nginx(role): split up repo setup and install task lists to estab. conv.

Split up repo setup and package installation after all to establish this
as a convention (its already done this way in the docker role and was
done this way in the nginx role before) to highlight that an external
repo is used.

playbooks/maintenance.yaml

@@ -1,10 +1,15 @@
-- name: Ensure nginx install on nginx_hosts and nextcloud_hosts
+- name: Ensure NGINX repo setup and nginx install on nginx_hosts and nextcloud_hosts
   hosts: nginx_hosts:nextcloud_hosts
   tasks:
-    - name: Ensure NGINX is installed
+    - name: Ensure NGINX repo is setup
       ansible.builtin.include_role:
         name: nginx
-        tasks_from: main/02_nginx_install.yaml
+        tasks_from: main/02_repo_setup.yaml
+
+    - name: Ensure nginx is installed
+      ansible.builtin.include_role:
+        name: nginx
+        tasks_from: main/03_nginx_install.yaml
 
 - name: Make Sure System Package Are Up-To-Date for all non-hypervisors
   hosts: all:!hypervisors

roles/nginx/tasks/main.yaml

@@ -2,10 +2,14 @@
   ansible.builtin.import_tasks:
     file: main/01_validate_config_names.yaml
 
+- name: Ensure NGINX repo is set up
+  ansible.builtin.import_tasks:
+    file: main/02_repo_setup.yaml
+
 - name: Ensure nginx is installed
   ansible.builtin.import_tasks:
-    file: main/02_nginx_install.yaml
+    file: main/03_nginx_install.yaml
 
 - name: Ensure configuration deployment
   ansible.builtin.import_tasks:
-    file: main/03_config_deploy.yaml
+    file: main/04_config_deploy.yaml

roles/nginx/tasks/main/02_repo_setup.yaml

@@ -0,0 +1,39 @@
+- name: Ensure gnupg is installed
+  ansible.builtin.apt:
+    name: gnupg
+    state: present
+  become: true
+
+- name: Ensure NGINX signing key is added
+  ansible.builtin.get_url:
+    url: https://nginx.org/keys/nginx_signing.key
+    dest: /etc/apt/trusted.gpg.d/nginx.asc
+    mode: "0644"
+    owner: root
+    group: root
+  become: true
+
+- name: Ensure NGINX APT repository is added
+  ansible.builtin.apt_repository:
+    repo: "deb [arch=amd64 signed-by=/etc/apt/trusted.gpg.d/nginx.asc] https://nginx.org/packages/debian/ {{ ansible_distribution_release }} nginx"
+    state: present
+  become: true
+
+- name: Ensure NGINX APT source repository is added
+  ansible.builtin.apt_repository:
+    repo: "deb-src [arch=amd64 signed-by=/etc/apt/trusted.gpg.d/nginx.asc] https://nginx.org/packages/debian/ {{ ansible_distribution_release }} nginx"
+    state: present
+  become: true
+
+- name: Ensure repository pinning to make sure nginx package gets installed from NGINX repositories is set up
+  ansible.builtin.copy:
+    content: |
+      Package: *
+      Pin: origin nginx.org
+      Pin: release o=nginx
+      Pin-Priority: 900
+    dest: /etc/apt/preferences.d/99nginx
+    owner: root
+    group: root
+    mode: "0644"
+  become: true

roles/nginx/tasks/main/03_nginx_install.yaml

@@ -0,0 +1,6 @@
+- name: Ensure nginx is installed
+  ansible.builtin.apt:
+    name: nginx
+    state: present
+    update_cache: true
+  become: true

