From 49364704f7f3c88bc28226aab185ca053748b745 Mon Sep 17 00:00:00 2001 From: Nick Forrer Date: Sat, 22 Oct 2022 13:48:36 -0400 Subject: [PATCH] Initial commit --- group_vars/webservers.yml | 9 ++ inventory.ini | 2 + roles/webserver/files/etc/nginx/nginx.conf | 85 +++++++++++++++++++ .../nginx/sites-available/git.nickforrer.com | 27 ++++++ .../etc/nginx/sites-available/nickforrer.com | 28 ++++++ roles/webserver/handlers/main.yml | 5 ++ roles/webserver/tasks/main.yml | 63 ++++++++++++++ roles/webserver/vars/main.yml | 4 + site.yml | 3 + 9 files changed, 226 insertions(+) create mode 100644 group_vars/webservers.yml create mode 100644 inventory.ini create mode 100644 roles/webserver/files/etc/nginx/nginx.conf create mode 100644 roles/webserver/files/etc/nginx/sites-available/git.nickforrer.com create mode 100644 roles/webserver/files/etc/nginx/sites-available/nickforrer.com create mode 100644 roles/webserver/handlers/main.yml create mode 100644 roles/webserver/tasks/main.yml create mode 100644 roles/webserver/vars/main.yml create mode 100644 site.yml diff --git a/group_vars/webservers.yml b/group_vars/webservers.yml new file mode 100644 index 0000000..9e2d146 --- /dev/null +++ b/group_vars/webservers.yml @@ -0,0 +1,9 @@ +webserver_static_sites: + - name: nickforrer.com + root: /var/www/nickforrer.com + enabled: true + static: true + repository: https://git.nickforrer.com/nforrer/site.git + - name: git.nickforrer.com + enabled: true + static: false diff --git a/inventory.ini b/inventory.ini new file mode 100644 index 0000000..96ba0d0 --- /dev/null +++ b/inventory.ini @@ -0,0 +1,2 @@ +[webservers] +nickforrer.com \ No newline at end of file diff --git a/roles/webserver/files/etc/nginx/nginx.conf b/roles/webserver/files/etc/nginx/nginx.conf new file mode 100644 index 0000000..132f680 --- /dev/null +++ b/roles/webserver/files/etc/nginx/nginx.conf @@ -0,0 +1,85 @@ +user www-data; +worker_processes auto; +pid /run/nginx.pid; +include /etc/nginx/modules-enabled/*.conf; + +events { + worker_connections 768; + # multi_accept on; +} + +http { + + ## + # Basic Settings + ## + + sendfile on; + tcp_nopush on; + tcp_nodelay on; + keepalive_timeout 65; + types_hash_max_size 2048; + # server_tokens off; + + # server_names_hash_bucket_size 64; + # server_name_in_redirect off; + + include /etc/nginx/mime.types; + default_type application/octet-stream; + + ## + # SSL Settings + ## + + ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE + ssl_prefer_server_ciphers on; + + ## + # Logging Settings + ## + + access_log /var/log/nginx/access.log; + error_log /var/log/nginx/error.log; + + ## + # Gzip Settings + ## + + gzip on; + + # gzip_vary on; + # gzip_proxied any; + # gzip_comp_level 6; + # gzip_buffers 16 8k; + # gzip_http_version 1.1; + # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript; + + ## + # Virtual Host Configs + ## + + include /etc/nginx/conf.d/*.conf; + include /etc/nginx/sites-enabled/*; +} + + +#mail { +# # See sample authentication script at: +# # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript +# +# # auth_http localhost/auth.php; +# # pop3_capabilities "TOP" "USER"; +# # imap_capabilities "IMAP4rev1" "UIDPLUS"; +# +# server { +# listen localhost:110; +# protocol pop3; +# proxy on; +# } +# +# server { +# listen localhost:143; +# protocol imap; +# proxy on; +# } +#} diff --git a/roles/webserver/files/etc/nginx/sites-available/git.nickforrer.com b/roles/webserver/files/etc/nginx/sites-available/git.nickforrer.com new file mode 100644 index 0000000..240e539 --- /dev/null +++ b/roles/webserver/files/etc/nginx/sites-available/git.nickforrer.com @@ -0,0 +1,27 @@ +server { + server_name git.nickforrer.com; + + location / { + proxy_pass http://localhost:3000; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + + listen 443 ssl; # managed by