Compare commits

...

2 Commits

Author SHA1 Message Date
4a123b6f4a add static site 2024-01-12 21:26:09 -05:00
0bfb4a99cd fix renewal 2024-01-12 20:58:04 -05:00
6 changed files with 57 additions and 7 deletions

4
deploy-static.yml Normal file
View File

@ -0,0 +1,4 @@
- name: static setup
hosts: static
roles:
- static

View File

@ -51,3 +51,6 @@ europa ansible_user=root ansible_connection=ssh
[gitea] [gitea]
nijika ansible_user=root ansible_connection=ssh nijika ansible_user=root ansible_connection=ssh
[static]
levi ansible_user=root ansible_connection=ssh

View File

@ -84,11 +84,8 @@
- name: reload nginx to activate sites - name: reload nginx to activate sites
service: name=nginx state=restarted service: name=nginx state=restarted
- name: add daily letsencrypt cronjob for cert renewal based on hash of domain name to prevent hitting LE rate limits - name: add daily renewal
cron: cron:
name: "letsencrypt_renewal_{{ item.stdout }}" name: "letsencrypt_renewal"
minute: "0" special_time: "daily"
hour: "5,17" job: "REQUESTS_CA_BUNDLE=/usr/local/share/ca-certificates/{{ step_bootstrap_ca_url }}.crt letsencrypt renew --force-renewal"
job: "REQUESTS_CA_BUNDLE=/usr/local/share/ca-certificates/{{ step_bootstrap_ca_url }}.crt letsencrypt renew --server https://{{ step_bootstrap_ca_url }}:{{ step_ca_port }}/acme/ACME/directory --cert-name {{ item.stdout }} -n --webroot -w /var/www/letsencrypt --agree-tos --email {{ step_acme_cert_contact }} && service nginx reload"
loop: "{{ extracted_domains.results }}"
when: item.stdout != ""

View File

@ -0,0 +1,8 @@
---
- name: clone static repo
git:
repo: https://git.simponic.xyz/simponic/static.simponic.xyz.git
dest: /var/www/html/static.simponic.xyz
clone: yes
update: yes

View File

@ -0,0 +1,13 @@
server {
listen 80;
server_name static.simponic.xyz;
location /.well-known/acme-challenge {
root /var/www/letsencrypt;
try_files $uri $uri/ =404;
}
location / {
rewrite ^ https://static.simponic.xyz$request_uri? permanent;
}
}

View File

@ -0,0 +1,25 @@
server {
listen 443 ssl;
server_name static.simponic.xyz;
ssl_certificate /etc/letsencrypt/live/static.simponic.xyz/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/static.simponic.xyz/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/static.simponic.xyz/fullchain.pem;
ssl_session_cache shared:SSL:50m;
ssl_session_timeout 5m;
ssl_stapling on;
ssl_stapling_verify on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
ssl_dhparam /etc/nginx/dhparams.pem;
ssl_prefer_server_ciphers on;
root /var/www/html/static.simponic.xyz;
location / {
try_files $uri $uri/ $uri.html =404;
}
}