From 22c743baec24bc47d85d4259d7a9bdf5b4cc4243 Mon Sep 17 00:00:00 2001 From: Markus Hauschild Date: Tue, 7 Nov 2023 16:49:13 +0100 Subject: [PATCH] new host: argentum.binary-kitchen.net (event web) --- host_vars/argentum.binary-kitchen.net | 4 ++++ hosts | 1 + roles/event_web/files/certs | 15 ++++++++++++++ roles/event_web/files/vhost | 27 ++++++++++++++++++++++++++ roles/event_web/handlers/main.yml | 7 +++++++ roles/event_web/meta/main.yml | 5 +++++ roles/event_web/tasks/main.yml | 28 +++++++++++++++++++++++++++ site.yml | 7 ++++++- 8 files changed, 93 insertions(+), 1 deletion(-) create mode 100644 host_vars/argentum.binary-kitchen.net create mode 100644 roles/event_web/files/certs create mode 100644 roles/event_web/files/vhost create mode 100644 roles/event_web/handlers/main.yml create mode 100644 roles/event_web/meta/main.yml create mode 100644 roles/event_web/tasks/main.yml diff --git a/host_vars/argentum.binary-kitchen.net b/host_vars/argentum.binary-kitchen.net new file mode 100644 index 0000000..4756cb1 --- /dev/null +++ b/host_vars/argentum.binary-kitchen.net @@ -0,0 +1,4 @@ +--- + +root_keys_host: +- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICyGAePGA47K+VNFcKdvcQG3xM3ywcnrVtUD7wPrIin1 christoph" diff --git a/hosts b/hosts index 652d6ba..1cb52c1 100644 --- a/hosts +++ b/hosts @@ -36,4 +36,5 @@ molybdenum.binary-kitchen.net ruthenium.binary-kitchen.net rhodium.binary-kitchen.net palladium.binary-kitchen.net +argentum.binary-kitchen.net barium.binary-kitchen.net diff --git a/roles/event_web/files/certs b/roles/event_web/files/certs new file mode 100644 index 0000000..65485a8 --- /dev/null +++ b/roles/event_web/files/certs @@ -0,0 +1,15 @@ +--- + +eh2x.binary-kitchen.de: +- path: /etc/nginx/ssl/eh2x.binary-kitchen.de.crt + user: root + group: root + perm: '400' + format: crt,ca + action: '/usr/sbin/service nginx restart' +- path: /etc/nginx/ssl/eh2x.binary-kitchen.de.key + user: root + group: root + perm: '400' + format: key + action: '/usr/sbin/service nginx restart' diff --git a/roles/event_web/files/vhost b/roles/event_web/files/vhost new file mode 100644 index 0000000..3738cdd --- /dev/null +++ b/roles/event_web/files/vhost @@ -0,0 +1,27 @@ +server { + listen 80; + listen [::]:80; + + server_name eh2x.binary-kitchen.de; + + location /.well-known/acme-challenge { + default_type "text/plain"; + alias /var/www/acme-challenge; + } + + location / { + return 301 https://eh2x.binary-kitchen.de$request_uri; + } +} + +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + + server_name eh2x.binary-kitchen.de; + + ssl_certificate_key /etc/nginx/ssl/eh2x.binary-kitchen.de.key; + ssl_certificate /etc/nginx/ssl/eh2x.binary-kitchen.de.crt; + + root /var/www/eh2x; +} diff --git a/roles/event_web/handlers/main.yml b/roles/event_web/handlers/main.yml new file mode 100644 index 0000000..ff936dd --- /dev/null +++ b/roles/event_web/handlers/main.yml @@ -0,0 +1,7 @@ +--- + +- name: Restart nginx + service: name=nginx state=restarted + +- name: Run acertmgr + command: /usr/bin/acertmgr diff --git a/roles/event_web/meta/main.yml b/roles/event_web/meta/main.yml new file mode 100644 