Add netbox role

Kinda ouroborosish if you think about it. Better don’t.

roles/nginx/files/default.conf

@@ -0,0 +1,11 @@
+# handle .well-known and HTTPS redirect for all domains
+server {
+	listen 80 default_server;
+	listen [::]:80 default_server;
+	location /.well-known/ {
+		alias /srv/http/.well-known/;
+	}
+	location / {
+		return 301 https://$host$request_uri;
+	}
+}

roles/nginx/handlers/main.yml

@@ -0,0 +1,5 @@
+- name: reload nginx
+  service:
+    name: nginx
+    state: reloaded
+  when: "'handler' not in ansible_skip_tags"

roles/nginx/tasks/main.yml

@@ -0,0 +1,39 @@
+- name: Install packages
+  package:
+    name:
+      - certbot
+      - nginx
+
+- name: Create HTTP server directories
+  file:
+    path: /srv/http/.well-known
+    recurse: true
+    state: directory
+    owner: nginx
+    group: nginx
+
+- name: Set up default HTTP server
+  copy:
+    dest: /etc/nginx/http.d
+    src: default.conf
+  notify: reload nginx
+
+- name: Enable nginx service
+  service:
+    name: nginx
+    enabled: true
+    state: started
+
+- name: Get LE certificate
+  command:
+    cmd: certbot certonly --non-interactive --agree-tos --register-unsafely-without-email --webroot --webroot-path /srv/http -d {{ item }}
+    creates: '/etc/letsencrypt/renewal/{{ item }}.conf'
+  loop: '{{ fqdns }}'
+
+- name: Enable certbot renewal
+  cron:
+    name: "certbot renew"
+    job: "certbot renew --quiet"
+    user: root
+    hour: "2,14"
+    minute: "18"