n

main.yml

---
- name: Ensure user nginx exists
  user:
    name: nginx
    system: yes
    create_home: no
  become: yes

- name: Ensure directories for nginx configurations exist
  file:
    path: "{{ current_dir }}"
    state: directory
    mode: 0750
    owner: nginx
    group: nginx
  become: yes
  loop_control:
    loop_var: current_dir
  with_items:
    - "{{ nginx_configuration_path_host }}"
    - "{{ nginx_configuration_path_host }}/sites-enabled"
    - "{{ nginx_configuration_path_host }}/tls"

- name: Copy DH params
  copy:
    src: "{{ nginx_dh_params['src'] }}"
    dest: "{{ nginx_configuration_path_host }}/tls/dhparams.txt"
  become: yes

- name: Generate nginx.conf
  template:
    src: nginx.conf.j2
    dest: "{{ nginx_configuration_path_host }}/nginx.conf"
    owner: nginx
    group: nginx
    mode: 0440
  become: yes

- name: Generate site configurations (tls)
  template:
    src: site_tls.conf.j2
    dest: "{{ nginx_configuration_path_host }}/sites-enabled/{{ server_name }}"
    owner: nginx
    group: nginx
    mode: 0440
  become: yes
  loop: "{{ nginx_sites }}"
  when: "item['tls']|bool"
  vars:
    server_name: "{{ item['server_name']}}"
    tls_cert: "{{ item['tls_cert'] }}"
    tls_key: "{{ item['tls_key'] }}"
    nginx_locations: "{{ item['locations'] }}"

- name: Generate site configurations (insecure http)
  template:
    src: site_insecure.conf.j2
    dest: "{{ nginx_configuration_path_host }}/sites-enabled/{{ server_name }}"
    owner: nginx
    group: nginx
    mode: 0440
  become: yes
  loop: "{{ nginx_sites }}"
  when: "not item['tls']|bool"
  vars:
    server_name: "{{ item['server_name']}}"
    nginx_locations: "{{ item['locations'] }}"


- apt:
    name:
     - rsync
     - python3-openssl
  become: yes
  when: ansible_os_family == 'Debian'

server.conf.j2

server {
    listen 80;
    return 301 https://$host$request_uri;
    server_tokens off;
    server_name {{ server_name }};
    modsecurity on;
    modsecurity_rules_file /etc/nginx/modsec/main.conf;
}

server {
    listen 443 ssl http2;
    server_name {{ server_name }};
    ssl_certificate /etc/nginx/tls/{{ tls_cert }};
    ssl_certificate_key /etc/nginx/tls/{{ tls_key }};
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
    ssl_session_tickets off;
    server_tokens off;
    modsecurity on;
    modsecurity_rules_file /etc/nginx/modsec/main.conf;
    ssl_dhparam {{ nginx_dh_params['dest'] }};
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    # HSTS (ngx_http_headers_module is required) (63072000 seconds)
    add_header Strict-Transport-Security "max-age=63072000" always;

    # OCSP stapling
    ssl_stapling on;
    ssl_stapling_verify on;

{% if tls_ca_cert is defined %}
    # verify chain of trust of OCSP response using Root CA and Intermediate certs
    ssl_trusted_certificate {{ tls_ca_cert['dest'] }};
{% endif %}
{% for location in nginx_locations %}
{{ location }}
{% endfor %}
}

vars.yml

nginx_dh_params:
  src: files/dhparams.txt
  dest: /etc/nginx/tls/dhparams.txt
nginx_sites:
  - server_name: test.example.local
    tls: yes
    tls_cert: test.example.local.pem
    tls_key: test.example.local.key
    locations:
      - >
         location / {
             client_max_body_size 100m;
             proxy_set_header X-Forwarded-Host $host;
             proxy_set_header X-Forwarded-Server $host;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_pass http://172.17.0.1:9999;
         }
  - server_name: test2.example.local
    tls: no
    locations:
      - >
         location / {
             client_max_body_size 100m;
             proxy_set_header X-Forwarded-Host $host;
             proxy_set_header X-Forwarded-Server $host;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_pass http://172.17.0.1:9998;
         }