Jenkinsfile

@@ -25,9 +25,9 @@ pipeline {
             }
             steps {
                 script {
-                    def ask_for_certs = input message: 'Upload RootCA certificate and key', parameters: [base64File(name: 'rootca'), base64File(name: 'rootca_key')]
-                    sh 'echo "${ask_for_certs["rootca"]}" > roles/rproxy/files/RootCA.crt'
-                    sh 'echo "${ask_for_certs["rootca_key"]}" > roles/rproxy/files/RootCA.key'
+                    def userInput = input message: 'Upload RootCA certificate and key', parameters: [base64File(name: 'rootca'), base64File(name: 'rootca_key')]
+                    writeFile(file: 'roles/rproxy/files/RootCA.crt', text: new String(userInput['rootca'].decodeBase64()))
+                    writeFile(file: 'roles/rproxy/files/RootCA.key', text: new String(userInput['rootca_key'].decodeBase64()))
                 }
             }
         }

roles/rproxy/files/repo.conf

@@ -1,8 +1,16 @@
 server {
-    listen 9000;
+    listen 9000 default ssl;
     server_name _;
     root /repo;
 
+    ssl_certificate /etc/nginx/certs/repo.crt;
+    ssl_certificate_key /etc/nginx/certs/repo.key;
+    ssl_protocols TLSv1.2;
+    ssl_ciphers EECDH:+AES256:-3DES:!RSA+AES:!RSA+3DES:!NULL:!RC4;
+    ssl_prefer_server_ciphers on;
+
+    error_page 497 301 =307 https://$host:$server_port$request_uri;
+
     location / {
         charset utf-8;
         autoindex on;

roles/rproxy/tasks/main.yml

@@ -51,12 +51,6 @@
         path: "{{ rproxy_dir }}/sites"
         state: directory
 
-    - name: Create repo dir
-      ansible.builtin.file:
-        path: "{{ rproxy_dir }}/repo"
-        state: directory
-        mode: 0777
-
     - name: Create certs dir
       ansible.builtin.file:
         path: "{{ rproxy_dir }}/certs"
@@ -72,11 +66,6 @@
         src: files/nginx.conf
         dest: "{{ rproxy_dir }}/nginx.conf"
 
-    - name: Copy repo.conf
-      ansible.builtin.copy:
-        src: files/repo.conf
-        dest: "{{ rproxy_dir }}/sites/repo.conf"
-
     - name: Copy RootCA certificate
       ansible.builtin.copy:
         src: files/RootCA.crt
@@ -92,6 +81,62 @@
         project_src: "{{ rproxy_dir }}"
   tags: install
 
+- name: Create https repository
+  block:
+    - name: Get IP address
+      ansible.builtin.shell:
+        cmd: hostname -I | awk '{print $1}'
+      register: IP
+
+    - name: Create repo dir
+      ansible.builtin.file:
+        path: "{{ rproxy_dir }}/repo"
+        state: directory
+        mode: 0777
+
+    - name: Copy repo.conf
+      ansible.builtin.copy:
+        src: files/repo.conf
+        dest: "{{ rproxy_dir }}/sites/repo.conf"
+
+    - name: Copy repo certificate cnf
+      ansible.builtin.template:
+        src: templates/repo.cnf.j2
+        dest: '{{ rproxy_dir }}/certs/repo.cnf'
+
+    - name: Generate repo certificate key
+      ansible.builtin.shell:
+        cmd: 'openssl genrsa -out {{ rproxy_dir }}/certs/repo.key 2048'
+
+    - name: Generate server csr
+      ansible.builtin.shell:
+        cmd: 'openssl req -key {{ rproxy_dir }}/certs/repo.key -new -out {{ rproxy_dir }}/certs/repo.csr -config {{ rproxy_dir }}/certs/repo.cnf'
+
+    - name: Sign server certificate
+      ansible.builtin.shell:
+        cmd: 'openssl x509 -req -CA {{ rproxy_dir }}/certs/RootCA.crt -CAkey {{ rproxy_dir }}/certs/RootCA.key -in {{ rproxy_dir }}/certs/repo.csr -out {{ rproxy_dir }}/certs/repo.crt -CAcreateserial -extfile {{ rproxy_dir }}/certs/repo.cnf -days 365 -extensions v3_x509'
+
+    - name: Create fullchain certificate
+      ansible.builtin.shell:
+        cmd: 'cat {{ rproxy_dir }}/certs/RootCA.crt >> {{ rproxy_dir }}/certs/repo.crt'
+
+    - name: Delete csr
+      ansible.builtin.file:
+        path: "{{ rproxy_dir }}/certs/repo.csr"
+        state: absent
+
+    - name: Delete cnf
+      ansible.builtin.file:
+        path: "{{ rproxy_dir }}/certs/repo.cnf"
+        state: absent
+
+    - name: Restart rproxy
+      community.docker.docker_compose:
+        project_src: "{{ rproxy_dir }}"
+        build: false
+        restarted: true
+  tags: install
+
 - name: Create configs
   block:
     - name: Copy server.conf

roles/rproxy/templates/repo.cnf.j2

@@ -0,0 +1,29 @@
+[ req ]
+prompt                 = no
+distinguished_name     = repo.{{ domain.stdout }}
+req_extensions         = v3_req
+x509_extensions		   = v3_x509
+
+
+[ repo.{{ domain.stdout }} ]
+countryName            = RU
+stateOrProvinceName    = RU
+localityName           = MSK
+organizationName       = {{ domain.stdout }}
+organizationalUnitName = IT
+commonName             = repo.{{ domain.stdout }}
+emailAddress           = admin@{{ domain.stdout }}
+
+[ v3_req ]
+basicConstraints       = CA:false
+keyUsage               = digitalSignature, keyEncipherment
+subjectAltName         = @sans
+
+[ v3_x509 ]
+basicConstraints       = CA:false
+keyUsage               = digitalSignature, keyEncipherment
+subjectAltName         = @sans
+
+[ sans ]
+DNS.1 = repo.{{ domain.stdout }}
+IP.1 = {{ IP.stdout }}