Refactor and enhance Ansible configurations for dev-02 and nginx proxy setup
- Updated host_vars for dev-02 to include login history settings and modified code server authentication. - Adjusted opencode server configurations and reduced resource allocation. - Introduced a new playbook for configuring nginx reverse proxy with TLS and OAuth2. - Enhanced linux_dev_station role defaults and tasks, including package updates and service configurations. - Removed unnecessary credential assertions in linux_dev_station tasks. - Created nginx_proxy role with tasks for certbot, nginx installation, and oauth2-proxy setup. - Added templates for nginx and oauth2-proxy configurations. - Updated terraform configuration to reflect new DNS records for ide and agent services. - Documented changes and configurations in linux_dev_station.md for clarity and future reference.
This commit is contained in:
@@ -0,0 +1,60 @@
|
||||
---
|
||||
- name: Remove certbot installed via package manager
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
name: certbot
|
||||
state: absent
|
||||
|
||||
- name: Install pip
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
name: python3-pip
|
||||
state: present
|
||||
|
||||
- name: Install certbot and DNS plugin via pip
|
||||
become: true
|
||||
ansible.builtin.pip:
|
||||
name:
|
||||
- certbot
|
||||
- certbot-dns-cloudns
|
||||
state: present
|
||||
|
||||
- name: Ensure CloudDNS credentials directory exists
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: /etc/letsencrypt
|
||||
state: directory
|
||||
mode: '0700'
|
||||
|
||||
- name: Create CloudDNS credentials file
|
||||
become: true
|
||||
ansible.builtin.copy:
|
||||
content: |
|
||||
dns_cloudns_auth_id={{ nginx_proxy_cloudns_auth_id }}
|
||||
dns_cloudns_auth_password={{ nginx_proxy_cloudns_auth_password }}
|
||||
dest: "{{ nginx_proxy_certbot_credential_file }}"
|
||||
mode: "{{ nginx_proxy_certbot_credential_mode }}"
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Obtain TLS certificate via DNS-01 challenge
|
||||
become: true
|
||||
ansible.builtin.command: >-
|
||||
certbot certonly
|
||||
--authenticator dns-cloudns
|
||||
--dns-cloudns-credentials {{ nginx_proxy_certbot_credential_file }}
|
||||
--dns-cloudns-nameserver {{ nginx_proxy_cloudns_nameserver }}
|
||||
-d {{ __nginx_proxy_certbot_domains | join(' -d ') }}
|
||||
--non-interactive
|
||||
--agree-tos
|
||||
-m {{ nginx_proxy_certbot_email }}
|
||||
args:
|
||||
creates: "/etc/letsencrypt/live/{{ __nginx_proxy_certbot_domains[0] }}/fullchain.pem"
|
||||
|
||||
- name: Create certbot renewal cron job
|
||||
become: true
|
||||
ansible.builtin.cron:
|
||||
name: "certbot renewal"
|
||||
minute: "{{ nginx_proxy_certbot_cron_minute }}"
|
||||
hour: "{{ nginx_proxy_certbot_cron_hour }}"
|
||||
job: "certbot renew --deploy-hook 'systemctl reload nginx'"
|
||||
@@ -0,0 +1,39 @@
|
||||
---
|
||||
- name: Validate nginx_proxy_sites is defined
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- nginx_proxy_sites is defined
|
||||
- nginx_proxy_sites | length > 0
|
||||
fail_msg: "nginx_proxy_sites must be defined with at least one site"
|
||||
|
||||
- name: Validate each site has required fields
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- item.server_name is defined
|
||||
- item.upstream is defined
|
||||
- item.upstream.host is defined
|
||||
- item.upstream.port is defined
|
||||
fail_msg: "Each site in nginx_proxy_sites must have server_name, upstream.host, and upstream.port"
|
||||
loop: "{{ nginx_proxy_sites }}"
|
||||
|
||||
- name: Calculate certbot domains from sites
|
||||
ansible.builtin.set_fact:
|
||||
__nginx_proxy_certbot_domains: "{{ nginx_proxy_sites | map(attribute='server_name') | list }}"
|
||||
when: nginx_proxy_certbot_domains is not defined
|
||||
|
||||
