55 lines
1.9 KiB
Markdown
55 lines
1.9 KiB
Markdown
# Role `nginx`
|
|
|
|
Makes sure the `nginx` package is installed from the NGINX repos on the specified hosts.
|
|
Also makes sure a desirable baseline of NGINX configs is deployed on the specified hosts.
|
|
For the NGINX site configurations the config template below can be used.
|
|
|
|
## Entry Points
|
|
|
|
The entry points available for external use are:
|
|
|
|
- `main`
|
|
|
|
## Supported Distributions
|
|
|
|
The following distributions are supported:
|
|
|
|
- Debian 11
|
|
|
|
## Required Arguments
|
|
|
|
For the required arguments look at the [`argument_specs.yaml`](./meta/argument_specs.yaml).
|
|
|
|
## Updates
|
|
|
|
This role updates NGINX to the latest version covered by the provided version spec., if needed.
|
|
|
|
## `hosts`
|
|
|
|
The `hosts` for this role need to be the machines, for which you want to make sure the `nginx` package is installed from the NGINX repos and a desirable baseline of NGINX configs is deployed.
|
|
|
|
## Config Template
|
|
|
|
Here's a config template, which can be used for new NGINX site configs, which you can supply to this role using the `nginx__configurations` argument.
|
|
Just replace the placeholder values with real ones and extend and edit it as needed.
|
|
|
|
```
|
|
# partly generated 2022-01-08, Mozilla Guideline v5.6, nginx 1.17.7, OpenSSL 1.1.1k, intermediate configuration
|
|
# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
|
|
server {
|
|
listen 443 ssl http2;
|
|
#listen [::]:443 ssl http2;
|
|
server_name replace_me;
|
|
|
|
ssl_certificate /path/to/signed_cert_plus_intermediates;
|
|
ssl_certificate_key /path/to/private_key;
|
|
# verify chain of trust of OCSP response using Root CA and Intermediate certs
|
|
ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;
|
|
|
|
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
|
|
add_header Strict-Transport-Security "max-age=63072000" always;
|
|
|
|
# replace with the IP address of your resolver
|
|
resolver 127.0.0.1;
|
|
}
|
|
```
|