fix(nginx): make Let's Encrypt opt-in per service

certbot cannot issue for internal hostnames (*.nas.local), which made
nginx-enabled services with internal names fail on deploy.

Add a <service>_nginx_letsencrypt flag (default false) and computed
<service>_nginx_ssl_certificate/_key paths: when off the vhost uses the
shared self-signed cert (nginx_default_ssl_cert), when on it uses the
Let's Encrypt lineage. Gate the certbot include on the flag and apply the
pattern to all service roles (deluge, fdroid, gitea, grafana, immich,
metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).

roles/deluge/README.md

@@ -18,8 +18,8 @@ Set the inbound port to `{{ deluge_torrent_port }}` under Preferences → Networ
 
 ## Storage
 
-- `deluge_config_dir` - torrent state, auth and web settings. Backed up.
+- `deluge_config_dir` - torrent state, auth and web settings. Must stay on local storage (SQLite over NFS corrupts under concurrent access). Backed up.
-- `deluge_downloads_dir` - default save path for completed torrents. User data, not backed up.
+- `deluge_downloads_dir` - default save path for completed torrents. May be a network mount (see `roles/nfs_client`). User data, not backed up.
 
 ## Ports
 
@@ -30,9 +30,21 @@ Set the inbound port to `{{ deluge_torrent_port }}` under Preferences → Networ
 
 The thin-client daemon port (58846) is not mapped; add it to the pod manifest if a native Deluge client needs to connect.
 
+## Firewall
+
+The role opens `deluge_torrent_port` (tcp+udp) in ufw for
+`deluge_firewall_allowed_sources` (default `0.0.0.0/0` — peers must reach it for
+a seedbox to work). The web UI port is not opened: expose it via nginx or reach
+it over the VPN.
+
 ## Nginx Reverse Proxy
 
-Set `deluge_nginx_enabled: true` and `deluge_nginx_hostname` to expose the web UI over HTTPS. Certificates are provisioned via the shared `nginx` role's certbot tasks. If the hostname is not the apex, point a DNS record at the host first.
+Set `deluge_nginx_enabled: true` and `deluge_nginx_hostname` to expose the web UI over HTTPS. TLS is opt-in:
+
+- `deluge_nginx_letsencrypt: false` (default) — use the shared self-signed cert (`nginx_default_ssl_cert`, generated by the `nginx` role). Required for internal names like `*.nas.local`, which Let's Encrypt cannot issue.
+- `deluge_nginx_letsencrypt: true` — provision a Let's Encrypt cert via the shared `nginx` role's certbot tasks. Requires a publicly-resolvable hostname with a DNS record pointing at the host.
+
+The web UI login has no fail2ban coverage (Deluge uses form auth, not HTTP Basic), so don't leave it public. Set `deluge_nginx_allowed_sources` to the VPN subnet (e.g. `["192.168.30.0/27"]`) to restrict the vhost to the tunnel; everything else gets a 403. Empty (the default) leaves it open.
 
 ## Backup
 

roles/deluge/defaults/main.yml

@@ -12,10 +12,17 @@ deluge_timezone: UTC
 deluge_loglevel: error
 
 # Storage. Config holds torrent state, auth and web settings; downloads is the
-# default save path. Both must live on local storage, not NFS.
+# default save path. Config MUST stay on local storage (SQLite over NFS corrupts
+# under concurrent access); downloads may be a network mount (see roles/nfs_client).
 deluge_config_dir: "{{ podman_projects_dir }}/deluge/config"
 deluge_downloads_dir: "{{ podman_projects_dir }}/deluge/downloads"
 
+# Inbound firewall. The torrent port must be reachable by peers, so it is open
+# to the world by default. The web UI is not opened here: expose it via nginx
+# (deluge_nginx_enabled) or reach it over the VPN.
+deluge_firewall_allowed_sources:
+  - "0.0.0.0/0"
+
 # Backup manifest - consumed by roles/backup via inventory `backup_jobs`.
 # Only the config (torrent state, auth, web settings) is worth backing up;
 # downloads are user data, not Ansible-reproducible state.
@@ -25,3 +32,20 @@ deluge_backup_paths:
 # Nginx reverse proxy configuration
 deluge_nginx_enabled: false
 deluge_nginx_hostname: deluge.nas.local
+# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal
+# names (e.g. *.nas.local) cannot get a public cert: leave this false to use
+# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public
+# DNS record points at the host.
+deluge_nginx_letsencrypt: false
+deluge_nginx_ssl_certificate: >-
+  {{ deluge_nginx_letsencrypt | ternary(
+     '/etc/letsencrypt/live/' ~ deluge_nginx_hostname ~ '/fullchain.pem',
+     nginx_default_ssl_cert) }}
+deluge_nginx_ssl_certificate_key: >-
+  {{ deluge_nginx_letsencrypt | ternary(
+     '/etc/letsencrypt/live/' ~ deluge_nginx_hostname ~ '/privkey.pem',
+     nginx_default_ssl_key) }}
+# Optional client allow-list for the vhost. Empty = reachable from anywhere.
+# Set to the VPN subnet (e.g. ["192.168.30.0/27"]) to keep the web UI off the
+# public internet while still reaching it over the tunnel.
+deluge_nginx_allowed_sources: []

