stash

deploy/prod/playbook.yml

@@ -15,8 +15,9 @@
 # at a time, never the whole "toolshed" group in one run):
 #   ansible-playbook -i inventory.yml playbook.yml --limit my-server
 #
-# toolshed_repo_url, toolshed_domain, toolshed_handle_domain (optional),
-# toolshed_version (optional, defaults to "stable"), behind_tls_proxy and
+# toolshed_repo_url, toolshed_domain, toolshed_handle_domain (optional,
+# either may be a single domain or a list of domains), toolshed_version
+# (optional, defaults to "stable"), behind_tls_proxy and
 # toolshed_letsencrypt_email (required unless behind_tls_proxy is true) are
 # per-deployment and must be set as host_vars in inventory.yml (copy
 # inventory.example.yml) rather than here or via -e, so that each host in
@@ -53,11 +54,17 @@
     # proxying to gunicorn for every asset request.
     toolshed_static_dir: /var/www/toolshed-static
     # Domain(s) this server accepts registrations for (the "handle domain" -
-    # see the README's DNS section). Served as a static /local/domains
-    # fixture that the frontend's registration/pairing forms fetch to
-    # populate their domain dropdown (frontend/src/views/Register.vue,
-    # Pairing.vue) - without it that dropdown is just empty.
-    toolshed_register_domains: "{{ [toolshed_handle_domain | default(toolshed_domain)] | unique }}"
+    # see the README's DNS section). toolshed_handle_domain may be a single
+    # domain or a list; when unset it falls back to toolshed_domain (whole
+    # list, if that's a list too). Served as a static /local/domains fixture
+    # that the frontend's registration/pairing forms fetch to populate their
+    # domain dropdown (frontend/src/views/Register.vue, Pairing.vue) -
+    # without it that dropdown is just empty.
+    toolshed_handle_domain_or_default: "{{ toolshed_handle_domain | default(toolshed_domain) }}"
+    toolshed_register_domains: >-
+      {{ ([toolshed_handle_domain_or_default]
+          if toolshed_handle_domain_or_default is string
+          else toolshed_handle_domain_or_default) | unique }}
     # DoH resolvers the frontend falls back to for SRV lookups when it has
     # no cached preference yet, served as a static /local/dns fixture. These
     # match the frontend's own hardcoded fallback (frontend/src/dns.js), so
@@ -90,8 +97,18 @@
     # and doesn't necessarily have an A record pointing at this host at all
     # (see the README's DNS section), so it can't reliably serve an HTTP-01
     # challenge or ever show up as this nginx's Host header.
+    #
+    # toolshed_domain may be a single domain or a list (e.g. a bare domain
+    # plus a "www." alias). certbot names the Let's Encrypt certificate's
+    # live/ directory after whichever domain is passed first via -d, so
+    # toolshed_hostnames[0] (below) is used wherever the playbook needs to
+    # reference that directory by name.
+    toolshed_domain_checked: >-
+      {{ toolshed_domain | mandatory('toolshed_domain must be set as a host_var for ' ~ inventory_hostname) }}
     toolshed_hostnames: >-
-      {{ [toolshed_domain | mandatory('toolshed_domain must be set as a host_var for ' ~ inventory_hostname)] }}
+      {{ ([toolshed_domain_checked]
+          if toolshed_domain_checked is string
+          else toolshed_domain_checked) | unique }}
     # Generated once per host on the controller and reused on every
     # subsequent run against that host, keyed by inventory_hostname so
     # separate deployments never end up sharing a Django SECRET_KEY.
@@ -243,8 +260,8 @@
           listen [::]:443 ssl;
           server_name {{ toolshed_hostnames | join(' ') }};
 
-          ssl_certificate     /etc/letsencrypt/live/{{ toolshed_domain }}/fullchain.pem;
-          ssl_certificate_key /etc/letsencrypt/live/{{ toolshed_domain }}/privkey.pem;
+          ssl_certificate     /etc/letsencrypt/live/{{ toolshed_hostnames[0] }}/fullchain.pem;
+          ssl_certificate_key /etc/letsencrypt/live/{{ toolshed_hostnames[0] }}/privkey.pem;
 
           client_max_body_size 128M;
           root {{ toolshed_dist_dir }};
@@ -330,19 +347,13 @@
       # until reloaded.
       notify: reload nginx
 
-    # Owned by ansible_user rather than www-data up front: the frontend dist
-    # sync below pushes files over a plain rsync-over-ssh connection as
-    # ansible_user (synchronize shells out to the local rsync binary, which
-    # opens its own ssh session - it doesn't go through Ansible's become),
-    # so that account needs write access here first. "Fix ownership of
-    # exported frontend build" resets this to www-data (via become) right
-    # after the sync completes.
     - name: Create frontend static output directory
       ansible.builtin.file:
         path: "{{ toolshed_dist_dir }}"
         state: directory
-        owner: "{{ ansible_user }}"
-        mode: "0755"
+        owner: "www-data"
+        group: "www-data"
+        mode: "0750"
 
     - name: Create backend static output directory
       ansible.builtin.file:
@@ -350,7 +361,7 @@
         state: directory
         owner: www-data
         group: www-data
-        mode: "0755"
+        mode: "0750"
 
     - name: Write backend environment file
       ansible.builtin.copy:
@@ -570,7 +581,7 @@
 
     - name: Check for an existing Let's Encrypt certificate
       ansible.builtin.stat:
-        path: "/etc/letsencrypt/live/{{ toolshed_domain }}/fullchain.pem"
+        path: "/etc/letsencrypt/live/{{ toolshed_hostnames[0] }}/fullchain.pem"
       register: toolshed_cert
       when: not (behind_tls_proxy | default(false) | bool)
 
@@ -633,7 +644,7 @@
 
     - name: Re-check the certificate now that certbot has run
       ansible.builtin.stat:
-        path: "/etc/letsencrypt/live/{{ toolshed_domain }}/fullchain.pem"
+        path: "/etc/letsencrypt/live/{{ toolshed_hostnames[0] }}/fullchain.pem"
       register: toolshed_cert
       when: not (behind_tls_proxy | default(false) | bool)