Clément Désiles
5efc0b0d6e
certbot cannot issue for internal hostnames (*.nas.local), which made nginx-enabled services with internal names fail on deploy. Add a <service>_nginx_letsencrypt flag (default false) and computed <service>_nginx_ssl_certificate/_key paths: when off the vhost uses the shared self-signed cert (nginx_default_ssl_cert), when on it uses the Let's Encrypt lineage. Gate the certbot include on the flag and apply the pattern to all service roles (deluge, fdroid, gitea, grafana, immich, metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).
32 lines
1.3 KiB
YAML
32 lines
1.3 KiB
YAML
---
|
|
metabase_version: latest
|
|
metabase_image: metabase/metabase
|
|
|
|
# Host port (Metabase listens on 3000 inside the container; 3000 is reserved
|
|
# for dev/testing on the host, following gitea 3100 / grafana 3200 / uptime-kuma 3300)
|
|
metabase_port: 3400
|
|
|
|
metabase_postgres_db_name: metabase
|
|
metabase_postgres_user: metabase
|
|
# metabase_postgres_password: "" # Intentionally undefined - role will fail if not set
|
|
# metabase_postgres_host: "" # Must be set in inventory (e.g. "{{ podman_gw_gateway }}")
|
|
metabase_postgres_port: 5432
|
|
|
|
metabase_timezone: UTC
|
|
|
|
metabase_nginx_enabled: false
|
|
metabase_nginx_hostname: metabase.nas.local
|
|
# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal
|
|
# names (e.g. *.nas.local) cannot get a public cert: leave this false to use
|
|
# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public
|
|
# DNS record points at the host.
|
|
metabase_nginx_letsencrypt: false
|
|
metabase_nginx_ssl_certificate: >-
|
|
{{ metabase_nginx_letsencrypt | ternary(
|
|
'/etc/letsencrypt/live/' ~ metabase_nginx_hostname ~ '/fullchain.pem',
|
|
nginx_default_ssl_cert) }}
|
|
metabase_nginx_ssl_certificate_key: >-
|
|
{{ metabase_nginx_letsencrypt | ternary(
|
|
'/etc/letsencrypt/live/' ~ metabase_nginx_hostname ~ '/privkey.pem',
|
|
nginx_default_ssl_key) }}
|