roles/dl/defaults/main.yaml

@@ -4,5 +4,5 @@ dl_server_root: /var/www/dl
 dl_access_log: /var/log/nginx/dl.access.log
 dl_error_log: /var/log/nginx/dl.error.log
 dl_ssl_enabled: false
-dl_ssl_certificate: "/var/lib/lego/certificates/{{ dl_server_name }}.crt"
-dl_ssl_certificate_key: "/var/lib/lego/certificates/{{ dl_server_name }}.key"
+dl_ssl_certificate: "/etc/letsencrypt/live/{{ dl_server_name }}/fullchain.pem"
+dl_ssl_certificate_key: "/etc/letsencrypt/live/{{ dl_server_name }}/privkey.pem"

roles/gitea/defaults/main.yaml

@@ -53,8 +53,6 @@ gitea_config:
     colorize: no
   service:
     register_manual_confirm: true
-  metrics:
-    enabled: true
 
 gitea_var_tree:
   - "{{ gitea_var_path }}"
@@ -64,6 +62,6 @@ gitea_var_tree:
   - "{{ gitea_var_path }}/backup"
 
 gitea_ssl_enabled: yes
-gitea_ssl_certificate: "/var/lib/lego/certificates/{{ gitea_domain }}.crt"
-gitea_ssl_certificate_key: "/var/lib/lego/certificates/{{ gitea_domain }}.key"
+gitea_ssl_certificate: "/etc/letsencrypt/live/{{ gitea_domain }}/fullchain.pem"
+gitea_ssl_certificate_key: "/etc/letsencrypt/live/{{ gitea_domain }}/privkey.pem"
 #gitea_ssl_dhparam: "/etc/letsencrypt/ssl-dhparams.pem"

roles/grafana/defaults/main.yaml

@@ -26,8 +26,8 @@ grafana_config:
     http_port: "{{ grafana_port }}"
 
 grafana_ssl_enabled: true
-grafana_ssl_certificate: "/var/lib/lego/certificates/{{ grafana_domain }}.crt"
-grafana_ssl_certificate_key: "/var/lib/lego/certificates/{{ grafana_domain }}.key"
+grafana_ssl_certificate: "/etc/letsencrypt/live/{{ grafana_domain }}/fullchain.pem"
+grafana_ssl_certificate_key: "/etc/letsencrypt/live/{{ grafana_domain }}/privkey.pem"
 # grafana_ssl_dhparam: "/etc/letsencrypt/ssl-dhparams.pem"
 
 

roles/minecraft/defaults/main.yaml

@@ -11,8 +11,8 @@ minecraft_port: 25565
 minecraft_user: minecraft
 minecraft_group: minecraft
 
-minecraft_jar_url: https://piston-data.mojang.com/v1/objects/84194a2f286ef7c14ed7ce0090dba59902951553/server.jar
-minecraft_jar_checksum: sha256:3af73a9dc5a102e38147946360dd27d4d70bae7055bf91cf2151cd5d121b79e0
+minecraft_jar_url: https://launcher.mojang.com/v1/objects/e00c4052dac1d59a1188b2aa9d5a87113aaf1122/server.jar
+minecraft_jar_checksum: sha256:deefd056f0cf89c3d7fd48d03f56a8a73943586e8c061fdabd0fd92d32ced2b2
 
 minecraft_opt_path: /opt/minecraft
 minecraft_var_path: /var/opt/minecraft

roles/nginx/tasks/main.yml

@@ -44,19 +44,6 @@
     mode: 0644
   notify: reload nginx
 
-- name: configure htpasswd files
-  ansible.builtin.copy:
-    dest: "{{ nginx_etc_path }}/{{ item.key }}.htpasswd"
-    owner: root
-    group: nginx
-    mode: 0640
-    content: |
-      {% for u, h in item.value.items() %}
-      {{ u }}:{{ h }}
-      {% endfor %}
-  loop: "{{ nginx_htpasswd_files | dict2items }}"
-  notify: reload nginx
-
 - name: configure virtual hosts
   ansible.builtin.include_tasks: vhost.yaml
   loop: "{{ nginx_vhosts | dict2items }}"
@@ -65,4 +52,4 @@
   service:
     name: "{{ nginx_service_name }}"
     state: "{{ nginx_service_state }}"
-    enabled: "{{ nginx_service_enabled }}"
+    enabled: "{{ nginx_service_enabled }}"

roles/nginx/tasks/vhost.yaml

@@ -3,11 +3,11 @@
   block:
   - name: create webroot
     file:
-      path: "{{ server.root }}"
+      path: "{{ vhost.root }}"
       state: directory
-    loop: "{{ item.value.server }}"
+    loop: "{{ item.value }}"
     loop_control:
-      loop_var: server
+      loop_var: vhost
 
