From 66281c90d33070a9850e72ea1959bfceedc391d8 Mon Sep 17 00:00:00 2001 From: boxswapper Date: Mon, 16 Mar 2026 12:41:49 -0600 Subject: [PATCH] updated to add ssl (not tested) --- group_vars/all.yml | 10 +++ playbook.yml | 12 +-- roles/nginx-proxy/files/mysite/index.html | 0 roles/nginx-proxy/tasks/main.yml | 85 ++++++++++++------- .../templates/Dockerfile-nginx-certbot.j2 | 0 .../templates/certbot-entrypoint.sh | 0 roles/nginx-proxy/templates/default.conf.j2 | 52 +++++++++--- 7 files changed, 107 insertions(+), 52 deletions(-) create mode 100644 roles/nginx-proxy/files/mysite/index.html create mode 100644 roles/nginx-proxy/templates/Dockerfile-nginx-certbot.j2 create mode 100644 roles/nginx-proxy/templates/certbot-entrypoint.sh diff --git a/group_vars/all.yml b/group_vars/all.yml index a9bcce9..b046ca4 100644 --- a/group_vars/all.yml +++ b/group_vars/all.yml @@ -13,3 +13,13 @@ db_name: "synapse" db_user: "synapse" db_pass: "{{ synapse_db_pass | mandatory }}" synapse_db_pass: "supersecretpassword" # use vault for real deployments! + + +matrix_domain: "matrix.example.com" +landing_domain: "example.com" # optional, or use same domain + path-based routing + +# For certbot +certbot_email: "admin@example.com" + +# Static site path +nginx_webroot: "/var/lib/matrix-nginx" \ No newline at end of file diff --git a/playbook.yml b/playbook.yml index 943c581..8655b48 100644 --- a/playbook.yml +++ b/playbook.yml @@ -1,19 +1,19 @@ -- name: Deploy Matrix + Nginx + Landing Page +- name: Deploy Matrix + Nginx + Static Site with TLS hosts: matrix_servers become: yes vars: synapse_db_pass: "{{ vault_synapse_db_pass }}" - synapse_registration_secret: "{{ vault_synapse_registration_secret }}" + certbot_email: "{{ vault_certbot_email | default('admin@example.com') }}" - pre_tasks: - - name: Ensure Podman is installed + tasks: + - name: Setup common dependencies import_role: name: common - - name: Deploy Nginx reverse proxy & landing page + - name: Deploy Nginx + Static Site + TLS (with Certbot) import_role: name: nginx-proxy - - name: Deploy Synapse + - name: Deploy Synapse (PostgreSQL + containers) import_role: name: matrix-synapse diff --git a/roles/nginx-proxy/files/mysite/index.html b/roles/nginx-proxy/files/mysite/index.html new file mode 100644 index 0000000..e69de29 diff --git a/roles/nginx-proxy/tasks/main.yml b/roles/nginx-proxy/tasks/main.yml index 7822a35..2ba4436 100644 --- a/roles/nginx-proxy/tasks/main.yml +++ b/roles/nginx-proxy/tasks/main.yml @@ -1,41 +1,62 @@ -- name: Install Nginx - package: - name: nginx - state: present - -- name: Create web root for landing page +- name: Ensure web root exists (for ACME) file: - path: "{{ nginx_webroot }}" + path: "/var/www/{{ matrix_domain }}" state: directory mode: '0755' -- name: Deploy landing page HTML +- name: Copy compiled site to host (for volume mount) copy: - content: | - - - Welcome - -

Welcome to Matrix!

