/nginx/sites-enabled/{{ zot_domain }}.conf"
+    mode: "0644"
+  notify: Restart nginx