fix(nginx): make Let's Encrypt opt-in per service
certbot cannot issue for internal hostnames (*.nas.local), which made nginx-enabled services with internal names fail on deploy. Add a <service>_nginx_letsencrypt flag (default false) and computed <service>_nginx_ssl_certificate/_key paths: when off the vhost uses the shared self-signed cert (nginx_default_ssl_cert), when on it uses the Let's Encrypt lineage. Gate the certbot include on the flag and apply the pattern to all service roles (deluge, fdroid, gitea, grafana, immich, metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).
This commit is contained in:
Clément Désiles
+15
-3
@@ -18,8 +18,8 @@ Set the inbound port to `{{ deluge_torrent_port }}` under Preferences → Networ
|
||||
|
||||
## Storage
|
||||
|
||||
- `deluge_config_dir` - torrent state, auth and web settings. Backed up.
|
||||
- `deluge_downloads_dir` - default save path for completed torrents. User data, not backed up.
|
||||
- `deluge_config_dir` - torrent state, auth and web settings. Must stay on local storage (SQLite over NFS corrupts under concurrent access). Backed up.
|
||||
- `deluge_downloads_dir` - default save path for completed torrents. May be a network mount (see `roles/nfs_client`). User data, not backed up.
|
||||
|
||||
## Ports
|
||||
|
||||
@@ -30,9 +30,21 @@ Set the inbound port to `{{ deluge_torrent_port }}` under Preferences → Networ
|
||||
|
||||
The thin-client daemon port (58846) is not mapped; add it to the pod manifest if a native Deluge client needs to connect.
|
||||
|
||||
## Firewall
|
||||
|
||||
The role opens `deluge_torrent_port` (tcp+udp) in ufw for
|
||||
`deluge_firewall_allowed_sources` (default `0.0.0.0/0` — peers must reach it for
|
||||
a seedbox to work). The web UI port is not opened: expose it via nginx or reach
|
||||
it over the VPN.
|
||||
|
||||
## Nginx Reverse Proxy
|
||||
|
||||
Set `deluge_nginx_enabled: true` and `deluge_nginx_hostname` to expose the web UI over HTTPS. Certificates are provisioned via the shared `nginx` role's certbot tasks. If the hostname is not the apex, point a DNS record at the host first.
|
||||
Set `deluge_nginx_enabled: true` and `deluge_nginx_hostname` to expose the web UI over HTTPS. TLS is opt-in:
|
||||
|
||||
- `deluge_nginx_letsencrypt: false` (default) — use the shared self-signed cert (`nginx_default_ssl_cert`, generated by the `nginx` role). Required for internal names like `*.nas.local`, which Let's Encrypt cannot issue.
|
||||
- `deluge_nginx_letsencrypt: true` — provision a Let's Encrypt cert via the shared `nginx` role's certbot tasks. Requires a publicly-resolvable hostname with a DNS record pointing at the host.
|
||||
|
||||
The web UI login has no fail2ban coverage (Deluge uses form auth, not HTTP Basic), so don't leave it public. Set `deluge_nginx_allowed_sources` to the VPN subnet (e.g. `["192.168.30.0/27"]`) to restrict the vhost to the tunnel; everything else gets a 403. Empty (the default) leaves it open.
|
||||
|
||||
## Backup
|
||||
|
||||
|
||||
@@ -12,10 +12,17 @@ deluge_timezone: UTC
|
||||
deluge_loglevel: error
|
||||
|
||||
# Storage. Config holds torrent state, auth and web settings; downloads is the
|
||||
# default save path. Both must live on local storage, not NFS.
|
||||
# default save path. Config MUST stay on local storage (SQLite over NFS corrupts
|
||||
# under concurrent access); downloads may be a network mount (see roles/nfs_client).
|
||||
deluge_config_dir: "{{ podman_projects_dir }}/deluge/config"
|
||||
deluge_downloads_dir: "{{ podman_projects_dir }}/deluge/downloads"
