150 lines
3.3 KiB
YAML
150 lines
3.3 KiB
YAML
---
|
|
- name: add official nginx apt key
|
|
apt_key:
|
|
state: present
|
|
id: 7BD9BF62
|
|
url: "https://nginx.org/keys/nginx_signing.key"
|
|
|
|
- name: add official nginx apt repository
|
|
apt_repository:
|
|
state: present
|
|
repo: "{{ item }}"
|
|
update_cache: yes
|
|
filename: nginx
|
|
loop:
|
|
- deb http://nginx.org/packages/debian/ stretch nginx
|
|
- deb-src http://nginx.org/packages/debian/ stretch nginx
|
|
|
|
- name: install nginx packages
|
|
package:
|
|
name: nginx
|
|
state: present
|
|
|
|
- name: install ssl-cert packages
|
|
package:
|
|
name: ssl-cert
|
|
state: present
|
|
|
|
- name: Add remote server to known_hosts
|
|
known_hosts:
|
|
path: /etc/ssh/ssh_known_hosts
|
|
name: zuckerwatte.ffmwu.org
|
|
key: "{{ lookup('file', 'known_hosts') }}"
|
|
|
|
- name: create cronjob to sync ssl certs
|
|
template:
|
|
src: ssl_certs.cron.j2
|
|
dest: /etc/cron.daily/ssl_certs
|
|
mode: 0755
|
|
owner: root
|
|
group: root
|
|
notify: restart cron
|
|
|
|
- name: create config snippets directory
|
|
file:
|
|
path: /etc/nginx/snippets
|
|
state: directory
|
|
mode: 0755
|
|
owner: root
|
|
group: root
|
|
|
|
- name: create certs directory
|
|
file:
|
|
path: /etc/nginx/ssl/{{ inventory_hostname_short }}.{{ http_domain_external }}
|
|
state: directory
|
|
mode: 0550
|
|
owner: www-data
|
|
group: admin
|
|
|
|
- name: create snakeoil cert
|
|
shell: make-ssl-cert generate-default-snakeoil
|
|
args:
|
|
creates: /etc/ssl/certs/ssl-cert-snakeoil.pem
|
|
|
|
- name: copy snakeoil ssl key for first start
|
|
copy:
|
|
src: /etc/ssl/private/ssl-cert-snakeoil.key
|
|
dest: /etc/nginx/ssl/{{ inventory_hostname_short }}.{{ http_domain_external }}/privkey.pem
|
|
remote_src: yes
|
|
force: no
|
|
owner: www-data
|
|
group: admin
|
|
mode: 0440
|
|
|
|
- name: copy snakeoil ssl cert for first start
|
|
copy:
|
|
src: /etc/ssl/certs/ssl-cert-snakeoil.pem
|
|
dest: /etc/nginx/ssl/{{ inventory_hostname_short }}.{{ http_domain_external }}/fullchain.pem
|
|
remote_src: yes
|
|
force: no
|
|
owner: www-data
|
|
group: admin
|
|
mode: 0440
|
|
|
|
- name: sync ssl certs
|
|
shell: /etc/cron.daily/ssl_certs
|
|
|
|
- name: copy gzip.conf to snippets
|
|
copy:
|
|
src: gzip.conf
|
|
dest: /etc/nginx/snippets/gzip.conf
|
|
mode: 0644
|
|
owner: root
|
|
group: root
|
|
|
|
- name: copy redirect-to-ssl.conf to snippets
|
|
copy:
|
|
src: redirect-to-ssl.conf
|
|
dest: /etc/nginx/snippets/redirect-to-ssl.conf
|
|
mode: 0644
|
|
owner: root
|
|
group: root
|
|
|
|
- name: write letsencrypt-acme-challenge.conf to snippets
|
|
template:
|
|
src: letsencrypt-acme-challenge.conf.j2
|
|
dest: /etc/nginx/snippets/letsencrypt-acme-challenge.conf
|
|
mode: 0644
|
|
owner: root
|
|
group: root
|
|
|
|
- name: write nginx configuration nginx.conf
|
|
template:
|
|
src: nginx.conf.j2
|
|
dest: /etc/nginx/nginx.conf
|
|
mode: 0644
|
|
owner: root
|
|
group: root
|
|
notify: restart nginx
|
|
|
|
- name: write nginx configuration default.conf
|
|
template:
|
|
src: default.conf.j2
|
|
dest: /etc/nginx/conf.d/default.conf
|
|
mode: 0644
|
|
notify: restart nginx
|
|
|
|
- name: manage html directory for static files
|
|
file:
|
|
path: /var/www/html/static
|
|
state: directory
|
|
mode: 0755
|
|
|
|
- name: copy css stylesheet
|
|
copy:
|
|
src: style.css
|
|
dest: /var/www/html/static/style.css
|
|
mode: 0644
|
|
|
|
- name: write index.html
|
|
template:
|
|
src: index.html.j2
|
|
dest: /var/www/html/index.html
|
|
mode: 0644
|
|
|
|
- name: configure systemd unit nginx
|
|
systemd:
|
|
name: nginx
|
|
state: started
|
|
enabled: yes
|