# Reverse proxy for all cloud services.
# the vhosts serve https using certs in /etc/letsencrypt
- name: Install nginx (+certbot when TLS is on)
  package:
    name: "{{ ['nginx', 'certbot'] if cloud_nginx_tls | default(false) else ['nginx'] }}"
    state: present

- name: Create ACME webroot
  file:
    path: /var/www/letsencrypt
    state: directory
    mode: "0755"
  when: cloud_nginx_tls | default(false)

- name: Template vhosts
  template:
    src: cloud_nginx/vhost.conf.j2
    dest: "/etc/nginx/sites-available/{{ item.name }}"
    mode: "0644"
  loop: "{{ cloud_nginx_sites }}"
  notify: reload nginx

- name: Enable vhosts
  file:
    src: "/etc/nginx/sites-available/{{ item.name }}"
    dest: "/etc/nginx/sites-enabled/{{ item.name }}"
    state: link
  loop: "{{ cloud_nginx_sites }}"
  notify: reload nginx

- name: Disable default site
  file:
    path: /etc/nginx/sites-enabled/default
    state: absent
  notify: reload nginx

- name: Enable nginx
  systemd:
    name: nginx
    enabled: yes
    state: started