166 lines
3.9 KiB
YAML
166 lines
3.9 KiB
YAML
---
|
|
- name: Install balancer nginx
|
|
hosts: vm03
|
|
roles:
|
|
- nginx
|
|
- firewall
|
|
# - chrony
|
|
|
|
vars:
|
|
###### NGINX Configuration ######
|
|
nginx_worker_connections: 16384
|
|
nginx_use_epoll: true
|
|
nginx_multi_accept: "on"
|
|
nginx_selinux: false
|
|
pki_dir: /etc/nginx/certs
|
|
nginx_webroot: /var/www
|
|
local_http_port: 8080
|
|
nginx_letsencrypt_managed: false
|
|
letsencrypt_acme_install: false
|
|
letsencrypt_acme_certs_dir: /etc/letsencrypt/live
|
|
nginx_ssl_cert_file: '/etc/letsencrypt/live/mrwho.ru/fullchain.pem'
|
|
nginx_ssl_cert_key: '/etc/letsencrypt/live/mrwho.ru/privkey.pem'
|
|
nginx_conf_snippets:
|
|
- nginx-compression.conf
|
|
- nginx-proxy-params.conf
|
|
- nginx-server-ssl.conf
|
|
- nginx-websockets.conf
|
|
# - nginx-browser-cache.conf
|
|
# - letsencrypt-proxy.conf
|
|
# - nginx-cors.conf
|
|
nginx_streams:
|
|
- stream: NTP
|
|
type: proxy
|
|
listen_port: 123
|
|
protocol: udp
|
|
responses: 1
|
|
timeout: 3
|
|
backends:
|
|
- 10.203.2.11:123
|
|
- 10.203.2.12:123
|
|
- stream: HTTPS_ssl_preread
|
|
listen_port: 443
|
|
type: ssl_preread
|
|
ssl_preread:
|
|
ssl_preread: true
|
|
proxy_protocol: true
|
|
server_names:
|
|
- ams.mrwho.ru: ocserv
|
|
default_target: https
|
|
upstreams:
|
|
- name: https
|
|
servers:
|
|
- 127.0.0.1:8443
|
|
- name: ocserv
|
|
servers:
|
|
- 127.0.0.1:9443
|
|
# proxy_timeout: 4s
|
|
# proxy_responses: 1
|
|
nginx_virthosts:
|
|
- virthost_name: git.mrwho.ru
|
|
http_port: 80
|
|
https_port: 8443
|
|
server_name: git.mrwho.ru
|
|
server_aliases: git.local.mrwho.ru
|
|
# index: index.php
|
|
# error_page: /path_to_error_page.html
|
|
ssl_enabled: true
|
|
ssl_only: true
|
|
# ssl_letsencrypt_certs: "{{ nginx_letsencrypt_managed }}"
|
|
# root: "{{ nginx_webroot }}"
|
|
server_tokens: "off"
|
|
proxy_standard_setup: true
|
|
proxy_additional_options:
|
|
- proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=cache:30m max_size=250m;
|
|
locations:
|
|
- location: /
|
|
target: "http://172.20.21.105:3000"
|
|
|
|
###### Firewalld configuration ######
|
|
firewall:
|
|
# - previous: replaced # flush previous rules
|
|
|
|
- zone: internal
|
|
state: enabled
|
|
permanent: true
|
|
service:
|
|
- ssh
|
|
- ntp
|
|
- dns
|
|
- http
|
|
- https
|
|
source:
|
|
- 10.0.0.0/8
|
|
- 172.16.0.0/12
|
|
- 192.168.0.0/16
|
|
|
|
- zone: internal
|
|
state: disabled
|
|
permanent: true
|
|
service:
|
|
- cockpit
|
|
- dhcpv6-client
|
|
- mdns
|
|
- samba-client
|
|
|
|
- zone: public
|
|
state: enabled
|
|
permanent: true
|
|
service:
|
|
- ssh
|
|
- ntp
|
|
- dns
|
|
- http
|
|
- https
|
|
|
|
- zone: public
|
|
state: disabled
|
|
permanent: true
|
|
service:
|
|
- cockpit
|
|
- dhcpv6-client
|
|
- mdns
|
|
- samba-client
|
|
|
|
# - set_default_zone: internal
|
|
# state: enabled
|
|
# permanent: true
|
|
|
|
# - interface: eth1
|
|
# zone: internal
|
|
# state: enabled
|
|
# permanent: true
|
|
|
|
# - interface: eth2
|
|
# zone: internal
|
|
# state: enabled
|
|
# permanent: true
|
|
|
|
- interface: eth0
|
|
zone: public
|
|
state: enabled
|
|
permanent: true
|
|
|
|
# - interface: tun0
|
|
# zone: external
|
|
# state: enabled
|
|
# permanent: true
|
|
|
|
# - interface: tun1
|
|
# zone: external
|
|
# state: enabled
|
|
# permanent: true
|
|
|
|
|
|
###### chrony-client ######
|
|
chrony_disable_ntpd: true
|
|
chrony_enable: true
|
|
chrony_log_enable: true
|
|
chrony_log: measurements statistics tracking
|
|
chrony_logdir: /var/log/chrony/
|
|
chrony_ntp_servers:
|
|
- 10.203.2.11
|
|
- 10.203.2.12
|
|
chrony_rtcsync: true
|
|
chrony_timezone: Europe/Moscow
|