From 89c9e8031ceeca0ad82ada7fb3395c35564a5a6f Mon Sep 17 00:00:00 2001 From: Markus Hauschild Date: Mon, 9 May 2016 20:33:49 +0200 Subject: [PATCH] Add ccc-r.de and ccc-regensburg.de to web. --- roles/web/files/certs | 14 ++++++++++++++ roles/web/files/vhost | 30 ++++++++++++++++++++++++++++++ roles/web/tasks/main.yml | 6 +++++- 3 files changed, 49 insertions(+), 1 deletion(-) diff --git a/roles/web/files/certs b/roles/web/files/certs index 2343dea..cd10dca 100644 --- a/roles/web/files/certs +++ b/roles/web/files/certs @@ -13,3 +13,17 @@ www.binary-kitchen.de: perm: '400' format: key action: 'service nginx restart' + +www.ccc-r.de: +- path: /etc/nginx/ssl/www.ccc-r.de.crt + user: root + group: root + perm: '400' + format: crt,ca + action: 'service nginx restart' +- path: /etc/nginx/ssl/www.ccc-r.de.key + user: root + group: root + perm: '400' + format: key + action: 'service nginx restart' diff --git a/roles/web/files/vhost b/roles/web/files/vhost index b838adf..7c702e5 100644 --- a/roles/web/files/vhost +++ b/roles/web/files/vhost @@ -54,3 +54,33 @@ server { fastcgi_intercept_errors on; } } + +server { + listen 80; + listen [::]:80; + + server_name ccc-r.de www.ccc-r.de ccc-regensburg.de www.ccc-regensburg.de; + + location /.well-known/acme-challenge { + default_type "text/plain"; + alias /var/www/acme-challenge; + } + + location / { + return 301 https://www.ccc-r.de$request_uri; + } +} + +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + + server_name www.ccc-r.de; + + ssl_certificate_key /etc/nginx/ssl/www.ccc-r.de.key; + ssl_certificate /etc/nginx/ssl/www.ccc-r.de.crt; + + root /var/www/ccc-r; + + default_type text/html; +} diff --git a/roles/web/tasks/main.yml b/roles/web/tasks/main.yml index a58c7fe..96b9fa8 100644 --- a/roles/web/tasks/main.yml +++ b/roles/web/tasks/main.yml @@ -10,10 +10,14 @@ - name: Create vhost directory file: path=/var/www/kitchen state=directory owner=www-data group=www-data -- name: Ensure certificates are available +- name: Ensure (BK) certificates are available command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/nginx/ssl/www.binary-kitchen.de.key -out /etc/nginx/ssl/www.binary-kitchen.de.crt -days 730 -subj "/CN=www.binary-kitchen.de" creates=/etc/nginx/ssl/www.binary-kitchen.de.crt notify: Restart nginx +- name: Ensure (CCC-R) certificates are available + command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/nginx/ssl/www.ccc-r.de.key -out /etc/nginx/ssl/www.ccc-r.de.crt -days 730 -subj "/CN=www.ccc-r.de" creates=/etc/nginx/ssl/www.ccc-r.de.crt + notify: Restart nginx + - name: Configure certificate manager copy: src=certs dest=/etc/acme/domains.d/www.binary-kitchen.de.conf