ansible-config/roles/web-server/base/tasks/main.yml
2015-11-14 18:48:41 +01:00

103 lines
2.3 KiB
YAML

---
- name: be sure nginx is installed
apt: name=nginx state=latest
tags: nginx
- name: check ssl directories exist an have correct permissions
file: >
path="{{ item.path }}"
mode="{{ item.mode }}"
state=directory
with_items:
- { path: "/etc/ssl", mode: "0755" }
- { path: "/etc/ssl/certs", mode: "0755" }
- { path: "/etc/ssl/dhparam", mode: "0755" }
- { path: "/etc/ssl/private", mode: "0700" }
tags:
- nginx
- ssl
- name: generate dhparams if those do not exist yet (can take a while)
command: "openssl dhparam -out {{ item }} 2048 creates={{ item }}"
with_items: "{{ web.ssl.values() | map(attribute = 'dhparam') | list }}"
tags:
- nginx
- ssl
- name: check certificates exist and have correct permissions
file: >
path="{{ item }}"
mode="0400"
state=file
with_flattened:
- "{{ web.ssl.values() | map(attribute = 'cert') | list }}"
- "{{ web.ssl.values() | map(attribute = 'key') | list }}"
- "{{ web.ssl.values() | map(attribute = 'dhparam') | list }}"
tags:
- nginx
- ssl
- name: copy includes
copy: >
backup=yes
src=etc/nginx/include
dest=/etc/nginx
mode=0644
owner=root
group=root
notify:
- restart nginx
tags: nginx
- name: copy configs
copy: >
backup=yes
src=etc/nginx/conf.d
dest=/etc/nginx
mode=0644
owner=root
group=root
notify:
- restart nginx
tags: nginx
- name: apply templates
template: >
backup=yes
src="etc/nginx/{{ item }}.j2"
dest="/etc/nginx/{{ item }}"
mode=0644
owner=root
group=root
with_items:
- include/ssl_wildcard.conf
- include/ssl_hamburg_freifunk_net.conf
notify:
- restart nginx
tags: nginx
- name: remove default sites / configs
file: path={{ item }} state=absent
with_items:
- /etc/nginx/conf.d/default.conf_disabled
- /etc/nginx/conf.d/example_ssl.conf_disabled
- /etc/nginx/conf.d/mail.conf
- /etc/nginx/sites-available/default
- /etc/nginx/sites-enabled/default
- /var/www/html
notify:
- restart nginx
tags: nginx
- name: configure nginx
copy: >
backup=yes
src=etc/nginx/nginx.conf
dest=/etc/nginx/nginx.conf
mode=0644
owner=root
group=root
notify:
- restart nginx
tags: nginx