---
- name: Install balancer nginx
  hosts: router
  roles:
    - nginx
#    - firewall
#    - chrony

  vars:
###### NGINX Configuration ######
    nginx_worker_connections: 16384
    nginx_use_epoll: true
    nginx_multi_accept: "on"
    nginx_selinux: false
    pki_dir: /etc/nginx/certs
    nginx_webroot: /var/www
    local_http_port: 8080
    nginx_letsencrypt_managed: false
    letsencrypt_acme_install: false
    letsencrypt_acme_certs_dir: /etc/letsencrypt/live
    nginx_ssl_cert_file: '/etc/letsencrypt/live/mrwho.ru/fullchain.pem'
    nginx_ssl_cert_key: '/etc/letsencrypt/live/mrwho.ru/privkey.pem'
    nginx_conf_snippets:
      - nginx-compression.conf
      - nginx-proxy-params.conf
      - nginx-server-ssl.conf
    #     - nginx-websockets.conf
    #     - nginx-browser-cache.conf
    #     - letsencrypt-proxy.conf
    #     - nginx-cors.conf
    nginx_streams:
      - stream: NTP
        listen_port: 123
        protocol: udp
        responses: 1
        timeout: 3
        backends:
          - 10.203.2.11:123
          - 10.203.2.12:123

    nginx_virthosts:
      - virthost_name: git.local.mrwho.ru
        listen: "80"
        server_name: git.mrwho.ru
        serveraliases: git.local.mrwho.ru
  #      index: index.php
        # error_page: /path_to_error_page.html
        ssl_enabled: true
        ssl_only: true
  #      ssl_letsencrypt_certs: "{{ nginx_letsencrypt_managed }}"
  #      root: "{{ nginx_webroot }}"
        server_tokens: "off"
        proxy_standard_setup: true
        proxy_additional_options:
          - proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=cache:30m max_size=250m;
        locations:
          - location: /
            target: "http://172.20.21.105:3000"

###### Firewalld configuration ######
    firewall:
#      - previous: replaced          # flush previous rules

      - zone: internal
        state: enabled
        permanent: true
        service:
          - ssh
          - ntp
          - dns
          - http
          - https
        source:
          - 10.0.0.0/8
          - 172.16.0.0/12
          - 192.168.0.0/16

      - zone: internal
        state: disabled
        permanent: true
        service:
          - cockpit
          - dhcpv6-client
          - mdns
          - samba-client

      - zone: public
        state: enabled
        permanent: true
        service:
          - ntp
          - dns
          - http
          - https

      - zone: external
        state: disabled
        permanent: true
        service:
          - ssh
          - cockpit
          - dhcpv6-client
          - mdns
          - samba-client

      - set_default_zone: internal
        state: enabled
        permanent: true

      - interface: eth1
        zone: internal
        state: enabled
        permanent: true

      - interface: eth2
        zone: internal
        state: enabled
        permanent: true

      - interface: eth0
        zone: external
        state: enabled
        permanent: true

      - interface: tun0
        zone: external
        state: enabled
        permanent: true

      - interface: tun1
        zone: external
        state: enabled
        permanent: true


###### chrony-client ######
    chrony_disable_ntpd: true
    chrony_enable: true
    chrony_log_enable: true
    chrony_log: measurements statistics tracking
    chrony_logdir: /var/log/chrony/
    chrony_ntp_servers:
      - 10.203.2.11
      - 10.203.2.12
    chrony_rtcsync: true
    chrony_timezone: Europe/Moscow
