From f86afc5e3ae9054df583d38d6f71c402ee7b143f Mon Sep 17 00:00:00 2001 From: Robert Kaussow Date: Sat, 2 Feb 2019 00:57:15 +0100 Subject: [PATCH] add nginx vhost config --- defaults/main.yml | 16 ++++++++++++++ tasks/main.yml | 2 ++ tasks/nginx.yml | 48 ++++++++++++++++++++++++++++++++++++++++ templates/nginx/vhost.j2 | 38 +++++++++++++++++++++++++++++++ 4 files changed, 104 insertions(+) create mode 100644 tasks/nginx.yml create mode 100644 templates/nginx/vhost.j2 diff --git a/defaults/main.yml b/defaults/main.yml index 59def40..f7bc9a4 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -40,6 +40,7 @@ jellyfin_logrotate_config: - compress - shred +jellyfin_base_url: mystream.example.com # DONT CHANGE IT! # Changing the bind ports is currently not supported jellyfin_http_bind_port: 8096 @@ -56,3 +57,18 @@ jellyfin_open_ports: rules: | -A OUTPUT -m state --state NEW -p udp --destination 239.255.255.250 --dport 1900 -j ACCEPT state: present + + +jellyfin_tls_cert_source: mycert.pem +jellyfin_tls_key_source: mykey.pem + +jellyfin_nginx_vhost_enabled: False +jellyfin_nginx_server: localhost +jellyfin_nginx_vhost_dir: /etc/nginx/sites-available +jellyfin_nginx_vhost_symlink: /etc/nginx/sites-enabled +jellyfin_nginx_iptables_enabled: False +jellyfin_nginx_tls_enabled: False +jellyfin_nginx_tls_cert_file: jellyfin-cert.pem +jellyfin_nginx_tls_key_file: jellyfin-key.pem +jellyfin_nginx_proxy_port: "{{ jellyfin_http_bind_port }}" +jellyfin_nginx_proxy_ip: "{{ ansible_default_ipv4.address }}" diff --git a/tasks/main.yml b/tasks/main.yml index a27688c..5fcc207 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -3,4 +3,6 @@ - import_tasks: storage.yml when: jellyfin_lvm_enabled - include_tasks: install.yml +- import_tasks: nginx.yml + when: matrix_nginx_vhost_enabled - include_tasks: post_tasks.yml diff --git a/tasks/nginx.yml b/tasks/nginx.yml new file mode 100644 index 0000000..bc4e353 --- /dev/null +++ b/tasks/nginx.yml @@ -0,0 +1,48 @@ +--- +- block: + - name: Copy certs and private key to nginx proxy + copy: + src: "{{ item.src }}" + dest: "{{ item.dest }}" + mode: "{{ item.mode }}" + loop: + - { src: "{{ jellyfin_tls_key_source }}", dest: '/etc/pki/tls/private/{{ jellyfin_nginx_tls_key_file }}', mode: '0600' } + - { src: "{{ jellyfin_tls_cert_source }}", dest: '/etc/pki/tls/certs/{{ jellyfin_nginx_tls_cert_file }}', mode: '0750' } + loop_control: + label: "{{ item.dest }}" + notify: __nginx_reload + delegate_to: "{{ jellyfin_nginx_server }}" + when: jellyfin_nginx_tls_enabled + become: True + become_user: root + tags: tls_renewal + +- block: + - name: Add vhost configuration file + template: + src: nginx/vhost.j2 + dest: "{{ jellyfin_nginx_vhost_dir }}/jellyfin" + owner: root + group: root + mode: 0640 + notify: __nginx_reload + + - name: Enable jellyfin vhost + file: + src: "{{ jellyfin_nginx_vhost_dir }}/jellyfin" + dest: "{{ jellyfin_nginx_vhost_symlink }}/jellyfin" + owner: root + group: root + state: link + notify: __nginx_reload + when: jellyfin_nginx_vhost_symlink is defined + + - name: Open ports in iptables + iptables_raw: + name: allow_jellyfin_nginx_proxy + state: present + rules: '-A OUTPUT -m state --state NEW -p tcp -d {{ jellyfin_nginx_proxy_ip }} --dport {{ jellyfin_nginx_proxy_port }} -j ACCEPT' + when: jellyfin_nginx_iptables_enabled + delegate_to: "{{ jellyfin_nginx_server }}" + become: True + become_user: root diff --git a/templates/nginx/vhost.j2 b/templates/nginx/vhost.j2 new file mode 100644 index 0000000..77c867d --- /dev/null +++ b/templates/nginx/vhost.j2 @@ -0,0 +1,38 @@ +#jinja2: lstrip_blocks: True +# {{ ansible_managed }} +upstream backend_jellyfin { + server {{ jellyfin_nginx_proxy_ip }}:{{ jellyfin_nginx_proxy_port }}; +} + +server { + listen 80; + server_name {{ jellyfin_base_url | urlsplit('hostname') }}; + + client_max_body_size 200M; + + {% if jellyfin_nginx_tls_enabled %} + return 301 https://$server_name$request_uri; + {% else %} + location / { + proxy_pass {{ 'https' if jellyfin_tls_enabled else 'http' }}://backend_jellyfin; + proxy_set_header X-Forwarded-For $remote_addr; + } + {% endif %} +} + +{% if jellyfin_nginx_tls_enabled %} +server { + listen 443 ssl; + server_name {{ jellyfin_base_url | urlsplit('hostname') }}; + + client_max_body_size 200M; + + location / { + proxy_pass {{ 'https' if jellyfin_tls_enabled else 'http' }}://backend_jellyfin; + proxy_set_header X-Forwarded-For $remote_addr; + } + + ssl_certificate /etc/pki/tls/certs/{{ jellyfin_nginx_tls_cert_file }}; + ssl_certificate_key /etc/pki/tls/private/{{ jellyfin_nginx_tls_key_file }}; +} +{% endif %}