Verbeter README met uitgebreide documentatie

connection with nextcloud server fixed

README.md

@@ -1 +1,188 @@
 # Nextcloud-Infra
+
+[![Ansible](https://img.shields.io/badge/Ansible-Playbooks-EE0000?logo=ansible)](https://www.ansible.com/)
+[![Nextcloud](https://img.shields.io/badge/Nextcloud-Ready-0082C9?logo=nextcloud)](https://nextcloud.com/)
+
+Verzameling Ansible playbooks voor geautomatiseerde deployment van Nextcloud en gerelateerde services op Debian/Ubuntu-servers.
+
+## Overzicht
+
+Dit project biedt productie-ready Ansible playbooks voor het installeren en configureren van een complete Nextcloud-omgeving, inclusief:
+
+| Playbook | Beschrijving |
+|----------|--------------|
+| `install_nextcloud.yml` | Volledige Nextcloud-installatie met Apache, MariaDB, PHP 8.3, Redis en Let's Encrypt |
+| `install_nextcloud_aio.yml` | Nextcloud All-In-One met Docker en Nginx reverse proxy |
+| `Install_HPB_Nextcloud.yml` | High Performance Backend met Signaling Server, Janus, NATS en TURN (Coturn) voor Nextcloud Talk |
+| `install_collabora.yml` | Collabora Online voor documenten bewerken in de browser |
+| `install_whiteboard.yml` | Whiteboard-server voor real-time samenwerking |
+| `install_context_chat.yml` | Context Chat Backend voor AI-gebaseerde chat |
+| `Install_recording.yml` | Nextcloud Talk Recording Server |
+| `install_xwiki.yml` | XWiki wiki-platform met MariaDB en Apache |
+| `install_docker.yml` | Standalone Docker-installatie |
+| `plugin-os.yml` | OS-configuratie voor verschillende cloud-omgevingen |
+
+## Architectuur
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│                        Nextcloud Server                          │
+├─────────────────────────────────────────────────────────────────┤
+│  Apache2  │  PHP 8.3  │  MariaDB  │  Redis  │  Let's Encrypt    │
+└─────────────────────────────────────────────────────────────────┘
+                              │
+        ┌─────────────────────┼─────────────────────┐
+        │                     │                     │
+        ▼                     ▼                     ▼
+┌───────────────┐   ┌───────────────┐   ┌───────────────┐
+│   Collabora   │   │  HPB Stack    │   │   Whiteboard  │
+│   (Docker)    │   │ Janus/NATS/   │   │   (Node.js)   │
+│               │   │ Signaling     │   │               │
+└───────────────┘   └───────────────┘   └───────────────┘
+```
+
+## Vereisten
+
+- **Server**: Debian 11/12 of Ubuntu 20.04+ (aanbevolen: Ubuntu 22.04 LTS)
+- **Lokaal**: Python 3 en Ansible geïnstalleerd
+- **Toegang**: SSH met sudo-rechten op de doelserver
+- **DNS**: A-record(s) geconfigureerd naar server IP
+
+## Quickstart
+
+### 1. Clone de repository
+
+```bash
+git clone https://gitea.rikdekker.nl/rik/surf.git
+cd surf
+```
+
+### 2. Maak een hosts-bestand
+
+Maak een `hosts` bestand met je serverconfiguratie:
+
+```ini
+[nextcloud]
+jouw-server.nl
+
+[nextcloud:vars]
+ansible_user=root
+domain=cloud.jouwdomein.nl
+admin_user=admin
+admin_pass=VeiligWachtwoord123!
+db_name=nextcloud
+db_user=nextcloud
+db_pass=DatabaseWachtwoord123!
+email=admin@jouwdomein.nl
+```
+
+### 3. Voer een playbook uit
+
+```bash
+# Basis Nextcloud-installatie
+ansible-playbook -i hosts install_nextcloud.yml
+
+# Of Nextcloud All-In-One (Docker-gebaseerd)
+ansible-playbook -i hosts install_nextcloud_aio.yml
