From 2be08631867fe838c379397cddd634981ca5dabd Mon Sep 17 00:00:00 2001
From: Ryan Aslett <raslett@linuxfoundation.org>
Date: Thu, 15 Oct 2026 17:04:53 -0700
Subject: [PATCH 1/6] ansible: add certbot role using Cloudflare DNS-01

Installs the distro-packaged certbot and certbot-dns-cloudflare, writes
a 0600 credentials file from the secrets repo, issues a certificate
via DNS-01, and reloads nginx on renewal through a deploy hook.
Renewal is handled by the packaged certbot.timer.

Wire it into the ci and ci-release Jenkins plays to issue certificates
for ci.nodejs.org and ci-release.nodejs.org. nginx is not yet pointed
at the issued certificates.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Signed-off-by: Ryan Aslett <raslett@linuxfoundation.org>
---
 ansible/playbooks/jenkins/host/create.yml     |  2 +
 ansible/roles/certbot/defaults/main.yml       |  4 ++
 ansible/roles/certbot/files/reload-nginx.sh   |  2 +
 ansible/roles/certbot/meta/main.yml           |  4 ++
 ansible/roles/certbot/tasks/main.yml          | 60 +++++++++++++++++++
 .../roles/certbot/templates/cloudflare.ini.j2 |  1 +
 6 files changed, 73 insertions(+)
 create mode 100644 ansible/roles/certbot/defaults/main.yml
 create mode 100644 ansible/roles/certbot/files/reload-nginx.sh
 create mode 100644 ansible/roles/certbot/meta/main.yml
 create mode 100644 ansible/roles/certbot/tasks/main.yml
 create mode 100644 ansible/roles/certbot/templates/cloudflare.ini.j2

diff --git a/ansible/playbooks/jenkins/host/create.yml b/ansible/playbooks/jenkins/host/create.yml
index 222ef9253..662020d64 100644
--- a/ansible/playbooks/jenkins/host/create.yml
+++ b/ansible/playbooks/jenkins/host/create.yml
@@ -19,7 +19,9 @@
 - hosts: infra-digitalocean-ubuntu2204-x64-1 # ci.nodejs.org
   roles:
   - { role: jenkins-nginx, jenkins_nginx_fqdn: 'ci.nodejs.org', jenkins_nginx_status_page: true }
+  - { role: certbot, certbot_domains: ['ci.nodejs.org'] }
 
