Sebastian Gumprich
bb588bd777
* linting Signed-off-by: Sebastian Gumprich <[email protected]> * more linting Signed-off-by: Sebastian Gumprich <[email protected]> * change line length issues Signed-off-by: Sebastian Gumprich <[email protected]> * replace yes with true in tasks Signed-off-by: Sebastian Gumprich <[email protected]> * use manual line-wrapping because ansible-lint does not support it correctly. see https://github.com/ansible/ansible-lint/issues/2522 * use manual line-wrapping because ansible-lint does not support it correctly. see https://github.com/ansible/ansible-lint/issues/2522 Signed-off-by: Sebastian Gumprich <[email protected]> * use manual line-wrapping because ansible-lint does not support it correctly. see https://github.com/ansible/ansible-lint/issues/2522 Signed-off-by: Sebastian Gumprich <[email protected]> * add exception for task Signed-off-by: Sebastian Gumprich <[email protected]> * remove trailing whitespace * add back deleted params Signed-off-by: Sebastian Gumprich <[email protected]> * add back deleted params Signed-off-by: Sebastian Gumprich <[email protected]> * add back tasks Signed-off-by: Sebastian Gumprich <[email protected]>
95 lines
3.0 KiB
YAML
95 lines
3.0 KiB
YAML
---
|
|
- name: Create additional configuration
|
|
ansible.builtin.template:
|
|
src: hardening.conf.j2
|
|
dest: "{{ nginx_configuration_dir }}/conf.d/90.hardening.conf"
|
|
mode: "0600"
|
|
owner: "{{ nginx_owner_user }}"
|
|
group: "{{ nginx_owner_group }}"
|
|
notify: Restart nginx
|
|
|
|
- name: Change configuration in main nginx.conf
|
|
ansible.builtin.lineinfile:
|
|
dest: "{{ nginx_configuration_dir }}/nginx.conf"
|
|
regexp: ^\s*server_tokens
|
|
line: " server_tokens {{ nginx_server_tokens }};"
|
|
insertafter: http {
|
|
mode: "0640"
|
|
owner: "{{ nginx_owner_user }}"
|
|
group: "{{ nginx_owner_group }}"
|
|
notify: Restart nginx
|
|
|
|
- name: Change ssl_protocols in main nginx.conf
|
|
ansible.builtin.lineinfile:
|
|
dest: "{{ nginx_configuration_dir }}/nginx.conf"
|
|
regexp: ^\s*ssl_protocols
|
|
line: " ssl_protocols {{ nginx_ssl_protocols }};"
|
|
insertafter: http {
|
|
mode: "0640"
|
|
owner: "{{ nginx_owner_user }}"
|
|
group: "{{ nginx_owner_group }}"
|
|
notify: Restart nginx
|
|
|
|
- name: Change ssl_prefer_server_ciphers in main nginx.conf
|
|
ansible.builtin.lineinfile:
|
|
dest: "{{ nginx_configuration_dir }}/nginx.conf"
|
|
regexp: ^\s*ssl_prefer_server_ciphers
|
|
line: " ssl_prefer_server_ciphers {{ nginx_ssl_prefer_server_ciphers }};"
|
|
insertafter: http {
|
|
mode: "0640"
|
|
owner: "{{ nginx_owner_user }}"
|
|
group: "{{ nginx_owner_group }}"
|
|
notify: Restart nginx
|
|
|
|
- name: Change client_max_body_size in main nginx.conf
|
|
ansible.builtin.lineinfile:
|
|
dest: "{{ nginx_configuration_dir }}/nginx.conf"
|
|
regexp: ^\s*client_max_body_size
|
|
line: " client_max_body_size {{ nginx_client_max_body_size }};"
|
|
insertafter: http {
|
|
mode: "0640"
|
|
owner: "{{ nginx_owner_user }}"
|
|
group: "{{ nginx_owner_group }}"
|
|
notify: Restart nginx
|
|
|
|
- name: Change client_body_buffer_size in main nginx.conf
|
|
ansible.builtin.lineinfile:
|
|
dest: "{{ nginx_configuration_dir }}/nginx.conf"
|
|
regexp: ^\s*client_body_buffer_size
|
|
line: " client_body_buffer_size {{ nginx_client_body_buffer_size }};"
|
|
insertafter: http {
|
|
mode: "0640"
|
|
owner: "{{ nginx_owner_user }}"
|
|
group: "{{ nginx_owner_group }}"
|
|
notify: Restart nginx
|
|
|
|
- name: Change keepalive_timeout in main nginx.conf
|
|
ansible.builtin.lineinfile:
|
|
dest: "{{ nginx_configuration_dir }}/nginx.conf"
|
|
regexp: ^\s*keepalive_timeout
|
|
line: " keepalive_timeout {{ nginx_keepalive_timeout }};"
|
|
insertafter: http {
|
|
mode: "0640"
|
|
owner: "{{ nginx_owner_user }}"
|
|
group: "{{ nginx_owner_group }}"
|
|
notify: Restart nginx
|
|
|
|
- name: Remove default.conf
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: absent
|
|
when: nginx_remove_default_site
|
|
notify: Restart nginx
|
|
loop:
|
|
- "{{ nginx_configuration_dir }}/conf.d/default.conf"
|
|
- "{{ nginx_configuration_dir }}/sites-enabled/default"
|
|
|
|
- name: Generate dh group
|
|
community.crypto.openssl_dhparam:
|
|
path: "{{ nginx_configuration_dir }}/dh{{ nginx_dh_size }}.pem"
|
|
size: "{{ nginx_dh_size }}"
|
|
mode: "0640"
|
|
owner: "{{ nginx_owner_user }}"
|
|
group: "{{ nginx_owner_group }}"
|
|
notify: Restart nginx
|