fix some standards

defaults/main.yml

@@ -58,6 +58,11 @@ nginx_tls_source_use_files: True
 nginx_tls_cert_file: mycert.pem
 nginx_tls_key_file: mykey.pem
 
+nginx_tls_ciphers:
+  - ECDHE-ECDSA-CHACHA20-POLY1305
+  - ECDHE-ECDSA-AES128-GCM-SHA256
+  - ECDHE-ECDSA-AES128-SHA
+
 nginx_tls_ocsp_enabled: False
 # nginx_tls_ocsp_trusted_certificate: # defaults to not set
 

handlers/main.yml

@@ -1,9 +1,8 @@
 ---
-- name: reload nginx
+- name: Reload nginx
   systemd:
     state: reloaded
     name: nginx
-  listen:
+  listen: __nginx_reload
-    - __nginx_reload
   become: True
   become_user: root

meta/main.yml

@@ -1,3 +1,4 @@
+# Standards: 0.1
 ---
 galaxy_info:
   author: xoxys
@@ -5,9 +6,9 @@ galaxy_info:
   license: MIT
   min_ansible_version: 2.4
   platforms:
-  - name: EL
+    - name: EL
-    versions:
+      versions:
-    - 7
+        - 7
   galaxy_tags:
     - nginx
     - webserver

tasks/install.yml

@@ -1,128 +1,128 @@
 ---
 - block:
-  - name: Add nginx repository
+    - name: Add nginx repository
-    yum_repository:
+      yum_repository:
-      name: nginx
+        name: nginx
-      file: nginx
+        file: nginx
-      description: NGINX High Performance Web Server
+        description: NGINX High Performance Web Server
-      baseurl: "https://nginx.org/packages/centos/{{ ansible_distribution_major_version }}/$basearch/"
+        baseurl: "https://nginx.org/packages/centos/{{ ansible_distribution_major_version }}/$basearch/"
-      gpgkey: https://nginx.org/keys/nginx_signing.key
+        gpgkey: https://nginx.org/keys/nginx_signing.key
-      gpgcheck: yes
+        gpgcheck: yes
-    when: nginx_official_repo_enabled
+      when: nginx_official_repo_enabled
 
-  - name: Installing nginx
+    - name: Installing nginx
-    yum:
+      yum:
-      name: nginx
+        name: nginx
-      state: installed
+        state: installed
 
-  - name: Create group '{{ nginx_group }}'
+    - name: Create group '{{ nginx_group }}'
-    group:
+      group:
-      name: "{{ nginx_group }}"
+        name: "{{ nginx_group }}"
-      state: present
+        state: present
-    when: nginx_group != "nginx"
+      when: nginx_group != "nginx"
 
-  - name: Create user '{{ nginx_user }}'
+    - name: Create user '{{ nginx_user }}'
-    user:
+      user:
-      name: "{{ nginx_user }}"
+        name: "{{ nginx_user }}"
-      group: "{{ nginx_group }}"
+        group: "{{ nginx_group }}"
-      createhome: no
+        createhome: no
-      shell: /sbin/nologin
+        shell: /sbin/nologin
-    when: nginx_user != "nginx"
+      when: nginx_user != "nginx"
 
-  - name: Prepare vhost directories
+    - name: Prepare vhost directories
-    file:
+      file:
-      path: "{{ item }}"
+        path: "{{ item }}"
-      state: directory
+        state: directory
-      owner: "{{ nginx_user }}"
+        owner: "{{ nginx_user }}"
-      group: "{{ nginx_group }}"
+        group: "{{ nginx_group }}"
-      mode: 0750
+        mode: 0750
-    with_items:
+      with_items:
-      - "{{ nginx_vhosts_dir }}"
+        - "{{ nginx_vhosts_dir }}"
-      - "{{ nginx_vhosts_dir }}/default"
+        - "{{ nginx_vhosts_dir }}/default"
 
