ansible: add certbot role and serve origins from Let's Encrypt (#4523) * ansible: add certbot role using Cloudflare DNS-01 Installs the distro-packaged certbot and certbot-dns-cloudflare, writes a 0600 credentials file from the secrets repo, issues a certificate via DNS-01, and reloads nginx on renewal through a deploy hook. Renewal is handled by the packaged certbot.timer. Wire it into the ci and ci-release Jenkins plays to issue certificates for ci.nodejs.org and ci-release.nodejs.org. nginx is not yet pointed at the issued certificates. Co-Authored-By: Claude Sonnet 5.5 Signed-off-by: Ryan Aslett * ansible: certbot role fixes, run tags, and web host wiring Create the renewal-hooks/deploy directory before installing the hook so a first run on a fresh host works, and drop --deploy-hook since certbot already runs every script in that directory on renewal. Tag the certbot and jenkins-nginx role entries so each can be run alone with --tags without skipping its read-secrets dependency. Issue certificates on www (nodejs.org and *.nodejs.org) and on the unencrypted host. nginx is not yet pointed at them. Co-Authored-By: Claude Sonnet 5.5 Signed-off-by: Ryan Aslett * ansible: tag the certbot read-secrets dependency Tags on a role entry are not inherited by the tasks of its meta dependencies, so running with --tags certbot skipped the secrets decrypt step and left the Cloudflare token undefined. Tag the dependency so the certbot role can be run on its own. Co-Authored-By: Claude Sonnet 5.5 Signed-off-by: Ryan Aslett * ansible: switch certbot role to HTTP-01 with per-host certificates Issue one certificate per directly reachable origin name (ci, ci-release, direct and unencrypted) using certbot --webroot, instead of the Cloudflare DNS-01 plugin. This needs no API token and no DNS delegation, and keeps certbot distro-packaged. Serve /.well-known/acme-challenge/ from /var/www/letsencrypt on the port 80 vhosts, and add reload handlers plus an nginx-sites tag so those vhost changes can be deployed without running the whole nginx role. ci-release moves its port 80 redirect into a location so the challenge path is reachable. nginx is not yet pointed at the issued certificates. Co-Authored-By: Claude Sonnet 5.5 Signed-off-by: Ryan Aslett * ansible: serve ci-release from its Let's Encrypt certificate Point the ci-release nginx vhost at the certificate certbot issues for ci-release.nodejs.org and drop OCSP stapling, which Let's Encrypt no longer supports. Co-Authored-By: Claude Sonnet 5.5 Signed-off-by: Ryan Aslett * ansible: serve ci from its Let's Encrypt certificate Point the ci nginx vhost at the certificate certbot issues for ci.nodejs.org and drop OCSP stapling, which Let's Encrypt no longer supports. Co-Authored-By: Claude Sonnet 5.5 Signed-off-by: Ryan Aslett --------- Signed-off-by: Ryan Aslett Co-authored-by: Claude Sonnet 5.5

Sunbelt Computer Software

PL/B Language Development and Support