roles/deluge/tasks/main.yml

@@ -83,11 +83,27 @@
   become: false
   become_user: "{{ ansible_user }}"
 
+- name: Allow torrent traffic through firewall
+  community.general.ufw:
+    rule: allow
+    port: "{{ deluge_torrent_port }}"
+    proto: any
+    from: "{{ item }}"
+    direction: in
+    comment: "Deluge torrent"
+  loop: "{{ deluge_firewall_allowed_sources }}"
+  loop_control:
+    label: "{{ item }}"
+  retries: 5
+  delay: 2
+  register: _deluge_ufw
+  until: _deluge_ufw is succeeded
+
 - name: Provision TLS certificate for Deluge
   ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml"
   vars:
     certbot_hostname: "{{ deluge_nginx_hostname }}"
-  when: deluge_nginx_enabled
+  when: deluge_nginx_enabled and deluge_nginx_letsencrypt
 
 - name: Deploy nginx vhost configuration for Deluge
   ansible.builtin.template:

roles/deluge/templates/nginx-vhost.conf.j2

@@ -1,4 +1,4 @@
-# Deluge vhost with Let's Encrypt (Certbot)
+# Deluge vhost (Let's Encrypt when deluge_nginx_letsencrypt, else self-signed)
 # Managed by Ansible - DO NOT EDIT MANUALLY
 
 server {
@@ -22,9 +22,8 @@ server {
     listen [::]:443 ssl;
     server_name {{ deluge_nginx_hostname }};
 
-    # Let's Encrypt certificates (managed by Certbot)
+    ssl_certificate {{ deluge_nginx_ssl_certificate }};
-    ssl_certificate /etc/letsencrypt/live/{{ deluge_nginx_hostname }}/fullchain.pem;
+    ssl_certificate_key {{ deluge_nginx_ssl_certificate_key }};
-    ssl_certificate_key /etc/letsencrypt/live/{{ deluge_nginx_hostname }}/privkey.pem;
 
     # SSL configuration
     ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }};
@@ -41,6 +40,12 @@ server {
     client_max_body_size 20M;
 
     location / {
+{% if deluge_nginx_allowed_sources | length > 0 %}
+{% for source in deluge_nginx_allowed_sources %}
+        allow {{ source }};
+{% endfor %}
+        deny all;
+{% endif %}
         proxy_pass http://127.0.0.1:{{ deluge_web_port }};
         proxy_set_header Host $http_host;
         proxy_set_header X-Real-IP $remote_addr;

roles/fdroid/defaults/main.yml

@@ -31,3 +31,16 @@ fdroid_update_interval: "24h"
 # Nginx reverse proxy configuration
 fdroid_nginx_enabled: false
 fdroid_nginx_hostname: apk.nas.local
+# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal
+# names (e.g. *.nas.local) cannot get a public cert: leave this false to use
+# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public
+# DNS record points at the host.
+fdroid_nginx_letsencrypt: false
+fdroid_nginx_ssl_certificate: >-
+  {{ fdroid_nginx_letsencrypt | ternary(
+     '/etc/letsencrypt/live/' ~ fdroid_nginx_hostname ~ '/fullchain.pem',
+     nginx_default_ssl_cert) }}
+fdroid_nginx_ssl_certificate_key: >-
+  {{ fdroid_nginx_letsencrypt | ternary(
+     '/etc/letsencrypt/live/' ~ fdroid_nginx_hostname ~ '/privkey.pem',
+     nginx_default_ssl_key) }}

roles/fdroid/tasks/main.yml

@@ -168,7 +168,7 @@
   ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml"
   vars:
     certbot_hostname: "{{ fdroid_nginx_hostname }}"
-  when: fdroid_nginx_enabled
+  when: fdroid_nginx_enabled and fdroid_nginx_letsencrypt
 