 - hosts: infra-ibm-ubuntu2404-x64-1 # ci-release.nodejs.org
   roles:
   - { role: jenkins-nginx, jenkins_nginx_fqdn: 'ci-release.nodejs.org' }
+  - { role: certbot, certbot_domains: ['ci-release.nodejs.org'] }
diff --git a/ansible/roles/certbot/defaults/main.yml b/ansible/roles/certbot/defaults/main.yml
new file mode 100644
index 000000000..272806d98
--- /dev/null
+++ b/ansible/roles/certbot/defaults/main.yml
@@ -0,0 +1,4 @@
+---
+
+certbot_email: build@iojs.org
+certbot_domains: []
diff --git a/ansible/roles/certbot/files/reload-nginx.sh b/ansible/roles/certbot/files/reload-nginx.sh
new file mode 100644
index 000000000..05e53077f
--- /dev/null
+++ b/ansible/roles/certbot/files/reload-nginx.sh
@@ -0,0 +1,2 @@
+#!/bin/sh
+systemctl reload nginx
diff --git a/ansible/roles/certbot/meta/main.yml b/ansible/roles/certbot/meta/main.yml
new file mode 100644
index 000000000..c1873b46e
--- /dev/null
+++ b/ansible/roles/certbot/meta/main.yml
@@ -0,0 +1,4 @@
+---
+
+dependencies:
+  - role: read-secrets
diff --git a/ansible/roles/certbot/tasks/main.yml b/ansible/roles/certbot/tasks/main.yml
new file mode 100644
index 000000000..f5c18361f
--- /dev/null
+++ b/ansible/roles/certbot/tasks/main.yml
@@ -0,0 +1,60 @@
+---
+
+#
+# issues and auto-renews a Let's Encrypt certificate via the
+# certbot-dns-cloudflare plugin (DNS-01 challenge). Works whether or not
+# the domain is Cloudflare-proxied, since it only needs DNS API access,
+# not inbound HTTP on the host.
+#
+# expects:
+#   certbot_domains: list of hostnames to include on the certificate.
+#     certbot_domains[0] is used as the certificate's --cert-name.
+#   certbot_email: contact address passed to --email.
+#     Defaults to build@iojs.org.
+#
+# expects a `cloudflare_api_token` secret (via the read-secrets role),
+# scoped to a Cloudflare API token restricted to editing DNS on the
+# zone(s) covering certbot_domains.
+#
+
+- name: certbot | install certbot and the cloudflare dns plugin
+  package:
+    name:
+      - certbot
+      - python3-certbot-dns-cloudflare
+    state: present
+
+- name: certbot | install cloudflare dns api credentials
+  template:
+    src: cloudflare.ini.j2
+    dest: /etc/letsencrypt/cloudflare.ini
+    mode: 0600
+  no_log: yes
+
+- name: certbot | install nginx reload deploy hook
+  copy:
+    src: reload-nginx.sh
+    dest: /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh
+    mode: 0755
+
+- name: certbot | request certificate
+  command:
+    cmd: >-
+      certbot certonly
+      --dns-cloudflare
+      --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini
+      --dns-cloudflare-propagation-seconds 30
+      --cert-name {{ certbot_domains[0] }}
+      -d {{ certbot_domains | join(' -d ') }}
+      --email {{ certbot_email }}
+      --agree-tos
+      --non-interactive
+      --deploy-hook /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh
+  args:
+    creates: "/etc/letsencrypt/live/{{ certbot_domains[0] }}/fullchain.pem"
+
+- name: certbot | enable and start renewal timer
+  service:
+    name: certbot.timer
+    state: started
+    enabled: yes
diff --git a/ansible/roles/certbot/templates/cloudflare.ini.j2 b/ansible/roles/certbot/templates/cloudflare.ini.j2
new file mode 100644
index 000000000..f521e0179
--- /dev/null
+++ b/ansible/roles/certbot/templates/cloudflare.ini.j2
@@ -0,0 +1 @@
+dns_cloudflare_api_token = {{ secrets.cloudflare_api_token }}

From 23966f71054ffa742add89c1ba9cc537362f8739 Mon Sep 17 00:00:00 2001
From: Ryan Aslett <raslett@linuxfoundation.org>
Date: Fri, 16 Oct 2026 00:03:44 -0700
Subject: [PATCH 2/6] ansible: certbot role fixes, run tags, and web host
 wiring

Create the renewal-hooks/deploy directory before installing the hook so
a first run on a fresh host works, and drop --deploy-hook since certbot
already runs every script in that directory on renewal.

Tag the certbot and jenkins-nginx role entries so each can be run alone
with --tags without skipping its read-secrets dependency.

Issue certificates on www (nodejs.org and *.nodejs.org) and on the
unencrypted host. nginx is not yet pointed at them.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Signed-off-by: Ryan Aslett <raslett@linuxfoundation.org>
---
 ansible/playbooks/create-rsync-unencrypted.yml | 1 +
 ansible/playbooks/create-webhost.yml           | 1 +
 ansible/playbooks/jenkins/host/create.yml      | 8 ++++----
 ansible/roles/certbot/tasks/main.yml           | 7 ++++++-
 4 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/ansible/playbooks/create-rsync-unencrypted.yml b/ansible/playbooks/create-rsync-unencrypted.yml
index 7858f7335..6e3bba200 100644
--- a/ansible/playbooks/create-rsync-unencrypted.yml
+++ b/ansible/playbooks/create-rsync-unencrypted.yml
@@ -12,3 +12,4 @@
     - package-upgrade
     - baselayout
     - { role: nginx, sites: [ 'nodejs.org','unencrypted' ] }
+    - { role: certbot, certbot_domains: ['unencrypted.nodejs.org'], tags: certbot }
diff --git a/ansible/playbooks/create-webhost.yml b/ansible/playbooks/create-webhost.yml
index e8ce85940..49abe6f23 100644
--- a/ansible/playbooks/create-webhost.yml
+++ b/ansible/playbooks/create-webhost.yml
@@ -14,6 +14,7 @@
     - package-upgrade
     - baselayout
     - { role: nginx, sites: [ 'nodejs.org', 'iojs.org', 'dist.libuv.org' ] }
+    - { role: certbot, certbot_domains: ['nodejs.org', '*.nodejs.org'], tags: certbot }
 
