feat (role): adds nginx installation role, tests are required

Reviewed-on: #6

README.md

@@ -1,3 +1,20 @@
 # ansible_home
 
-My own home services automation repository
+## How to use it?
+
+It's better to use a virtual environment to avoid incompatibility issues
+
+```bash
+git clone https://git.vmn.su/max/vmn-ansible
+cd vmn-ansible
+python3 -m venv .venv
+source .venv/bin/activate
+pip install -r requirements.txt
+ansible-galaxy collection install -r requirements.yaml
+ansible-galaxy role install -r requirements.yaml
+ansible-playbook playbooks/deploy_and_set_up_lxc_on_proxmox.yaml --vault-pass-file $VAULT_PASS_PATH -i inventory/localhost.yaml --private-key $SSH_KEY
+```
+
+**deploy** playbooks must be used with `inventory/localhost.yaml`, they need access to proxmox host only
+
+There are also a systemd service and timer under `systemd` directory

inventory/group_vars/all/main.yaml

@@ -2,3 +2,4 @@
 
 ansible_become_passwd: "{{ ansible_password }}"
 human_admin_user: max
+proxmox_1_host: 192.168.0.2

inventory/hosts.yaml

@@ -1,17 +1,41 @@
 ---
-physical:
+all:
+  children:
+    physical:
+      proxmox_1:
+        ansible_host: "{{ proxmox_1_host }}"
+        ansible_become_password: "{{ ansible_become_passwd }}"
+        services_to_run: []
+    virtual:
       hosts:
         localhost:
           ansible_become_password: "{{ ansible_become_passwd }}"
           ansible_connection: local
           ansible_python_interpreter: "{{ ansible_playbook_python }}"
-    192.168.0.6:
+          services_to_run:
+            - webhook 
+        nfs-server:
+          ansible_host: 192.168.0.6
           ansible_become_password: "{{ ansible_become_passwd }}"
-    192.168.0.8:
+          services_to_run: []
+        jellyfin:
+          ansible_host: 192.168.0.8
           ansible_become_password: "{{ ansible_become_passwd }}"
-    192.168.0.12:
+          services_to_run: []
+        frigate:
+          ansible_host: 192.168.0.12
           ansible_become_password: "{{ ansible_become_passwd }}"
-    192.168.0.16:
+          services_to_run: []
+        vs-code:
+          ansible_host: 192.168.0.16
           ansible_become_password: "{{ ansible_become_passwd }}"
-    192.168.0.39:
+          services_to_run: []
+        gitea-server:
+          ansible_host: 192.168.0.39
           ansible_become_password: "{{ ansible_become_passwd }}"
+          services_to_run: []
+        ai-host:
+          ansible_host: 192.168.0.50
+          ansible_become_password: "{{ ansible_become_passwd }}"
+          services_to_run:
+            - coder_ai

playbooks/deploy_and_set_up_lxc_on_proxmox.yaml

@@ -25,6 +25,10 @@
       prompt: "IP address for the container (in x.x.x.x/x formant)"
       private: false
 
+    - name: lxc_is_privileged
+      prompt: "Unprivileged LXC (true/false)?"
+      private: false
+
   pre_tasks:
     - name: Validate hostname
       ansible.builtin.fail:

playbooks/maintain.yaml

@@ -1,6 +1,6 @@
 ---
 - name: Deploy and set up an LXC container in Proxmox
-  hosts: all
+  hosts: virtual
   remote_user: ansible
   
   vars_files:
@@ -18,3 +18,5 @@
     - ../roles/harden_ssh
     # Update configs - omz, nvim, ranger and so on. Distribute the last version of those configs
     - ../roles/update_configs
+    # Make sure that the services that are supposed to run are running
+    - ../roles/check_services

roles/check_services/tasks/main.yaml

@@ -0,0 +1,7 @@
+---
+
+- name: Make sure required services are running
+  ansible.builtin.service:
+    name: "{{ item }}"
+    state: started
+  loop: "{{ services_to_run }}"

roles/common_healthcheck/tasks/main.yaml

@@ -23,8 +23,8 @@
       become: false
       # We have to use this complicated pipeline because of Alpine and its wierd df implementation
       ansible.builtin.shell: set -o pipefail && df -h / | tail -1 | awk '{gsub(/%/, "", $5); print $5}'
-      register: free_disk_space_result
-      failed_when: free_disk_space_result.stdout | int > 85
+      register: common_healthcheck_space_left_result
+      failed_when: common_healthcheck_space_left_result.stdout | int > 85
       changed_when: false   # This task does not change the system
 
