add nginx role

group_vars/nginx.yml

@@ -0,0 +1,3 @@
+---
+
+dh_params_src: https://ssl-config.mozilla.org/ffdhe2048.txt

inventory

@@ -9,3 +9,6 @@ fern.hatecomputers.club  ansible_user=root ansible_connection=ssh
 
 [kanidm]
 fern.hatecomputers.club  ansible_user=root ansible_connection=ssh
+
+[nginx]
+fern.hatecomputers.club  ansible_user=root ansible_connection=ssh

playbooks/deploy-nginx.yml

@@ -0,0 +1,6 @@
+---
+
+- name: Nginx setup
+  hosts: nginx
+  roles:
+    - nginx

playbooks/roles/nginx/files/nginx.conf

@@ -0,0 +1,26 @@
+user www-data;
+worker_processes 4;
+pid /run/nginx.pid;
+
+events {
+  worker_connections 768;
+}
+
+http {
+  sendfile on;
+  tcp_nopush on;
+  tcp_nodelay on;
+  keepalive_timeout 65;
+  types_hash_max_size 2048;
+  include /etc/nginx/mime.types;
+  default_type application/octet-stream;
+
+  access_log /var/log/nginx/access.log;
+  error_log /var/log/nginx/error.log;
+
+  gzip on;
+  gzip_disable "msie6";
+
+  include /etc/nginx/conf.d/*.conf;
+  include /etc/nginx/sites-enabled/*;
+}

playbooks/roles/nginx/handlers/main.yml

@@ -0,0 +1,12 @@
+---
+
+- name: Restart nginx
+  ansible.builtin.service:
+    name: nginx
+    state: restarted
+    enabled: true
+
+- name: Restart ufw
+  ansible.builtin.service:
+    name: ufw
+    state: restarted

playbooks/roles/nginx/tasks/main.yml

@@ -0,0 +1,44 @@
+---
+
+- name: Allow http
+  community.general.ufw:
+    rule: allow
+    port: '80'
+    proto: tcp
+
+- name: Allow https
+  community.general.ufw:
+    rule: allow
+    port: '443'
+    proto: tcp
+  notify:
+    - Restart ufw
+
+- name: Install nginx
+  ansible.builtin.apt:
+    name: nginx
+    state: present
+  notify:
+    - Restart nginx
+
+- name: Download dhparams
+  ansible.builtin.get_url:
+    url: "{{ dh_params_src }}"
+    dest: /etc/nginx/dhparams.pem
+    mode: '0755'
+
+- name: Add system nginx config
+  ansible.builtin.copy:
+    src: nginx.conf
+    dest: /etc/nginx/nginx.conf
+    mode: '0755'
+
+- name: Copy nginx sites
+  ansible.builtin.template:
+    src: "{{ item }}"
+    dest: "/etc/nginx/sites-enabled/"
+    mode: '0755'
+  with_fileglob:
+    - "templates/{{ inventory_hostname }}/*.conf"
+  notify:
+    - Restart nginx

playbooks/roles/nginx/templates/fern.hatecomputers.club/http.auth.hatecomputers.club.conf

@@ -0,0 +1,8 @@
+server {
+  listen 80;
+  server_name auth.hatecomputers.club;
+
+  location / {
+    rewrite ^ https://auth.hatecomputers.club$request_uri? permanent;
+  }
+}

playbooks/roles/nginx/templates/fern.hatecomputers.club/https.auth.hatecomputers.club.conf

@@ -0,0 +1,23 @@
+server {
+  server_name auth.hatecomputers.club;
+  listen 443 ssl;
+
+  ssl_dhparam /etc/nginx/dhparams.pem;
+  
+  ssl_session_timeout 1d;
+  ssl_session_tickets off;
+  ssl_protocols TLSv1.2 TLSv1.3;
+  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
+  ssl_prefer_server_ciphers off;
+
+  ssl_certificate /etc/letsencrypt/live/auth.hatecomputers.club/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/auth.hatecomputers.club/privkey.pem;
+
+  location / {
+    proxy_pass         https://localhost:8443;
+    proxy_redirect     off;
+    proxy_set_header   X-Real-IP $remote_addr;
+    proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header   X-Forwarded-Host $server_name;
+  }
+}