   pre_tasks:
     - name: check if secrets are properly set
diff --git a/ansible/playbooks/jenkins/host/create.yml b/ansible/playbooks/jenkins/host/create.yml
index 662020d64..980d1f453 100644
--- a/ansible/playbooks/jenkins/host/create.yml
+++ b/ansible/playbooks/jenkins/host/create.yml
@@ -18,10 +18,10 @@
 
 - hosts: infra-digitalocean-ubuntu2204-x64-1 # ci.nodejs.org
   roles:
-  - { role: jenkins-nginx, jenkins_nginx_fqdn: 'ci.nodejs.org', jenkins_nginx_status_page: true }
-  - { role: certbot, certbot_domains: ['ci.nodejs.org'] }
+  - { role: jenkins-nginx, jenkins_nginx_fqdn: 'ci.nodejs.org', jenkins_nginx_status_page: true, tags: jenkins-nginx }
+  - { role: certbot, certbot_domains: ['ci.nodejs.org'], tags: certbot }
 
 - hosts: infra-ibm-ubuntu2404-x64-1 # ci-release.nodejs.org
   roles:
-  - { role: jenkins-nginx, jenkins_nginx_fqdn: 'ci-release.nodejs.org' }
-  - { role: certbot, certbot_domains: ['ci-release.nodejs.org'] }
+  - { role: jenkins-nginx, jenkins_nginx_fqdn: 'ci-release.nodejs.org', tags: jenkins-nginx }
+  - { role: certbot, certbot_domains: ['ci-release.nodejs.org'], tags: certbot }
diff --git a/ansible/roles/certbot/tasks/main.yml b/ansible/roles/certbot/tasks/main.yml
index f5c18361f..fb0ba731d 100644
--- a/ansible/roles/certbot/tasks/main.yml
+++ b/ansible/roles/certbot/tasks/main.yml
@@ -24,6 +24,12 @@
       - python3-certbot-dns-cloudflare
     state: present
 
+- name: certbot | ensure renewal deploy hook directory
+  file:
+    path: /etc/letsencrypt/renewal-hooks/deploy
+    state: directory
+    mode: 0755
+
 - name: certbot | install cloudflare dns api credentials
   template:
     src: cloudflare.ini.j2
@@ -49,7 +55,6 @@
       --email {{ certbot_email }}
       --agree-tos
       --non-interactive
-      --deploy-hook /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh
   args:
     creates: "/etc/letsencrypt/live/{{ certbot_domains[0] }}/fullchain.pem"
 

From 966f71cbaf8bf49a1820bb0b051cf4af24e34663 Mon Sep 17 00:00:00 2001
From: Ryan Aslett <raslett@linuxfoundation.org>
Date: Fri, 16 Oct 2026 00:19:26 -0700
Subject: [PATCH 3/6] ansible: tag the certbot read-secrets dependency

Tags on a role entry are not inherited by the tasks of its meta
dependencies, so running with --tags certbot skipped the secrets
decrypt step and left the Cloudflare token undefined. Tag the
dependency so the certbot role can be run on its own.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Signed-off-by: Ryan Aslett <raslett@linuxfoundation.org>
---
 ansible/roles/certbot/meta/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ansible/roles/certbot/meta/main.yml b/ansible/roles/certbot/meta/main.yml
index c1873b46e..98cc82d67 100644
--- a/ansible/roles/certbot/meta/main.yml
+++ b/ansible/roles/certbot/meta/main.yml
@@ -1,4 +1,4 @@
 ---
 
 dependencies:
-  - role: read-secrets
+  - { role: read-secrets, tags: certbot }

From a23f23065d08683ceb66d3f90f2f4ab7c0681da2 Mon Sep 17 00:00:00 2001
From: Ryan Aslett <raslett@linuxfoundation.org>
Date: Fri, 16 Oct 2026 10:03:09 -0700
Subject: [PATCH 4/6] ansible: switch certbot role to HTTP-01 with per-host
 certificates

Issue one certificate per directly reachable origin name (ci,
ci-release, direct and unencrypted) using certbot --webroot, instead
of the Cloudflare DNS-01 plugin. This needs no API token and no DNS
delegation, and keeps certbot distro-packaged.

