33 lines
1013 B
YAML
33 lines
1013 B
YAML
---
|
|
# Two-phase TLS setup: nginx first serves plain HTTP (for the certbot
|
|
# webroot challenge), then certbot obtains real certs, then the TLS
|
|
# vhosts (proxying to Woodpecker and Zot) are deployed and nginx reloaded.
|
|
|
|
- name: Ensure certbot webroot directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ certbot_webroot }}"
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
- name: Include geerlingguy.nginx role (HTTP-only vhosts for ACME challenge)
|
|
ansible.builtin.include_role:
|
|
name: geerlingguy.nginx
|
|
|
|
- name: Include geerlingguy.certbot role (obtain certificates)
|
|
ansible.builtin.include_role:
|
|
name: geerlingguy.certbot
|
|
|
|
- name: Deploy TLS vhost for Woodpecker
|
|
ansible.builtin.template:
|
|
src: woodpecker.conf.j2
|
|
dest: "/etc/nginx/sites-enabled/{{ woodpecker_domain }}.conf"
|
|
mode: "0644"
|
|
notify: Restart nginx
|
|
|
|
- name: Deploy TLS vhost for Zot
|
|
ansible.builtin.template:
|
|
src: zot.conf.j2
|
|
dest: "/etc/nginx/sites-enabled/{{ zot_domain }}.conf"
|
|
mode: "0644"
|
|
notify: Restart nginx
|