164 lines
4 KiB
YAML
164 lines
4 KiB
YAML
---
|
|
- name: Install balancer nginx
|
|
hosts: router
|
|
roles:
|
|
- nginx
|
|
# - firewall
|
|
# - chrony
|
|
|
|
vars:
|
|
###### NGINX Configuration ######
|
|
nginx_worker_connections: 16384
|
|
nginx_use_epoll: true
|
|
nginx_multi_accept: "on"
|
|
nginx_selinux: false
|
|
pki_dir: /etc/nginx/certs
|
|
nginx_webroot: /var/www
|
|
local_http_port: 8080
|
|
nginx_letsencrypt_managed: false
|
|
letsencrypt_acme_install: false
|
|
letsencrypt_acme_certs_dir: /etc/letsencrypt/live
|
|
nginx_ssl_cert_file: '/etc/letsencrypt/live/mrwho.ru/fullchain.pem'
|
|
nginx_ssl_cert_key: '/etc/letsencrypt/live/mrwho.ru/privkey.pem'
|
|
nginx_conf_snippets:
|
|
- nginx-compression.conf
|
|
- nginx-proxy-params.conf
|
|
- nginx-server-ssl.conf
|
|
# - nginx-websockets.conf
|
|
# - nginx-browser-cache.conf
|
|
# - letsencrypt-proxy.conf
|
|
# - nginx-cors.conf
|
|
nginx_streams:
|
|
- stream: NTP
|
|
listen_port: 123
|
|
protocol: udp
|
|
responses: 1
|
|
timeout: 3
|
|
backends:
|
|
- 10.203.2.11:123
|
|
- 10.203.2.12:123
|
|
|
|
nginx_virthosts:
|
|
- virthost_name: git.local.mrwho.ru
|
|
listen: "80"
|
|
server_name: git.mrwho.ru
|
|
serveraliases: git.local.mrwho.ru
|
|
# index: index.php
|
|
# error_page: /path_to_error_page.html
|
|
ssl_enabled: true
|
|
ssl_only: true
|
|
# ssl_letsencrypt_certs: "{{ nginx_letsencrypt_managed }}"
|
|
# root: "{{ nginx_webroot }}"
|
|
server_tokens: "off"
|
|
proxy_standard_setup: true
|
|
proxy_additional_options:
|
|
- proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=cache:30m max_size=250m;
|
|
locations:
|
|
- location: /
|
|
target: "http://172.20.21.105:3000"
|
|
|
|
- virthost_name: portainer.local.mrwho.ru
|
|
listen: "80"
|
|
server_name: portainer.local.mrwho.ru
|
|
# index: index.php
|
|
# error_page: /path_to_error_page.html
|
|
ssl_enabled: true
|
|
ssl_only: true
|
|
# ssl_letsencrypt_certs: "{{ nginx_letsencrypt_managed }}"
|
|
# root: "{{ nginx_webroot }}"
|
|
server_tokens: "off"
|
|
proxy_standard_setup: true
|
|
proxy_additional_options:
|
|
- proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=cache:30m max_size=250m;
|
|
locations:
|
|
- location: /
|
|
target: "https://172.20.21.105:9443"
|
|
|
|
###### Firewalld configuration ######
|
|
firewall:
|
|
# - previous: replaced # flush previous rules
|
|
|
|
- zone: internal
|
|
state: enabled
|
|
permanent: true
|
|
service:
|
|
- ssh
|
|
- ntp
|
|
- dns
|
|
- http
|
|
- https
|
|
source:
|
|
- 10.0.0.0/8
|
|
- 172.16.0.0/12
|
|
- 192.168.0.0/16
|
|
|
|
- zone: internal
|
|
state: disabled
|
|
permanent: true
|
|
service:
|
|
- cockpit
|
|
- dhcpv6-client
|
|
- mdns
|
|
- samba-client
|
|
|
|
- zone: public
|
|
state: enabled
|
|
permanent: true
|
|
service:
|
|
- ntp
|
|
- dns
|
|
- http
|
|
- https
|
|
|
|
- zone: external
|
|
state: disabled
|
|
permanent: true
|
|
service:
|
|
- ssh
|
|
- cockpit
|
|
- dhcpv6-client
|
|
- mdns
|
|
- samba-client
|
|
|
|
- set_default_zone: internal
|
|
state: enabled
|
|
permanent: true
|
|
|
|
- interface: eth1
|
|
zone: internal
|
|
state: enabled
|
|
permanent: true
|
|
|
|
- interface: eth2
|
|
zone: internal
|
|
state: enabled
|
|
permanent: true
|
|
|
|
- interface: eth0
|
|
zone: external
|
|
state: enabled
|
|
permanent: true
|
|
|
|
- interface: tun0
|
|
zone: external
|
|
state: enabled
|
|
permanent: true
|
|
|
|
- interface: tun1
|
|
zone: external
|
|
state: enabled
|
|
permanent: true
|
|
|
|
|
|
###### chrony-client ######
|
|
chrony_disable_ntpd: true
|
|
chrony_enable: true
|
|
chrony_log_enable: true
|
|
chrony_log: measurements statistics tracking
|
|
chrony_logdir: /var/log/chrony/
|
|
chrony_ntp_servers:
|
|
- 10.203.2.11
|
|
- 10.203.2.12
|
|
chrony_rtcsync: true
|
|
chrony_timezone: Europe/Moscow
|