updated to add ssl (not tested)

group_vars/all.yml

@@ -13,3 +13,13 @@ db_name: "synapse"
 db_user: "synapse"
 db_pass: "{{ synapse_db_pass | mandatory }}"
 synapse_db_pass: "supersecretpassword"  # use vault for real deployments!
+
+
+matrix_domain: "matrix.example.com"
+landing_domain: "example.com"  # optional, or use same domain + path-based routing
+
+# For certbot
+certbot_email: "admin@example.com"
+
+# Static site path
+nginx_webroot: "/var/lib/matrix-nginx"

playbook.yml

@@ -1,19 +1,19 @@
-- name: Deploy Matrix + Nginx + Landing Page
+- name: Deploy Matrix + Nginx + Static Site with TLS
   hosts: matrix_servers
   become: yes
   vars:
     synapse_db_pass: "{{ vault_synapse_db_pass }}"
-    synapse_registration_secret: "{{ vault_synapse_registration_secret }}"
+    certbot_email: "{{ vault_certbot_email | default('admin@example.com') }}"
 
-  pre_tasks:
+  tasks:
-    - name: Ensure Podman is installed
+    - name: Setup common dependencies
       import_role:
         name: common
 
-    - name: Deploy Nginx reverse proxy & landing page
+    - name: Deploy Nginx + Static Site + TLS (with Certbot)
       import_role:
         name: nginx-proxy
 
-    - name: Deploy Synapse
+    - name: Deploy Synapse (PostgreSQL + containers)
       import_role:
         name: matrix-synapse

roles/nginx-proxy/tasks/main.yml

@@ -1,41 +1,62 @@
-- name: Install Nginx
+- name: Ensure web root exists (for ACME)
-  package:
-    name: nginx
-    state: present
-
-- name: Create web root for landing page
   file:
-    path: "{{ nginx_webroot }}"
+    path: "/var/www/{{ matrix_domain }}"
     state: directory
     mode: '0755'
 
-- name: Deploy landing page HTML
+- name: Copy compiled site to host (for volume mount)
   copy:
-    content: |
+    src: "files/mysite/"
-      <!DOCTYPE html>
+    dest: "{{ nginx_webroot }}/mysite/"
-      <html>
-      <head><title>Welcome</title></head>
-      <body>
-        <h1>Welcome to Matrix!</h1>
-        <p>Visit <a href="/_matrix">Matrix</a></p>
-      </body>
-      </html>
-    dest: "{{ nginx_webroot }}/index.html"
     mode: '0644'
+  vars:
+    nginx_webroot: "/var/lib/matrix-nginx"
 
-- name: Deploy Nginx config
+- name: Ensure nginx data dir exists
-  template:
-    src: nginx/default.conf.j2
-    dest: "/etc/nginx/conf.d/{{ matrix_domain }}.conf"
-    mode: '0644'
-
-- name: Remove default config (optional)
   file:
-    path: "/etc/nginx/conf.d/default.conf"
+    path: "{{ item }}"
-    state: absent
+    state: directory
+    mode: '0755'
+  loop:
+    - "/var/lib/matrix-nginx"
+    - "/var/lib/matrix-nginx/certbot"
 
-- name: Restart & enable Nginx
+- name: Create custom Nginx image (if missing)
-  service:
+  command: >
-    name: nginx
+    podman build
-    state: restarted
+    -f "{{ role_path }}/templates/Dockerfile-nginx-certbot.j2"
-    enabled: yes
+    -t nginx-matrix:latest
+    "{{ role_path }}/templates/"
+  args:
+    creates: /var/lib/containers/storage/overlay-images/... # (use container_exists check instead)
+  register: build_result
+  changed_when: false
+
+- name: Create Podman pod
+  command: >
+    podman pod create
+    --name {{ podman_pod_name }}
+    --publish 80:80
+    --publish 443:443
+    --publish 8008:8008
+    --publish 8448:8448
+  changed_when: false
+
+- name: Run Nginx container (with TLS & site)
+  container:
+    name: nginx-matrix
+    image: nginx-matrix:latest
+    state: started
+    restart_policy: unless-stopped
+    pod: "{{ podman_pod_name }}"
+    volumes:
+      - "/var/lib/matrix-nginx/mysite:/usr/share/nginx/html/mysite:ro"
+      - "/var/lib/matrix-nginx/certbot:/etc/letsencrypt"
+    env:
+      NGINX_HOST: "{{ matrix_domain }}"
+    security_opt:
+      - label: disable  # if rootless: disable SELinux
+  register: nginx_cont
+
+- name: Run Synapse (PostgreSQL & all)
+  # ... (existing synapse task from before)

roles/nginx-proxy/templates/default.conf.j2

@@ -1,29 +1,50 @@
-# Landing page (root path)
+# Redirect HTTP → HTTPS (except ACME challenges)
 server {
     listen 80;
-    server_name {{ landing_domain }} {{ matrix_domain }};
+    server_name {{ matrix_domain }} {{ landing_domain }};
 
-    root {{ nginx_webroot }};
+    # ACME-challenge (for Let's Encrypt)
-    index index.html;
+    location ~ /.well-known/acme-challenge/ {
-
+        root /var/www;
-    location / {
+        try_files $uri =404;
-        try_files $uri $uri/ =404;
     }
 
-    # Matrix Synapse
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+# HTTPS server
+server {
+    listen 443 ssl http2;
+    server_name {{ matrix_domain }};
+
+    # TLS certs (mounted from Let's Encrypt dir)
+    ssl_certificate /etc/letsencrypt/live/{{ matrix_domain }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ matrix_domain }}/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/{{ matrix_domain }}/chain.pem;
+
+    ssl_session_cache shared:SSL:10m;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers HIGH:!aNULL:!MD5;
+
+    # Serve static site (root)
+    location / {
+        root /usr/share/nginx/html/mysite;
+        try_files $uri $uri/ /index.html;
+    }
+
+    # Matrix Synapse (client)
     location /_matrix/ {
         proxy_pass http://127.0.0.1:8008/_matrix/;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Forwarded-Server $host;
         proxy_buffering off;
-        proxy_request_buffering off;
     }
 
-    # Federation (port 8448 usually, but often proxied at /_matrix too)
+    # Federation
     location /_matrix/federation/v1/ {
         proxy_pass http://127.0.0.1:8448/_matrix/federation/v1/;
         proxy_set_header Host $host;
@@ -32,5 +53,8 @@ server {
         proxy_set_header X-Forwarded-Proto $scheme;
     }
 
-    # Optional: Caddy or Let’s Encrypt ACME
+    # Optional: Add a Matrix admin link
+    location /admin {
+        return 301 https://matrix-admin.example.com; # or proxy to a UI like SynapseAdmin
+    }
 }