rabbitmq.yml

---
hostname: your-instance-fqdn

# Certbot
certbot_admin_email: security@your_domain.eu
certbot_agree_tos: --agree-tos
certbot_auth_method: --webroot
certbot_auto_renew: true
certbot_auto_renew_user: root
certbot_auto_renew_hour: "{{ 23 |random(seed=inventory_hostname)  }}"
certbot_auto_renew_minute: "{{ 59 |random(seed=inventory_hostname)  }}"
certbot_domains:
  - "{{ hostname }}"
certbot_environment: "staging"    # change to production when ready to go
certbot_install_method: virtualenv
certbot_share_key_users:
  - nginx
  - rabbitmq

certbot_post_renewal: |
    systemctl restart nginx || true
    systemctl restart rabbitmq-server || true
certbot_virtualenv_package_name: python3-virtualenv
certbot_virtualenv_command: virtualenv
certbot_well_known_root: /srv/nginx/_well-known_root


# NGINX
nginx_enable_default_server: false
nginx_servers:
  - rabbitmq
nginx_ssl_servers:
  - rabbitmq-ssl
nginx_remove_default_vhost: true

# Nginx Letsencrypt bindings
nginx_ssl_role: usegalaxy_eu.certbot
nginx_conf_ssl_certificate: /etc/ssl/certs/fullchain.pem
nginx_conf_ssl_certificate_key: /etc/ssl/user/privkey-nginx.pem

# RabbitMQ
rabbitmq_users:
  - user: mqadmin
    password: "{{ rabbitmq_users_password.mqadmin }}"
    tags: administrator
    vhost: /
  - user: galaxy
    password: "{{ rabbitmq_users_password.galaxy }}"
    vhost: galaxy

rabbitmq_plugins:
  - rabbitmq_management

rabbitmq_config:
  listeners:
    tcp: none
  ssl_listeners:
    default: 5671
  ssl_options:
    cacertfile: /etc/ssl/certs/fullchain.pem
    certfile: /etc/ssl/certs/cert.pem
    keyfile: /etc/ssl/user/privkey-rabbitmq.pem
    verify: verify_peer
    fail_if_no_peer_cert: 'false'

rabbitmq_container:
  name: rabbit_hole
  image: rabbitmq:3.9.11
  hostname: "{{ inventory_hostname }}"