fix(nginx): make Let's Encrypt opt-in per service

certbot cannot issue for internal hostnames (*.nas.local), which made
nginx-enabled services with internal names fail on deploy.

Add a <service>_nginx_letsencrypt flag (default false) and computed
<service>_nginx_ssl_certificate/_key paths: when off the vhost uses the
shared self-signed cert (nginx_default_ssl_cert), when on it uses the
Let's Encrypt lineage. Gate the certbot include on the flag and apply the
pattern to all service roles (deluge, fdroid, gitea, grafana, immich,
metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).

roles/radarr/README.md

@@ -26,7 +26,10 @@ See `defaults/main.yml` for all available variables and their default values.
 
 ## Nginx Reverse Proxy
 
-Set `radarr_nginx_enabled: true` and `radarr_nginx_hostname` to expose the web UI over HTTPS. Certificates are provisioned via the shared `nginx` role's certbot tasks. If the hostname is not the apex, point a DNS record at the host first.
+Set `radarr_nginx_enabled: true` and `radarr_nginx_hostname` to expose the web UI over HTTPS. TLS is opt-in:
+
+- `radarr_nginx_letsencrypt: false` (default) — use the shared self-signed cert (`nginx_default_ssl_cert`, generated by the `nginx` role). Required for internal names like `*.nas.local`, which Let's Encrypt cannot issue.
+- `radarr_nginx_letsencrypt: true` — provision a Let's Encrypt cert via the shared `nginx` role's certbot tasks. Requires a publicly-resolvable hostname with a DNS record pointing at the host.
 
 ## Backup
 

roles/radarr/defaults/main.yml

@@ -25,3 +25,16 @@ radarr_backup_paths:
 # Nginx reverse proxy configuration
 radarr_nginx_enabled: false
 radarr_nginx_hostname: radarr.nas.local
+# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal
+# names (e.g. *.nas.local) cannot get a public cert: leave this false to use
+# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public
+# DNS record points at the host.
+radarr_nginx_letsencrypt: false
+radarr_nginx_ssl_certificate: >-
+  {{ radarr_nginx_letsencrypt | ternary(
+     '/etc/letsencrypt/live/' ~ radarr_nginx_hostname ~ '/fullchain.pem',
+     nginx_default_ssl_cert) }}
+radarr_nginx_ssl_certificate_key: >-
+  {{ radarr_nginx_letsencrypt | ternary(
+     '/etc/letsencrypt/live/' ~ radarr_nginx_hostname ~ '/privkey.pem',
+     nginx_default_ssl_key) }}

roles/radarr/tasks/main.yml

@@ -87,7 +87,7 @@
   ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml"
   vars:
     certbot_hostname: "{{ radarr_nginx_hostname }}"
-  when: radarr_nginx_enabled
+  when: radarr_nginx_enabled and radarr_nginx_letsencrypt
 
 - name: Deploy nginx vhost configuration for Radarr
   ansible.builtin.template:

roles/radarr/templates/nginx-vhost.conf.j2

@@ -22,9 +22,8 @@ server {
     listen [::]:443 ssl;
     server_name {{ radarr_nginx_hostname }};
 
-    # Let's Encrypt certificates (managed by Certbot)
-    ssl_certificate /etc/letsencrypt/live/{{ radarr_nginx_hostname }}/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/{{ radarr_nginx_hostname }}/privkey.pem;
+    ssl_certificate {{ radarr_nginx_ssl_certificate }};
+    ssl_certificate_key {{ radarr_nginx_ssl_certificate_key }};
 
     # SSL configuration
     ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }};