Git initial commit

LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) <year> <copyright holders>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

README.md

@@ -0,0 +1,3 @@
+# cloud-nginx
+
+Ansible role to provide nginx.

defaults/main.yml

@@ -0,0 +1,77 @@
+---
+cloud_apps: /opt
+cloud_storage: /opt/storage
+cloud_stage: prod
+cloud_update: false
+
+www_root: /var/www
+www_group: www-data
+
+web_sites: []
+  # - domain: my-domain.tld
+  #   filetag: file.my-domain.tld
+  #   state: present
+  #   stream: false
+  #   owner: user
+  #   port: 80
+  #   port_option: ""
+  #   root: "{{ www_root }}/my-domain.tld"
+  #   root_setup: True
+  #   index:
+  #     - index.html
+  #     - index.htm
+  #     - index.php
+  #   locations:
+  #     - location: "/"
+  #       options: "try_files $uri $uri/ =404;"
+  #   options:
+  #     access_log: "/var/log/nginx/my-domain-access.log"
+  #     option_key: "option_value"
+  #   add_header:
+  #     - Referrer-Policy                      \"no-referrer\"   always
+  #     - someother header
+  #   pre_options: ""
+  #   post_options: ""
+
+nginx_conf_http: []
+nginx_conf: []
+
+nginx_worker_count: 768
+nginx_pid: /run/nginx.pid
+nginx_log_path: /var/log/nginx
+nginx_gzip: true
+
+letsencrypt_mail_address: admin@my-domain.tld
+
+letsencrypt_renewal_scripts: []
+  # - name: "copy_to_coturn_folder"
+  #   type: "deploy"
+  #   content: |
+  #     #!/bin/sh
+
+  #     set -e
+
+  #     for domain in $RENEWED_DOMAINS; do
+  #             case $domain in
+  #             example.com)
+  #                     daemon_cert_root=/etc/coturn/certs
+
+  #                     # Make sure the certificate and private key files are
+  #                     # never world readable, even just for an instant while
+  #                     # we're copying them into daemon_cert_root.
+  #                     umask 077
+
+  #                     cp "$RENEWED_LINEAGE/fullchain.pem" "$daemon_cert_root/$domain.cert"
+  #                     cp "$RENEWED_LINEAGE/privkey.pem" "$daemon_cert_root/$domain.key"
+
+  #                     # Apply the proper file ownership and permissions for
+  #                     # the daemon to read its certificate and key.
+  #                     chown turnserver "$daemon_cert_root/$domain.cert" \
+  #                             "$daemon_cert_root/$domain.key"
+  #                     chmod 400 "$daemon_cert_root/$domain.cert" \
+  #                             "$daemon_cert_root/$domain.key"
+
+  #                     service coturn restart >/dev/null
+  #                     ;;
+  #             esac
+  #     done

handlers/main.yml

@@ -0,0 +1,11 @@
+---
+- name: reload nginx
+  systemd:
+    name: nginx
+    state: reloaded
+
+- name: restart nginx
+  systemd:
+    name: nginx
+    state: restarted
+    daemon_reload: yes

meta/main.yml

@@ -0,0 +1,16 @@
+---
+galaxy_info:
+  role_name: nginx
+  namespace: hahn-cloud
+  author: Lars Hahn
+  company: OpenDevChain
+  license: MIT
+  description: Role to setup an nginx server serving for Mail, WordPress, Redmine, and other services.
+  min_ansible_version: 2.7
+  platforms:
+    - name: Debian
+      versions:
+        - 10
+  galaxy_tags:
+    - nginx
+dependencies: []

tasks/letsencrypt.yml

@@ -0,0 +1,52 @@
+---
+- name: install python3 certbot and recommendations
+  apt:
+    update_cache: yes
+    state: "{% if cloud_update | bool %}latest{% else %}present{% endif %}"
+    install_recommends: yes
+    pkg:
+      - python3-certbot
+      - python3-certbot-nginx
+  register: certbot_nginx_installation
+
+- name: create letsencrypt account
+  command: 
+    cmd: |
+      certbot register
+      -m {{ letsencrypt_mail_address }} 
+      --agree-tos 
+      --noninteractive 
+      --redirect
+  when: certbot_nginx_installation.changed
+
+- name: Setup renewal scripts
+  copy:
+    dest: "/etc/letsencrypt/renewal-hooks/{{ item.type }}/{{ item.name }}.sh"
+    mode: 0700
+    content: "{{ item.content }}"
+  loop: "{{ letsencrypt_renewal_scripts }}"
+  loop_control:
+    label: "{{ item.name }}"
+
+- name: create let's-encrypt certificates for web web_sites
+  command:
+    cmd: |
+      certbot 
+      --nginx 
+      -d {% if cert_domain is not string and cert_domain is iterable %}{{ cert_domain | join(',') }}{% else %}{{ cert_domain }}{% endif %} 
+      -m {{ letsencrypt_mail_address }} 
+      --agree-tos 
+      --noninteractive 
+      --redirect
+    creates: "/etc/letsencrypt/live/{% if cert_domain is not string and cert_domain is iterable %}{{ cert_domain[0] }}{% else %}{{ cert_domain }}{% endif %}"
+  loop: "{{ web_sites | json_query('[?letsencrypt==`true`&&state==`present`].domain') }}"
+  loop_control:
+    loop_var: cert_domain
+    label: "{% if cert_domain is not string and cert_domain is iterable %}{{ cert_domain | join(',') }}{% else %}{{ cert_domain }}{% endif %}"
+
+- name: Setup cronjob for auto renewal
+  cron:
+    name: letsencrypt
+    special_time: daily
+    job: /usr/bin/certbot -q renew
+

