updated to add ssl (not tested)

roles/nginx-proxy/tasks/main.yml

@@ -1,41 +1,62 @@
-- name: Install Nginx
-  package:
-    name: nginx
-    state: present
-
-- name: Create web root for landing page
+- name: Ensure web root exists (for ACME)
   file:
-    path: "{{ nginx_webroot }}"
+    path: "/var/www/{{ matrix_domain }}"
     state: directory
     mode: '0755'
 
-- name: Deploy landing page HTML
+- name: Copy compiled site to host (for volume mount)
   copy:
-    content: |
-      <!DOCTYPE html>
-      <html>
-      <head><title>Welcome</title></head>
-      <body>
-        <h1>Welcome to Matrix!</h1>
-        <p>Visit <a href="/_matrix">Matrix</a></p>
-      </body>
-      </html>
-    dest: "{{ nginx_webroot }}/index.html"
+    src: "files/mysite/"
+    dest: "{{ nginx_webroot }}/mysite/"
     mode: '0644'
+  vars:
+    nginx_webroot: "/var/lib/matrix-nginx"
 
-- name: Deploy Nginx config
-  template:
-    src: nginx/default.conf.j2
-    dest: "/etc/nginx/conf.d/{{ matrix_domain }}.conf"
-    mode: '0644'
-
-- name: Remove default config (optional)
+- name: Ensure nginx data dir exists
   file:
-    path: "/etc/nginx/conf.d/default.conf"
-    state: absent
+    path: "{{ item }}"
+    state: directory
+    mode: '0755'
+  loop:
+    - "/var/lib/matrix-nginx"
+    - "/var/lib/matrix-nginx/certbot"
 
-- name: Restart & enable Nginx
-  service:
-    name: nginx
-    state: restarted
-    enabled: yes
+- name: Create custom Nginx image (if missing)
+  command: >
+    podman build
+    -f "{{ role_path }}/templates/Dockerfile-nginx-certbot.j2"
+    -t nginx-matrix:latest
+    "{{ role_path }}/templates/"
+  args:
+    creates: /var/lib/containers/storage/overlay-images/... # (use container_exists check instead)
+  register: build_result
+  changed_when: false
+
+- name: Create Podman pod
+  command: >
+    podman pod create
+    --name {{ podman_pod_name }}
+    --publish 80:80
+    --publish 443:443
+    --publish 8008:8008
+    --publish 8448:8448
+  changed_when: false
+
+- name: Run Nginx container (with TLS & site)
+  container:
+    name: nginx-matrix
+    image: nginx-matrix:latest
+    state: started
+    restart_policy: unless-stopped
+    pod: "{{ podman_pod_name }}"
+    volumes:
+      - "/var/lib/matrix-nginx/mysite:/usr/share/nginx/html/mysite:ro"
+      - "/var/lib/matrix-nginx/certbot:/etc/letsencrypt"
+    env:
+      NGINX_HOST: "{{ matrix_domain }}"
+    security_opt:
+      - label: disable  # if rootless: disable SELinux
+  register: nginx_cont
+
+- name: Run Synapse (PostgreSQL & all)
+  # ... (existing synapse task from before)