updated certbot files

.gitignore

@@ -1 +1,2 @@
 vault_pw
+*.key

README.md

@@ -15,7 +15,14 @@ test federation
 curl https://{{ matrix_domain }}/_matrix/federation/v1/version
 ```
 
-
+## to generate config files default before deploymenta and templating ##
+```
+podman run -it --rm \
+  -v "$(pwd)":/data \
+  -e SYNAPSE_SERVER_NAME=my.matrix.host \
+  -e SYNAPSE_REPORT_STATS=yes \
+  docker.io/matrixdotorg/synapse:latest generate
+```
 
 
 | Area | Recommendation |

group_vars/all.yml

@@ -1,42 +1,25 @@
-$ANSIBLE_VAULT;1.1;AES256
+# Variables
-64353034326537373762336464383964336133663564333362623733636134633235353362613430
+matrix_domain: "matrix.example.com"
-6639396262306130393035643463333166333437613832310a323130306134366634326365373962
+landing_domain: "example.com"  # or same as matrix_domain + path-based routing
-61663763363964623437633134616365646166303036613863326330333533313230613364653638
+podman_user: "matrix"          # set to 'root' for rootful
-6230303436346137390a313635633366363637636135373736353337613639313538666230393530
+podman_pod_name: "matrix-pod"
-33306661653632666439633566326564623962653063646366366638643235613738346635346263
+
-31616566666563643866656364373731326238393863663737666435366663633332336436663563
+synapse_data_dir: "/var/lib/matrix-synapse"
-30336337306562613133346163363539613034373033613834353962656539336131646232383134
+nginx_config_dir: "/etc/nginx/conf.d"
-64653735613332643437613733343032356261386266636337353534306264663031613730383331
+nginx_webroot: "/var/www/landing"
-63323631383830363034633238396131626636373163636266326632306230616430343038643039
+
-36663532356436386335386537353739393335343661366366656364656538313866666139383832
+# Database (PostgreSQL)
-39363933623836353265316536653036626165333436653534323531363734393065346563383264
+db_name: "synapse"
-32313336313361653337393437326430393465303632326332653735383264646165316238656235
+db_user: "synapse"
-39313966663934626337303932303366353365663865393764613132306634653830373936326466
+db_pass: "{{ synapse_db_pass | mandatory }}"
-34376431656165323838663137363730303833646330653165623238393061653763363636626265
+synapse_db_pass: "supersecretpassword"  # use vault for real deployments!
-61333036646663663564333762333535383132396137626639393135343765323165346432343531
+
-62366132643931643239316633643738363166623030613938326134326235323634656266323234
+
-39666632303730393161373935383066613834376237323162653833363039333761656232633731
+matrix_domain: "matrix.example.com"
-37366161373931306166636532363362646634306336666135353066353632643138656339343739
+landing_domain: "example.com"  # optional, or use same domain + path-based routing
-31343966626237343665353963616632396433323138666662323166663337323037343233323539
+
-62653630376331393532313435356664626639393461356138303833656631613536653338316661
+# For certbot
-61383938636339343332376463663334343436303334346230663964613734653763343563633163
+certbot_email: "admin@example.com"
-64303764353766643635303637353661626462393933336361653463333739613562343131653032
+
-39303561633534323537323261323466393437316164366332363832313131376165363234633930
+# Static site path
-63373463326132303366303861623630343735633835623437303832653763396538313962396237
+nginx_webroot: "/var/lib/matrix-nginx"
-66626165323132633963333137363466613364323031356362393331636661353130313539313831
-66346536323764646464376631353931343034366566373363363532646166303562343131306638
-66383064363964613962646630303634633537623763656336373939376533623637353364626433
-38643162386562643566376133646239386462633931626236613635396662663239633461343061
-65626236633238613663303831653133656664653466346564346535336532336130626662356532
-35393134653131363262613038303332303838323332326232623639653937613935356536343231
-32383131353530633735393730366665386661336139383830653836353239626330633461656132
-65663765303863313733313834393762643537636464356534613263353061333166636434393566
-34656465323335376231373835613566353461663232353138313566653736633631313130653161
-35366230326263626633343031373362623331363735313861356462333765613765363363646230
-38353265396331616666626639396538383261313132363765613332613137653737303562633237
-33306265333732623161356435626432313136626439333861333234373739306331306330626138
-62353861643539323737376561633664383964653533353939303761313036623464356463383931
-31356365626537303061306438626231656665613931386531343439343436646463393632646262
-63356136336437383436346135333435663637336434356232633061656231633336303165393964
-37383063613936396135303835313235666239626530653833343835663763333536323934323065
-36393437313662666134376333303134613035643264643334356136343633336639

roles/nginx-proxy/templates/Dockerfile-nginx-certbot.j2

@@ -0,0 +1,11 @@
+FROM nginx:1.25-alpine
+
+# Install Certbot (Python-based)
+RUN apk add --no-cache certbot python3 py3-pip
+
+# Add entrypoint script to auto-renew certs (optional)
+COPY certbot-entrypoint.sh /usr/local/bin/certbot-entrypoint.sh
+RUN chmod +x /usr/local/bin/certbot-entrypoint.sh
+
+ENTRYPOINT ["/usr/local/bin/certbot-entrypoint.sh"]
+CMD ["nginx", "-g", "daemon off;"]

roles/nginx-proxy/templates/certbot-entrypoint.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+set -e
+
+# Generate cert if not exists (first-run)
+if [ ! -d "/etc/letsencrypt/live/{{ matrix_domain }}" ]; then
+  echo "Requesting initial Let's Encrypt certificate..."
+  certbot certonly --standalone \
+    --non-interactive --agree-tos --email admin@{{ matrix_domain }} \
+    -d {{ matrix_domain }} \
+    --domain {{ matrix_domain }} \
+    --preferred-challenges http \
+    --http-01-port 8080 \
+    --server https://acme-v02.api.letsencrypt.org/directory || true
+
+  # For staging (dev): use --server https://acme-staging-v02.api.letsencrypt.org/directory
+fi
+
+# Try to renew (non-blocking)
+echo "Attempting certificate renewal..."
+certbot renew --dry-run --quiet || true
+
+# Start Nginx (certs will be loaded if they exist)
+exec "$@"