 - name: Deploy nginx vhost configuration for fdroid
   ansible.builtin.template:

roles/fdroid/templates/nginx-vhost.conf.j2

@@ -22,9 +22,8 @@ server {
     listen [::]:443 ssl;
     server_name {{ fdroid_nginx_hostname }};
 
-    # Let's Encrypt certificates (managed by Certbot)
+    ssl_certificate {{ fdroid_nginx_ssl_certificate }};
-    ssl_certificate /etc/letsencrypt/live/{{ fdroid_nginx_hostname }}/fullchain.pem;
+    ssl_certificate_key {{ fdroid_nginx_ssl_certificate_key }};
-    ssl_certificate_key /etc/letsencrypt/live/{{ fdroid_nginx_hostname }}/privkey.pem;
 
     # SSL configuration
     ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }};

roles/gitea/defaults/main.yml

@@ -31,3 +31,16 @@ gitea_disable_registration: false
 # Nginx reverse proxy configuration
 gitea_nginx_enabled: true
 gitea_nginx_hostname: "{{ gitea_domain }}"
+# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal
+# names (e.g. *.nas.local) cannot get a public cert: leave this false to use
+# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public
+# DNS record points at the host.
+gitea_nginx_letsencrypt: false
+gitea_nginx_ssl_certificate: >-
+  {{ gitea_nginx_letsencrypt | ternary(
+     '/etc/letsencrypt/live/' ~ gitea_nginx_hostname ~ '/fullchain.pem',
+     nginx_default_ssl_cert) }}
+gitea_nginx_ssl_certificate_key: >-
+  {{ gitea_nginx_letsencrypt | ternary(
+     '/etc/letsencrypt/live/' ~ gitea_nginx_hostname ~ '/privkey.pem',
+     nginx_default_ssl_key) }}

roles/gitea/tasks/main.yml

@@ -147,7 +147,7 @@
   ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml"
   vars:
     certbot_hostname: "{{ gitea_nginx_hostname }}"
-  when: gitea_nginx_enabled
+  when: gitea_nginx_enabled and gitea_nginx_letsencrypt
 
 - name: Deploy nginx vhost configuration for Gitea
   ansible.builtin.template:

roles/gitea/templates/nginx-vhost.conf.j2

@@ -22,9 +22,8 @@ server {
     listen [::]:443 ssl;
     server_name {{ gitea_nginx_hostname }};
 
-    # Let's Encrypt certificates (managed by Certbot)
+    ssl_certificate {{ gitea_nginx_ssl_certificate }};
-    ssl_certificate /etc/letsencrypt/live/{{ gitea_nginx_hostname }}/fullchain.pem;
+    ssl_certificate_key {{ gitea_nginx_ssl_certificate_key }};
-    ssl_certificate_key /etc/letsencrypt/live/{{ gitea_nginx_hostname }}/privkey.pem;
 
     # SSL configuration
     ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }};

roles/grafana/defaults/main.yml

@@ -31,6 +31,19 @@ grafana_check_for_updates: false
 # Nginx reverse proxy
 grafana_nginx_enabled: true
 grafana_nginx_hostname: "{{ grafana_domain }}"
+# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal
+# names (e.g. *.nas.local) cannot get a public cert: leave this false to use
+# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public
+# DNS record points at the host.
+grafana_nginx_letsencrypt: false
+grafana_nginx_ssl_certificate: >-
+  {{ grafana_nginx_letsencrypt | ternary(
+     '/etc/letsencrypt/live/' ~ grafana_nginx_hostname ~ '/fullchain.pem',
+     nginx_default_ssl_cert) }}
+grafana_nginx_ssl_certificate_key: >-
+  {{ grafana_nginx_letsencrypt | ternary(
+     '/etc/letsencrypt/live/' ~ grafana_nginx_hostname ~ '/privkey.pem',
+     nginx_default_ssl_key) }}
 
 # Alerting (Grafana Unified Alerting → ntfy webhook)
 # When enabled, provisions disk alert rules (HDD temperature + ZFS/filesystem

roles/grafana/tasks/main.yml

@@ -346,7 +346,7 @@
   ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml"
   vars:
     certbot_hostname: "{{ grafana_nginx_hostname }}"
-  when: grafana_nginx_enabled
+  when: grafana_nginx_enabled and grafana_nginx_letsencrypt
 