|
||||
|
||||
# Inbound firewall. The torrent port must be reachable by peers, so it is open
|
||||
# to the world by default. The web UI is not opened here: expose it via nginx
|
||||
# (deluge_nginx_enabled) or reach it over the VPN.
|
||||
deluge_firewall_allowed_sources:
|
||||
- "0.0.0.0/0"
|
||||
|
||||
# Backup manifest - consumed by roles/backup via inventory `backup_jobs`.
|
||||
# Only the config (torrent state, auth, web settings) is worth backing up;
|
||||
# downloads are user data, not Ansible-reproducible state.
|
||||
@@ -25,3 +32,20 @@ deluge_backup_paths:
|
||||
# Nginx reverse proxy configuration
|
||||
deluge_nginx_enabled: false
|
||||
deluge_nginx_hostname: deluge.nas.local
|
||||
# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal
|
||||
# names (e.g. *.nas.local) cannot get a public cert: leave this false to use
|
||||
# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public
|
||||
# DNS record points at the host.
|
||||
deluge_nginx_letsencrypt: false
|
||||
deluge_nginx_ssl_certificate: >-
|
||||
{{ deluge_nginx_letsencrypt | ternary(
|
||||
'/etc/letsencrypt/live/' ~ deluge_nginx_hostname ~ '/fullchain.pem',
|
||||
nginx_default_ssl_cert) }}
|
||||
deluge_nginx_ssl_certificate_key: >-
|
||||
{{ deluge_nginx_letsencrypt | ternary(
|
||||
'/etc/letsencrypt/live/' ~ deluge_nginx_hostname ~ '/privkey.pem',
|
||||
nginx_default_ssl_key) }}
|
||||
# Optional client allow-list for the vhost. Empty = reachable from anywhere.
|
||||
# Set to the VPN subnet (e.g. ["192.168.30.0/27"]) to keep the web UI off the
|
||||
# public internet while still reaching it over the tunnel.
|
||||
deluge_nginx_allowed_sources: []
|
||||
|
||||
@@ -83,11 +83,27 @@
|
||||
become: false
|
||||
become_user: "{{ ansible_user }}"
|
||||
|
||||
- name: Allow torrent traffic through firewall
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: "{{ deluge_torrent_port }}"
|
||||
proto: any
|
||||
from: "{{ item }}"
|
||||
direction: in
|
||||
comment: "Deluge torrent"
|
||||
loop: "{{ deluge_firewall_allowed_sources }}"
|
||||
loop_control:
|
||||
label: "{{ item }}"
|
||||
retries: 5
|
||||
delay: 2
|
||||
register: _deluge_ufw
|
||||
until: _deluge_ufw is succeeded
|
||||
|
||||
- name: Provision TLS certificate for Deluge
|
||||
ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml"
|
||||
vars:
|
||||
certbot_hostname: "{{ deluge_nginx_hostname }}"
|
||||
when: deluge_nginx_enabled
|
||||
when: deluge_nginx_enabled and deluge_nginx_letsencrypt
|
||||
|
||||
- name: Deploy nginx vhost configuration for Deluge
|
||||
ansible.builtin.template:
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# Deluge vhost with Let's Encrypt (Certbot)
|
||||
# Deluge vhost (Let's Encrypt when deluge_nginx_letsencrypt, else self-signed)
|
||||
# Managed by Ansible - DO NOT EDIT MANUALLY
|
||||
|
||||
server {
|
||||
@@ -22,9 +22,8 @@ server {
|
||||
listen [::]:443 ssl;
|
||||
server_name {{ deluge_nginx_hostname }};
|
||||
|
||||
# Let's Encrypt certificates (managed by Certbot)
|
||||
ssl_certificate /etc/letsencrypt/live/{{ deluge_nginx_hostname }}/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/{{ deluge_nginx_hostname }}/privkey.pem;
|
||||
ssl_certificate {{ deluge_nginx_ssl_certificate }};
|
||||
ssl_certificate_key {{ deluge_nginx_ssl_certificate_key }};
|
||||
|
||||
# SSL configuration
|
||||
ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }};
|
||||
@@ -41,6 +40,12 @@ server {
|
||||
client_max_body_size 20M;
|
||||
|
||||
location / {
|
||||
{% if deluge_nginx_allowed_sources | length > 0 %}
|
||||
{% for source in deluge_nginx_allowed_sources %}
|
||||
allow {{ source }};
|
||||
{% endfor %}
|
||||
deny all;
|
||||
{% endif %}
|
||||
proxy_pass http://127.0.0.1:{{ deluge_web_port }};
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
|
||||
Reference in New Issue
Block a user