- name: Use explicit certbot domains when defined
|
||||
ansible.builtin.set_fact:
|
||||
__nginx_proxy_certbot_domains: "{{ nginx_proxy_certbot_domains }}"
|
||||
when: nginx_proxy_certbot_domains is defined
|
||||
|
||||
- name: Install certbot
|
||||
ansible.builtin.include_tasks: certbot.yml
|
||||
when: nginx_proxy_certbot_enabled | bool
|
||||
|
||||
- name: Install nginx
|
||||
ansible.builtin.include_tasks: nginx.yml
|
||||
when: nginx_proxy_nginx_enabled | bool
|
||||
|
||||
- name: Install oauth2-proxy
|
||||
ansible.builtin.include_tasks: oauth2_proxy.yml
|
||||
when: nginx_proxy_oauth2_proxy_enabled | bool
|
||||
@@ -0,0 +1,46 @@
|
||||
---
|
||||
- name: Install nginx
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
name: nginx
|
||||
state: present
|
||||
|
||||
- name: Deploy nginx.conf
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: nginx.conf.j2
|
||||
dest: /etc/nginx/nginx.conf
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
notify: Reload nginx
|
||||
|
||||
- name: Deploy server blocks configuration
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: nginx-server.conf.j2
|
||||
dest: /etc/nginx/conf.d/nginx-proxy.conf
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
notify: Reload nginx
|
||||
|
||||
- name: Enable and start nginx
|
||||
become: true
|
||||
ansible.builtin.systemd:
|
||||
name: nginx
|
||||
state: started
|
||||
enabled: true
|
||||
daemon_reload: true
|
||||
|
||||
- name: Set SELinux context for Let's Encrypt certificates
|
||||
become: true
|
||||
ansible.builtin.command: >-
|
||||
semanage fcontext -a -t httpd_cert_t "/etc/letsencrypt(/.*)?"
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
|
||||
- name: Restore SELinux context for Let's Encrypt directory
|
||||
become: true
|
||||
ansible.builtin.command: restorecon -Rv /etc/letsencrypt
|
||||
changed_when: false
|
||||
@@ -0,0 +1,68 @@
|
||||
---
|
||||
- name: Download oauth2-proxy
|
||||
become: true
|
||||
ansible.builtin.get_url:
|
||||
url: "https://github.com/oauth2-proxy/oauth2-proxy/releases/download/v{{ nginx_proxy_oauth2_proxy_version }}/oauth2-proxy-v{{ nginx_proxy_oauth2_proxy_version }}.linux-amd64.tar.gz"
|
||||
dest: /tmp/oauth2-proxy.tar.gz
|
||||
mode: "0644"
|
||||
|
||||
- name: Extract oauth2-proxy binary
|
||||
become: true
|
||||
ansible.builtin.unarchive:
|
||||
src: /tmp/oauth2-proxy.tar.gz
|
||||
dest: /tmp/
|
||||
remote_src: true
|
||||
|
||||
- name: Install oauth2-proxy binary
|
||||
become: true
|
||||
ansible.builtin.copy:
|
||||
src: >-
|
||||
/tmp/oauth2-proxy-v{{ nginx_proxy_oauth2_proxy_version }}.linux-amd64/oauth2-proxy
|
||||
dest: /usr/local/bin/oauth2-proxy
|
||||
mode: "0755"
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Create oauth2-proxy config directory
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: /etc/oauth2-proxy
|
||||
state: directory
|
||||
mode: "0755"
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Deploy oauth2-proxy configuration
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: oauth2-proxy.cfg.j2
|
||||
dest: /etc/oauth2-proxy/oauth2-proxy.cfg
|
||||
mode: "0640"
|
||||
owner: root
|
||||
group: nginx
|
||||
|
||||
- name: Create oauth2-proxy log file
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: "{{ nginx_proxy_oauth2_proxy_log_file }}"
|
||||
state: touch
|
||||
mode: "0644"
|
||||
owner: nginx
|
||||
group: nginx
|
||||
|
||||
- name: Deploy oauth2-proxy systemd service
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: oauth2-proxy.service.j2
|
||||
dest: /etc/systemd/system/oauth2-proxy.service
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Enable and start oauth2-proxy
|
||||
become: true
|
||||
ansible.builtin.systemd:
|
||||
name: oauth2-proxy
|
||||
state: started
|
||||
enabled: true
|
||||
daemon_reload: true
|
||||
Reference in New Issue
Block a user