deploy-speedtesters.yml

- hosts: speedtesters
  become: yes

  vars:
    certbot_admin_email: davidy@funkypenguin.co.nz
    certbot_auto_renew_user: root
    certbot_create_if_missing: true
    certbot_create_standalone_stop_services: []
    certbot_create_extra_args: 
    certbot_certs:
      - domains:
          - "{{ inventory_hostname }}"
    nginx_vhosts:
      - listen: "443 ssl http2"
        server_name: "{{ inventory_hostname }}"
        root: "/usr/share/nginx/html"
        index: "index.html index.htm"
        state: "present"
        template: "{{ nginx_vhost_template }}"
        filename: "certbot_test.conf"
        extra_parameters: |
          ssl_certificate     /etc/letsencrypt/live/{{ inventory_hostname }}/fullchain.pem;
          ssl_certificate_key /etc/letsencrypt/live/{{ inventory_hostname }}/privkey.pem;
          ssl_protocols       TLSv1.1 TLSv1.2;
          ssl_ciphers         HIGH:!aNULL:!MD5;

          location / {
              proxy_pass http://127.0.0.1:1231;
              proxy_set_header Host $host;
              proxy_set_header X-Real-IP $remote_addr;
              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $scheme;
          }          

  pre_tasks:
    - name: Update apt cache.
      apt: update_cache=true cache_valid_time=600
      when: ansible_os_family == 'Debian'
      changed_when: false

    - name: Install cron (Debian).
      apt: name=cron state=present
      when: ansible_os_family == 'Debian'

  roles:
    - geerlingguy.certbot
    - geerlingguy.nginx

  tasks:
    - name: Flush handlers in case any configs have changed.
      meta: flush_handlers

    - name: Test secure connection to SSL domain.
      uri:
        url: https://{{ inventory_hostname }}
        status_code: 200
      delegate_to: localhost
      become: false