149 lines
3.5 KiB
YAML
149 lines
3.5 KiB
YAML
---
|
|
- name: Install nginx
|
|
hosts: vm01-balancer
|
|
roles:
|
|
- nginx
|
|
- zabbix-agent2
|
|
- firewall
|
|
- chrony
|
|
|
|
vars:
|
|
###### NGINX Configuration ######
|
|
nginx_selinux: false
|
|
pki_dir: /etc/nginx/certs
|
|
nginx_webroot: /var/www
|
|
local_http_port: 8080
|
|
nginx_letsencrypt_managed: true
|
|
letsencrypt_acme_install: true
|
|
letsencrypt_acme_certs_dir: /etc/letsencrypt/live
|
|
nginx_conf_snippets:
|
|
- nginx-compression.conf
|
|
- nginx-proxy-params.conf
|
|
- nginx-server-ssl.conf
|
|
# - nginx-websockets.conf
|
|
# - nginx-browser-cache.conf
|
|
# - letsencrypt-proxy.conf
|
|
# - nginx-cors.conf
|
|
|
|
nginx_streams:
|
|
- stream: DNS
|
|
listen_port: 53
|
|
protocol: udp
|
|
backends:
|
|
- 10.203.2.11:53
|
|
- 10.203.2.12:53
|
|
- stream: NTP
|
|
listen_port: 123
|
|
protocol: udp
|
|
backends:
|
|
- 10.203.2.11:123
|
|
- 10.203.2.12:123
|
|
|
|
nginx_virthosts:
|
|
- virthost_name: gigacoms.ru
|
|
listen: "80"
|
|
server_name: gigacoms.ru
|
|
server_aliases: "www.gigacoms.ru"
|
|
# index: index.php
|
|
# error_page: /path_to_error_page.html
|
|
ssl_enabled: true
|
|
ssl_only: true
|
|
ssl_letsencrypt_certs: "{{ nginx_letsencrypt_managed }}"
|
|
# root: "{{ nginx_webroot }}"
|
|
server_tokens: "off"
|
|
proxy_standard_setup: true
|
|
proxy_additional_options:
|
|
- proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=cache:30m max_size=250m;
|
|
locations:
|
|
- location: /
|
|
target: "http://10.203.2.251:80"
|
|
|
|
###### Zabbix agent configuration ######
|
|
agent_major_version: "7.0"
|
|
agent_variant: "2"
|
|
agent_package_state: present # present or latest
|
|
agent_param_server: ::/0
|
|
agent_param_listenport: 10050
|
|
# agent_2_plugin_list: ['named'] # set in inventory vars
|
|
agent_param_tlsconnect: unencrypted
|
|
agent_param_tlsaccept:
|
|
- unencrypted
|
|
agent_apply_firewalld_rule: auto # force or auto
|
|
|
|
###### Firewalld configuration ######
|
|
firewall:
|
|
- previous: replaced
|
|
|
|
- zone: internal
|
|
state: enabled
|
|
permanent: true
|
|
service:
|
|
- ssh
|
|
- zabbix-agent
|
|
- ntp
|
|
- dns
|
|
- http
|
|
- https
|
|
port:
|
|
- '10050/tcp'
|
|
source:
|
|
- 10.0.0.0/8
|
|
- 172.16.0.0/12
|
|
- 192.168.0.0/16
|
|
|
|
- zone: internal
|
|
state: disabled
|
|
permanent: true
|
|
service:
|
|
- cockpit
|
|
- dhcpv6-client
|
|
- mdns
|
|
- samba-client
|
|
|
|
- zone: public
|
|
state: enabled
|
|
permanent: true
|
|
service:
|
|
- ntp
|
|
- dns
|
|
- http
|
|
- https
|
|
# forward_port:
|
|
# - '53/udp;;10.203.2.11'
|
|
|
|
- zone: public
|
|
state: disabled
|
|
permanent: true
|
|
service:
|
|
- ssh
|
|
- cockpit
|
|
- dhcpv6-client
|
|
- mdns
|
|
- samba-client
|
|
|
|
- set_default_zone: internal
|
|
state: enabled
|
|
permanent: true
|
|
|
|
- interface: ens192
|
|
zone: internal
|
|
state: enabled
|
|
permanent: true
|
|
|
|
- interface: ens224
|
|
zone: public
|
|
state: enabled
|
|
permanent: true
|
|
|
|
###### chrony-client ######
|
|
chrony_disable_ntpd: true
|
|
chrony_enable: true
|
|
chrony_log_enable: true
|
|
chrony_log: measurements statistics tracking
|
|
chrony_logdir: /var/log/chrony/
|
|
chrony_ntp_servers:
|
|
- 10.203.2.11
|
|
- 10.203.2.12
|
|
chrony_rtcsync: true
|
|
chrony_timezone: Europe/Moscow
|