alanorth/ansible-personal
1
0
Fork 0
Code Issues 4 Pull Requests Projects Releases Wiki Activity
e50f413f5e
ansible-personal/roles/nginx/defaults/main.yml

168 lines
3.0 KiB
YAML
Raw Normal View History

roles/nginx: Add defaults for nginx role Signed-off-by: Alan Orth <alan.orth@gmail.com>
2014-08-27 19:02:29 +02:00
---
# file: roles/nginx/defaults/main.yml
# path config
nginx_confd_path: /etc/nginx/conf.d
# parent directory of vhost roots
nginx_root_prefix: /var/www
roles/nginx: Templatize SSL parameters using role defaults Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-06-04 22:28:31 +02:00
# 1 hour timeout
nginx_ssl_session_timeout: 1h
# 10MB -> 40,000 sessions
nginx_ssl_session_cache: shared:SSL:10m
# 1400 bytes to fit in one MTU (default is 16k!)
nginx_ssl_buffer_size: 1400
nginx_ssl_dhparam: /etc/ssl/certs/dhparam.pem
nginx_ssl_protocols: 'TLSv1 TLSv1.1 TLSv1.2'
Set use_letsencrypt to true for nginx role The variable name is misleading as this really does is install the certbot client and its dependencies, and we generally want this to always happen. If a host doesn't want it, they can override it in their host vars. Perhaps I should rename this variable to "bootstrap_letsencrypt" or something so it is more accurate.
2016-10-09 10:57:23 +02:00
# install certbot + dependencies?
# True unless you're in development and using "localhost" + snakeoil certs
use_letsencrypt: True
roles/nginx: Allow usage of Let's Encrypt certs Hosts can specify use_letsencrypt: 'yes' in their host_vars. For now this assumes that the certificates already exist (ie, you have to manually run Let's Encrypt first to register/create the certs).
2016-06-27 18:07:48 +02:00
# Directory root for Let's Encrypt certs
letsencrypt_root: /etc/letsencrypt/live
roles/nginx: Update nginx https stuff - re-organize tls vhost configuration - copy TLS cert from host_vars directly to file Signed-off-by: Alan Orth <alan.orth@gmail.com>
2014-09-13 22:16:54 +02:00
roles/nginx: Rework Let's Encrypt stuff Take an opinionated stance on HTTPS and assume that hosts are using HTTPS for all vhosts. This can either be via custom TLS cert/key pairs defined in the host's variables (could even be self-signed certificates on dev boxes) or via Let's Encrypt.
2016-06-27 22:52:39 +02:00
# Location of Let's Encrypt's certbot script
letsencrypt_certbot_dest: /opt/certbot-auto
group_vars/dspace: Update comment for nginx branch NGINX 1.14.0 was released and is the current "stable" version. The next "mainline" version should be 1.15.0. See: https://nginx.org/en/CHANGES-1.14
2018-04-18 15:58:33 +02:00
# stable is 1.14.x
# mainline is 1.15.x
roles/nginx: Use mainline branch by default Has all the good stuff: http://nginx.org/en/CHANGES
2016-05-27 07:14:04 +02:00
nginx_version: mainline
roles/nginx: Use template for nginx repo A template is better than ansible's `apt_repository` module because we can idempotently control the contents of the file based on vari- ables. Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-05-24 23:15:49 +02:00
roles/nginx: Separate Ubuntu 16.04 "Xenial" Let's Encrypt deps Instead of iterating over fifteen packages with a loop that does fifteen separate apt transactions, it is better to give the apt module a list so it can install them all in one transaction. This is both quicker and te- chnically more safe for dependency resolution.
2018-04-25 19:01:39 +02:00
# Dependencies of certbot-auto on Ubuntu 16.04 "xenial"
# taken after running certbot-auto on a clean install
letsencrypt_ubuntu_xenial_deps:
- augeas-doc
- augeas-tools
- binutils
- cpp
- cpp-5
- dialog
- gcc
- gcc-5
- libasan2
- libatomic1
- libcc1-0
- libcilkrts5
- libexpat1-dev
- libffi-dev
- libgcc-5-dev
- libgomp1
- libisl15
- libitm1
- liblsan0
- libmpc3
- libmpx0
- libpython-dev
- libpython2.7
- libpython2.7-dev
- libquadmath0
- libssl-dev
- libtsan0
- libubsan0
- python-dev
- python-pip-whl
- python-pkg-resources
- python-virtualenv
- python2.7-dev
- python3-virtualenv
- virtualenv
- zlib1g-dev
roles/nginx: Add dependencies for certbot on Ubuntu 18.04 Taken from running the Let's Encrypt certbot-auto client on a freshly installed Ubuntu 18.04 system.
2018-04-25 18:40:33 +02:00
# Dependencies of certbot-auto on Ubuntu 18.04 "bionic"
# taken after running certbot-auto on a clean install
letsencrypt_ubuntu_bionic_deps:
- augeas-lenses
- binutils
- binutils-common
- binutils-x86-64-linux-gnu
- cpp
- cpp-7
- gcc
- gcc-7
- gcc-7-base
- libasan4
- libatomic1
- libaugeas0
- libbinutils
- libc-dev-bin
- libc6-dev
- libcc1-0
- libcilkrts5
- libexpat1-dev
- libffi-dev
- libgcc-7-dev
- libgomp1
- libisl19
- libitm1
- liblsan0
- libmpc3
- libmpx2
- libpython-dev
- libpython2.7
- libpython2.7-dev
- libquadmath0
- libssl-dev
- libtsan0
- libubsan0
- linux-libc-dev
- python-dev
- python-pip-whl
- python-pkg-resources
- python-virtualenv
- python2.7-dev
- python3-virtualenv
- virtualenv
roles/nginx: Separate Debian 9 "stretch" Let's Encrypt deps Instead of iterating over fifteen packages with a loop that does fifteen separate apt transactions, it is better to give the apt module a list so it can install them all in one transaction. This is both quicker and te- chnically more safe for dependency resolution.
2018-04-25 19:02:42 +02:00
# Dependencies of certbot-auto on Debian 9 "stretch"
# taken after running certbot-auto on a clean install
letsencrypt_debian_stretch_deps:
- augeas-doc
- augeas-tools
- autoconf
- automake
- binutils
- bison
- cpp
- cpp-6
- flex
- gcc-6
- gcc-doc
- gcc-multilib
- gdb
- libasan3
- libatomic1
- libc-dev-bin
- libc6-dev
- libcc1-0
- libcilkrts5
- libexpat1-dev
- libffi-dev
- libgcc-6-dev
- libgomp1
- libisl15
- libitm1
- liblsan0
- libmpc3
- libmpx2
- libpython-dev
- libpython2.7
- libpython2.7-dev
- libquadmath0
- libssl-dev
- libtool
- libtsan0
- libubsan0
- linux-libc-dev
- make
- python-dev
- python-pip-whl
- python-pkg-resources
- python-virtualenv
- python2.7-dev
- python3-virtualenv
- virtualenv
roles/nginx: Add defaults for nginx role Signed-off-by: Alan Orth <alan.orth@gmail.com>
2014-08-27 19:02:29 +02:00
# vim: set ts=2 sw=2:
Reference in New Issue Copy Permalink