From 89c9e8031ceeca0ad82ada7fb3395c35564a5a6f Mon Sep 17 00:00:00 2001
From: Markus Hauschild <markus@moepman.eu>
Date: Mon, 9 May 2016 20:33:49 +0200
Subject: [PATCH] Add ccc-r.de and ccc-regensburg.de to web.

---
 roles/web/files/certs    | 14 ++++++++++++++
 roles/web/files/vhost    | 30 ++++++++++++++++++++++++++++++
 roles/web/tasks/main.yml |  6 +++++-
 3 files changed, 49 insertions(+), 1 deletion(-)

diff --git a/roles/web/files/certs b/roles/web/files/certs
index 2343dea..cd10dca 100644
--- a/roles/web/files/certs
+++ b/roles/web/files/certs
@@ -13,3 +13,17 @@ www.binary-kitchen.de:
   perm: '400'
   format: key
   action: 'service nginx restart'
+
+www.ccc-r.de:
+- path: /etc/nginx/ssl/www.ccc-r.de.crt
+  user: root
+  group: root
+  perm: '400'
+  format: crt,ca
+  action: 'service nginx restart'
+- path: /etc/nginx/ssl/www.ccc-r.de.key
+  user: root
+  group: root
+  perm: '400'
+  format: key
+  action: 'service nginx restart'
diff --git a/roles/web/files/vhost b/roles/web/files/vhost
index b838adf..7c702e5 100644
--- a/roles/web/files/vhost
+++ b/roles/web/files/vhost
@@ -54,3 +54,33 @@ server {
 		fastcgi_intercept_errors on;
 	}
 }
+
+server {
+	listen 80;
+	listen [::]:80;
+
+	server_name ccc-r.de www.ccc-r.de ccc-regensburg.de www.ccc-regensburg.de;
+
+	location /.well-known/acme-challenge {
+		default_type "text/plain";
+		alias /var/www/acme-challenge;
+	}
+
+	location / {
+		return 301 https://www.ccc-r.de$request_uri;
+	}
+}
+
+server {
+	listen 443 ssl http2;
+	listen [::]:443 ssl http2;
+
+	server_name www.ccc-r.de;
+
+	ssl_certificate_key /etc/nginx/ssl/www.ccc-r.de.key;
+	ssl_certificate /etc/nginx/ssl/www.ccc-r.de.crt;
+
+	root /var/www/ccc-r;
+
+	default_type text/html;
+}
diff --git a/roles/web/tasks/main.yml b/roles/web/tasks/main.yml
index a58c7fe..96b9fa8 100644
--- a/roles/web/tasks/main.yml
+++ b/roles/web/tasks/main.yml
@@ -10,10 +10,14 @@
 - name: Create vhost directory
   file: path=/var/www/kitchen state=directory owner=www-data group=www-data
 
-- name: Ensure certificates are available
+- name: Ensure (BK) certificates are available
   command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/nginx/ssl/www.binary-kitchen.de.key -out /etc/nginx/ssl/www.binary-kitchen.de.crt -days 730 -subj "/CN=www.binary-kitchen.de" creates=/etc/nginx/ssl/www.binary-kitchen.de.crt
   notify: Restart nginx
 
+- name: Ensure (CCC-R) certificates are available
+  command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/nginx/ssl/www.ccc-r.de.key -out /etc/nginx/ssl/www.ccc-r.de.crt -days 730 -subj "/CN=www.ccc-r.de" creates=/etc/nginx/ssl/www.ccc-r.de.crt
+  notify: Restart nginx
+
 - name: Configure certificate manager
   copy: src=certs dest=/etc/acme/domains.d/www.binary-kitchen.de.conf