---
- name: Install nginx
  hosts: vm01-balancer
  roles:
    - nginx
    - zabbix-agent2
    - firewall
    - chrony

  vars:
###### NGINX Configuration ######
    nginx_selinux: false
    pki_dir: /etc/nginx/certs
    nginx_webroot: /var/www
    local_http_port: 8080
    nginx_letsencrypt_managed: true
    letsencrypt_acme_install: true
    letsencrypt_acme_certs_dir: /etc/letsencrypt/live
    nginx_conf_snippets:
      - nginx-compression.conf
      - nginx-proxy-params.conf
      - nginx-server-ssl.conf
    #     - nginx-websockets.conf
    #     - nginx-browser-cache.conf
    #     - letsencrypt-proxy.conf
    #     - nginx-cors.conf

    nginx_streams:
      - stream: DNS
        listen_port: 53
        protocol: udp
        backends:
          - 10.203.2.11:53
          - 10.203.2.12:53
      - stream: NTP
        listen_port: 123
        protocol: udp
        backends:
          - 10.203.2.11:123
          - 10.203.2.12:123

    nginx_virthosts:
      - virthost_name: gigacoms.ru
        listen: "80"
        server_name: gigacoms.ru
        server_aliases: "www.gigacoms.ru"
  #      index: index.php
        # error_page: /path_to_error_page.html
        ssl_enabled: true
        ssl_only: true
        ssl_letsencrypt_certs: "{{ nginx_letsencrypt_managed }}"
  #      root: "{{ nginx_webroot }}"
        server_tokens: "off"
        proxy_standard_setup: true
        proxy_additional_options:
          - proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=cache:30m max_size=250m;
        locations:
          - location: /
            target: "http://10.203.2.251:80"

###### Zabbix agent configuration ######
    agent_major_version: "7.0"
    agent_variant: "2"
    agent_package_state: present # present or latest
    agent_param_server: ::/0
    agent_param_listenport: 10050
    # agent_2_plugin_list: ['named'] # set in inventory vars
    agent_param_tlsconnect: unencrypted
    agent_param_tlsaccept:
      - unencrypted
    agent_apply_firewalld_rule: auto # force or auto

###### Firewalld configuration ######
    firewall:
      - previous: replaced

      - zone: internal
        state: enabled
        permanent: true
        service:
          - ssh
          - zabbix-agent
          - ntp
          - dns
          - http
          - https
        port:
          - '10050/tcp'
        source:
          - 10.0.0.0/8
          - 172.16.0.0/12
          - 192.168.0.0/16

      - zone: internal
        state: disabled
        permanent: true
        service:
          - cockpit
          - dhcpv6-client
          - mdns
          - samba-client

      - zone: public
        state: enabled
        permanent: true
        service:
          - ntp
          - dns
          - http
          - https
#        forward_port:
#          - '53/udp;;10.203.2.11'

      - zone: public
        state: disabled
        permanent: true
        service:
          - ssh
          - cockpit
          - dhcpv6-client
          - mdns
          - samba-client

      - set_default_zone: internal
        state: enabled
        permanent: true

      - interface: ens192
        zone: internal
        state: enabled
        permanent: true

      - interface: ens224
        zone: public
        state: enabled
        permanent: true

###### chrony-client ######
    chrony_disable_ntpd: true
    chrony_enable: true
    chrony_log_enable: true
    chrony_log: measurements statistics tracking
    chrony_logdir: /var/log/chrony/
    chrony_ntp_servers:
      - 10.203.2.11
      - 10.203.2.12
    chrony_rtcsync: true
    chrony_timezone: Europe/Moscow