   rescue:
@@ -41,5 +41,9 @@
         body:
           - "{{ ansible_facts['hostname'] }}: Disk space is low"
       delegate_to: 127.0.0.1
-      failed_when: false
+      failed_when: false    # It's OK if it fails, not critical
       changed_when: false   # This task does not change the system
+
+    - name: Resize rootfs if it's an LXC
+      ansible.builtin.include_tasks: resize_lxc_rootfs.yaml
+      when: ansible_virtualization_type == 'lxc'

roles/common_healthcheck/tasks/resize_lxc_rootfs.yaml

@@ -0,0 +1,24 @@
+---
+- name: Get container info by name
+  delegate_to: localhost
+  become: false
+  community.general.proxmox_vm_info:
+    validate_certs: false
+    node: proxmox-server
+    api_user: root@pam
+    api_host: 192.168.0.2
+    api_token_id: ansible
+    api_token_secret: "{{ proxmox_token_secret }}"
+
+    name: "{{ inventory_hostname }}"
+    type: lxc
+  register: common_healthcheck_vmid
+
+- name: Resize LXC's rootfs
+  become: true
+  ansible.builtin.command:
+    cmd: pct resize {{ common_healthcheck_vmid.proxmox_vms[0].vmid }} rootfs +5G
+  delegate_to: 192.168.0.2
+  changed_when: true
+  vars:
+    ansible_become_password: "{{ ansible_become_passwd  }}"

roles/deploy_lxc_on_proxmox/tasks/main.yaml

@@ -6,7 +6,7 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
 
@@ -14,6 +14,7 @@
     password: "{{ lxc_root_password }}"
     hostname: "{{ lxc_hostname }}"
     ostemplate: 'main:vztmpl/debian-13-golden-image.tar.gz'
+    unprivileged: "{{ lxc_is_privileged }}"
     memory: 2048
     cores: 2
     state: present
@@ -33,7 +34,7 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
 

roles/deploy_vm_on_proxmox/tasks/create_vm.yaml

@@ -6,7 +6,7 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
 
@@ -29,7 +29,7 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
 
@@ -49,7 +49,7 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
 
@@ -64,10 +64,9 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
 
     name: "{{ vm_hostname }}"
     state: started
-

roles/deploy_vm_on_proxmox/tasks/main.yaml

@@ -5,7 +5,7 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
     

roles/deploy_vm_on_proxmox/tasks/start_vm.yaml

@@ -6,7 +6,7 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
 
@@ -19,4 +19,3 @@
     timeout: 120
   delegate_to: localhost
   changed_when: false
-

roles/human_admin_user/files/ssh_config

@@ -0,0 +1,15 @@
+# PUT NEW BLOCKS STRICTLY BEFORE ANY MATCH BLOCK
+
+
+# Private keys are NOT distributed via Ansible
+# They must to be copied manually ONLY to those hosts that need access to others
+
+# Most of the home major LAN hosts should be accessible with this key
+Match Host 192.168.0.?
+     User     max
+     IdentityFile       ~/.ssh/max_regular_key
+
+# This virtual network has the same hosts range
+Match Host 10.9.2.?
+     User     max
+     IdentityFile       ~/.ssh/max_regular_key

roles/human_admin_user/tasks/main.yaml

@@ -48,6 +48,15 @@
     group: "{{ human_admin_user }}"
     mode: u=rw,g=r,o-rwx
 
+- name: Configure ssh client, by pushing the config
+  remote_user: ansible
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/ssh_config"
+    dest: "/home/{{ human_admin_user }}/.ssh/config"
+    owner: "{{ human_admin_user }}"
+    group: "{{ human_admin_user }}"
+    mode: u=rw,g=r,o-rwx
+
 