Serve /.well-known/acme-challenge/ from /var/www/letsencrypt on the
port 80 vhosts, and add reload handlers plus an nginx-sites tag so
those vhost changes can be deployed without running the whole nginx
role. ci-release moves its port 80 redirect into a location so the
challenge path is reachable.

nginx is not yet pointed at the issued certificates.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Signed-off-by: Ryan Aslett <raslett@linuxfoundation.org>
---
 ansible/playbooks/create-webhost.yml          |  2 +-
 ansible/roles/certbot/defaults/main.yml       |  6 +++
 ansible/roles/certbot/meta/main.yml           |  4 --
 ansible/roles/certbot/tasks/main.yml          | 41 ++++++++-----------
 .../roles/certbot/templates/cloudflare.ini.j2 |  1 -
 ansible/roles/jenkins-nginx/handlers/main.yml |  6 +++
 ansible/roles/jenkins-nginx/tasks/main.yml    |  1 +
 .../templates/ci-release.nodejs.org.conf.j2   | 10 ++++-
 .../templates/ci.nodejs.org.conf.j2           |  5 +++
 ansible/roles/nginx/handlers/main.yml         |  6 +++
 ansible/roles/nginx/tasks/main.yml            |  3 ++
 .../roles/nginx/templates/nodejs.org.conf.j2  |  6 +++
 .../roles/nginx/templates/unencrypted.conf.j2 |  5 +++
 13 files changed, 65 insertions(+), 31 deletions(-)
 delete mode 100644 ansible/roles/certbot/meta/main.yml
 delete mode 100644 ansible/roles/certbot/templates/cloudflare.ini.j2
 create mode 100644 ansible/roles/jenkins-nginx/handlers/main.yml
 create mode 100644 ansible/roles/nginx/handlers/main.yml

diff --git a/ansible/playbooks/create-webhost.yml b/ansible/playbooks/create-webhost.yml
index 49abe6f23..2cb49590a 100644
--- a/ansible/playbooks/create-webhost.yml
+++ b/ansible/playbooks/create-webhost.yml
@@ -14,7 +14,7 @@
     - package-upgrade
     - baselayout
     - { role: nginx, sites: [ 'nodejs.org', 'iojs.org', 'dist.libuv.org' ] }
-    - { role: certbot, certbot_domains: ['nodejs.org', '*.nodejs.org'], tags: certbot }
+    - { role: certbot, certbot_domains: ['direct.nodejs.org'], tags: certbot }
 
   pre_tasks:
     - name: check if secrets are properly set
diff --git a/ansible/roles/certbot/defaults/main.yml b/ansible/roles/certbot/defaults/main.yml
index 272806d98..475de41cf 100644
--- a/ansible/roles/certbot/defaults/main.yml
+++ b/ansible/roles/certbot/defaults/main.yml
@@ -1,4 +1,10 @@
 ---
 
 certbot_email: build@iojs.org
+
+# Hostnames for one certificate; the first is also the certificate name.
+# Each must resolve straight to this host on port 80, and the nginx vhost
+# answering on port 80 must serve /.well-known/acme-challenge/ from
+# certbot_webroot.
 certbot_domains: []
+certbot_webroot: /var/www/letsencrypt
diff --git a/ansible/roles/certbot/meta/main.yml b/ansible/roles/certbot/meta/main.yml
deleted file mode 100644
index 98cc82d67..000000000
--- a/ansible/roles/certbot/meta/main.yml
+++ /dev/null
@@ -1,4 +0,0 @@
----
-
-dependencies:
-  - { role: read-secrets, tags: certbot }
diff --git a/ansible/roles/certbot/tasks/main.yml b/ansible/roles/certbot/tasks/main.yml
index fb0ba731d..a02116e00 100644
--- a/ansible/roles/certbot/tasks/main.yml
+++ b/ansible/roles/certbot/tasks/main.yml
@@ -1,42 +1,36 @@
 ---
 
