Point rubenhensen.nl to mailserver for reverse proxy

ansible/mailserver/roles/nginx/templates/k8s-backend-ip.conf.j2

@@ -0,0 +1 @@
+set $k8s_ip 127.0.0.1;

ansible/mailserver/roles/nginx/templates/k8s-proxy.conf.j2

@@ -0,0 +1,17 @@
+# Catch-all for any domain not handled by mail.conf
+# Proxies ACME challenges to K8s for cert-manager, redirects rest to HTTPS
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name _;
+
+    location /.well-known/acme-challenge/ {
+        include /etc/nginx/k8s-backend-ip.conf;
+        proxy_pass http://$k8s_ip:80;
+        proxy_set_header Host $host;
+    }
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}

ansible/mailserver/roles/nginx/templates/k8s-upstream.conf.j2

@@ -0,0 +1,3 @@
+upstream k8s_tls {
+    server 127.0.0.1:443;
+}

ansible/mailserver/roles/nginx/templates/mail.conf.j2

@@ -15,8 +15,7 @@ server {
 }
 
 server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
+    listen 127.0.0.1:8443 ssl http2;
     server_name {{ nginx_server_name }};
 
     ssl_certificate {{ nginx_tls_cert }};
@@ -94,8 +93,7 @@ server {
 }
 
 server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
+    listen 127.0.0.1:8443 ssl http2;
     server_name {{ nginx_stalwart_server_name }};
 
     ssl_certificate {{ nginx_tls_cert }};

ansible/mailserver/roles/nginx/templates/nginx.conf.j2

@@ -0,0 +1,54 @@
+user www-data;
+worker_processes auto;
+pid /run/nginx.pid;
+include /etc/nginx/modules-enabled/*.conf;
+
+events {
+    worker_connections 768;
+}
+
+http {
+    sendfile on;
+    tcp_nopush on;
+    types_hash_max_size 2048;
+
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+
+    access_log /var/log/nginx/access.log;
+    error_log /var/log/nginx/error.log;
+
+    gzip on;
+
+    include /etc/nginx/sites-enabled/*;
+}
+
+stream {
+    log_format stream '$remote_addr [$time_local] '
+                      '$protocol $status $bytes_sent $bytes_received '
+                      '$session_time "$ssl_preread_server_name"';
+    access_log /var/log/nginx/stream.log stream;
+
+    map $ssl_preread_server_name $tls_backend {
+{% for domain in nginx_local_tls_domains %}
+        {{ domain }}  local_tls;
+{% endfor %}
+        default       k8s_tls;
+    }
+
+    upstream local_tls {
+        server 127.0.0.1:8443;
+    }
+
+    include /etc/nginx/stream.d/*.conf;
+
+    server {
+        listen 443;
+        listen [::]:443;
+        ssl_preread on;
+        proxy_pass $tls_backend;
+    }
+}