fix(role): replaces ansible.builtin.fetch with ansible.posix.synchronize to pull the directory

inventory/hosts.yaml

@@ -39,3 +39,11 @@ all:
           ansible_become_password: "{{ ansible_become_passwd }}"
           services_to_run:
             - coder_ai
+    web-servers:
+      hosts:
+        cert-proxy:
+          ansible_host: 192.168.0.47
+          ansible_become_password: "{{ ansible_become_passwd }}"
+        monitoring:
+          ansible_host: 192.168.0.49
+          ansible_become_password: "{{ ansible_become_passwd }}"

playbooks/maintain.yaml

@@ -1,5 +1,5 @@
 ---
-- name: Deploy and set up an LXC container in Proxmox
+- name: Perform regular maintenance
   hosts: virtual
   remote_user: ansible
   
@@ -20,3 +20,14 @@
     - ../roles/update_configs
     # Make sure that the services that are supposed to run are running
     - ../roles/check_services
+
+- name: Ensure all web-servers have fresh TLS certificates
+  hosts: web-servers
+  remote_user: ansible
+  
+  vars_files:
+    ../inventory/group_vars/all/secrets.yaml
+  
+  roles:
+    # Pull certificates from cert_proxy and distribute them among the servers
+    - ../roles/update_certificates

roles/human_admin_user/files/ssh_config

@@ -5,11 +5,11 @@
 # They must to be copied manually ONLY to those hosts that need access to others
 
 # Most of the home major LAN hosts should be accessible with this key
-Match Host 192.168.0.?
+Match 192.168.0.0/24
      User     max
      IdentityFile       ~/.ssh/max_regular_key
 
 # This virtual network has the same hosts range
-Match Host 10.9.2.?
+Match 10.9.2.0/24
      User     max
      IdentityFile       ~/.ssh/max_regular_key

roles/install_nginx/files/nginx/.htpasswd

@@ -1 +0,0 @@
-max:$apr1$NPIFdkB/$hya7NW2rdTGEKBDm0PH3g0

roles/install_nginx/files/nginx/.htpasswd_old

@@ -1 +0,0 @@
-max:$apr1$/3oBTCwW$u9OMKSD56v8czs5rZ0rDp0

roles/install_nginx/files/nginx/fastcgi.conf

@@ -1,27 +0,0 @@
-
-fastcgi_param  SCRIPT_FILENAME    $document_root$fastcgi_script_name;
-fastcgi_param  QUERY_STRING       $query_string;
-fastcgi_param  REQUEST_METHOD     $request_method;
-fastcgi_param  CONTENT_TYPE       $content_type;
-fastcgi_param  CONTENT_LENGTH     $content_length;
-
-fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
-fastcgi_param  REQUEST_URI        $request_uri;
-fastcgi_param  DOCUMENT_URI       $document_uri;
-fastcgi_param  DOCUMENT_ROOT      $document_root;
-fastcgi_param  SERVER_PROTOCOL    $server_protocol;
-fastcgi_param  REQUEST_SCHEME     $scheme;
-fastcgi_param  HTTPS              $https if_not_empty;
-
-fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
-fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;
-
-fastcgi_param  REMOTE_ADDR        $remote_addr;
-fastcgi_param  REMOTE_PORT        $remote_port;
-fastcgi_param  REMOTE_USER        $remote_user;
-fastcgi_param  SERVER_ADDR        $server_addr;
-fastcgi_param  SERVER_PORT        $server_port;
-fastcgi_param  SERVER_NAME        $server_name;
-
-# PHP only, required if PHP was built with --enable-force-cgi-redirect
-fastcgi_param  REDIRECT_STATUS    200;