 #
-# issues and auto-renews a Let's Encrypt certificate via the
-# certbot-dns-cloudflare plugin (DNS-01 challenge). Works whether or not
-# the domain is Cloudflare-proxied, since it only needs DNS API access,
-# not inbound HTTP on the host.
+# issues and auto-renews a Let's Encrypt certificate using the HTTP-01
+# challenge, answered by nginx from a webroot. Renewal runs from the
+# distro-packaged certbot.timer.
 #
 # expects:
-#   certbot_domains: list of hostnames to include on the certificate.
-#     certbot_domains[0] is used as the certificate's --cert-name.
+#   certbot_domains: list of hostnames on the certificate. The first is
+#     used as the certificate name. See defaults for the requirements.
 #   certbot_email: contact address passed to --email.
-#     Defaults to build@iojs.org.
 #
-# expects a `cloudflare_api_token` secret (via the read-secrets role),
-# scoped to a Cloudflare API token restricted to editing DNS on the
-# zone(s) covering certbot_domains.
+# The first run requests the certificate; later runs leave renewal to
+# certbot.timer.
 #
 
-- name: certbot | install certbot and the cloudflare dns plugin
+- name: certbot | install certbot
   package:
-    name:
-      - certbot
-      - python3-certbot-dns-cloudflare
+    name: certbot
     state: present
 
+- name: certbot | create the acme challenge webroot
+  file:
+    path: "{{ certbot_webroot }}"
+    state: directory
+    mode: 0755
+
 - name: certbot | ensure renewal deploy hook directory
   file:
     path: /etc/letsencrypt/renewal-hooks/deploy
     state: directory
     mode: 0755
 
-- name: certbot | install cloudflare dns api credentials
-  template:
-    src: cloudflare.ini.j2
-    dest: /etc/letsencrypt/cloudflare.ini
-    mode: 0600
-  no_log: yes
-
 - name: certbot | install nginx reload deploy hook
   copy:
     src: reload-nginx.sh
@@ -47,9 +41,8 @@
   command:
     cmd: >-
       certbot certonly
-      --dns-cloudflare
-      --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini
-      --dns-cloudflare-propagation-seconds 30
+      --webroot
+      --webroot-path {{ certbot_webroot }}
       --cert-name {{ certbot_domains[0] }}
       -d {{ certbot_domains | join(' -d ') }}
       --email {{ certbot_email }}
diff --git a/ansible/roles/certbot/templates/cloudflare.ini.j2 b/ansible/roles/certbot/templates/cloudflare.ini.j2
deleted file mode 100644
index f521e0179..000000000
--- a/ansible/roles/certbot/templates/cloudflare.ini.j2
+++ /dev/null
@@ -1 +0,0 @@
-dns_cloudflare_api_token = {{ secrets.cloudflare_api_token }}
diff --git a/ansible/roles/jenkins-nginx/handlers/main.yml b/ansible/roles/jenkins-nginx/handlers/main.yml
new file mode 100644
index 000000000..edde81c50
--- /dev/null
+++ b/ansible/roles/jenkins-nginx/handlers/main.yml
@@ -0,0 +1,6 @@
+---
+
+- name: reload nginx
+  service:
+    name: nginx
+    state: reloaded
diff --git a/ansible/roles/jenkins-nginx/tasks/main.yml b/ansible/roles/jenkins-nginx/tasks/main.yml
index f65840101..7755bfd4a 100644
--- a/ansible/roles/jenkins-nginx/tasks/main.yml
+++ b/ansible/roles/jenkins-nginx/tasks/main.yml
@@ -41,6 +41,7 @@
     src: "{{ jenkins_nginx_fqdn }}.conf.j2"
     dest: /etc/nginx/sites-available/jenkins-iojs
     mode: 0644
+  notify: reload nginx
 