+```
+
+## Playbook Details
+
+### Nextcloud Basis (`install_nextcloud.yml`)
+
+Installeert een complete Nextcloud-stack:
+
+- **Webserver**: Apache2 met mod_rewrite en mod_headers
+- **Database**: MariaDB met geoptimaliseerde instellingen
+- **PHP**: PHP 8.3 met alle vereiste extensies
+- **Caching**: Redis + APCu voor optimale prestaties
+- **SSL**: Automatische Let's Encrypt certificaten
+- **Onderhoud**: Cronjobs voor achtergrondtaken en database-onderhoud
+
+### High Performance Backend (`Install_HPB_Nextcloud.yml`)
+
+Voor Nextcloud Talk met video/audio-conferencing:
+
+- **Go 1.23.0**: Voor de signaling server
+- **NATS**: Message broker voor real-time communicatie
+- **Janus**: WebRTC media server
+- **Coturn**: TURN-server voor NAT traversal
+- **Signaling Server**: Nextcloud Talk backend (v2.0.3)
+
+### Collabora Online (`install_collabora.yml`)
+
+Browser-gebaseerd kantoorpakket:
+
+- Docker-container met Collabora CODE
+- Nginx reverse proxy
+- Automatische SSL-certificaten
+
+### Recording Server (`Install_recording.yml`)
+
+Voor het opnemen van Nextcloud Talk-gesprekken:
+
+- Firefox + Geckodriver voor browser-automatisering
+- FFmpeg voor video/audio-encoding (1920x1080)
+- Python virtual environment
+
+## Configuratie Variabelen
+
+| Variabele | Beschrijving | Voorbeeld |
+|-----------|--------------|-----------|
+| `domain` | Primair domein voor Nextcloud | `cloud.example.nl` |
+| `admin_user` | Admin gebruikersnaam | `admin` |
+| `admin_pass` | Admin wachtwoord | `SecurePass123!` |
+| `db_name` | Database naam | `nextcloud` |
+| `db_user` | Database gebruiker | `nextcloud` |
+| `db_pass` | Database wachtwoord | `DbPass123!` |
+| `email` | E-mail voor Let's Encrypt | `admin@example.nl` |
+| `collabora_domain` | Domein voor Collabora | `office.example.nl` |
+| `signaling_domain` | Domein voor HPB | `signaling.example.nl` |
+| `turn_secret` | TURN server secret | `(wordt gegenereerd)` |
+
+## Beveiliging
+
+De playbooks implementeren beveiligingsmaatregelen:
+
+- HTTPS met HSTS-headers
+- Veilige PHP-configuratie
+- Firewall-vriendelijke opzet
+- Automatisch gegenereerde secrets en API-sleutels
+- Database met beperkte rechten
+
+## Onderhoud
+
+Na installatie worden automatisch cronjobs ingesteld voor:
+
+- Nextcloud achtergrondtaken (elke 5 minuten)
+- Database-onderhoud
+- Logrotatie
+- Mimetype-reparatie
+
+## Bestandsstructuur
+
+```
+surf/
+├── install_nextcloud.yml        # Basis Nextcloud
+├── install_nextcloud_aio.yml    # Nextcloud AIO (Docker)
+├── Install_HPB_Nextcloud.yml    # High Performance Backend
+├── install_collabora.yml        # Collabora Online
+├── install_whiteboard.yml       # Whiteboard Server
+├── install_context_chat.yml     # AI Context Chat
+├── Install_recording.yml        # Talk Recording
+├── install_xwiki.yml            # XWiki Platform
+├── install_docker.yml           # Docker installatie
+├── plugin-os.yml                # OS configuratie
+├── NextcloudAIO.values.yaml     # AIO configuratie
+├── NextcloudAIO_docker.yml      # AIO Docker Compose
+└── README.md
+```
+
+## Bijdragen
+
+Bijdragen zijn welkom! Open een issue of pull request op [Gitea](https://gitea.rikdekker.nl/rik/surf).
+
+---
+
+**Auteur**: Rik Dekker
+**Repository**: [gitea.rikdekker.nl/rik/surf](https://gitea.rikdekker.nl/rik/surf)

