roles: Add nginx (for debian)

roles/nginx/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+#nginx_acme_mail: "" # required

roles/nginx/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: reload nginx
+  systemd:
+    state: reloaded
+    name: nginx

roles/nginx/tasks/main.yml

@@ -0,0 +1,29 @@
+---
+- name: Install webserver
+  package:
+    state: latest
+    name:
+    - nginx
+    - dehydrated
+
+- name: acme mail
+  copy:
+    dest: "/etc/dehydrated/conf.d/mail"
+    content: "CONTACT_EMAIL={{ nginx_acme_mail }}"
+
+- name: get let's encrypt account
+  command: /usr/bin/dehydrated --register --accept-terms
+  args:
+    creates: /var/lib/dehydrated/accounts
+
+- name: nginx default config
+  notify: reload nginx
+  template:
+    src: default.nginx
+    dest: /etc/nginx/sites-available/default
+
+- name: nginx snippets for acme
+  notify: reload nginx
+  template:
+    src: snippets-tls.nginx
+    dest: /etc/nginx/snippets/tls-acme.conf

roles/nginx/templates/default.nginx

@@ -0,0 +1,12 @@
+server {
+	listen [::]:80;
+	listen 80;
+
+	server_name _;
+
+	location / {
+		return 301 https://$host$request_uri;
+	}
+
+	include snippets/tls-acme.conf;
+}

roles/nginx/templates/snippets-tls.nginx

@@ -0,0 +1,4 @@
+location /.well-known/acme-challenge {
+	alias /var/lib/dehydrated/acme-challenges;
+	allow all;
+}