ansible-personal/roles/nginx/tasks/vhosts.yml

---

- block:
  - name: Configure https vhosts
    template: src=vhost.conf.j2 dest={{ nginx_confd_path }}/{{ item.domain_name }}.conf mode=0644 owner=root group=root
    loop: "{{ nginx_vhosts }}"
    notify:
      - reload nginx

  - name: Download 4096-bit RFC 7919 dhparams
    get_url:
      url: https://raw.githubusercontent.com/internetstandards/dhe_groups/master/ffdhe4096.pem
      checksum: sha256:64852d6890ff9e62eecd1ee89c72af9af244dfef5b853bcedea3dfd7aade22b3
      dest: "{{ nginx_ssl_dhparam }}"
    notify:
      - reload nginx

  - name: Create vhost document roots
    file: path={{ nginx_root_prefix }}/{{ item.domain_name }} state=directory mode=0755 owner=nginx group=nginx
    loop: "{{ nginx_vhosts }}"
  tags: nginx

# vim: set ts=2 sw=2:
roles/nginx: Update nginx https stuff - re-organize tls vhost configuration - copy TLS cert from host_vars directly to file Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-09-13 22:16:54 +02:00			`---`

roles/nginx: Use dynamic includes for tasks As of Ansible 2.4 and 2.5 the behavior for importing tasks has changed to introduce the notion of static imports and dynamic includes. If the tasks doing the import is using variable interpolation or conditionals then the task should be dynamic. This results in quicker playbook runs due to less importing of unneccessary tasks. One side effect of this is that child tasks of dynamic includes do not inherit their parents' tags so you must tag them explicitly or a block. 2018-04-26 09:45:01 +02:00			`- block:`
			`- name: Configure https vhosts`
			`template: src=vhost.conf.j2 dest={{ nginx_confd_path }}/{{ item.domain_name }}.conf mode=0644 owner=root group=root`
			`loop: "{{ nginx_vhosts }}"`
			`notify:`
			`- reload nginx`

roles/nginx: Use RFC 7919 4096-bit dhparams Recommended by internet.nl, which made me aware of RFC 7919. See: https://tools.ietf.org/html/rfc7919#page-14 2021-03-19 12:13:56 +01:00			`- name: Download 4096-bit RFC 7919 dhparams`
			`get_url:`
			`url: https://raw.githubusercontent.com/internetstandards/dhe_groups/master/ffdhe4096.pem`
			`checksum: sha256:64852d6890ff9e62eecd1ee89c72af9af244dfef5b853bcedea3dfd7aade22b3`
roles/nginx: Use variable for nginx_ssl_dhparam I went years without realizing that I was hard coding the file dest in this particular task. 2021-03-19 17:13:37 +01:00			`dest: "{{ nginx_ssl_dhparam }}"`
roles/nginx: Use dynamic includes for tasks As of Ansible 2.4 and 2.5 the behavior for importing tasks has changed to introduce the notion of static imports and dynamic includes. If the tasks doing the import is using variable interpolation or conditionals then the task should be dynamic. This results in quicker playbook runs due to less importing of unneccessary tasks. One side effect of this is that child tasks of dynamic includes do not inherit their parents' tags so you must tag them explicitly or a block. 2018-04-26 09:45:01 +02:00			`notify:`
			`- reload nginx`

			`- name: Create vhost document roots`
			`file: path={{ nginx_root_prefix }}/{{ item.domain_name }} state=directory mode=0755 owner=nginx group=nginx`
			`loop: "{{ nginx_vhosts }}"`
			`tags: nginx`
roles/nginx: Rework Let's Encrypt stuff Take an opinionated stance on HTTPS and assume that hosts are using HTTPS for all vhosts. This can either be via custom TLS cert/key pairs defined in the host's variables (could even be self-signed certificates on dev boxes) or via Let's Encrypt. 2016-06-27 22:52:39 +02:00
roles/nginx: Update nginx https stuff - re-organize tls vhost configuration - copy TLS cert from host_vars directly to file Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-09-13 22:16:54 +02:00			`# vim: set ts=2 sw=2:`