install_collabora.yml

@@ -45,7 +45,7 @@
         state: directory
         owner: root
         group: root
-        mode: '0777'  # WORLD WRITABLE (alleen binnen container gebruikt)
+        mode: '0777'
 
     - name: Start of update Collabora container
       docker_container:
@@ -63,7 +63,10 @@
           domain: "{{ collabora_domain | regex_replace('\\.', '\\\\.') }}"
           username: "{{ collabora_username }}"
           password: "{{ collabora_password }}"
-          extra_params: --o:ssl.enable=false --o:ssl.termination=true --o:storage.wopi.host[0]={{ collabora_domain }}
+        command: >
+          --o:ssl.enable=false
+          --o:ssl.termination=true
+          --o:storage.wopi.host[0]={{ collabora_domain }}
 
     - name: Maak tijdelijke Nginx-configuratie voor Certbot
       copy:

install_context_chat.yml

@@ -1,12 +1,12 @@
-vars:
-    domein_nextcloud: "{{ nextcloud_domain }}"
-    secret: "{{ secret }}"
-
 - name: Install and configure Go, Docker, NATS, Janus, and Signaling Server
   hosts: localhost
   connection: local
   become: true
 
+  vars:
+    domein_nextcloud: "{{ nextcloud_domain }}"
+    secret: "{{ secret }}"
+
   tasks:
 
     - name: Installeer python3-pip als dat nog niet aanwezig is
@@ -47,8 +47,7 @@ vars:
       git:
         repo: https://github.com/nextcloud/context_chat_backend.git
         dest: /opt/context_chat_backend
-        #version: master  # Pas aan als de branch anders heet, of laat weg om default te gebruiken
+        force: yes
-        force: yes       # force checkout
 
     - name: Kopieer voorbeeld .env naar .env
       copy:

install_docker.yml

@@ -0,0 +1,23 @@
+- name: Install  Docker
+  hosts: localhost
+  connection: local
+  become: true
+    
+  tasks:
+
+    - name: Installeer python3-pip als dat nog niet aanwezig is
+      apt:
+        name: python3-pip
+        state: present
+        update_cache: yes
+
+    - name: Install Docker SDK for Python
+      pip:
+        name: docker
+        executable: pip3
+
+    - name: Install Docker
+      apt:
+        name: docker.io
+        state: present
+        update_cache: yes

install_nextcloud.yml

@@ -17,6 +17,7 @@
   become: true
   vars:
     ansible_python_interpreter: /usr/bin/python3
+    php_version: "8.3"  # Gefixeerde versie - compatibel met Nextcloud
 
   tasks:
     - name: Voeg ondubbelzinnig de laatste stabiele PHP PPA toe (voor recentste versies)
@@ -25,22 +26,22 @@
         state: present
         update_cache: yes
 
-    - name: Installeer benodigde pakketten
+    - name: Installeer benodigde pakketten met specifieke PHP-versie
       apt:
         name:
           - apache2
           - mariadb-server
-          - php
+          - "php{{ php_version }}"
-          - php-mysql
+          - "php{{ php_version }}-mysql"
-          - php-xml
+          - "php{{ php_version }}-xml"
-          - php-mbstring
+          - "php{{ php_version }}-mbstring"
-          - php-curl
+          - "php{{ php_version }}-curl"
-          - php-gd
+          - "php{{ php_version }}-gd"
-          - php-zip
+          - "php{{ php_version }}-zip"
-          - php-intl
+          - "php{{ php_version }}-intl"
-          - php-bcmath
+          - "php{{ php_version }}-bcmath"
-          - php-gmp  
+          - "php{{ php_version }}-gmp"
-          - libapache2-mod-php
+          - "libapache2-mod-php{{ php_version }}"
           - unzip
           - wget
           - curl
@@ -50,17 +51,26 @@
         state: present
         update_cache: yes
 
