Better support SSL certinficates in the frontend role

.gitignore

@@ -1,2 +1,6 @@
 roles/mastodon/vars/main.yml
 host_vars/
+roles/frontend/templates/cdn.fullchain.pem
+roles/frontend/templates/cdn.privkey.pem
+roles/frontend/templates/domain.fullchain.pem
+roles/frontend/templates/domain.privkey.pem

Makefile

@@ -1,3 +1,3 @@
 install:
-	ansible-galaxy install geerlingguy.docker geerlingguy.nginx geerlingguy.certbot
+	ansible-galaxy install geerlingguy.docker geerlingguy.nginx
 	git submodule update --init --recursive

README.md

@@ -50,7 +50,6 @@ ENV_PRODUCTION:
   AWS_SECRET_ACCESS_KEY: changeme
   S3_ALIAS_HOST: changeme
   STATSD_ADDR: statsd:9125
-swap_space: 1G
 ```
 
 In addition, you'll need to update the `group_vars/all` file and setup the location of your postgres server. This is used by pgbouncer.
@@ -72,3 +71,26 @@ sidekiq:
 ```
 
 This will create a service called `sidekiq-ingress-and-stuff` with the `ingress` and `default` queues.  To have the default queues, leave the `q` array empty.
+
+## Configuring frontend
+
+You must provide two sets of certificates and keys into the directory `roles/frontend/templates` of the names:
+- domain.fullchain.pem
+- domain.privkey.pem
+- cdn.fullchain.pem
+- cdn.privkey.pem
+
+These files can be built from any number of ways, for example in my development environment I have the following:
+```
+#!/bin/bash
+
+sudo certbot certonly -d masto.yttrx.com
+sudo certbot certonly -d files.yttrx.com
+cd $HOME/masto-ansible/roles/frontend/templates
+sudo cp /etc/letsencrypt/live/masto.yttrx.com/fullchain.pem domain.fullchain.pem
+sudo cp /etc/letsencrypt/live/masto.yttrx.com/privkey.pem domain.privkey.pem
+sudo cp /etc/letsencrypt/live/files.yttrx.com/fullchain.pem cdn.fullchain.pem
+sudo cp /etc/letsencrypt/live/files.yttrx.com/fullchain.pem cdn.fullchain.pem
+sudo cp /etc/letsencrypt/live/files.yttrx.com/privkey.pem cdn.privkey.pem
+chmod ga+r *.pem
+```

firstboot.yml

@@ -0,0 +1,22 @@
+---
+- hosts: yttrx
+  tasks:
+    - name: Update apt-get repo and cache
+      apt: update_cache=yes force_apt_get=yes
+    
+    - name: Upgrade all apt packages
+      apt: upgrade=dist force_apt_get=yes
+    
+    - name: Check if a reboot is needed for Debian and Ubuntu boxes
+      register: reboot_required_file
+      stat: path=/var/run/reboot-required get_md5=no
+    
+    - name: Reboot the Debian or Ubuntu server
+      reboot:
+        msg: "Reboot initiated by Ansible due to kernel updates"
+        connect_timeout: 5
+        reboot_timeout: 300
+        pre_reboot_delay: 0
+        post_reboot_delay: 30
+        test_command: uptime
+      when: reboot_required_file.stat.exists

group_vars/all

@@ -1,3 +1,4 @@
 MASTODON_VERSION: v4.0.2
 REAL_DB_HOST: tusky.masto.yttrx.com
 DB_POOL: 25
+letsencrypt_account_email: [email protected]

hosts

@@ -3,19 +3,20 @@ grafana.yttrx.com ansible_user=root
 tusky.masto.yttrx.com ansible_user=root
 mammut.masto.yttrx.com ansible_user=root
 mail.yttrx.com ansible_user=root
+wooly.masto.yttrx.com ansible_user=root
 
 [mastodon]
 #tusky.masto.yttrx.com ansible_user=root
 mammut.masto.yttrx.com ansible_user=root
 
 [sidekiq]
-wooly.masto.yttrx.com ansible_user=root
+#wooly.masto.yttrx.com ansible_user=root
 
 [frontend]
 wooly.masto.yttrx.com ansible_user=root
 
 [webapp]
-#wooly.masto.yttrx.com ansible_user=root
+wooly.masto.yttrx.com ansible_user=root
 
