blob: e9095dcc6e76f884baf04eaca54ba0f9ea987958 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
|
---
- name: "Include OS-specific variables"
ansible.builtin.include_vars: "{{ ansible_facts['os_family'] | lower }}.yml"
- name: "Stop and disable caddy"
become: true
ansible.builtin.service:
name: "caddy"
state: "stopped"
enabled: false
failed_when: false
- name: "Ensure nginx is installed"
become: true
ansible.builtin.package:
name: "nginx"
state: "present"
- name: "Ensure nginx directories exist"
become: true
ansible.builtin.file:
path: "{{ item }}"
state: "directory"
owner: "root"
group: "root"
mode: "0755"
loop:
- "/etc/nginx/conf.d"
- "/etc/nginx/modules-enabled"
- "/var/log/nginx"
- name: "Ensure nginx vhosts.d directory exists"
become: true
ansible.builtin.file:
path: "/etc/nginx/vhosts.d"
state: "directory"
owner: "root"
group: "root"
mode: "0755"
- name: "Check if SSL certificate exists"
become: true
ansible.builtin.stat:
path: "{{ nginx_ssl_certificate }}"
register: nginx_ssl_cert_check
- name: "Check if SSL private key exists"
become: true
ansible.builtin.stat:
path: "{{ nginx_ssl_certificate_key }}"
register: nginx_ssl_key_check
- name: "Generate self-signed SSL certificate"
become: true
ansible.builtin.command:
cmd: >
openssl req -x509 -newkey rsa:2048 -days 365 -nodes
-keyout "{{ nginx_ssl_certificate_key }}"
-out "{{ nginx_ssl_certificate }}"
-subj "/CN={{ nginx_server_name }}"
-addext "subjectAltName=DNS:{{ nginx_server_name }},DNS:localhost,IP:127.0.0.1"
when: not nginx_ssl_cert_check.stat.exists or not nginx_ssl_key_check.stat.exists
changed_when: true
- name: "Set SSL certificate permissions"
become: true
ansible.builtin.file:
path: "{{ nginx_ssl_certificate }}"
owner: "root"
group: "root"
mode: "0644"
when: not nginx_ssl_cert_check.stat.exists or not nginx_ssl_key_check.stat.exists
- name: "Set SSL private key permissions"
become: true
ansible.builtin.file:
path: "{{ nginx_ssl_certificate_key }}"
owner: "root"
group: "root"
mode: "0600"
when: not nginx_ssl_cert_check.stat.exists or not nginx_ssl_key_check.stat.exists
- name: "Create nginx configuration"
become: true
ansible.builtin.template:
src: "nginx.conf.j2"
dest: "/etc/nginx/nginx.conf"
owner: "root"
group: "root"
mode: "0644"
backup: true
validate: "nginx -t -c %s"
notify: "Restart nginx"
- name: "Start and enable nginx"
become: true
ansible.builtin.service:
name: "nginx"
state: "started"
enabled: true
# Create logrotate configurations
# Rotate weekly
# Keep 3 month (12 rotations)
- name: "Create nginx logrotate configuration"
become: true
ansible.builtin.copy:
content: |
/var/log/nginx/*.log {
weekly
missingok
rotate 12
compress
delaycompress
notifempty
create 0644 root root
postrotate
if [ -f /var/run/nginx.pid ]; then
kill -USR1 `cat /var/run/nginx.pid`
fi
endscript
}
dest: "/etc/logrotate.d/nginx"
owner: "root"
group: "root"
mode: "0644"
failed_when: false
|
