---
# file: roles/nginx/defaults/main.yml

# path config
nginx_confd_path: /etc/nginx/conf.d

# parent directory of vhost roots
nginx_root_prefix: /var/www

# 1 hour timeout
nginx_ssl_session_timeout: 1h
# 10MB -> 40,000 sessions
nginx_ssl_session_cache: shared:SSL:10m
# 1400 bytes to fit in one MTU (default is 16k!)
nginx_ssl_buffer_size: 1400
nginx_ssl_dhparam: /etc/ssl/certs/dhparam.pem
nginx_ssl_protocols: 'TLSv1.2 TLSv1.3'

# DNS resolvers for OCSP stapling (default to Cloudflare public DNS)
# See: https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling
nginx_ssl_stapling_resolver: '1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001]'

# install certbot + dependencies?
# True unless you're in development and using "localhost" + snakeoil certs
use_letsencrypt: True

# Directory root for Let's Encrypt certs
letsencrypt_root: /etc/letsencrypt/live

# Location of Let's Encrypt's certbot script
letsencrypt_certbot_dest: /opt/certbot-auto

# stable is 1.18.x
# mainline is 1.19.x
nginx_version: mainline

# vim: set ts=2 sw=2: