Clément Désiles
5efc0b0d6e
certbot cannot issue for internal hostnames (*.nas.local), which made nginx-enabled services with internal names fail on deploy. Add a <service>_nginx_letsencrypt flag (default false) and computed <service>_nginx_ssl_certificate/_key paths: when off the vhost uses the shared self-signed cert (nginx_default_ssl_cert), when on it uses the Let's Encrypt lineage. Gate the certbot include on the flag and apply the pattern to all service roles (deluge, fdroid, gitea, grafana, immich, metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).
47 lines
1.8 KiB
YAML
47 lines
1.8 KiB
YAML
---
|
|
# Uptime Kuma version to deploy
|
|
uptime_kuma_version: "2"
|
|
|
|
# Storage location (CRITICAL: Must be local storage, NOT NFS)
|
|
# NFS is NOT supported - will cause SQLite corruption
|
|
uptime_kuma_data_dir: "{{ podman_projects_dir }}/uptime-kuma/data"
|
|
|
|
# Backup manifest - consumed by roles/backup via inventory `backup_jobs`.
|
|
# The uptime_kuma role owns WHAT gets backed up: kuma.db holds every monitor,
|
|
# notification channel and status page, and is a live SQLite file - so it is
|
|
# excluded from the live tree and dumped with sqlite3 .backup instead (copying
|
|
# a live SQLite file yields a torn snapshot, recent writes sit in the -wal
|
|
# sidecar). The rest of the data dir is archived as-is.
|
|
uptime_kuma_backup_paths:
|
|
- "{{ uptime_kuma_data_dir }}"
|
|
uptime_kuma_backup_exclude:
|
|
- "{{ uptime_kuma_data_dir }}/kuma.db*"
|
|
uptime_kuma_backup_sqlite:
|
|
- "{{ uptime_kuma_data_dir }}/kuma.db"
|
|
|
|
# Network configuration
|
|
uptime_kuma_port: 3300
|
|
|
|
# Container image
|
|
uptime_kuma_image: louislam/uptime-kuma
|
|
|
|
# Timezone
|
|
uptime_kuma_timezone: UTC
|
|
|
|
# Nginx reverse proxy configuration
|
|
uptime_kuma_nginx_enabled: false
|
|
uptime_kuma_nginx_hostname: uptime.nas.local
|
|
# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal
|
|
# names (e.g. *.nas.local) cannot get a public cert: leave this false to use
|
|
# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public
|
|
# DNS record points at the host.
|
|
uptime_kuma_nginx_letsencrypt: false
|
|
uptime_kuma_nginx_ssl_certificate: >-
|
|
{{ uptime_kuma_nginx_letsencrypt | ternary(
|
|
'/etc/letsencrypt/live/' ~ uptime_kuma_nginx_hostname ~ '/fullchain.pem',
|
|
nginx_default_ssl_cert) }}
|
|
uptime_kuma_nginx_ssl_certificate_key: >-
|
|
{{ uptime_kuma_nginx_letsencrypt | ternary(
|
|
'/etc/letsencrypt/live/' ~ uptime_kuma_nginx_hostname ~ '/privkey.pem',
|
|
nginx_default_ssl_key) }}
|