Better support SSL certinficates in the frontend role

roles/frontend/tasks/main.yml

@@ -8,10 +8,10 @@
     owner: www-data
     group: www-data
 
-- name: Install nginx site files
+- name: Install nginx site cdn
   template:
-    src: files.j2
-    dest: /etc/nginx/sites-available/files
+    src: cdn.j2
+    dest: /etc/nginx/sites-available/cdn
   notify: restart nginx
 
 - name: Install nginx mastodon config
@@ -20,10 +20,10 @@
     dest: /etc/nginx/sites-available/mastodon
   notify: restart nginx
 
-- name: Enable files
+- name: Enable cdn
   file:
-    src: /etc/nginx/sites-available/files
-    dest: /etc/nginx/sites-enabled/files
+    src: /etc/nginx/sites-available/cdn
+    dest: /etc/nginx/sites-enabled/cdn
     state: link
 
 - name: Enable mastodon
@@ -43,13 +43,36 @@
     dest: /etc/nginx/dmca
   notify: restart nginx
 
+- name: Prep SSL directory
+  file:
+    path: /etc/nginx/ssl
+    state: directory
+    owner: www-data
+    group: www-data
+
+- name: Install mastodon domain SSL certificate
+  template:
+    src: domain.fullchain.pem
+    dest: /etc/nginx/ssl/domain.fullchain.pem
+
+- name: Install mastodon domain ssl key
+  template:
+    src: domain.privkey.pem
+    dest: /etc/nginx/ssl/domain.privkey.pem
+
+- name: Install mastodon CDN SSL certificate
+  template:
+    src: cdn.fullchain.pem
+    dest: /etc/nginx/ssl/cdn.fullchain.pem
+
+- name: Install mastodon CDN ssl key
+  template:
+    src: cdn.privkey.pem
+    dest: /etc/nginx/ssl/cdn.privkey.pem
+
 - name: Copy cloudflare
   template:
     src: cloudflare
     dest: /etc/nginx/cloudflare
   notify: restart nginx
 
-- name: install certbot
-  package:
-    name: python3-certbot-nginx
-    state: present

roles/frontend/templates/cdn.j2

@@ -22,8 +22,8 @@ server {
 
   include /etc/nginx/cloudflare;
 
-  ssl_certificate     /etc/letsencrypt/live/{{ ENV_PRODUCTION['S3_ALIAS_HOST'] }}/fullchain.pem;
-  ssl_certificate_key /etc/letsencrypt/live/{{ ENV_PRODUCTION['S3_ALIAS_HOST'] }}/privkey.pem;
+  ssl_certificate     /etc/nginx/ssl/cdn.fullchain.pem;
+  ssl_certificate_key /etc/nginx/ssl/cdn.privkey.pem;
 
   access_log /var/log/nginx/{{ ENV_PRODUCTION['S3_ALIAS_HOST'] }}.access.log files_cache;
   error_log /var/log/nginx/{{ ENV_PRODUCTION['S3_ALIAS_HOST'] }}.error.log;

roles/frontend/templates/mastodon.j2

@@ -36,8 +36,8 @@ server {
   ssl_ciphers HIGH:!MEDIUM:!LOW:!aNULL:!NULL:!SHA; ssl_prefer_server_ciphers on;
   ssl_session_cache shared:SSL:10m;
 
-  ssl_certificate     /etc/letsencrypt/live/{{ ENV_PRODUCTION['LOCAL_DOMAIN'] }}/fullchain.pem;
-  ssl_certificate_key /etc/letsencrypt/live/{{ ENV_PRODUCTION['LOCAL_DOMAIN'] }}/privkey.pem;
+  ssl_certificate     /etc/nginx/ssl/domain.fullchain.pem;
+  ssl_certificate_key /etc/nginx/ssl/domain.privkey.pem;
 
   keepalive_timeout    70;
   sendfile             on;

roles/frontend/vars/main.yml

@@ -1 +1,9 @@
 ---
+letsencrypt_cert:
+  name: yttrx
+  domains:
+    - masto.yttrx.com
+    - files.yttrx.com
+  challenge: dns
+  services:
+    - nginx