max/vmn-ansible
1
1
Fork 0
Code Issues 9 Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

merge into: max/vmn-ansible:dev
Branches Tags
max/vmn-ansible:main max/vmn-ansible:dev max/vmn-ansible:nginx-role
...
pull from: max/vmn-ansible:nginx-role
Branches Tags
max/vmn-ansible:dev max/vmn-ansible:main max/vmn-ansible:nginx-role

1 Commits
dev ... nginx-role

Author SHA1 Message Date
max 32b6a49bc8 feat (role): adds nginx installation role, tests are required 2026-09-06 19:50:08 +05:00
19 changed files with 297 additions and 0 deletions
Expand all files Collapse all files
roles/install_nginx/files/nginx/.htpasswd
+1
View File
@@ -0,0 +1 @@
max:$apr1$NPIFdkB/$hya7NW2rdTGEKBDm0PH3g0
roles/install_nginx/files/nginx/.htpasswd_old
+1
View File
@@ -0,0 +1 @@
max:$apr1$/3oBTCwW$u9OMKSD56v8czs5rZ0rDp0
roles/install_nginx/files/nginx/fastcgi.conf
+27
View File
@@ -0,0 +1,27 @@
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
fastcgi_param REQUEST_URI $request_uri;
fastcgi_param DOCUMENT_URI $document_uri;
fastcgi_param DOCUMENT_ROOT $document_root;
fastcgi_param SERVER_PROTOCOL $server_protocol;
fastcgi_param REQUEST_SCHEME $scheme;
fastcgi_param HTTPS $https if_not_empty;
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
fastcgi_param REMOTE_ADDR $remote_addr;
fastcgi_param REMOTE_PORT $remote_port;
fastcgi_param REMOTE_USER $remote_user;
fastcgi_param SERVER_ADDR $server_addr;
fastcgi_param SERVER_PORT $server_port;
fastcgi_param SERVER_NAME $server_name;
# PHP only, required if PHP was built with --enable-force-cgi-redirect
fastcgi_param REDIRECT_STATUS 200;
roles/install_nginx/files/nginx/fastcgi_params
+57
View File
@@ -0,0 +1,57 @@
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
fastcgi_param REQUEST_URI $request_uri;
fastcgi_param DOCUMENT_URI $document_uri;
fastcgi_param DOCUMENT_ROOT $document_root;
fastcgi_param SERVER_PROTOCOL $server_protocol;
fastcgi_param REQUEST_SCHEME $scheme;
fastcgi_param HTTPS $https if_not_empty;
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
fastcgi_param REMOTE_ADDR $remote_addr;
fastcgi_param REMOTE_PORT $remote_port;
fastcgi_param REMOTE_USER $remote_user;
fastcgi_param SERVER_ADDR $server_addr;
fastcgi_param SERVER_PORT $server_port;
fastcgi_param SERVER_NAME $server_name;
# PHP only, required if PHP was built with --enable-force-cgi-redirect
fastcgi_param REDIRECT_STATUS 200;
# !!! Security workaround !!!
# Do not use HTTP_HOST as "$http_host".
#
# "$http_host" is the Host header exactly as supplied by the client.
# This is unsafe when a client sends an absolute-form request target together
# with a different Host header, for example:
#
# GET https://example.com/ HTTP/1.1
# Host: malformedhost
#
# In such a case, passing "$http_host" upstream exposes the raw client-supplied
# Host value ("malformedhost") to the backend application, even though it does
# not match the effective request target. Applications often use HTTP_HOST for
# redirects, absolute URL generation, virtual host routing, or security checks;
# forwarding the raw Host header can therefore lead to incorrect or unsafe
# behaviour.
#
# Newer nginx versions (since 1.30.0) introduce variables "$is_request_port" and
# "$request_port", allowing HTTP_HOST to be constructed as:
# $host$is_request_port$request_port
#
# In stable/oldstable packages we use "$host" as a security workaround.
# It avoids forwarding an untrusted raw Host header to the backend.
#
# Note: this changes behaviour compared to previous versions, because "$host"
# does not preserve the client-supplied port, while "$http_host" typically
# does. Existing deployments that rely on "$http_host" containing a port number
# may therefore break or behave differently after this change.
fastcgi_param HTTP_HOST $host;
roles/install_nginx/files/nginx/mime.types
+101
View File
@@ -0,0 +1,101 @@
types {
text/html html htm shtml;
text/css css;
text/xml xml;
image/gif gif;
image/jpeg jpeg jpg;
application/javascript js;
application/atom+xml atom;
application/rss+xml rss;
text/mathml mml;
text/plain txt;
text/vnd.sun.j2me.app-descriptor jad;
text/vnd.wap.wml wml;
text/x-component htc;
image/avif avif;
image/png png;
image/svg+xml svg svgz;
image/tiff tif tiff;
image/vnd.wap.wbmp wbmp;
image/webp webp;
image/x-icon ico;
image/x-jng jng;
image/x-ms-bmp bmp;
font/woff woff;
font/woff2 woff2;
application/java-archive jar war ear;
application/json json;
application/mac-binhex40 hqx;
application/msword doc;
application/pdf pdf;
application/postscript ps eps ai;
application/rtf rtf;
application/vnd.apple.mpegurl m3u8;
application/vnd.google-earth.kml+xml kml;
application/vnd.google-earth.kmz kmz;
application/vnd.ms-excel xls;
application/vnd.ms-fontobject eot;
application/vnd.ms-powerpoint ppt;
application/vnd.oasis.opendocument.graphics odg;
application/vnd.oasis.opendocument.presentation odp;
application/vnd.oasis.opendocument.spreadsheet ods;
application/vnd.oasis.opendocument.text odt;
application/vnd.openxmlformats-officedocument.presentationml.presentation
pptx;
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
xlsx;
application/vnd.openxmlformats-officedocument.wordprocessingml.document
docx;
application/vnd.wap.wmlc wmlc;
application/wasm wasm;
application/x-7z-compressed 7z;
application/x-cocoa cco;
application/x-java-archive-diff jardiff;
application/x-java-jnlp-file jnlp;
application/x-makeself run;
application/x-perl pl pm;
application/x-pilot prc pdb;
application/x-rar-compressed rar;
application/x-redhat-package-manager rpm;
application/x-sea sea;
application/x-shockwave-flash swf;
application/x-stuffit sit;
application/x-tcl tcl tk;
application/x-x509-ca-cert der pem crt;
application/x-xpinstall xpi;
application/xhtml+xml xhtml;
application/xslt+xml xsl xslt;
application/xspf+xml xspf;
application/zip zip;
application/octet-stream bin exe dll;
application/octet-stream deb;
application/octet-stream dmg;
application/octet-stream iso img;
application/octet-stream msi msp msm;
audio/midi mid midi kar;
audio/mpeg mp3;
audio/ogg ogg;
audio/x-m4a m4a;
audio/x-realaudio ra;
video/3gpp 3gpp 3gp;
video/mp2t ts;
video/mp4 mp4;
video/mpeg mpeg mpg;
video/ogg ogv;
video/quicktime mov;
video/webm webm;
video/x-flv flv;
video/x-m4v m4v;
video/x-matroska mkv;
video/x-mng mng;
video/x-ms-asf asx asf;
video/x-ms-wmv wmv;
video/x-msvideo avi;
}
roles/install_nginx/files/nginx/modules-enabled/50-mod-http-auth-pam.conf
Symlink
+1
View File
@@ -0,0 +1 @@
/usr/share/nginx/modules-available/mod-http-auth-pam.conf
roles/install_nginx/files/nginx/modules-enabled/50-mod-http-dav-ext.conf
Symlink
+1
View File
@@ -0,0 +1 @@
/usr/share/nginx/modules-available/mod-http-dav-ext.conf
roles/install_nginx/files/nginx/modules-enabled/50-mod-http-echo.conf
Symlink
+1
View File
@@ -0,0 +1 @@
/usr/share/nginx/modules-available/mod-http-echo.conf
roles/install_nginx/files/nginx/modules-enabled/50-mod-http-geoip2.conf
Symlink
+1
View File
@@ -0,0 +1 @@
/usr/share/nginx/modules-available/mod-http-geoip2.conf
roles/install_nginx/files/nginx/modules-enabled/50-mod-http-subs-filter.conf
Symlink
+1
View File
@@ -0,0 +1 @@
/usr/share/nginx/modules-available/mod-http-subs-filter.conf
roles/install_nginx/files/nginx/modules-enabled/50-mod-http-upstream-fair.conf
Symlink
+1
View File
@@ -0,0 +1 @@
/usr/share/nginx/modules-available/mod-http-upstream-fair.conf
roles/install_nginx/files/nginx/modules-enabled/50-mod-stream.conf
Symlink
+1
View File
@@ -0,0 +1 @@
/usr/share/nginx/modules-available/mod-stream.conf
roles/install_nginx/files/nginx/modules-enabled/70-mod-stream-geoip2.conf
Symlink
+1
View File
@@ -0,0 +1 @@
/usr/share/nginx/modules-available/mod-stream-geoip2.conf
roles/install_nginx/files/nginx/nginx.conf
+24
View File
@@ -0,0 +1,24 @@
user www-data;
worker_processes auto;
pid /run/nginx.pid;
error_log /var/log/nginx/error.log;
include /etc/nginx/modules-enabled/*.conf;
events {
worker_connections 768;
}
http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent"';
include /etc/nginx/conf.d/*.conf;
# Hide NGINX version from responses
server_tokens off;
