first commit

ansible/roles/nginx_letsencrypt/tasks/main.yml

@@ -0,0 +1,56 @@
+---
+- name: Nginx и certbot
+  ansible.builtin.apt:
+    name:
+      - nginx
+      - certbot
+      - python3-certbot-nginx
+    state: present
+    update_cache: true
+
+- name: Виртуальный хост (HTTP → Docker)
+  ansible.builtin.template:
+    src: laravel.nginx.conf.j2
+    dest: /etc/nginx/sites-available/laravel.conf
+    mode: "0644"
+
+- name: Включить сайт
+  ansible.builtin.file:
+    src: /etc/nginx/sites-available/laravel.conf
+    dest: /etc/nginx/sites-enabled/laravel.conf
+    state: link
+    force: true
+
+- name: Отключить default сайт
+  ansible.builtin.file:
+    path: /etc/nginx/sites-enabled/default
+    state: absent
+
+- name: Проверить и перезагрузить nginx
+  ansible.builtin.command: nginx -t
+  changed_when: false
+
+- name: Перезапуск nginx
+  ansible.builtin.service:
+    name: nginx
+    state: reloaded
+
+- name: Получить сертификат Let's Encrypt
+  ansible.builtin.command: >
+    certbot --nginx
+    -d {{ project_domain }}
+    --non-interactive
+    --agree-tos
+    -m {{ letsencrypt_email }}
+    --redirect
+  args:
+    creates: /etc/letsencrypt/live/{{ project_domain }}/fullchain.pem
+  tags:
+    - letsencrypt
+
+- name: Автообновление сертификатов (timer или cron от пакета certbot)
+  ansible.builtin.service:
+    name: certbot.timer
+    state: started
+    enabled: true
+  ignore_errors: true

ansible/roles/nginx_letsencrypt/templates/laravel.nginx.conf.j2

@@ -0,0 +1,15 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name {{ project_domain }};
+
+    location / {
+        proxy_pass http://127.0.0.1:8080;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 120s;
+    }
+}