jokester/ansible-playbooks
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(nginx): make Let's Encrypt opt-in per service

Browse Source 
certbot cannot issue for internal hostnames (*.nas.local), which made
nginx-enabled services with internal names fail on deploy.

Add a <service>_nginx_letsencrypt flag (default false) and computed
<service>_nginx_ssl_certificate/_key paths: when off the vhost uses the
shared self-signed cert (nginx_default_ssl_cert), when on it uses the
Let's Encrypt lineage. Gate the certbot include on the flag and apply the
pattern to all service roles (deluge, fdroid, gitea, grafana, immich,
metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).
This commit is contained in:
Clément Désiles
2026-09-21 10:04:47 +02:00
parent 61621715e0
commit 5efc0b0d6e
42 changed files with 258 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/nginx/README.md
+4
View File
@@ -48,6 +48,10 @@ prometheus_scrape_configs:
- targets: ['127.0.0.1:9113']
```
## TLS certificates
Let's Encrypt (via the shared `certbot.yml` task) only works for publicly-resolvable hostnames. Each service role exposes a `<service>_nginx_letsencrypt` flag (default `false`) and two computed paths (`<service>_nginx_ssl_certificate` / `_key`): when the flag is off the vhost uses the shared self-signed cert (`nginx_default_ssl_cert`), when on it uses `/etc/letsencrypt/live/<hostname>/`. Gate the certbot include on the flag and reference the path variables from the vhost template. Set the flag `true` in inventory only once a public DNS record points at the host.
## Service Integration Pattern
Each service role should deploy its own vhost config: