nginx_sites:
  - id: credentials
    name: "example.com"
    ip: x.x.x.x
    state: present
    add_webroot: no
    aliases:
      - "alias.example.com"
    template: templates-shared/nginx-with-https-upgrade.tmpl
    webroot: "/srv/x/webroot"
    # Where the .well-known folder sits in
    wellknown: "/srv/x/letsencrypt"
    redirects:
      - "{{ another.example.com }}"
      - "{{ something.example.com }}.au"
    ssl:
      cert_path: /etc/letsencrypt/live/{{ x }}
      cert_name: fullchain.pem
      key_name: privkey.pem
    rules: []
    append: ''

cat reverse-proxy.j2 
# {{ ansible_managed }}
# HTTPS terminating proxy sitting in front of webapp.
# TODO: Check: Some of this file can probably be removed with no loss in functionality.

# default_server on listen is required to work around bug https://github.com/certbot/certbot/issues/5817#issuecomment-391051737
server {
    server_name {{ item.name }}{% for value in item.aliases|default([]) %} {{ value }}{% endfor %};

    return 301 https://$host$request_uri;

    listen 80 ;
    return 404;
}

server {
    server_name {{ item.name }}{% for value in item.aliases|default([]) %} {{ value }}{% endfor %};

    charset utf-8;
    keepalive_timeout 65;
    client_max_body_size 128M;
    gzip_types text/css application/javascript text/javascript text/plain text/xml application/xml;
    gzip_vary on;

    root {{ item.webroot }};

    # Letsencrypt
    location /.well-known {
        alias {{ item.wellknown }}/.well-known;
    }

    location / {
        proxy_pass http://127.0.0.1:8000/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    listen 443 ssl;
    ssl_certificate {{ item.ssl.cert_path |default(openssl_certs_path) }}/{{ item.ssl.cert_name|default('server.crt') }};
    ssl_certificate_key {{ item.ssl.cert_path |default(openssl_keys_path) }}/{{ item.ssl.key_name|default('server.key') }};

}