r/lego-nginx: Configure LEGO for nginx

The *lego-nginx* role automates obtaining certificates for *nginx* via
ACME using `lego`.  It generates a shell script with the appropriate
arguments for `lego run`, runs it once to obtain a certificate
initially, then schedules it to run periodically via a systemd timer
unit. Using `lego`'s "hook" capability, the script signals the `nginx`
server process to reload.  This uses `doas` for now, but could be
adapted easily to use `sudo`, if the need ever arises.

roles/lego-nginx/tasks/nginx.yml

@@ -0,0 +1,37 @@
+- name: ensure nginx is installed
+  package:
+    name: nginx
+    state: present
+  tags:
+  - install
+
+- name: ensure nginx is running
+  service:
+    name: nginx
+    state: started
+  tags:
+  - service
+
+- name: ensure nginx is configured for lego
+  copy:
+    src: lego.nginx.conf
+    dest: /etc/nginx/default.d/lego.conf
+    owner: root
+    group: root
+    mode: u=rw,go=r
+  notify:
+  - reload nginx
+  tags:
+  - nginx-config
+
+- name: ensure firewall allows http acme challenges
+  firewalld:
+    service: http
+    state: enabled
+    immediate: true
+  when: host_uses_firewalld|d(true)
+  tags:
+  - firewalld
+
+- name: flush handlers
+  meta: flush_handlers