roles/install_nginx/files/nginx/fastcgi_params

@@ -1,57 +0,0 @@
-
-fastcgi_param  QUERY_STRING       $query_string;
-fastcgi_param  REQUEST_METHOD     $request_method;
-fastcgi_param  CONTENT_TYPE       $content_type;
-fastcgi_param  CONTENT_LENGTH     $content_length;
-
-fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
-fastcgi_param  REQUEST_URI        $request_uri;
-fastcgi_param  DOCUMENT_URI       $document_uri;
-fastcgi_param  DOCUMENT_ROOT      $document_root;
-fastcgi_param  SERVER_PROTOCOL    $server_protocol;
-fastcgi_param  REQUEST_SCHEME     $scheme;
-fastcgi_param  HTTPS              $https if_not_empty;
-
-fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
-fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;
-
-fastcgi_param  REMOTE_ADDR        $remote_addr;
-fastcgi_param  REMOTE_PORT        $remote_port;
-fastcgi_param  REMOTE_USER        $remote_user;
-fastcgi_param  SERVER_ADDR        $server_addr;
-fastcgi_param  SERVER_PORT        $server_port;
-fastcgi_param  SERVER_NAME        $server_name;
-
-# PHP only, required if PHP was built with --enable-force-cgi-redirect
-fastcgi_param  REDIRECT_STATUS    200;
-
-# !!! Security workaround !!!
-# Do not use HTTP_HOST as "$http_host".
-#
-# "$http_host" is the Host header exactly as supplied by the client.
-# This is unsafe when a client sends an absolute-form request target together
-# with a different Host header, for example:
-#
-#     GET https://example.com/ HTTP/1.1
-#     Host: malformedhost
-#
-# In such a case, passing "$http_host" upstream exposes the raw client-supplied
-# Host value ("malformedhost") to the backend application, even though it does
-# not match the effective request target. Applications often use HTTP_HOST for
-# redirects, absolute URL generation, virtual host routing, or security checks;
-# forwarding the raw Host header can therefore lead to incorrect or unsafe
-# behaviour.
-#
-# Newer nginx versions (since 1.30.0) introduce variables "$is_request_port" and
-# "$request_port", allowing HTTP_HOST to be constructed as:
-#     $host$is_request_port$request_port
-#
-# In stable/oldstable packages we use "$host" as a security workaround.
-# It avoids forwarding an untrusted raw Host header to the backend.
-#
-# Note: this changes behaviour compared to previous versions, because "$host"
-# does not preserve the client-supplied port, while "$http_host" typically
-# does. Existing deployments that rely on "$http_host" containing a port number
-# may therefore break or behave differently after this change.
-
-fastcgi_param  HTTP_HOST        $host;

roles/install_nginx/files/nginx/mime.types

@@ -1,101 +0,0 @@
-types {
-    text/html                                        html htm shtml;
-    text/css                                         css;
-    text/xml                                         xml;
-    image/gif                                        gif;
-    image/jpeg                                       jpeg jpg;
-    application/javascript                           js;
-    application/atom+xml                             atom;
-    application/rss+xml                              rss;
-
-    text/mathml                                      mml;
-    text/plain                                       txt;
-    text/vnd.sun.j2me.app-descriptor                 jad;
-    text/vnd.wap.wml                                 wml;
-    text/x-component                                 htc;
-
-    image/avif                                       avif;
-    image/png                                        png;
-    image/svg+xml                                    svg svgz;
-    image/tiff                                       tif tiff;
-    image/vnd.wap.wbmp                               wbmp;
-    image/webp                                       webp;
-    image/x-icon                                     ico;
-    image/x-jng                                      jng;
-    image/x-ms-bmp                                   bmp;
-
-    font/woff                                        woff;
-    font/woff2                                       woff2;
-
-    application/java-archive                         jar war ear;
-    application/json                                 json;
-    application/mac-binhex40                         hqx;
-    application/msword                               doc;
-    application/pdf                                  pdf;
-    application/postscript                           ps eps ai;
-    application/rtf                                  rtf;
-    application/vnd.apple.mpegurl                    m3u8;
-    application/vnd.google-earth.kml+xml             kml;
-    application/vnd.google-earth.kmz                 kmz;
-    application/vnd.ms-excel                         xls;
-    application/vnd.ms-fontobject                    eot;
-    application/vnd.ms-powerpoint                    ppt;
-    application/vnd.oasis.opendocument.graphics      odg;
-    application/vnd.oasis.opendocument.presentation  odp;
-    application/vnd.oasis.opendocument.spreadsheet   ods;
-    application/vnd.oasis.opendocument.text          odt;
-    application/vnd.openxmlformats-officedocument.presentationml.presentation
-                                                     pptx;
-    application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
-                                                     xlsx;
-    application/vnd.openxmlformats-officedocument.wordprocessingml.document
-                                                     docx;
-    application/vnd.wap.wmlc                         wmlc;
-    application/wasm                                 wasm;
-    application/x-7z-compressed                      7z;
-    application/x-cocoa                              cco;
-    application/x-java-archive-diff                  jardiff;
-    application/x-java-jnlp-file                     jnlp;
-    application/x-makeself                           run;
-    application/x-perl                               pl pm;
-    application/x-pilot                              prc pdb;
-    application/x-rar-compressed                     rar;
-    application/x-redhat-package-manager             rpm;
-    application/x-sea                                sea;
-    application/x-shockwave-flash                    swf;
-    application/x-stuffit                            sit;
-    application/x-tcl                                tcl tk;
-    application/x-x509-ca-cert                       der pem crt;
-    application/x-xpinstall                          xpi;
-    application/xhtml+xml                            xhtml;
-    application/xslt+xml                             xsl xslt;
-    application/xspf+xml                             xspf;
-    application/zip                                  zip;
-
-    application/octet-stream                         bin exe dll;
-    application/octet-stream                         deb;
-    application/octet-stream                         dmg;
-    application/octet-stream                         iso img;
-    application/octet-stream                         msi msp msm;
-
-    audio/midi                                       mid midi kar;
-    audio/mpeg                                       mp3;
-    audio/ogg                                        ogg;
-    audio/x-m4a                                      m4a;
-    audio/x-realaudio                                ra;
-
-    video/3gpp                                       3gpp 3gp;
-    video/mp2t                                       ts;
-    video/mp4                                        mp4;
-    video/mpeg                                       mpeg mpg;
-    video/ogg                                        ogv;
-    video/quicktime                                  mov;
-    video/webm                                       webm;
-    video/x-flv                                      flv;
-    video/x-m4v                                      m4v;
-    video/x-matroska                                 mkv;
-    video/x-mng                                      mng;
-    video/x-ms-asf                                   asx asf;
-    video/x-ms-wmv                                   wmv;
-    video/x-msvideo                                  avi;
-}

