ansible: capture jenkins-nginx config for ci and ci-release

[ryanaslett]

Summary

• Adds a jenkins-nginx role that captures the nginx reverse proxy config already running by hand in front of the Jenkins masters on ci.nodejs.org and ci-release.nodejs.org (package install, dhparam, proxy_cache_path config, per-host site config, and ci.nodejs.org's /server_status stub_status page).
• Management-only: templates/files were pulled from the live hosts and verified byte-for-byte against the running config, and --check --diff shows no behavior change (aside from one straight-quote fix to an already-mismatched-quote typo in a comment).
• Ansible will only actually be run against these hosts for this role (and the follow-up certbot work) at deploy time — not as part of this PR.

This is the first PR in a stack; a follow-up certbot automation PR will build on top of it.

Test plan

• Rendered each template locally with the target FQDN and diffed against the live /etc/nginx/sites-available/jenkins-iojs on both hosts (byte-identical modulo the one accepted quote fix)
• ansible-playbook ansible/playbooks/jenkins/host/create.yml --limit infra-digitalocean-ubuntu2204-x64-1,infra-ibm-ubuntu2404-x64-1 --check --diff --start-at-task "jenkins-nginx | install nginx" shows only the accepted quote fix (ci) and the accepted absolute-vs-relative symlink target normalization (ci-release)
• Apply for real against ci/ci-release at deploy time and confirm nginx does not reload/restart unexpectedly

🤖 Generated with Claude Code

[ryanaslett]

Worth noting that this package-upgrade does claim to update a fair amount of packges, which Is why I plan on only running the jenkins-nginx tasks to get the certbot bits over the line. I'd rather somebody else have eyes on what its going to upgrade as I dont want to just accidentally create unplanned changes to the ci and ci-release servers.

[ryanaslett]

Also worth noting that ansible wouldnt run at all without this being enabled as the base-layout tasks reference the package manager var from the package-upgrade role:

https://github.com/nodejs/build/blob/main/ansible/roles/baselayout/tasks/main.yml#L66

[Copilot]

Copilot review overview

🟡 Changes recommended

Critical and moderate findings remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1 · 2

Open (3)

• Remove unrelated package upgrade from nginx deployment · New
• Create nginx SSL directory before copying DH parameters · New
• Disable obsolete TLS protocols and weak cipher suites · New

What changed in this PR

Adds Ansible management for the existing Jenkins nginx reverse-proxy configurations on CI hosts.

Changes:

• Adds host-specific nginx templates and supporting files.
• Adds the jenkins-nginx role.
• Integrates the role into the Jenkins host playbook.

File	Summary
ansible/​roles/​jenkins-nginx/​templates/​ci.nodejs.org.conf.j2	CI nginx configuration; moderate TLS legacy-protocol/cipher finding (2 votes).
ansible/​roles/​jenkins-nginx/​templates/​ci-release.nodejs.org.conf.j2	CI-release nginx configuration; moderate TLS legacy-protocol/cipher finding (1 vote).
ansible/​roles/​jenkins-nginx/​tasks/​main.yml	Installs and configures nginx; moderate missing parent-directory creation finding (3 votes).
ansible/​roles/​jenkins-nginx/​files/​status.conf	Local nginx status endpoint.
ansible/​roles/​jenkins-nginx/​files/​jenkins-static.conf	Jenkins static asset cache configuration.
ansible/​roles/​jenkins-nginx/​files/​dhparam.pem	TLS DH parameters.
ansible/​playbooks/​jenkins/​host/​create.yml	Applies the role; critical unrelated package-upgrade finding (3 votes).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.