Clément Désiles
5efc0b0d6e
certbot cannot issue for internal hostnames (*.nas.local), which made nginx-enabled services with internal names fail on deploy. Add a <service>_nginx_letsencrypt flag (default false) and computed <service>_nginx_ssl_certificate/_key paths: when off the vhost uses the shared self-signed cert (nginx_default_ssl_cert), when on it uses the Let's Encrypt lineage. Gate the certbot include on the flag and apply the pattern to all service roles (deluge, fdroid, gitea, grafana, immich, metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).
52 lines
2.1 KiB
YAML
52 lines
2.1 KiB
YAML
---
|
|
# Deluge container image and version
|
|
deluge_image: lscr.io/linuxserver/deluge
|
|
deluge_version: latest
|
|
|
|
# Network
|
|
deluge_web_port: 8112
|
|
deluge_torrent_port: 6881
|
|
|
|
# Timezone and log level (error/info/debug)
|
|
deluge_timezone: UTC
|
|
deluge_loglevel: error
|
|
|
|
# Storage. Config holds torrent state, auth and web settings; downloads is the
|
|
# default save path. Config MUST stay on local storage (SQLite over NFS corrupts
|
|
# under concurrent access); downloads may be a network mount (see roles/nfs_client).
|
|
deluge_config_dir: "{{ podman_projects_dir }}/deluge/config"
|
|
deluge_downloads_dir: "{{ podman_projects_dir }}/deluge/downloads"
|
|
|
|
# Inbound firewall. The torrent port must be reachable by peers, so it is open
|
|
# to the world by default. The web UI is not opened here: expose it via nginx
|
|
# (deluge_nginx_enabled) or reach it over the VPN.
|
|
deluge_firewall_allowed_sources:
|
|
- "0.0.0.0/0"
|
|
|
|
# Backup manifest - consumed by roles/backup via inventory `backup_jobs`.
|
|
# Only the config (torrent state, auth, web settings) is worth backing up;
|
|
# downloads are user data, not Ansible-reproducible state.
|
|
deluge_backup_paths:
|
|
- "{{ deluge_config_dir }}"
|
|
|
|
# Nginx reverse proxy configuration
|
|
deluge_nginx_enabled: false
|
|
deluge_nginx_hostname: deluge.nas.local
|
|
# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal
|
|
# names (e.g. *.nas.local) cannot get a public cert: leave this false to use
|
|
# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public
|
|
# DNS record points at the host.
|
|
deluge_nginx_letsencrypt: false
|
|
deluge_nginx_ssl_certificate: >-
|
|
{{ deluge_nginx_letsencrypt | ternary(
|
|
'/etc/letsencrypt/live/' ~ deluge_nginx_hostname ~ '/fullchain.pem',
|
|
nginx_default_ssl_cert) }}
|
|
deluge_nginx_ssl_certificate_key: >-
|
|
{{ deluge_nginx_letsencrypt | ternary(
|
|
'/etc/letsencrypt/live/' ~ deluge_nginx_hostname ~ '/privkey.pem',
|
|
nginx_default_ssl_key) }}
|
|
# Optional client allow-list for the vhost. Empty = reachable from anywhere.
|
|
# Set to the VPN subnet (e.g. ["192.168.30.0/27"]) to keep the web UI off the
|
|
# public internet while still reaching it over the tunnel.
|
|
deluge_nginx_allowed_sources: []
|