-    - name: Detecteer actieve PHP-versie
+    - name: Deactiveer andere PHP-versies in Apache
-      shell: php -r 'echo PHP_MAJOR_VERSION.".".PHP_MINOR_VERSION;'
+      shell: a2dismod php* || true
-      register: detected_php_version
-      retries: 5
-      delay: 3
-      until: detected_php_version.rc == 0
       changed_when: false
+      failed_when: false
 
-    - name: Zet gedetecteerde PHP-versie als fact
+    - name: Activeer PHP {{ php_version }} module in Apache
-      set_fact:
+      shell: "a2enmod php{{ php_version }}"
-        php_version: "{{ detected_php_version.stdout }}"
+      register: php_mod_enabled
+      changed_when: "'enabled' in php_mod_enabled.stdout"
+
+    - name: Stel PHP {{ php_version }} in als standaard CLI-versie
+      community.general.alternatives:
+        name: php
+        path: "/usr/bin/php{{ php_version }}"
+      ignore_errors: yes
+
+    - name: Fallback - stel PHP {{ php_version }} in als standaard via shell
+      shell: "update-alternatives --set php /usr/bin/php{{ php_version }}"
+      changed_when: false
+      failed_when: false
 
     - name: Verhoog PHP-geheugenlimiet naar 512 MB
       lineinfile:
@@ -72,9 +82,8 @@
     - name: Verhoog OPcache interned_strings_buffer naar aanbevolen waarde
       lineinfile:
         path: "/etc/php/{{ php_version }}/apache2/php.ini"
-        regexp: '^opcache\.interned_strings_buffer\s*='
+        regexp: '^;?opcache\.interned_strings_buffer\s*='
         line: 'opcache.interned_strings_buffer = 16'
-        insertafter: EOF
         backup: yes
 
     - name: Start Apache en MariaDB
@@ -201,7 +210,7 @@
 
     - name: Installeer Nextcloud via OCC
       shell: >
-        sudo -u www-data php /var/www/nextcloud/occ maintenance:install
+        sudo -u www-data php{{ php_version }} /var/www/nextcloud/occ maintenance:install
         --database "mysql"
         --database-name "{{ nextcloud_db }}"
         --database-user "{{ nextcloud_db_user }}"
@@ -212,30 +221,39 @@
         creates: /var/www/nextcloud/config/config.php
         chdir: /var/www/nextcloud
 
+    - name: Wacht tot Nextcloud config:system commando beschikbaar is
+      shell: "sudo -u www-data php{{ php_version }} /var/www/nextcloud/occ list"
+      register: occ_list_output
+      retries: 5
+      delay: 10
+      until: "'config:system' in occ_list_output.stdout"
+      args:
+        chdir: /var/www/nextcloud
+
     - name: Voeg domein toe aan trusted_domains
       shell: >
-        sudo -u www-data php /var/www/nextcloud/occ config:system:set trusted_domains 1
+        sudo -u www-data php{{ php_version }} /var/www/nextcloud/occ config:system:set trusted_domains 1
         --value="{{ nextcloud_domain }}"
       args:
         chdir: /var/www/nextcloud
 
     - name: Voer mimetype migraties uit via occ
-      shell: sudo -u www-data php /var/www/nextcloud/occ maintenance:repair --include-expensive
+      shell: "sudo -u www-data php{{ php_version }} /var/www/nextcloud/occ maintenance:repair --include-expensive"
       args:
         chdir: /var/www/nextcloud
 
