websites: dustin.hatch.name: Deploy new site

Promoting the new site I have been working on at *dustin.hatch.is* to my
main domain, *dustin.hatch.name*.  The new site is just static content,
generated and uploaded by a Jenkins job.

Finally have a certificate for *dustin.hatch.name* now, too!

.certs

@@ -1 +1 @@
-Subproject commit 654b52b6080c1a54b6466ac9cdc00da8d2c910d9
+Subproject commit 13f97e4fa1468623cde4cb9e91d616d8ecc57225

certs/websites/dustin.hatch.name.cer

@@ -0,0 +1 @@
+../../.certs/acme.sh/dustin.hatch.name/fullchain.cer

certs/websites/dustin.hatch.name.key

@@ -0,0 +1 @@
+../../.certs/acme.sh/dustin.hatch.name/dustin.hatch.name.key

roles/websites/dustin.hatch.name/defaults/main.yml

@@ -0,0 +1 @@
+dchwww_publisher_keys: []

roles/websites/dustin.hatch.name/files/dustin.hatch.name.httpd.conf

@@ -1,20 +1,25 @@
 # vim: set ft=apache :
 
-WSGIDaemonProcess dchwww \
-	user=webapp.dchwww \
-	group=webapp.dchwww \
-	python-home=/srv/www/dustin.hatch.name/venv \
-	display-name=%{GROUP}
+<VirtualHost _default_:80>
+ServerName dustin.hatch.name
 
-
-<VirtualHost *:80>
-	ServerName dustin.hatch.name
-
-	WSGIScriptAlias / /srv/www/dustin.hatch.name/site.py \
-		process-group=dchwww
-	Alias /static /srv/www/dustin.hatch.name/static
-
-	<Location />
-		Require all granted
-	</Location>
+RewriteEngine On
+RewriteRule (.*) https://%{SERVER_NAME}$1 [R=301,L]
+</VirtualHost>
+
+<VirtualHost _default_:443>
+ServerName dustin.hatch.name
+
+Include conf.d/ssl.include
+SSLCertificateKeyFile /etc/pki/tls/private/dustin.hatch.name.key
+SSLCertificateFile /etc/pki/tls/certs/dustin.hatch.name.cer
+
+<IfModule mod_headers.c>
+    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
+</IfModule>
+
+DocumentRoot /srv/www/dustin.hatch.name/htdocs
+<Directory /srv/www/dustin.hatch.name/htdocs>
+    Require all granted
+</Directory>
 </VirtualHost>

roles/websites/dustin.hatch.name/handlers/main.yml

@@ -1,8 +1,4 @@
-- name: restart httpd
-  service:
-    name=httpd
-    state=restarted
 - name: reload httpd
   service:
-    name=httpd
-    state=reloaded
+    name: httpd
+    state: reloaded

roles/websites/dustin.hatch.name/tasks/main.yml

@@ -1,36 +1,36 @@
-- name: ensure mod_wsgi is installed
-  package:
-    name=python3-mod_wsgi
-    state=present
-  notify: restart httpd
-  tags:
-  - install
-
 - name: ensure rsync is installed
   package:
-    name=rsync
-    state=present
+    name: rsync
+    state: present
   tags:
   - install
 
 - name: ensure app group exists
   group:
-    name=webapp.dchwww
-    state=present
+    name: webapp.dchwww
+    state: present
 - name: ensure app user exists
   user:
-    name=webapp.dchwww
-    group=webapp.dchwww
-    home=/srv/www/dustin.hatch.name
-    createhome=yes
-    state=present
+    name: webapp.dchwww
+    group: webapp.dchwww
+    home: /srv/www/dustin.hatch.name
+    createhome: true
+    state: present
 
 - name: ensure app home directory permissions are set
   file:
-    path=/srv/www/dustin.hatch.name
-    mode=0755
-    state=directory
+    path: /srv/www/dustin.hatch.name
+    mode: u=rwx,go=rx
+    state: directory
 
+- name: ensure app ssh home directory exists
+  file:
+    path: /srv/www/dustin.hatch.name/.ssh
+    mode: '0700'
+    owner: webapp.dchwww
+    group: webapp.dchwww
+    setype: ssh_home_t
+    state: directory
 - name: ensure publisher keys are trusted
   authorized_key:
     key: "{{ dchwww_publisher_keys|join('\n') }}"
@@ -39,22 +39,16 @@
 - name: ensure authorized_keys file permissions are correct
   file:
     path: /srv/www/dustin.hatch.name/.ssh/authorized_keys
-    mode: '0600'
+    mode: u=rw,go=
     owner: webapp.dchwww
     group: webapp.dchwww
     setype: ssh_home_t
 
-- name: ensure virtualenv exists
-  become: true
-  become_user: webapp.dchwww
-  pip:
-    name: pip
-    virtualenv: /srv/www/dustin.hatch.name/venv
-    virtualenv_command: /usr/bin/python3 -m venv
-
 - name: ensure apache is configured to serve dustin.hatch.name
   copy:
-    src=dustin.hatch.name.httpd.conf
-    dest=/etc/httpd/conf.d/dustin.hatch.name.conf
-    mode=0644
+    src: dustin.hatch.name.httpd.conf
+    dest: /etc/httpd/conf.d/dustin.hatch.name.conf
+    mode: u=rw,go=r
   notify: reload httpd
+  tags:
+  - httpd-config

websites.yml

@@ -7,6 +7,12 @@
     tags: formsubmit
   - role: websites/pyrocufflink.net
     tags: websites/pyrocufflink.net
+  - role: cert
+    cert_src: websites/dustin.hatch.name.cer
+    cert_dest: /etc/pki/tls/certs/dustin.hatch.name.cer
+    cert_key_src: websites/dustin.hatch.name.key
+    cert_key_dest: /etc/pki/tls/private/dustin.hatch.name.key
+    tags: websites/dustin.hatch.name
   - role: websites/dustin.hatch.name
     tags: websites/dustin.hatch.name
   - role: websites/ebonfire.com