Replace caddy with nginx, gitea with forgejo, minor ansible deprecation fixes

group_vars/gitea.yml

@@ -4,7 +4,7 @@ firewalld_extra_allow_ports:
   - "80/tcp"
   - "443/tcp"
 
-gitea_version: 1.22.6
+gitea_version: 15.0.8
 gitea_database: mysql
 gitea_hostname: git.almalinux.org
 
@@ -53,7 +53,8 @@ gitea_config:
       APP_DATA_PATH: /var/lib/gitea/data
       DOMAIN: "{{ gitea_hostname }}"
       SSH_DOMAIN: "{{ gitea_hostname }}"
-      HTTP_PORT: 3000
+      HTTP_ADDR: "{{ gitea_listen_address }}"
+      HTTP_PORT: "{{ gitea_listen_port }}"
       DISABLE_SSH: "false"
       SSH_PORT: 22
       SSH_LISTEN_PORT: 22

requirements.yml

@@ -16,4 +16,7 @@ roles:
       src: git+https://github.com/TerryHowe/ansible-modules-hashivault.git
     - name: geerlingguy.postgresql
     - name: geerlingguy.mysql
+      # 6.0.0 is the first release whose conditionals are boolean, as
+      # ansible >= 2.19 requires
+      version: 6.5.0
     - name: geerlingguy.php

roles/gitea/defaults/main.yml

@@ -2,3 +2,22 @@
 gitea_database: sqlite
 gitea_hostname: localhost.localdomain
 gitea_cache: ''
+
+# Backend gitea listens on; nginx proxies to it
+gitea_listen_address: 127.0.0.1
+gitea_listen_port: 3000
+
+# Extra names to include on the certificate / vhost
+gitea_extra_domains: []
+
+# Git pushes and LFS uploads can be large
+gitea_client_max_body_size: 512M
+
+# Certbot authentication method: http | dns_route53 | dns_cloudflare
+gitea_certbot_auth: http
+gitea_cloudflare_propagation_seconds: 30
+
+# Only required when gitea_certbot_auth is dns_route53 / dns_cloudflare
+gitea_route53_access_key: ''
+gitea_route53_secret_key: ''
+gitea_cloudflare_api_token: ''

roles/gitea/handlers/main.yml

@@ -8,7 +8,12 @@
     name: gitea
     state: restarted
 
-- name: Restart caddy
+- name: Reload nginx
   ansible.builtin.systemd_service:
-    name: caddy.service
+    name: nginx.service
+    state: reloaded
+
+- name: Restart nginx
+  ansible.builtin.systemd_service:
+    name: nginx.service
     state: restarted

roles/gitea/tasks/certbot-obtain.yml

@@ -0,0 +1,57 @@
+---
+- name: Check for existing certbot-managed certificate
+  ansible.builtin.stat:
+    path: /etc/letsencrypt/renewal/{{ gitea_hostname }}.conf
+  register: gitea_certbot_renewal_check
+  tags: certbot
+
+- name: Remove placeholder certificate before certbot provisioning
+  ansible.builtin.file:
+    path: /etc/letsencrypt/live/{{ gitea_hostname }}
+    state: absent
+  when: not gitea_certbot_renewal_check.stat.exists
+  tags: certbot
+
+- name: Obtain SSL certificate with certbot # noqa no-changed-when
+  ansible.builtin.shell: >
+    certbot certonly
+    {% if gitea_certbot_auth == 'dns_route53' %}
+    --dns-route53
+    {% elif gitea_certbot_auth == 'dns_cloudflare' %}
+    --dns-cloudflare --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini
+    --dns-cloudflare-propagation-seconds {{ gitea_cloudflare_propagation_seconds }}
+    {% else %}
+    --webroot -w /var/lib/letsencrypt
+    {% endif %}
+    --cert-name {{ gitea_hostname }}
+    -d {{ gitea_hostname }}
+    {% for domain in gitea_extra_domains %}
+    -d {{ domain }}
+    {% endfor %}
+    -m {{ certbot_email }} --agree-tos -n
+    --deploy-hook /etc/letsencrypt/deploy-nginx.sh
+  when: not gitea_certbot_renewal_check.stat.exists
+  register: gitea_certbot_result
+  failed_when:
+    - gitea_certbot_result.rc is defined
+    - gitea_certbot_result.rc != 0
+    - gitea_certbot_auth != 'http'
+  tags: certbot
+
+- name: Check for SSL certificate after obtainment
+  ansible.builtin.stat:
+    path: /etc/letsencrypt/live/{{ gitea_hostname }}/fullchain.pem
+  register: gitea_le_cert_check
+  tags: certbot
+
+- name: Update vhost config with real certificate paths
+  ansible.builtin.template:
+    src: nginx/gitea.conf.j2
+    dest: /etc/nginx/conf.d/{{ gitea_hostname }}.conf
+    mode: "0644"
+    owner: root
+    group: root
+  vars:
+    _ssl_cert_path: "{{ '/etc/letsencrypt/live/' ~ gitea_hostname if gitea_le_cert_check.stat.exists else '/etc/pki/nginx/' ~ gitea_hostname }}"
+  notify: Reload nginx
+  tags: certbot

