ansible-personal/roles/nginx/tasks/main.yml

---
- name: Add nginx.org apt signing key
  apt_key: url=http://nginx.org/keys/nginx_signing.key state=present
  tags: nginx, packages

- name: Add nginx.org repo
  template: src=nginx_org_sources.list.j2 dest=/etc/apt/sources.list.d/nginx_org_sources.list owner=root group=root mode=0644
  tags: nginx, packages

- name: Install nginx
  apt: pkg=nginx update_cache=yes state=latest cache_valid_time=3600
  tags: nginx, packages

- name: Copy nginx configs
  copy: src={{ item }} dest=/etc/nginx/{{ item }} mode=0644 owner=root group=root
  with_items:
    - extra-security.conf
    - fastcgi_cache
    - nginx.conf
  notify:
    - reload nginx
  tags: nginx

- name: Remove default nginx vhost
  file: path=/etc/nginx/conf.d/default.conf state=absent
  tags: nginx

- name: Create fastcgi cache dir
  file: path=/var/cache/nginx/cached/fastcgi state=directory owner=nginx group=nginx mode=0755
  tags: nginx

- include: vhosts.yml
  when: nginx_vhosts is defined
  tags: nginx

- name: Configure blank nginx vhost
  template: src=blank-vhost.conf.j2 dest={{ nginx_confd_path }}/blank-vhost.conf  mode=0644 owner=root group=root
  notify:
    - reload nginx
  tags: nginx

- name: Configure munin vhost
  copy: src=munin.conf dest=/etc/nginx/conf.d/munin.conf mode=0644 owner=root group=root
  notify:
    - reload nginx
  tags: nginx

- name: Start and enable nginx service
  service: name=nginx state=started enabled=yes
  tags: nginx

# vim: set ts=2 sw=2:
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00			`---`
			`- name: Add nginx.org apt signing key`
			`apt_key: url=http://nginx.org/keys/nginx_signing.key state=present`
Add 'packages' tag to any task doing package stuff For idempotence we need to run all apt-related tasks, like editing source files, adding keys, installing packages, etc, when running the 'packages' tag. 2016-08-14 15:33:48 +02:00			`tags: nginx, packages`
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00
roles/nginx: Use template for nginx repo A template is better than ansible's `apt_repository` module because we can idempotently control the contents of the file based on vari- ables. Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-05-24 23:15:49 +02:00			`- name: Add nginx.org repo`
roles/nginx: Rename nginx sources.list template Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-08-23 12:24:43 +02:00			`template: src=nginx_org_sources.list.j2 dest=/etc/apt/sources.list.d/nginx_org_sources.list owner=root group=root mode=0644`
Add 'packages' tag to any task doing package stuff For idempotence we need to run all apt-related tasks, like editing source files, adding keys, installing packages, etc, when running the 'packages' tag. 2016-08-14 15:33:48 +02:00			`tags: nginx, packages`
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00
			`- name: Install nginx`
Only update packages indexes if the cache is 1 hour old I have added cache_valid_time=3600 for the first task in each tag that could be possibly running apt-related commands. For ex, the "nginx" tag is also in the "packages" tag, but sometimes you run the nginx tag by itself (perhaps repeatadely), so you'd want to limit the update unless the cache was 1 hour old 2016-08-22 14:33:57 +02:00			`apt: pkg=nginx update_cache=yes state=latest cache_valid_time=3600`
Add 'packages' tag to any task doing package stuff For idempotence we need to run all apt-related tasks, like editing source files, adding keys, installing packages, etc, when running the 'packages' tag. 2016-08-14 15:33:48 +02:00			`tags: nginx, packages`
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00
roles/nginx: Add HTTP headers for web application security See: https://github.com/h5bp/server-configs-nginx/blob/master/h5bp/directive-only/extra-security.conf See: https://www.owasp.org/index.php/List_of_useful_HTTP_headers Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-01-24 11:05:42 +01:00			`- name: Copy nginx configs`
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00			`copy: src={{ item }} dest=/etc/nginx/{{ item }} mode=0644 owner=root group=root`
			`with_items:`
roles/nginx: Add HTTP headers for web application security See: https://github.com/h5bp/server-configs-nginx/blob/master/h5bp/directive-only/extra-security.conf See: https://www.owasp.org/index.php/List_of_useful_HTTP_headers Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-01-24 11:05:42 +01:00			`- extra-security.conf`
roles/nginx: Add fastcgi caching Bypasses caching for logged in users (right now only for sessions where the "wordpress_logged_in" cookie is set. Doubles the trans- actions per second as measured by siege: $ siege -d1 -t1M -c50 https://mjanja.ch Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-02-10 21:04:28 +01:00			`- fastcgi_cache`
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00			`- nginx.conf`
			`notify:`
			`- reload nginx`
			`tags: nginx`

			`- name: Remove default nginx vhost`
			`file: path=/etc/nginx/conf.d/default.conf state=absent`
			`tags: nginx`

roles/nginx: Create fastcgi cache dir Or else nginx doesn't start. Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-02-19 16:49:39 +01:00			`- name: Create fastcgi cache dir`
			`file: path=/var/cache/nginx/cached/fastcgi state=directory owner=nginx group=nginx mode=0755`
roles/nginx: Add missing nginx tag The creation of the fastcgi cache dir is part of the nginx role and should be labled as such. In situations where you only run nginx tasks with `-t nginx` nginx will fail to start due to the missing cache dir. 2016-04-15 11:29:35 +02:00			`tags: nginx`
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00
Finish moving logic and variables from nginx_tls_vhosts to nginx_vhosts Everything is TLS now (whether self-signed or not), so it's pointless to distinguish. Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-12-09 23:14:47 +01:00			`- include: vhosts.yml`
			`when: nginx_vhosts is defined`
roles/nginx: Use template to configure nginx vhosts Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-27 19:03:34 +02:00			`tags: nginx`

roles/nginx: Add blank vhost For security and predictability clients should only get a reponse if they request a hostname we are actually hosting. If TLS is in use then this will use a self-signed snakeoil cert for an HTTPS-enabled blank, default vhost. Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-06-04 22:30:06 +02:00			`- name: Configure blank nginx vhost`
			`template: src=blank-vhost.conf.j2 dest={{ nginx_confd_path }}/blank-vhost.conf mode=0644 owner=root group=root`
			`notify:`
			`- reload nginx`
roles/nginx: Add missing nginx tag to blank vhost task Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-06-05 23:05:09 +02:00			`tags: nginx`
roles/nginx: Add blank vhost For security and predictability clients should only get a reponse if they request a hostname we are actually hosting. If TLS is in use then this will use a self-signed snakeoil cert for an HTTPS-enabled blank, default vhost. Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-06-04 22:30:06 +02:00
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00			`- name: Configure munin vhost`
			`copy: src=munin.conf dest=/etc/nginx/conf.d/munin.conf mode=0644 owner=root group=root`
			`notify:`
			`- reload nginx`
			`tags: nginx`

roles/nginx: Replace "&" with "and" 2016-06-27 18:13:20 +02:00			`- name: Start and enable nginx service`
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00			`service: name=nginx state=started enabled=yes`
			`tags: nginx`
roles/nginx: Add vim modeline to main.yml Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-27 19:00:42 +02:00
			`# vim: set ts=2 sw=2:`