2017-07-15 15:39:52 +00:00
|
|
|
---
|
2018-08-09 19:20:06 +00:00
|
|
|
nginx_official_repo_enabled: True
|
2017-12-24 13:05:27 +00:00
|
|
|
nginx_user: nginx
|
|
|
|
|
nginx_group: nginx
|
2017-12-24 16:36:43 +00:00
|
|
|
nginx_worker_processes: 1
|
2017-12-24 16:42:23 +00:00
|
|
|
nginx_worker_connections: 1024
|
2018-08-11 12:59:43 +00:00
|
|
|
nginx_error_log:
|
|
|
|
|
enabled: True
|
|
|
|
|
file: /var/log/nginx/error.log
|
|
|
|
|
level: error
|
2018-08-11 13:22:15 +00:00
|
|
|
nginx_access_log:
|
2018-08-11 12:59:43 +00:00
|
|
|
enabled: True
|
|
|
|
|
file: /var/log/nginx/access.log
|
2018-08-11 13:27:27 +00:00
|
|
|
format: main
|
2018-08-11 12:59:43 +00:00
|
|
|
|
|
|
|
|
## nginx buffer sizes
|
|
|
|
|
nginx_client_body_buffer_size: 10k
|
|
|
|
|
nginx_client_header_buffer_size: 1k
|
|
|
|
|
nginx_client_max_body_size: 8m
|
|
|
|
|
|
|
|
|
|
## nginx timeout settings
|
|
|
|
|
nginx_client_body_timeout: 60
|
|
|
|
|
nginx_client_header_timeout: 60
|
|
|
|
|
nginx_keepalive_timeout: 65
|
|
|
|
|
nginx_send_timeout: 60
|
|
|
|
|
nginx_reset_timedout_connection: True
|
|
|
|
|
|
|
|
|
|
## nginx compression
|
|
|
|
|
nginx_gzip_enabled: True
|
|
|
|
|
nginx_gzip_comp_level: 2
|
|
|
|
|
nginx_gzip_min_length: 1000
|
|
|
|
|
nginx_gzip_proxied:
|
|
|
|
|
- expired
|
|
|
|
|
- no-cache
|
|
|
|
|
- no-store
|
|
|
|
|
- private
|
|
|
|
|
- auth
|
|
|
|
|
nginx_gzip_types:
|
|
|
|
|
- text/plain
|
|
|
|
|
- application/x-javascript
|
|
|
|
|
- text/xml
|
|
|
|
|
- text/css
|
|
|
|
|
- application/xml
|
|
|
|
|
|
2018-08-14 20:02:35 +00:00
|
|
|
nginx_iptables_enabled: False
|
2017-07-15 15:39:52 +00:00
|
|
|
nginx_open_ports:
|
|
|
|
|
- 80
|
|
|
|
|
- 443
|
2018-08-11 12:59:43 +00:00
|
|
|
|
2017-12-23 11:25:55 +00:00
|
|
|
nginx_tls_enabled: False
|
2018-10-22 08:11:35 +00:00
|
|
|
# You can deploy your certificates from a file or from content.
|
|
|
|
|
# If you enable nginx_tls_source_use_content you have to put the content of your cert files into
|
|
|
|
|
# nginx_tls_cert_file and nginx_tls_cert_file.
|
2018-08-12 09:31:12 +00:00
|
|
|
nginx_tls_source_use_content: False
|
2018-10-22 08:11:35 +00:00
|
|
|
# If you enable nginx_tls_source_use_files theses variables have to contain the path to your
|
|
|
|
|
# certificate files located on the ansible "master" host
|
2018-08-12 09:31:12 +00:00
|
|
|
nginx_tls_source_use_files: True
|
2018-10-22 19:31:38 +00:00
|
|
|
nginx_tls_cert_source: mycert.pem
|
|
|
|
|
nginx_tls_key_source: mykey.pem
|
2018-10-22 08:11:35 +00:00
|
|
|
nginx_tls_cert_file: mycert.pem
|
|
|
|
|
nginx_tls_key_file: mykey.pem
|
2018-12-09 22:12:03 +00:00
|
|
|
# nginx_tls_dhparam_file: # defaults to not set
|
|
|
|
|
# nginx_tls_dhparam_size: # defaults to 2048
|
2018-08-12 09:31:12 +00:00
|
|
|
|
2018-10-22 08:56:39 +00:00
|
|
|
nginx_tls_ciphers:
|
|
|
|
|
- ECDHE-ECDSA-CHACHA20-POLY1305
|
|
|
|
|
- ECDHE-ECDSA-AES128-GCM-SHA256
|
|
|
|
|
- ECDHE-ECDSA-AES128-SHA
|
|
|
|
|
|
2018-08-14 20:35:00 +00:00
|
|
|
nginx_tls_ocsp_enabled: False
|
2018-10-22 08:11:35 +00:00
|
|
|
# nginx_tls_ocsp_trusted_certificate: # defaults to not set
|
2018-08-14 20:35:00 +00:00
|
|
|
|
|
|
|
|
nginx_tls_hsts_enabled: False
|
2018-08-11 23:14:47 +00:00
|
|
|
nginx_hsts_options:
|
2018-12-09 22:12:54 +00:00
|
|
|
- max-age=63072000
|
2018-08-11 23:14:47 +00:00
|
|
|
- includeSubDomains
|
|
|
|
|
|
2018-10-22 08:11:35 +00:00
|
|
|
nginx_xfo_enabled: True
|
|
|
|
|
nginx_xfo_policy: deny
|
|
|
|
|
|
|
|
|
|
nginx_xcto_enabled: True
|
|
|
|
|
|
|
|
|
|
nginx_xxxsp_enabled: True
|
|
|
|
|
nginx_xxxsp_parameters:
|
|
|
|
|
- mode=block
|
|
|
|
|
|
2018-08-11 12:59:43 +00:00
|
|
|
nginx_vhosts_dir: /var/www/vhosts
|
|
|
|
|
|
|
|
|
|
nginx_default_page_enabled: False
|
|
|
|
|
|
|
|
|
|
nginx_server_names_hash_bucket_size: 32
|
