Clément Désiles
5efc0b0d6e
certbot cannot issue for internal hostnames (*.nas.local), which made nginx-enabled services with internal names fail on deploy. Add a <service>_nginx_letsencrypt flag (default false) and computed <service>_nginx_ssl_certificate/_key paths: when off the vhost uses the shared self-signed cert (nginx_default_ssl_cert), when on it uses the Let's Encrypt lineage. Gate the certbot include on the flag and apply the pattern to all service roles (deluge, fdroid, gitea, grafana, immich, metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).
static-web
Deploy static websites from Git repositories with Nginx.
Variables
Main configuration:
static_web_sites:
"portfolio.example.fr":
git_repo: "https://github.com/example/portfolio.git"
git_branch: "main" # Optional, defaults to main
git_depth: 1 # Optional, shallow clone
build_command: "npm install && npm run build" # Optional
root_dir: "dist" # Optional, serve subdirectory
ssl_enabled: true # Optional, defaults to true (HTTPS)
"blog.example.com":
git_repo: "https://github.com/example/blog.git"
# ssl_enabled defaults to true, set to false for HTTP only
Notes
- Nginx configuration is deployed to
{{ nginx_conf_dir }}/<hostname>.conf - Sites are owned by nginx user (www-data on Debian, http on Arch)
- Git clones use shallow clone (depth=1) by default for efficiency
- Build commands run as nginx user