Certbot + ssl_certificate /etc/letsencrypt/live/nickforrer.com/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/letsencrypt/live/nickforrer.com/privkey.pem; # managed by Certbot + include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot +} + +server { + if ($host = git.nickforrer.com) { + return 301 https://$host$request_uri; + } # managed by Certbot + + listen 80; + server_name git.nickforrer.com; + return 404; # managed by Certbot +} \ No newline at end of file diff --git a/roles/webserver/files/etc/nginx/sites-available/nickforrer.com b/roles/webserver/files/etc/nginx/sites-available/nickforrer.com new file mode 100644 index 0000000..77f717e --- /dev/null +++ b/roles/webserver/files/etc/nginx/sites-available/nickforrer.com @@ -0,0 +1,28 @@ +server { + server_name nickforrer.com; + + root /var/www/nickforrer.com; + index index.html; + + location / { + try_files $uri $uri/ =404; + } + + listen [::]:443 ssl ipv6only=on; # managed by Certbot + listen 443 ssl; # managed by Certbot + ssl_certificate /etc/letsencrypt/live/nickforrer.com/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/letsencrypt/live/nickforrer.com/privkey.pem; # managed by Certbot + include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot +} + +server { + if ($host = nickforrer.com) { + return 301 https://$host$request_uri; + } # managed by Certbot + + listen 80; + listen [::]:80; + server_name nickforrer.com; + return 404; # managed by Certbot +} \ No newline at end of file diff --git a/roles/webserver/handlers/main.yml b/roles/webserver/handlers/main.yml new file mode 100644 index 0000000..eb20826 --- /dev/null +++ b/roles/webserver/handlers/main.yml @@ -0,0 +1,5 @@ +- name: Reload NGINX + service: + name: nginx + state: reloaded + become: true diff --git a/roles/webserver/tasks/main.yml b/roles/webserver/tasks/main.yml new file mode 100644 index 0000000..fd8a1b2 --- /dev/null +++ b/roles/webserver/tasks/main.yml @@ -0,0 +1,63 @@ +--- +- name: Install packages + package: + name: "{{ webserver_packages }}" + state: latest + become: true + +- name: Add base NGINX configuration file + copy: + dest: /etc/nginx/nginx.conf + src: etc/nginx/nginx.conf + owner: root + group: root + mode: 0644 + become: true + notify: Reload NGINX + +- name: Add server block + copy: + src: "etc/nginx/sites-available/{{ item.name }}" + dest: "/etc/nginx/sites-available/{{ item.name }}" + become: true + with_items: "{{ webserver_static_sites }}" + notify: Reload NGINX +- name: Enable server + file: + src: "/etc/nginx/sites-available/{{ item.name }}" + dest: "/etc/nginx/sites-enabled/{{ item.name }}" + owner: root + group: root + mode: 0644 + state: link + when: item.enabled + become: true + with_items: "{{ webserver_static_sites }}" + notify: Reload NGINX +- name: Disable server + file: + dest: "/etc/nginx/sites-enabled/{{ item.name }}" + state: absent + when: not item.enabled + become: true + with_items: "{{ webserver_static_sites }}" + notify: Reload NGINX + +# - name: Copy site contents +# copy: +# dest: "{{ item.root }}/" +# src: "var/www/{{ item.name }}/" +# owner: root +# group: root +# mode: 0755 +# when: item.static +# become: true +# with_items: "{{ webserver_static_sites }}" +- name: Clone git repositories + git: + repo: "{{ item.repository }}" + dest: "{{ item.root }}" + force: yes + when: item.static + become: true + with_items: "{{ webserver_static_sites }}" diff --git a/roles/webserver/vars/main.yml b/roles/webserver/vars/main.yml new file mode 100644 index 0000000..b58132c --- /dev/null +++ b/roles/webserver/vars/main.yml @@ -0,0 +1,4 @@ +--- +webserver_packages: + - nginx + - git diff --git a/site.yml b/site.yml new file mode 100644 index 0000000..142bc23 --- /dev/null +++ b/site.yml @@ -0,0 +1,3 @@ +- hosts: webservers + roles: + - webserver \ No newline at end of file