[irregular-apocalypse] split out nginx configs

ansible/irregular-apocalypse/nginx.conf

@@ -1,29 +0,0 @@
-server {
-
-    server_name dev.irregular-apocalypse.kejadlen.dev;
-
-    # Redirect non-https traffic to https
-    if ($scheme != "https") {
-        return 301 https://$host$request_uri;
-    }
-
-    location / {
-        proxy_pass http://localhost:3000/;
-    }
-
-}
-
-server {
-
-    server_name irregular-apocalypse.kejadlen.dev;
-
-    # Redirect non-https traffic to https
-    if ($scheme != "https") {
-        return 301 https://$host$request_uri;
-    }
-
-    location /dev {
-        proxy_pass http://localhost:3000/;
-    }
-
-}

ansible/irregular-apocalypse/nginx.yml

@@ -17,13 +17,16 @@
 
   - name: nginx conf files
     copy:
-      src: nginx.conf
-      dest: /etc/nginx/conf.d/irregular-apocalypse.kejadlen.dev.conf
+      src: nginx/{{ item }}.conf
+      dest: /etc/nginx/conf.d/{{ item }}.conf
+    with_items:
+      - irregular-apocalypse.kejadlen.dev
+      - dev.irregular-apocalypse.kejadlen.dev
     notify: reload nginx
 
   - name: obtain ssl certificates
     command: >-
-      certbot --nginx
+      certbot certonly --nginx
       -d {{ item }}
       -m alpha+lets.encrypt@kejadlen.dev
       --agree-tos

ansible/irregular-apocalypse/nginx/dev.irregular-apocalypse.kejadlen.dev.conf

@@ -0,0 +1,23 @@
+server {
+
+    server_name dev.irregular-apocalypse.kejadlen.dev;
+
+    # Redirect non-https traffic to https
+    if ($scheme != "https") {
+        return 301 https://$host$request_uri;
+    }
+
+    location / {
+        proxy_pass http://localhost:3000/;
+    }
+
+    listen 80;
+
+    listen 443 ssl;
+    ssl_certificate /etc/letsencrypt/live/dev.irregular-apocalypse.kejadlen.dev/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/dev.irregular-apocalypse.kejadlen.dev/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+}
+

ansible/irregular-apocalypse/nginx/irregular-apocalypse.kejadlen.dev.conf

@@ -0,0 +1,22 @@
+server {
+
+    server_name irregular-apocalypse.kejadlen.dev;
+
+    # Redirect non-https traffic to https
+    if ($scheme != "https") {
+        return 301 https://$host$request_uri;
+    }
+
+    location /dev {
+        proxy_pass http://localhost:3000/;
+    }
+
+    listen 80;
+
+    listen 443 ssl;
+    ssl_certificate /etc/letsencrypt/live/irregular-apocalypse.kejadlen.dev/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/irregular-apocalypse.kejadlen.dev/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+}