 - name: Deploy nginx vhost
   ansible.builtin.template:

roles/grafana/templates/nginx-vhost.conf.j2

@@ -22,9 +22,8 @@ server {
     listen [::]:443 ssl;
     server_name {{ grafana_nginx_hostname }};
 
-    # Let's Encrypt certificates (managed by Certbot)
+    ssl_certificate {{ grafana_nginx_ssl_certificate }};
-    ssl_certificate /etc/letsencrypt/live/{{ grafana_nginx_hostname }}/fullchain.pem;
+    ssl_certificate_key {{ grafana_nginx_ssl_certificate_key }};
-    ssl_certificate_key /etc/letsencrypt/live/{{ grafana_nginx_hostname }}/privkey.pem;
 
     # SSL configuration
     ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }};

roles/immich/defaults/main.yml

@@ -68,3 +68,16 @@ immich_timezone: UTC
 # Nginx reverse proxy configuration
 immich_nginx_enabled: false
 immich_nginx_hostname: photos.nas.local
+# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal
+# names (e.g. *.nas.local) cannot get a public cert: leave this false to use
+# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public
+# DNS record points at the host.
+immich_nginx_letsencrypt: false
+immich_nginx_ssl_certificate: >-
+  {{ immich_nginx_letsencrypt | ternary(
+     '/etc/letsencrypt/live/' ~ immich_nginx_hostname ~ '/fullchain.pem',
+     nginx_default_ssl_cert) }}
+immich_nginx_ssl_certificate_key: >-
+  {{ immich_nginx_letsencrypt | ternary(
+     '/etc/letsencrypt/live/' ~ immich_nginx_hostname ~ '/privkey.pem',
+     nginx_default_ssl_key) }}

roles/immich/tasks/main.yml

@@ -173,7 +173,7 @@
   ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml"
   vars:
     certbot_hostname: "{{ immich_nginx_hostname }}"
-  when: immich_nginx_enabled
+  when: immich_nginx_enabled and immich_nginx_letsencrypt
 
 - name: Deploy nginx vhost configuration for Immich
   ansible.builtin.template:

roles/immich/templates/nginx-vhost.conf.j2

@@ -23,9 +23,8 @@ server {
     http2 on;
     server_name {{ immich_nginx_hostname }};
 
-    # Let's Encrypt certificates (managed by Certbot)
+    ssl_certificate {{ immich_nginx_ssl_certificate }};
-    ssl_certificate /etc/letsencrypt/live/{{ immich_nginx_hostname }}/fullchain.pem;
+    ssl_certificate_key {{ immich_nginx_ssl_certificate_key }};
-    ssl_certificate_key /etc/letsencrypt/live/{{ immich_nginx_hostname }}/privkey.pem;
 
     # SSL configuration
     ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }};

roles/metabase/defaults/main.yml

@@ -16,3 +16,16 @@ metabase_timezone: UTC
 
 metabase_nginx_enabled: false
 metabase_nginx_hostname: metabase.nas.local
+# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal
+# names (e.g. *.nas.local) cannot get a public cert: leave this false to use
+# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public
+# DNS record points at the host.
+metabase_nginx_letsencrypt: false
+metabase_nginx_ssl_certificate: >-
+  {{ metabase_nginx_letsencrypt | ternary(
+     '/etc/letsencrypt/live/' ~ metabase_nginx_hostname ~ '/fullchain.pem',
+     nginx_default_ssl_cert) }}
+metabase_nginx_ssl_certificate_key: >-
+  {{ metabase_nginx_letsencrypt | ternary(
+     '/etc/letsencrypt/live/' ~ metabase_nginx_hostname ~ '/privkey.pem',
+     nginx_default_ssl_key) }}

roles/metabase/tasks/main.yml

@@ -119,7 +119,7 @@
   ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml"
   vars:
     certbot_hostname: "{{ metabase_nginx_hostname }}"
-  when: metabase_nginx_enabled
+  when: metabase_nginx_enabled and metabase_nginx_letsencrypt
 
 - name: Deploy nginx vhost configuration for Metabase
   ansible.builtin.template:

roles/metabase/templates/nginx-vhost.conf.j2

@@ -20,8 +20,8 @@ server {
     http2 on;
     server_name {{ metabase_nginx_hostname }};
 
