feat: initial commit

roles/podman_nginx/defaults/main.yml

@@ -0,0 +1,6 @@
+---
+podman_nginx_additional_hostnames: []
+podman_nginx_certbot_testing: false
+# podman_nginx_frontend_network:
+podman_nginx_podman_rootless_user: nginx
+# podman_nginx_primary_hostname:

roles/podman_nginx/handlers/main.yml

@@ -0,0 +1,18 @@
+---
+- name: restart certbot-renew
+  ansible.builtin.systemd_service:
+    name: certbot-renew
+    state: started
+    scope: user
+    daemon_reload: true
+  become: true
+  become_user: "{{ podman_nginx_podman_rootless_user }}"
+
+- name: restart nginx
+  ansible.builtin.systemd_service:
+    name: nginx
+    state: restarted
+    scope: user
+    daemon_reload: true
+  become: true
+  become_user: "{{ podman_nginx_podman_rootless_user }}"

roles/podman_nginx/tasks/main.yml

@@ -0,0 +1,110 @@
+---
+- name: create service configuration directories
+  ansible.builtin.file:
+    path: "/home/{{ podman_nginx_podman_rootless_user }}/{{ item }}"
+    state: directory
+    owner: "{{ podman_nginx_podman_rootless_user }}"
+    group: "{{ podman_nginx_podman_rootless_user }}"
+    mode: "0755"
+  become: true
+  with_items:
+    - .config/systemd/user
+    - certbot/conf
+    - certbot/www
+    - nginx
+
+- name: install podman quadlet for rootless podman user
+  ansible.builtin.template:
+    src: "{{ item }}"
+    dest: "/home/{{ podman_nginx_podman_rootless_user }}/.config/containers/systemd/{{ item }}"
+    owner: "{{ podman_nginx_podman_rootless_user }}"
+    mode: "0400"
+  with_items:
+    - certbot-renew.container
+    - nginx.container
+  notify:
+    - "restart {{ item | split('.') | first }}"
+  become: true
+
+- name: install certbot renewal timer for rootless podman user
+  ansible.builtin.template:
+    src: "certbot-renew.timer"
+    dest: "/home/{{ podman_nginx_podman_rootless_user }}/.config/systemd/user/certbot-renew.timer"
+    owner: "{{ podman_nginx_podman_rootless_user }}"
+    mode: "0400"
+  become: true
+
+- name: verify quadlets are correctly defined
+  ansible.builtin.command: /usr/libexec/podman/quadlet -dryrun -user
+  register: podman_nginx_quadlet_result
+  ignore_errors: true
+  changed_when: false
+  become: true
+  become_user: "{{ podman_nginx_podman_rootless_user }}"
+
+- name: check if certificate exists
+  stat:
+    path: "/home/{{ podman_nginx_podman_rootless_user }}/certbot/conf/live/{{ podman_nginx_primary_hostname }}/fullchain.pem"
+  register: podman_nginx_cert_stat
+  become: yes
+  become_user: "{{ podman_nginx_podman_rootless_user }}"
+
+- name: create temporary nginx configuration (no https)
+  ansible.builtin.template:
+    src: nginx.conf
+    dest: "/home/{{ podman_nginx_podman_rootless_user }}/nginx/nginx.conf"
+    owner: "{{ podman_nginx_podman_rootless_user }}"
+    group: "{{ podman_nginx_podman_rootless_user }}"
+    mode: "0644"
+  become: true
+  when: podman_nginx_cert_stat.stat.exists == false
+
+- name: start nginx
+  ansible.builtin.systemd_service:
+    name: nginx
+    state: started
+    scope: user
+    daemon_reload: true
+  become: true
+  become_user: "{{ podman_nginx_podman_rootless_user }}"
+
+- name: run certbot container to create certificate
+  ansible.builtin.command:
+    cmd: >
+      podman run --name certbot-generate
+      --rm
+      --volume /home/{{ podman_nginx_podman_rootless_user }}/certbot/www:/var/www/certbot:rw
+      --volume /home/{{ podman_nginx_podman_rootless_user }}/certbot/conf:/etc/letsencrypt:rw
+      docker.io/certbot/certbot:latest
+      certonly
+      --register-unsafely-without-email
+      --agree-tos
+      --webroot
+      --webroot-path /var/www/certbot/
+      -d "{{ podman_nginx_primary_hostname }}"
+      {% for hostname in podman_nginx_additional_hostnames %} -d "{{ hostname }}"{% endfor %}
+      {% if podman_nginx_certbot_testing %} --test-cert{% endif %}
+  when: podman_nginx_cert_stat.stat.exists == false
+  become: yes
+  become_user: "{{ podman_nginx_podman_rootless_user }}"
+
+- name: check if certificate exists
+  stat:
+    path: "/home/{{ podman_nginx_podman_rootless_user }}/certbot/conf/live/{{ podman_nginx_primary_hostname }}/fullchain.pem"
+  register: podman_nginx_cert_stat
+  become: yes
+  become_user: "{{ podman_nginx_podman_rootless_user }}"
+
+- name: ensure certificate exists now
+  ansible.builtin.assert:
+    that:
+      - podman_nginx_cert_stat.stat.exists
+    fail_msg: "Failed to get a Lets Encrypt certificate."
+
+- name: start certbot renewal timer
+  ansible.builtin.systemd_service:
+    name: "certbot-renew.timer"
+    state: started
+    scope: user
+  become: true
+  become_user: "{{ podman_nginx_podman_rootless_user }}"

roles/podman_nginx/templates/certbot-renew.container

@@ -0,0 +1,13 @@
+[Unit]
+Description=Run certbot renew
+
+[Container]
+AutoUpdate=registry
+ContainerName=certbot-renew
+Exec=renew
+Image=docker.io/certbot/certbot:latest
+Volume=/home/{{ podman_nginx_podman_rootless_user }}/certbot/www:/var/www/certbot
+Volume=/home/{{ podman_nginx_podman_rootless_user }}/certbot/conf:/etc/letsencrypt
+
+[Service]
+Restart=no

roles/podman_nginx/templates/certbot-renew.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=Timer for certbot renewals
+
+[Timer]
+OnCalendar=daily
+Persistent=true
+
+[Install]
+WantedBy=timers.target

roles/podman_nginx/templates/nginx.conf

@@ -0,0 +1,17 @@
+# {{ ansible_managed }}
+
+server {
+    listen 80;
+    listen [::]:80;
+
+    server_name {{ podman_nginx_primary_hostname }};
+    server_tokens off;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    location / {
+        return 301 https://{{ podman_nginx_primary_hostname }}$request_uri;
+    }
+}

roles/podman_nginx/templates/nginx.container

@@ -0,0 +1,16 @@
+[Container]
+ContainerName=nginx
+Image=docker.io/nginx:latest
+{% if podman_nginx_frontend_network is defined %}Network={{ podman_nginx_frontend_network }}.network{% endif +%}
+PublishPort=80:80
+PublishPort=443:443
+Volume=/home/{{ podman_nginx_podman_rootless_user }}/certbot/www:/var/www/certbot/:ro
+Volume=/home/{{ podman_nginx_podman_rootless_user }}/certbot/conf/:/etc/letsencrypt/:ro
+Volume=/home/{{ podman_nginx_podman_rootless_user }}/nginx:/etc/nginx/conf.d/:ro
+
+[Service]
+RuntimeMaxSec=604800
+Restart=always
+
+[Install]
+WantedBy=default.target