CCCHH/ansible-infra
CCCHH/ansible-infra
2
2
Fork 2
Code Issues 7 Pull requests 4 Wiki Activity Actions

light: fix tls cert expiring and not renewing
Some checks failed
/ Ansible Lint (push) Failing after 39s
Details

Browse source
This commit is contained in:
chris 2026-01-25 22:36:30 +01:00
commit 6a92aa68c1
Signed by: c6ristian
SSH key fingerprint: SHA256:B3m+yzpaxGXSEcDBpPHfvza/DNC0wuX+CKMeGq8wgak
4 changed files with 34 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

14
inventories/z9/host_vars/light.yaml
View file

@ -50,10 +50,22 @@ ola__configs:
content: "{{ lookup('ansible.builtin.file', 'resources/z9/light/ola/ola-usbdmx.conf') }}" content: "{{ lookup('ansible.builtin.file', 'resources/z9/light/ola/ola-usbdmx.conf') }}"
- name: ola-usbserial - name: ola-usbserial
content: "{{ lookup('ansible.builtin.file', 'resources/z9/light/ola/ola-usbserial.conf') }}" content: "{{ lookup('ansible.builtin.file', 'resources/z9/light/ola/ola-usbserial.conf') }}"
nginx__version_spec: "" nginx__version_spec: ""
nginx__deploy_redirect_conf: false nginx__deploy_redirect_conf: false
nginx__configurations: nginx__configurations:
- name: light - name: light
content: "{{ lookup('ansible.builtin.file', 'resources/z9/light/nginx/light.conf') }}" content: "{{ lookup('ansible.builtin.file', 'resources/z9/light/nginx/light.conf') }}"
- name: http_handler - name: http_handler
content: "{{ lookup('ansible.builtin.file', 'resources/z9/light/nginx/http_handler.conf') }}" content: "{{ lookup('ansible.builtin.file', 'resources/z9/dooris/nginx/http_handler.conf') }}"
certbot__version_spec: ""
certbot__acme_account_email_address: le-admin@hamburg.ccc.de
certbot__certificate_domains:
- "light-werkstatt.ccchh.net"
- "light.ccchh.net"
- "light.z9.ccchh.net"
certbot__new_cert_commands:
- "systemctl reload nginx.service"

1
inventories/z9/hosts.yaml
View file

@ -20,6 +20,7 @@ all:
certbot_hosts: certbot_hosts:
hosts: hosts:
dooris: dooris:
light:
docker_compose_hosts: docker_compose_hosts:
hosts: hosts:
dooris: dooris:

10
resources/z9/light/nginx/http_handler.conf
View file

@ -1,14 +1,12 @@
server { server {
listen 80 default_server; listen 80 default_server;
listen [::]:80 default_server; listen [::]:80 default_server;
server_name _;
location /.well-known/acme-challenge/ {
autoindex on;
root /webroot-for-acme-challenge;
}
location / { location / {
return 301 https://$host$request_uri; return 301 https://$host$request_uri;
} }
location /.well-known/acme-challenge/ {
proxy_pass http://127.0.0.1:31820/.well-known/acme-challenge/;
}
} }

27
resources/z9/light/nginx/light.conf
View file

@ -1,15 +1,16 @@
# partly generated 2022-01-08, Mozilla Guideline v5.6, nginx 1.17.7, OpenSSL 1.1.1k, intermediate configuration # partly generated 2022-01-08, Mozilla Guideline v5.6, nginx 1.17.7, OpenSSL 1.1.1k, intermediate configuration
# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6 # https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
server { server {
listen 443 ssl http2; listen 443 ssl;
listen [::]:443 ssl http2; listen [::]:443 ssl;
http2 on;
server_name light-werkstatt.ccchh.net; server_name light-werkstatt.ccchh.net;
ssl_certificate /etc/letsencrypt/live/light.ccchh.net/fullchain.pem; ssl_certificate /etc/letsencrypt/live/light-werkstatt.ccchh.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/light.ccchh.net/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/light-werkstatt.ccchh.net/privkey.pem;
# verify chain of trust of OCSP response using Root CA and Intermediate certs # verify chain of trust of OCSP response using Root CA and Intermediate certs
ssl_trusted_certificate /etc/letsencrypt/live/light.ccchh.net/chain.pem; ssl_trusted_certificate /etc/letsencrypt/live/light-werkstatt.ccchh.net/chain.pem;
# replace with the IP address of your resolver # replace with the IP address of your resolver
resolver 10.31.208.1; resolver 10.31.208.1;
@ -25,15 +26,16 @@ server {
} }
server { server {
listen 443 ssl http2; listen 443 ssl;
listen [::]:443 ssl http2; listen [::]:443 ssl;
http2 on;
server_name light.z9.ccchh.net; server_name light.z9.ccchh.net;
ssl_certificate /etc/letsencrypt/live/light.ccchh.net/fullchain.pem; ssl_certificate /etc/letsencrypt/live/light.z9.ccchh.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/light.ccchh.net/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/light.z9.ccchh.net/privkey.pem;
# verify chain of trust of OCSP response using Root CA and Intermediate certs # verify chain of trust of OCSP response using Root CA and Intermediate certs
ssl_trusted_certificate /etc/letsencrypt/live/light.ccchh.net/chain.pem; ssl_trusted_certificate /etc/letsencrypt/live/light.z9.ccchh.net/chain.pem;
location / { location / {
return 307 https://light.ccchh.net$request_uri; return 307 https://light.ccchh.net$request_uri;
@ -41,8 +43,9 @@ server {
} }
server { server {
listen 443 ssl http2; listen 443 ssl;
listen [::]:443 ssl http2; listen [::]:443 ssl;
http2 on;
server_name light.ccchh.net; server_name light.ccchh.net;