roles/install_nginx/files/nginx/modules-enabled/50-mod-http-auth-pam.conf

@@ -1 +0,0 @@
-/usr/share/nginx/modules-available/mod-http-auth-pam.conf

roles/install_nginx/files/nginx/modules-enabled/50-mod-http-dav-ext.conf

@@ -1 +0,0 @@
-/usr/share/nginx/modules-available/mod-http-dav-ext.conf

roles/install_nginx/files/nginx/modules-enabled/50-mod-http-echo.conf

@@ -1 +0,0 @@
-/usr/share/nginx/modules-available/mod-http-echo.conf

roles/install_nginx/files/nginx/modules-enabled/50-mod-http-geoip2.conf

@@ -1 +0,0 @@
-/usr/share/nginx/modules-available/mod-http-geoip2.conf

roles/install_nginx/files/nginx/modules-enabled/50-mod-http-subs-filter.conf

@@ -1 +0,0 @@
-/usr/share/nginx/modules-available/mod-http-subs-filter.conf

roles/install_nginx/files/nginx/modules-enabled/50-mod-http-upstream-fair.conf

@@ -1 +0,0 @@
-/usr/share/nginx/modules-available/mod-http-upstream-fair.conf

roles/install_nginx/files/nginx/modules-enabled/50-mod-stream.conf

@@ -1 +0,0 @@
-/usr/share/nginx/modules-available/mod-stream.conf

roles/install_nginx/files/nginx/modules-enabled/70-mod-stream-geoip2.conf

@@ -1 +0,0 @@
-/usr/share/nginx/modules-available/mod-stream-geoip2.conf

roles/install_nginx/files/nginx/nginx.conf

@@ -1,24 +0,0 @@
-user www-data;
-worker_processes auto;
-pid /run/nginx.pid;
-error_log /var/log/nginx/error.log;
-include /etc/nginx/modules-enabled/*.conf;
-
-
-events {
-	worker_connections 768;
-}
-
-http {
-  log_format main '$remote_addr - $remote_user [$time_local] "$request" '
-                        '$status $body_bytes_sent "$http_referer" '
-                        '"$http_user_agent"';
-  include /etc/nginx/conf.d/*.conf;
-  
-  # Hide NGINX version from responses
-  server_tokens off;
-  # Use modern TLS protocols only
-  ssl_protocols TLSv1.2 TLSv1.3;
-  ssl_prefer_server_ciphers on;
-  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
-}

roles/install_nginx/files/nginx/proxy_params

@@ -1,33 +0,0 @@
-# !!! Security workaround !!!
-# Do not set the `Host` header as "$http_host".
-#
-# "$http_host" is the Host header exactly as supplied by the client.
-# This is unsafe when a client sends an absolute-form request target together
-# with a different Host header, for example:
-#
-#     GET https://example.com/ HTTP/1.1
-#     Host: malformedhost
-#
-# In such a case, passing "$http_host" upstream exposes the raw client-supplied
-# Host value ("malformedhost") to the backend application, even though it does
-# not match the effective request target. Applications often use HTTP_HOST for
-# redirects, absolute URL generation, virtual host routing, or security checks;
-# forwarding the raw Host header can therefore lead to incorrect or unsafe
-# behaviour.
-#
-# Newer nginx versions (since 1.30.0) introduce variables "$is_request_port" and
-# "$request_port", allowing `Host` to be constructed as:
-#     $host$is_request_port$request_port
-#
-# In stable/oldstable packages we use "$host" as a security workaround.
-# It avoids forwarding an untrusted raw Host header to the backend.
-#
-# Note: this changes behaviour compared to previous versions, because "$host"
-# does not preserve the client-supplied port, while "$http_host" typically
-# does. Existing deployments that rely on "$http_host" containing a port number
-# may therefore break or behave differently after this change.
-
-proxy_set_header Host $host;
-proxy_set_header X-Real-IP $remote_addr;
-proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-proxy_set_header X-Forwarded-Proto $scheme;

roles/install_nginx/files/nginx/snippets/error_pages.conf

@@ -1 +0,0 @@
-/srv/http/default/snippets/error_pages.conf

roles/install_nginx/files/nginx/snippets/error_pages_content.conf

@@ -1 +0,0 @@
-/srv/http/default/snippets/error_pages_content.conf

roles/install_nginx/files/nginx/snippets/fastcgi-php.conf

@@ -1,13 +0,0 @@
-# regex to split $uri to $fastcgi_script_name and $fastcgi_path
-fastcgi_split_path_info ^(.+?\.php)(/.*)$;
-
-# Check that the PHP script exists before passing it
-try_files $fastcgi_script_name =404;
-
-# Bypass the fact that try_files resets $fastcgi_path_info
-# see: http://trac.nginx.org/nginx/ticket/321
-set $path_info $fastcgi_path_info;
-fastcgi_param PATH_INFO $path_info;
-
-fastcgi_index index.php;
-include fastcgi.conf;

roles/install_nginx/tasks/main.yaml

@@ -1,30 +0,0 @@
----
-
-- name: Install NGINX on apt-based systems
-  become: true
-  ansible.builtin.apt:
-    name: nginx
-    state: present
-    update_cache: true
-
-- name: Enable systemd service
-  ansible.builtin.service:
-    name: nginx
-    state: started
-    enabled: true
-
-# We don't want to activate this config right away, so push it after service started
-- name: Configure NGINX, by pushing the config directory
-  become: true
-  ansible.builtin.copy:
-    src: "{{ role_path }}/files/nginx"
-    dst: "/etc/nginx"
-
-- name: Install custom error pages
-  become: true
-  ansible.builtin.shell: |
-    mkdir -p /srv/http/default
-    git clone https://github.com/denysvitali/nginx-error-pages /srv/http/default 
-    ln -s /srv/http/default/snippets/error_pages.conf /etc/nginx/snippets/error_pages.conf
-    ln -s /srv/http/default/snippets/error_pages_content.conf /etc/nginx/snippets/error_pages_content.conf
-

roles/update_certificates/tasks/main.yaml

@@ -0,0 +1,23 @@
+---
+- name: Pull directory from remote host to control node
+  ansible.posix.synchronize:
+    mode: pull
+    src: /tmp/letsencrypt
+    dest: /tmp 
+    recursive: true
+    delete: true
+  when: "inventory_hostname == 'cert-proxy'"
+
+- name: Push loki.vmn.su certificate to the target
+  ansible.builtin.copy:
+    src: /tmp/letsencrypt/live/loki.vmn.su/fullchain.pem
+    dest: /etc/nginx/certs/loki_fullchain.pem
+    local_follow: true
+  when: "inventory_hostname == 'monitoring'"
+
+- name: Push loki.vmn.su key to the target
+  ansible.builtin.copy:
+    src: /tmp/letsencrypt/live/loki.vmn.su/privkey.pem
+    dest: /etc/nginx/certs/loki_privkey.pem
+    local_follow: true
+  when: "inventory_hostname == 'monitoring'"