alexandre.pires
8724360fb2
- Updated AGENTS.md to include new directories for execution plans and implemented feature reports. - Modified Ansible host variables for dev-02 and gpu-01 to change API endpoints and add new configurations for Scaleway. - Adjusted firewall rules in gpu-01 to allow HTTPS traffic instead of the previous Ollama port. - Added OAuth2 proxy configurations to gpu-01 for enhanced security. - Removed deprecated open-webui module from Terraform app configurations. - Updated Terraform configurations to reflect changes in local variables and removed unused secrets. - Created a new sectool.json file for CloudNS integration with Bitwarden. - Enhanced SELinux configurations for nginx to allow connections to any port and added oauth2-proxy port.
62 lines
1.5 KiB
YAML
62 lines
1.5 KiB
YAML
---
|
|
- name: Install nginx
|
|
become: true
|
|
ansible.builtin.dnf:
|
|
name: nginx
|
|
state: present
|
|
|
|
- name: Deploy nginx.conf
|
|
become: true
|
|
ansible.builtin.template:
|
|
src: nginx.conf.j2
|
|
dest: /etc/nginx/nginx.conf
|
|
mode: "0644"
|
|
owner: root
|
|
group: root
|
|
notify: Reload nginx
|
|
|
|
- name: Deploy server blocks configuration
|
|
become: true
|
|
ansible.builtin.template:
|
|
src: nginx-server.conf.j2
|
|
dest: /etc/nginx/conf.d/nginx-proxy.conf
|
|
mode: "0644"
|
|
owner: root
|
|
group: root
|
|
notify: Reload nginx
|
|
|
|
- name: Enable and start nginx
|
|
become: true
|
|
ansible.builtin.systemd:
|
|
name: nginx
|
|
state: started
|
|
enabled: true
|
|
daemon_reload: true
|
|
|
|
- name: Set SELinux context for Let's Encrypt certificates
|
|
become: true
|
|
ansible.builtin.command: >-
|
|
semanage fcontext -a -t httpd_cert_t "/etc/letsencrypt(/.*)?"
|
|
failed_when: false
|
|
changed_when: false
|
|
|
|
- name: Restore SELinux context for Let's Encrypt directory
|
|
become: true
|
|
ansible.builtin.command: restorecon -Rv /etc/letsencrypt
|
|
changed_when: false
|
|
|
|
- name: Set SELinux boolean to allow nginx to connect to any port
|
|
become: true
|
|
ansible.builtin.command: semanage boolean -m --on nginx_connect_any
|
|
failed_when: false
|
|
changed_when: false
|
|
when: ansible_selinux.status == "enabled"
|
|
|
|
- name: Add oauth2-proxy port to SELinux http_port_t
|
|
become: true
|
|
ansible.builtin.command: >-
|
|
semanage port -a -t http_port_t -p tcp {{ nginx_proxy_oauth2_proxy_port }}
|
|
failed_when: false
|
|
changed_when: false
|
|
when: ansible_selinux.status == "enabled"
|