98 lines
2.7 KiB
YAML
98 lines
2.7 KiB
YAML
---
|
|
- name: Install Nginx for Debian
|
|
ansible.builtin.import_tasks: nginx-deb.yml
|
|
when: ansible_distribution_file_variety == "Debian"
|
|
|
|
- name: Install Nginx for EL
|
|
ansible.builtin.import_tasks: nginx-rh.yml
|
|
when: ansible_distribution_file_variety == "RedHat"
|
|
|
|
- name: Generate Nginx Config
|
|
ansible.builtin.import_tasks: nginx-config.yml
|
|
|
|
- name: Configure VHosts
|
|
ansible.builtin.import_tasks: nginx-virtualhosts.yml
|
|
# when: nginx_virthosts is defined
|
|
when: nginx_virthosts | length > 0
|
|
|
|
- name: Configure streams
|
|
ansible.builtin.import_tasks: nginx-stream.yml
|
|
when: nginx_streams | length > 0
|
|
|
|
- name: Generate robots.txt
|
|
ansible.builtin.import_tasks: robots-txt.yml
|
|
|
|
- name: Configure logrotate
|
|
ansible.builtin.import_tasks: nginx-logrotate.yml
|
|
#
|
|
# - name: Confugure Letsencrypt
|
|
# ansible.builtin.import_tasks: nginx-letsencrypt.yml
|
|
# when: letsencrypt_acme_install is defined and letsencrypt_acme_install
|
|
# - ansible.builtin.import_tasks: basic-auth.yml
|
|
# - ansible.builtin.import_tasks: pam-ldap.yml
|
|
|
|
- name: Ensure that the webserver is running and enabled at boot time
|
|
ansible.builtin.service:
|
|
name: nginx
|
|
state: started
|
|
enabled: true
|
|
when: nginx_enabled
|
|
# ignore_errors: true
|
|
failed_when: false
|
|
tags: nginx
|
|
|
|
- name: Ensure that the webserver is stopped and disabled
|
|
ansible.builtin.service:
|
|
name: nginx
|
|
state: stopped
|
|
enabled: true
|
|
when: not nginx_enabled
|
|
# ignore_errors: true
|
|
failed_when: false
|
|
tags: nginx
|
|
|
|
# - name: Create file with secure permissions
|
|
# ansible.builtin.file:
|
|
# path: /etc/rsyslog.d/10-local7-to-graylog.conf
|
|
# state: touch
|
|
# owner: root
|
|
# group: root
|
|
# mode: '0644'
|
|
|
|
# - name: Add rsyslog to graylog
|
|
## ansible.builtin.lineinfile:
|
|
# path: /etc/rsyslog.d/10-local7-to-graylog.conf
|
|
# line: "local7.* @@{{ graylog_server }}:{{ graylog_port }};RSYSLOG_SyslogProtocol23Format"
|
|
# state: present
|
|
# notify: Restart rsyslog service
|
|
|
|
- name: Add rsyslog configuration
|
|
ansible.builtin.template:
|
|
src: rsyslog.conf.j2
|
|
dest: /etc/rsyslog.d/10-local7-to-graylog.conf
|
|
mode: '0644'
|
|
owner: root
|
|
group: root
|
|
notify: Restart rsyslog service
|
|
|
|
- name: Set net.netfilter.nf_conntrack_max
|
|
ansible.posix.sysctl:
|
|
name: net.netfilter.nf_conntrack_max
|
|
value: 524288
|
|
state: present
|
|
sysctl_file: /etc/sysctl.d/02-udp.conf
|
|
|
|
- name: Set net.netfilter.nf_conntrack_udp_timeout
|
|
ansible.posix.sysctl:
|
|
name: net.netfilter.nf_conntrack_udp_timeout
|
|
value: 10
|
|
state: present
|
|
sysctl_file: /etc/sysctl.d/02-udp.conf
|
|
|
|
- name: Set net.netfilter.nf_conntrack_udp_timeout_stream
|
|
ansible.posix.sysctl:
|
|
name: net.netfilter.nf_conntrack_udp_timeout_stream
|
|
value: 30
|
|
state: present
|
|
sysctl_file: /etc/sysctl.d/02-udp.conf
|