xoxys.nginx/tasks/config.yml

---
- name: Enable nginx service
  service:
    name: nginx
    enabled: yes
    state: started

- name: Prepare vhost directories
  file:
    path: '{{ item }}'
    state: directory
    owner: nginx
    group: nginx
    mode: 0750
  with_items:
    - /var/www/vhosts
    - /var/www/vhosts/default

- name: Prepare nginx directories
  file:
    path: '{{ item }}'
    state: directory
    owner: root
    group: root
    mode: 0640
  with_items:
    - /etc/nginx/sites-available
    - /etc/nginx/sites-enabled

- name: Add default page
  template:
    src: 'var/www/vhosts/default/index.html.j2'
    dest: '/var/www/vhosts/default/index.html'
    owner: nginx
    group: nginx
    mode: 0750

- name: Update nginx.conf
  template:
    src: 'etc/nginx/nginx.conf.j2'
    dest: '/etc/nginx/nginx.conf'
    owner: root
    group: root
    mode: 0640
  notify:
    - nginx_reload

- name: Update conf.d files
  template:
    src: 'etc/nginx/conf.d/{{ item }}.j2'
    dest: '/etc/nginx/conf.d/{{ item }}'
    owner: root
    group: root
    mode: 0640
  with_items:
    - header.conf
    - tls.conf
  notify:
    - nginx_reload

- name: Remove default.conf from conf.d
  file:
    path: /etc/nginx/conf.d/default.conf
    state: absent

- name: Add default page config
  template:
    src: 'etc/nginx/sites-available/default.j2'
    dest: '/etc/nginx/sites-available/default'
    owner: root
    group: root
    mode: 0640

- name: Enable default page
  file:
    src: /etc/nginx/sites-available/default
    dest: /etc/nginx/sites-enabled/default
    owner: root
    group: root
    state: link
  notify:
    - nginx_reload

- name: Copy ssl chained certs
  copy:
    content: '{{ ssl_chained_cert }}'
    dest: /etc/pki/tls/certs/my-chained.crt
    owner: root
    group: root
    mode: 0644
  notify:
    - nginx_reload

- name: Copy ssl intermediate cert
  copy:
    content: '{{ ssl_intermediate_cert }}'
    dest: /etc/pki/tls/certs/my-intermediate.crt
    owner: root
    group: root
    mode: 0644
  notify:
    - nginx_reload

- name: Copy ssl private key
  copy:
    content: '{{ ssl_priv_key }}'
    dest: /etc/pki/tls/private/my-private.key
    owner: root
    group: root
    mode: 0600
  notify:
    - nginx_reload

- name: register dhparam file
  stat:
    path: "{{ dhparam_file }}"
  register: dh_file

- name: Generate Diffie-Hellman parameter file
  shell: "/usr/bin/openssl dhparam -out '{{ dhparam_file }}' {{ dhparam_size }}"
  async: 3600
  poll: 60
  when: dh_file.stat.exists == 'false'
  notify:
    - nginx_reload

- name: Open ports in iptables
  iptables_raw:
    name: allow_nginx_ports
    state: present
    rules: '-A INPUT -p tcp -m multiport --dports {{ nginx_open_ports|join(",") }} -j ACCEPT'