index 0000000..8fcf724 --- /dev/null +++ b/roles/event_web/meta/main.yml @@ -0,0 +1,5 @@ +--- + +dependencies: +- { role: acertmgr } +- { role: nginx, nginx_ssl: True } diff --git a/roles/event_web/tasks/main.yml b/roles/event_web/tasks/main.yml new file mode 100644 index 0000000..e375cbd --- /dev/null +++ b/roles/event_web/tasks/main.yml @@ -0,0 +1,28 @@ +--- + +- name: Install dependencies + apt: + name: + - php-fpm + +- name: Create vhost directory + file: path=/var/www/eh2x state=directory owner=www-data group=www-data + +- name: Ensure certificates are available + command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/nginx/ssl/eh2x.binary-kitchen.de.key -out /etc/nginx/ssl/eh2x.binary-kitchen.de.crt -days 730 -subj "/CN=eh2x.binary-kitchen.de" creates=/etc/nginx/ssl/eh2x.binary-kitchen.de.crt + notify: Restart nginx + +#- name: Configure certificate manager +# copy: src=certs dest=/etc/acertmgr/eh2x.binary-kitchen.de.conf +# notify: Run acertmgr + +- name: Configure vhosts + copy: src=vhost dest=/etc/nginx/sites-available/www + notify: Restart nginx + +- name: Enable vhosts + file: src=/etc/nginx/sites-available/www dest=/etc/nginx/sites-enabled/www state=link + notify: Restart nginx + +- name: Start php8.2-fpm + service: name=php8.2-fpm state=started enabled=yes diff --git a/site.yml b/site.yml index fd064b7..703c4ca 100644 --- a/site.yml +++ b/site.yml @@ -7,7 +7,7 @@ - root_keys - name: Setup unattended updates - hosts: [sulis.binary.kitchen, nabia.binary.kitchen, epona.binary.kitchen, pizza.binary.kitchen, pancake.binary.kitchen, knoedel.binary.kitchen, bob.binary.kitchen, lasagne.binary.kitchen, tschunk.binary.kitchen, bowle.binary.kitchen, beryllium.binary-kitchen.net, boron.binary-kitchen.net, carbon.binary-kitchen.net, nitrogen.binary-kitchen.net, oxygen.binary-kitchen.net, fluorine.binary-kitchen.net, neon.binary-kitchen.net, sodium.binary-kitchen.net, magnesium.binary-kitchen.net, krypton.binary-kitchen.net, yttrium.binary-kitchen.net, zirconium.binary-kitchen.net, molybdenum.binary-kitchen.net, ruthenium.binary-kitchen.net, rhodium.binary-kitchen.net, palladium.binary-kitchen.net, barium.binary-kitchen.net] + hosts: [sulis.binary.kitchen, nabia.binary.kitchen, epona.binary.kitchen, pizza.binary.kitchen, pancake.binary.kitchen, knoedel.binary.kitchen, bob.binary.kitchen, lasagne.binary.kitchen, tschunk.binary.kitchen, bowle.binary.kitchen, beryllium.binary-kitchen.net, boron.binary-kitchen.net, carbon.binary-kitchen.net, nitrogen.binary-kitchen.net, oxygen.binary-kitchen.net, fluorine.binary-kitchen.net, neon.binary-kitchen.net, sodium.binary-kitchen.net, magnesium.binary-kitchen.net, krypton.binary-kitchen.net, yttrium.binary-kitchen.net, zirconium.binary-kitchen.net, molybdenum.binary-kitchen.net, ruthenium.binary-kitchen.net, rhodium.binary-kitchen.net, palladium.binary-kitchen.net, argentum.binary-kitchen.net, barium.binary-kitchen.net] roles: - uau @@ -149,6 +149,11 @@ roles: - pretalx +- name: Setup event web host + hosts: argentum.binary-kitchen.net + roles: + - event_web + - name: Setup WorkAdventure host hosts: barium.binary-kitchen.net roles: