From 6294edaa591dbf2c8f637406e23a43130a55993b Mon Sep 17 00:00:00 2001
From: Fenris Wolf <fenris@folksprak.org>
Date: Thu, 9 Oct 2025 01:47:49 +0200
Subject: [PATCH] [task-406] nginx

---
 roles/authelia-and-nginx/cfg.schema.json    | 24 +++++++++++++++++++++
 roles/authelia-and-nginx/defaults/main.json |  5 +++--
 roles/authelia-and-nginx/tasks/main.json    | 13 ++++++++---
 roles/authelia-and-nginx/templates/conf.j2  | 12 +++++------
 roles/authelia-and-nginx/vardef.json        | 15 -------------
 5 files changed, 43 insertions(+), 26 deletions(-)
 create mode 100644 roles/authelia-and-nginx/cfg.schema.json
 delete mode 100644 roles/authelia-and-nginx/vardef.json

diff --git a/roles/authelia-and-nginx/cfg.schema.json b/roles/authelia-and-nginx/cfg.schema.json
new file mode 100644
index 0000000..59e399d
--- /dev/null
+++ b/roles/authelia-and-nginx/cfg.schema.json
@@ -0,0 +1,24 @@
+{
+	"nullable": false,
+	"type": "object",
+	"properties": {
+		"domain": {
+			"nullable": false,
+			"type": "string"
+		},
+		"tls_mode": {
+			"nullable": false,
+			"type": "string",
+			"options": [
+				"disable",
+				"enable",
+				"force"
+			],
+			"enum": "force"
+		}
+	},
+	"additionalProperties": false,
+	"required": [
+		"domain"
+	]
+}
diff --git a/roles/authelia-and-nginx/defaults/main.json b/roles/authelia-and-nginx/defaults/main.json
index 0aaf1b7..28e3be5 100644
--- a/roles/authelia-and-nginx/defaults/main.json
+++ b/roles/authelia-and-nginx/defaults/main.json
@@ -1,4 +1,5 @@
 {
-	"var_authelia_and_nginx_domain": "authelia.example.org",
-	"var_authelia_and_nginx_tls_mode": "force"
+	"cfg_authelia_and_nginx_defaults": {
+		"tls_mode": "force"
+	}
 }
diff --git a/roles/authelia-and-nginx/tasks/main.json b/roles/authelia-and-nginx/tasks/main.json
index 87dcf2b..c56c915 100644
--- a/roles/authelia-and-nginx/tasks/main.json
+++ b/roles/authelia-and-nginx/tasks/main.json
@@ -1,4 +1,11 @@
 [
+	{
+		"name": "show vars",
+		"when": "switch_show_vars",
+		"ansible.builtin.debug": {
+			"var": "vars.cfg_authelia_and_nginx"
+		}
+	},
 	{
 		"name": "deactivate default site",
 		"become": true,
@@ -12,7 +19,7 @@
 		"become": true,
 		"ansible.builtin.template": {
 			"src": "conf.j2",
-			"dest": "/etc/nginx/sites-available/{{var_authelia_and_nginx_domain}}"
+			"dest": "/etc/nginx/sites-available/{{cfg_authelia_and_nginx.domain}}"
 		}
 	},
 	{
@@ -20,8 +27,8 @@
 		"become": true,
 		"ansible.builtin.file": {
 			"state": "link",
-			"src": "/etc/nginx/sites-available/{{var_authelia_and_nginx_domain}}",
-			"dest": "/etc/nginx/sites-enabled/{{var_authelia_and_nginx_domain}}"
+			"src": "/etc/nginx/sites-available/{{cfg_authelia_and_nginx.domain}}",
+			"dest": "/etc/nginx/sites-enabled/{{cfg_authelia_and_nginx.domain}}"
 		}
 	},
 	{
diff --git a/roles/authelia-and-nginx/templates/conf.j2 b/roles/authelia-and-nginx/templates/conf.j2
index cd3b8d6..2b99bcb 100644
--- a/roles/authelia-and-nginx/templates/conf.j2
+++ b/roles/authelia-and-nginx/templates/conf.j2
@@ -45,27 +45,27 @@
 {% endmacro %}
 
 server {
-	server_name {{var_authelia_and_nginx_domain}};
+	server_name {{cfg_authelia_and_nginx.domain}};
 	
 	listen 80;
 	listen [::]:80;
 	
-{% if (var_authelia_and_nginx_tls_mode == 'force') %}
+{% if (cfg_authelia_and_nginx.tls_mode == 'force') %}
 	return 301 https://$http_host$request_uri;
 {% else %}
 {{ authelia_common() }}
 {% endif %}
 }
 
-{% if (var_authelia_and_nginx_tls_mode != 'disable') %}
+{% if (cfg_authelia_and_nginx.tls_mode != 'disable') %}
 server {
-	server_name {{var_authelia_and_nginx_domain}};
+	server_name {{cfg_authelia_and_nginx.domain}};
 	
 	listen [::]:443 ssl http2;
 	listen 443 ssl http2;
 	
-	ssl_certificate_key /etc/ssl/private/{{var_authelia_and_nginx_domain}}.pem;
-	ssl_certificate /etc/ssl/fullchains/{{var_authelia_and_nginx_domain}}.pem;
+	ssl_certificate_key /etc/ssl/private/{{cfg_authelia_and_nginx.domain}}.pem;
+	ssl_certificate /etc/ssl/fullchains/{{cfg_authelia_and_nginx.domain}}.pem;
 	include /etc/nginx/ssl-hardening.conf;
 	
 {{ authelia_common() }}
diff --git a/roles/authelia-and-nginx/vardef.json b/roles/authelia-and-nginx/vardef.json
deleted file mode 100644
index b78ac7a..0000000
--- a/roles/authelia-and-nginx/vardef.json
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-	"domain": {
-		"type": "string",
-		"mandatory": false
-	},
-	"tls_mode": {
-		"type": "string",
-		"options": [
-			"disable",
-			"enable",
-			"force"
-		],
-		"mandatory": false
-	}
-}