webserver.yaml

---
- name: Install nginx
  hosts: web

  roles:
  # This role also installs certbot
  - hispanico.nginx_revproxy

  vars:
    homedir: /srv
    webhook: { user: webhook, name: git.zeusops.com, dest: "{{ homedir }}/webhook/webhook", gh_user: Gehock }
    www_dir: /var/www
    cockpit_origins:
    - https://cockpit.zeusops.com
    # Sites that should be redirected from example.com to www.example.com
    www_redirects:
    - zeusops.com
    sites:
    - gehock.dy.fi
    - gehock.com
    - gehock.fi

    git_sites:
    - { domain: www.zeusops.com, repo: https://github.com/zeusops/zeusops.com.git, version: HEAD }
    - { domain: dev.zeusops.com, repo: https://github.com/zeusops/zeusops.com.git, version: test }

    nginx_revproxy_sites:
      #default:
      #  ssl: false
      #  letsencrypt: false

      git.zeusops.com:
        domains:
          - git.zeusops.com
        upstreams:
          - { backend_address: 127.0.0.1, backend_port: 9000 }
        ssl: true
        letsencrypt: true
        letsencrypt_email: webmaster@zeusops.com
      cockpit.zeusops.com:
        domains:
          - cockpit.zeusops.com
        upstreams:
          #- { backend_address: /run/cockpit/wsinstance/http.sock, backend_port: 8080 }
          - { backend_address: 127.0.0.1, backend_port: 9090 }
        ssl: true
        letsencrypt: true
        letsencrypt_email: webmaster@zeusops.com
      wakapi.gehock.fi:
        domains:
          - wakapi.gehock.fi
        upstreams:
          - { backend_address: 127.0.0.1, backend_port: 3100 }
        ssl: true
        letsencrypt: true
        letsencrypt_email: webmaster@zeusops.com
      aar.zeusops.com:
        domains:
          - aar.zeusops.com
        upstreams:
          - { backend_address: 127.0.0.1, backend_port: 5000 }
        ssl: true
        letsencrypt: true
        letsencrypt_email: webmaster@zeusops.com
      wiki.zeusops.com:
        domains:
          - wiki.zeusops.com
        upstreams:
          - { backend_address: 127.0.0.1, backend_port: 3101 }
        ssl: true
        letsencrypt: true
        letsencrypt_email: webmaster@zeusops.com
    # Without these the revproxy role will remove manually managed sites
    nginx_revproxy_remove_webroot_sites: no
    nginx_revproxy_de_activate_sites: no
    nginx_revproxy_certbot_from_pip: yes
    zeusopscom_redirects:
    - [doc, "https://docs.google.com/document/d/1NKLi_VazqMgpnZYHa6FDOQbZyfqLDPosi4xdOQPgHMU/edit?usp=sharing"]
    - [meeting, "https://docs.google.com/document/d/1Xs4YG8eZ3XTc-lpm8ePSwKNKBgyj_3mM4swr5BNuDmE/edit?tab=t.0#heading=h.qgoz7pdun6ly"]
    - [rules, "https://docs.google.com/document/d/1DWK53LF3AjRqxZkb4qQXeBBvtSIOtamnUXyk2b6aaAs/edit?usp=sharing"]
    - [zeus, "https://docs.google.com/document/d/1PFK__UcgmAJ1P3xBnJxeW2ow7u8bgEfM8lkpHJrLYDU/edit?usp=sharing"]
