Cut over Gitea HTTPS to Atlas with managed NPM upstream

ansible/inventory/group_vars/server.yml

@@ -92,6 +92,7 @@ server_gitea_cutover_tools_enabled: false
 server_gitea_final_export: false
 server_gitea_on_atlas: false
 server_gitea_atlas_address: "{{ hostvars['atlas'].ansible_host }}"
+server_gitea_npm_domains: []
 server_gitea_ssh_public_port: 2222
 server_gitea_ssh_target_port: 2222
 server_backup_export_source_keep: 3

ansible/inventory/host_vars/prometheus.yml

@@ -10,6 +10,10 @@ server_backup_export_enabled: true
 server_backup_export_start_timer: true
 # Install the final-copy helper only; it is never run by a normal playbook invocation.
 server_gitea_cutover_tools_enabled: true
+server_gitea_on_atlas: true
+server_gitea_npm_domains:
+  - git.fscotto.duckdns.org
+  - git.ov-ad3410.infomaniak.ch
 server_duckdns_domain: fscotto
 server_ssh_authorized_keys:
   - name: ikaros

ansible/roles/profile_server/tasks/gitea_npm_proxy.yml

@@ -0,0 +1,59 @@
+---
+- name: Validate the NPM Gitea cutover override
+  tags: [services, gitea_cutover]
+  ansible.builtin.assert:
+    that:
+      - server_gitea_cutover_tools_enabled | bool
+      - server_gitea_npm_domains | length > 0
+      - server_gitea_npm_domains | select('match', '^[a-zA-Z0-9.-]+$') | list | length == server_gitea_npm_domains | length
+    fail_msg: Declare the exact NPM Gitea hostnames before enabling the Atlas upstream.
+  when: server_gitea_on_atlas | bool
+
+- name: Ensure the NPM custom configuration directory exists
+  tags: [services, gitea_cutover]
+  ansible.builtin.file:
+    path: /opt/npm/data/nginx/custom
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  when: server_gitea_cutover_tools_enabled | bool
+
+- name: Render the Gitea-only NPM runtime upstream override
+  tags: [services, gitea_cutover]
+  ansible.builtin.template:
+    src: prometheus-gitea-npm-proxy.conf.j2
+    dest: /opt/npm/data/nginx/custom/server_proxy.conf
+    owner: root
+    group: root
+    mode: "0644"
+  register: server_gitea_npm_override
+  when: server_gitea_on_atlas | bool
+
+- name: Remove the Gitea NPM override when source routing is selected
+  tags: [services, gitea_cutover]
+  ansible.builtin.file:
+    path: /opt/npm/data/nginx/custom/server_proxy.conf
+    state: absent
+  when:
+    - server_gitea_cutover_tools_enabled | bool
+    - not server_gitea_on_atlas | bool
+
+- name: Validate NPM configuration after a Gitea upstream change
+  tags: [services, gitea_cutover]
+  ansible.builtin.command:
+    argv: [podman, exec, nginx-proxy-manager, nginx, -t]
+  changed_when: false
+  when:
+    - server_gitea_on_atlas | bool
+    - server_gitea_npm_override is changed
+    - not ansible_check_mode
+
+- name: Reload NPM after validating the Gitea upstream change
+  tags: [services, gitea_cutover]
+  ansible.builtin.command:
+    argv: [podman, exec, nginx-proxy-manager, nginx, -s, reload]
+  when:
+    - server_gitea_on_atlas | bool
+    - server_gitea_npm_override is changed
+    - not ansible_check_mode

ansible/roles/profile_server/tasks/main.yml

@@ -65,6 +65,9 @@
 - name: Import Prometheus Gitea SSH proxy tasks
   ansible.builtin.import_tasks: gitea_ssh_proxy.yml
 
+- name: Import Prometheus Gitea NPM proxy override tasks
+  ansible.builtin.import_tasks: gitea_npm_proxy.yml
+
 - name: Ensure server SSH authorized key fragments directory exists
   tags: [services, ssh]
   ansible.builtin.file:

ansible/roles/profile_server/templates/prometheus-gitea-npm-proxy.conf.j2

@@ -0,0 +1,6 @@
+# Managed by Ansible. NPM's variable proxy upstream uses Nginx DNS, not /etc/hosts.
+{% for domain in server_gitea_npm_domains %}
+if ($host = {{ domain }}) {
+  set $server {{ server_gitea_atlas_address }};
+}
+{% endfor %}

ansible/templates/server/docker-compose.yml.j2

@@ -13,10 +13,6 @@ services:
       - "127.0.0.1:81:81"
     extra_hosts:
       - "host.containers.internal:host-gateway"
-{% if server_gitea_on_atlas | bool %}
-      # Keep both existing NPM Proxy Hosts unchanged; their gitea name now resolves to Atlas.
-      - "gitea:{{ server_gitea_atlas_address }}"
-{% endif %}
     volumes:
       - "/opt/npm/data:/data{{ ':' ~ selinux_volume_option if selinux_volume_option else '' }}"
       - "/opt/npm/letsencrypt:/etc/letsencrypt{{ ':' ~ selinux_volume_option if selinux_volume_option else '' }}"