roles/reverse_proxy: better handling of multi names

matrix.yaml

@@ -8,7 +8,7 @@
   roles:
     - role: 'dns_record'
     - role: 'reverse_proxy'
-      reverse_proxy_site_fqdns:
+      reverse_proxy_site_fqdn:
         - 'matrix.{{ domain }}'
         - 'riot.{{ domain }}'
     - role: 'coturn'

projects.yaml

@@ -8,7 +8,7 @@
   roles:
     - role: 'dns_record'
     - role: 'reverse_proxy'
-      reverse_proxy_site_fqdns:
+      reverse_proxy_site_fqdn:
         - 'projects.{{ domain }}'
         - 'mattermost.{{ domain }}'
     - role: 'gitlab'

roles/reverse_proxy/defaults/main.yaml

@@ -1,6 +1,5 @@
 ---
-reverse_proxy_site_fqdns:
-  - '{{ ansible_hostname }}.{{ domain }}'
-  - 'www.{{ ansible_hostname }}.{{ domain }}'
+reverse_proxy_site_fqdn: '{{ ansible_hostname }}.{{ domain }}'
 reverse_proxy_proxy_protocol: true
+reverse_proxy_www_redir: false
 ...

roles/reverse_proxy/handlers/main.yaml

@@ -1,3 +1,5 @@
-- name: reload nginx
+---
+- name: 'reload reverse proxy'
   command: '/usr/sbin/nginx -s reload'
-  delegate_to: reverse_proxy
+  delegate_to: 'reverse_proxy'
+...

roles/reverse_proxy/tasks/main.yaml

@@ -35,9 +35,8 @@
               proxy_protocol {{ 'on' if reverse_proxy_proxy_protocol else 'off' }};
           }
       }
-
   delegate_to: 'reverse_proxy'
-  notify: 'reload nginx'
+  notify: 'reload reverse proxy'
 
 - name: 'configure nginx http 80 forwarder'
   lineinfile:
@@ -45,14 +44,14 @@
     insertafter: '^http {'
     line: 'include /etc/nginx/http.conf.d/*.conf;'
   delegate_to: 'reverse_proxy'
-  notify: 'reload nginx'
+  notify: 'reload reverse proxy'
 
 - name: 'create configuration directories for sites'
   file:
     state: 'directory'
     dest: '/etc/nginx/{{ item }}'
   delegate_to: 'reverse_proxy'
-  notify: 'reload nginx'
+  notify: 'reload reverse proxy'
   loop:
     - 'http.conf.d'
     - 'map.conf.d'
@@ -63,7 +62,7 @@
     src: 'http.conf.j2'
     dest: '/etc/nginx/http.conf.d/{{ ansible_hostname }}.conf'
   delegate_to: 'reverse_proxy'
-  notify: 'reload nginx'
+  notify: 'reload reverse proxy'
 
 - name: 'configure upstream server spec'
   copy:
@@ -75,18 +74,18 @@
       }
     dest: '/etc/nginx/upstream.conf.d/{{ ansible_hostname }}.conf'
   delegate_to: 'reverse_proxy'
-  notify: 'reload nginx'
+  notify: 'reload reverse proxy'
 
 - name: 'configure sni-upstream mapping'
   copy:
     content: |
-      {% for site_fqdn in reverse_proxy_site_fqdns %}
+      {% for site_fqdn in [reverse_proxy_site_fqdn] | flatten(levels=1)  %}
       {{ site_fqdn }} {{ ansible_hostname }}_https;
       {% endfor %}
     dest: '/etc/nginx/map.conf.d/{{ ansible_hostname }}.conf'
   delegate_to: 'reverse_proxy'
-  notify: 'reload nginx'
+  notify: 'reload reverse proxy'
 
--  meta: 'flush_handlers'
+- meta: 'flush_handlers'
 
 

roles/reverse_proxy/templates/http.conf.j2

@@ -1,22 +1,25 @@
+{% for server_name in [reverse_proxy_site_fqdn] | flatten(levels=1) %}
 server {
     listen {{ public_ip }}:80;
 
-    server_name {{ reverse_proxy_site_fqdns | join(" ") }};
+    server_name
+        {{ server_name }}{% if reverse_proxy_www_redir %} www.{{ server_name }}{% endif %};
 
     # Redirect ACME Challenges to the upstream server port 80
     location /.well-known/acme-challenge/ {
-      proxy_set_header X-Real-IP $remote_addr;
-      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-      proxy_set_header Host $host;
-      proxy_set_header X-NginX-Proxy true;
-      proxy_pass http://{{ hostvars | ip_from_inventory(ansible_hostname) }};
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header Host $host;
+        proxy_set_header X-NginX-Proxy true;
+        proxy_pass http://{{ hostvars | ip_from_inventory(ansible_hostname) }};
     }
 
     # Redirect to HTTPS all non-ACME requests
     location / {
-      if ($request_method = POST) {
-        return 307 https://$host$request_uri;
-      }
-      return 301 https://$host$request_uri;
+        if ($request_method = POST) {
+            return 307 https://$server_name$request_uri;
+        }
+        return 301 https://$server_name$request_uri;
     }
 }
+{% endfor %}