jmrothst
eb2dd37385
Replace remote git checkouts on target web nodes with an orchestrated
local staging and rsync deployment pipeline.
Recent OpenSSH updates in Fedora dropped agent forwarding into remote
sessions, breaking remote git fetch operations. Furthermore, pulling
directly from Git on production servers exposed .git repositories in
public webroots and required target servers to hold Git credentials.
- Create an ephemeral, unguessable local staging directory (0700) on
localhost via ansible.builtin.tempfile scoped by inventory_hostname.
- Stage checkouts using repo hash prefixes to prevent collision when
public and private servers share identical FQDNs.
- Execute shallow checkouts (depth: 1) on the control node using local
credentials.
- Push website content to /srv/http/{fqdn}/ via ansible.posix.synchronize
with checksum delta comparisons and automated cleanup (--delete).
- Introduce ensure_apache_rsync_excludes in role defaults to strip
.git*, .env*, CI/CD pipelines (.gitea, .github), editor swap files,
and OS metadata while preserving .htaccess and /.well-known/.
- Enforce httpd_sys_content_t SELinux context recursively across webroots.
- Guarantee staging directory cleanup on localhost via an always block.
Role Name
A brief description of the role goes here.
Requirements
Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
Feature List
- Apache deployed
- Enables HTTP/2
- Enables and convets connections to HTTPS by default
- ACME based TLS Certificate request and renewal
- ACME uses Lets Encrypt by default, alternative ACME Providers may be specified
- Optionally act as a proxy to another URL
- Optionally redirect traffic to another URL
- Optionally populate DocumentRoot with git clone
- Multiple DocumentRoots supported, with aliases
Role Variables
-
Lets Encrypt configuration
- lets_encrypt_admin : The Email address your Lets Encrypt account is with
- lets_encrypt_url : The ACME URL to speak with, defaults to Lets Encrypt, may set to 'https://acme-staging-v02.api.letsencrypt.org/directory' for Staging
-
Web Host variable of type list
- http_vhost
-
required dictionary elements
- fqdn : The FQDN of the website
-
optional dictionary elements
- aliases : list of alternative FQDN for the website
- proxy : URL to direct traffic for the FQDN to, e.g. http://localhost:8080
- redirect : Where should we send traffic?
- repo : git URL of website repo to clone/update
lets_encrypt_admin: 'acme@example.com'
lets_encrypt_url: 'https://ipa.example.com'
http_vhost:
- fqdn: 'www.example.com'
aliases:
- 'exmaple.com'
proxy: 'http://localhost:8080'
Dependencies
A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
Example Playbook
Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
- hosts: servers
roles:
- { role: username.rolename, x: 42 }
License
BSD
Author Information
An optional section for the role authors to include contact information, or a website (HTML is not allowed).