stash

deploy/prod/README.md

@@ -48,17 +48,27 @@ toolshed:
 ```
 
 - `toolshed_domain` — the **web domain**: the nginx `server_name`, Django
-  `ALLOWED_HOSTS`, and the hostname you'll point a TLS cert at — e.g.
-  `toolshed.webdomain.tld`. Required, no default. This is not necessarily the
-  same as the **handle domain** your users log in with (the part after `@`
-  in `user@yourtoolshed.tld`) — see [DNS](#3-dns) for how those two relate.
+  `ALLOWED_HOSTS`, and the hostname(s) you'll point a TLS cert at — e.g.
+  `toolshed.webdomain.tld`. Required, no default. May be a single domain (as
+  above) or a list, e.g. to also answer on a `www.` alias:
+  ```yaml
+  toolshed_domain:
+    - toolshed.webdomain.tld
+    - www.toolshed.webdomain.tld
+  ```
+  The Let's Encrypt certificate covers all of them, named on disk after
+  whichever one is listed first. This is not necessarily the same as the
+  **handle domain** your users log in with (the part after `@` in
+  `user@yourtoolshed.tld`) — see [DNS](#3-dns) for how those two relate.
 - `toolshed_handle_domain` — the **handle domain**, only needed when it's
   different from `toolshed_domain`. Omit it when the two are the same (it
-  then defaults to `toolshed_domain`). It doesn't affect nginx/Django at all
-  (they only ever accept `toolshed_domain` as the `Host` header) — it's used
+  then defaults to `toolshed_domain`). Like `toolshed_domain`, it may be a
+  single domain or a list, e.g. if this deployment accepts registrations for
+  more than one handle domain. It doesn't affect nginx/Django at all (they
+  only ever accept `toolshed_domain` as the `Host` header) — it's used
   solely to populate the `/local/domains` registration fixture (see
-  `toolshed_register_domains` in `playbook.yml`); publishing the SRV record is a
-  separate, manual DNS step either way.
+  `toolshed_register_domains` in `playbook.yml`); publishing the SRV record for
+  each handle domain is a separate, manual DNS step either way.
 - `toolshed_repo_url` — the git remote the playbook checks out and builds
   from. Required, no default.
 - `toolshed_version` — the branch, tag or commit to check out and build.

deploy/prod/inventory.example.yml

@@ -10,10 +10,21 @@ toolshed:
       ansible_user: deploy
       # toolshed_domain is the "web domain" - see the README's DNS section
       # for how this relates to the separate "handle domain" your users
-      # log in with (user@yourtoolshed.tld).
+      # log in with (user@yourtoolshed.tld). May be a single domain (as
+      # here) or a list, e.g. to also answer on a "www." alias:
+      #   toolshed_domain:
+      #     - toolshed.webdomain.tld
+      #     - www.toolshed.webdomain.tld
+      # The Let's Encrypt certificate is requested for all of them, named
+      # after whichever one is listed first.
       toolshed_domain: toolshed.webdomain.tld
       # Optional - only needed if the handle domain differs from the web
-      # domain above. Omit it entirely when they're the same.
+      # domain above. Omit it entirely when they're the same. Like
+      # toolshed_domain, this may be a single domain or a list, e.g. if this
+      # deployment accepts registrations for more than one handle domain:
+      #   toolshed_handle_domain:
+      #     - yourtoolshed.tld
+      #     - alt.yourtoolshed.tld
       toolshed_handle_domain: yourtoolshed.tld
       toolshed_repo_url: git@example.com:your-org/toolshed.git
       # Optional - branch, tag or commit to deploy. Defaults to "stable".

deploy/prod/playbook.yml

@@ -15,8 +15,9 @@
 # at a time, never the whole "toolshed" group in one run):
 #   ansible-playbook -i inventory.yml playbook.yml --limit my-server
 #
-# toolshed_repo_url, toolshed_domain, toolshed_handle_domain (optional),
-# toolshed_version (optional, defaults to "stable"), behind_tls_proxy and
+# toolshed_repo_url, toolshed_domain, toolshed_handle_domain (optional,
+# either may be a single domain or a list of domains), toolshed_version
+# (optional, defaults to "stable"), behind_tls_proxy and
 # toolshed_letsencrypt_email (required unless behind_tls_proxy is true) are
 # per-deployment and must be set as host_vars in inventory.yml (copy
 # inventory.example.yml) rather than here or via -e, so that each host in
@@ -53,11 +54,17 @@
     # proxying to gunicorn for every asset request.
     toolshed_static_dir: /var/www/toolshed-static
     # Domain(s) this server accepts registrations for (the "handle domain" -
-    # see the README's DNS section). Served as a static /local/domains
-    # fixture that the frontend's registration/pairing forms fetch to
-    # populate their domain dropdown (frontend/src/views/Register.vue,
-    # Pairing.vue) - without it that dropdown is just empty.
