Feature Request: Normalize SSL provider tasks

[tangrufus]

What is the current behavior?

• letsencrypt has its own role whereas self-signed-certificate is embedded inside wordpress-setup.

• Although letsencrypt task is separated, its variables (for example: letsencrypt_cert_ids) are leaded to other tasks like wordpress-setup because they are used in Nginx templates.

What is the expected or desired behavior?

Normalize SSL provider tasks:

• Separate self-signed-certificate task

• SSL provider tasks (letsencrypt & self-signed-certificate) template their own Nginx config to {{ nginx_path }}/includes.d/{{ item.key }}/ssl/xxx.conf (Note: ssl subdirectory!)

• Remove hardcoded Nginx ssl config, for example:
  

  trellis/roles/wordpress-setup/templates/wordpress-site.conf.j2

  Lines 88 to 103 in 12ac783

  	{% if item.value.ssl.provider | default('manual') == 'manual' and item.value.ssl.cert is defined and item.value.ssl.key is defined -%}
  	ssl_certificate {{ nginx_path }}/ssl/{{ item.value.ssl.cert | basename }};
  	ssl_certificate_key {{ nginx_path }}/ssl/{{ item.value.ssl.key | basename }};
  	{% elif item.value.ssl.provider | default('manual') == 'letsencrypt' -%}
  	ssl_certificate {{ nginx_path }}/ssl/letsencrypt/{{ item.key }}-{{ letsencrypt_cert_ids[item.key] }}-bundled.cert;
  	ssl_certificate_key {{ nginx_path }}/ssl/letsencrypt/{{ item.key }}.key;
  	{% elif item.value.ssl.provider | default('manual') == 'self-signed' -%}
  	ssl_certificate {{ nginx_path }}/ssl/{{ item.key }}.cert;
  	ssl_trusted_certificate {{ nginx_path }}/ssl/{{ item.key }}.cert;
  	ssl_certificate_key {{ nginx_path }}/ssl/{{ item.key }}.key;
  	{% endif -%}
  	{% endif -%}
  	{% endblock -%}

• Move SSL provider tasks after wordpress-setup to prevent wordpress-setup/nginx-includes from deleting ssl nginx config.

Please provide use cases for changing the current behavior:

• Serve as a reference for third party SSL providers

• Less trouble when working with tags, see: Add Nginx ssl.no-default.conf to drop requests for unknown hosts #888 (comment)

• Other tasks and custom Nginx template need less knowledge about SSL config. Whenever needed, include {{ nginx_path }}/includes.d/{{ item.key }}/ssl/*.conf is enough, see: Add Nginx ssl.no-default.conf to drop requests for unknown hosts #888 (comment)

[swalkinshaw]

I like the sound of all of this 👍 seems like a nice improvement with the separate roles

But I reserve the right to see it first 😛

[swalkinshaw]

Closing since this issue was related to #896

#1310 is a potential successor to this that still needs work.