    - [template, "https://github.com/zeusops/mission-templates"]
    - [discord, "https://discord.gg/UAgPN7j"]
    - [units, "https://units.arma3.com/unit/zeusops"]
    - [attendance, "https://docs.google.com/spreadsheets/d/1obK3_FU5yMzhBgFLmk3g0v5dn5wFqT30RQXHWCAccCQ/edit"]
    - [allattendance, "/all"]
    - [all, "https://docs.google.com/spreadsheets/d/1Blc0MwWPSgKfWQ1KruEhxQ8T-z3Ig1Y0RqDh_ntCWZo/edit"]
    - [mod, "https://steamcommunity.com/sharedfiles/filedetails/?id=2168912301"]
    - [mods, "https://steamcommunity.com/sharedfiles/filedetails/?id=754233724"]
    - [optional, "/optionals"]
    - [optionals, "https://steamcommunity.com/sharedfiles/filedetails/?id=1115077330"]
    - [jointop, "https://steamcommunity.com/sharedfiles/filedetails/?id=1312402629"]
    - [terrains, "https://steamcommunity.com/sharedfiles/filedetails/?id=1424089214"]
    - [overhaul, "https://steamcommunity.com/sharedfiles/filedetails/?id=2879803157"]
    - [tsplugin, "/plugin"]
    - [tsplugins, "/plugin"]
    - [plugins, "/plugin"]
    - [plugin, "https://i.imgur.com/FY05Lvn.jpg"]
    - [feedback, "https://docs.google.com/forms/d/e/1FAIpQLSd_CUC9Bi8pelnJLtK4dKxLyWqHkO_LH8z4MIuCli1JUm0jdQ/viewform"]
    - [zeusresponses, "https://docs.google.com/spreadsheets/d/1unjBeQx2X6PGKvs80JztFBKpp-uFj-bRx7d6egaqvl8/edit"]
    - [watch, "https://w2g.tv/rooms/zeusoperations-p7wbtfre05cwi65s"]
    - [anniversary, "https://docs.google.com/spreadsheets/d/1UXULpdp5zB83E72JDGmGrBpNOhtkFkNPoreqh0H8og8/edit#gid=1299351339"]
    - [points, "https://banner.zeusops.com/image/"]
    - [co, "https://hackmd.io/@zeusops/HJ3oAiiQ1l"]
    - [meetings, "https://hackmd.io/@zeusops/B1lXuftfu"]
    - [review, "https://docs.google.com/forms/d/e/1FAIpQLSfWY53jmyAKsOg12LZw4AqdL40IBynUJBp2I7du7BsmJX4yfQ/viewform"]
    - [reviewresponses, "https://docs.google.com/spreadsheets/d/1_c2tc22Udwf2Nl-AOQD_qnwGFlULoLnLP7hx8Fns-ZE/edit"]
    - [hqfeedback, "https://docs.google.com/forms/d/e/1FAIpQLSe8vSltxZALqHYp1AJIr8F45KgHQ6B_qLVijv8eaG_EEQ7BLA/viewform"]
    - [hqresponses, "https://docs.google.com/spreadsheets/d/1BtosRxvotFQJfGNPnw_WuZENEpXtKBhx1v8DXLys25o/edit"]
    - [github, "https://github.com/zeusops"]
    - [coinfo, "https://docs.google.com/document/d/1mYguW7eceldh_mXQreNOOEHtThQ3GCRow4VyzqvrU6c/edit"]
    hetzner_dns_token: !vault |
      $ANSIBLE_VAULT;1.1;AES256
      64646431616139336435373932326636353537613739363137393139383164663961633465633630
      6566366561323164626636653739313131613636346335620a393736653631643737393331623263
      35323336313834643632383065656439663531306136303939656663366262653363623561613637
      6236653933373034640a336434633436343363393634623966333963376537636165393163363333
      64616162363362323133613364363738626136393734383461356138393930663364373838633763
      6565346233303634663866626564316262323061363839366263
    wildcard_site_domain: zeusops.com