 [yttrx:vars]
 ansible_python_interpreter=/usr/bin/python3

roles/frontend/tasks/main.yml

@@ -8,10 +8,10 @@
     owner: www-data
     group: www-data
 
-- name: Install nginx site files
+- name: Install nginx site cdn
   template:
-    src: files.j2
-    dest: /etc/nginx/sites-available/files
+    src: cdn.j2
+    dest: /etc/nginx/sites-available/cdn
   notify: restart nginx
 
 - name: Install nginx mastodon config
@@ -20,10 +20,10 @@
     dest: /etc/nginx/sites-available/mastodon
   notify: restart nginx
 
-- name: Enable files
+- name: Enable cdn
   file:
-    src: /etc/nginx/sites-available/files
-    dest: /etc/nginx/sites-enabled/files
+    src: /etc/nginx/sites-available/cdn
+    dest: /etc/nginx/sites-enabled/cdn
     state: link
 
 - name: Enable mastodon
@@ -43,13 +43,36 @@
     dest: /etc/nginx/dmca
   notify: restart nginx
 
+- name: Prep SSL directory
+  file:
+    path: /etc/nginx/ssl
+    state: directory
+    owner: www-data
+    group: www-data
+
+- name: Install mastodon domain SSL certificate
+  template:
+    src: domain.fullchain.pem
+    dest: /etc/nginx/ssl/domain.fullchain.pem
+
+- name: Install mastodon domain ssl key
+  template:
+    src: domain.privkey.pem
+    dest: /etc/nginx/ssl/domain.privkey.pem
+
+- name: Install mastodon CDN SSL certificate
+  template:
+    src: cdn.fullchain.pem
+    dest: /etc/nginx/ssl/cdn.fullchain.pem
+
+- name: Install mastodon CDN ssl key
+  template:
+    src: cdn.privkey.pem
+    dest: /etc/nginx/ssl/cdn.privkey.pem
+
 - name: Copy cloudflare
   template:
     src: cloudflare
     dest: /etc/nginx/cloudflare
   notify: restart nginx
 
-- name: install certbot
-  package:
-    name: python3-certbot-nginx
-    state: present

roles/frontend/templates/cdn.j2

@@ -22,8 +22,8 @@ server {
 
   include /etc/nginx/cloudflare;
 
-  ssl_certificate     /etc/letsencrypt/live/{{ ENV_PRODUCTION['S3_ALIAS_HOST'] }}/fullchain.pem;
-  ssl_certificate_key /etc/letsencrypt/live/{{ ENV_PRODUCTION['S3_ALIAS_HOST'] }}/privkey.pem;
+  ssl_certificate     /etc/nginx/ssl/cdn.fullchain.pem;
+  ssl_certificate_key /etc/nginx/ssl/cdn.privkey.pem;
 
   access_log /var/log/nginx/{{ ENV_PRODUCTION['S3_ALIAS_HOST'] }}.access.log files_cache;
   error_log /var/log/nginx/{{ ENV_PRODUCTION['S3_ALIAS_HOST'] }}.error.log;

roles/frontend/templates/mastodon.j2

@@ -36,8 +36,8 @@ server {
   ssl_ciphers HIGH:!MEDIUM:!LOW:!aNULL:!NULL:!SHA; ssl_prefer_server_ciphers on;
   ssl_session_cache shared:SSL:10m;
 
-  ssl_certificate     /etc/letsencrypt/live/{{ ENV_PRODUCTION['LOCAL_DOMAIN'] }}/fullchain.pem;
-  ssl_certificate_key /etc/letsencrypt/live/{{ ENV_PRODUCTION['LOCAL_DOMAIN'] }}/privkey.pem;
+  ssl_certificate     /etc/nginx/ssl/domain.fullchain.pem;
+  ssl_certificate_key /etc/nginx/ssl/domain.privkey.pem;
 
   keepalive_timeout    70;
   sendfile             on;

roles/frontend/vars/main.yml

@@ -1 +1,9 @@
 ---
+letsencrypt_cert:
+  name: yttrx
+  domains:
+    - masto.yttrx.com
+    - files.yttrx.com
+  challenge: dns
+  services:
+    - nginx