---
argument_specs:
  main:
    short_description: The main entry point for the nginx hardening role.
    version_added: 8.8.0
    options:
      nginx_client_body_buffer_size:
        default: 1k
        type: str
        description: Sets buffer size for reading client request body. In case the
          request body is larger than the buffer, the whole body or only its part
          is written to a temporary file. See [nginx_client_body_buffer_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size)
      nginx_remove_default_site:
        default: true
        type: bool
        description: Disables the default site. Set to false to enable the default
          site in nginx.
      nginx_client_max_body_size:
        default: 1k
        type: str
        description: Sets the maximum allowed size of the client request body, specified
          in the "Content-Length" request header field. If the size in a request exceeds
          the configured value, the 413 (Request Entity Too Large) error is returned
          to the client. See [nginx_client_max_body_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size)
      nginx_keepalive_timeout:
        default: 5 5
        type: str
        description: The first parameter sets a timeout during which a keep-alive
          client connection will stay open on the server side. The zero value disables
          keep-alive client connections. The optional second parameter sets a value
          in the "Keep-Alive timeout=time" response header field. See [nginx_keepalive_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout)  # noqa yaml[line-length]
      nginx_server_tokens:
        default: 'off'
        type: str
        description: Disables emitting nginx version in error messages and in the
          "Server" response header field. Set to on to enable the nginx version in
          error messages and "Server" response header. See [nginx_server_tokens](http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens)
      nginx_client_header_buffer_size:
        default: 1k
        type: str
        description: Sets buffer size for reading client request header. For most
          requests, a buffer of 1K bytes is enough. See [nginx_client_header_buffer_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client
      nginx_large_client_header_buffers:
        default: 2 1k
        type: str
        description: Sets the maximum number and size of buffers used for reading
          large client request header. See [nginx_large_client_header_buffers](http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers)  # noqa yaml[line-length]
      nginx_client_body_timeout:
        default: 10
        type: int
        description: Defines a timeout for reading client request body. See [nginx_client_body_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_timeout)  # noqa yaml[line-length]
      nginx_client_header_timeout:
        default: 10
        type: int
        description: Defines a timeout for reading client request header. See [nginx_client_header_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_timeout)  # noqa yaml[line-length]
      nginx_send_timeout:
        default: 10
        type: int
        description: Sets a timeout for transmitting a response to the client. See
          [nginx_send_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#send_timeout)
      nginx_limit_conn_zone:
        default: $binary_remote_addr zone=default:10m
        type: str
        description: Sets parameters for a shared memory zone that will keep states
          for various keys. See [nginx_limit_conn_zone](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn_zone)
      nginx_limit_conn:
        default: default 5
        type: str
        description: Sets the shared memory zone and the maximum allowed number of
          connections for a given key value. See [nginx_limit_conn](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn)
      nginx_add_header:
        default: [X-Frame-Options SAMEORIGIN, X-Content-Type-Options nosniff, X-XSS-Protection
              "1; mode=block", Content-Security-Policy \"script-src 'self'; object-src
              'self'\"]
        type: list
        description: Adds the specified field to a response header provided that the
          response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307. See
          [nginx_add_header](http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header)
      nginx_ssl_protocols:
        default: TLSv1.2
        type: str
        description: Specifies the SSL protocol which should be used. See [nginx_ssl_protocols](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols)  # noqa yaml[line-length]
      nginx_ssl_ciphers:
        default: ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256  # noqa yaml[line-length]
        type: str
        description: Specifies the TLS ciphers which should be used. See [nginx_ssl_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers)
      nginx_ssl_prefer_server_ciphers:
        default: 'on'
        type: str
        description: Specifies that server ciphers should be preferred over client
          ciphers when using the TLS protocols. Set to false to disable it. See [nginx_ssl_prefer_server_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers)  # noqa yaml[line-length]
      nginx_dh_size:
        default: 2048
        type: int
        description: Specifies the length of DH parameters for EDH ciphers. See [nginx_dh_size](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam)  # noqa yaml[line-length]
      nginx_configuration_dir:
        default: /etc/nginx
        type: str
        description: The main location for all nginx configuration files
      nginx_configuration_hardening_dir:
        default: /etc/nginx
        type: str
        description: The location for the nginx hardening configuration file (Could
          be different e.g. when used in jails)
      nginx_owner_user:
        default: root
        type: str
        description: The owner user of the nginx configuration files
      nginx_owner_group:
        default: root
        type: str
        description: The owner group of the nginx configuration files