-    ssl_certificate     /etc/letsencrypt/live/{{ metabase_nginx_hostname }}/fullchain.pem;
+    ssl_certificate     {{ metabase_nginx_ssl_certificate }};
-    ssl_certificate_key /etc/letsencrypt/live/{{ metabase_nginx_hostname }}/privkey.pem;
+    ssl_certificate_key {{ metabase_nginx_ssl_certificate_key }};
     ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }};
     ssl_prefer_server_ciphers on;
 

roles/nginx/README.md

@@ -48,6 +48,10 @@ prometheus_scrape_configs:
       - targets: ['127.0.0.1:9113']
 ```
 
+## TLS certificates
+
+Let's Encrypt (via the shared `certbot.yml` task) only works for publicly-resolvable hostnames. Each service role exposes a `<service>_nginx_letsencrypt` flag (default `false`) and two computed paths (`<service>_nginx_ssl_certificate` / `_key`): when the flag is off the vhost uses the shared self-signed cert (`nginx_default_ssl_cert`), when on it uses `/etc/letsencrypt/live/<hostname>/`. Gate the certbot include on the flag and reference the path variables from the vhost template. Set the flag `true` in inventory only once a public DNS record points at the host.
+
 ## Service Integration Pattern
 
 Each service role should deploy its own vhost config:

roles/nginx/tasks/certbot.yml

@@ -5,12 +5,16 @@
 #   - certbot_hostname: the domain to provision (e.g. "apk.jokester.fr")
 #   - acme_email: Let's Encrypt account email (typically from host_vars)
 #
+# Let's Encrypt only issues for publicly-resolvable hostnames, so gate the
+# include on the service's `<service>_nginx_letsencrypt` flag (default false;
+# internal names fall back to the shared self-signed cert).
+#
 # Usage from a service role:
 #   - name: Provision TLS certificate
 #     ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml"
 #     vars:
 #       certbot_hostname: "{{ myservice_nginx_hostname }}"
-#     when: myservice_nginx_enabled
+#     when: myservice_nginx_enabled and myservice_nginx_letsencrypt
 
 - name: Validate certbot requirements
   ansible.builtin.assert:

roles/ntfy/defaults/main.yml

@@ -43,3 +43,16 @@ ntfy_enable_reservations: true # Only authenticated users can reserve topics
 # Nginx reverse proxy configuration
 ntfy_nginx_enabled: false
 ntfy_nginx_hostname: ntfy.nas.local
+# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal
+# names (e.g. *.nas.local) cannot get a public cert: leave this false to use
+# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public
+# DNS record points at the host.
+ntfy_nginx_letsencrypt: false
+ntfy_nginx_ssl_certificate: >-
+  {{ ntfy_nginx_letsencrypt | ternary(
+     '/etc/letsencrypt/live/' ~ ntfy_nginx_hostname ~ '/fullchain.pem',
+     nginx_default_ssl_cert) }}
+ntfy_nginx_ssl_certificate_key: >-
+  {{ ntfy_nginx_letsencrypt | ternary(
+     '/etc/letsencrypt/live/' ~ ntfy_nginx_hostname ~ '/privkey.pem',
+     nginx_default_ssl_key) }}

roles/ntfy/tasks/main.yml

@@ -147,7 +147,7 @@
   ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml"
   vars:
     certbot_hostname: "{{ ntfy_nginx_hostname }}"
-  when: ntfy_nginx_enabled
+  when: ntfy_nginx_enabled and ntfy_nginx_letsencrypt
 
 - name: Deploy nginx vhost configuration for ntfy
   ansible.builtin.template:

roles/ntfy/templates/nginx-vhost.conf.j2

@@ -22,9 +22,8 @@ server {
     listen [::]:443 ssl;
     server_name {{ ntfy_nginx_hostname }};
 
-    # Let's Encrypt certificates (managed by Certbot)
+    ssl_certificate {{ ntfy_nginx_ssl_certificate }};
-    ssl_certificate /etc/letsencrypt/live/{{ ntfy_nginx_hostname }}/fullchain.pem;
+    ssl_certificate_key {{ ntfy_nginx_ssl_certificate_key }};
-    ssl_certificate_key /etc/letsencrypt/live/{{ ntfy_nginx_hostname }}/privkey.pem;
 
     # SSL configuration
     ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }};

roles/prowlarr/README.md

@@ -22,7 +22,10 @@ See `defaults/main.yml` for all available variables and their default values.
 