 # WARNING: we've finished with the initial setup, drop ansible key
 # Push regular user key

roles/install_nginx/files/nginx/.htpasswd

@@ -0,0 +1 @@
+max:$apr1$NPIFdkB/$hya7NW2rdTGEKBDm0PH3g0

roles/install_nginx/files/nginx/.htpasswd_old

@@ -0,0 +1 @@
+max:$apr1$/3oBTCwW$u9OMKSD56v8czs5rZ0rDp0

roles/install_nginx/files/nginx/fastcgi.conf

@@ -0,0 +1,27 @@
+
+fastcgi_param  SCRIPT_FILENAME    $document_root$fastcgi_script_name;
+fastcgi_param  QUERY_STRING       $query_string;
+fastcgi_param  REQUEST_METHOD     $request_method;
+fastcgi_param  CONTENT_TYPE       $content_type;
+fastcgi_param  CONTENT_LENGTH     $content_length;
+
+fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
+fastcgi_param  REQUEST_URI        $request_uri;
+fastcgi_param  DOCUMENT_URI       $document_uri;
+fastcgi_param  DOCUMENT_ROOT      $document_root;
+fastcgi_param  SERVER_PROTOCOL    $server_protocol;
+fastcgi_param  REQUEST_SCHEME     $scheme;
+fastcgi_param  HTTPS              $https if_not_empty;
+
+fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
+fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;
+
+fastcgi_param  REMOTE_ADDR        $remote_addr;
+fastcgi_param  REMOTE_PORT        $remote_port;
+fastcgi_param  REMOTE_USER        $remote_user;
+fastcgi_param  SERVER_ADDR        $server_addr;
+fastcgi_param  SERVER_PORT        $server_port;
+fastcgi_param  SERVER_NAME        $server_name;
+
+# PHP only, required if PHP was built with --enable-force-cgi-redirect
+fastcgi_param  REDIRECT_STATUS    200;

roles/install_nginx/files/nginx/fastcgi_params

@@ -0,0 +1,57 @@
+
+fastcgi_param  QUERY_STRING       $query_string;
+fastcgi_param  REQUEST_METHOD     $request_method;
+fastcgi_param  CONTENT_TYPE       $content_type;
+fastcgi_param  CONTENT_LENGTH     $content_length;
+
+fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
+fastcgi_param  REQUEST_URI        $request_uri;
+fastcgi_param  DOCUMENT_URI       $document_uri;
+fastcgi_param  DOCUMENT_ROOT      $document_root;
+fastcgi_param  SERVER_PROTOCOL    $server_protocol;
+fastcgi_param  REQUEST_SCHEME     $scheme;
+fastcgi_param  HTTPS              $https if_not_empty;
+
+fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
+fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;
+
+fastcgi_param  REMOTE_ADDR        $remote_addr;
+fastcgi_param  REMOTE_PORT        $remote_port;
+fastcgi_param  REMOTE_USER        $remote_user;
+fastcgi_param  SERVER_ADDR        $server_addr;
+fastcgi_param  SERVER_PORT        $server_port;
+fastcgi_param  SERVER_NAME        $server_name;
+
+# PHP only, required if PHP was built with --enable-force-cgi-redirect
+fastcgi_param  REDIRECT_STATUS    200;
+
+# !!! Security workaround !!!
+# Do not use HTTP_HOST as "$http_host".
+#
+# "$http_host" is the Host header exactly as supplied by the client.
+# This is unsafe when a client sends an absolute-form request target together
+# with a different Host header, for example:
+#
+#     GET https://example.com/ HTTP/1.1
+#     Host: malformedhost
+#
+# In such a case, passing "$http_host" upstream exposes the raw client-supplied
+# Host value ("malformedhost") to the backend application, even though it does
+# not match the effective request target. Applications often use HTTP_HOST for
+# redirects, absolute URL generation, virtual host routing, or security checks;
+# forwarding the raw Host header can therefore lead to incorrect or unsafe
+# behaviour.
+#
+# Newer nginx versions (since 1.30.0) introduce variables "$is_request_port" and
+# "$request_port", allowing HTTP_HOST to be constructed as:
+#     $host$is_request_port$request_port
+#
+# In stable/oldstable packages we use "$host" as a security workaround.
+# It avoids forwarding an untrusted raw Host header to the backend.
+#
+# Note: this changes behaviour compared to previous versions, because "$host"
+# does not preserve the client-supplied port, while "$http_host" typically
+# does. Existing deployments that rely on "$http_host" containing a port number
+# may therefore break or behave differently after this change.
+
+fastcgi_param  HTTP_HOST        $host;

