From cbd109adc0822485431fa64e4d552facf05ad02b Mon Sep 17 00:00:00 2001
From: Tharre <tharre3@gmail.com>
Date: Tue, 19 Feb 2019 05:33:14 +0100
Subject: Add znc role

---
 group_vars/all/znc.yml                |  2 ++
 playbooks/nyarlathotep.yml            |  1 +
 roles/znc/files/znc-certbot-hook      | 10 ++++++++++
 roles/znc/meta/main.yml               |  4 ++++
 roles/znc/tasks/main.yml              | 30 ++++++++++++++++++++++++++++++
 roles/znc/templates/znc_nginx.conf.j2 | 30 ++++++++++++++++++++++++++++++
 6 files changed, 77 insertions(+)
 create mode 100644 group_vars/all/znc.yml
 create mode 100644 roles/znc/files/znc-certbot-hook
 create mode 100644 roles/znc/meta/main.yml
 create mode 100644 roles/znc/tasks/main.yml
 create mode 100644 roles/znc/templates/znc_nginx.conf.j2

diff --git a/group_vars/all/znc.yml b/group_vars/all/znc.yml
new file mode 100644
index 0000000..e29ee2a
--- /dev/null
+++ b/group_vars/all/znc.yml
@@ -0,0 +1,2 @@
+---
+znc_subdomain: "znc.th73.ovh"
diff --git a/playbooks/nyarlathotep.yml b/playbooks/nyarlathotep.yml
index 649eb26..b5a971b 100644
--- a/playbooks/nyarlathotep.yml
+++ b/playbooks/nyarlathotep.yml
@@ -5,6 +5,7 @@
   roles:
     - { role: teamspeak, tags: ['ts3'] }
     - { role: nginx, tags: ['www'] }
+    - { role: znc, tags: ['znc'] }
     - { role: gitolite, git_config_keys: ".*", tags: ['git'] }
     - { role: grokmirror, tags: ['git'] }
     - { role: cgit, tags: ['cgit'] }
diff --git a/roles/znc/files/znc-certbot-hook b/roles/znc/files/znc-certbot-hook
new file mode 100644
index 0000000..03273a8
--- /dev/null
+++ b/roles/znc/files/znc-certbot-hook
@@ -0,0 +1,10 @@
+#/bin/sh
+set -e
+
+for domain in $RENEWED_DOMAINS; do
+	case $domain in
+		znc.th73.ovh)
+			cat /etc/letsencrypt/live/znc.th73.ovh/{privkey.pem,cert.pem,chain.pem} > /var/lib/znc/.znc/znc.pem
+			;;
+	esac
+done
diff --git a/roles/znc/meta/main.yml b/roles/znc/meta/main.yml
new file mode 100644
index 0000000..5938332
--- /dev/null
+++ b/roles/znc/meta/main.yml
@@ -0,0 +1,4 @@
+---
+
+dependencies:
+  - { role: nginx }
diff --git a/roles/znc/tasks/main.yml b/roles/znc/tasks/main.yml
new file mode 100644
index 0000000..bf3d3ff
--- /dev/null
+++ b/roles/znc/tasks/main.yml
@@ -0,0 +1,30 @@
+---
+
+- name: Install znc
+  package:
+    name: znc
+    state: present
+
+- name: Install certbot hook
+  copy:
+    src: znc-certbot-hook
+    dest: /etc/letsencrypt/renewal-hooks/deploy/znc
+    owner: root
+    group: root
+    mode: 0755
+
+- name: Copy nginx conf file
+  template:
+    src: znc_nginx.conf.j2
+    dest: /etc/nginx/nginx.d/znc.conf
+    mode: 0644
+    owner: "root"
+    group: "root"
+  notify:
+    - reload nginx
+
+- name: Enable znc
+  service:
+    name: znc.service
+    state: started
+    enabled: yes
diff --git a/roles/znc/templates/znc_nginx.conf.j2 b/roles/znc/templates/znc_nginx.conf.j2
new file mode 100644
index 0000000..b11e6e3
--- /dev/null
+++ b/roles/znc/templates/znc_nginx.conf.j2
@@ -0,0 +1,30 @@
+# {{ ansible_managed }}
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name {{ znc_subdomain }};
+
+    include snippets/letsencrypt.conf;
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name {{ znc_subdomain }};
+
+    ssl_certificate         /etc/letsencrypt/live/{{ znc_subdomain }}/fullchain.pem;
+    ssl_certificate_key     /etc/letsencrypt/live/{{ znc_subdomain }}/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/{{ znc_subdomain }}/chain.pem;
+
+    location / {
+        proxy_pass       http://localhost:7778;
+        proxy_set_header Host            $host;
+        proxy_set_header X-Real-IP       $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+}
-- 
cgit v1.2.3-70-g09d2