 ## Nginx Reverse Proxy
 
-Set `prowlarr_nginx_enabled: true` and `prowlarr_nginx_hostname` to expose the web UI over HTTPS. Certificates are provisioned via the shared `nginx` role's certbot tasks. If the hostname is not the apex, point a DNS record at the host first.
+Set `prowlarr_nginx_enabled: true` and `prowlarr_nginx_hostname` to expose the web UI over HTTPS. TLS is opt-in:
+
+- `prowlarr_nginx_letsencrypt: false` (default) — use the shared self-signed cert (`nginx_default_ssl_cert`, generated by the `nginx` role). Required for internal names like `*.nas.local`, which Let's Encrypt cannot issue.
+- `prowlarr_nginx_letsencrypt: true` — provision a Let's Encrypt cert via the shared `nginx` role's certbot tasks. Requires a publicly-resolvable hostname with a DNS record pointing at the host.
 
 ## Backup
 

roles/prowlarr/defaults/main.yml

@@ -19,3 +19,16 @@ prowlarr_backup_paths:
 # Nginx reverse proxy configuration
 prowlarr_nginx_enabled: false
 prowlarr_nginx_hostname: prowlarr.nas.local
+# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal
+# names (e.g. *.nas.local) cannot get a public cert: leave this false to use
+# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public
+# DNS record points at the host.
+prowlarr_nginx_letsencrypt: false
+prowlarr_nginx_ssl_certificate: >-
+  {{ prowlarr_nginx_letsencrypt | ternary(
+     '/etc/letsencrypt/live/' ~ prowlarr_nginx_hostname ~ '/fullchain.pem',
+     nginx_default_ssl_cert) }}
+prowlarr_nginx_ssl_certificate_key: >-
+  {{ prowlarr_nginx_letsencrypt | ternary(
+     '/etc/letsencrypt/live/' ~ prowlarr_nginx_hostname ~ '/privkey.pem',
+     nginx_default_ssl_key) }}

roles/prowlarr/tasks/main.yml

@@ -84,7 +84,7 @@
   ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml"
   vars:
     certbot_hostname: "{{ prowlarr_nginx_hostname }}"
-  when: prowlarr_nginx_enabled
+  when: prowlarr_nginx_enabled and prowlarr_nginx_letsencrypt
 
 - name: Deploy nginx vhost configuration for Prowlarr
   ansible.builtin.template:

roles/prowlarr/templates/nginx-vhost.conf.j2

@@ -22,9 +22,8 @@ server {
     listen [::]:443 ssl;
     server_name {{ prowlarr_nginx_hostname }};
 
-    # Let's Encrypt certificates (managed by Certbot)
+    ssl_certificate {{ prowlarr_nginx_ssl_certificate }};
-    ssl_certificate /etc/letsencrypt/live/{{ prowlarr_nginx_hostname }}/fullchain.pem;
+    ssl_certificate_key {{ prowlarr_nginx_ssl_certificate_key }};
-    ssl_certificate_key /etc/letsencrypt/live/{{ prowlarr_nginx_hostname }}/privkey.pem;
 
     # SSL configuration
     ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }};

roles/radarr/README.md

@@ -26,7 +26,10 @@ See `defaults/main.yml` for all available variables and their default values.
 
 ## Nginx Reverse Proxy
 
-Set `radarr_nginx_enabled: true` and `radarr_nginx_hostname` to expose the web UI over HTTPS. Certificates are provisioned via the shared `nginx` role's certbot tasks. If the hostname is not the apex, point a DNS record at the host first.
+Set `radarr_nginx_enabled: true` and `radarr_nginx_hostname` to expose the web UI over HTTPS. TLS is opt-in:
+
+- `radarr_nginx_letsencrypt: false` (default) — use the shared self-signed cert (`nginx_default_ssl_cert`, generated by the `nginx` role). Required for internal names like `*.nas.local`, which Let's Encrypt cannot issue.
+- `radarr_nginx_letsencrypt: true` — provision a Let's Encrypt cert via the shared `nginx` role's certbot tasks. Requires a publicly-resolvable hostname with a DNS record pointing at the host.
 
 ## Backup
 

roles/radarr/defaults/main.yml

@@ -25,3 +25,16 @@ radarr_backup_paths:
 # Nginx reverse proxy configuration
 radarr_nginx_enabled: false
 radarr_nginx_hostname: radarr.nas.local
+# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal
+# names (e.g. *.nas.local) cannot get a public cert: leave this false to use
+# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public
+# DNS record points at the host.
+radarr_nginx_letsencrypt: false
+radarr_nginx_ssl_certificate: >-
+  {{ radarr_nginx_letsencrypt | ternary(
+     '/etc/letsencrypt/live/' ~ radarr_nginx_hostname ~ '/fullchain.pem',
+     nginx_default_ssl_cert) }}
+radarr_nginx_ssl_certificate_key: >-
+  {{ radarr_nginx_letsencrypt | ternary(
+     '/etc/letsencrypt/live/' ~ radarr_nginx_hostname ~ '/privkey.pem',
+     nginx_default_ssl_key) }}

roles/radarr/tasks/main.yml

@@ -87,7 +87,7 @@
   ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml"
   vars:
     certbot_hostname: "{{ radarr_nginx_hostname }}"
-  when: radarr_nginx_enabled
+  when: radarr_nginx_enabled and radarr_nginx_letsencrypt
 
 - name: Deploy nginx vhost configuration for Radarr
   ansible.builtin.template:

roles/radarr/templates/nginx-vhost.conf.j2

@@ -22,9 +22,8 @@ server {
     listen [::]:443 ssl;
     server_name {{ radarr_nginx_hostname }};
 
-    # Let's Encrypt certificates (managed by Certbot)
+    ssl_certificate {{ radarr_nginx_ssl_certificate }};
-    ssl_certificate /etc/letsencrypt/live/{{ radarr_nginx_hostname }}/fullchain.pem;
+    ssl_certificate_key {{ radarr_nginx_ssl_certificate_key }};
-    ssl_certificate_key /etc/letsencrypt/live/{{ radarr_nginx_hostname }}/privkey.pem;
 
     # SSL configuration
     ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }};

roles/seerr/README.md

@@ -28,7 +28,10 @@ The image runs as the unprivileged `node` user (UID/GID 1000). The pod maps the
 
 ## Nginx Reverse Proxy
 
-Set `seerr_nginx_enabled: true` and `seerr_nginx_hostname` to expose the web UI over HTTPS. Certificates are provisioned via the shared `nginx` role's certbot tasks. If the hostname is not the apex, point a DNS record at the host first.
+Set `seerr_nginx_enabled: true` and `seerr_nginx_hostname` to expose the web UI over HTTPS. TLS is opt-in:
+
+- `seerr_nginx_letsencrypt: false` (default) — use the shared self-signed cert (`nginx_default_ssl_cert`, generated by the `nginx` role). Required for internal names like `*.nas.local`, which Let's Encrypt cannot issue.
+- `seerr_nginx_letsencrypt: true` — provision a Let's Encrypt cert via the shared `nginx` role's certbot tasks. Requires a publicly-resolvable hostname with a DNS record pointing at the host.
 
 ## Backup
 

roles/seerr/defaults/main.yml

@@ -26,3 +26,16 @@ seerr_backup_paths:
 # Nginx reverse proxy configuration
 seerr_nginx_enabled: false
 seerr_nginx_hostname: seerr.nas.local
+# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal
+# names (e.g. *.nas.local) cannot get a public cert: leave this false to use
+# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public
+# DNS record points at the host.
+seerr_nginx_letsencrypt: false
+seerr_nginx_ssl_certificate: >-
+  {{ seerr_nginx_letsencrypt | ternary(
+     '/etc/letsencrypt/live/' ~ seerr_nginx_hostname ~ '/fullchain.pem',
+     nginx_default_ssl_cert) }}
+seerr_nginx_ssl_certificate_key: >-
+  {{ seerr_nginx_letsencrypt | ternary(
+     '/etc/letsencrypt/live/' ~ seerr_nginx_hostname ~ '/privkey.pem',
+     nginx_default_ssl_key) }}

roles/seerr/tasks/main.yml

@@ -84,7 +84,7 @@
   ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml"
   vars:
     certbot_hostname: "{{ seerr_nginx_hostname }}"
-  when: seerr_nginx_enabled
+  when: seerr_nginx_enabled and seerr_nginx_letsencrypt
 
 - name: Deploy nginx vhost configuration for Seerr
   ansible.builtin.template:

roles/seerr/templates/nginx-vhost.conf.j2

@@ -22,9 +22,8 @@ server {
     listen [::]:443 ssl;
     server_name {{ seerr_nginx_hostname }};
 
-    # Let's Encrypt certificates (managed by Certbot)
+    ssl_certificate {{ seerr_nginx_ssl_certificate }};
-    ssl_certificate /etc/letsencrypt/live/{{ seerr_nginx_hostname }}/fullchain.pem;