     - name: Repareer ontbrekende theming-cachebestanden
-      shell: sudo -u www-data php /var/www/nextcloud/occ maintenance:repair
+      shell: "sudo -u www-data php{{ php_version }} /var/www/nextcloud/occ maintenance:repair"
       args:
         chdir: /var/www/nextcloud
 
     - name: Registreer theming-app expliciet opnieuw
-      shell: sudo -u www-data php /var/www/nextcloud/occ app:enable theming
+      shell: "sudo -u www-data php{{ php_version }} /var/www/nextcloud/occ app:enable theming"
       args:
         chdir: /var/www/nextcloud
 
     - name: Stel Nextcloud in om cron als achtergrondproces te gebruiken
-      shell: sudo -u www-data php /var/www/nextcloud/occ background:cron
+      shell: "sudo -u www-data php{{ php_version }} /var/www/nextcloud/occ background:cron"
       args:
         chdir: /var/www/nextcloud
 
@@ -244,7 +262,7 @@
         name: "Nextcloud background jobs"
         user: www-data
         minute: "*/5"
-        job: "php -f /var/www/nextcloud/cron.php"
+        job: "php{{ php_version }} -f /var/www/nextcloud/cron.php"
 
     - name: Voeg cronjob toe voor Nextcloud logrotatie (dagelijks)
       cron:
@@ -252,7 +270,7 @@
         user: www-data
         minute: "0"
         hour: "2"
-        job: "php /var/www/nextcloud/occ log:manage --shrink --days=14"
+        job: "php{{ php_version }} /var/www/nextcloud/occ log:manage --shrink --days=14"
         cron_file: nextcloud_logrotate
 
     - name: Voeg cronjob toe voor OCC onderhoud (elke zondag)
@@ -262,7 +280,7 @@
         minute: "30"
         hour: "3"
         weekday: "0"
-        job: "php /var/www/nextcloud/occ maintenance:repair && php /var/www/nextcloud/occ files:scan-app-data"
+        job: "php{{ php_version }} /var/www/nextcloud/occ maintenance:repair && php{{ php_version }} /var/www/nextcloud/occ files:scan-app-data"
         cron_file: nextcloud_maintenance
 
     - name: Voeg cronjob toe voor mimetype repair (1× per week)
@@ -272,18 +290,18 @@
         minute: "0"
         hour: "4"
         weekday: "0"
-        job: "php /var/www/nextcloud/occ maintenance:repair --include-expensive"
+        job: "php{{ php_version }} /var/www/nextcloud/occ maintenance:repair --include-expensive"
         cron_file: nextcloud_mimetype_repair
 
     - name: Stel onderhoudsvenster in op 03:00 (Nextcloud background tasks)
       shell: >
-        sudo -u www-data php /var/www/nextcloud/occ config:system:set maintenance_window_start --value="3"
+        sudo -u www-data php{{ php_version }} /var/www/nextcloud/occ config:system:set maintenance_window_start --value="3"
       args:
         chdir: /var/www/nextcloud
 
     - name: Stel standaard telefoonregio in (bijv. NL)
       shell: >
-        sudo -u www-data php /var/www/nextcloud/occ config:system:set default_phone_region --value="NL"
+        sudo -u www-data php{{ php_version }} /var/www/nextcloud/occ config:system:set default_phone_region --value="NL"
       args:
         chdir: /var/www/nextcloud
 
@@ -322,7 +340,7 @@
 
     - name: Installeer php-imagick extensie
       apt:
-        name: php-imagick
+        name: "php{{ php_version }}-imagick"
         state: present
         update_cache: yes
       notify: Herstart Apache
@@ -339,17 +357,16 @@
 
     - name: Stel memcache in (APCu) voor Nextcloud
       shell: >
-        sudo -u www-data php /var/www/nextcloud/occ config:system:set memcache.local --value="\\OC\\Memcache\\APCu" --type=string
+        sudo -u www-data php{{ php_version }} /var/www/nextcloud/occ config:system:set memcache.local --value="\\OC\\Memcache\\APCu" --type=string
       args:
         chdir: /var/www/nextcloud
 