   - name: configure virtual host
     template:

roles/nginx/templates/vhost.conf.j2

@@ -1,59 +1,33 @@
 # {{ ansible_managed }}
 
-{% if item.value.upstream is defined %}
-{% for upstream in item.value.upstream %}
-upstream {{ upstream.name }} {
-{% for server in upstream.server %}
-    server {{ server }};
-{% endfor %}
-}
-{% endfor %}
-{% endif %}
-
-{% if item.value.map is defined %}
-{% for map in item.value.map %}
-map {{ map.name }} {{ map.variable }} {
-{% for k, v in map.content.items() %}
-{% if k is string and k == "" %}
-    "" {{ v }};
-{% else %}
-    {{ k }} {{ v }};
-{% endif %}
-{% endfor %}
-}
-{% endfor %}
-{% endif %}
-
-{% for server in item.value.server %}
+{% for vhost in item.value %}
 server {
-{% if server.listen is defined %}
-{% for listen in server.listen %}
+{% if vhost.listen is defined %}
+{% for listen in vhost.listen %}
     listen {{ listen }};
 {% endfor %}
+
+{% if vhost.server_name is defined %}
+    server_name {{ vhost.server_name }};
+{% endif %}
+{% endif %}
+    access_log {{ vhost.access_log | default(nginx_var_log_path + '/' + vhost.server_name + '.access.log main') }};
+    error_log {{ vhost.error_log | default(nginx_var_log_path + '/' + vhost.server_name + '.error.log warn') }};
+
+{% if vhost.root is defined %}
+    root {{ vhost.root }};
 {% endif %}
 
-    http2 {{ server.http2 | default("on") }};
+    index {{ vhost.index | default('index.html index.htm') }};
 
-{% if server.server_name is defined %}
-    server_name {{ server.server_name }};
+{% if vhost.ssl_certificate is defined %}
+    ssl_certificate {{ vhost.ssl_certificate }};
 {% endif %}
-    access_log {{ server.access_log | default(nginx_var_log_path + '/' + server.server_name + '.access.log main') }};
-    error_log {{ server.error_log | default(nginx_var_log_path + '/' + server.server_name + '.error.log warn') }};
-
-{% if server.root is defined %}
-    root {{ server.root }};
+{% if vhost.ssl_certificate_key is defined %}
+    ssl_certificate_key {{ vhost.ssl_certificate_key }};
 {% endif %}
-
-    index {{ server.index | default('index.html index.htm') }};
-
-{% if server.ssl_certificate is defined %}
-    ssl_certificate {{ server.ssl_certificate }};
-{% endif %}
-{% if server.ssl_certificate_key is defined %}
-    ssl_certificate_key {{ server.ssl_certificate_key }};
-{% endif %}
-{% if server.ssl_dhparam is defined %}
-    ssl_dhparam {{ server.ssl_dhparam }};
+{% if vhost.ssl_dhparam is defined %}
+    ssl_dhparam {{ vhost.ssl_dhparam }};
 {% endif %}
 
     location /.well-known/acme-challenge/ {
@@ -61,8 +35,8 @@ server {
         try_files $uri =404;
     }
 
-{% if server.raw is defined %}
-    {{ server.raw | indent(4) }}
+{% if vhost.raw is defined %}
+    {{ vhost.raw | indent(4) }}
 {% endif %}
 }
-{% endfor %}
+{% endfor %}

roles/prometheus/defaults/main.yaml

@@ -39,8 +39,8 @@ prometheus_bin_path: /usr/local/bin
 
 prometheus_ssl_enabled: true
 prometheus_hostname: "{{ prometheus_web_external_url | urlsplit('hostname') }}"
-prometheus_ssl_certificate: "/var/lib/lego/certificates/{{ prometheus_hostname }}.crt"
-prometheus_ssl_certificate_key: "/var/lib/lego/certificates/{{ prometheus_hostname }}.key"
+prometheus_ssl_certificate: "/etc/letsencrypt/live/{{ prometheus_hostname }}/fullchain.pem"
+prometheus_ssl_certificate_key: "/etc/letsencrypt/live/{{ prometheus_hostname }}/privkey.pem"
 
 prometheus_alertmanager_enabled: true
 

roles/prometheus/tasks/configure.yaml

@@ -23,14 +23,6 @@
     group: "{{ prometheus_etc_group }}"
     mode: "{{ prometheus_etc_mode }}"
 
-- name: create file_sd_config.d path
-  file:
-    path: "{{ prometheus_etc_path }}/file_sd_config.d"
-    state: directory
-    owner: "{{ prometheus_etc_owner }}"
-    group: "{{ prometheus_etc_group }}"
-    mode: "{{ prometheus_etc_mode }}"
-
 - name: create var path
   file:
     path: "{{ prometheus_var_path }}"
@@ -57,15 +49,6 @@
     mode: 0444
   notify: reload prometheus
 
