roles/nginx: Update nginx https stuff

- re-organize tls vhost configuration
- copy TLS cert from host_vars directly to file

Signed-off-by: Alan Orth <alan.orth@gmail.com>

roles/nginx/defaults/main.yml

@@ -10,4 +10,7 @@ nginx_root_prefix: /var/www
 # TLS protocol versions to support
 nginx_tls_protocols: TLSv1 TLSv1.1 TLSv1.2
 
+# TLS key directory
+tls_key_dir: /etc/ssl/private
+
 # vim: set ts=2 sw=2:

roles/nginx/tasks/main.yml

@@ -23,16 +23,12 @@
   file: path=/etc/nginx/conf.d/default.conf state=absent
   tags: nginx
 
-- name: Configure nginx vhosts
-  template: src=vhost.conf.j2 dest={{ nginx_confd_path }}/{{ item.nginx_domain_name }}.conf mode=0644 owner=root group=root
-  with_items: nginx_vhosts
-  notify:
-    - reload nginx
+- include: vhosts.yml
+  when: nginx_vhosts is defined
   tags: nginx
 
-- name: Create vhost document roots
-  file: path={{ nginx_root_prefix }}/{{ item.nginx_domain_name }} state=directory mode=0755 owner=nginx group=nginx
-  with_items: nginx_vhosts
+- include: tls_vhosts.yml
+  when: nginx_tls_vhosts is defined
   tags: nginx
 
 - name: Configure munin vhost
@@ -41,10 +37,6 @@
     - reload nginx
   tags: nginx
 
-- name: Generate 2048-bit dhparam
-  command: openssl dhparam -out dhparam.pem 2048 chdir=/etc/ssl/certs creates=dhparam.pem
-  tags: nginx
-
 - name: Start & enable nginx service
   service: name=nginx state=started enabled=yes
   tags: nginx

roles/nginx/tasks/tls_vhosts.yml

@@ -0,0 +1,26 @@
+---
+
+- name: Configure https vhosts
+  template: src=vhost.conf.j2 dest={{ nginx_confd_path }}/{{ item.nginx_domain_name }}.conf mode=0644 owner=root group=root
+  with_items: nginx_tls_vhosts
+  notify:
+    - reload nginx
+
+# concatenated key + cert, can live in the same file
+# See: http://nginx.org/en/docs/http/configuring_https_servers.html
+- name: Copy TLS certs
+  copy: content="{{ item.tls_cert }}" dest={{ tls_key_dir }}/{{ item.nginx_domain_name }}.crt.pem mode=0700 owner=root group=root
+  with_items: nginx_tls_vhosts
+  notify:
+    - reload nginx
+
+- name: Generate 2048-bit dhparam
+  command: openssl dhparam -out dhparam.pem 2048 chdir=/etc/ssl/certs creates=dhparam.pem
+  notify:
+    - reload nginx
+
+- name: Create vhost document roots
+  file: path={{ nginx_root_prefix }}/{{ item.nginx_domain_name }} state=directory mode=0755 owner=nginx group=nginx
+  with_items: nginx_tls_vhosts
+
+# vim: set ts=2 sw=2:

roles/nginx/tasks/vhosts.yml

@@ -0,0 +1,13 @@
+---
+
+- name: Configure http vhosts
+  template: src=vhost.conf.j2 dest={{ nginx_confd_path }}/{{ item.nginx_domain_name }}.conf mode=0644 owner=root group=root
+  with_items: nginx_vhosts
+  notify:
+    - reload nginx
+
+- name: Create vhost document roots
+  file: path={{ nginx_root_prefix }}/{{ item.nginx_domain_name }} state=directory mode=0755 owner=nginx group=nginx
+  with_items: nginx_vhosts
+
+# vim: set ts=2 sw=2:

roles/nginx/templates/https.j2

@@ -1,8 +1,9 @@
-{% set tls_cert         = item.tls_cert %}
-{% set tls_key          = item.tls_key %}
+{% set domain_name      = item.nginx_domain_name %}
 
-    ssl_certificate {{ tls_cert }};
-    ssl_certificate_key {{ tls_key }};
+    # concatenated key + cert
+    # See: http://nginx.org/en/docs/http/configuring_https_servers.html
+    ssl_certificate {{ tls_key_dir }}/{{ domain_name }}.crt.pem;
+    ssl_certificate_key {{ tls_key_dir }}/{{ domain_name }}.crt.pem;
 
     ssl_session_timeout 5m;
     ssl_session_cache shared:SSL:1m;