From 5efc0b0d6ef3fc2392d8d6a0c30c294085e889de Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Cl=C3=A9ment=20D=C3=A9siles?= <1536672+cdesiles@users.noreply.github.com> Date: Mon, 21 Sep 2026 10:04:47 +0200 Subject: [PATCH] fix(nginx): make Let's Encrypt opt-in per service certbot cannot issue for internal hostnames (*.nas.local), which made nginx-enabled services with internal names fail on deploy. Add a _nginx_letsencrypt flag (default false) and computed _nginx_ssl_certificate/_key paths: when off the vhost uses the shared self-signed cert (nginx_default_ssl_cert), when on it uses the Let's Encrypt lineage. Gate the certbot include on the flag and apply the pattern to all service roles (deluge, fdroid, gitea, grafana, immich, metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma). --- roles/deluge/README.md | 18 ++++++++++--- roles/deluge/defaults/main.yml | 26 ++++++++++++++++++- roles/deluge/tasks/main.yml | 18 ++++++++++++- roles/deluge/templates/nginx-vhost.conf.j2 | 13 +++++++--- roles/fdroid/defaults/main.yml | 13 ++++++++++ roles/fdroid/tasks/main.yml | 2 +- roles/fdroid/templates/nginx-vhost.conf.j2 | 5 ++-- roles/gitea/defaults/main.yml | 13 ++++++++++ roles/gitea/tasks/main.yml | 2 +- roles/gitea/templates/nginx-vhost.conf.j2 | 5 ++-- roles/grafana/defaults/main.yml | 13 ++++++++++ roles/grafana/tasks/main.yml | 2 +- roles/grafana/templates/nginx-vhost.conf.j2 | 5 ++-- roles/immich/defaults/main.yml | 13 ++++++++++ roles/immich/tasks/main.yml | 2 +- roles/immich/templates/nginx-vhost.conf.j2 | 5 ++-- roles/metabase/defaults/main.yml | 13 ++++++++++ roles/metabase/tasks/main.yml | 2 +- roles/metabase/templates/nginx-vhost.conf.j2 | 4 +-- roles/nginx/README.md | 4 +++ roles/nginx/tasks/certbot.yml | 6 ++++- roles/ntfy/defaults/main.yml | 13 ++++++++++ roles/ntfy/tasks/main.yml | 2 +- roles/ntfy/templates/nginx-vhost.conf.j2 | 5 ++-- roles/prowlarr/README.md | 5 +++- roles/prowlarr/defaults/main.yml | 13 ++++++++++ roles/prowlarr/tasks/main.yml | 2 +- roles/prowlarr/templates/nginx-vhost.conf.j2 | 5 ++-- roles/radarr/README.md | 5 +++- roles/radarr/defaults/main.yml | 13 ++++++++++ roles/radarr/tasks/main.yml | 2 +- roles/radarr/templates/nginx-vhost.conf.j2 | 5 ++-- roles/seerr/README.md | 5 +++- roles/seerr/defaults/main.yml | 13 ++++++++++ roles/seerr/tasks/main.yml | 2 +- roles/seerr/templates/nginx-vhost.conf.j2 | 5 ++-- roles/static_web/defaults/main.yml | 5 +++- roles/static_web/tasks/main.yml | 1 + .../static_web/templates/nginx-vhost.conf.j2 | 9 ++++--- roles/uptime_kuma/defaults/main.yml | 13 ++++++++++ roles/uptime_kuma/tasks/main.yml | 2 +- .../uptime_kuma/templates/nginx-vhost.conf.j2 | 5 ++-- 42 files changed, 258 insertions(+), 56 deletions(-) diff --git a/roles/deluge/README.md b/roles/deluge/README.md index 1b33347..becbddb 100644 --- a/roles/deluge/README.md +++ b/roles/deluge/README.md @@ -18,8 +18,8 @@ Set the inbound port to `{{ deluge_torrent_port }}` under Preferences → Networ ## Storage -- `deluge_config_dir` - torrent state, auth and web settings. Backed up. -- `deluge_downloads_dir` - default save path for completed torrents. User data, not backed up. +- `deluge_config_dir` - torrent state, auth and web settings. Must stay on local storage (SQLite over NFS corrupts under concurrent access). Backed up. +- `deluge_downloads_dir` - default save path for completed torrents. May be a network mount (see `roles/nfs_client`). User data, not backed up. ## Ports @@ -30,9 +30,21 @@ Set the inbound port to `{{ deluge_torrent_port }}` under Preferences → Networ The thin-client daemon port (58846) is not mapped; add it to the pod manifest if a native Deluge client needs to connect. +## Firewall + +The role opens `deluge_torrent_port` (tcp+udp) in ufw for +`deluge_firewall_allowed_sources` (default `0.0.0.0/0` — peers must reach it for +a seedbox to work). The web UI port is not opened: expose it via nginx or reach +it over the VPN. + ## Nginx Reverse Proxy -Set `deluge_nginx_enabled: true` and `deluge_nginx_hostname` to expose the web UI over HTTPS. Certificates are provisioned via the shared `nginx` role's certbot tasks. If the hostname is not the apex, point a DNS record at the host first. +Set `deluge_nginx_enabled: true` and `deluge_nginx_hostname` to expose the web UI over HTTPS. TLS is opt-in: + +- `deluge_nginx_letsencrypt: false` (default) — use the shared self-signed cert (`nginx_default_ssl_cert`, generated by the `nginx` role). Required for internal names like `*.nas.local`, which Let's Encrypt cannot issue. +- `deluge_nginx_letsencrypt: true` — provision a Let's Encrypt cert via the shared `nginx` role's certbot tasks. Requires a publicly-resolvable hostname with a DNS record pointing at the host. + +The web UI