Move certificates to files/ and use a wildcard certificate

.gitignore

@@ -1,7 +1,5 @@
 roles/mastodon/vars/main.yml
 host_vars/
 group_vars/
-roles/frontend/templates/cdn.fullchain.pem
-roles/frontend/templates/cdn.privkey.pem
-roles/frontend/templates/domain.fullchain.pem
-roles/frontend/templates/domain.privkey.pem
+roles/frontend/files/wildcard.fullchain.pem
+roles/frontend/files/wildcard.privkey.pem

hosts

@@ -1,18 +1,20 @@
 [yttrx]
 tusky.masto.yttrx.com
-wooly.masto.yttrx.com
+mammoth.masto.yttrx.com
+grafana.yttrx.com
+mail.yttrx.com
 
 [mastodon]
-wooly.masto.yttrx.com
+mammoth.masto.yttrx.com
 
 [frontend]
-wooly.masto.yttrx.com
+mammoth.masto.yttrx.com
 
 [webapp]
-wooly.masto.yttrx.com
+mammoth.masto.yttrx.com
 
 [sidekiq]
-wooly.masto.yttrx.com
+mammoth.masto.yttrx.com
 
 [yttrx:vars]
 ansible_python_interpreter=/usr/bin/python3

roles/frontend/tasks/main.yml

@@ -67,29 +67,29 @@
     - install
 
 - name: Install mastodon domain SSL certificate
-  template:
-    src: domain.fullchain.pem
+  copy:
+    src: wildcard.fullchain.pem
     dest: /etc/nginx/ssl/domain.fullchain.pem
   tags:
     - install
 
 - name: Install mastodon domain ssl key
-  template:
-    src: domain.privkey.pem
+  copy:
+    src: wildcard.privkey.pem
     dest: /etc/nginx/ssl/domain.privkey.pem
   tags:
     - install
 
 - name: Install mastodon CDN SSL certificate
-  template:
-    src: cdn.fullchain.pem
+  copy:
+    src: wildcard.fullchain.pem
     dest: /etc/nginx/ssl/cdn.fullchain.pem
   tags:
     - install
 
 - name: Install mastodon CDN ssl key
-  template:
-    src: cdn.privkey.pem
+  copy:
+    src: wildcard.privkey.pem
     dest: /etc/nginx/ssl/cdn.privkey.pem
   tags:
     - install

roles/frontend/templates/cdn.j2

@@ -12,7 +12,7 @@ log_format files_cache '$remote_addr - $upstream_cache_status [$time_local]  '
                     '"$request" $status $body_bytes_sent '
                     '"$http_referer" "$http_user_agent"';
 
-proxy_cache_path /data/nginx/cache keys_zone=mycache:50m inactive=3d;
+proxy_cache_path /data/nginx/cache keys_zone=mycache:50m inactive=7d;
 
 server {
   listen 443 ssl http2;
@@ -25,8 +25,8 @@ server {
   ssl_certificate     /etc/nginx/ssl/cdn.fullchain.pem;
   ssl_certificate_key /etc/nginx/ssl/cdn.privkey.pem;
 
-  access_log /var/log/nginx/{{ ENV_PRODUCTION['S3_ALIAS_HOST'] }}.access.log files_cache;
-  error_log /var/log/nginx/{{ ENV_PRODUCTION['S3_ALIAS_HOST'] }}.error.log;
+  access_log /var/log/nginx/cdn.access.log files_cache;
+  error_log /var/log/nginx/cdn.error.log;
 
   proxy_cache mycache;
   keepalive_timeout 30;

roles/frontend/templates/mastodon.j2

@@ -3,15 +3,17 @@ map $http_upgrade $connection_upgrade {
   ''      close;
 }
 
+{% for server in ENV_PRODUCTION['ALTERNATE_DOMAINS'] | split(",") %}
 server {
   listen 80;
   listen [::]:80;
-  server_name {{ ENV_PRODUCTION['LOCAL_DOMAIN'] }}
+  server_name {{ server }}
   root /home/mastodon/live/public;
   # Useful for Let's Encrypt
   location /.well-known/acme-challenge/ { allow all; }
   location / { return 301 https://$host$request_uri; }
 }
+{% endfor %}
 
 upstream webbackend {
 {% for server in webapp_hosts %}
@@ -25,10 +27,11 @@ upstream streamingbackend {
 {% endfor %}
 }
 
+{% for server in ENV_PRODUCTION['ALTERNATE_DOMAINS'] | split(",") %}
 server {
   listen 443 ssl http2;
   listen [::]:443 ssl http2;
-  server_name {{ ENV_PRODUCTION['LOCAL_DOMAIN'] }};
+  server_name {{ server }};
 
   include /etc/nginx/cloudflare;
 
@@ -56,6 +59,15 @@ server {
 
   add_header Strict-Transport-Security "max-age=31536000";
 
+{% if PREFERRED_ALT_DOMAIN and PREFERRED_ALT_DOMAIN != server %}
+  location = / {
+    rewrite / https://{{ PREFERRED_ALT_DOMAIN }}/ redirect;
+  }
+  location ~ ^/@(.+)?$ {
+    rewrite ^/(@.*) https://{{ PREFERRED_ALT_DOMAIN }}/$1 permanent;
+  }
+
+{% endif %}
   location / {
     try_files $uri @proxy;
   }
@@ -121,3 +133,4 @@ server {
 
   error_page 500 501 502 503 504 /500.html;
 }
+{% endfor %}

roles/mastodon/files/tootctl

@@ -1,4 +1,4 @@
 #!/bin/bash
 
 # Wrap around a docker command to invoke `tootctl`
-docker exec -it $(docker ps -f name=web -q | head -n1) bin/tootctl $*
+docker exec -it $(docker ps -f name=web -q | head -n1) bin/tootctl $@

roles/mastodon/tasks/maintenance.yml

@@ -23,6 +23,7 @@
     hour: "*/6"
   tags:
     - configure
+  when: TRIM_STORAGE is defined and TRIM_STORAGE
 
 - name: Install image puller
   copy:
@@ -53,3 +54,14 @@
     mode: '0755'
   tags:
     - install
+
+- name: Create cronjob for tootctl accounts prune
+  ansible.builtin.cron:
+    name: tootctl accounts prune
+    job: /usr/local/bin/tootctl accounts prune
+    weekday: "1"
+    minute: "0"
+    hour: "5"
+  tags:
+    - configure
+  when: PRUNE_ACCOUNTS is defined and PRUNE_ACCOUNTS

roles/sidekiq/default/main.yml

@@ -1,4 +1,3 @@
 ---
 sidekiq:
   - name: default
-    q: [ 'push', 'pull', 'default', 'ingress', 'mailer', 'scheduler' ]

roles/sidekiq/templates/docker-compose.sidekiq.yml.j2

@@ -9,7 +9,7 @@ services:
 {% if 'q' in SK %}
     command: bundle exec sidekiq -q {{ SK['q'] | join(' -q ') }} -c 10
 {% else %}
-    command: bundle exec sidekiq
+    command: bundle exec sidekiq -c 10
 {% endif %}
     depends_on:
       - pgbouncer

roles/sidekiq/vars/main.yml

@@ -1,4 +1,3 @@
 ---
 sidekiq:
   - name: default
-    q: [ 'push', 'pull', 'default', 'ingress', 'mailers', 'scheduler' ]

roles/yttrx/tasks/main.yml

@@ -1,6 +1,10 @@
 ---
 - import_tasks: swap.yml
 
+- name: Set timezone
+  timezone:
+    name: America/Los_Angeles
+
 - name: Install prometheus node exporter
   package:
     name: prometheus-node-exporter

roles/yttrx/tasks/nvim.yml

@@ -40,7 +40,24 @@
     name: unzip
     state: present
 
+- name: install clang
+  package:
+    name: clang
+    state: present
+
+- name: install npm
+  package:
+    name: npm
+    state: present
+
 - name: Install python3.10-venv
   package:
     name: python3.10-venv
     state: present
+  when: ansible_distribution == 'Ubuntu'
+
+- name: Install python3.10-venv
+  package:
+    name: python3-venv
+    state: present
+  when: ansible_distribution == 'Debian'

yttrx-playbook.yml

@@ -1,5 +1,5 @@
 ---
 - name: Configure yttrx mastodon server
-  hosts: [mastodon]
+  hosts: [yttrx]
   roles:
     - role: yttrx