Nginx Reverse Proxy Helper

NGINX Reverse Proxy Server

This role is tested on Ubuntu with Docker, using my role bsmeding.docker on Linux systems.

It acts as the frontend for deploying Docker containers on various platforms. The default image is from Linuxserver: https://docs.linuxserver.io/images/docker-nginx

Currently, only a limited number of configuration options are available, more will be added later.

Reverse Proxy Configuration

For each container (or any other service/server), you can add a proxy configuration using the variable list nginx__proxy_confs_subdomain. If you are using containers, make sure they are connected to the same Docker network for easier name resolution and enhanced security.

Here's an example that forwards incoming requests for dash.example.com on port 80 to a container named dashboard on port 9090 (HTTP):

nginx__proxy_confs_subdomain:
 - server_name: dash.example.com
   listen: 80
   enable_ldap: false
   enable_authelia: false
   default_upstream_proto: http
   default_upstream_url: dashboard
   default_upstream_port: 9090

Site Files

If you want to copy a website directory, place them in /files/nginx/sites/<site_directory>, or in /files/nginx/<inventory_hostname>/sites/<site_directory> if you're deploying multiple servers with different sites.

Site Configuration Files

If you need specific site configuration files, place them in your playbook directory at /files/nginx/site-confs/. They should be named <site.conf>. Alternatively, use /files/nginx/<inventory_hostname>/site-confs/ for separate host configurations.

HTTPS / SSL / Certificate

If you need SSL certificates, place them in your playbook directory under files/nginx/certs/, and name them website_url.crt and website_url.key.

If your key file is secured by a passphrase, include this in your subdomain variable, so it can be secured by ansible-vault:

nginx__proxy_confs_subdomain:
 - server_name: dash.example.com
   listen: 80
   listen_https: 443 # Enable HTTPS
   cert_key_passphrase: 'sbsta261da' # Example passphrase for the cert.key file if applicable. If not, don't include this variable.
   enable_ldap: false
   enable_authelia: false
   default_upstream_proto: http
   default_upstream_url: dashboard
   default_upstream_port: 9090