login has no fail2ban coverage (Deluge uses form auth, not HTTP Basic), so don't leave it public. Set `deluge_nginx_allowed_sources` to the VPN subnet (e.g. `["192.168.30.0/27"]`) to restrict the vhost to the tunnel; everything else gets a 403. Empty (the default) leaves it open. ## Backup diff --git a/roles/deluge/defaults/main.yml b/roles/deluge/defaults/main.yml index ca93c37..deca0db 100644 --- a/roles/deluge/defaults/main.yml +++ b/roles/deluge/defaults/main.yml @@ -12,10 +12,17 @@ deluge_timezone: UTC deluge_loglevel: error # Storage. Config holds torrent state, auth and web settings; downloads is the -# default save path. Both must live on local storage, not NFS. +# default save path. Config MUST stay on local storage (SQLite over NFS corrupts +# under concurrent access); downloads may be a network mount (see roles/nfs_client). deluge_config_dir: "{{ podman_projects_dir }}/deluge/config" deluge_downloads_dir: "{{ podman_projects_dir }}/deluge/downloads" +# Inbound firewall. The torrent port must be reachable by peers, so it is open +# to the world by default. The web UI is not opened here: expose it via nginx +# (deluge_nginx_enabled) or reach it over the VPN. +deluge_firewall_allowed_sources: + - "0.0.0.0/0" + # Backup manifest - consumed by roles/backup via inventory `backup_jobs`. # Only the config (torrent state, auth, web settings) is worth backing up; # downloads are user data, not Ansible-reproducible state. @@ -25,3 +32,20 @@ deluge_backup_paths: # Nginx reverse proxy configuration deluge_nginx_enabled: false deluge_nginx_hostname: deluge.nas.local +# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal +# names (e.g. *.nas.local) cannot get a public cert: leave this false to use +# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public +# DNS record points at the host. +deluge_nginx_letsencrypt: false +deluge_nginx_ssl_certificate: >- + {{ deluge_nginx_letsencrypt | ternary( + '/etc/letsencrypt/live/' ~ deluge_nginx_hostname ~ '/fullchain.pem', + nginx_default_ssl_cert) }} +deluge_nginx_ssl_certificate_key: >- + {{ deluge_nginx_letsencrypt | ternary( + '/etc/letsencrypt/live/' ~ deluge_nginx_hostname ~ '/privkey.pem', + nginx_default_ssl_key) }} +# Optional client allow-list for the vhost. Empty = reachable from anywhere. +# Set to the VPN subnet (e.g. ["192.168.30.0/27"]) to keep the web UI off the +# public internet while still reaching it over the tunnel. +deluge_nginx_allowed_sources: [] diff --git a/roles/deluge/tasks/main.yml b/roles/deluge/tasks/main.yml index cd90f40..685fea9 100644 --- a/roles/deluge/tasks/main.yml +++ b/roles/deluge/tasks/main.yml @@ -83,11 +83,27 @@ become: false become_user: "{{ ansible_user }}" +- name: Allow torrent traffic through firewall + community.general.ufw: + rule: allow + port: "{{ deluge_torrent_port }}" + proto: any + from: "{{ item }}" + direction: in + comment: "Deluge torrent" + loop: "{{ deluge_firewall_allowed_sources }}" + loop_control: + label: "{{ item }}" + retries: 5 + delay: 2 + register: _deluge_ufw + until: _deluge_ufw is succeeded + - name: Provision TLS certificate for Deluge ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml" vars: certbot_hostname: "{{ deluge_nginx_hostname }}" - when: deluge_nginx_enabled + when: deluge_nginx_enabled and deluge_nginx_letsencrypt - name: Deploy nginx vhost configuration for Deluge ansible.builtin.template: diff --git a/roles/deluge/templates/nginx-vhost.conf.j2 b/roles/deluge/templates/nginx-vhost.conf.j2 index 73e3cb8..4bd18aa 100644 --- a/roles/deluge/templates/nginx-vhost.conf.j2 +++ b/roles/deluge/templates/nginx-vhost.conf.j2 @@ -1,4 +1,4 @@ -# Deluge vhost with Let's Encrypt (Certbot) +# Deluge vhost (Let's Encrypt when deluge_nginx_letsencrypt, else self-signed) # Managed by Ansible - DO NOT EDIT MANUALLY server { @@ -22,9 +22,8 @@ server { listen [::]:443 ssl; server_name {{ deluge_nginx_hostname }}; - # Let's Encrypt certificates (managed by Certbot) - ssl_certificate /etc/letsencrypt/live/{{ deluge_nginx_hostname }}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/{{ deluge_nginx_hostname }}/privkey.pem; + ssl_certificate {{ deluge_nginx_ssl_certificate }}; + ssl_certificate_key {{ deluge_nginx_ssl_certificate_key }}; # SSL configuration ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }}; @@ -41,6 +40,12 @@ server { client_max_body_size 20M; location / { +{% if deluge_nginx_allowed_sources | length > 0 %} +{% for source in deluge_nginx_allowed_sources %} + allow {{ source }}; +{% endfor %} + deny all; +{% endif %} proxy_pass http://127.0.0.1:{{ deluge_web_port }}; proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; diff --git a/roles/fdroid/defaults/main.yml b/roles/fdroid/defaults/main.yml index 2f8c532..8d4e0d3 