Let’s Encrypt SSL for Nginx 🔐

Description

Automates obtaining, configuring, and renewing Let’s Encrypt SSL certificates for Nginx with Certbot. Keeps your sites secure with minimal fuss! 🌐

Overview

This Ansible role sets up the necessary Nginx configuration and Certbot integration to:

  • Redirect HTTP traffic to HTTPS

  • Serve the ACME challenge for certificate issuance

  • Apply strong SSL/TLS defaults

  • Schedule automatic renewals

It’s idempotent: configuration and certificate tasks only run when needed. ✅

Purpose

Ensure all your Nginx-hosted sites use free, trusted SSL certificates from Let’s Encrypt—all managed automatically via Ansible. 🎯

Features

  • Automatic Certificate Issuance: Uses Certbot’s webroot plugin to request and install certificates. 📜

  • Nginx Redirect: Creates a temporary HTTP → HTTPS redirect block. ↪️

  • ACME‐Challenge Handling: Configures /.well-known/acme-challenge/ for Certbot validation. 🔍

  • Secure SSL Defaults: Includes modern cipher suites, HSTS, OCSP stapling, and session settings. 🔒

  • Auto‐Renewal: Leverages system scheduling (cron or systemd timer) to renew certs before expiration. 🔄

  • One‐Time Setup: Tasks guarded by a “run once” fact to avoid re-applying unchanged templates. 🏃‍♂️