roles/nginx/tasks/main/04_config_deploy.yaml

@@ -0,0 +1,150 @@
+- name: Check, if a save of a previous `nginx.conf` is present
+  ansible.builtin.stat:
+    path: /etc/nginx/nginx.conf.ansiblesave
+  register: nginx__nginx_conf_ansiblesave_stat
+
+- name: Handle the case, where a custom `nginx.conf` is to be used
+  when: nginx__use_custom_nginx_conf
+  block:
+    - name: When no `nginx.conf.ansiblesave` is present, save the current `nginx.conf`
+      when: not nginx__nginx_conf_ansiblesave_stat.stat.exists
+      ansible.builtin.copy:
+        force: true
+        dest: /etc/nginx/nginx.conf.ansiblesave
+        mode: "0644"
+        owner: root
+        group: root
+        remote_src: true
+        src: /etc/nginx/nginx.conf
+      become: true
+
+    - name: Ensure the custom `nginx.conf` is deployed
+      ansible.builtin.copy:
+        content: "{{ nginx__custom_nginx_conf }}"
+        dest: "/etc/nginx/nginx.conf"
+        mode: "0644"
+        owner: root
+        group: root
+      become: true
+      notify: Restart nginx
+
+- name: Handle the case, where no custom `nginx.conf` is to be used
+  when: not nginx__use_custom_nginx_conf
+  block:
+    - name: When a `nginx.conf.ansiblesave` is present, copy it to `nginx.conf`
+      when: nginx__nginx_conf_ansiblesave_stat.stat.exists
+      ansible.builtin.copy:
+        force: true
+        dest: /etc/nginx/nginx.conf
+        mode: "0644"
+        owner: root
+        group: root
+        remote_src: true
+        src: /etc/nginx/nginx.conf.ansiblesave
+      become: true
+      notify: Restart nginx
+
+    - name: Ensure no `nginx.conf.ansiblesave` is present
+      when: nginx__nginx_conf_ansiblesave_stat.stat.exists
+      ansible.builtin.file:
+        path: /etc/nginx/nginx.conf.ansiblesave
+        state: absent
+      become: true
+
+- name: Ensure mozilla dhparam is deployed
+  ansible.builtin.get_url:
+    force: true
+    dest: /etc/nginx-mozilla-dhparam
+    mode: "0644"
+    url: https://ssl-config.mozilla.org/ffdhe2048.txt
+  become: true
+  notify: Restart nginx
+
+- name: Set `nginx__config_files_to_exist` fact initially to an empty list
+  ansible.builtin.set_fact:
+    nginx__config_files_to_exist: [ ]
+
+- name: Handle the case, where tls.conf should be deployed
+  when: nginx__deploy_tls_conf
+  block:
+    - name: Ensure tls.conf is deployed
+      ansible.builtin.copy:
+        force: true
+        dest: /etc/nginx/conf.d/tls.conf
+        mode: "0644"
+        owner: root
+        group: root
+        src: tls.conf
+      become: true
+      notify: Restart nginx
+
+    - name: Add tls.conf to nginx__config_files_to_exist
+      ansible.builtin.set_fact:
+        nginx__config_files_to_exist: "{{ nginx__config_files_to_exist + [ 'tls.conf' ] }}"  # noqa: jinja[spacing]
+
+- name: Handle the case, where redirect.conf should be deployed
+  when: nginx__deploy_redirect_conf
+  block:
+    - name: Ensure redirect.conf is deployed
+      ansible.builtin.copy:
+        force: true
+        dest: /etc/nginx/conf.d/redirect.conf
+        mode: "0644"
+        owner: root
+        group: root
+        src: redirect.conf
+      become: true
+      notify: Restart nginx
+
+    - name: Add redirect.conf to nginx__config_files_to_exist
+      ansible.builtin.set_fact:
+        nginx__config_files_to_exist: "{{ nginx__config_files_to_exist + [ 'redirect.conf' ] }}"  # noqa: jinja[spacing]
+
+- name: Handle the case, where logging.conf should be deployed
+  when: nginx__deploy_logging_conf
+  block:
+    - name: Ensure logging.conf is deployed
+      ansible.builtin.copy:
+        force: true
+        dest: /etc/nginx/conf.d/logging.conf
+        mode: "0644"
+        owner: root
+        group: root
+        src: logging.conf
+      become: true
+      notify: Restart nginx
+
+    - name: Add logging.conf to nginx__config_files_to_exist
+      ansible.builtin.set_fact:
+        nginx__config_files_to_exist: "{{ nginx__config_files_to_exist + [ 'logging.conf' ] }}"  # noqa: jinja[spacing]
+
+- name: Ensure all given configuration files are deployed
+  ansible.builtin.copy:
+    content: "{{ item.content }}"
+    dest: "/etc/nginx/conf.d/{{ item.name }}.conf"
+    mode: "0644"
+    owner: root
+    group: root
+  become: true
+  loop: "{{ nginx__configurations }}"
+  notify: Restart nginx
+
+- name: Add names with suffixes from `nginx__configurations` to `nginx__config_files_to_exist` fact
+  ansible.builtin.set_fact:
+    nginx__config_files_to_exist: "{{ nginx__config_files_to_exist + [ item.name + '.conf' ] }}"  # noqa: jinja[spacing]
+  loop: "{{ nginx__configurations }}"
+
+- name: Find configuration files to remove
+  ansible.builtin.find:
+    paths: /etc/nginx/conf.d/
+    recurse: false
+    excludes: "{{ nginx__config_files_to_exist }}"
+  register: nginx__config_files_to_remove
+
+- name: Remove all configuration file, which should be removed
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: absent
+  become: true
+  loop: "{{ nginx__config_files_to_remove.files }}"
+  notify: Restart nginx