100644 --- a/roles/fdroid/defaults/main.yml +++ b/roles/fdroid/defaults/main.yml @@ -31,3 +31,16 @@ fdroid_update_interval: "24h" # Nginx reverse proxy configuration fdroid_nginx_enabled: false fdroid_nginx_hostname: apk.nas.local +# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal +# names (e.g. *.nas.local) cannot get a public cert: leave this false to use +# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public +# DNS record points at the host. +fdroid_nginx_letsencrypt: false +fdroid_nginx_ssl_certificate: >- + {{ fdroid_nginx_letsencrypt | ternary( + '/etc/letsencrypt/live/' ~ fdroid_nginx_hostname ~ '/fullchain.pem', + nginx_default_ssl_cert) }} +fdroid_nginx_ssl_certificate_key: >- + {{ fdroid_nginx_letsencrypt | ternary( + '/etc/letsencrypt/live/' ~ fdroid_nginx_hostname ~ '/privkey.pem', + nginx_default_ssl_key) }} diff --git a/roles/fdroid/tasks/main.yml b/roles/fdroid/tasks/main.yml index d5453dd..5f6a735 100644 --- a/roles/fdroid/tasks/main.yml +++ b/roles/fdroid/tasks/main.yml @@ -168,7 +168,7 @@ ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml" vars: certbot_hostname: "{{ fdroid_nginx_hostname }}" - when: fdroid_nginx_enabled + when: fdroid_nginx_enabled and fdroid_nginx_letsencrypt - name: Deploy nginx vhost configuration for fdroid ansible.builtin.template: diff --git a/roles/fdroid/templates/nginx-vhost.conf.j2 b/roles/fdroid/templates/nginx-vhost.conf.j2 index d0080b6..462c6e3 100644 --- a/roles/fdroid/templates/nginx-vhost.conf.j2 +++ b/roles/fdroid/templates/nginx-vhost.conf.j2 @@ -22,9 +22,8 @@ server { listen [::]:443 ssl; server_name {{ fdroid_nginx_hostname }}; - # Let's Encrypt certificates (managed by Certbot) - ssl_certificate /etc/letsencrypt/live/{{ fdroid_nginx_hostname }}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/{{ fdroid_nginx_hostname }}/privkey.pem; + ssl_certificate {{ fdroid_nginx_ssl_certificate }}; + ssl_certificate_key {{ fdroid_nginx_ssl_certificate_key }}; # SSL configuration ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }}; diff --git a/roles/gitea/defaults/main.yml b/roles/gitea/defaults/main.yml index 642f128..5d55d39 100644 --- a/roles/gitea/defaults/main.yml +++ b/roles/gitea/defaults/main.yml @@ -31,3 +31,16 @@ gitea_disable_registration: false # Nginx reverse proxy configuration gitea_nginx_enabled: true gitea_nginx_hostname: "{{ gitea_domain }}" +# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal +# names (e.g. *.nas.local) cannot get a public cert: leave this false to use +# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public +# DNS record points at the host. +gitea_nginx_letsencrypt: false +gitea_nginx_ssl_certificate: >- + {{ gitea_nginx_letsencrypt | ternary( + '/etc/letsencrypt/live/' ~ gitea_nginx_hostname ~ '/fullchain.pem', + nginx_default_ssl_cert) }} +gitea_nginx_ssl_certificate_key: >- + {{ gitea_nginx_letsencrypt | ternary( + '/etc/letsencrypt/live/' ~ gitea_nginx_hostname ~ '/privkey.pem', + nginx_default_ssl_key) }} diff --git a/roles/gitea/tasks/main.yml b/roles/gitea/tasks/main.yml index 8e7d0ee..4f18bf0 100644 --- a/roles/gitea/tasks/main.yml +++ b/roles/gitea/tasks/main.yml @@ -147,7 +147,7 @@ ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml" vars: certbot_hostname: "{{ gitea_nginx_hostname }}" - when: gitea_nginx_enabled + when: gitea_nginx_enabled and gitea_nginx_letsencrypt - name: Deploy nginx vhost configuration for Gitea ansible.builtin.template: diff --git a/roles/gitea/templates/nginx-vhost.conf.j2 b/roles/gitea/templates/nginx-vhost.conf.j2 index 2f1a24d..3d6eec2 100644 --- a/roles/gitea/templates/nginx-vhost.conf.j2 +++ b/roles/gitea/templates/nginx-vhost.conf.j2 @@ -22,9 +22,8 @@ server { listen [::]:443 ssl; server_name {{ gitea_nginx_hostname }}; - # Let's Encrypt certificates (managed by Certbot) - ssl_certificate /etc/letsencrypt/live/{{ gitea_nginx_hostname }}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/{{ gitea_nginx_hostname }}/privkey.pem; + ssl_certificate {{ gitea_nginx_ssl_certificate }}; + ssl_certificate_key {{ gitea_nginx_ssl_certificate_key }}; # SSL configuration ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }}; diff --git a/roles/grafana/defaults/main.yml b/roles/grafana/defaults/main.yml index 8195c69..0da9322 100644 --- a/roles/grafana/defaults/main.yml +++ b/roles/grafana/defaults/main.yml @@ -31,6 +31,19 @@ grafana_check_for_updates: false # Nginx reverse proxy grafana_nginx_enabled: true grafana_nginx_hostname: "{{ grafana_domain }}" +# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal +# names (e.g. *.nas.local) cannot get a public cert: leave this false to use +# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public +# DNS record points at the host. +grafana_nginx_letsencrypt: false +grafana_nginx_ssl_certificate: >- + {{ grafana_nginx_letsencrypt | ternary( + '/etc/letsencrypt/live/' ~ grafana_nginx_hostname ~ '/fullchain.pem', + nginx_default_ssl_cert) }} +grafana_nginx_ssl_certificate_key: >- + {{ grafana_nginx_letsencrypt | ternary( + '/etc/letsencrypt/live/' ~ grafana_nginx_hostname ~ '/privkey.pem', + nginx_default_ssl_key) }} # Alerting (Grafana Unified Alerting → ntfy webhook) # When enabled, provisions disk alert rules (HDD temperature + ZFS/filesystem diff --git a/roles/grafana/tasks/main.yml b/roles/grafana/tasks/main.yml index 8d669c9..42c7cdc 100644 --- a/roles/grafana/tasks/main.yml +++ b/roles/grafana/tasks/main.yml @@ -346,7 +346,7 @@ ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml" vars: certbot_hostname: "{{ grafana_nginx_hostname }}" - when: grafana_nginx_enabled + when: grafana_nginx_enabled and grafana_nginx_letsencrypt - name: Deploy nginx vhost ansible.builtin.template: diff --git a/roles/grafana/templates/nginx-vhost.conf.j2 b/roles/grafana/templates/nginx-vhost.conf.j2 index 78dcbf2..ae2a922 100644 --- a/roles/grafana/templates/nginx-vhost.conf.j2 +++ b/roles/grafana/templates/nginx-vhost.conf.j2 @@ -22,9 +22,8 @@ server { listen [::]:443 ssl; server_name {{ grafana_nginx_hostname }}; - # Let's Encrypt certificates (managed by Certbot) - ssl_certificate /etc/letsencrypt/live/{{ grafana_nginx_hostname }}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/{{ grafana_nginx_hostname }}/privkey.pem; + ssl_certificate {{ grafana_nginx_ssl_certificate }}; + ssl_certificate_key {{ grafana_nginx_ssl_certificate_key }}; # SSL configuration ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }}; diff --git a/roles/immich/defaults/main.yml b/roles/immich/defaults/main.yml index d5767a9..ce23f67 100644 --- a/roles/immich/defaults/main.yml +++ b/roles/immich/defaults/main.yml @@ -68,3 +68,16 @@ immich_timezone: UTC # Nginx reverse proxy configuration immich_nginx_enabled: false immich_nginx_hostname: photos.nas.local +# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal +# names (e.g. *.nas.local) cannot get a public cert: leave this false to use +# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public +# DNS record points at the host. +immich_nginx_letsencrypt: false +immich_nginx_ssl_certificate: >- + {{ immich_nginx_letsencrypt | ternary( + '/etc/letsencrypt/live/' ~ immich_nginx_hostname ~ '/fullchain.pem', + nginx_default_ssl_cert) }} +immich_nginx_ssl_certificate_key: >- + {{ immich_nginx_letsencrypt | ternary( + '/etc/letsencrypt/live/' ~ immich_nginx_hostname ~ '/privkey.pem', + nginx_default_ssl_key) }} diff --git a/roles/immich/tasks/main.yml b/roles/immich/tasks/main.yml index 23edcc8..743236c 100644 --- a/roles/immich/tasks/main.yml +++ b/roles/immich/tasks/main.yml @@ -173,7 +173,7 @@ ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml" vars: certbot_hostname: "{{ immich_nginx_hostname }}" - when: immich_nginx_enabled + when: immich_nginx_enabled and immich_nginx_letsencrypt - name: Deploy nginx vhost configuration for Immich ansible.builtin.template: diff --git a/roles/immich/templates/nginx-vhost.conf.j2 b/roles/immich/templates/nginx-vhost.conf.j2 index 09c2287..89f53ef 100644 --- a/roles/immich/templates/nginx-vhost.conf.j2 +++ b/roles/immich/templates/nginx-vhost.conf.j2 @@ -23,9 +23,8 @@ server { http2 on; server_name {{ immich_nginx_hostname }}; - # Let's Encrypt certificates (managed by Certbot) - ssl_certificate /etc/letsencrypt/live/{{ immich_nginx_hostname }}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/{{ immich_nginx_hostname }}/privkey.pem; + ssl_certificate {{ immich_nginx_ssl_certificate }}; + ssl_certificate_key {{ immich_nginx_ssl_certificate_key }}; # SSL configuration ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }}; diff --git a/roles/metabase/defaults/main.yml b/roles/metabase/defaults/main.yml index 6c1d7d2..8f4e695 100644 --- a/roles/metabase/defaults/main.yml +++ b/roles/metabase/defaults/main.yml @@ -16,3 +16,16 @@ metabase_timezone: UTC metabase_nginx_enabled: false metabase_nginx_hostname: metabase.nas.local +# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal +# names (e.g. *.nas.local) cannot get a public cert: leave this false to use +# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public +# DNS record points at the host. +metabase_nginx_letsencrypt: false +metabase_nginx_ssl_certificate: >- + {{ metabase_nginx_letsencrypt | ternary( + '/etc/letsencrypt/live/' ~ metabase_nginx_hostname ~ '/fullchain.pem', + nginx_default_ssl_cert) }} +metabase_nginx_ssl_certificate_key: >- + {{ metabase_nginx_letsencrypt | ternary( + '/etc/letsencrypt/live/' ~ metabase_nginx_hostname ~ '/privkey.pem', + nginx_default_ssl_key) }} diff --git