113 lines
6.6 KiB
YAML
113 lines
6.6 KiB
YAML
---
|
|
argument_specs:
|
|
main:
|
|
short_description: The main entry point for the nginx hardening role.
|
|
version_added: 8.8.0
|
|
options:
|
|
nginx_client_body_buffer_size:
|
|
default: 1k
|
|
type: str
|
|
description: Sets buffer size for reading client request body. In case the
|
|
request body is larger than the buffer, the whole body or only its part
|
|
is written to a temporary file. See [nginx_client_body_buffer_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size)
|
|
nginx_remove_default_site:
|
|
default: true
|
|
type: bool
|
|
description: Disables the default site. Set to false to enable the default
|
|
site in nginx.
|
|
nginx_client_max_body_size:
|
|
default: 1k
|
|
type: str
|
|
description: Sets the maximum allowed size of the client request body, specified
|
|
in the "Content-Length" request header field. If the size in a request exceeds
|
|
the configured value, the 413 (Request Entity Too Large) error is returned
|
|
to the client. See [nginx_client_max_body_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size)
|
|
nginx_keepalive_timeout:
|
|
default: 5 5
|
|
type: str
|
|
description: The first parameter sets a timeout during which a keep-alive
|
|
client connection will stay open on the server side. The zero value disables
|
|
keep-alive client connections. The optional second parameter sets a value
|
|
in the "Keep-Alive timeout=time" response header field. See [nginx_keepalive_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout) # noqa yaml[line-length]
|
|
nginx_server_tokens:
|
|
default: 'off'
|
|
type: str
|
|
description: Disables emitting nginx version in error messages and in the
|
|
"Server" response header field. Set to on to enable the nginx version in
|
|
error messages and "Server" response header. See [nginx_server_tokens](http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens)
|
|
nginx_client_header_buffer_size:
|
|
default: 1k
|
|
type: str
|
|
description: Sets buffer size for reading client request header. For most
|
|
requests, a buffer of 1K bytes is enough. See [nginx_client_header_buffer_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client
|
|
nginx_large_client_header_buffers:
|
|
default: 2 1k
|
|
type: str
|
|
description: Sets the maximum number and size of buffers used for reading
|
|
large client request header. See [nginx_large_client_header_buffers](http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers) # noqa yaml[line-length]
|
|
nginx_client_body_timeout:
|
|
default: 10
|
|
type: int
|
|
description: Defines a timeout for reading client request body. See [nginx_client_body_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_timeout) # noqa yaml[line-length]
|
|
nginx_client_header_timeout:
|
|
default: 10
|
|
type: int
|
|
description: Defines a timeout for reading client request header. See [nginx_client_header_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_timeout) # noqa yaml[line-length]
|
|
nginx_send_timeout:
|
|
default: 10
|
|
type: int
|
|
description: Sets a timeout for transmitting a response to the client. See
|
|
[nginx_send_timeout](http://nginx.org/en/docs/http/ngx_http_core_module.html#send_timeout)
|
|
nginx_limit_conn_zone:
|
|
default: $binary_remote_addr zone=default:10m
|
|
type: str
|
|
description: Sets parameters for a shared memory zone that will keep states
|
|
for various keys. See [nginx_limit_conn_zone](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn_zone)
|
|
nginx_limit_conn:
|
|
default: default 5
|
|
type: str
|
|
description: Sets the shared memory zone and the maximum allowed number of
|
|
connections for a given key value. See [nginx_limit_conn](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn)
|
|
nginx_add_header:
|
|
default: [X-Frame-Options SAMEORIGIN, X-Content-Type-Options nosniff, X-XSS-Protection
|
|
"1; mode=block", Content-Security-Policy \"script-src 'self'; object-src
|
|
'self'\"]
|
|
type: list
|
|
description: Adds the specified field to a response header provided that the
|
|
response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307. See
|
|
[nginx_add_header](http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header)
|
|
nginx_ssl_protocols:
|
|
default: TLSv1.2
|
|
type: str
|
|
description: Specifies the SSL protocol which should be used. See [nginx_ssl_protocols](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols) # noqa yaml[line-length]
|
|
nginx_ssl_ciphers:
|
|
default: ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 # noqa yaml[line-length]
|
|
type: str
|
|
description: Specifies the TLS ciphers which should be used. See [nginx_ssl_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers)
|
|
nginx_ssl_prefer_server_ciphers:
|
|
default: 'on'
|
|
type: str
|
|
description: Specifies that server ciphers should be preferred over client
|
|
ciphers when using the TLS protocols. Set to false to disable it. See [nginx_ssl_prefer_server_ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers) # noqa yaml[line-length]
|
|
nginx_dh_size:
|
|
default: 2048
|
|
type: int
|
|
description: Specifies the length of DH parameters for EDH ciphers. See [nginx_dh_size](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam) # noqa yaml[line-length]
|
|
nginx_configuration_dir:
|
|
default: /etc/nginx
|
|
type: str
|
|
description: The main location for all nginx configuration files
|
|
nginx_configuration_hardening_dir:
|
|
default: /etc/nginx
|
|
type: str
|
|
description: The location for the nginx hardening configuration file (Could
|
|
be different e.g. when used in jails)
|
|
nginx_owner_user:
|
|
default: root
|
|
type: str
|
|
description: The owner user of the nginx configuration files
|
|
nginx_owner_group:
|
|
default: root
|
|
type: str
|
|
description: The owner group of the nginx configuration files
|