Svc-prx-openresty Role¶

Description: NGINX-based web platform and reverse proxy with validated config reloads and Let’s Encrypt integration

Variables¶

author: Kevin Veen-Birkenbach
description: NGINX-based web platform and reverse proxy with validated config reloads and Let’s Encrypt integration
license: Infinito.Nexus Community License (Non-Commercial)
company: Kevin Veen-Birkenbach https://www.veen.world
galaxy_tags: [‘openresty’, ‘nginx’, ‘docker’, ‘reverse_proxy’]
issue_tracker_url: https://s.infinito.nexus/issues
min_ansible_version: 2.9
platforms: [{‘name’: ‘ArchLinux’, ‘versions’: [‘all’]}, {‘name’: ‘Debian’, ‘versions’: [‘all’]}, {‘name’: ‘EL’, ‘versions’: [‘all’]}, {‘name’: ‘Fedora’, ‘versions’: [‘all’]}, {‘name’: ‘Ubuntu’, ‘versions’: [‘all’]}]

README¶

OpenResty¶

This role deploys an OpenResty container via Docker Compose, validates its configuration, and restarts it on changes.

Description¶

Runs an OpenResty container in host network mode
Mounts NGINX configuration and Let’s Encrypt directories
Validates the OpenResty (NGINX) configuration before any restart
Restarts the container only if the configuration is valid

Overview¶

Loads the base Docker Compose setup
Adds the OpenResty service
Defines handlers to validate and restart the container
Triggers a restart on configuration changes

Cosmos¶

The diagram places OpenResty in the Infinito.Nexus cosmos: the components it deploys (capabilities), the central services it consumes (dependencies), and its outward reach (federation and bridged external networks).

flowchart LR
    subgraph deps [Dependencies]
        dep_svc_bkp_volume_2_local["svc-bkp-volume-2-local 💻"]
        dep_svc_net_tor["svc-net-tor 🐳🐝"]
    end
    subgraph role [svc-prx-openresty 🐳🐝]
        svc_openresty["openresty"]
        svc_tor["tor"]
        svc_container_backup["container_backup"]
    end
    dep_svc_bkp_volume_2_local -- "1:1" --> svc_container_backup
    dep_svc_net_tor -. "0..1" .-> svc_tor

Solid 1:1 edges are fixed relationships; dashed 0..1 edges are conditional (enabled only in matching deployments); red 0..0 edges are turned off in this role. Node markers show the role’s deploy modes (💻 host, 🐳 compose, 🐝 swarm); ❌ marks a service that is explicitly turned off, and ⚙️ an Ansible role dependency declared in meta/main.yml.

Features¶

Automated provisioning: Configured by Ansible without manual steps.

Quick Setup¶

Development¶

Clone, set up the workstation, and deploy OpenResty onto the local stack:

git clone https://github.com/infinito-nexus/core.git
cd core
make onboard
make compose-deploy mode=reinstall apps=svc-prx-openresty full_cycle=false

Production¶

Run the published image to provision the inventory and deploy OpenResty to a managed server (the mounted volume persists the inventory):

APP=svc-prx-openresty
HOST=<your-server>
DOMAIN=<your-domain>
TLS_MODE=self_signed
SSH_PUBLIC_KEY="<your-ssh-public-key>"

docker run --rm -it \
  -v "$PWD/inventories:/etc/infinito.nexus/inventories" \
  -e APP="$APP" -e HOST="$HOST" -e DOMAIN="$DOMAIN" -e TLS_MODE="$TLS_MODE" -e SSH_PUBLIC_KEY="$SSH_PUBLIC_KEY" \
  ghcr.io/infinito-nexus/core/debian bash -c '
    INVENTORY=/etc/infinito.nexus/inventories/production
    infinito administration inventory provision "$INVENTORY" \
      --inventory-file "$INVENTORY/devices.yml" \
      --host "$HOST" \
      --include "$APP" \
      --vars "{\"TLS_MODE\": \"$TLS_MODE\", \"DOMAIN_PRIMARY\": \"$DOMAIN\", \"users\": {\"administrator\": {\"authorized_keys\": [\"$SSH_PUBLIC_KEY\"]}}}" &&
    infinito administration deploy dedicated "$INVENTORY/devices.yml" \
      --password-file "$INVENTORY/.password" \
      --diff -vv'

Credits¶

Implemented by Kevin Veen-Birkenbach. Part of the Infinito.Nexus Project and maintained by Kevin Veen-Birkenbach. Licensed under the Infinito.Nexus Community License (Non-Commercial).