switched to roles

- all tasks/* have been moved to their own roles in roles/*
- each file && template is now oragnized per-role
- annotated each task which still isn't idempotent !TODO!

roles/nginx/files/nginx.conf

@@ -0,0 +1,52 @@
+user www-data;
+worker_processes auto;
+include /etc/nginx/modules-enabled/*.conf;
+pid /run/nginx.pid;
+
+events {
+    worker_connections 768;
+}
+
+http {
+
+    ##
+    # Basic Settings
+    ##
+
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+    keepalive_timeout 65;
+    types_hash_max_size 2048;
+
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    ##
+    # SSL Settings
+    ##
+
+    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
+    ssl_prefer_server_ciphers on;
+
+    ##
+    # Logging Settings
+    ##
+
+    access_log /var/log/nginx/access.log;
+    error_log /var/log/nginx/error.log;
+
+    ##
+    # Gzip Settings
+    ##
+
+    gzip on;
+    gzip_disable "msie6";
+
+    ##
+    # Virtual Host Configs
+    ##
+
+    include /etc/nginx/conf.d/*.conf;
+    include /etc/nginx/sites-enabled/*;
+}

roles/nginx/tasks/main.yml

@@ -0,0 +1,55 @@
+---
+
+# TODO: make idempotent
+- name: Remove default nginx config
+  file:
+    name: /etc/nginx/sites-enabled
+    state: absent
+
+# TODO: make idempotent
+- name: Restore sites-enabled
+  file:
+    name: /etc/nginx/sites-enabled
+    state: directory
+
+- name: Install system nginx config
+  copy:
+    src: nginx.conf
+    dest: /etc/nginx/nginx.conf
+
+# setup our configs for each host (we don't want to 
+# overwrite certbot's changes, so if it already exists,
+# don't copy!)
+
+- name: Install nginx config for {{ domain }}
+  template:
+    src: templates/site.conf
+    dest: /etc/nginx/conf.d/{{ domain }}.conf
+    force: no
+
+- name: Install nginx config for git.{{ domain }}
+  template:
+    src: templates/gitea.conf
+    dest: /etc/nginx/conf.d/git.{{ domain }}.conf
+    force: no
+
+- name: Install nginx config for our Hidden Service
+  template:
+    src: templates/tor.conf
+    dest: /etc/nginx/conf.d/tor-{{ domain }}.conf
+    force: no
+
+- name: Reload Nginx to install LetsEncrypt
+  service:
+    name: nginx
+    state: restarted
+
+# certbot is a life saver. thank you certbot devs!
+- name: Setup certbot
+  shell: "certbot --nginx --non-interactive --agree-tos -m {{ contact_email }} -d {{ domain }} -d git.{{ domain }}"
+
+- name: Reload Nginx with LetsEncrypt installed
+  systemd:
+    name: nginx
+    enabled: yes
+    state: restarted

roles/nginx/templates/gitea.conf

@@ -0,0 +1,11 @@
+server {
+    server_name git.{{ domain }};
+    listen 80;
+
+    location / {
+        add_header Permissions-Policy interest-cohort=();
+        proxy_pass http://localhost:3000;
+    }
+
+    client_max_body_size 100M;
+}

roles/nginx/templates/site.conf

@@ -0,0 +1,13 @@
+server {
+    server_name {{ domain }};
+    listen 80;
+
+    root /var/www/{{ domain }}/public;
+    index index.html index.htm;
+
+    location / {
+        add_header Permissions-Policy interest-cohort=();
+        add_header Referrer-Policy: "no-referrer";
+        try_files $uri $uri/ =404;
+    }
+}

roles/nginx/templates/tor.conf

@@ -0,0 +1,12 @@
+server {
+    root /var/www/{{ domain }}/public;
+    index index.html index.htm;
+
+    location / {
+        add_header Permissions-Policy interest-cohort=();
+        try_files $uri $uri/ =404;
+    }
+
+    # our tor hidden service is hosted on this port
+    listen 2171;
+}