add dnsmasq pi server

nginx/certbot.yaml

@@ -12,6 +12,14 @@
       name:
         - certbot
       state: present
+  - name: Stop nginx service so we can get certs
+    ansible.builtin.systemd_service:
+      state: stopped
+      name: nginx
   - name: Get certs for all terminate domains
     ansible.builtin.shell: /usr/bin/certbot certonly --standalone -d '{{ item.external_domain }}' -n
     loop: "{{ terminate_ssl }}"
+  - name: Start nginx service
+    ansible.builtin.systemd_service:
+      state: started
+      name: nginx

nginx/nginx.conf

@@ -1,5 +1,7 @@
 load_module /usr/lib64/nginx/modules/ngx_stream_module.so;
 
+worker_processes 8;
+
 events {}
 
 stream {
@@ -12,19 +14,19 @@ stream {
     # Map all SSL parsed server names to hosts
     map $ssl_preread_server_name $name {
 
-        "" 127.0.0.1;
+        "" 127.0.0.1:443;
 
         # For each domain we need to stream to a remote server, forward to internal domain
         {% for domain in stream_ssl %}
-        {{ domain.external_domain }} {{ domain.internal_domain }};
+        {{ domain.external_domain }} {{ domain.internal_domain }}:{{ domain.internal_port }};
         {% endfor %}
 
         # For each domain we want to terminate, forward to internal http server
         {% for domain in terminate_ssl %}
-        {{ domain.external_domain }} 127.0.0.1;
+        {{ domain.external_domain }} 127.0.0.1:443;
         {% endfor %}
 
-        default {{ nginx.defaults.domain }};
+        default {{ nginx.defaults.domain }}:443;
     }
 
     # Forward 80 traffic
@@ -32,8 +34,9 @@ stream {
         access_log /var/log/nginx/stream-access-80.log basic;
         listen {{ ansible_default_ipv4.address }}:80;
         resolver 1.1.1.1;
-        proxy_pass $name:80;
+        proxy_pass $name;
         ssl_preread on;
+        proxy_socket_keepalive on;
     }
 
     # Forward 443 traffic
@@ -41,8 +44,9 @@ stream {
         access_log /var/log/nginx/stream-access-443.log basic;
         listen {{ ansible_default_ipv4.address }}:443;
         resolver 1.1.1.1;
-        proxy_pass $name:443;
+        proxy_pass $name;
         ssl_preread on;
+        proxy_socket_keepalive on;
     }
 
 }

nginx/stream.d/iperf3.conf

@@ -0,0 +1,6 @@
+server {
+    access_log /var/log/nginx/iperf.log basic;
+    listen {{ ansible_default_ipv4.address }}:5201;
+    listen {{ ansible_default_ipv4.address }}:5201 udp;
+    proxy_pass 127.0.0.1:5201;
+}

nginx/vars.yaml

@@ -29,6 +29,21 @@ terminate_ssl:
     internal_domain: orange.reeselink.com
     internal_port: 9090
     internal_protocol: https
+  - external_domain: node1.reeseapps.com
+    external_port: 443
+    internal_domain: node1.reeselink.com
+    internal_port: 9090
+    internal_protocol: https
+  - external_domain: node2.reeseapps.com
+    external_port: 443
+    internal_domain: node2.reeselink.com
+    internal_port: 9090
+    internal_protocol: https
+  - external_domain: node3.reeseapps.com
+    external_port: 443
+    internal_domain: node3.reeselink.com
+    internal_port: 9090
+    internal_protocol: https
 stream_ssl:
   - external_domain: nextcloud-aio.reeseapps.com
     external_port: 443