-- name: configure file_sd_config.d
-  copy:
-    dest: "{{ prometheus_etc_path }}/file_sd_config.d/{{ item.name }}"
-    content: "{{ (item.targets | default([])) | to_json }}"
-    owner: root
-    group: root
-    mode: 0444
-  loop: "{{ prometheus_file_sd_config_d_files | default([]) }}"
-
 - name: configure systemd template
   template:
     src: prometheus.service.j2

roles/rsyslog/defaults/main.yaml

@@ -33,9 +33,3 @@ rsyslog_default_rules_state: file
 rsyslog_default_rules: []
 rsyslog_rules: []
 rsyslog_archival_format_enabled: false
-
-rsyslog_etc_path: /etc/rsyslog.d
-rsyslog_config_path: /etc/rsyslog.conf
-
-rsyslog_d:
-  []

roles/rsyslog/tasks/archival.yaml

@@ -50,7 +50,7 @@
 - name: configure archival format
   template:
     src: archival.conf.j2
-    dest: "{{ rsyslog_etc_path }}/10-archival.conf"
+    dest: /etc/rsyslog.d/10-archival.conf
     owner: root
     group: root
     mode: 0644
@@ -59,7 +59,7 @@
 
 - name: manage archive rules
   file:
-    path: "{{ rsyslog_etc_path }}/10-archival.conf"
+    path: /etc/rsyslog.d/10-archival.conf
     state: "{{ rsyslog_archival_format_enabled | ternary('file', 'absent') }}"
 
 - name: compress log cron job

roles/rsyslog/tasks/main.yaml

@@ -14,7 +14,7 @@
 - name: configure
   template:
     src: rsyslog.conf.j2
-    dest: "{{ rsyslog_config_path }}"
+    dest: /etc/rsyslog.conf
     owner: root
     group: root
     mode: 0644
@@ -26,7 +26,7 @@
 - name: configure default rules
   template:
     src: default.conf.j2
-    dest: "{{ rsyslog_etc_path }}/50-default.conf"
+    dest: /etc/rsyslog.d/50-default.conf
     owner: root
     group: root
     mode: 0644
@@ -35,19 +35,8 @@
 
 - name: manage default rules
   file:
-    path: "{{ rsyslog_etc_path }}/50-default.conf"
+    path: /etc/rsyslog.d/50-default.conf
     state: "{{ rsyslog_default_rules_state }}"
-  notify: restart rsyslog
-
-- name: configure rsyslog.d rules
-  ansible.builtin.copy:
-    dest: "{{ rsyslog_etc_path }}/{{ item.priority }}-{{ item.name }}.conf"
-    owner: root
-    group: root
-    mode: 0644
-    content: "{{ item.content }}"
-  loop: "{{ rsyslog_d | default([]) }}"
-  notify: restart rsyslog
 
 - name: manage service
   service:

roles/unattended-upgrades/defaults/main.yaml

@@ -21,10 +21,10 @@ unattended_upgrades_unattended_upgrade: true
 unattended_upgrades_allowed_origins:
   - "${distro_id}:${distro_codename}"
   - "${distro_id}:${distro_codename}-security"
-  - "${distro_id}:${distro_codename}-updates"
-  # - "${distro_id}:${distro_codename}-backports"
+  - "${distro_id}ESM:${distro_codename}"
+  # - "${distro_id}:${distro_codename}-updates"
   # - "${distro_id}:${distro_codename}-proposed"
-  # - "${distro_id}ESM:${distro_codename}"
+  # - "${distro_id}:${distro_codename}-backports"
 
 # List of packages to not update (regexp are supported)
 # unattended_upgrades_package_blacklist: []

roles/wireguard/templates/wg-multi.conf.j2

@@ -15,9 +15,6 @@ Address = {{ address }}
 {%   if "listen_port" in i %}
 ListenPort = {{ i.listen_port }}
 {%   endif %}
-{%   if "table" in i %}
-Table = {{ i.table }}
-{%   endif %}
 {% endmacro -%}
 
 {%- macro render_peer(p) %}
@@ -38,12 +35,6 @@ AllowedIPs = {{ p.allowed_ips }}
 AllowedIPs = {{ p.allowed_ips | join(', ') }}
 {%     endif %}
 {%   endif %}
-{%   if "preshared_key" in p %}
-PresharedKey = {{ p.preshared_key }}
-{%   endif %}
-{%   if "persistent_keepalive" in p %}
-PersistentKeepalive = {{ p.persistent_keepalive }}
-{%   endif %}
 {% endmacro -%}
 
 {% if wireguard_interfaces[_wireguard_interface] and