ansible: Serve web interface directly with nginx

ansible/hosts

@@ -7,3 +7,7 @@ motis:
     spline-vm-motis:
       ansible_user: root
       ansible_host: 130.133.110.196
+      cert_domains:
+        - transitous.jbb.ghsq.de
+        - api.transitous.jbb.ghsq.de
+      email: [email protected]

ansible/motis.yml

@@ -6,6 +6,7 @@
   hosts: motis
   roles:
     - motis
+    - nginx
   tasks:
     - name: Install rsync
       apt:

ansible/roles/motis/files/config.ini

@@ -11,10 +11,12 @@ modules=intermodal
 modules=nigiri
 
 intermodal.router=nigiri
-server.static_path=/opt/motis/web
 dataset.no_schedule=true
 
 
+[server]
+host=127.0.0.1
+
 [import]
 #paths=osm:europe-latest.osm.pbf
 paths=osm:aachen.osm.pbf

ansible/roles/nginx/files/api.transitous.jbb.ghsq.de.conf

@@ -0,0 +1,21 @@
+# SPDX-FileCopyrightText: 2024 Jonah Brüchert <[email protected]>
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+server {
+    #listen 443 http2 ssl;
+    #listen [::]:443 http2 ssl;
+    listen 80;
+    listen [::]:80;
+
+    server_name api.transitous.jbb.ghsq.de;
+
+    # For certbot
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/www/html/;
+    }
+
+    location / {
+        proxy_pass http://localhost:8080;
+    }
+}

ansible/roles/nginx/files/nginx.conf

@@ -0,0 +1,65 @@
+# SPDX-FileCopyrightText: 2024 Jonah Brüchert <[email protected]>
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+user www-data;
+worker_processes auto;
+pid /run/nginx.pid;
+error_log /var/log/nginx/error.log;
+include /etc/nginx/modules-enabled/*.conf;
+
+events {
+	worker_connections 768;
+	# multi_accept on;
+}
+
+http {
+
+	##
+	# Basic Settings
+	##
+
+	sendfile on;
+	tcp_nopush on;
+	types_hash_max_size 2048;
+	# server_tokens off;
+
+	# server_names_hash_bucket_size 64;
+	# server_name_in_redirect off;
+
+	include /etc/nginx/mime.types;
+	default_type application/octet-stream;
+
+	##
+	# SSL Settings
+	##
+
+	ssl_protocols TLSv1.2 TLSv1.3;
+	ssl_prefer_server_ciphers on;
+
+	##
+	# Logging Settings
+	##
+
+	access_log /var/log/nginx/access.log;
+
+	##
+	# Gzip Settings
+	##
+
+	gzip on;
+
+	# gzip_vary on;
+	# gzip_proxied any;
+	# gzip_comp_level 6;
+	# gzip_buffers 16 8k;
+	# gzip_http_version 1.1;
+	# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+
+	##
+	# Virtual Host Configs
+	##
+
+	include /etc/nginx/conf.d/*.conf;
+	include /etc/nginx/sites-enabled/*;
+}

ansible/roles/nginx/files/transitous.jbb.ghsq.de.conf

@@ -0,0 +1,29 @@
+# SPDX-FileCopyrightText: 2024 Jonah Brüchert <[email protected]>
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+server {
+    #listen 443 http2 ssl;
+    #listen [::]:443 http2 ssl;
+    listen 80;
+    listen [::]:80;
+
+    server_name transitous.jbb.ghsq.de;
+
+    # For certbot
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/www/html/;
+    }
+
+    location = / {
+        if ($arg_motis != http%3A%2F%2Fapi.transitous.jbb.ghsq.de) {
+                return 301 http://$host?motis=http%3A%2F%2Fapi.transitous.jbb.ghsq.de;
+        }
+
+        root /opt/motis/web/;
+    }
+
+    location / {
+        root /opt/motis/web/;
+    }
+}

ansible/roles/nginx/tasks/main.yml

@@ -0,0 +1,69 @@
+# SPDX-FileCopyrightText: 2024 Jonah Brüchert <[email protected]>
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+- name: Install nginx
+  apt:
+    name: nginx
+
+- name: Make sure nginx is running
+  systemd:
+    name: nginx.service
+    state: started
+#
+# - name: Install certbot
+#   apt:
+#     name: certbot
+#
+# - name: Check if certificate already exists.
+#   stat:
+#     path: /etc/letsencrypt/live/{{ cert_domains | first | replace('*.', '') }}/cert.pem
+#   register: letsencrypt_cert
+#
+# - name: Generate new certificate if one doesn't exist.
+#   command: >-
+#     certbot certonly --noninteractive --agree-tos --dry-run
+#     --email {{ email }}
+#     -w /var/www/html/
+#     -d {{ cert_domains | join(',') }}
+#     --webroot
+#     --expand
+#   when: not letsencrypt_cert.stat.exists
+#
+# - name: Enable automatic certificate renewal
+#   service:
+#     name: certbot.timer
+#     enabled: true
+#     masked: false
+
+- name: Install nginx config
+  copy:
+    src: nginx.conf
+    dest: /etc/nginx/nginx.conf
+
+- name: Install site config
+  copy:
+    src: "{{ item }}.conf"
+    dest: "/etc/nginx/sites-available/{{ item }}.conf"
+  with_items:
+    - transitous.jbb.ghsq.de
+    - api.transitous.jbb.ghsq.de
+
+- name: Disable default site configuration
+  file:
+    path: /etc/nginx/sites-enabled/default
+    state: absent
+
+- name: Enable nginx sites
+  file:
+    src: "/etc/nginx/sites-available/{{ item }}.conf"
+    dest: "/etc/nginx/sites-enabled/{{ item }}.conf"
+    state: link
+  with_items:
+    - transitous.jbb.ghsq.de
+    - api.transitous.jbb.ghsq.de
+
+- name: Reload nginx
+  systemd:
+    name: nginx.service
+    state: reloaded