From 29d4f33a46faf5341747f684a8a97311e36f848b Mon Sep 17 00:00:00 2001 From: Alex Tavarez Date: Tue, 14 Jul 2026 14:43:49 -0400 Subject: [PATCH] inserted 'fqdn' variable so use of inventory hostname as a fully qualified domain name for managed node or target host services could be overridden --- init@homeserver.yml | 4 +-- init@vps.yml | 4 +-- .../tasks/contingent/pkg/certbot.yml | 8 ++--- .../tasks/contingent/pkg/dsnet.yml | 4 +-- .../tasks/contingent/pkg/skato_compose.yml | 4 +-- .../init-server/templates/user/certbot.env.j2 | 2 +- .../templates/user/config/caddy/Caddyfile.j2 | 32 ++++++++++++++----- vars/certbot_settings@homeserver.yml | 4 +-- vars/certbot_settings@vps.yml | 4 +-- 9 files changed, 41 insertions(+), 25 deletions(-) diff --git a/init@homeserver.yml b/init@homeserver.yml index f20bf01..8d0f531 100644 --- a/init@homeserver.yml +++ b/init@homeserver.yml @@ -34,13 +34,13 @@ - name: Updating hostname become: true ansible.builtin.hostname: - name: "{{ inventory_hostname }}" + name: "{{ fqdn | default(inventory_hostname) }}" - name: Updating hosts file become: true ansible.builtin.lineinfile: path: /etc/hosts regexp: "^127\\.0\\.1\\.1" - line: "127.0.1.1 {{ inventory_hostname }}" + line: "127.0.1.1 {{ fqdn | default(inventory_hostname) }}" insertbefore: BOF state: present - name: Updating host icon name diff --git a/init@vps.yml b/init@vps.yml index 9b78812..b63ef7b 100644 --- a/init@vps.yml +++ b/init@vps.yml @@ -37,13 +37,13 @@ - name: Updating hostname become: true ansible.builtin.hostname: - name: "{{ inventory_hostname }}" + name: "{{ fqdn | default(inventory_hostname) }}" - name: Updating hosts file become: true ansible.builtin.lineinfile: path: /etc/hosts regexp: "^127\\.0\\.1\\.1" - line: "127.0.1.1 {{ inventory_hostname }}" + line: "127.0.1.1 {{ fqdn | default(inventory_hostname) }}" insertbefore: BOF state: present - name: Updating host icon name diff --git a/roles/init-server/tasks/contingent/pkg/certbot.yml b/roles/init-server/tasks/contingent/pkg/certbot.yml index c806ea2..c47cda0 100644 --- a/roles/init-server/tasks/contingent/pkg/certbot.yml +++ b/roles/init-server/tasks/contingent/pkg/certbot.yml @@ -38,10 +38,10 @@ - name: Exemplifying needed ACME record ansible.builtin.set_fact: acme_record: | - {{ inventory_hostname }} IN A {{ ipify_public_ip }} - _acme-challenge.{{ inventory_hostname }} IN CNAME {{ inventory_hostname }}.acme.{{ inventory_hostname }}. - acme.{{ inventory_hostname }} IN NS ns.acme.{{ inventory_hostname }}. - ns.acme.{{ inventory_hostname }} IN A {{ ipify_public_ip }} + {{ fqdn | default(inventory_hostname) }} IN A {{ ipify_public_ip }} + _acme-challenge.{{ fqdn | default(inventory_hostname) }} IN CNAME {{ fqdn | default(inventory_hostname) }}.acme.{{ fqdn | default(inventory_hostname) }}. + acme.{{ fqdn | default(inventory_hostname) }} IN NS ns.acme.{{ fqdn | default(inventory_hostname) }}. + ns.acme.{{ fqdn | default(inventory_hostname) }} IN A {{ ipify_public_ip }} - name: Informing user of need to set up ACME record ansible.builtin.debug: msg: "Please set ACME record in domain name provider:\n {{ acme_record }}" diff --git a/roles/init-server/tasks/contingent/pkg/dsnet.yml b/roles/init-server/tasks/contingent/pkg/dsnet.yml index 69d7080..ecfe32f 100644 --- a/roles/init-server/tasks/contingent/pkg/dsnet.yml +++ b/roles/init-server/tasks/contingent/pkg/dsnet.yml @@ -67,12 +67,12 @@ when: data_method.user_input == "fetch" block: - name: Informing user of inventory requirements for VPN clients - when: not item.name in groups.homeserver + when: ((fqdn is undefined or fqdn == None) and item.name != fqdn) or not item.name in groups.homeserver ansible.builtin.fail: msg: The VPN client must be the name of an inventory host in a homeserver group loop: "{{ vpn.clients }}" - name: Dupliciating DSNet VPN service client configuration files to control node - when: item.name in groups.homeserver + when: ((fqdn is defined and fqdn != None) and item.name == fqdn) or item.name in groups.homeserver ansible.builtin.fetch: src: "{{ ansible_user_home.stdout }}/.wg/authorized_clients.d/{{ item.name }}{{ (idx | string) }}.conf" dest: "./.tmp/{{ inventory_hostname }}-dsnet/" diff --git a/roles/init-server/tasks/contingent/pkg/skato_compose.yml b/roles/init-server/tasks/contingent/pkg/skato_compose.yml index 560f9cc..24bdb2b 100644 --- a/roles/init-server/tasks/contingent/pkg/skato_compose.yml +++ b/roles/init-server/tasks/contingent/pkg/skato_compose.yml @@ -181,7 +181,7 @@ - name: Copying VPN client configuration files become: true become_user: "{{ current_user.stdout }}" - when: item.name == inventory_hostname + when: ((fqdn is defined and fqdn != None) and item.name == fqdn) or item.name == inventory_hostname ansible.builtin.copy: src: "user/wg/containerized/{{ item.name }}{{ (idx | string) }}.conf" dest: "{{ ansible_user_home.stdout }}/.wg/containerized/" @@ -772,7 +772,7 @@ - name: Creating required tailnet container secret for tailnet container specified by Compose file become: true # become_user: "{{ current_user.stdout }}" - when: item.name == inventory_hostname + when: ((fqdn is defined and fqdn != None) and item.name == fqdn) or item.name == inventory_hostname ansible.builtin.copy: src: "{{ item.name }}-{{ headscale.users.admin.username }}@headscale/headscale{{ (idx | string) }}.key" dest: "{{ ansible_user_home.stdout }}/.podsecrets/headscale.key" diff --git a/roles/init-server/templates/user/certbot.env.j2 b/roles/init-server/templates/user/certbot.env.j2 index a39bd61..c9a725b 100644 --- a/roles/init-server/templates/user/certbot.env.j2 +++ b/roles/init-server/templates/user/certbot.env.j2 @@ -1,6 +1,6 @@ CERTBOT_EMAIL="{{ certbot.email }}" CERTBOT_AUTHENTICATOR={{ certbot.auth_method }} -SERVER_WEBROOT_PATH={{ ansible_user_home.stdout + "/srv/acme." + inventory_hostname }} +SERVER_WEBROOT_PATH={{ ansible_user_home.stdout + "/srv/certbot." + (fqdn | default(inventory_hostname)) }} {% if compose.mode == "dev" %} # @TODO find a better way to have processed the below in Ansible CERTBOT_CHALLENGE_DOMAINS={{ certbot.domains | map("regex_replace", "\\.([^\\.]*)$", ".test") | list | join(",") }} diff --git a/roles/init-server/templates/user/config/caddy/Caddyfile.j2 b/roles/init-server/templates/user/config/caddy/Caddyfile.j2 index 8ab3ff9..c12c280 100644 --- a/roles/init-server/templates/user/config/caddy/Caddyfile.j2 +++ b/roles/init-server/templates/user/config/caddy/Caddyfile.j2 @@ -1,11 +1,27 @@ -http://<< inventory_hostname >> { - handle /.well-known/acme-challenge/* { - reverse_proxy localhost:80 - } +http://<< web_fqdn >> { + handle /.well-known/acme-challenge/* { + reverse_proxy localhost:80 + } + handle { + redir https://{host}{uri} 308 + } } - :80 { - root * /srv/<< inventory_hostname >> - file_server - encode gzip + root /srv/certbot.<< web_fqdn >> + browse +} +<< web_fqdn >> { + respond 503 + # root /srv/<< web_fqdn >> + file_server + + header /.well-known/openpgpkey/* { + Content-Type application/octet-stream + Access-Control-Allow-Origin * + } + + handle_errors { + rewrite /error/{err.status_code}.html + templates + } } diff --git a/vars/certbot_settings@homeserver.yml b/vars/certbot_settings@homeserver.yml index 3db1581..a3a2097 100644 --- a/vars/certbot_settings@homeserver.yml +++ b/vars/certbot_settings@homeserver.yml @@ -5,6 +5,6 @@ certbot: port: ~ email: ajt95@prole.biz domains: - - "{{ inventory_hostname }}" - - "*.{{ inventory_hostname }}" + - "{{ fqdn | default(inventory_hostname) }}" + - "*.{{ fqdn | default(inventory_hostname) }}" cron: "2 6 24 1 *" \ No newline at end of file diff --git a/vars/certbot_settings@vps.yml b/vars/certbot_settings@vps.yml index 89b7e49..2841533 100644 --- a/vars/certbot_settings@vps.yml +++ b/vars/certbot_settings@vps.yml @@ -5,6 +5,6 @@ certbot: port: 53 email: ajt95@prole.biz domains: - - "{{ inventory_hostname }}" - - "*.{{ inventory_hostname }}" + - "{{ fqdn | default(inventory_hostname) }}" + - "*.{{ fqdn | default(inventory_hostname) }}" cron: ~ \ No newline at end of file