Enable SSL

roles/jellyfin/templates/jellyfin.conf.j2

@@ -3,12 +3,23 @@ server {
     server_name "jellyfin.{{ base_domain }}";
     set $jellyfin {{ server_ip }};
     #resolver 127.0.0.1 valid=30;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name "jellyfin.{{ base_domain }}";
+    set $jellyfin {{ server_ip }};
 
     # Security/XSS Mitigation Headers
     add_header X-Frame-Options "SAMEORIGIN";
     add_header X-XSS-Protection "1; mode=block";
     add_header X-Content-Type-Options "nosniff";
 
+    location = / {
+        return 302 https://$host/web/;
+    }
+
     location / {
         proxy_pass http://$jellyfin:8096;
         proxy_set_header Host $host;

roles/nginx/files/localhost.crt

@@ -0,0 +1,24 @@
+-----BEGIN CERTIFICATE-----
+MIID8zCCAtugAwIBAgIUPXGk144K0wqfLNwO7MK4g3ddbewwDQYJKoZIhvcNAQEL
+BQAwgYgxCzAJBgNVBAYTAkNaMRMwEQYDVQQIDApTb21lLVN0YXRlMQ8wDQYDVQQH
+DAZQcmFndWUxGDAWBgNVBAoMD0t1Y2hhcmN6eWsgTHRkLjEUMBIGA1UEAwwLKi5k
+ZXYubG9jYWwxIzAhBgkqhkiG9w0BCQEWFGx1a2FzQGt1Y2hhcmN6eWsueHl6MB4X
+DTIxMDQyNjIxMDA1OFoXDTMxMDQyNDIxMDA1OFowgYgxCzAJBgNVBAYTAkNaMRMw
+EQYDVQQIDApTb21lLVN0YXRlMQ8wDQYDVQQHDAZQcmFndWUxGDAWBgNVBAoMD0t1
+Y2hhcmN6eWsgTHRkLjEUMBIGA1UEAwwLKi5kZXYubG9jYWwxIzAhBgkqhkiG9w0B
+CQEWFGx1a2FzQGt1Y2hhcmN6eWsueHl6MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEAx/LUqs2Z8GS9x0KZrlrdL9Ndsskw5Q8EYGNJDxqebncMAkFbYbi1
+ZhHz4mnVzLKFg6mQ7yXdnUz5DFCltEQcQHpIULPcbLyj3XXBA0Hd40Hc8+7hghJ0
+Un9tH47JwMetnlNQcvmY2XJfQ+MV92pmIh7qzvkyj1EgjkNaTdf87zYl6zYnPJjy
+MU7K3KMikPd8jECh5zhsrw9imgr86bqtWBjNkcA3F9Oauui6UhyN3/eGIa74+vx6
+nYomiMSjuN3zkN0cyxX/PFVOZZOzTbmHUIPhIN3p5pXLhqA9tc3ePpifRATzU+Sn
+ePPM++PVvSgf2PMFvTtPC/z/jKXHDB4C2QIDAQABo1MwUTAdBgNVHQ4EFgQUUa10
+hrJc8F/WBDC0rWVISN5o6C8wHwYDVR0jBBgwFoAUUa10hrJc8F/WBDC0rWVISN5o
+6C8wDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAZOwIDGg+CzK3
+/wwIE3ttv/OeU1lHu8I87dR51ixG6kGfj6+iKyP9OhA4If+mRIlMRSmigZe/ENbw
+2tVDcoIogu8zw3SLlpMzxSDiAE3Ro4O60x8IQ7+HNOvbfiVq5Hdhb39T9VvDkNv8
+k9mectnlqTNRmbw9oYDbg7zjY+5yGz264QeakF2UwJdtGlDUHVt2w83WJLY/rYAv
+uuowVf4Tqt1evIr5lfsxVbRO9oVzBnbivYZPe5hjNxOBXTti17DfedIC+y6bLavm
+VNlba18xxCDEPadyJnOSLFQlD0aoMoV7m5hZCJZEciw6X/JpX3SIpRF0MQm02RPi
+wncx4+iqGA==
+-----END CERTIFICATE-----