+    ssl_certificate_key {{ seerr_nginx_ssl_certificate_key }};
-    ssl_certificate_key /etc/letsencrypt/live/{{ seerr_nginx_hostname }}/privkey.pem;
 
     # SSL configuration
     ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }};

roles/static_web/defaults/main.yml

@@ -9,7 +9,10 @@
 #       git_depth: 1  # optional, shallow clone depth
 #       build_command: ""  # optional, command to run after git clone (e.g., npm build)
 #       root_dir: ""  # optional, subdirectory to serve (e.g., "dist" or "build")
-#       ssl_enabled: true  # optional, enable HTTPS with Let's Encrypt (default: true)
+#       ssl_enabled: true  # optional, enable HTTPS (default: true)
+#       letsencrypt: false  # optional, use Let's Encrypt for TLS (default: false,
+#                           # falls back to the shared self-signed cert). Requires
+#                           # a publicly-resolvable hostname.
 
 static_web_sites: {}
 

roles/static_web/tasks/main.yml

@@ -62,6 +62,7 @@
   when:
     - static_web_sites | length > 0
     - item.value.ssl_enabled | default(true)
+    - item.value.letsencrypt | default(false)
 
 - name: Deploy nginx vhost configurations
   ansible.builtin.template:

roles/static_web/templates/nginx-vhost.conf.j2

@@ -23,9 +23,12 @@ server {
     listen [::]:443 ssl;
     server_name {{ hostname }};
 
-    # Let's Encrypt certificates (managed by Certbot)
+    ssl_certificate {{ (site_config.letsencrypt | default(false)) | ternary(
-    ssl_certificate /etc/letsencrypt/live/{{ hostname }}/fullchain.pem;
+        '/etc/letsencrypt/live/' ~ hostname ~ '/fullchain.pem',
-    ssl_certificate_key /etc/letsencrypt/live/{{ hostname }}/privkey.pem;
+        nginx_default_ssl_cert) }};
+    ssl_certificate_key {{ (site_config.letsencrypt | default(false)) | ternary(
+        '/etc/letsencrypt/live/' ~ hostname ~ '/privkey.pem',
+        nginx_default_ssl_key) }};
 
     # SSL configuration
     ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }};

roles/uptime_kuma/defaults/main.yml

@@ -31,3 +31,16 @@ uptime_kuma_timezone: UTC
 # Nginx reverse proxy configuration
 uptime_kuma_nginx_enabled: false
 uptime_kuma_nginx_hostname: uptime.nas.local
+# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal
+# names (e.g. *.nas.local) cannot get a public cert: leave this false to use
+# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public
+# DNS record points at the host.
+uptime_kuma_nginx_letsencrypt: false
+uptime_kuma_nginx_ssl_certificate: >-
+  {{ uptime_kuma_nginx_letsencrypt | ternary(
+     '/etc/letsencrypt/live/' ~ uptime_kuma_nginx_hostname ~ '/fullchain.pem',
+     nginx_default_ssl_cert) }}
+uptime_kuma_nginx_ssl_certificate_key: >-
+  {{ uptime_kuma_nginx_letsencrypt | ternary(
+     '/etc/letsencrypt/live/' ~ uptime_kuma_nginx_hostname ~ '/privkey.pem',
+     nginx_default_ssl_key) }}

roles/uptime_kuma/tasks/main.yml

@@ -83,7 +83,7 @@
   ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml"
   vars:
     certbot_hostname: "{{ uptime_kuma_nginx_hostname }}"
-  when: uptime_kuma_nginx_enabled
+  when: uptime_kuma_nginx_enabled and uptime_kuma_nginx_letsencrypt
 
 - name: Deploy nginx vhost configuration for uptime-kuma
   ansible.builtin.template:

roles/uptime_kuma/templates/nginx-vhost.conf.j2

@@ -22,9 +22,8 @@ server {
     listen [::]:443 ssl;
     server_name {{ uptime_kuma_nginx_hostname }};
 
-    # Let's Encrypt certificates (managed by Certbot)
+    ssl_certificate {{ uptime_kuma_nginx_ssl_certificate }};
-    ssl_certificate /etc/letsencrypt/live/{{ uptime_kuma_nginx_hostname }}/fullchain.pem;
+    ssl_certificate_key {{ uptime_kuma_nginx_ssl_certificate_key }};
-    ssl_certificate_key /etc/letsencrypt/live/{{ uptime_kuma_nginx_hostname }}/privkey.pem;
 
     # SSL configuration
     ssl_protocols {{ nginx_ssl_protocols | default('TLSv1.3') }};