ansible-roles
/
common
1
0
Fork 0
Code Issues 2 Releases Activity

Add var "common__certbot__nginx_ssl_ciphers"

This commit is contained in:
Alex Kotov 2020-02-06 17:25:21 +05:00
parent e3d11bf11f
commit 2153bc89c2
Signed by: kotovalexarian
GPG Key ID: 553C0EBBEB5D5F08
5 changed files with 63 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
files/certbot/options-ssl-nginx.conf
View File

@ -1,13 +0,0 @@
# This file contains important security parameters. If you modify this file
# manually, Certbot will be unable to automatically provide future security
# updates. Instead, Certbot will print and log an error message with a path to
# the up-to-date file that you will need to refer to when manually updating
# this file.
ssl_session_cache shared:le_nginx_SSL:1m;
ssl_session_timeout 1440m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS";

15
molecule/default/tests/test_default.py
View File

@ -89,3 +89,18 @@ def test_certbot_nginx_config(host):
assert f.user == 'root'
assert f.group == 'root'
assert f.mode == 0o644
assert f.contains(
'ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:'
'ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:'
'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:'
'ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:'
'DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:'
'ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:'
'ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:'
'ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:'
'ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:'
'DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:'
'ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:'
'AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:'
'AES256-SHA:DES-CBC3-SHA:!DSS";'
)

4
tasks/certbot.yml
View File

@ -20,8 +20,8 @@
group: root
- name: Install Nginx SSL options
copy:
src: files/certbot/options-ssl-nginx.conf
template:
src: templates/certbot/options-ssl-nginx.conf
dest: '{{ common__certbot__conf_nginx }}'
mode: 'u=rw,g=r,o=r'
owner: root

13
templates/certbot/options-ssl-nginx.conf Normal file
View File

@ -0,0 +1,13 @@
# This file contains important security parameters. If you modify this file
# manually, Certbot will be unable to automatically provide future security
# updates. Instead, Certbot will print and log an error message with a path to
# the up-to-date file that you will need to refer to when manually updating
# this file.
ssl_session_cache shared:le_nginx_SSL:1m;
ssl_session_timeout 1440m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "{{ common__certbot__nginx_ssl_ciphers | join(':') }}";

33
vars/main.yml
View File

@ -15,3 +15,36 @@ common__nginx__enabled_dir: '{{ common__nginx__conf_dir }}/sites-enabled'
common__apache__conf_dir: '/etc/apache2'
common__apache__available_dir: '{{ common__apache__conf_dir }}/sites-available'
common__apache__enabled_dir: '{{ common__apache__conf_dir }}/sites-enabled'
common__certbot__nginx_ssl_ciphers:
- 'ECDHE-ECDSA-CHACHA20-POLY1305'
- 'ECDHE-RSA-CHACHA20-POLY1305'
- 'ECDHE-ECDSA-AES128-GCM-SHA256'
- 'ECDHE-RSA-AES128-GCM-SHA256'
- 'ECDHE-ECDSA-AES256-GCM-SHA384'
- 'ECDHE-RSA-AES256-GCM-SHA384'
- 'DHE-RSA-AES128-GCM-SHA256'
- 'DHE-RSA-AES256-GCM-SHA384'
- 'ECDHE-ECDSA-AES128-SHA256'
- 'ECDHE-RSA-AES128-SHA256'
- 'ECDHE-ECDSA-AES128-SHA'
- 'ECDHE-RSA-AES256-SHA384'
- 'ECDHE-RSA-AES128-SHA'
- 'ECDHE-ECDSA-AES256-SHA384'
- 'ECDHE-ECDSA-AES256-SHA'
- 'ECDHE-RSA-AES256-SHA'
- 'DHE-RSA-AES128-SHA256'
- 'DHE-RSA-AES128-SHA'
- 'DHE-RSA-AES256-SHA256'
- 'DHE-RSA-AES256-SHA'
- 'ECDHE-ECDSA-DES-CBC3-SHA'
- 'ECDHE-RSA-DES-CBC3-SHA'
- 'EDH-RSA-DES-CBC3-SHA'
- 'AES128-GCM-SHA256'
- 'AES256-GCM-SHA384'
- 'AES128-SHA256'
- 'AES256-SHA256'
- 'AES128-SHA'
- 'AES256-SHA'
- 'DES-CBC3-SHA'
- '!DSS'