ansible-personal/roles/nginx/tasks/vhosts.yml

---

- block:
  - name: Configure https vhosts
    template: src=vhost.conf.j2 dest={{ nginx_confd_path }}/{{ item.domain_name }}.conf mode=0644 owner=root group=root
    loop: "{{ nginx_vhosts }}"
    notify:
      - reload nginx

  - name: Generate self-signed TLS cert
    command: openssl req -x509 -nodes -sha256 -days 365 -subj "/C=SO/ST=SO/L=snakeoil/O=snakeoil/CN=snakeoil" -newkey rsa:2048 -keyout /etc/ssl/private/nginx-snakeoil.key -out /etc/ssl/certs/nginx-snakeoil.crt -extensions v3_ca creates=/etc/ssl/certs/nginx-snakeoil.crt
    notify:
      - reload nginx

  - name: Download 4096-bit RFC 7919 dhparams
    get_url:
      url: https://raw.githubusercontent.com/internetstandards/dhe_groups/master/ffdhe4096.pem
      checksum: sha256:64852d6890ff9e62eecd1ee89c72af9af244dfef5b853bcedea3dfd7aade22b3
      dest: "{{ nginx_ssl_dhparam }}"
    notify:
      - reload nginx

  # TODO: this could break because we can override the document root in host vars
  - name: Create vhost document roots
    file: path={{ nginx_root_prefix }}/{{ item.domain_name }} state=directory mode=0755 owner=nginx group=nginx
    loop: "{{ nginx_vhosts }}"
  tags: nginx

# vim: set ts=2 sw=2:
roles/nginx: Update nginx https stuff - re-organize tls vhost configuration - copy TLS cert from host_vars directly to file Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-09-13 22:16:54 +02:00			`---`

roles/nginx: Use dynamic includes for tasks As of Ansible 2.4 and 2.5 the behavior for importing tasks has changed to introduce the notion of static imports and dynamic includes. If the tasks doing the import is using variable interpolation or conditionals then the task should be dynamic. This results in quicker playbook runs due to less importing of unneccessary tasks. One side effect of this is that child tasks of dynamic includes do not inherit their parents' tags so you must tag them explicitly or a block. 2018-04-26 09:45:01 +02:00			`- block:`
			`- name: Configure https vhosts`
			`template: src=vhost.conf.j2 dest={{ nginx_confd_path }}/{{ item.domain_name }}.conf mode=0644 owner=root group=root`
			`loop: "{{ nginx_vhosts }}"`
			`notify:`
			`- reload nginx`

roles/nginx: generate snakeoil cert manually The ssl-cert does this, but it includes the hostname of the server as the subject name in the cert, which is a huge leak of privacy. 2021-09-27 09:48:24 +02:00			`- name: Generate self-signed TLS cert`
			`command: openssl req -x509 -nodes -sha256 -days 365 -subj "/C=SO/ST=SO/L=snakeoil/O=snakeoil/CN=snakeoil" -newkey rsa:2048 -keyout /etc/ssl/private/nginx-snakeoil.key -out /etc/ssl/certs/nginx-snakeoil.crt -extensions v3_ca creates=/etc/ssl/certs/nginx-snakeoil.crt`
			`notify:`
			`- reload nginx`

roles/nginx: Use RFC 7919 4096-bit dhparams Recommended by internet.nl, which made me aware of RFC 7919. See: https://tools.ietf.org/html/rfc7919#page-14 2021-03-19 12:13:56 +01:00			`- name: Download 4096-bit RFC 7919 dhparams`
			`get_url:`
			`url: https://raw.githubusercontent.com/internetstandards/dhe_groups/master/ffdhe4096.pem`
			`checksum: sha256:64852d6890ff9e62eecd1ee89c72af9af244dfef5b853bcedea3dfd7aade22b3`
roles/nginx: Use variable for nginx_ssl_dhparam I went years without realizing that I was hard coding the file dest in this particular task. 2021-03-19 17:13:37 +01:00			`dest: "{{ nginx_ssl_dhparam }}"`
roles/nginx: Use dynamic includes for tasks As of Ansible 2.4 and 2.5 the behavior for importing tasks has changed to introduce the notion of static imports and dynamic includes. If the tasks doing the import is using variable interpolation or conditionals then the task should be dynamic. This results in quicker playbook runs due to less importing of unneccessary tasks. One side effect of this is that child tasks of dynamic includes do not inherit their parents' tags so you must tag them explicitly or a block. 2018-04-26 09:45:01 +02:00			`notify:`
			`- reload nginx`

roles/nginx: add todo about document roots We assume it's always /var/www/$domain_name but it can be overriden in the host_vars... 2021-09-27 11:05:53 +02:00			`# TODO: this could break because we can override the document root in host vars`
roles/nginx: Use dynamic includes for tasks As of Ansible 2.4 and 2.5 the behavior for importing tasks has changed to introduce the notion of static imports and dynamic includes. If the tasks doing the import is using variable interpolation or conditionals then the task should be dynamic. This results in quicker playbook runs due to less importing of unneccessary tasks. One side effect of this is that child tasks of dynamic includes do not inherit their parents' tags so you must tag them explicitly or a block. 2018-04-26 09:45:01 +02:00			`- name: Create vhost document roots`
			`file: path={{ nginx_root_prefix }}/{{ item.domain_name }} state=directory mode=0755 owner=nginx group=nginx`
			`loop: "{{ nginx_vhosts }}"`
			`tags: nginx`
roles/nginx: Rework Let's Encrypt stuff Take an opinionated stance on HTTPS and assume that hosts are using HTTPS for all vhosts. This can either be via custom TLS cert/key pairs defined in the host's variables (could even be self-signed certificates on dev boxes) or via Let's Encrypt. 2016-06-27 22:52:39 +02:00
roles/nginx: Update nginx https stuff - re-organize tls vhost configuration - copy TLS cert from host_vars directly to file Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-09-13 22:16:54 +02:00			`# vim: set ts=2 sw=2:`