roles/nginx/files/localhost.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDH8tSqzZnwZL3H
+QpmuWt0v012yyTDlDwRgY0kPGp5udwwCQVthuLVmEfPiadXMsoWDqZDvJd2dTPkM
+UKW0RBxAekhQs9xsvKPddcEDQd3jQdzz7uGCEnRSf20fjsnAx62eU1By+ZjZcl9D
+4xX3amYiHurO+TKPUSCOQ1pN1/zvNiXrNic8mPIxTsrcoyKQ93yMQKHnOGyvD2Ka
+Cvzpuq1YGM2RwDcX05q66LpSHI3f94Yhrvj6/HqdiiaIxKO43fOQ3RzLFf88VU5l
+k7NNuYdQg+Eg3enmlcuGoD21zd4+mJ9EBPNT5Kd488z749W9KB/Y8wW9O08L/P+M
+pccMHgLZAgMBAAECggEANoUiNAin5wKxNLoWSZKBKV9K90sgx/SWTuoDq9ioRpqz
+bZIApt7Ep7ZRd/U/1PcArOv5lxwOF6w7ZH5BEKxZv8MYINlKS2QMkoBfRtIY/LSi
+2OjUGLGLgks4qBg5LxXDY554G0GvyesDyvEKtlIO01L218TfYnDOnbwDzaINV/RC
+W/nbyx8Z5teorU+vS5IlDaNMDSFkAMFOfQ8gNrwCaWxX2FJRUyyzM/54J4bNgGUi
++3APpt8w4N54CrMbI6FzyQhUbAY9MRFryaLgw22v0haiM1nAE9BWpU5m20Q8Ilx8
+f1e9PVDqwTXshxx01b0Z6RrHZViyi9+XOo6QU+4xYQKBgQDrYQZ8trvV3j+1E6Eu
+rESMni+93ZbhRMbVVUDOhxU7BzfsFnvGodQms9sCaNQrexML0xH9DhWbssCDOvOm
+MWSOnxUA1yivMiYvE4FzEM5iRRyFSjE3uS3+FZ0yY3iUr1vf9G9fJrtt/ag05AF5
+ZywhmvvtiA06F9+/qZzMW4jxfQKBgQDZdy/tYZQI9PlfznI6juy/Kx310vGNN9aW
+Zzv3WRon40awiRMxUhGViiq9eD1IEzLDIXGXHdOI4E+DQUd+pn7Cr08QoWbOQk2n
+BujCDY0mevc2kDi5NASa2SUFvUXo/vCqZdfP/EA7BudYwknZp3hCV+nZt6DcW+M2
++WLYjxTVjQKBgGs/QTpv9HQFGRgDgqyGd5FuvigPoCCyOrqXZrjzmbvUlSlwMSOX
+NtgPmRmm9A1/vXTkzkx0L2pK7yacJMoztTK6z1IbtwDko7tNcu0f2jmybcVZwcU3
+Dfq4lHCSHC37HKyVbm13c20xZ4P546YSWWxSdrmLBSPUHvHwcW43wtTtAoGBAMOb
+yAqYiRX9dQrOokU2JpJWcF6cXhaOsYEcXv5AsZxLfVxyEEd+8L44R/Wh4E2ipziK
+LqildY9bZWpFH9A2ZzMric0FwXmqfjrNpjRXCC4i0ZfM5pkAx1uaEwk0lVvdZhGA
+Bj3ZQtVVgmd+a/tR/oR+m6Tw3csZBCqA7H6rRSxJAoGBAIFd0PRdKm5+mUc575GQ
+sxVznovODCdRyOAeD9IKyCcpMo8zB9uiNDRPG/sUebnowC3v7EeCYUUHlUDtsSjc
+BZyasg71mrZElWg2mDonw/J9fcrEPGrh59wmqk49MLvzB0An/eP+gGK3RFgbijkN
+EZcByagGNGdICcaaxr+RhgcU
+-----END PRIVATE KEY-----

roles/nginx/tasks/main.yml

@@ -5,6 +5,13 @@
     mode: '0755'
   loop:
     - "{{ nginx_confd_folder }}"
+- name: copy certificates
+  copy:
+    src: "{{ item }}"
+    dest: "{{ data_folder }}/nginx"
+  loop:
+    - localhost.key
+    - localhost.crt
 - name: copy .conf file
   template:
     src: nginx.conf.j2
@@ -16,9 +23,12 @@
     image: nginx
     volumes:
       - "{{ data_folder }}/nginx/nginx.conf:/etc/nginx/nginx.conf"
+      - "{{ data_folder }}/nginx/localhost.crt:/etc/nginx/localhost.crt"
+      - "{{ data_folder }}/nginx/localhost.key:/etc/nginx/localhost.key"
       - "{{ nginx_confd_folder }}:/etc/nginx/conf.d"
     ports:
       - "80:80"
+      - "443:443"
     env:
       NGINX_HOST: "{{ base_domain }}"
       NGINX_PORT: '80'

roles/nginx/templates/nginx.conf.j2

@@ -0,0 +1,32 @@
+user  nginx;
+worker_processes  1;
+
+error_log  /var/log/nginx/error.log warn;
+pid        /var/run/nginx.pid;
+
+
+events {
+    worker_connections  1024;
+}
+
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log  /var/log/nginx/access.log  main;
+
+    sendfile        on;
+    #tcp_nopush     on;
+
+    keepalive_timeout  65;
+
+    #gzip  on;
+    ssl_certificate /etc/nginx/localhost.crt;
+    ssl_certificate_key /etc/nginx/localhost.key;
+    include /etc/nginx/conf.d/*.conf;
+}