infrastructure/nginx.yml at master · emissions-api/infrastructure · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
---

- hosts: server
  become: yes
  vars_files:
    - secret-vars.yml
  tasks:
    - name: install needed amazon extras
      command: amazon-linux-extras install nginx1 epel
      when: ansible_distribution == "Amazon"

    - name: permit traffic in default zone for https service
      ansible.posix.firewalld:
        service: '{{ item }}'
        permanent: true
        immediate: true
        state: enabled
      with_items:
        - http
        - https
      when: ansible_os_family == "RedHat"

    - name: install needed software
      package:
        name:
          - nginx
          - certbot
          - python3-certbot-nginx
          - python3-passlib
      when: ansible_os_family == "RedHat"

    - name: Set httpd_can_network_connect flag
      seboolean:
        name: httpd_can_network_connect
        state: true
        persistent: true

    - name: nginx enabled and started
      service:
        name: nginx
        state: started
        enabled: true

    - name: create certificate
      command: certbot certonly --domain {{ ansible_host }} --nginx --agree-tos -m info@emissions-api.org
      args:
        creates: /etc/letsencrypt/live/{{ ansible_host }}/cert.pem
      notify: reload nginx

    - name: certbot-renew enabled and started
      service:
        name: certbot-renew.timer
        state: started
        enabled: true

    - name: install diffie hellmann paramter
      copy:
        src: nginx/dhparam.pem
        dest: /etc/nginx/dhparam.pem
        force: yes
      notify: reload nginx

    - name: install config file
      template:
        dest: /etc/nginx/conf.d/server.conf
        src: nginx/server.conf
        force: yes
      notify: reload nginx

    - name: create prometheus api user
      htpasswd:
        path: /etc/nginx/.htpasswd
        name: '{{ prometheus.user }}'
        password: '{{ prometheus.password }}'
        owner: root
        group: '{{ "www-data" if ansible_os_family == "Debian" else "nginx" }}'
        mode: 0640
      notify: reload nginx

  handlers:
    - name: reload nginx
      service:
        name: nginx
        state: reloaded