Files

T

History

Clément Désiles 5efc0b0d6e fix(nginx): make Let's Encrypt opt-in per service

certbot cannot issue for internal hostnames (*.nas.local), which made
nginx-enabled services with internal names fail on deploy.

Add a <service>_nginx_letsencrypt flag (default false) and computed
<service>_nginx_ssl_certificate/_key paths: when off the vhost uses the
shared self-signed cert (nginx_default_ssl_cert), when on it uses the
Let's Encrypt lineage. Gate the certbot include on the flag and apply the
pattern to all service roles (deluge, fdroid, gitea, grafana, immich,
metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).

2026-09-21 10:04:47 +02:00

defaults

fix(nginx): make Let's Encrypt opt-in per service

2026-09-21 10:04:47 +02:00

handlers

chore: ansible-lint review (almost done)

2026-01-04 11:21:15 +01:00

README.md

static-web

Deploy static websites from Git repositories with Nginx.

Variables

See defaults/main.yml

Main configuration:

static_web_sites:
    "portfolio.example.fr":
        git_repo: "https://github.com/example/portfolio.git"
        git_branch: "main" # Optional, defaults to main
        git_depth: 1 # Optional, shallow clone
        build_command: "npm install && npm run build" # Optional
        root_dir: "dist" # Optional, serve subdirectory
        ssl_enabled: true # Optional, defaults to true (HTTPS)

    "blog.example.com":
        git_repo: "https://github.com/example/blog.git"
        # ssl_enabled defaults to true, set to false for HTTP only

Notes

Nginx configuration is deployed to {{ nginx_conf_dir }}/<hostname>.conf
Sites are owned by nginx user (www-data on Debian, http on Arch)
Git clones use shallow clone (depth=1) by default for efficiency
Build commands run as nginx user