a/roles/metabase/tasks/main.yml b/roles/metabase/tasks/main.yml index 5a68dce..4d69270 100644 --- a/roles/metabase/tasks/main.yml +++ b/roles/metabase/tasks/main.yml @@ -119,7 +119,7 @@ ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml" vars: certbot_hostname: "{{ metabase_nginx_hostname }}" - when: metabase_nginx_enabled + when: metabase_nginx_enabled and metabase_nginx_letsencrypt - name: Deploy nginx vhost configuration for Metabase ansible.builtin.template: diff --git a/roles/metabase/templates/nginx-vhost.conf.j2 b/roles/metabase/templates/nginx-vhost.conf.j2 index 0dfb04e..54182cf 100644 --- a/roles/metabase/templates/nginx-vhost.conf.j2 +++ b/roles/metabase/templates/nginx-vhost.conf.j2 @@ -20,8 +20,8 @@ server { http2 on; server_name {{ metabase_nginx_hostname }}; - ssl_certificate /etc/letsencrypt/live/{{ metabase_nginx_hostname }}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/{{ metabase_nginx_hostname }}/privkey.pem; + ssl_certificate {{ metabase_nginx_ssl_certificate }}; + ssl_certificate_key {{ metabase_nginx_ssl_certificate_key }}; ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }}; ssl_prefer_server_ciphers on; diff --git a/roles/nginx/README.md b/roles/nginx/README.md index 05dd541..8595690 100644 --- a/roles/nginx/README.md +++ b/roles/nginx/README.md @@ -48,6 +48,10 @@ prometheus_scrape_configs: - targets: ['127.0.0.1:9113'] ``` +## TLS certificates + +Let's Encrypt (via the shared `certbot.yml` task) only works for publicly-resolvable hostnames. Each service role exposes a `_nginx_letsencrypt` flag (default `false`) and two computed paths (`_nginx_ssl_certificate` / `_key`): when the flag is off the vhost uses the shared self-signed cert (`nginx_default_ssl_cert`), when on it uses `/etc/letsencrypt/live//`. Gate the certbot include on the flag and reference the path variables from the vhost template. Set the flag `true` in inventory only once a public DNS record points at the host. + ## Service Integration Pattern Each service role should deploy its own vhost config: diff --git a/roles/nginx/tasks/certbot.yml b/roles/nginx/tasks/certbot.yml index e5849d2..b3e6fc9 100644 --- a/roles/nginx/tasks/certbot.yml +++ b/roles/nginx/tasks/certbot.yml @@ -5,12 +5,16 @@ # - certbot_hostname: the domain to provision (e.g. "apk.jokester.fr") # - acme_email: Let's Encrypt account email (typically from host_vars) # +# Let's Encrypt only issues for publicly-resolvable hostnames, so gate the +# include on the service's `_nginx_letsencrypt` flag (default false; +# internal names fall back to the shared self-signed cert). +# # Usage from a service role: # - name: Provision TLS certificate # ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml" # vars: # certbot_hostname: "{{ myservice_nginx_hostname }}" -# when: myservice_nginx_enabled +# when: myservice_nginx_enabled and myservice_nginx_letsencrypt - name: Validate certbot requirements ansible.builtin.assert: diff --git a/roles/ntfy/defaults/main.yml b/roles/ntfy/defaults/main.yml index f56e552..977628c 100644 --- a/roles/ntfy/defaults/main.yml +++ b/roles/ntfy/defaults/main.yml @@ -43,3 +43,16 @@ ntfy_enable_reservations: true # Only authenticated users can reserve topics # Nginx reverse proxy configuration ntfy_nginx_enabled: false ntfy_nginx_hostname: ntfy.nas.local +# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal +# names (e.g. *.nas.local) cannot get a public cert: leave this false to use +# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public +# DNS record points at the host. +ntfy_nginx_letsencrypt: false +ntfy_nginx_ssl_certificate: >- + {{ ntfy_nginx_letsencrypt | ternary( + '/etc/letsencrypt/live/' ~ ntfy_nginx_hostname ~ '/fullchain.pem', + nginx_default_ssl_cert) }} +ntfy_nginx_ssl_certificate_key: >- + {{ ntfy_nginx_letsencrypt | ternary( + '/etc/letsencrypt/live/' ~ ntfy_nginx_hostname ~ '/privkey.pem', + nginx_default_ssl_key) }} diff --git a/roles/ntfy/tasks/main.yml b/roles/ntfy/tasks/main.yml index f03081f..1ae5f5c 100644 --- a/roles/ntfy/tasks/main.yml +++ b/roles/ntfy/tasks/main.yml @@ -147,7 +147,7 @@ ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml" vars: certbot_hostname: "{{ ntfy_nginx_hostname }}" - when: ntfy_nginx_enabled + when: ntfy_nginx_enabled and ntfy_nginx_letsencrypt - name: Deploy nginx vhost configuration for ntfy ansible.builtin.template: diff --git a/roles/ntfy/templates/nginx-vhost.conf.j2 b/roles/ntfy/templates/nginx-vhost.conf.j2 index 619ff27..ba97902 100644 --- a/roles/ntfy/templates/nginx-vhost.conf.j2 +++ b/roles/ntfy/templates/nginx-vhost.conf.j2 @@ -22,9 +22,8 @@ server { listen [::]:443 ssl; server_name {{ ntfy_nginx_hostname }}; - # Let's Encrypt certificates (managed by Certbot) - ssl_certificate /etc/letsencrypt/live/{{ ntfy_nginx_hostname }}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/{{ ntfy_nginx_hostname }}/privkey.pem; + ssl_certificate {{ ntfy_nginx_ssl_certificate }}; + ssl_certificate_key {{ ntfy_nginx_ssl_certificate_key }}; # SSL configuration ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }}; diff --git a/roles/prowlarr/README.md b/roles/prowlarr/README.md index 355aea9..bea1ea8 100644 --- a/roles/prowlarr/README.md +++ b/roles/prowlarr/README.md @@ -22,7 +22,10 @@ See `defaults/main.yml` for all available variables and their default values. ## Nginx Reverse Proxy -Set `prowlarr_nginx_enabled: true` and `prowlarr_nginx_hostname` to expose the web UI over HTTPS. Certificates are provisioned via the shared `nginx` role's certbot tasks. If the hostname is not the apex, point a DNS record at the host first. +Set `prowlarr_nginx_enabled: true` and `prowlarr_nginx_hostname` to expose the web UI over HTTPS. TLS is opt-in: + +- `prowlarr_nginx_letsencrypt: false` (default) — use the shared self-signed cert (`nginx_default_ssl_cert`, generated by the `nginx` role). Required for internal names like `*.nas.local`, which Let's Encrypt cannot issue. +- `prowlarr_nginx_letsencrypt: true` — provision a Let's Encrypt cert via the shared `nginx` role's certbot tasks. Requires a publicly-resolvable hostname with a DNS record pointing at the host. ## Backup diff --git a/roles/prowlarr/defaults/main.yml b/roles/prowlarr/defaults/main.yml index 5078017..96160d5 100644 --- a/roles/prowlarr/defaults/main.yml +++ b/roles/prowlarr/defaults/main.yml @@ -19,3 +19,16 @@ prowlarr_backup_paths: # Nginx reverse proxy configuration prowlarr_nginx_enabled: false prowlarr_nginx_hostname: prowlarr.nas.local +# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal +# names (e.g. *.nas.local) cannot get a public cert: leave this false to use +# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public +# DNS record points at the host. +prowlarr_nginx_letsencrypt: false +prowlarr_nginx_ssl_certificate: >- + {{ prowlarr_nginx_letsencrypt | ternary( + '/etc/letsencrypt/live/' ~ prowlarr_nginx_hostname ~ '/fullchain.pem', + nginx_default_ssl_cert) }} +prowlarr_nginx_ssl_certificate_key: >- + {{ prowlarr_nginx_letsencrypt | ternary( + '/etc/letsencrypt/live/' ~ prowlarr_nginx_hostname ~ '/privkey.pem', + nginx_default_ssl_key) }} diff --git a/roles/prowlarr/tasks/main.yml b/roles/prowlarr/tasks/main.yml index a218d36..8cd2933 100644 --- a/roles/prowlarr/tasks/main.yml +++ b/roles/prowlarr/tasks/main.yml @@ -84,7 +84,7 @@ ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml" vars: certbot_hostname: "{{ prowlarr_nginx_hostname }}" - when: prowlarr_nginx_enabled + when: prowlarr_nginx_enabled and prowlarr_nginx_letsencrypt - name: Deploy nginx vhost configuration for Prowlarr ansible.builtin.template: diff --git a/roles/prowlarr/templates/nginx-vhost.conf.j2 b/roles/prowlarr/templates/nginx-vhost.conf.j2 index e6962df..8804792 100644 --- a/roles/prowlarr/templates/nginx-vhost.conf.j2 +++ b/roles/prowlarr/templates/nginx-vhost.conf.j2 @@ -22,9 +22,8 @@ server { listen [::]:443 ssl; server_name {{ prowlarr_nginx_hostname }}; - # Let's Encrypt certificates (managed by Certbot) - ssl_certificate /etc/letsencrypt/live/{{ prowlarr_nginx_hostname }}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/{{ prowlarr_nginx_hostname }}/privkey.pem; + ssl_certificate {{ prowlarr_nginx_ssl_certificate }}; + ssl_certificate_key {{ prowlarr_nginx_ssl_certificate_key }}; # SSL configuration ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }}; diff --git a/roles/radarr/README.md b/roles/radarr/README.md index a7e8d77..96a50b3 100644 --- a/roles/radarr/README.md +++ b/roles/radarr/README.md @@ -26,7 +26,10 @@ See `defaults/main.yml` for all available variables and their default values. ## Nginx Reverse Proxy -Set `radarr_nginx_enabled: true` and `radarr_nginx_hostname` to expose the web UI over HTTPS. Certificates are provisioned via the shared `nginx` role's certbot tasks. If the hostname is not the apex, point a DNS record at the host first. +Set `radarr_nginx_enabled: true` and `radarr_nginx_hostname` to expose the web UI over HTTPS. TLS is opt-in: + +- `radarr_nginx_letsencrypt: false` (default) — use the shared self-signed cert (`nginx_default_ssl_cert`, generated by the `nginx` role). Required for internal names like `*.nas.local`, which Let's Encrypt cannot issue. +- `radarr_nginx_letsencrypt: true` — provision a Let's Encrypt cert via the shared `nginx` role's certbot tasks. Requires a publicly-resolvable hostname with a DNS record pointing at the host. ## Backup diff --git a/roles/radarr/defaults/main.yml b/roles/radarr/defaults/main.yml index b553b27..0eb057c 100644 --- a/roles/radarr/defaults/main.yml +++ b/roles/radarr/defaults/main.yml @@ -25,3 +25,16 @@ radarr_backup_paths: # Nginx reverse proxy configuration radarr_nginx_enabled: false radarr_nginx_hostname: radarr.nas.local +# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal +# names (e.g. *.nas.local) cannot get a public cert: leave this false to use +# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public +# DNS record points at the host. +radarr_nginx_letsencrypt: false +radarr_nginx_ssl_certificate: >- + {{ radarr_nginx_letsencrypt | ternary( + '/etc/letsencrypt/live/' ~ radarr_nginx_hostname ~ '/fullchain.pem', + nginx_default_ssl_cert) }} +radarr_nginx_ssl_certificate_key: >- + {{ radarr_nginx_letsencrypt | ternary( + '/etc/letsencrypt/live/' ~ radarr_nginx_hostname ~ '/privkey.pem', + nginx_default_ssl_key) }} diff --git a/roles/radarr/tasks/main.yml b/roles/radarr/tasks/main.yml index 90749b5..5266feb 100644 --- a/roles/radarr/tasks/main.yml +++ b/roles/radarr/tasks/main.yml @@ -87,7 +87,7 @@ ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml" vars: certbot_hostname: "{{ radarr_nginx_hostname }}" - when: radarr_nginx_enabled + when: radarr_nginx_enabled and radarr_nginx_letsencrypt - name: Deploy nginx vhost configuration for Radarr ansible.builtin.template: diff --git a/roles/radarr/templates/nginx-vhost.conf.j2 b/roles/radarr/templates/nginx-vhost.conf.j2 index 445b0c0..442237b 100644 --- a/roles/radarr/templates/nginx-vhost.conf.j2 +++ b/roles/radarr/templates/nginx-vhost.conf.j2 @@ -22,9 +22,8 @@ server { listen [::]:443 ssl; server_name {{ radarr_nginx_hostname }}; - # Let's Encrypt certificates (managed by Certbot) - ssl_certificate /etc/letsencrypt/live/{{ radarr_nginx_hostname }}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/{{ radarr_nginx_hostname }}/privkey.pem; + ssl_certificate {{ radarr_nginx_ssl_certificate }}; + ssl_certificate_key {{ radarr_nginx_ssl_certificate_key }}; # SSL configuration ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }}; diff --git a/roles/seerr/README.md b/roles/seerr/README.md index b8b72f1..eb86bb6 100644 --- a/roles/seerr/README.md +++ b/roles/seerr/README.md @@ -28,7 +28,10 @@ The image runs as the unprivileged `node` user (UID/GID 1000). The pod maps the ## Nginx Reverse Proxy -Set `seerr_nginx_enabled: true` and `seerr_nginx_hostname` to expose the web UI over HTTPS. Certificates are provisioned via the shared `nginx` role's certbot tasks. If the hostname is not the apex, point a DNS record at the host first. +Set `seerr_nginx_enabled: true` and `seerr_nginx_hostname` to expose the web UI over HTTPS. TLS is opt-in: + +- `seerr_nginx_letsencrypt: false` (default) — use the shared self-signed cert (`nginx_default_ssl_cert`, generated by the `nginx` role). Required for internal names like `*.nas.local`, which Let's Encrypt cannot issue. +- `seerr_nginx_letsencrypt: true` — provision a Let's Encrypt cert via the shared `nginx` role's certbot tasks. Requires a publicly-resolvable hostname with a DNS record pointing at the host. ## Backup diff --git a/roles/seerr/defaults/main.yml b/roles/seerr/defaults/main.yml index 6cfdba3..7c84d94 100644 --- a/roles/seerr/defaults/main.yml +++ b/roles/seerr/defaults/main.yml @@ -26,3 +26,16 @@ seerr_backup_paths: # Nginx reverse proxy configuration seerr_nginx_enabled: false seerr_nginx_hostname: seerr.nas.local +# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal +# names (e.g. *.nas.local) cannot get a public cert: leave this false to use +# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public +# DNS record points at the host. +seerr_nginx_letsencrypt: false +seerr_nginx_ssl_certificate: >- + {{ seerr_nginx_letsencrypt | ternary( + '/etc/letsencrypt/live/' ~ seerr_nginx_hostname ~ '/fullchain.pem', + nginx_default_ssl_cert) }} +seerr_nginx_ssl_certificate_key: >- + {{ seerr_nginx_letsencrypt | ternary( + '/etc/letsencrypt/live/' ~ seerr_nginx_hostname ~ '/privkey.pem', + nginx_default_ssl_key) }} diff --git a/roles/seerr/tasks/main.yml b/roles/seerr/tasks/main.yml index 66045b9..ed44b1c 100644 --- a/roles/seerr/tasks/main.yml +++ b/roles/seerr/tasks/main.yml @@ -84,7 +84,7 @@ ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml" vars: certbot_hostname: "{{ seerr_nginx_hostname }}" - when: seerr_nginx_enabled + when: seerr_nginx_enabled and seerr_nginx_letsencrypt - name: Deploy nginx vhost configuration for Seerr ansible.builtin.template: diff --git a/roles/seerr/templates/nginx-vhost.conf.j2 b/roles/seerr/templates/nginx-vhost.conf.j2 index c79fc98..caa5245 100644 --- a/roles/seerr/templates/nginx-vhost.conf.j2 +++ b/roles/seerr/templates/nginx-vhost.conf.j2 @@ -22,9 +22,8 @@ server { listen [::]:443 ssl; server_name {{ seerr_nginx_hostname }}; - # Let's