-    toolshed_register_domains: "{{ [toolshed_handle_domain | default(toolshed_domain)] | unique }}"
+    # see the README's DNS section). toolshed_handle_domain may be a single
+    # domain or a list; when unset it falls back to toolshed_domain (whole
+    # list, if that's a list too). Served as a static /local/domains fixture
+    # that the frontend's registration/pairing forms fetch to populate their
+    # domain dropdown (frontend/src/views/Register.vue, Pairing.vue) -
+    # without it that dropdown is just empty.
+    toolshed_handle_domain_or_default: "{{ toolshed_handle_domain | default(toolshed_domain) }}"
+    toolshed_register_domains: >-
+      {{ ([toolshed_handle_domain_or_default]
+          if toolshed_handle_domain_or_default is string
+          else toolshed_handle_domain_or_default) | unique }}
     # DoH resolvers the frontend falls back to for SRV lookups when it has
     # no cached preference yet, served as a static /local/dns fixture. These
     # match the frontend's own hardcoded fallback (frontend/src/dns.js), so
@@ -90,8 +97,18 @@
     # and doesn't necessarily have an A record pointing at this host at all
     # (see the README's DNS section), so it can't reliably serve an HTTP-01
     # challenge or ever show up as this nginx's Host header.
+    #
+    # toolshed_domain may be a single domain or a list (e.g. a bare domain
+    # plus a "www." alias). certbot names the Let's Encrypt certificate's
+    # live/ directory after whichever domain is passed first via -d, so
+    # toolshed_hostnames[0] (below) is used wherever the playbook needs to
+    # reference that directory by name.
+    toolshed_domain_checked: >-
+      {{ toolshed_domain | mandatory('toolshed_domain must be set as a host_var for ' ~ inventory_hostname) }}
     toolshed_hostnames: >-
-      {{ [toolshed_domain | mandatory('toolshed_domain must be set as a host_var for ' ~ inventory_hostname)] }}
+      {{ ([toolshed_domain_checked]
+          if toolshed_domain_checked is string
+          else toolshed_domain_checked) | unique }}
     # Generated once per host on the controller and reused on every
     # subsequent run against that host, keyed by inventory_hostname so
     # separate deployments never end up sharing a Django SECRET_KEY.
@@ -243,8 +260,8 @@
           listen [::]:443 ssl;
           server_name {{ toolshed_hostnames | join(' ') }};
 
-          ssl_certificate     /etc/letsencrypt/live/{{ toolshed_domain }}/fullchain.pem;
-          ssl_certificate_key /etc/letsencrypt/live/{{ toolshed_domain }}/privkey.pem;
+          ssl_certificate     /etc/letsencrypt/live/{{ toolshed_hostnames[0] }}/fullchain.pem;
+          ssl_certificate_key /etc/letsencrypt/live/{{ toolshed_hostnames[0] }}/privkey.pem;
 
           client_max_body_size 128M;
           root {{ toolshed_dist_dir }};
@@ -330,19 +347,13 @@
       # until reloaded.
       notify: reload nginx
 
-    # Owned by ansible_user rather than www-data up front: the frontend dist
-    # sync below pushes files over a plain rsync-over-ssh connection as
-    # ansible_user (synchronize shells out to the local rsync binary, which
-    # opens its own ssh session - it doesn't go through Ansible's become),
-    # so that account needs write access here first. "Fix ownership of
-    # exported frontend build" resets this to www-data (via become) right
-    # after the sync completes.
     - name: Create frontend static output directory
       ansible.builtin.file:
         path: "{{ toolshed_dist_dir }}"
         state: directory
-        owner: "{{ ansible_user }}"
-        mode: "0755"
+        owner: "www-data"
+        group: "www-data"
+        mode: "0750"
 
     - name: Create backend static output directory
       ansible.builtin.file:
@@ -350,7 +361,7 @@
         state: directory
         owner: www-data
         group: www-data
-        mode: "0755"
+        mode: "0750"
 
     - name: Write backend environment file
       ansible.builtin.copy:
@@ -570,7 +581,7 @@
 
     - name: Check for an existing Let's Encrypt certificate
       ansible.builtin.stat:
-        path: "/etc/letsencrypt/live/{{ toolshed_domain }}/fullchain.pem"
+        path: "/etc/letsencrypt/live/{{ toolshed_hostnames[0] }}/fullchain.pem"
       register: toolshed_cert
       when: not (behind_tls_proxy | default(false) | bool)
 
@@ -633,7 +644,7 @@
 
     - name: Re-check the certificate now that certbot has run
       ansible.builtin.stat:
-        path: "/etc/letsencrypt/live/{{ toolshed_domain }}/fullchain.pem"
+        path: "/etc/letsencrypt/live/{{ toolshed_hostnames[0] }}/fullchain.pem"
       register: toolshed_cert
       when: not (behind_tls_proxy | default(false) | bool)