refactoring and cleanup

tasks/install.yml

@@ -1,95 +1,96 @@
 ---
-- name:
+- block:
-  yum_repository:
+  - name:
-    name: nginx
+    yum_repository:
-    file: nginx
+      name: nginx
-    description: NGINX High Performance Web Server
+      file: nginx
-    baseurl: "http://nginx.org/packages/centos/{{ ansible_distribution_major_version }}/$basearch/"
+      description: NGINX High Performance Web Server
-    gpgkey: https://nginx.org/keys/nginx_signing.key
+      baseurl: "http://nginx.org/packages/centos/{{ ansible_distribution_major_version }}/$basearch/"
-    gpgcheck: yes
+      gpgkey: https://nginx.org/keys/nginx_signing.key
+      gpgcheck: yes
 
-- name: Installing nginx
+  - name: Installing nginx
-  yum:
+    yum:
-    name: nginx
+      name: nginx
-    state: installed
+      state: installed
 
-- name: Prepare vhost directories
+  - name: Prepare vhost directories
-  file:
+    file:
-    path: '{{ item }}'
+      path: '{{ item }}'
-    state: directory
+      state: directory
-    owner: nginx
+      owner: nginx
-    group: nginx
+      group: nginx
-    mode: 0750
+      mode: 0750
-  with_items:
+    with_items:
-    - /var/www/vhosts
+      - /var/www/vhosts
-    - /var/www/vhosts/default
+      - /var/www/vhosts/default
 
-- name: Prepare nginx directories
+  - name: Prepare nginx directories
-  file:
+    file:
-    path: '{{ item }}'
+      path: '{{ item }}'
-    state: directory
+      state: directory
-    owner: root
+      owner: root
-    group: root
+      group: root
-    mode: 0640
+      mode: 0640
-  with_items:
+    with_items:
-    - /etc/nginx/sites-available
+      - /etc/nginx/sites-available
-    - /etc/nginx/sites-enabled
+      - /etc/nginx/sites-enabled
 
-- name: Add default page
+  - name: Update nginx.conf
-  template:
+    template:
-    src: 'var/www/vhosts/default/index.html.j2'
+      src: 'etc/nginx/nginx.conf.j2'
-    dest: '/var/www/vhosts/default/index.html'
+      dest: '/etc/nginx/nginx.conf'
-    owner: nginx
+      owner: root
-    group: nginx
+      group: root
-    mode: 0750
+      mode: 0640
+    notify:
+      - nginx_reload
 
-- name: Update nginx.conf
+  - name: Update conf.d files
-  template:
+    template:
-    src: 'etc/nginx/nginx.conf.j2'
+      src: 'etc/nginx/conf.d/{{ item }}.j2'
-    dest: '/etc/nginx/nginx.conf'
+      dest: '/etc/nginx/conf.d/{{ item }}'
-    owner: root
+      owner: root
-    group: root
+      group: root
-    mode: 0640
+      mode: 0640
-  notify:
+    with_items:
-    - nginx_reload
+      - header.conf
+      - tls.conf
+    notify:
+      - nginx_reload
 
-- name: Update conf.d files
+  - name: Remove default.conf from conf.d
-  template:
+    file:
-    src: 'etc/nginx/conf.d/{{ item }}.j2'
+      path: /etc/nginx/conf.d/default.conf
-    dest: '/etc/nginx/conf.d/{{ item }}'
+      state: absent
-    owner: root
-    group: root
-    mode: 0640
-  with_items:
-    - header.conf
-    - tls.conf
-  notify:
-    - nginx_reload
 
-- name: Remove default.conf from conf.d
+  - name: Add default page config
-  file:
+    template:
-    path: /etc/nginx/conf.d/default.conf
+      src: 'etc/nginx/sites-available/default.j2'
-    state: absent
+      dest: '/etc/nginx/sites-available/default'
+      owner: root
+      group: root
+      mode: 0640
+    notify:
+      - nginx_reload
 
-- name: Add default page config
+  - name: Enable default page
-  template:
+    file:
-    src: 'etc/nginx/sites-available/default.j2'
+      src: /etc/nginx/sites-available/default
-    dest: '/etc/nginx/sites-available/default'
+      dest: /etc/nginx/sites-enabled/default
-    owner: root
+      owner: root
-    group: root
+      group: root
-    mode: 0640
+      state: link
-  notify:
+    notify:
-    - nginx_reload
+      - nginx_reload
 
-- name: Enable default page
+  - name: Open ports in iptables
-  file:
+    iptables_raw:
-    src: /etc/nginx/sites-available/default
+      name: allow_nginx_ports
-    dest: /etc/nginx/sites-enabled/default
+      state: present
-    owner: root
+      rules: '-A INPUT -p tcp -m multiport --dports {{ nginx_open_ports|join(",") }} -j ACCEPT'
-    group: root
+  become: True
-    state: link
+  become_user: root
-  notify:
-    - nginx_reload
 
 - block:
   - name: Copy tls certificate
@@ -142,11 +143,16 @@
   become_user: root
   when: nginx_pfs_enabled
 
-- name: Open ports in iptables
+- block:
-  iptables_raw:
+  - name: Add default page
-    name: allow_nginx_ports
+    template:
-    state: present
+      src: 'var/www/vhosts/default/index.html.j2'
-    rules: '-A INPUT -p tcp -m multiport --dports {{ nginx_open_ports|join(",") }} -j ACCEPT'
+      dest: '/var/www/vhosts/default/index.html'
+      owner: nginx
+      group: nginx
+      mode: 0750
+  become: True
+  become_user: nginx
 
 - name: Enable nginx service
   systemd: