Add "tasks/nginx.yml"

defaults/main.yml

@@ -1 +1,4 @@
 ---
+common__nginx__remove_default: true
+common__nginx__upstreams: []
+common__nginx__sites: []

handlers/main.yml

@@ -10,3 +10,9 @@
 
 - name: common | Load iptables rules for IPv6
   shell: 'cat {{ common__iptables__conf_ipv6 }} | ip6tables-restore'
+
+- name: common | Restart Nginx
+  systemd:
+    daemon_reload: true
+    name: nginx
+    state: restarted

molecule/default/tests/test_default.py

@@ -49,3 +49,8 @@ def test_iptables_config(host, version):
     assert f.user == 'root'
     assert f.group == 'root'
     assert f.mode == 0o644
+
+
+def test_nginx_default_removed(host):
+    assert host.file('/etc/nginx/sites-available/default').exists
+    assert not host.file('/etc/nginx/sites-enabled/default').exists

tasks/main.yml

@@ -2,3 +2,4 @@
 - include_tasks: usability.yml
 - include_tasks: ssh.yml
 - include_tasks: iptables.yml
+- include_tasks: nginx.yml

tasks/nginx.yml

@@ -0,0 +1,55 @@
+---
+- name: Install Nginx
+  apt:
+    update_cache: true
+    name: nginx
+
+- name: Create directories for Nginx configuration
+  file:
+    state: directory
+    path: '{{ item }}'
+    mode: 'u=rwx,g=rx,o=rx'
+    owner: root
+    group: root
+  with_items:
+    - '{{ common__nginx__conf_dir }}'
+    - '{{ common__nginx__confd_dir }}'
+    - '{{ common__nginx__available_dir }}'
+    - '{{ common__nginx__enabled_dir }}'
+
+- name: Remove Nginx default site
+  file:
+    state: absent
+    path: '{{ common__nginx__enabled_dir }}/default'
+  when: common__nginx__remove_default | bool
+  notify: common | Restart Nginx
+
+- name: Add Nginx upstreams
+  template:
+    src: 'templates/nginx/upstream.conf'
+    dest: '{{ common__nginx__confd_dir }}/upstream-{{ item.name }}.conf'
+    mode: 'u=rw,g=r,o=r'
+    owner: root
+    group: root
+  with_items: '{{ common__nginx__upstreams }}'
+  notify: common | Restart Nginx
+
+- name: Add Nginx sites
+  template:
+    src: 'templates/nginx/{{ item.type }}.conf'
+    dest: '{{ common__nginx__available_dir }}/{{ item.domain }}.conf'
+    mode: 'u=rw,g=r,o=r'
+    owner: root
+    group: root
+  with_items: '{{ common__nginx__sites }}'
+  notify: common | Restart Nginx
+
+- name: Enable Nginx sites
+  file:
+    state: link
+    src: '{{ common__nginx__available_dir }}/{{ item.domain }}.conf'
+    dest: '{{ common__nginx__enabled_dir }}/{{ item.domain }}.conf'
+    owner: root
+    group: root
+  with_items: '{{ common__nginx__sites }}'
+  notify: common | Restart Nginx

templates/nginx/origin.conf

@@ -0,0 +1,42 @@
+server {
+  listen 80;
+  listen [::]:80;
+
+  server_name {{ item.domain }};
+
+  return 301 https://$host$request_uri;
+}
+
+server {
+  listen 443 ssl;
+  listen [::]:443 ssl;
+
+  server_name {{ item.domain }};
+
+  ssl_certificate     {{ item.cert }};
+  ssl_certificate_key {{ item.key }};
+
+  include {{ item.ssl_conf }};
+
+  root {{ item.root }};
+
+  try_files $uri/index.html $uri @origin;
+
+  location @origin {
+    proxy_cache_bypass $http_upgrade;
+    proxy_http_version 1.1;
+    proxy_redirect     off;
+
+    proxy_set_header Connection        "upgrade";
+    proxy_set_header HOST              $http_host;
+    proxy_set_header Upgrade           $http_upgrade;
+    proxy_set_header X-Forwarded-For   $http_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+
+    proxy_pass http://{{ item.upstream }};
+  }
+
+  error_page 500 502 503 504 /500.html;
+  client_max_body_size 4G;
+  keepalive_timeout 10;
+}

templates/nginx/proxy.conf

@@ -0,0 +1,59 @@
+server {
+  listen 80;
+  listen [::]:80;
+
+  server_name {{ item.domain }};
+
+  return 301 https://$host$request_uri;
+}
+
+server {
+  listen 443 ssl;
+  listen [::]:443 ssl;
+
+  server_name {{ item.domain }};
+
+  ssl_certificate     {{ item.cert }};
+  ssl_certificate_key {{ item.key }};
+
+  include {{ item.ssl_conf }};
+
+  ssl_verify_client optional;
+  ssl_client_certificate {{ item.clnt_ca }};
+
+  proxy_cache_bypass $http_upgrade;
+  proxy_http_version 1.1;
+  proxy_redirect     off;
+
+  proxy_set_header Connection        "upgrade";
+  proxy_set_header HOST              $host;
+  proxy_set_header Upgrade           $http_upgrade;
+  proxy_set_header X-Forwarded-For   $remote_addr;
+  proxy_set_header X-Forwarded-Host  $host;
+  proxy_set_header X-Forwarded-Port  $server_port;
+  proxy_set_header X-Forwarded-Proto $scheme;
+  proxy_set_header X-Real-IP         $remote_addr;
+
+  location / {
+    recursive_error_pages on;
+
+    error_page 418 = @no_crt;
+    error_page 419 = @with_crt;
+
+    if ($ssl_client_verify != SUCCESS) {
+      return 418;
+    }
+
+    if ($ssl_client_verify = SUCCESS) {
+      return 419;
+    }
+  }
+
+  location @no_crt {
+    proxy_pass https://{{ item.no_crt }};
+  }
+
+  location @with_crt {
+    proxy_pass https://{{ item.with_crt }};
+  }
+}

templates/nginx/redirect.conf

@@ -0,0 +1,22 @@
+server {
+  listen 80;
+  listen [::]:80;
+
+  server_name {{ item.domain }};
+
+  return 301 https://$host$request_uri;
+}
+
+server {
+  listen 443 ssl;
+  listen [::]:443 ssl;
+
+  server_name {{ item.domain }};
+
+  ssl_certificate     {{ item.cert }};
+  ssl_certificate_key {{ item.key }};
+
+  include {{ item.ssl_conf }};
+
+  return 301 https://{{ item.redir_to }}$request_uri;
+}

templates/nginx/upstream.conf

@@ -0,0 +1,5 @@
+upstream {{ item.name }} {
+{% for server in item.servers %}
+  server {{ server }};
+{% endfor %}
+}

vars/main.yml

@@ -2,3 +2,8 @@
 common__iptables__conf_dir: '/etc/iptables'
 common__iptables__conf_ipv4: '{{ common__iptables__conf_dir }}/rules.v4'
 common__iptables__conf_ipv6: '{{ common__iptables__conf_dir }}/rules.v6'
+
+common__nginx__conf_dir: '/etc/nginx'
+common__nginx__confd_dir: '{{ common__nginx__conf_dir }}/conf.d'
+common__nginx__available_dir: '{{ common__nginx__conf_dir }}/sites-available'
+common__nginx__enabled_dir: '{{ common__nginx__conf_dir }}/sites-enabled'