  tasks:
  # === General ===
  - name: Remove apache
    ansible.builtin.apt:
      name: apache2
      state: absent
  - name: Install nginx
    ansible.builtin.apt:
      name: nginx
      update_cache: true
  - name: Allow nginx through the firewall
    community.general.ufw:
      rule: allow
      name: Nginx Full

  # === Webhook ===
  - name: Webhook setup
    block:
    - name: Create user
      ansible.builtin.user:
        name: "{{ webhook.user }}"
        system: yes
        home: "{{ homedir }}/{{ webhook.user }}"
    - name: Create SSH directory
      become: yes
      become_user: "{{ webhook.user }}"
      ansible.builtin.file:
        path: "{{ homedir }}/{{ webhook.user }}/.ssh"
        state: directory
    - name: Install SSH dependency
      ansible.builtin.pip:
        name: stormssh
    - name: Generate SSH deploy key
      become: yes
      become_user: "{{ webhook.user }}"
      community.crypto.openssh_keypair:
        type: ed25519
        path: "{{ homedir }}/{{ webhook.user }}/.ssh/{{ webhook.name }}_deploy_key"
        comment: "{{ webhook.user }}@{{ ansible_hostname }}#{{ webhook.name }}"
      # TODO: make sshkey parser support a single item below
      loop: [1]
      register: sshkey
    - name: Print key
      when: sshkey.changed
      # TODO: format this in a more beautiful way
      debug:
        #msg: "{{ sshkey | json_query('results[*].[public_key, comment]') }}"
        msg: "SSH key: {{ item }}"
      loop: "{{ sshkey | json_query('results[*].[public_key, comment]') | json_query(\"[*].join(' ', @)\")  }}"
      loop_control:
        label: 'key'
    - name: Prompt to add deploy key
      when: sshkey.changed
      ansible.builtin.pause:
        prompt: "add the above keys to GitHub before continuing"

    - name: Create SSH config
      become: yes
      become_user: "{{ webhook.user }}"
      community.general.ssh_config:
        user: "{{ webhook.user }}"
        host: "github.com-{{ webhook.name }}"
        hostname: github.com
        identity_file: "{{ homedir }}/{{ webhook.user }}/.ssh/{{ webhook.name }}_deploy_key"

    - name: Clone repo
      become: yes
      become_user: "{{ webhook.user }}"
      ansible.builtin.git:
        repo: "git@github.com-{{ webhook.name }}:{{ webhook.gh_user | d('zeusops') }}/{{ webhook.name }}.git"
        dest: "{{ webhook.dest }}"
        accept_newhostkey: yes
        # Submodules are cloned manually because we want to set the SSH remote
        # address instead of HTTPS
        #recursive: no

    - name: Check if unit file exists
      ansible.builtin.stat:
        path: "/etc/systemd/system/{{ webhook.user }}.service"
      register: service
    - name: Fetch template
      run_once: yes
      ansible.builtin.fetch:
        src: "{{ webhook.dest }}/systemd/webhook.service.j2"
        dest: /tmp/webhook.service.j2
        flat: yes
      when: not service.stat.exists
    - name: Create systemd service
      ansible.builtin.template:
        src: /tmp/webhook.service.j2
        dest: "/etc/systemd/system/{{ webhook.user }}.service"
      vars:
        dir: "{{ webhook.dest }}"
      notify:
      - Reload systemd
      when: not service.stat.exists
    - name: Run webhook
      ansible.builtin.systemd:
        state: started
        enabled: yes
        name: "{{ webhook.user }}"

  # === Setup nginx ===

  - name: Remove default site
    ansible.builtin.file:
      path: /etc/nginx/sites-enabled/default
      state: absent

  - name: Copy nginx config
    ansible.builtin.template:
      src: files/nginx/nginx.conf.j2
      dest: /etc/nginx/nginx.conf
    vars:
      ssl_certificate: /etc/letsencrypt/live/{{ wildcard_site_domain }}/fullchain.pem
      ssl_certificate_key: /etc/letsencrypt/live/{{ wildcard_site_domain }}/privkey.pem
    notify:
    - Reload nginx

  # === zeusops.com ===
  - name: Set up sites from git
    block:
    - name: Clone site repo
      ansible.builtin.git:
        repo: "{{ item.repo }}"
        dest: "{{ www_dir }}/{{ item.domain }}"
        version: "{{ item.version }}"
        accept_newhostkey: yes
      loop: "{{ git_sites }}"

    - name: Enable site
      ansible.builtin.file:
        src: /etc/nginx/sites-available/{{ item.domain }}.conf
        dest: /etc/nginx/sites-enabled/{{ item.domain }}.conf
        force: yes
        follow: no
        state: link
      loop: "{{ git_sites }}"

    - name: Copy site config
      ansible.builtin.template:
        src: files/nginx/site.conf.j2
        dest: /etc/nginx/sites-available/{{ server_name }}.conf
      vars:
        server_name: "{{ item.domain }}"
        access_log: /var/log/nginx/{{ server_name }}.log
        error_log: /var/log/nginx/{{ server_name }}.err
        root: "{{ www_dir }}/{{ server_name }}/public"
        redirects: "{{ zeusopscom_redirects }}"
      loop: "{{ git_sites }}"
      notify:
      - Reload nginx