-  - name: Prepare nginx directories
+    - name: Prepare nginx directories
-    file:
+      file:
-      path: "{{ item }}"
+        path: "{{ item }}"
-      state: directory
+        state: directory
-      owner: root
+        owner: root
-      group: root
+        group: root
-      mode: 0640
+        mode: 0640
-    with_items:
+      with_items:
-      - /etc/nginx/sites-available
+        - /etc/nginx/sites-available
-      - /etc/nginx/sites-enabled
+        - /etc/nginx/sites-enabled
 
-  - name: Update nginx.conf
+    - name: Update nginx.conf
-    template:
+      template:
-      src: etc/nginx/nginx.conf.j2
+        src: etc/nginx/nginx.conf.j2
-      dest: "/etc/nginx/nginx.conf"
+        dest: "/etc/nginx/nginx.conf"
-      owner: root
+        owner: root
-      group: root
+        group: root
-      mode: 0640
+        mode: 0640
-      validate: /sbin/nginx -t -c %s
+        validate: /sbin/nginx -t -c %s
-    notify: __nginx_reload
+      notify: __nginx_reload
 
-  - name: Remove default.conf from conf.d
+    - name: Remove default.conf from conf.d
-    file:
+      file:
-      path: /etc/nginx/conf.d/default.conf
+        path: /etc/nginx/conf.d/default.conf
-      state: absent
+        state: absent
 
-  - name: Update header.conf
+    - name: Update header.conf
-    template:
+      template:
-      src: etc/nginx/conf.d/header.conf.j2
+        src: etc/nginx/conf.d/header.conf.j2
-      dest: /etc/nginx/conf.d/header.conf
+        dest: /etc/nginx/conf.d/header.conf
-      owner: root
+        owner: root
-      group: root
+        group: root
-      mode: 0640
+        mode: 0640
-      validate: bash -c 'nginx -t -c /dev/stdin <<< "events {worker_connections 1;} http { include %s; }"'
+        validate: bash -c 'nginx -t -c /dev/stdin <<< "events {worker_connections 1;} http { include %s; }"'
-    notify: __nginx_reload
+      notify: __nginx_reload
 
-  - name: Open ports in iptables
+    - name: Open ports in iptables
-    iptables_raw:
+      iptables_raw:
-      name: allow_nginx_ports
+        name: allow_nginx_ports
-      state: present
+        state: present
-      rules: '-A INPUT -p tcp -m multiport --dports {{ nginx_open_ports|join(",") }} -j ACCEPT'
+        rules: '-A INPUT -p tcp -m multiport --dports {{ nginx_open_ports|join(",") }} -j ACCEPT'
-    when: nginx_iptables_enabled
+      when: nginx_iptables_enabled
 
-  - name: Set selinux booleans
+    - name: Set selinux booleans
-    seboolean:
+      seboolean:
-      name: "{{ item.name }}"
+        name: "{{ item.name }}"
-      state: "{{ item.state }}"
+        state: "{{ item.state }}"
-      persistent: "{{ item.persistent }}"
+        persistent: "{{ item.persistent }}"
-    with_items: "{{ nginx_set_sebooleans }}"
+      with_items: "{{ nginx_set_sebooleans }}"
-    when: nginx_set_sebooleans is defined
+      when: nginx_set_sebooleans is defined
   become: True
   become_user: root
 
 - block:
-  - name: Add default page
+    - name: Add default page
-    template:
+      template:
-      src: var/www/vhosts/default/index.html.j2
+        src: var/www/vhosts/default/index.html.j2
-      dest: /var/www/vhosts/default/index.html
+        dest: /var/www/vhosts/default/index.html
-      owner: "{{ nginx_user }}"
+        owner: "{{ nginx_user }}"
-      group: "{{ nginx_group }}"
+        group: "{{ nginx_group }}"
-      mode: 0750
+        mode: 0750
   when: nginx_default_page_enabled
   become: True
   become_user: "{{ nginx_user }}"
 
 - block:
-  - name: Add default page configuration file
+    - name: Add default page configuration file
-    template:
+      template:
-      src: etc/nginx/sites-available/default.j2
+        src: etc/nginx/sites-available/default.j2
-      dest: /etc/nginx/sites-available/default
+        dest: /etc/nginx/sites-available/default
-      owner: root
+        owner: root
-      group: root
+        group: root
-      mode: 0640
+        mode: 0640
-    notify: __nginx_reload
+      notify: __nginx_reload
 
-  - name: Enable default page
+    - name: Enable default page
-    file:
+      file:
-      src: /etc/nginx/sites-available/default
+        src: /etc/nginx/sites-available/default
-      dest: /etc/nginx/sites-enabled/default
+        dest: /etc/nginx/sites-enabled/default
-      owner: root
+        owner: root
-      group: root
+        group: root
-      state: link
+        state: link
-    notify: __nginx_reload
+      notify: __nginx_reload
   when: nginx_default_page_enabled
   become: True
   become_user: root

tasks/tls.yml

@@ -1,28 +1,29 @@
+---
 - block:
-  - name: Copy certs and private key (content)
+    - name: Copy certs and private key (content)
-    copy:
+      copy:
-      content: "{{ item.src }}"
+        content: "{{ item.src }}"
-      dest: "{{ item.dest }}"
+        dest: "{{ item.dest }}"
-      mode: "{{ item.mode }}"
+        mode: "{{ item.mode }}"
-    with_items:
+      with_items:
-      - { src: "{{ nginx_tls_key_source }}", dest: '/etc/pki/tls/private/{{ nginx_tls_key_file }}', mode: '0600' }
+        - { src: "{{ nginx_tls_key_source }}", dest: '/etc/pki/tls/private/{{ nginx_tls_key_file }}', mode: '0600' }
-      - { src: "{{ nginx_tls_cert_source }}", dest: '/etc/pki/tls/certs/{{ nginx_tls_cert_file }}', mode: '0750' }
+        - { src: "{{ nginx_tls_cert_source }}", dest: '/etc/pki/tls/certs/{{ nginx_tls_cert_file }}', mode: '0750' }
-    loop_control:
+      loop_control:
-      label: "{{ item.dest }}"
+        label: "{{ item.dest }}"
-    notify: __nginx_reload
+      notify: __nginx_reload
-    when: nginx_tls_source_use_content
+      when: nginx_tls_source_use_content
 
-  - name: Copy certs and private key (files)
+    - name: Copy certs and private key (files)
-    copy:
+      copy:
-      src: "{{ item.src }}"
+        src: "{{ item.src }}"
-      dest: "{{ item.dest }}"
+        dest: "{{ item.dest }}"
-      mode: "{{ item.mode }}"
+        mode: "{{ item.mode }}"
-    with_items:
+      with_items:
-      - { src: "{{ nginx_tls_key_source }}", dest: '/etc/pki/tls/private/{{ nginx_tls_key_file }}', mode: '0600' }
+        - { src: "{{ nginx_tls_key_source }}", dest: '/etc/pki/tls/private/{{ nginx_tls_key_file }}', mode: '0600' }
-      - { src: "{{ nginx_tls_cert_source }}", dest: '/etc/pki/tls/certs/{{ nginx_tls_cert_file }}', mode: '0750' }
+        - { src: "{{ nginx_tls_cert_source }}", dest: '/etc/pki/tls/certs/{{ nginx_tls_cert_file }}', mode: '0750' }
-    loop_control:
+      loop_control:
-      label: "{{ item.dest }}"
+        label: "{{ item.dest }}"
-    notify: __nginx_reload
+      notify: __nginx_reload
-    when: nginx_tls_source_use_files
+      when: nginx_tls_source_use_files
   become: True
   become_user: root

templates/etc/nginx/conf.d/tls.conf.j2

@@ -1,13 +1,12 @@
 # {{ ansible_managed }}
-# certificate settings
+ssl_ciphers '{{ nginx_tls_ciphers | join(":") }}';
-ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA';
 ssl_prefer_server_ciphers on;
 
 ssl_protocols TLSv1.2;
 ssl_session_cache shared:SSL:10m;
 
-{% if nginx_tls_enabled and nginx_tls_ocsp_enabled %}
+{% if nginx_tls_ocsp_enabled %}
 ssl_stapling on;
-ssl_trusted_certificate /pfad/bundle.ca.pem;
+ssl_trusted_certificate {{ nginx_tls_ocsp_trusted_certificate }};
 ssl_stapling_verify on;
 {% endif %}