-

Visit Matrix

- - - dest: "{{ nginx_webroot }}/index.html" + src: "files/mysite/" + dest: "{{ nginx_webroot }}/mysite/" mode: '0644' + vars: + nginx_webroot: "/var/lib/matrix-nginx" -- name: Deploy Nginx config - template: - src: nginx/default.conf.j2 - dest: "/etc/nginx/conf.d/{{ matrix_domain }}.conf" - mode: '0644' - -- name: Remove default config (optional) +- name: Ensure nginx data dir exists file: - path: "/etc/nginx/conf.d/default.conf" - state: absent + path: "{{ item }}" + state: directory + mode: '0755' + loop: + - "/var/lib/matrix-nginx" + - "/var/lib/matrix-nginx/certbot" -- name: Restart & enable Nginx - service: - name: nginx - state: restarted - enabled: yes +- name: Create custom Nginx image (if missing) + command: > + podman build + -f "{{ role_path }}/templates/Dockerfile-nginx-certbot.j2" + -t nginx-matrix:latest + "{{ role_path }}/templates/" + args: + creates: /var/lib/containers/storage/overlay-images/... # (use container_exists check instead) + register: build_result + changed_when: false + +- name: Create Podman pod + command: > + podman pod create + --name {{ podman_pod_name }} + --publish 80:80 + --publish 443:443 + --publish 8008:8008 + --publish 8448:8448 + changed_when: false + +- name: Run Nginx container (with TLS & site) + container: + name: nginx-matrix + image: nginx-matrix:latest + state: started + restart_policy: unless-stopped + pod: "{{ podman_pod_name }}" + volumes: + - "/var/lib/matrix-nginx/mysite:/usr/share/nginx/html/mysite:ro" + - "/var/lib/matrix-nginx/certbot:/etc/letsencrypt" + env: + NGINX_HOST: "{{ matrix_domain }}" + security_opt: + - label: disable # if rootless: disable SELinux + register: nginx_cont + +- name: Run Synapse (PostgreSQL & all) + # ... (existing synapse task from before) diff --git a/roles/nginx-proxy/templates/Dockerfile-nginx-certbot.j2 b/roles/nginx-proxy/templates/Dockerfile-nginx-certbot.j2 new file mode 100644 index 0000000..e69de29 diff --git a/roles/nginx-proxy/templates/certbot-entrypoint.sh b/roles/nginx-proxy/templates/certbot-entrypoint.sh new file mode 100644 index 0000000..e69de29 diff --git a/roles/nginx-proxy/templates/default.conf.j2 b/roles/nginx-proxy/templates/default.conf.j2 index 40fdbe8..00dc23a 100644 --- a/roles/nginx-proxy/templates/default.conf.j2 +++ b/roles/nginx-proxy/templates/default.conf.j2 @@ -1,29 +1,50 @@ -# Landing page (root path) +# Redirect HTTP → HTTPS (except ACME challenges) server { listen 80; - server_name {{ landing_domain }} {{ matrix_domain }}; + server_name {{ matrix_domain }} {{ landing_domain }}; - root {{ nginx_webroot }}; - index index.html; - - location / { - try_files $uri $uri/ =404; + # ACME-challenge (for Let's Encrypt) + location ~ /.well-known/acme-challenge/ { + root /var/www; + try_files $uri =404; } - # Matrix Synapse + location / { + return 301 https://$host$request_uri; + } +} + +# HTTPS server +server { + listen 443 ssl http2; + server_name {{ matrix_domain }}; + + # TLS certs (mounted from Let's Encrypt dir) + ssl_certificate /etc/letsencrypt/live/{{ matrix_domain }}/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/{{ matrix_domain }}/privkey.pem; + ssl_trusted_certificate /etc/letsencrypt/live/{{ matrix_domain }}/chain.pem; + + ssl_session_cache shared:SSL:10m; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers HIGH:!aNULL:!MD5; + + # Serve static site (root) + location / { + root /usr/share/nginx/html/mysite; + try_files $uri $uri/ /index.html; + } + + # Matrix Synapse (client) location /_matrix/ { proxy_pass http://127.0.0.1:8008/_matrix/; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; - proxy_set_header X-Forwarded-Host $host; - proxy_set_header X-Forwarded-Server $host; proxy_buffering off; - proxy_request_buffering off; } - # Federation (port 8448 usually, but often proxied at /_matrix too) + # Federation location /_matrix/federation/v1/ { proxy_pass http://127.0.0.1:8448/_matrix/federation/v1/; proxy_set_header Host $host; @@ -32,5 +53,8 @@ server { proxy_set_header X-Forwarded-Proto $scheme; } - # Optional: Caddy or Let’s Encrypt ACME -} + # Optional: Add a Matrix admin link + location /admin { + return 301 https://matrix-admin.example.com; # or proxy to a UI like SynapseAdmin + } +} \ No newline at end of file