roles/install_nginx/files/nginx/mime.types

@@ -0,0 +1,101 @@
+types {
+    text/html                                        html htm shtml;
+    text/css                                         css;
+    text/xml                                         xml;
+    image/gif                                        gif;
+    image/jpeg                                       jpeg jpg;
+    application/javascript                           js;
+    application/atom+xml                             atom;
+    application/rss+xml                              rss;
+
+    text/mathml                                      mml;
+    text/plain                                       txt;
+    text/vnd.sun.j2me.app-descriptor                 jad;
+    text/vnd.wap.wml                                 wml;
+    text/x-component                                 htc;
+
+    image/avif                                       avif;
+    image/png                                        png;
+    image/svg+xml                                    svg svgz;
+    image/tiff                                       tif tiff;
+    image/vnd.wap.wbmp                               wbmp;
+    image/webp                                       webp;
+    image/x-icon                                     ico;
+    image/x-jng                                      jng;
+    image/x-ms-bmp                                   bmp;
+
+    font/woff                                        woff;
+    font/woff2                                       woff2;
+
+    application/java-archive                         jar war ear;
+    application/json                                 json;
+    application/mac-binhex40                         hqx;
+    application/msword                               doc;
+    application/pdf                                  pdf;
+    application/postscript                           ps eps ai;
+    application/rtf                                  rtf;
+    application/vnd.apple.mpegurl                    m3u8;
+    application/vnd.google-earth.kml+xml             kml;
+    application/vnd.google-earth.kmz                 kmz;
+    application/vnd.ms-excel                         xls;
+    application/vnd.ms-fontobject                    eot;
+    application/vnd.ms-powerpoint                    ppt;
+    application/vnd.oasis.opendocument.graphics      odg;
+    application/vnd.oasis.opendocument.presentation  odp;
+    application/vnd.oasis.opendocument.spreadsheet   ods;
+    application/vnd.oasis.opendocument.text          odt;
+    application/vnd.openxmlformats-officedocument.presentationml.presentation
+                                                     pptx;
+    application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
+                                                     xlsx;
+    application/vnd.openxmlformats-officedocument.wordprocessingml.document
+                                                     docx;
+    application/vnd.wap.wmlc                         wmlc;
+    application/wasm                                 wasm;
+    application/x-7z-compressed                      7z;
+    application/x-cocoa                              cco;
+    application/x-java-archive-diff                  jardiff;
+    application/x-java-jnlp-file                     jnlp;
+    application/x-makeself                           run;
+    application/x-perl                               pl pm;
+    application/x-pilot                              prc pdb;
+    application/x-rar-compressed                     rar;
+    application/x-redhat-package-manager             rpm;
+    application/x-sea                                sea;
+    application/x-shockwave-flash                    swf;
+    application/x-stuffit                            sit;
+    application/x-tcl                                tcl tk;
+    application/x-x509-ca-cert                       der pem crt;
+    application/x-xpinstall                          xpi;
+    application/xhtml+xml                            xhtml;
+    application/xslt+xml                             xsl xslt;
+    application/xspf+xml                             xspf;
+    application/zip                                  zip;
+
+    application/octet-stream                         bin exe dll;
+    application/octet-stream                         deb;
+    application/octet-stream                         dmg;
+    application/octet-stream                         iso img;
+    application/octet-stream                         msi msp msm;
+
+    audio/midi                                       mid midi kar;
+    audio/mpeg                                       mp3;
+    audio/ogg                                        ogg;
+    audio/x-m4a                                      m4a;
+    audio/x-realaudio                                ra;
+
+    video/3gpp                                       3gpp 3gp;
+    video/mp2t                                       ts;
+    video/mp4                                        mp4;
+    video/mpeg                                       mpeg mpg;
+    video/ogg                                        ogv;
+    video/quicktime                                  mov;
+    video/webm                                       webm;
+    video/x-flv                                      flv;
+    video/x-m4v                                      m4v;
+    video/x-matroska                                 mkv;
+    video/x-mng                                      mng;
+    video/x-ms-asf                                   asx asf;
+    video/x-ms-wmv                                   wmv;
+    video/x-msvideo                                  avi;
+}

