Refactor pi roles to use .home.arpa subdomains for services

4 files changed, 22 insertions, 23 deletions

diff --git a/roles/wg_portal/defaults/main.yml b/roles/wg_portal/defaults/main.yml
index 38f1bda7..3d47add4 100644
--- a/roles/wg_portal/defaults/main.yml
+++ b/roles/wg_portal/defaults/main.yml
@@ -2,4 +2,4 @@
 wg_portal_version: "latest"
 wg_portal_port: "8080"
 wg_portal_password: "{{ ('changeme' | hash('sha256') | hash('sha256'))[:64] }}"
-wg_portal_by_nginx: false
+wg_portal_hostname: "vpn.home.arpa"
diff --git a/roles/wg_portal/meta/argument_specs.yml b/roles/wg_portal/meta/argument_specs.yml
index 3ffdc604..eee9d7ed 100644
--- a/roles/wg_portal/meta/argument_specs.yml
+++ b/roles/wg_portal/meta/argument_specs.yml
@@ -14,7 +14,7 @@ argument_specs:
         description: "Password hash for wg-portal authentication"
         type: "str"
         default: "{{ ('changeme' | hash('sha256') | hash('sha256'))[:64] }}"
-      wg_portal_by_nginx:
-        description: "Serve wg_portal behind nginx reverse proxy"
-        type: "bool"
-        default: false
+      wg_portal_hostname:
+        type: "str"
+        description: "FQDN for the wg-portal nginx vhost (e.g. 'vpn.home.arpa')."
+        default: "vpn.home.arpa"
diff --git a/roles/wg_portal/tasks/main.yml b/roles/wg_portal/tasks/main.yml
index a7962919..78a235a1 100644
--- a/roles/wg_portal/tasks/main.yml
+++ b/roles/wg_portal/tasks/main.yml
@@ -94,28 +94,17 @@
     state: "started"
     enabled: true
 
-- name: "Create wg-portal nginx configurations"
+- name: "Create wg-portal nginx vhost configuration"
   become: true
-  when: wg_portal_by_nginx is defined and wg_portal_by_nginx | bool
-  ansible.builtin.copy:
-    content: |
-      location / {
-        proxy_pass http://127.0.0.1:{{ wg_portal_port }}/;
-      }
-      location /api/connections {
-        proxy_pass http://127.0.0.1:{{ wg_portal_port }}/api/connections;
-      }
-      location /api/status {
-        proxy_pass http://127.0.0.1:{{ wg_portal_port }}/api/status;
-      }
-    dest: "/etc/nginx/conf.d/wg-portal.conf"
+  when: wg_portal_hostname | length > 0
+  ansible.builtin.template:
+    src: "wg_portal.nginx.conf.j2"
+    dest: "/etc/nginx/vhosts.d/wg-portal.conf"
     owner: "root"
     group: "root"
     mode: "0644"
     backup: true
-    # workaround issue: https://github.com/ansible/ansible/issues/9112
-    # ref: https://serverfault.com/a/811520
     validate: >
-      bash -c 'echo "events { worker_connections 2; } http { server { include %s; } }" > /tmp/nginx.conf;
-        sudo nginx -T -c /tmp/nginx.conf; ec=$?; rm -f /tmp/nginx.conf; exit $ec'
+      bash -c 'echo "events { worker_connections 64; } http { include %s; }" > /tmp/nginx-vhost.conf;
+        sudo nginx -T -c /tmp/nginx-vhost.conf; ec=$?; rm -f /tmp/nginx-vhost.conf; exit $ec'
   notify: "Restart nginx"
diff --git a/roles/wg_portal/templates/wg_portal.nginx.conf.j2 b/roles/wg_portal/templates/wg_portal.nginx.conf.j2
new file mode 100644
index 00000000..734ecac9
--- /dev/null
+++ b/roles/wg_portal/templates/wg_portal.nginx.conf.j2
@@ -0,0 +1,10 @@
+server {
+    listen 80;
+    listen [::]:80;
+
+    server_name {{ wg_portal_hostname }};
+
+    location / {
+        proxy_pass http://127.0.0.1:{{ wg_portal_port }}/;
+    }
+}