 - name: jenkins-nginx | symlink site into sites-enabled
   file:
diff --git a/ansible/roles/jenkins-nginx/templates/ci-release.nodejs.org.conf.j2 b/ansible/roles/jenkins-nginx/templates/ci-release.nodejs.org.conf.j2
index 32d4a2e3e..36ede24f2 100644
--- a/ansible/roles/jenkins-nginx/templates/ci-release.nodejs.org.conf.j2
+++ b/ansible/roles/jenkins-nginx/templates/ci-release.nodejs.org.conf.j2
@@ -1,7 +1,15 @@
 server {
     listen 80;
     server_name {{ jenkins_nginx_fqdn }};
-    return 301 https://{{ jenkins_nginx_fqdn }}$request_uri;
+
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/www/letsencrypt;
+        default_type text/plain;
+    }
+
+    location / {
+        return 301 https://{{ jenkins_nginx_fqdn }}$request_uri;
+    }
 }
 
 server {
diff --git a/ansible/roles/jenkins-nginx/templates/ci.nodejs.org.conf.j2 b/ansible/roles/jenkins-nginx/templates/ci.nodejs.org.conf.j2
index 79313406a..a0a2b9f6f 100644
--- a/ansible/roles/jenkins-nginx/templates/ci.nodejs.org.conf.j2
+++ b/ansible/roles/jenkins-nginx/templates/ci.nodejs.org.conf.j2
@@ -23,6 +23,11 @@ server {
       autoindex on;
     }
 
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/www/letsencrypt;
+        default_type text/plain;
+    }
+
     location / {
         rewrite ^ https://{{ jenkins_nginx_fqdn }}$request_uri permanent;
     }
diff --git a/ansible/roles/nginx/handlers/main.yml b/ansible/roles/nginx/handlers/main.yml
new file mode 100644
index 000000000..edde81c50
--- /dev/null
+++ b/ansible/roles/nginx/handlers/main.yml
@@ -0,0 +1,6 @@
+---
+
+- name: reload nginx
+  service:
+    name: nginx
+    state: reloaded
diff --git a/ansible/roles/nginx/tasks/main.yml b/ansible/roles/nginx/tasks/main.yml
index e718fc02e..fdcad263c 100644
--- a/ansible/roles/nginx/tasks/main.yml
+++ b/ansible/roles/nginx/tasks/main.yml
@@ -20,6 +20,8 @@
   loop_control:
     loop_var: site
   with_items: "{{ sites }}"
+  notify: reload nginx
+  tags: nginx-sites
 
 - name: symlink sites to `sites-enabled`
   file:
@@ -29,6 +31,7 @@
   loop_control:
     loop_var: site
   with_indexed_items: "{{ sites }}"
+  tags: nginx-sites
 
 - name: remove default site
   file:
diff --git a/ansible/roles/nginx/templates/nodejs.org.conf.j2 b/ansible/roles/nginx/templates/nodejs.org.conf.j2
index a7d8cce17..a147a357c 100644
--- a/ansible/roles/nginx/templates/nodejs.org.conf.j2
+++ b/ansible/roles/nginx/templates/nodejs.org.conf.j2
@@ -37,6 +37,12 @@ server {
 
     error_page 404 /404.html;
 
+    # Let's Encrypt HTTP-01 validation, served from the certbot webroot
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/www/letsencrypt;
+        default_type text/plain;
+    }
+
     # For the unencrypted Node.js server, we redirect any request to the HTTPS site
     # Unless it is within /dist or is for a JSON file
     location ~ ^/(?!(dist/|dist$|\.json$)) {
diff --git a/ansible/roles/nginx/templates/unencrypted.conf.j2 b/ansible/roles/nginx/templates/unencrypted.conf.j2
index 36ebd0ab5..b2d678f2f 100644
--- a/ansible/roles/nginx/templates/unencrypted.conf.j2
+++ b/ansible/roles/nginx/templates/unencrypted.conf.j2
@@ -7,6 +7,11 @@ server {
 
     root /home/dist/www;
 