roles/gitea/tasks/certbot.yml

@@ -0,0 +1,107 @@
+---
+- name: Route53 tasks
+  ansible.builtin.include_tasks: route53.yml
+  when: gitea_certbot_auth == 'dns_route53'
+  tags: certbot
+
+- name: Install certbot
+  ansible.builtin.package:
+    name:
+      - certbot
+    state: present
+  tags: certbot
+
+- name: Install certbot Route53 plugin
+  ansible.builtin.package:
+    name:
+      - python3-certbot-dns-route53
+    state: present
+  when: gitea_certbot_auth == 'dns_route53'
+  tags: certbot
+
+- name: Install certbot Cloudflare plugin
+  ansible.builtin.package:
+    name:
+      - python3-certbot-dns-cloudflare
+    state: present
+  when: gitea_certbot_auth == 'dns_cloudflare'
+  tags: certbot
+
+- name: Ensure Let's Encrypt directory exists
+  ansible.builtin.file:
+    path: /etc/letsencrypt
+    state: directory
+    mode: "0700"
+  tags: certbot
+
+- name: Cloudflare credentials
+  ansible.builtin.include_tasks: cloudflare.yml
+  when: gitea_certbot_auth == 'dns_cloudflare'
+  tags: certbot
+
+- name: Create ACME webroot directory
+  ansible.builtin.file:
+    path: /var/lib/letsencrypt/.well-known/acme-challenge
+    state: directory
+    mode: "0755"
+    owner: root
+    group: root
+  tags: certbot
+
+- name: Start/enable certbot renew timer
+  ansible.builtin.systemd_service:
+    name: certbot-renew.timer
+    enabled: true
+    state: started
+  tags: certbot
+
+- name: Configure certbot deploy hook
+  ansible.builtin.template:
+    src: certbot-deploy-hook.sh.j2
+    dest: /etc/letsencrypt/deploy-nginx.sh
+    mode: "0755"
+  tags: certbot
+
+- name: Create self-signed certificate directory
+  ansible.builtin.file:
+    path: /etc/pki/nginx/{{ gitea_hostname }}
+    state: directory
+    mode: "0700"
+  tags: certbot
+
+- name: Generate self-signed certificate for initial nginx startup # noqa no-changed-when
+  ansible.builtin.command:
+    cmd: >
+      openssl req -x509 -nodes -days 365 -newkey rsa:2048
+      -keyout /etc/pki/nginx/{{ gitea_hostname }}/privkey.pem
+      -out /etc/pki/nginx/{{ gitea_hostname }}/fullchain.pem
+      -subj '/CN={{ gitea_hostname }}'
+    creates: /etc/pki/nginx/{{ gitea_hostname }}/fullchain.pem
+  tags: certbot
+
+- name: Check for existing certbot renewal config (DNS pre-fetch)
+  ansible.builtin.stat:
+    path: /etc/letsencrypt/renewal/{{ gitea_hostname }}.conf
+  register: gitea_certbot_dns_check
+  tags: certbot
+
+- name: Obtain DNS-auth certificate before nginx startup # noqa no-changed-when
+  ansible.builtin.shell: >
+    certbot certonly
+    {% if gitea_certbot_auth == 'dns_route53' %}
+    --dns-route53
+    {% elif gitea_certbot_auth == 'dns_cloudflare' %}
+    --dns-cloudflare --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini
+    --dns-cloudflare-propagation-seconds {{ gitea_cloudflare_propagation_seconds }}
+    {% endif %}
+    --cert-name {{ gitea_hostname }}
+    -d {{ gitea_hostname }}
+    {% for domain in gitea_extra_domains %}
+    -d {{ domain }}
+    {% endfor %}
+    -m {{ certbot_email }} --agree-tos -n
+    --deploy-hook /etc/letsencrypt/deploy-nginx.sh
+  when:
+    - not gitea_certbot_dns_check.stat.exists
+    - gitea_certbot_auth != 'http'
+  tags: certbot