Encrypt certificates (managed by Certbot) - ssl_certificate /etc/letsencrypt/live/{{ seerr_nginx_hostname }}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/{{ seerr_nginx_hostname }}/privkey.pem; + ssl_certificate {{ seerr_nginx_ssl_certificate }}; + ssl_certificate_key {{ seerr_nginx_ssl_certificate_key }}; # SSL configuration ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }}; diff --git a/roles/static_web/defaults/main.yml b/roles/static_web/defaults/main.yml index 93d211a..6cdb2b0 100644 --- a/roles/static_web/defaults/main.yml +++ b/roles/static_web/defaults/main.yml @@ -9,7 +9,10 @@ # git_depth: 1 # optional, shallow clone depth # build_command: "" # optional, command to run after git clone (e.g., npm build) # root_dir: "" # optional, subdirectory to serve (e.g., "dist" or "build") -# ssl_enabled: true # optional, enable HTTPS with Let's Encrypt (default: true) +# ssl_enabled: true # optional, enable HTTPS (default: true) +# letsencrypt: false # optional, use Let's Encrypt for TLS (default: false, +# # falls back to the shared self-signed cert). Requires +# # a publicly-resolvable hostname. static_web_sites: {} diff --git a/roles/static_web/tasks/main.yml b/roles/static_web/tasks/main.yml index 9af4a77..f681659 100644 --- a/roles/static_web/tasks/main.yml +++ b/roles/static_web/tasks/main.yml @@ -62,6 +62,7 @@ when: - static_web_sites | length > 0 - item.value.ssl_enabled | default(true) + - item.value.letsencrypt | default(false) - name: Deploy nginx vhost configurations ansible.builtin.template: diff --git a/roles/static_web/templates/nginx-vhost.conf.j2 b/roles/static_web/templates/nginx-vhost.conf.j2 index 3c70ab0..21ea030 100644 --- a/roles/static_web/templates/nginx-vhost.conf.j2 +++ b/roles/static_web/templates/nginx-vhost.conf.j2 @@ -23,9 +23,12 @@ server { listen [::]:443 ssl; server_name {{ hostname }}; - # Let's Encrypt certificates (managed by Certbot) - ssl_certificate /etc/letsencrypt/live/{{ hostname }}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/{{ hostname }}/privkey.pem; + ssl_certificate {{ (site_config.letsencrypt | default(false)) | ternary( + '/etc/letsencrypt/live/' ~ hostname ~ '/fullchain.pem', + nginx_default_ssl_cert) }}; + ssl_certificate_key {{ (site_config.letsencrypt | default(false)) | ternary( + '/etc/letsencrypt/live/' ~ hostname ~ '/privkey.pem', + nginx_default_ssl_key) }}; # SSL configuration ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }}; diff --git a/roles/uptime_kuma/defaults/main.yml b/roles/uptime_kuma/defaults/main.yml index 1ec5381..90d6353 100644 --- a/roles/uptime_kuma/defaults/main.yml +++ b/roles/uptime_kuma/defaults/main.yml @@ -31,3 +31,16 @@ uptime_kuma_timezone: UTC # Nginx reverse proxy configuration uptime_kuma_nginx_enabled: false uptime_kuma_nginx_hostname: uptime.nas.local +# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal +# names (e.g. *.nas.local) cannot get a public cert: leave this false to use +# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public +# DNS record points at the host. +uptime_kuma_nginx_letsencrypt: false +uptime_kuma_nginx_ssl_certificate: >- + {{ uptime_kuma_nginx_letsencrypt | ternary( + '/etc/letsencrypt/live/' ~ uptime_kuma_nginx_hostname ~ '/fullchain.pem', + nginx_default_ssl_cert) }} +uptime_kuma_nginx_ssl_certificate_key: >- + {{ uptime_kuma_nginx_letsencrypt | ternary( + '/etc/letsencrypt/live/' ~ uptime_kuma_nginx_hostname ~ '/privkey.pem', + nginx_default_ssl_key) }} diff --git a/roles/uptime_kuma/tasks/main.yml b/roles/uptime_kuma/tasks/main.yml index 30f82f8..8e9e802 100644 --- a/roles/uptime_kuma/tasks/main.yml +++ b/roles/uptime_kuma/tasks/main.yml @@ -83,7 +83,7 @@ ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml" vars: certbot_hostname: "{{ uptime_kuma_nginx_hostname }}" - when: uptime_kuma_nginx_enabled + when: uptime_kuma_nginx_enabled and uptime_kuma_nginx_letsencrypt - name: Deploy nginx vhost configuration for uptime-kuma ansible.builtin.template: diff --git a/roles/uptime_kuma/templates/nginx-vhost.conf.j2 b/roles/uptime_kuma/templates/nginx-vhost.conf.j2 index af395dc..ea1bd0f 100644 --- a/roles/uptime_kuma/templates/nginx-vhost.conf.j2 +++ b/roles/uptime_kuma/templates/nginx-vhost.conf.j2 @@ -22,9 +22,8 @@ server { listen [::]:443 ssl; server_name {{ uptime_kuma_nginx_hostname }}; - # Let's Encrypt certificates (managed by Certbot) - ssl_certificate /etc/letsencrypt/live/{{ uptime_kuma_nginx_hostname }}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/{{ uptime_kuma_nginx_hostname }}/privkey.pem; + ssl_certificate {{ uptime_kuma_nginx_ssl_certificate }}; + ssl_certificate_key {{ uptime_kuma_nginx_ssl_certificate_key }}; # SSL configuration ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }};