nginx_site: Prefix all variables with role name

playbooks/dna-gw.yml

@@ -18,7 +18,7 @@
     - dhcpd
     - nginx/server
     - role: nginx_site
-      site: gw.home.foo.sh
+      nginx_site_name: gw.home.foo.sh
     - tftp
     - websockify
 

playbooks/mail.yml

@@ -35,8 +35,8 @@
     - dovecot
     - role: nginx/server
     - role: nginx_site
-      site: "{{ mail_server }}"
+      nginx_site_name: "{{ mail_server }}"
-      redirect: https://webmail.foo.sh/
+      nginx_site_redirect: https://webmail.foo.sh/
     - grossd
     - spamassassin
     - spamassassin_clamav

playbooks/mqtt.yml

@@ -15,4 +15,4 @@
     - telegraf
     - nginx/server
     - role: nginx_site
-      site: iot.foo.sh
+      nginx_site_name: iot.foo.sh

playbooks/nms.yml

@@ -27,7 +27,7 @@
     - base
     - nginx/server
     - role: nginx_site
-      site: oob.foo.sh
+      nginx_site_name: oob.foo.sh
     - sssd
     - mkhomedir
     - tftp

playbooks/ns.yml

@@ -17,7 +17,7 @@
     - nsd
     - role: nginx/server
     - role: nginx_site
-      site: "{{ nsd_server }}"
+      nginx_site_name: "{{ nsd_server }}"
-      redirect: https://www.foo.sh/
+      nginx_site_redirect: https://www.foo.sh/
     - role: ifstated
       when: "'vultr' not in group_names"

playbooks/proxy.yml

@@ -17,92 +17,94 @@
     - ifstated
     - nginx/server
     - role: nginx_site
-      site: ca.foo.sh
+      nginx_site_name: ca.foo.sh
     - role: nginx_site
-      site: foo.monster
+      nginx_site_name: foo.monster
     - role: nginx_site
-      site: tuiradc.fi
+      nginx_site_name: tuiradc.fi
-      redirect: https://facebook.com/TuiraDC
+      nginx_site_redirect: https://facebook.com/TuiraDC
     - role: nginx_site
-      site: www.tuiradc.fi
+      nginx_site_name: www.tuiradc.fi
-      redirect: https://facebook.com/TuiraDC
+      nginx_site_redirect: https://facebook.com/TuiraDC
     - role: nginx_site
-      site: foo.sh
+      nginx_site_name: foo.sh
-      redirect: https://www.foo.sh/
+      nginx_site_redirect: https://www.foo.sh/
     - role: nginx_site
-      site: autoconfig.foo.sh
+      nginx_site_name: autoconfig.foo.sh
     - role: nginx_site
-      site: boot.foo.sh
+      nginx_site_name: boot.foo.sh
-      ssl_config: old
+      nginx_site_ssl_config: old
     - role: nginx_site
-      site: bitbucket.foo.sh
+      nginx_site_name: bitbucket.foo.sh
-      redirect: https://bitbucket.org/tmakinen/
+      nginx_site_redirect: https://bitbucket.org/tmakinen/
     - role: nginx_site
-      site: certbot.home.foo.sh
+      nginx_site_name: certbot.home.foo.sh
-      proxy: https://certbot.home.foo.sh/
+      nginx_site_proxy: https://certbot.home.foo.sh/
     - role: nginx_site
-      site: chat.foo.sh
+      nginx_site_name: chat.foo.sh
-      proxy:
+      nginx_site_proxy:
         - https://oci-node01.home.foo.sh/rocketchat/
         - https://oci-node02.home.foo.sh/rocketchat/
     - role: nginx_site
-      site: collab.foo.sh
+      nginx_site_name: collab.foo.sh
-      proxy: https://collab01.home.foo.sh/
+      nginx_site_proxy: https://collab01.home.foo.sh/
     - role: nginx_site
-      site: devel01.foo.sh
+      nginx_site_name: devel01.foo.sh
-      proxy: https://devel01.home.foo.sh/
+      nginx_site_proxy: https://devel01.home.foo.sh/
     - role: nginx_site
-      site: dns.home.foo.sh
+      nginx_site_name: dns.home.foo.sh
-      redirect: https://www.foo.sh/
+      nginx_site_redirect: https://www.foo.sh/
     - role: nginx_site
-      site: git.foo.sh
+      nginx_site_name: git.foo.sh
-      proxy: https://gitea02.home.foo.sh/
+      nginx_site_proxy: https://gitea02.home.foo.sh/
     - role: nginx_site
-      site: gitea.foo.sh
+      nginx_site_name: gitea.foo.sh
-      redirect: https://git.foo.sh/
+      nginx_site_redirect: https://git.foo.sh/
     - role: nginx_site
-      site: ha.foo.sh
+      nginx_site_name: ha.foo.sh
-      proxy: https://homeassistant01.home.foo.sh/
+      nginx_site_proxy: https://homeassistant01.home.foo.sh/
     - role: nginx_site
-      site: id.foo.sh
+      nginx_site_name: id.foo.sh
-      proxy:
+      nginx_site_proxy:
         - https://oci-node01.home.foo.sh
         - https://oci-node02.home.foo.sh
     - role: nginx_site
-      site: influxdb.foo.sh
+      nginx_site_name: influxdb.foo.sh
-      proxy: https://influxdb01.home.foo.sh/
+      nginx_site_proxy: https://influxdb01.home.foo.sh/
     - role: nginx_site
-      site: iot.foo.sh
+      nginx_site_name: iot.foo.sh
-      redirect: https://www.foo.sh/
+      nginx_site_redirect: https://www.foo.sh/
     - role: nginx_site
-      site: munin.foo.sh
+      nginx_site_name: munin.foo.sh
-      proxy: https://munin01.home.foo.sh/
+      nginx_site_proxy: https://munin01.home.foo.sh/
     - role: nginx_site
-      site: mirrors.foo.sh
+      nginx_site_name: mirrors.foo.sh
-      proxy: https://mirror01.home.foo.sh/
+      nginx_site_proxy: https://mirror01.home.foo.sh/
     - role: nginx_site
-      site: movies.foo.sh
+      nginx_site_name: movies.foo.sh
-      proxy:
+      nginx_site_proxy:
         - https://oci-node01.home.foo.sh/php4dvd/
     - role: nginx_site
-      site: noc.foo.sh
+      nginx_site_name: noc.foo.sh
-      proxy:
+      nginx_site_proxy:
         - https://oci-node01.home.foo.sh/grafana/
         - https://oci-node02.home.foo.sh/grafana/
     - role: nginx_site
-      site: print.foo.sh
+      nginx_site_name: print.foo.sh
-      proxy: https://print01.home.foo.sh:631/
+      nginx_site_proxy: https://print01.home.foo.sh:631/
     - role: nginx_site
-      site: registry.foo.sh
+      nginx_site_name: registry.foo.sh
-      proxy: ["registry01.home.foo.sh:5000", "registry02.home.foo.sh:5000"]
+      nginx_site_proxy:
+        - "registry01.home.foo.sh:5000"
+        - "registry02.home.foo.sh:5000"
     - role: nginx_site
-      site: webmail.foo.sh
+      nginx_site_name: webmail.foo.sh
-      proxy:
+      nginx_site_proxy:
         - https://oci-node01.home.foo.sh/roundcube/
     - role: nginx_site
-      site: wpad.foo.sh
+      nginx_site_name: wpad.foo.sh
     - role: nginx_site
-      site: www.foo.sh
+      nginx_site_name: www.foo.sh
     - role: nginx_site
-      site: zm.foo.sh
+      nginx_site_name: zm.foo.sh
-      proxy: https://zm02.home.foo.sh/
+      nginx_site_proxy: https://zm02.home.foo.sh/

playbooks/relay.yml

@@ -18,11 +18,11 @@
     - relayd
     - nginx/server
     - role: nginx_site
-      site: ldap.foo.sh
+      nginx_site_name: ldap.foo.sh
-      redirect: https://www.foo.sh/
+      nginx_site_redirect: https://www.foo.sh/
     - role: nginx_site
-      site: ldap01.foo.sh
+      nginx_site_name: ldap01.foo.sh
-      redirect: https://www.foo.sh/
+      nginx_site_redirect: https://www.foo.sh/
     - role: nginx_site
-      site: loghost.foo.sh
+      nginx_site_name: loghost.foo.sh
-      redirect: https://www.foo.sh/
+      nginx_site_redirect: https://www.foo.sh/

roles/nginx_site/tasks/main.yml

@@ -1,47 +1,47 @@
 ---
-- name: "Create site data directory for {{ site }}"
+- name: "Create site data directory for {{ nginx_site_name }}"
   ansible.builtin.file:
-    path: "/srv/web/{{ site }}"
+    path: "/srv/web/{{ nginx_site_name }}"
     state: directory
     mode: "0755"
     owner: root
     group: "{{ ansible_wheel }}"
-  when: redirect is not defined and proxy is not defined
+  when: nginx_site_redirect is not defined and nginx_site_proxy is not defined
 
-- name: "Create site config for {{ site }}"
+- name: "Create site config for {{ nginx_site_name }}"
   ansible.builtin.template:
-    dest: /etc/nginx/conf.d/{{ site }}.conf
+    dest: /etc/nginx/conf.d/{{ nginx_site_name }}.conf
     src: site.conf.j2
     mode: "0644"
     owner: root
     group: "{{ ansible_wheel }}"
   notify: Restart nginx
 
-- name: "Copy site private key for {{ site }}"
+- name: "Copy site private key for {{ nginx_site_name }}"
   ansible.builtin.copy:
-    dest: "{{ tls_private }}/{{ site }}.key"
+    dest: "{{ tls_private }}/{{ nginx_site_name }}.key"
     src: "{{ item }}"
     mode: "0600"
     owner: root
     group: "{{ ansible_wheel }}"
   with_first_found:
-    - "/srv/letsencrypt/live/{{ site }}/privkey.pem"
+    - "/srv/letsencrypt/live/{{ nginx_site_name }}/privkey.pem"
-    - "/srv/ca/private/{{ site }}.key"
+    - "/srv/ca/private/{{ nginx_site_name }}.key"
     - "/srv/ca/private/{{ inventory_hostname }}.key"
   tags: certificates
   notify: Restart nginx
 
-- name: "Copy site certificate for {{ site }}"
+- name: "Copy site certificate for {{ nginx_site_name }}"
   ansible.builtin.copy:
     src: "{{ item }}"
-    dest: "{{ tls_certs }}/{{ site }}-fullchain.crt"
+    dest: "{{ tls_certs }}/{{ nginx_site_name }}-fullchain.crt"
     mode: "0644"
     owner: root
     group: "{{ ansible_wheel }}"
     validate: /usr/bin/openssl x509 -in %s -noout
   with_first_found:
-    - "/srv/letsencrypt/live/{{ site }}/fullchain.pem"
+    - "/srv/letsencrypt/live/{{ nginx_site_name }}/fullchain.pem"
-    - "/srv/ca/certs/hosts/{{ site }}.crt"
+    - "/srv/ca/certs/hosts/{{ nginx_site_name }}.crt"
     - "/srv/ca/certs/hosts/{{ inventory_hostname }}.crt"
   tags: certificates
   notify: Restart nginx

roles/nginx_site/templates/site.conf.j2

@@ -1,6 +1,6 @@
-{% if proxy is defined and proxy is not string %}
+{% if nginx_site_proxy is defined and nginx_site_proxy is not string %}
-upstream {{ site }} {
+upstream {{ nginx_site_name }} {
-{% for item in proxy %}
+{% for item in nginx_site_proxy %}
 {%   set item = item | regex_replace("^(https://)?([^/]*).*$", "\\2") %}
 {%   if item | regex_search(".*:[0-9]+$") %}
     server {{ item }};
@@ -13,52 +13,52 @@ upstream {{ site }} {
 server {
     listen 443 ssl http2;
     listen [::]:443 ssl http2;
-    server_name {{ site }};
+    server_name {{ nginx_site_name }};
 
-    access_log {{ nginx_logdir }}/{{ site }}.access.log combined;
+    access_log {{ nginx_logdir }}/{{ nginx_site_name }}.access.log combined;
-    error_log {{ nginx_logdir }}/{{ site }}.error.log warn;
+    error_log {{ nginx_logdir }}/{{ nginx_site_name }}.error.log warn;
 
     add_header Strict-Transport-Security "max-age=63072000" always;
 
-{% if ssl_config is defined %}
+{% if nginx_site_ssl_config is defined %}
-{%   if ssl_config == "old" %}
+{%   if nginx_site_ssl_config == "old" %}
     ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
     ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA;
     ssl_prefer_server_ciphers on;
 {%   endif %}
 {% endif %}
-    ssl_certificate {{ tls_certs }}/{{ site }}-fullchain.crt;
+    ssl_certificate {{ tls_certs }}/{{ nginx_site_name }}-fullchain.crt;
-    ssl_certificate_key {{ tls_private }}/{{ site }}.key;
+    ssl_certificate_key {{ tls_private }}/{{ nginx_site_name }}.key;
 
-{% include "./{}.conf.j2".format(site) ignore missing %}
+{% include "./{}.conf.j2".format(nginx_site_name) ignore missing %}
-{% if redirect is defined %}
+{% if nginx_site_redirect is defined %}
-    return 301 {{ redirect }};
+    return 301 {{ nginx_site_redirect }};
-{% elif proxy is defined %}
+{% elif nginx_site_proxy is defined %}
     location / {
-{%  if proxy is not string %}
+{%  if nginx_site_proxy is not string %}
-{%    set path = proxy[0] | regex_replace("^(https://)?([^/]*)(.*)$", "\\3") %}
+{%    set path = nginx_site_proxy[0] | regex_replace("^(https://)?([^/]*)(.*)$", "\\3") %}
         # https://trac.nginx.org/nginx/ticket/1307
         proxy_ssl_verify off;
-        proxy_pass https://{{ site }}{{ path }};
+        proxy_pass https://{{ nginx_site_name }}{{ path }};
 {%  else %}
-        proxy_pass {{ proxy }};
+        proxy_pass {{ nginx_site_proxy }};
 {%  endif %}
     }
 {% else %}
-    root /srv/web/{{ site }};
+    root /srv/web/{{ nginx_site_name }};
 {% endif %}
 }
 
 server {
     listen 80;
     listen [::]:80;
-    server_name {{ site }};
+    server_name {{ nginx_site_name }};
     location /.well-known/acme-challenge/ {
         proxy_pass https://certbot.home.foo.sh/.well-known/acme-challenge/;
     }
     location / {
-{% if redirect is defined %}
+{% if nginx_site_redirect is defined %}
-        return 301 {{ redirect }};
+        return 301 {{ nginx_site_redirect }};
 {% else %}
         return 301 https://$host$request_uri;
 {% endif %}