From 98deb6b468c52d09c69c699b02ab16791f557beb Mon Sep 17 00:00:00 2001
From: Dmitry Ilvokhin <d@ilvokhin.com>
Date: Thu, 21 Dec 2023 18:08:22 +0000
Subject: Enable certbot for certificates renewal

---
 roles/web/files/certbot/certbot.service |  6 ++++
 roles/web/files/certbot/certbot.timer   | 10 ++++++
 roles/web/files/nginx                   | 12 -------
 roles/web/files/nginx.conf              | 55 ---------------------------------
 roles/web/files/nginx/nginx.conf        | 55 +++++++++++++++++++++++++++++++++
 roles/web/files/nginx/nginx.logrotate   | 12 +++++++
 6 files changed, 83 insertions(+), 67 deletions(-)
 create mode 100644 roles/web/files/certbot/certbot.service
 create mode 100644 roles/web/files/certbot/certbot.timer
 delete mode 100644 roles/web/files/nginx
 delete mode 100644 roles/web/files/nginx.conf
 create mode 100644 roles/web/files/nginx/nginx.conf
 create mode 100644 roles/web/files/nginx/nginx.logrotate

(limited to 'roles/web/files')

diff --git a/roles/web/files/certbot/certbot.service b/roles/web/files/certbot/certbot.service
new file mode 100644
index 0000000..bea307c
--- /dev/null
+++ b/roles/web/files/certbot/certbot.service
@@ -0,0 +1,6 @@
+[Unit]
+Description=Let's Encrypt renewal
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/certbot renew --agree-tos --deploy-hook "systemctl reload nginx"
diff --git a/roles/web/files/certbot/certbot.timer b/roles/web/files/certbot/certbot.timer
new file mode 100644
index 0000000..565b4ee
--- /dev/null
+++ b/roles/web/files/certbot/certbot.timer
@@ -0,0 +1,10 @@
+[Unit]
+Description=Renewal of Let's Encrypt's certificates
+
+[Timer]
+OnCalendar=daily
+OnCalendar=0/12:12:00
+Persistent=true
+
+[Install]
+WantedBy=timers.target
diff --git a/roles/web/files/nginx b/roles/web/files/nginx
deleted file mode 100644
index da8ba47..0000000
--- a/roles/web/files/nginx
+++ /dev/null
@@ -1,12 +0,0 @@
-/var/log/nginx/*log {
-	missingok
-	notifempty
-	create 640 http root
-	daily
-	rotate 14
-	sharedscripts
-	compress
-	postrotate
-		test ! -r /run/nginx.pid || kill -USR1 `cat /run/nginx.pid`
-	endscript
-}
diff --git a/roles/web/files/nginx.conf b/roles/web/files/nginx.conf
deleted file mode 100644
index ce8302d..0000000
--- a/roles/web/files/nginx.conf
+++ /dev/null
@@ -1,55 +0,0 @@
-# Run workers under http user.
-user http;
-
-# Set number of worker processes to number of available CPU cores.
-worker_processes 1;
-
-# Log errors in a separate file.
-error_log /var/log/nginx/error.log;
-
-# Write a PID-file.
-pid /run/nginx.pid;
-
-
-events {
-    # Maximum number of simultaneous connections that can be opened by a worker
-    # process.
-    # worker_connections 512;
-}
-
-
-http {
-    include mime.types;
-    default_type application/octet-stream;
-
-    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
-                    '$status $body_bytes_sent "$http_referer" '
-                    '"$http_user_agent" "$http_x_forwarded_for"';
-
-    # Use log_format defined above.
-    access_log /var/log/nginx/access.log main;
-
-    # Enable use of sendfile.
-    sendfile on;
-
-    # Set keepalive timeout to 65 seconds.
-    keepalive_timeout 65;
-
-    # Set types_hash_max_size to 2048 to avoid warning in logs.
-    types_hash_max_size 4096;
-
-    # Load configs for all enabled sites.
-    include /etc/nginx/sites-enabled/*;
-
-    server {
-        # Listen on port 80 and become a default server.
-        listen 80;
-        listen [::]:80 default_server;
-
-        # Serve as a default server block.
-        server_name _;
-
-        # Redirect any non-matched request to default page.
-        return 301 https://ilvokhin.com$request_uri;
-    }
-}
diff --git a/roles/web/files/nginx/nginx.conf b/roles/web/files/nginx/nginx.conf
new file mode 100644
index 0000000..ce8302d
--- /dev/null
+++ b/roles/web/files/nginx/nginx.conf
@@ -0,0 +1,55 @@
+# Run workers under http user.
+user http;
+
+# Set number of worker processes to number of available CPU cores.
+worker_processes 1;
+
+# Log errors in a separate file.
+error_log /var/log/nginx/error.log;
+
+# Write a PID-file.
+pid /run/nginx.pid;
+
+
+events {
+    # Maximum number of simultaneous connections that can be opened by a worker
+    # process.
+    # worker_connections 512;
+}
+
+
+http {
+    include mime.types;
+    default_type application/octet-stream;
+
+    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+                    '$status $body_bytes_sent "$http_referer" '
+                    '"$http_user_agent" "$http_x_forwarded_for"';
+
+    # Use log_format defined above.
+    access_log /var/log/nginx/access.log main;
+
+    # Enable use of sendfile.
+    sendfile on;
+
+    # Set keepalive timeout to 65 seconds.
+    keepalive_timeout 65;
+
+    # Set types_hash_max_size to 2048 to avoid warning in logs.
+    types_hash_max_size 4096;
+
+    # Load configs for all enabled sites.
+    include /etc/nginx/sites-enabled/*;
+
+    server {
+        # Listen on port 80 and become a default server.
+        listen 80;
+        listen [::]:80 default_server;
+
+        # Serve as a default server block.
+        server_name _;
+
+        # Redirect any non-matched request to default page.
+        return 301 https://ilvokhin.com$request_uri;
+    }
+}
diff --git a/roles/web/files/nginx/nginx.logrotate b/roles/web/files/nginx/nginx.logrotate
new file mode 100644
index 0000000..da8ba47
--- /dev/null
+++ b/roles/web/files/nginx/nginx.logrotate
@@ -0,0 +1,12 @@
+/var/log/nginx/*log {
+	missingok
+	notifempty
+	create 640 http root
+	daily
+	rotate 14
+	sharedscripts
+	compress
+	postrotate
+		test ! -r /run/nginx.pid || kill -USR1 `cat /run/nginx.pid`
+	endscript
+}
-- 
cgit v1.2.3-70-g09d2