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/www/letsencrypt;
+        default_type text/plain;
+    }
+
     location /download {
         alias /home/dist/$dist_path;
         autoindex on;

From c1138b0543041285f208e273a6ebda5f01d4b2bf Mon Sep 17 00:00:00 2001
From: Ryan Aslett <raslett@linuxfoundation.org>
Date: Fri, 16 Oct 2026 12:45:55 -0700
Subject: [PATCH 5/6] ansible: serve ci-release from its Let's Encrypt
 certificate

Point the ci-release nginx vhost at the certificate certbot issues for
ci-release.nodejs.org and drop OCSP stapling, which Let's Encrypt no
longer supports.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Signed-off-by: Ryan Aslett <raslett@linuxfoundation.org>
---
 .../jenkins-nginx/templates/ci-release.nodejs.org.conf.j2  | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/ansible/roles/jenkins-nginx/templates/ci-release.nodejs.org.conf.j2 b/ansible/roles/jenkins-nginx/templates/ci-release.nodejs.org.conf.j2
index 36ede24f2..599ca2fca 100644
--- a/ansible/roles/jenkins-nginx/templates/ci-release.nodejs.org.conf.j2
+++ b/ansible/roles/jenkins-nginx/templates/ci-release.nodejs.org.conf.j2
@@ -16,8 +16,8 @@ server {
     listen 443 default_server ssl http2;
     server_name {{ jenkins_nginx_fqdn }};
 
-    ssl_certificate     ssl/nodejs_chained.crt;
-    ssl_certificate_key ssl/nodejs.key;
+    ssl_certificate     /etc/letsencrypt/live/{{ jenkins_nginx_fqdn }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ jenkins_nginx_fqdn }}/privkey.pem;
 
     ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";
     ssl_prefer_server_ciphers on;
@@ -26,9 +26,6 @@ server {
     ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
     ssl_session_cache shared:SSL:50m;
 
-    ssl_stapling on;
-    ssl_stapling_verify on;
-    ssl_trusted_certificate ssl/nodejs_chained.crt;
     resolver 8.8.4.4 8.8.8.8 valid=300s;
     resolver_timeout 10s;
 

From d835795f1443f16720ff69d94b818c7e346f3f36 Mon Sep 17 00:00:00 2001
From: Ryan Aslett <raslett@linuxfoundation.org>
Date: Fri, 16 Oct 2026 12:53:50 -0700
Subject: [PATCH 6/6] ansible: serve ci from its Let's Encrypt certificate

Point the ci nginx vhost at the certificate certbot issues for
ci.nodejs.org and drop OCSP stapling, which Let's Encrypt no longer
supports.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Signed-off-by: Ryan Aslett <raslett@linuxfoundation.org>
---
 .../roles/jenkins-nginx/templates/ci.nodejs.org.conf.j2    | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/ansible/roles/jenkins-nginx/templates/ci.nodejs.org.conf.j2 b/ansible/roles/jenkins-nginx/templates/ci.nodejs.org.conf.j2
index a0a2b9f6f..9930aa207 100644
--- a/ansible/roles/jenkins-nginx/templates/ci.nodejs.org.conf.j2
+++ b/ansible/roles/jenkins-nginx/templates/ci.nodejs.org.conf.j2
@@ -39,8 +39,8 @@ server {
     listen 443 default_server ssl spdy;
     server_name {{ jenkins_nginx_fqdn }};
 
-    ssl_certificate     ssl/nodejs_chained.crt;
-    ssl_certificate_key ssl/nodejs.key;
+    ssl_certificate     /etc/letsencrypt/live/{{ jenkins_nginx_fqdn }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ jenkins_nginx_fqdn }}/privkey.pem;
 
     ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";
     ssl_prefer_server_ciphers on;
@@ -49,9 +49,6 @@ server {
     ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
     ssl_session_cache shared:SSL:50m;
 
-    ssl_stapling on;
-    ssl_stapling_verify on;
-    ssl_trusted_certificate ssl/nodejs_chained.crt;
     resolver 8.8.4.4 8.8.8.8 valid=300s;
     resolver_timeout 10s;