Ansible-Roles/roles/nginx/tasks/nginx-config.yml

---
- name: Nginx configuration
  when: nginx_enabled
  tags: [nginx, nginx_conf, nginx_virtualhost]
  block:
    - name: Create the snippets directory
      ansible.builtin.file:
        dest: "{{ nginx_snippets_dir }}"
        owner: nginx
        group: nginx
        mode: "0755"
        state: directory

    - name: Create the pki directory
      ansible.builtin.file:
        dest: "{{ pki_dir }}/nginx"
        owner: nginx
        group: nginx
        mode: "0755"
        state: directory

    - name: Create the client body tmp directory, if needed
      ansible.builtin.file:
        dest: "{{ nginx_client_body_temp_dir }}/nginx"
        state: directory
        owner: www-data
        group: www-data
        mode: "0700"
      when: nginx_client_body_temp_dir is defined

    - name: Create a dhparams file 2048 bits long
      ansible.builtin.command: openssl dhparam -out {{ pki_dir }}/nginx/dhparams.pem 2048
      args:
        creates: "{{ pki_dir }}/nginx/dhparams.pem"
      when: nginx_ssl_level == 'intermediate' or nginx_ssl_level == 'modern'
      notify: Reload nginx

    - name: Install the supported configuration snippets
      ansible.builtin.template:
        src: "{{ item }}.j2"
        dest: /etc/nginx/snippets/{{ item }}
        owner: root
        group: root
        mode: "0644"
      with_items: "{{ nginx_conf_snippets }}"
      notify: Reload nginx

    - name: Download any remote snippet templates
      become: false
      ansible.builtin.get_url:
        url: "{{ item.url }}"
        dest: /var/tmp/{{ item.name }}
        owner: root
        group: root
        mode: "0644"
      loop: "{{ nginx_conf_remote_snippets }}"
      delegate_to: localhost

    - name: Install any remote snippet configuration file
      ansible.builtin.template:
        src: /var/tmp/{{ item.name }}
        dest: /etc/nginx/snippets/{{ item.name }}
        owner: root
        group: root
        mode: "0644"
      loop: "{{ nginx_conf_remote_snippets }}"
      notify: Reload nginx

    - name: Download any remote global config templates
      become: false
      ansible.builtin.get_url:
        url: "{{ item.url }}"
        dest: /var/tmp/{{ item.name }}
        owner: root
        group: root
        mode: "0644"
      loop: "{{ nginx_conf_remote_global_conf }}"
      delegate_to: localhost

    - name: Install any remote global configuration file
      ansible.builtin.template:
        src: /var/tmp/{{ item.name }}
        dest: /etc/nginx/conf.d/{{ item.name }}.conf
        owner: root
        group: root
        mode: "0644"
      loop: "{{ nginx_conf_remote_global_conf }}"
      notify: Reload nginx

    - name: Create the modules- directories
      ansible.builtin.file:
        dest: /etc/nginx/modules-{{ item }}
        state: directory
        owner: nginx
        group: nginx
        mode: "0644"
      loop:
        - available
        - enabled

    - name: Install the modules configurations
      ansible.builtin.copy:
        content: load_module modules/{{ item.mod_name }};
        dest: /etc/nginx/modules-available/{{ item.pkg_name }}.conf
        owner: root
        group: root
        mode: "0644"
      loop: "{{ nginx_org_modules }}"
      when:
        - item.enabled
        - nginx_use_nginx_org_repo

    - name: Enable the additional modules
      ansible.builtin.file:
        src: /etc/nginx/modules-available/{{ item.pkg_name }}.conf
        dest: /etc/nginx/modules-enabled/{{ item.pkg_name }}.conf
        state: link
      when: item.enabled
      loop: "{{ nginx_org_modules }}"

    - name: Disable the additional modules that we do not want installed
      ansible.builtin.file:
        dest: /etc/nginx/modules-enabled/{{ item.pkg_name }}.conf
        state: absent
      when: not item.enabled
      loop: "{{ nginx_org_modules }}"

    - name: Remove the default configuration when using the nginx.com repository
      ansible.builtin.file:
        dest: /etc/nginx/conf.d/default.conf
        state: absent
      when: nginx_use_nginx_org_repo

    - name: Install the main nginx.conf
      ansible.builtin.template:
        src: nginx.conf.j2
        dest: /etc/nginx/nginx.conf
        mode: "0444"
      notify: Reload nginx

    - name: Install Statistics stub
      ansible.builtin.template:
        src: nginx-stub.conf.j2
        dest: /etc/nginx/conf.d/nginx-stats.conf
        mode: "0444"

    - name: Создать директорию для systemd override nginx
      ansible.builtin.file:
        path: /etc/systemd/system/nginx.service.d
        state: directory
      when: nginx_streams | default([]) | selectattr('transparent', 'defined') | selectattr('transparent') | list | length > 0

    - name: Systemd override для nginx — CAP_NET_RAW (transparent proxy)
      ansible.builtin.template:
        src: nginx-systemd-override.j2
        dest: /etc/systemd/system/nginx.service.d/transparent.conf
      when: nginx_streams | default([]) | selectattr('transparent', 'defined') | selectattr('transparent') | list | length > 0
      notify:
        - Daemon reload
        - Restart nginx

- name: Disable nginx
  when:
    - nginx_enabled
    - ansible_distribution_file_variety == "Debian"
  tags: [nginx, nginx_conf, nginx_virtualhost]
  block:
    - name: Remove nginx default virtualhost
      ansible.builtin.file:
        dest: /etc/nginx/sites-enabled/default
        state: absent
      notify: Reload nginx