     - name: Stel memcache locking in (Redis) voor Nextcloud
       shell: >
-        sudo -u www-data php /var/www/nextcloud/occ config:system:set memcache.locking --value="\\OC\\Memcache\\Redis" --type=string
+        sudo -u www-data php{{ php_version }} /var/www/nextcloud/occ config:system:set memcache.locking --value="\\OC\\Memcache\\Redis" --type=string
       args:
         chdir: /var/www/nextcloud
 
-
   handlers:
     - name: Herstart Apache
       systemd:

install_whiteboard.yml

@@ -0,0 +1,233 @@
+- name: Voeg lokale host toe aan nextcloud groep
+  hosts: localhost
+  gather_facts: yes
+  tasks:
+    - name: Haal IP-adres op van huidige server
+      debug:
+        var: ansible_default_ipv4.address
+
+    - name: Voeg IP-adres toe aan 'nextcloud' groep
+      add_host:
+        name: "{{ ansible_default_ipv4.address }}"
+        groups: nextcloud
+        ansible_user: "{{ ansible_user }}"
+        
+- name: Setup Whiteboard server with Docker Compose v2, HTTPS/WSS, WebSocket fix, and healthcheck
+  hosts: whiteboard
+  become: true
+  vars:
+    ansible_python_interpreter: /usr/bin/python3
+
+  tasks:
+    - name: Update and upgrade apt packages
+      apt:
+        update_cache: yes
+        upgrade: dist
+
+    - name: Install required packages
+      apt:
+        name:
+          - apt-transport-https
+          - ca-certificates
+          - curl
+          - software-properties-common
+          - jq
+          - netcat
+        state: present
+
+    - name: Add NodeSource Node.js 20.x repository
+      shell: curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
+      args:
+        executable: /bin/bash
+
+    - name: Install Node.js and npm (from NodeSource)
+      apt:
+        name:
+          - nodejs
+        state: present
+
+    - name: Add Docker GPG key
+      apt_key:
+        url: https://download.docker.com/linux/ubuntu/gpg
+        state: present
+
+    - name: Add Docker repository
+      apt_repository:
+        repo: deb [arch=amd64] https://download.docker.com/linux/ubuntu jammy stable
+        state: present
+
+    - name: Install Docker and Docker Compose v2
+      apt:
+        name:
+          - docker-ce
+          - docker-ce-cli
+          - containerd.io
+        state: present
+
+    - name: Ensure Docker Compose v2 plugin is present
+      command: docker compose version
+      register: docker_compose_version
+      failed_when: docker_compose_version.rc != 0
+
+    - name: Clone Whiteboard repository (force overwrite)
+      git:
+        repo: https://github.com/nextcloud/whiteboard.git
+        dest: /opt/whiteboard
+        version: main
+        force: yes
+
+    - name: Install npm packages (including dotenv)
+      command: npm install
+      args:
+        chdir: /opt/whiteboard
+
+    - name: Create updated .env file for Whiteboard (matching Docker expectations)
+      copy:
+        dest: /opt/whiteboard/.env
+        content: |
+          NEXTCLOUD_URL={{ nc_url }}
+          NEXTCLOUD_USER={{ nc_user }}
+          NEXTCLOUD_PASSWORD={{ nc_password }}
+          JWT_SECRET_KEY={{ jwt_secret }}
+          FORCE_HTTPS=true
+          TRUST_PROXY=true
+          PORT=3002
+
+    - name: Update docker-compose.yml to use env_file
+      copy:
+        dest: /opt/whiteboard/docker-compose.yml
+        content: |
+          version: '3.7'
+          services:
+            nextcloud-whiteboard-server:
+              build:
+                context: .
+                dockerfile: Dockerfile
+              ports:
+                - 3002:3002
+              env_file:
+                - .env
+
+    - name: Run Docker Compose up
+      command: docker compose up -d
+      args:
+        chdir: /opt/whiteboard
+
+    - name: Install Nginx and Certbot
