Add the basics of some edge caching

ansible/roles/gateway/files/nginx-cdn.conf

@@ -0,0 +1,30 @@
+# {{ ansible_managed }}
+
+proxy_cache_path /var/lib/nginx/cache levels=1:2 keys_zone=cdncache:20m max_size=1g inactive=48h;
+
+{% for domain in cdn_domains %}
+server {
+    listen 8800 ssl proxy_protocol;
+    http2 on;
+
+    server_name {{ domain }};
+
+    ssl_certificate /etc/letsencrypt/live/{{ domain }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ domain }}/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/{{ domain }}/chain.pem;
+
+    include includes/ssl.conf;
+
+    real_ip_header proxy_protocol;
+
+    set_real_ip_from 127.0.0.1;
+
+    proxy_cache_use_stale error timeout http_500 http_502 http_503 http_504;
+
+    location / {
+        proxy_cache cdncache;
+        add_header X-Cache-Status $upstream_cache_status;
+        proxy_pass https://{{ wireguard.clients.ingress.ip }}:443;
+    }
+}
+{% endfor %}

ansible/roles/gateway/files/nginx.conf

@@ -9,8 +9,13 @@ access_log /var/log/nginx/gateway.log gateway;
 access_log /var/log/nginx/ips.log ips;
 
 map $ssl_preread_server_name $gateway_destination {
-    headscale.jakehoward.tech 127.0.0.1:8888;
-    default                   {{ wireguard.clients.ingress.ip }}:8443;
+    default                      {{ wireguard.clients.ingress.ip }}:8443;
+
+    headscale.jakehoward.tech    127.0.0.1:8888;
+
+    {% for domain in cdn_domains %}
+    {{ domain }}  127.0.0.1:8800;
+    {% endfor %}
 }
 
 server {

ansible/roles/gateway/tasks/nginx.yml

@@ -6,6 +6,14 @@
   become: true
   register: nginx_config
 
+- name: Install CDN config
+  template:
+    src: files/nginx-cdn.conf
+    dest: /etc/nginx/http.d/cdn.conf
+    mode: "0644"
+  become: true
+  register: nginx_config
+
 - name: Reload Nginx
   service:
     name: nginx