58 lines
2.5 KiB
Markdown
58 lines
2.5 KiB
Markdown
Configure Apache with SSL and acme.sh for one or more websites per host, optionally as reverse proxy.
|
|
|
|
Websites are defined as dict in host_vars / group_vars (or passed via `include_role` vars).
|
|
The key is the domain (ServerName and certificate name). Without `websites` the host
|
|
serves one website named after `inventory_hostname`.
|
|
|
|
Before a certificate is requested, a token is placed in `<docroot>/.well-known/acme-challenge/`
|
|
and fetched via `http://<domain>/...`. If the domain does not reach this host, certificate
|
|
and ssl vhost are skipped (warning at the end of the role) and retried on the next run.
|
|
|
|
# Example
|
|
|
|
```yaml
|
|
websites:
|
|
example.digital-infinity.de: # static site
|
|
aliases: www.example.digital-infinity.de
|
|
docroot: /var/www/example
|
|
extra_directives: |
|
|
Header always set Strict-Transport-Security "max-age=31536000"
|
|
|
|
app.digital-infinity.de: # reverse proxy, only the target url is required
|
|
proxy_pass: http://127.0.0.1:8080/
|
|
|
|
immich:
|
|
proxy_pass: http://127.0.0.1:2283/
|
|
proxy_websocket: true
|
|
proxy_timeout: 600
|
|
|
|
old.digital-infinity.de:
|
|
state: absent # removes vhosts and stops renewal, keeps cert files
|
|
```
|
|
|
|
# Options per website
|
|
|
|
| option | default | |
|
|
|---|---|---|
|
|
| state | present | `absent` removes the vhosts |
|
|
| aliases | [] | ServerAlias, string or list (not part of the certificate) |
|
|
| docroot | /var/www/html | also used as acme webroot |
|
|
| use_local_ca | `use_local_ca` / false | true -> internal `acme_sh_server` instead of letsencrypt (for internal sites) |
|
|
| check_dns | true | reachability check before requesting a certificate |
|
|
| extra_directives | "" | raw apache directives inside the ssl vhost |
|
|
| proxy_pass | "" | target url, enables the reverse proxy |
|
|
| proxy_path | / | |
|
|
| proxy_preserve_host | true | ProxyPreserveHost |
|
|
| proxy_forwarded_headers | true | X-Forwarded-Proto/-Port |
|
|
| proxy_websocket | false | adds `upgrade=websocket` (apache >= 2.4.47) |
|
|
| proxy_timeout | "" | `timeout=` in seconds |
|
|
| proxy_ssl_verify | true | false disables certificate checks for https backends |
|
|
| proxy_options | "" | further ProxyPass options, e.g. `nocanon` |
|
|
|
|
# Global variables
|
|
|
|
* `website_check_host` (default `inventory_hostname`): host running the reachability check, e.g. `localhost` to check from the controller
|
|
* `website_check_timeout` (default 10)
|
|
* `website_fail_without_cert` (default false): fail instead of warn if a domain is not reachable
|
|
* `website_site_defaults`: defaults for all websites
|