update

playbooks/mrwho/vm03-nginx.yml

@@ -0,0 +1,146 @@
+---
+- name: Install balancer nginx
+  hosts: vm03
+  roles:
+    - nginx
+    - firewall
+#    - chrony
+
+  vars:
+###### NGINX Configuration ######
+    nginx_worker_connections: 16384
+    nginx_use_epoll: true
+    nginx_multi_accept: "on"
+    nginx_selinux: false
+    pki_dir: /etc/nginx/certs
+    nginx_webroot: /var/www
+    local_http_port: 8080
+    nginx_letsencrypt_managed: false
+    letsencrypt_acme_install: false
+    letsencrypt_acme_certs_dir: /etc/letsencrypt/live
+    nginx_ssl_cert_file: '/etc/letsencrypt/live/mrwho.ru/fullchain.pem'
+    nginx_ssl_cert_key: '/etc/letsencrypt/live/mrwho.ru/privkey.pem'
+    nginx_conf_snippets:
+      - nginx-compression.conf
+      - nginx-proxy-params.conf
+      - nginx-server-ssl.conf
+    #     - nginx-websockets.conf
+    #     - nginx-browser-cache.conf
+    #     - letsencrypt-proxy.conf
+    #     - nginx-cors.conf
+    nginx_streams:
+      - stream: NTP
+        listen_port: 123
+        protocol: udp
+        responses: 1
+        timeout: 3
+        backends:
+          - 10.203.2.11:123
+          - 10.203.2.12:123
+
+    nginx_virthosts:
+      - virthost_name: git.mrwho.ru
+        listen: "80"
+        server_name: git.mrwho.ru
+        server_aliases: git.local.mrwho.ru
+  #      index: index.php
+        # error_page: /path_to_error_page.html
+        ssl_enabled: true
+        ssl_only: true
+  #      ssl_letsencrypt_certs: "{{ nginx_letsencrypt_managed }}"
+  #      root: "{{ nginx_webroot }}"
+        server_tokens: "off"
+        proxy_standard_setup: true
+        proxy_additional_options:
+          - proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=cache:30m max_size=250m;
+        locations:
+          - location: /
+            target: "http://172.20.21.105:3000"
+
+###### Firewalld configuration ######
+    firewall:
+#      - previous: replaced          # flush previous rules
+
+      - zone: internal
+        state: enabled
+        permanent: true
+        service:
+          - ssh
+          - ntp
+          - dns
+          - http
+          - https
+        source:
+          - 10.0.0.0/8
+          - 172.16.0.0/12
+          - 192.168.0.0/16
+
+      - zone: internal
+        state: disabled
+        permanent: true
+        service:
+          - cockpit
+          - dhcpv6-client
+          - mdns
+          - samba-client
+
+      - zone: public
+        state: enabled
+        permanent: true
+        service:
+          - ntp
+          - dns
+          - http
+          - https
+
+      - zone: public
+        state: disabled
+        permanent: true
+        service:
+          - ssh
+          - cockpit
+          - dhcpv6-client
+          - mdns
+          - samba-client
+
+#      - set_default_zone: internal
+#        state: enabled
+#        permanent: true
+
+#      - interface: eth1
+#        zone: internal
+#        state: enabled
+#        permanent: true
+
+#      - interface: eth2
+#        zone: internal
+#        state: enabled
+#        permanent: true
+
+      - interface: eth0
+        zone: public
+        state: enabled
+        permanent: true
+
+#      - interface: tun0
+#        zone: external
+#        state: enabled
+#        permanent: true
+
+#      - interface: tun1
+#        zone: external
+#        state: enabled
+#        permanent: true
+
+
+###### chrony-client ######
+    chrony_disable_ntpd: true
+    chrony_enable: true
+    chrony_log_enable: true
+    chrony_log: measurements statistics tracking
+    chrony_logdir: /var/log/chrony/
+    chrony_ntp_servers:
+      - 10.203.2.11
+      - 10.203.2.12
+    chrony_rtcsync: true
+    chrony_timezone: Europe/Moscow