roles/gitea/tasks/cloudflare.yml

@@ -0,0 +1,8 @@
+---
+- name: Write Cloudflare credentials file
+  ansible.builtin.template:
+    src: cloudflare.ini.j2
+    dest: /etc/letsencrypt/cloudflare.ini
+    mode: "0600"
+    owner: root
+    group: root

roles/gitea/tasks/main.yml

@@ -10,9 +10,13 @@
 
 - name: Download gitea binary
   ansible.builtin.get_url:
-    url: https://dl.gitea.com/gitea/{{ gitea_version }}/gitea-{{ gitea_version }}-linux-amd64
+    url: "{{ _gitea_url }}"
+    checksum: "sha256:{{ _gitea_url }}.sha256"
     dest: /usr/local/bin/gitea
     mode: "0755"
+  vars:
+    _gitea_url: https://code.forgejo.org/forgejo/forgejo/releases/download/v{{ gitea_version }}/forgejo-{{ gitea_version }}-linux-amd64
+  notify: Restart Gitea
 
 - name: Create system user
   ansible.builtin.user:
@@ -56,5 +60,11 @@
     state: started
     enabled: true
 
-- name: Configure caddy reverse proxy
-  ansible.builtin.include_tasks: caddy.yml
+- name: Certbot
+  ansible.builtin.include_tasks: certbot.yml
+
+- name: Configure nginx reverse proxy
+  ansible.builtin.include_tasks: nginx.yml
+
+- name: Obtain SSL certificate
+  ansible.builtin.include_tasks: certbot-obtain.yml

roles/gitea/tasks/nginx.yml

@@ -0,0 +1,87 @@
+---
+- name: Ensure Caddy is stopped and disabled
+  ansible.builtin.systemd_service:
+    name: caddy.service
+    state: stopped
+    enabled: false
+  failed_when: false
+  tags:
+    - nginx
+
+- name: Remove Caddy configuration
+  ansible.builtin.file:
+    path: /etc/caddy/Caddyfile
+    state: absent
+  tags:
+    - nginx
+
+- name: Install nginx and brotli module
+  ansible.builtin.dnf:
+    name:
+      - nginx
+      - nginx-mod-brotli
+    state: present
+  tags:
+    - nginx
+
+- name: Gather package facts for nginx version check
+  ansible.builtin.package_facts:
+    manager: auto
+  tags:
+    - nginx
+
+- name: Allow nginx to proxy to backend (SELinux)
+  ansible.posix.seboolean:
+    name: httpd_can_network_connect
+    state: true
+    persistent: true
+  tags:
+    - nginx
+    - selinux
+
+- name: Distribute /etc/nginx/nginx.conf
+  ansible.builtin.template:
+    src: nginx/nginx.conf.j2
+    dest: /etc/nginx/nginx.conf
+    mode: "0644"
+    owner: root
+    group: root
+  notify: Reload nginx
+  tags:
+    - nginx
+
+- name: Check for Let's Encrypt certificate
+  ansible.builtin.stat:
+    path: /etc/letsencrypt/live/{{ gitea_hostname }}/fullchain.pem
+  register: gitea_le_cert_check
+  tags:
+    - nginx
+
+- name: Distribute gitea vhost configuration
+  ansible.builtin.template:
+    src: nginx/gitea.conf.j2
+    dest: /etc/nginx/conf.d/{{ gitea_hostname }}.conf
+    mode: "0644"
+    owner: root
+    group: root
+  vars:
+    _ssl_cert_path: "{{ '/etc/letsencrypt/live/' ~ gitea_hostname if gitea_le_cert_check.stat.exists else '/etc/pki/nginx/' ~ gitea_hostname }}"
+  notify: Reload nginx
+  tags:
+    - nginx
+
+- name: Remove default nginx site configuration
+  ansible.builtin.file:
+    path: /etc/nginx/conf.d/default.conf
+    state: absent
+  notify: Reload nginx
+  tags:
+    - nginx
+
+- name: Start/enable nginx
+  ansible.builtin.systemd_service:
+    name: nginx.service
+    state: started
+    enabled: true
+  tags:
+    - nginx