roles/nginx: Update nginx https stuff

- re-organize tls vhost configuration
- copy TLS cert from host_vars directly to file

Signed-off-by: Alan Orth <alan.orth@gmail.com>
This commit is contained in:
Alan Orth 2014-09-13 23:16:54 +03:00
parent 4e4f415acd
commit e6ffdf8652
Signed by: alanorth
GPG Key ID: 0FB860CC9C45B1B9
5 changed files with 51 additions and 16 deletions

View File

@ -10,4 +10,7 @@ nginx_root_prefix: /var/www
# TLS protocol versions to support # TLS protocol versions to support
nginx_tls_protocols: TLSv1 TLSv1.1 TLSv1.2 nginx_tls_protocols: TLSv1 TLSv1.1 TLSv1.2
# TLS key directory
tls_key_dir: /etc/ssl/private
# vim: set ts=2 sw=2: # vim: set ts=2 sw=2:

View File

@ -23,16 +23,12 @@
file: path=/etc/nginx/conf.d/default.conf state=absent file: path=/etc/nginx/conf.d/default.conf state=absent
tags: nginx tags: nginx
- name: Configure nginx vhosts - include: vhosts.yml
template: src=vhost.conf.j2 dest={{ nginx_confd_path }}/{{ item.nginx_domain_name }}.conf mode=0644 owner=root group=root when: nginx_vhosts is defined
with_items: nginx_vhosts
notify:
- reload nginx
tags: nginx tags: nginx
- name: Create vhost document roots - include: tls_vhosts.yml
file: path={{ nginx_root_prefix }}/{{ item.nginx_domain_name }} state=directory mode=0755 owner=nginx group=nginx when: nginx_tls_vhosts is defined
with_items: nginx_vhosts
tags: nginx tags: nginx
- name: Configure munin vhost - name: Configure munin vhost
@ -41,10 +37,6 @@
- reload nginx - reload nginx
tags: nginx tags: nginx
- name: Generate 2048-bit dhparam
command: openssl dhparam -out dhparam.pem 2048 chdir=/etc/ssl/certs creates=dhparam.pem
tags: nginx
- name: Start & enable nginx service - name: Start & enable nginx service
service: name=nginx state=started enabled=yes service: name=nginx state=started enabled=yes
tags: nginx tags: nginx

View File

@ -0,0 +1,26 @@
---
- name: Configure https vhosts
template: src=vhost.conf.j2 dest={{ nginx_confd_path }}/{{ item.nginx_domain_name }}.conf mode=0644 owner=root group=root
with_items: nginx_tls_vhosts
notify:
- reload nginx
# concatenated key + cert, can live in the same file
# See: http://nginx.org/en/docs/http/configuring_https_servers.html
- name: Copy TLS certs
copy: content="{{ item.tls_cert }}" dest={{ tls_key_dir }}/{{ item.nginx_domain_name }}.crt.pem mode=0700 owner=root group=root
with_items: nginx_tls_vhosts
notify:
- reload nginx
- name: Generate 2048-bit dhparam
command: openssl dhparam -out dhparam.pem 2048 chdir=/etc/ssl/certs creates=dhparam.pem
notify:
- reload nginx
- name: Create vhost document roots
file: path={{ nginx_root_prefix }}/{{ item.nginx_domain_name }} state=directory mode=0755 owner=nginx group=nginx
with_items: nginx_tls_vhosts
# vim: set ts=2 sw=2:

View File

@ -0,0 +1,13 @@
---
- name: Configure http vhosts
template: src=vhost.conf.j2 dest={{ nginx_confd_path }}/{{ item.nginx_domain_name }}.conf mode=0644 owner=root group=root
with_items: nginx_vhosts
notify:
- reload nginx
- name: Create vhost document roots
file: path={{ nginx_root_prefix }}/{{ item.nginx_domain_name }} state=directory mode=0755 owner=nginx group=nginx
with_items: nginx_vhosts
# vim: set ts=2 sw=2:

View File

@ -1,8 +1,9 @@
{% set tls_cert = item.tls_cert %} {% set domain_name = item.nginx_domain_name %}
{% set tls_key = item.tls_key %}
ssl_certificate {{ tls_cert }}; # concatenated key + cert
ssl_certificate_key {{ tls_key }}; # See: http://nginx.org/en/docs/http/configuring_https_servers.html
ssl_certificate {{ tls_key_dir }}/{{ domain_name }}.crt.pem;
ssl_certificate_key {{ tls_key_dir }}/{{ domain_name }}.crt.pem;
ssl_session_timeout 5m; ssl_session_timeout 5m;
ssl_session_cache shared:SSL:1m; ssl_session_cache shared:SSL:1m;