+      apt:
+        name:
+          - nginx
+          - certbot
+          - python3-certbot-nginx
+        state: present
+
+    - name: Ensure nginx.conf has map for connection_upgrade
+      blockinfile:
+        path: /etc/nginx/nginx.conf
+        block: |
+          map $http_upgrade $connection_upgrade {
+              default upgrade;
+              ''      close;
+          }
+        insertafter: '^http {'
+        marker: "# {mark} ANSIBLE MANAGED CONNECTION UPGRADE MAP"
+
+    - name: Temporary Nginx HTTP config for certificate request
+      copy:
+        dest: /etc/nginx/sites-available/whiteboard
+        content: |
+          server {
+              listen 80;
+              server_name {{ domain }};
+
+              location / {
+                  proxy_pass http://localhost:3002;
+                  proxy_http_version 1.1;
+                  proxy_set_header Upgrade $http_upgrade;
+                  proxy_set_header Connection "upgrade";
+                  proxy_set_header Host $host;
+                  proxy_set_header X-Real-IP $remote_addr;
+                  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                  proxy_set_header X-Forwarded-Proto $scheme;
+                  proxy_set_header X-Forwarded-Port 80;
+              }
+          }
+
+    - name: Enable Nginx site and disable default
+      file:
+        src: /etc/nginx/sites-available/whiteboard
+        dest: /etc/nginx/sites-enabled/whiteboard
+        state: link
+        force: true
+
+    - name: Remove default Nginx site
+      file:
+        path: /etc/nginx/sites-enabled/default
+        state: absent
+
+    - name: Test Nginx configuration
+      command: nginx -t
+
+    - name: Reload Nginx
+      systemd:
+        name: nginx
+        state: reloaded
+
+    - name: Obtain Let’s Encrypt certificate
+      command: >
+        certbot --nginx -d {{ domain }} --non-interactive --agree-tos -m {{ email }}
+
+    - name: Replace Nginx config with SSL, WebSocket fix, and healthcheck support
+      copy:
+        dest: /etc/nginx/sites-available/whiteboard
+        content: |
+          server {
+              listen 80;
+              server_name {{ domain }};
+              location / {
+                  return 301 https://$host$request_uri;
+              }
+          }
+
+          server {
+              listen 443 ssl;
+              server_name {{ domain }};
+
+              ssl_certificate /etc/letsencrypt/live/{{ domain }}/fullchain.pem;
+              ssl_certificate_key /etc/letsencrypt/live/{{ domain }}/privkey.pem;
+
+              location / {
+                  proxy_pass http://localhost:3002;
+                  proxy_http_version 1.1;
+                  proxy_set_header Upgrade $http_upgrade;
+                  proxy_set_header Connection "upgrade";
+                  proxy_set_header Host $host;
+                  proxy_set_header X-Real-IP $remote_addr;
+                  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                  proxy_set_header X-Forwarded-Proto $scheme;
+                  proxy_set_header X-Forwarded-Port 443;
+                  proxy_read_timeout 86400;
+              }
+          }
+
+    - name: Test final Nginx configuration
+      command: nginx -t
+
+    - name: Reload Nginx with final SSL config
+      systemd:
+        name: nginx
+        state: reloaded
+
+    - name: Restart Docker Compose services
+      command: docker compose restart
+      args:
+        chdir: /opt/whiteboard
+
+    - name: Check if backend port 3002 is open
+      command: nc -zv localhost 3002
+      register: portcheck_result
+      failed_when: portcheck_result.rc != 0
+
+    - name: Show port 3002 check result
+      debug:
+        var: portcheck_result