Adding website hosting

inventories/production/group_vars/all.yml

@@ -107,6 +107,9 @@ forgejo_admin_password: "changeme_forgejo_admin"
 forgejo_admin_email: "admin@{{ base_domain }}"
 forgejo_ssh_port: 2222
 
+# Website
+website_nginx_version: "alpine"
+
 # SMTP (for services that send email)
 smtp_host: "stalwart"
 smtp_port: 587

playbooks/site.yml

@@ -29,3 +29,5 @@
       tags: [vaultwarden, passwords, vault]
     - role: forgejo
       tags: [forgejo, git, vcs]
+    - role: website
+      tags: [website, web]

roles/website/defaults/main.yml

@@ -0,0 +1,3 @@
+---
+website_data_dir: "{{ sovereign_base_dir }}/website"
+website_nginx_version: "alpine"

roles/website/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: restart website
+  community.docker.docker_compose_v2:
+    project_src: "{{ website_data_dir }}"
+    state: present
+    recreate: always

roles/website/tasks/main.yml

@@ -0,0 +1,21 @@
+---
+- name: Create website directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: '0755'
+  loop:
+    - "{{ website_data_dir }}"
+    - "{{ website_data_dir }}/html"
+
+- name: Deploy website docker-compose
+  ansible.builtin.template:
+    src: docker-compose.yml.j2
+    dest: "{{ website_data_dir }}/docker-compose.yml"
+    mode: '0644'
+  notify: restart website
+
+- name: Start website
+  community.docker.docker_compose_v2:
+    project_src: "{{ website_data_dir }}"
+    state: present

roles/website/templates/docker-compose.yml.j2

@@ -0,0 +1,24 @@
+services:
+  website:
+    image: nginx:{{ website_nginx_version }}
+    container_name: website
+    restart: unless-stopped
+    volumes:
+      - {{ website_data_dir }}/html:/usr/share/nginx/html:ro
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.website.rule=Host(`{{ base_domain }}`)"
+      - "traefik.http.routers.website.tls=true"
+      - "traefik.http.routers.website.tls.certresolver=letsencrypt"
+      - "traefik.http.services.website.loadbalancer.server.port=80"
+    networks:
+      - {{ sovereign_network_name }}
+    logging:
+      driver: gelf
+      options:
+        gelf-address: "udp://{{ graylog_host }}:{{ graylog_gelf_port }}"
+        tag: "website"
+
+networks:
+  {{ sovereign_network_name }}:
+    external: true