WIP: nginx

roles/nginx/files/dhparam

@@ -0,0 +1,8 @@
+-----BEGIN DH PARAMETERS-----
+MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
++8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
+87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
+YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
+7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
+ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
+-----END DH PARAMETERS-----

roles/nginx/files/log_format.conf

@@ -0,0 +1,7 @@
+log_format main '127.0.0.1 - $remote_user [$time_local] "$request_method / $server_protocol" '
+             '$status $body_bytes_sent "-" '
+             '"$http_user_agent" "$http_x_forwarded_for"';
+
+log_format  main_with_ip  '$remote_addr - $remote_user [$time_local] "$request" '
+               '$status $body_bytes_sent "$http_referer" '
+               '"$http_user_agent" "$http_x_forwarded_for"';

roles/nginx/files/ssl_extra.conf

@@ -0,0 +1,15 @@
+# SSL
+
+ssl_session_timeout 1d;
+ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
+ssl_session_tickets off;
+
+# curl https://ssl-config.mozilla.org/ffdhe2048.txt > /root/dhparam
+ssl_dhparam /etc/nginx/dhparam;
+
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+ssl_prefer_server_ciphers off;
+
+# HSTS (ngx_http_headers_module is required) (63072000 seconds)
+# add_header Strict-Transport-Security "max-age=63072000" always;

roles/nginx/handlers/main.yaml

@@ -0,0 +1,6 @@
+- name: restart nginx
+  service:
+    name: nginx
+    state: restarted
+    enabled: yes
+  when: 'nginx_syntax_check.stderr is defined and "syntax is ok" in nginx_syntax_check.stderr'

roles/nginx/tasks/main.yml

@@ -0,0 +1,71 @@
+- name: Copy ngnix SSL config
+  copy:
+    src: ssl_extra.conf
+    dest: /etc/nginx/ssl_extra
+  notify: "restart nginx"
+
+- name: Copy dhparam
+  copy:
+    src: dhparam
+    dest: /etc/nginx/dhparam
+  notify: "restart nginx"
+
+- name: Increase worker_connections to 10k
+  lineinfile:
+    dest: /etc/nginx/nginx.conf
+    regexp: "^\\s*worker_connections"
+    line: "worker_connections 10000;"
+  notify: restart nginx
+
+- name: Copy ngnix log config
+  copy:
+    src: log_format.conf
+    dest: /etc/nginx/log_format
+  notify: "restart nginx"
+
+- name: Register log_format
+  lineinfile:
+    dest: "/etc/nginx/nginx.conf"
+    regexp: "^include log_format;"
+    line: "include log_format;"
+    insertafter: "^http {"
+  notify: "restart nginx"
+
+- name: Create empty default page
+  template:
+    src: nginx-default.html.j2
+    dest: "/var/www/html/index.html"
+  notify: restart nginx
+
+- name: Create default config
+  template:
+    src: nginx-default.conf.j2
+    dest: "/etc/nginx/sites-available/default"
+  notify: restart nginx
+
+- name: Activate default config
+  file:
+    src: "/etc/nginx/sites-available/default"
+    dest: "/etc/nginx/sites-enabled/default"
+    owner: root
+    group: root
+    state: link
+  notify: restart nginx
+
+- include: page.yml
+  loop: "{{ pages }}"
+  vars:
+    page: "{{ item }}"
+
+- include: stats.yml
+  tags: nginx-stats
+
+- include: prom.yml
+  tags: nginx-prom
+
+- name: Validate nginx config
+  command: nginx -t
+  register: nginx_syntax_check
+  ignore_errors: yes
+
+- meta: flush_handlers

roles/nginx/templates/nginx.default.conf.j2

@@ -0,0 +1,12 @@
+server {
+  listen 80 default_server;
+  listen [::]:80 default_server;
+
+  root /var/www/html;
+  server_name _;
+  location / {
+    # First attempt to serve request as file, then
+    # as directory, then fall back to displaying a 404.
+    try_files $uri $uri/ =404;
+  }
+}