  # === gehock.dy.fi ===

  # NOTE: site data is currently copied manually to /var/www/gehock.dy.fi

  - name: Load local variables
    ansible.builtin.include_vars:
      file: vars/webserver-local.yaml
    when: "'vars/webserver-local.yaml' is file"

  - name: Get site certificates using certbot
    ansible.builtin.command: |
      certbot
      --nginx
      -n
      --agree-tos
      certonly
      -d {{ item }}
      creates=/etc/letsencrypt/live/{{ item }}/fullchain.pem
    loop: "{{ sites + sites_local }}"

  - name: Enable site
    ansible.builtin.file:
      src: /etc/nginx/sites-available/{{ server_name }}.conf
      dest: /etc/nginx/sites-enabled/{{ server_name }}.conf
      force: yes
      follow: no
      state: link
    loop: "{{ sites + sites_local }}"
    loop_control:
      loop_var: server_name

  # NOTE: setup TLS cert
  - name: Copy config
    ansible.builtin.template:
      src: files/nginx/site.conf.j2
      dest: /etc/nginx/sites-available/{{ server_name }}.conf
    vars:
      access_log: /var/log/nginx/{{ server_name }}.log
      error_log: /var/log/nginx/{{ server_name }}.err
      root: "{{ www_dir }}/{{ server_name }}/httpdocs"
      le: yes
    loop: "{{ sites + sites_local }}"
    loop_control:
      loop_var: server_name
    notify:
    - Reload nginx

  # === www redirect ===

  - name: Enable www redirect
    ansible.builtin.file:
      src: /etc/nginx/sites-available/{{ server_name }}.conf
      dest: /etc/nginx/sites-enabled/{{ server_name }}.conf
      force: yes
      follow: no
      state: link
    loop: "{{ www_redirects }}"
    loop_control:
      loop_var: server_name

  - name: Copy config
    ansible.builtin.template:
      src: files/nginx/www-redirect.conf.j2
      dest: /etc/nginx/sites-available/{{ server_name }}.conf
    notify:
    - Reload nginx
    loop: "{{ www_redirects }}"
    loop_control:
      loop_var: server_name

  # === https redirect ===

  - name: Enable default redirect
    ansible.builtin.file:
      src: /etc/nginx/sites-available/000-default.conf
      dest: /etc/nginx/sites-enabled/000-default.conf
      force: yes
      follow: no
      state: link

  - name: Copy config
    ansible.builtin.template:
      src: files/nginx/default.conf.j2
      dest: /etc/nginx/sites-available/000-default.conf
    notify:
    - Reload nginx

  # === cockpit ===
  - name: Create cockpit config
    ansible.builtin.template:
      src: files/cockpit/cockpit.conf.j2
      dest: /etc/cockpit/cockpit.conf

  # === *.zeusops.com certificate ===

  - name: Install certbot-hetzner scripts
    ansible.builtin.get_url:
      url: https://raw.githubusercontent.com/dschoeffm/hetzner-dns-certbot/856049ca8a2e34333a55b5d3d69335eae4f08936/{{ item }}
      dest: /usr/libexec/{{ item }}
      mode: '0755'
    loop:
    - certbot-hetzner-auth.sh
    - certbot-hetzner-cleanup.sh

  - name: Create hetzner DNS token file
    ansible.builtin.copy:
      dest: /etc/hetzner-dns-token
      content: "{{ hetzner_dns_token }}"
      mode: '0600'

  - name: Get wildcard certificate using certbot
    ansible.builtin.command: |
      certbot certonly
      --manual
      --preferred-challenges=dns
      --manual-auth-hook /usr/libexec/certbot-hetzner-auth.sh
      --manual-cleanup-hook /usr/libexec/certbot-hetzner-cleanup.sh
      -d {{ wildcard_site_domain }} -d *.{{ wildcard_site_domain }}
      creates=/etc/letsencrypt/live/{{ wildcard_site_domain }}/fullchain.pem

  # ====== handlers ======
  handlers:
  - name: Reload systemd
    ansible.builtin.systemd:
      daemon_reload: yes
  - name: Reload nginx
    ansible.builtin.service:
      name: nginx
      state: restarted