tasks/main.yml

@@ -0,0 +1,141 @@
+---
+- name: install nginx and recommendations
+  apt:
+    update_cache: yes
+    state: "{% if cloud_update | bool %}latest{% else %}present{% endif %}"
+    install_recommends: yes
+    pkg:
+      - "nginx-full"
+
+- name: setup nginx configuration file
+  template:
+    src: etc/nginx/nginx.conf.j2
+    dest: "{{ nginx_root_dir }}/nginx.conf"
+
+- name: setup nginx non-default folders
+  file:
+    state: directory
+    path: "{{ nginx_root_dir }}/{{ item }}"
+  loop:
+    - streams-available
+    - streams-enabled
+
+- name: setup document roots folder for nginx
+  file:
+    state: directory
+    path: "{{ website.root | default(www_root + '/' + website.domain) }}"
+    owner: "{{ website.owner | default(www_group) }}"
+    group: "{{ www_group }}"
+  when: website.root_setup | default(false) | bool
+  loop: "{{ web_sites }}"
+  loop_control:
+    loop_var: website
+    label: "{{ website.domain }}"
+  register: setup_doc_roots
+
+- name: setup default index.html if not exists
+  template:
+    src: index.html.j2
+    dest: "{{ website.root | default(www_root + '/' + website.domain) }}/index.html"
+    force: no
+    owner: "{{ website.owner | default(www_group) }}"
+    group: "{{ www_group }}"
+  loop: "{{ setup_doc_roots.results | json_query('[?changed==`true`].website') }}"
+  loop_control:
+    loop_var: website
+    label: "{{ website.domain }}"
+
+- name: setup sites-available virtual host config
+  template:
+    src: etc/nginx/sites-available/website.j2
+    dest: "{{ nginx_root_dir }}/sites-available/{{ website.filetag | default(website.domain) }}"
+    force: "{% if website.letsencrypt is defined and website.letsencrypt %}no{% else %}yes{% endif %}"
+  loop: "{{ web_sites | json_query('[?state==`present`&&(!stream||stream==`false`)]') }}"
+  loop_control:
+    loop_var: website
+    label: "{{ website.filetag | default(website.domain) }}"
+
+- name: setup streams-available virtual host config
+  template:
+    src: etc/nginx/streams-available/stream.j2
+    dest: "{{ nginx_root_dir }}/streams-available/{{ stream.filetag | default(stream.domain) }}"
+    force: "{% if stream.letsencrypt is defined and stream.letsencrypt %}no{% else %}yes{% endif %}"
+  loop: "{{ web_sites | json_query('[?state==`present`&&stream==`true`]') }}"
+  loop_control:
+    loop_var: stream
+    label: "{{ stream.filetag | default(stream.domain) }}"
+
+- name: configure *-enabled file site links for virtual hosts
+  file:
+    state: "link"
+    src: "{{ nginx_root_dir }}/sites-available/{{ item.filetag | default(item.domain) }}"
+    dest: "{{ nginx_root_dir }}/sites-enabled/{{ item.filetag | default(item.domain) }}"
+  loop: "{{ web_sites | json_query('[?state==`present`&&(!stream||stream==`false`)]') }}"
+  loop_control:
+    label: "{{ item.filetag | default(item.domain) }}"
+  notify: reload nginx
+
+- name: configure *-enabled file stream links for virtual hosts
+  file:
+    state: "link"
+    src: "{{ nginx_root_dir }}/streams-available/{{ stream.filetag | default(stream.domain) }}"
+    dest: "{{ nginx_root_dir }}/streams-enabled/{{ stream.filetag | default(stream.domain) }}"
+  loop: "{{ web_sites | json_query('[?state==`present`&&stream==`true`]') }}"
+  loop_control:
+    loop_var: stream
+    label: "{{ stream.filetag | default(stream.domain) }}"
+  notify: reload nginx
+
+- name: remove links for inactive virtual host sites
+  file:
+    state: "absent"
+    path: "{{ nginx_root_dir }}/sites-enabled/{{ website.filetag | default(website.domain) }}"
+  loop: "{{ web_sites | json_query('[?state==`absent`&&(!stream||stream==`false`)]') }}"
+  loop_control:
+    loop_var: website
+    label: "{{ website.filetag | default(website.domain) }}"
+  notify: reload nginx
+
+- name: remove links for inactive virtual host streams
+  file:
+    state: "absent"
+    path: "{{ nginx_root_dir }}/streams-enabled/{{ stream.filetag | default(stream.domain) }}"
+  loop: "{{ web_sites | json_query('[?state==`absent`&&stream==`true`]') }}"
+  loop_control:
+    loop_var: stream
+    label: "{{ stream.filetag | default(stream.domain) }}"
+  notify: reload nginx
+
+- name: run letsencrypt certificate generation
+  import_tasks: letsencrypt.yml
+
+- name: setup sites-available virtual ssl host config
+  template:
+    src: etc/nginx/sites-available/website.j2
+    dest: "{{ nginx_root_dir }}/sites-available/{{ website.filetag | default(website.domain) }}"
+  loop: "{{ web_sites | json_query('[?letsencrypt==`true`&&state==`present`&&(!stream||stream==`false`)]') }}"
+  loop_control:
+    loop_var: website
+    label: "{{ website.filetag | default(website.domain) }}"
+  vars:
+    use_ssl: true
+  notify: reload nginx
+
+- name: setup streams-available virtual ssl host config
+  template:
+    src: etc/nginx/streams-available/stream.j2
+    dest: "{{ nginx_root_dir }}/streams-available/{{ stream.filetag | default(stream.domain) }}"
+  loop: "{{ web_sites | json_query('[?letsencrypt==`true`&&state==`present`&&stream==`true`]') }}"
+  loop_control:
+    loop_var: stream
+    label: "{{ stream.filetag | default(stream.domain) }}"
+  vars:
+    use_ssl: true
+  notify: reload nginx
+
+- name: enable nginx systemd unit
+  systemd:
+    name: nginx
+    enabled: yes
+    daemon_reload: yes
+    state: started

