Initial working commit

ansible/roles/http/tasks/cron.yml

@@ -0,0 +1,10 @@
+---
+- cron: renew certbot ssl certificate weekly
+  cron:
+    name: ci_bdebyl_net_renewal
+    special_time: weekly
+    job: |
+      certbot --renew certonly --webroot --webroot-path=/srv/http \
+      -m {{ ci_server_email }} --agree-tos \
+      -d {{ ci_server_name }}
+  tags: never

ansible/roles/http/tasks/deps.yml

@@ -0,0 +1,7 @@
+---
+- name: install http dependencies
+  become: true
+  pacman:
+    name: "{{ deps }}"
+    state: present
+  tags: deps

ansible/roles/http/tasks/http.yml

@@ -0,0 +1,56 @@
+---
+- name: setup nginx base configuration
+  become: true
+  copy:
+    src: files/nginx/nginx.conf
+    dest: /etc/nginx/nginx.conf
+  notify: restart_nginx
+  tags: http
+
+- name: setup nginx directories
+  become: true
+  file:
+    path: "/etc/nginx/{{ item }}"
+    state: directory
+  with_items:
+    - sites-enabled
+    - sites-available
+  tags: http
+
+- name: chown http user home
+  become: true
+  file:
+    path: /srv/http
+    owner: http
+    group: http
+    recurse: true
+  tags: http
+
+- name: touch nginx logs, enable jail
+  become: true
+  file:
+    path: "/var/log/nginx/error.log"
+    state: file
+  notify: restart_fail2ban
+  tags: http, security
+
+- name: template nginx http sites-available
+  become: true
+  template:
+    src: "templates/nginx/sites/{{ item }}.j2"
+    dest: "/etc/nginx/sites-available/{{ item }}"
+  with_items:
+    - "{{ ci_server_name }}.http.conf"
+  notify: restart_nginx
+  tags: http
+
+- name: enable desired nginx http sites
+  become: true
+  file:
+    src: "/etc/nginx/sites-available/{{ item }}"
+    dest: "/etc/nginx/sites-enabled/{{ item }}"
+    state: link
+  with_items:
+    - "{{ ci_server_name }}.http.conf"
+  notify: restart_nginx
+  tags: http

ansible/roles/http/tasks/main.yml

@@ -0,0 +1,4 @@
+---
+- import_tasks: deps.yml
+- import_tasks: http.yml
+- import_tasks: ssl.yml

ansible/roles/http/tasks/ssl.yml

@@ -0,0 +1,59 @@
+---
+- name: flush existing nginx https enabled sites
+  become: true
+  file:
+    path: "/etc/nginx/sites-enabled/{{ item }}"
+    state: absent
+  with_items:
+    - "{{ ci_server_name }}.https.conf"
+  notify: restart_nginx
+  tags: ssl
+
+- meta: flush_handlers
+  tags: ssl
+
+- name: generate openssl dhparam for nginx
+  become: true
+  command: |
+    openssl dhparam -dsaparam -out /etc/ssl/certs/dhparam.pem 2048
+  args:
+    creates: /etc/ssl/certs/dhparam.pem
+  tags: ssl
+
+- name: create ssl certificate for ci server
+  become: true
+  command: |
+    certbot certonly --webroot --webroot-path=/srv/http \
+    -m {{ ci_server_email }} --agree-tos \
+    -d {{ ci_server_name }}
+  args:
+    creates: "/etc/letsencrypt/live/{{ ci_server_name }}"
+  tags: ssl
+
+- name: check if certbot certificate was created
+  become: true
+  stat:
+    path: "/etc/letsencrypt/live/{{ ci_server_name }}"
+  register: stat_result
+  tags: ssl
+
+- name: template nginx https sites-available
+  become: true
+  template:
+    src: "templates/nginx/sites/{{ item }}.j2"
+    dest: "/etc/nginx/sites-available/{{ item }}"
+  with_items:
+    - "{{ ci_server_name }}.https.conf"
+  tags: ssl
+
+- name: enable desired nginx https sites
+  become: true
+  file:
+    src: "/etc/nginx/sites-available/{{ item }}"
+    dest: "/etc/nginx/sites-enabled/{{ item }}"
+    state: link
+  with_items:
+    - "{{ ci_server_name }}.https.conf"
+  notify: restart_nginx
+  when: stat_result.stat.exists
+  tags: ssl