update repos

ansible/roles/nginx/handlers/main.yml

@@ -5,5 +5,5 @@
     state=restarted
 
 - name: Restore selinux context
-  command: restorecon -irv /root/.acme.sh/wo-bisch.ch
+  command: restorecon -irv /etc/letsencrypt
 

ansible/roles/nginx/tasks/main.yml

@@ -28,9 +28,9 @@
     - wo-bisch-web.css
     - wo-bisch-web-custom.css
 
-- name: Allow apache to read files in /root/.acme.sh/{{ letsEncryptDomain }}
+- name: Allow apache to read files in /etc/letsencrypt/{{ letsEncryptDomain }}
   sefcontext:
-    target: '/root/.acme.sh/{{ letsEncryptDomain }}(/.*)?'
+    target: '/etc/letsencrypt/{{ letsEncryptDomain }}(/.*)?'
     setype: httpd_sys_content_t
     state: present
   notify:
@@ -50,3 +50,9 @@
     group: root
     mode: '0644'
   notify: Restart nginx
+
+- name: create certificate directory
+  file:
+    path: /etc/letsencrypt/{{ letsEncryptDomain }}
+    state: directory
+

ansible/roles/nginx/templates/nginx.conf.j2

@@ -39,7 +39,7 @@ http {
         listen       [::]:80 default_server;
         server_name  _;
 
-        return 301   https://wo-bisch.ch$request_uri;
+        return 301   https://{{ letsEncryptDomain }}$request_uri;
 
     }
 
@@ -67,8 +67,8 @@ http {
 
         listen [::]:443 ssl ipv6only=on; 
         listen 443 ssl; 
-        ssl_certificate /root/.acme.sh/{{ letsEncryptDomain }}/fullchain.cer;
-        ssl_certificate_key /root/.acme.sh/{{ letsEncryptDomain }}/{{ letsEncryptDomain }}.key;
+        ssl_certificate /etc/letsencrypt/{{ letsEncryptDomain }}/fullchain.cer;
+        ssl_certificate_key /etc/letsencrypt/{{ letsEncryptDomain }}/{{ letsEncryptDomain }}.key;
     }
 
 }