roles/install_nginx/files/nginx/modules-enabled/50-mod-http-auth-pam.conf

@@ -0,0 +1 @@
+/usr/share/nginx/modules-available/mod-http-auth-pam.conf

roles/install_nginx/files/nginx/modules-enabled/50-mod-http-dav-ext.conf

@@ -0,0 +1 @@
+/usr/share/nginx/modules-available/mod-http-dav-ext.conf

roles/install_nginx/files/nginx/modules-enabled/50-mod-http-echo.conf

@@ -0,0 +1 @@
+/usr/share/nginx/modules-available/mod-http-echo.conf

roles/install_nginx/files/nginx/modules-enabled/50-mod-http-geoip2.conf

@@ -0,0 +1 @@
+/usr/share/nginx/modules-available/mod-http-geoip2.conf

roles/install_nginx/files/nginx/modules-enabled/50-mod-http-subs-filter.conf

@@ -0,0 +1 @@
+/usr/share/nginx/modules-available/mod-http-subs-filter.conf

roles/install_nginx/files/nginx/modules-enabled/50-mod-http-upstream-fair.conf

@@ -0,0 +1 @@
+/usr/share/nginx/modules-available/mod-http-upstream-fair.conf

roles/install_nginx/files/nginx/modules-enabled/50-mod-stream.conf

@@ -0,0 +1 @@
+/usr/share/nginx/modules-available/mod-stream.conf

roles/install_nginx/files/nginx/modules-enabled/70-mod-stream-geoip2.conf

@@ -0,0 +1 @@
+/usr/share/nginx/modules-available/mod-stream-geoip2.conf

roles/install_nginx/files/nginx/nginx.conf

@@ -0,0 +1,24 @@
+user www-data;
+worker_processes auto;
+pid /run/nginx.pid;
+error_log /var/log/nginx/error.log;
+include /etc/nginx/modules-enabled/*.conf;
+
+
+events {
+	worker_connections 768;
+}
+
+http {
+  log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+                        '$status $body_bytes_sent "$http_referer" '
+                        '"$http_user_agent"';
+  include /etc/nginx/conf.d/*.conf;
+  
+  # Hide NGINX version from responses
+  server_tokens off;
+  # Use modern TLS protocols only
+  ssl_protocols TLSv1.2 TLSv1.3;
+  ssl_prefer_server_ciphers on;
+  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
+}

roles/install_nginx/files/nginx/proxy_params

@@ -0,0 +1,33 @@
+# !!! Security workaround !!!
+# Do not set the `Host` header as "$http_host".
+#
+# "$http_host" is the Host header exactly as supplied by the client.
+# This is unsafe when a client sends an absolute-form request target together
+# with a different Host header, for example:
+#
+#     GET https://example.com/ HTTP/1.1
+#     Host: malformedhost
+#
+# In such a case, passing "$http_host" upstream exposes the raw client-supplied
+# Host value ("malformedhost") to the backend application, even though it does
+# not match the effective request target. Applications often use HTTP_HOST for
+# redirects, absolute URL generation, virtual host routing, or security checks;
+# forwarding the raw Host header can therefore lead to incorrect or unsafe
+# behaviour.
+#
+# Newer nginx versions (since 1.30.0) introduce variables "$is_request_port" and
+# "$request_port", allowing `Host` to be constructed as:
+#     $host$is_request_port$request_port
+#
+# In stable/oldstable packages we use "$host" as a security workaround.
+# It avoids forwarding an untrusted raw Host header to the backend.
+#
+# Note: this changes behaviour compared to previous versions, because "$host"
+# does not preserve the client-supplied port, while "$http_host" typically
+# does. Existing deployments that rely on "$http_host" containing a port number
+# may therefore break or behave differently after this change.
+
+proxy_set_header Host $host;
+proxy_set_header X-Real-IP $remote_addr;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $scheme;

roles/install_nginx/files/nginx/snippets/error_pages.conf

@@ -0,0 +1 @@
+/srv/http/default/snippets/error_pages.conf

roles/install_nginx/files/nginx/snippets/error_pages_content.conf

@@ -0,0 +1 @@
+/srv/http/default/snippets/error_pages_content.conf

roles/install_nginx/files/nginx/snippets/fastcgi-php.conf

@@ -0,0 +1,13 @@
+# regex to split $uri to $fastcgi_script_name and $fastcgi_path
+fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+
+# Check that the PHP script exists before passing it
+try_files $fastcgi_script_name =404;
+
+# Bypass the fact that try_files resets $fastcgi_path_info
+# see: http://trac.nginx.org/nginx/ticket/321
+set $path_info $fastcgi_path_info;
+fastcgi_param PATH_INFO $path_info;
+
+fastcgi_index index.php;
+include fastcgi.conf;

roles/install_nginx/tasks/main.yaml

@@ -0,0 +1,30 @@
+---
+
+- name: Install NGINX on apt-based systems
+  become: true
+  ansible.builtin.apt:
+    name: nginx
+    state: present
+    update_cache: true
+
+- name: Enable systemd service
+  ansible.builtin.service:
+    name: nginx
+    state: started
+    enabled: true
+
+# We don't want to activate this config right away, so push it after service started
+- name: Configure NGINX, by pushing the config directory
+  become: true
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/nginx"
+    dst: "/etc/nginx"
+
+- name: Install custom error pages
+  become: true
+  ansible.builtin.shell: |
+    mkdir -p /srv/http/default
+    git clone https://github.com/denysvitali/nginx-error-pages /srv/http/default 
+    ln -s /srv/http/default/snippets/error_pages.conf /etc/nginx/snippets/error_pages.conf
+    ln -s /srv/http/default/snippets/error_pages_content.conf /etc/nginx/snippets/error_pages_content.conf
+