# Use modern TLS protocols only
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
}
roles/install_nginx/files/nginx/proxy_params
+33
View File
@@ -0,0 +1,33 @@
# !!! Security workaround !!!
# Do not set the `Host` header as "$http_host".
#
# "$http_host" is the Host header exactly as supplied by the client.
# This is unsafe when a client sends an absolute-form request target together
# with a different Host header, for example:
#
# GET https://example.com/ HTTP/1.1
# Host: malformedhost
#
# In such a case, passing "$http_host" upstream exposes the raw client-supplied
# Host value ("malformedhost") to the backend application, even though it does
# not match the effective request target. Applications often use HTTP_HOST for
# redirects, absolute URL generation, virtual host routing, or security checks;
# forwarding the raw Host header can therefore lead to incorrect or unsafe
# behaviour.
#
# Newer nginx versions (since 1.30.0) introduce variables "$is_request_port" and
# "$request_port", allowing `Host` to be constructed as:
# $host$is_request_port$request_port
#
# In stable/oldstable packages we use "$host" as a security workaround.
# It avoids forwarding an untrusted raw Host header to the backend.
#
# Note: this changes behaviour compared to previous versions, because "$host"
# does not preserve the client-supplied port, while "$http_host" typically
# does. Existing deployments that rely on "$http_host" containing a port number
# may therefore break or behave differently after this change.
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
roles/install_nginx/files/nginx/snippets/error_pages.conf
Symlink
+1
View File
@@ -0,0 +1 @@
/srv/http/default/snippets/error_pages.conf
roles/install_nginx/files/nginx/snippets/error_pages_content.conf
Symlink
+1
View File
@@ -0,0 +1 @@
/srv/http/default/snippets/error_pages_content.conf
roles/install_nginx/files/nginx/snippets/fastcgi-php.conf
+13
View File
@@ -0,0 +1,13 @@
# regex to split $uri to $fastcgi_script_name and $fastcgi_path
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
# Check that the PHP script exists before passing it
try_files $fastcgi_script_name =404;
# Bypass the fact that try_files resets $fastcgi_path_info
# see: http://trac.nginx.org/nginx/ticket/321
set $path_info $fastcgi_path_info;
fastcgi_param PATH_INFO $path_info;
fastcgi_index index.php;
include fastcgi.conf;
roles/install_nginx/tasks/main.yaml
+30
View File
@@ -0,0 +1,30 @@
---
- name: Install NGINX on apt-based systems
become: true
ansible.builtin.apt:
name: nginx
state: present
update_cache: true
- name: Enable systemd service
ansible.builtin.service:
name: nginx
state: started
enabled: true
# We don't want to activate this config right away, so push it after service started
- name: Configure NGINX, by pushing the config directory
become: true
ansible.builtin.copy:
src: "{{ role_path }}/files/nginx"
dst: "/etc/nginx"
- name: Install custom error pages
become: true
ansible.builtin.shell: |
mkdir -p /srv/http/default
git clone https://github.com/denysvitali/nginx-error-pages /srv/http/default
ln -s /srv/http/default/snippets/error_pages.conf /etc/nginx/snippets/error_pages.conf
ln -s /srv/http/default/snippets/error_pages_content.conf /etc/nginx/snippets/error_pages_content.conf