ansible/xoxys.nginx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

add ssl_dhparam if enabled

Browse Source
This commit is contained in:
Robert Kaussow 2018-12-09 23:12:03 +01:00
parent 86600837e3
commit ac395e2a47
3 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
defaults/main.yml
View File

@ -59,6 +59,8 @@ nginx_tls_cert_source: mycert.pem
nginx_tls_key_source: mykey.pem nginx_tls_key_source: mykey.pem
nginx_tls_cert_file: mycert.pem nginx_tls_cert_file: mycert.pem
nginx_tls_key_file: mykey.pem nginx_tls_key_file: mykey.pem
# nginx_tls_dhparam_file: # defaults to not set
# nginx_tls_dhparam_size: # defaults to 2048
nginx_tls_ciphers: nginx_tls_ciphers:
- ECDHE-ECDSA-CHACHA20-POLY1305 - ECDHE-ECDSA-CHACHA20-POLY1305

6
tasks/tls.yml
View File

@ -26,6 +26,12 @@
notify: __nginx_reload notify: __nginx_reload
when: nginx_tls_source_use_files when: nginx_tls_source_use_files
- name: Create Diffie-Hellman Parameter
openssl_dhparam:
path: "{{ nginx_tls_dhparam_file }}"
size: "{{ nginx_tls_dhparam_size | default('2048') }}"
when: nginx_tls_dhparam_file is defined
- name: Update tls.conf - name: Update tls.conf
template: template:
src: etc/nginx/conf.d/tls.conf.j2 src: etc/nginx/conf.d/tls.conf.j2

4
templates/etc/nginx/conf.d/tls.conf.j2
View File

@ -1,6 +1,10 @@
#jinja2: lstrip_blocks: True
# {{ ansible_managed }} # {{ ansible_managed }}
ssl_ciphers '{{ nginx_tls_ciphers | join(":") }}'; ssl_ciphers '{{ nginx_tls_ciphers | join(":") }}';
ssl_prefer_server_ciphers on; ssl_prefer_server_ciphers on;
{% if nginx_tls_dhparam_file is definde %}
ssl_dhparam {{ nginx_tls_dhparam_file }};
{% endif %}
ssl_protocols TLSv1.2; ssl_protocols TLSv1.2;
ssl_session_cache shared:SSL:10m; ssl_session_cache shared:SSL:10m;