jokester/ansible-playbooks
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(nginx): make Let's Encrypt opt-in per service

Browse Source 
certbot cannot issue for internal hostnames (*.nas.local), which made
nginx-enabled services with internal names fail on deploy.

Add a <service>_nginx_letsencrypt flag (default false) and computed
<service>_nginx_ssl_certificate/_key paths: when off the vhost uses the
shared self-signed cert (nginx_default_ssl_cert), when on it uses the
Let's Encrypt lineage. Gate the certbot include on the flag and apply the
pattern to all service roles (deluge, fdroid, gitea, grafana, immich,
metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).
This commit is contained in:
Clément Désiles
2026-09-21 10:04:47 +02:00
parent 61621715e0
commit 5efc0b0d6e
42 changed files with 258 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/fdroid/templates/nginx-vhost.conf.j2
+2 -3
View File
@@ -22,9 +22,8 @@ server {
listen [::]:443 ssl;
server_name {{ fdroid_nginx_hostname }};
# Let's Encrypt certificates (managed by Certbot)
ssl_certificate /etc/letsencrypt/live/{{ fdroid_nginx_hostname }}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/{{ fdroid_nginx_hostname }}/privkey.pem;
ssl_certificate {{ fdroid_nginx_ssl_certificate }};
ssl_certificate_key {{ fdroid_nginx_ssl_certificate_key }};
# SSL configuration
ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }};