From 2358c978e07bafd68b894c1605886b252f122965 Mon Sep 17 00:00:00 2001
From: Robert Kaussow <mail@geeklabor.de>
Date: Sat, 15 Jul 2017 17:24:48 +0200
Subject: [PATCH] add basic nginx conf

---
 handlers/main.yml                          |  7 +++
 tasks/config.yml                           | 31 ++++++++++++
 tasks/install.yml                          |  2 +-
 templates/etc/nginx/conf.d/default.conf.j2 | 16 ++++++
 templates/etc/nginx/conf.d/header.conf.j2  |  5 ++
 templates/etc/nginx/nginx.conf.j2          | 57 ++++++++++++++++++++++
 6 files changed, 117 insertions(+), 1 deletion(-)
 create mode 100644 handlers/main.yml
 create mode 100644 templates/etc/nginx/conf.d/default.conf.j2
 create mode 100644 templates/etc/nginx/conf.d/header.conf.j2
 create mode 100644 templates/etc/nginx/nginx.conf.j2

diff --git a/handlers/main.yml b/handlers/main.yml
new file mode 100644
index 0000000..c2e1dd7
--- /dev/null
+++ b/handlers/main.yml
@@ -0,0 +1,7 @@
+---
+- name: reload nginx
+  systemd:
+    state: reloaded
+    name: nginx
+  listen:
+    - "nginx_restart"
diff --git a/tasks/config.yml b/tasks/config.yml
index 3bbc76c..a85fcf9 100644
--- a/tasks/config.yml
+++ b/tasks/config.yml
@@ -4,3 +4,34 @@
     name: nginx
     enabled: yes
     state: started
+
+- name: Prepare directories
+  file:
+    path: /var/www/vhosts
+    state: directory
+    owner: nginx
+    group: nginx
+    mode: 0750
+
+- name: Update nginx.conf
+  template:
+    src: 'etc/nginx/nginx.conf.j2'
+    dest: '/etc/nginx/nginx.conf'
+    owner: root
+    group: root
+    mode: 0640
+  notify:
+    - nginx_restart
+
+- name: Update conf.d files
+  template:
+    src: 'etc/nginx/conf.d/{{ item }}.j2'
+    dest: '/etc/nginx/conf.d/{{ item }}'
+    owner: root
+    group: root
+    mode: 0640
+  with_items:
+    - deafult.conf
+    - header.conf
+  notify:
+    - nginx_restart
diff --git a/tasks/install.yml b/tasks/install.yml
index a324c01..8944176 100644
--- a/tasks/install.yml
+++ b/tasks/install.yml
@@ -3,7 +3,7 @@
   yum:
     name: http://nginx.org/packages/centos/7/noarch/RPMS/nginx-release-centos-7-0.el7.ngx.noarch.rpm
 
-- name: Installing NGINX
+- name: Installing nginx
   yum:
     name: nginx
     state: latest
diff --git a/templates/etc/nginx/conf.d/default.conf.j2 b/templates/etc/nginx/conf.d/default.conf.j2
new file mode 100644
index 0000000..b2e5f9c
--- /dev/null
+++ b/templates/etc/nginx/conf.d/default.conf.j2
@@ -0,0 +1,16 @@
+# {{ ansible_managed }}
+server {
+    listen       80;
+    server_name  localhost;
+
+    location / {
+        root   /usr/share/nginx/html;
+        index  index.html index.htm;
+    }
+
+    # redirect server error pages to the static page /50x.html
+    error_page   500 502 503 504  /50x.html;
+    location = /50x.html {
+        root   /usr/share/nginx/html;
+    }
+}
diff --git a/templates/etc/nginx/conf.d/header.conf.j2 b/templates/etc/nginx/conf.d/header.conf.j2
new file mode 100644
index 0000000..57a58e4
--- /dev/null
+++ b/templates/etc/nginx/conf.d/header.conf.j2
@@ -0,0 +1,5 @@
+# {{ ansible_managed }}
+add_header Strict-Transport-Security max-age=63072000;
+add_header X-Frame-Options DENY;
+add_header X-Content-Type-Options nosniff;
+add_header X-XSS-Protection "1; mode=block";
diff --git a/templates/etc/nginx/nginx.conf.j2 b/templates/etc/nginx/nginx.conf.j2
new file mode 100644
index 0000000..8d1e0b0
--- /dev/null
+++ b/templates/etc/nginx/nginx.conf.j2
@@ -0,0 +1,57 @@
+# {{ ansible_managed }}
+
+user nginx;
+worker_processes 1;
+
+error_log /var/log/nginx/error.log;
+pid /run/nginx.pid;
+
+
+events {
+    worker_connections 1024;
+}
+
+
+http {
+    include             /etc/nginx/mime.types;
+    default_type        application/octet-stream;
+
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log  /var/log/nginx/access.log  main;
+
+    sendfile            on;
+    tcp_nopush          on;
+    tcp_nodelay         on;
+    types_hash_max_size 2048;
+    server_tokens off;
+
+    ## Buffers
+    client_body_buffer_size 10K;
+    client_header_buffer_size 1k;
+    client_max_body_size 8m;
+
+    ## Timeouts
+    client_body_timeout 12;
+    client_header_timeout 12;
+    keepalive_timeout 15;
+    send_timeout 10;
+
+    ## Gzip Settings
+    gzip             on;
+    gzip_comp_level  2;
+    gzip_min_length  1000;
+    gzip_proxied     expired no-cache no-store private auth;
+    gzip_types       text/plain application/x-javascript text/xml text/css application/xml;
+
+    # Load modular configuration files from the /etc/nginx/conf.d directory.
+    # See http://nginx.org/en/docs/ngx_core_module.html#include
+    # for more information.
+    include /etc/nginx/conf.d/*.conf;
+
+    ## Virtual Host Configs
+    include /etc/nginx/sites-enabled/*;
+    server_names_hash_bucket_size 64;
+}