# ---- MÅSTE ändras innan första körning (site.yml avbryter annars) ----
site_domain: "50ohm.se"
site_admin_email: "carl@vargklint.se"          # används av Let's Encrypt
# Git-källor för den svenska versionen. Byt till dina egna repon/forkar.
fiftyohm_repo: "https://git.nyaaa.net/Superminaren/50ohm.git"
fiftyohm_contents_dl_repo: "https://git.nyaaa.net/Superminaren/50ohm-contents-dl.git"
# -----------------------------------------------------------------------

fiftyohm_user: fiftyohm
fiftyohm_group: fiftyohm
destination_path: "/srv/{{ site_domain }}"
fiftyohm_branch: sv
fiftyohm_contents_dl_branch: sv

certbot_install_method: package
certbot_auto_renew: true
certbot_auto_renew_user: www-data
certbot_auto_renew_hour: "5"
certbot_auto_renew_minute: "15"
certbot_create_if_missing: true
certbot_create_method: webroot
certbot_admin_email: "{{ site_admin_email }}"
certbot_certs:
  - domains:
      - "{{ site_domain }}"
      - "www.{{ site_domain }}"
    webroot: "{{ destination_path }}/letsencrypt"

nginx_listen_ipv6: true
nginx_remove_default_vhost: true
nginx_user: www-data
nginx_worker_processes: "{{ ansible_processor_vcpus|default(ansible_processor_count) }}"
nginx_worker_connections: "1024"
nginx_multi_accept: "off"
nginx_error_log: "/var/log/nginx/error.log warn"
nginx_accept_log: "/var/log/nginx/access.log main buffer=16k flush=2m"
nginx_vhosts:
  - server_name: "{{ site_domain }}"
    listen: "443 ssl http2"
    filename: 50ohm-https.conf
    root: "{{ destination_path }}/50ohm/build"
    index: "index.html"
    state: "present"
    extra_parameters: |
      location "/" {
        try_files $uri $uri/ =404;
      }
      # Contact details: never indexed (also a robots meta tag and Disallow in robots.txt)
      location = /kontakt.html {
        add_header X-Robots-Tag "noindex, nofollow, noarchive, nosnippet" always;
        try_files $uri =404;
      }

      ssl_certificate /etc/letsencrypt/live/{{ site_domain }}/fullchain.pem;
      ssl_certificate_key /etc/letsencrypt/live/{{ site_domain }}/privkey.pem;
  - server_name: "www.{{ site_domain }}"
    listen: "443 ssl http2"
    filename: 50ohm-https-redirect.conf
    state: "present"
    extra_parameters: |
      ssl_certificate /etc/letsencrypt/live/{{ site_domain }}/fullchain.pem;
      ssl_certificate_key /etc/letsencrypt/live/{{ site_domain }}/privkey.pem;
      return 301 https://{{ site_domain }}$request_uri;
  - server_name: "{{ site_domain }}"
    listen: "80"
    filename: 50ohm-http.conf
    server_name_redirect: "www.{{ site_domain }}"
    root: "{{ destination_path }}/50ohm/build"
    state: "present"
    extra_parameters: |
      # Add the letsencrypt webroot for certbot challenges
      location "/.well-known/acme-challenge/" {
        root {{ destination_path }}/letsencrypt;
      }
      location "/" {
        return 301 https://{{ site_domain }}$request_uri;
      }