templates/etc/nginx/nginx.conf.j2

@@ -0,0 +1,96 @@
+user {{ www_group }};
+worker_processes auto;
+pid {{ nginx_pid }};
+include /etc/nginx/modules-enabled/*.conf;
+
+events {
+	worker_connections {{ nginx_worker_count }};
+	# multi_accept on;
+}
+
+http {
+
+	##
+	# Basic Settings
+	##
+
+	sendfile on;
+	tcp_nopush on;
+	tcp_nodelay on;
+	keepalive_timeout 65;
+	types_hash_max_size 2048;
+	# server_tokens off;
+
+	# server_names_hash_bucket_size 64;
+	# server_name_in_redirect off;
+
+	include /etc/nginx/mime.types;
+	default_type application/octet-stream;
+
+	##
+	# SSL Settings
+	##
+
+	ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
+	ssl_prefer_server_ciphers on;
+
+	##
+	# Logging Settings
+	##
+
+	access_log {{ nginx_log_path }}/access.log;
+	error_log {{ nginx_log_path }}/error.log;
+
+	##
+	# Gzip Settings
+	##
+
+	gzip {{ 'on' if nginx_gzip else 'off' }};
+
+	# gzip_vary on;
+	# gzip_proxied any;
+	# gzip_comp_level 6;
+	# gzip_buffers 16 8k;
+	# gzip_http_version 1.1;
+	# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+
+	##
+	# Virtual Host Configs
+	##
+
+	include /etc/nginx/conf.d/*.conf;
+	include /etc/nginx/sites-enabled/*;
+
+    ### Ansible included configs ###
+{% for http_conf in nginx_conf_http %}
+    {{ http_conf | indent(width=4, first=False) }}
+{% endfor %}    
+}
+#mail {
+#	# See sample authentication script at:
+#	# http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
+# 
+#	# auth_http localhost/auth.php;
+#	# pop3_capabilities "TOP" "USER";
+#	# imap_capabilities "IMAP4rev1" "UIDPLUS";
+# 
+#	server {
+#		listen     localhost:110;
+#		protocol   pop3;
+#		proxy      on;
+#	}
+# 
+#	server {
+#		listen     localhost:143;
+#		protocol   imap;
+#		proxy      on;
+#	}
+#}
+
+stream {
+	include /etc/nginx/streams-enabled/*;
+}
+
+{% for conf in nginx_conf %}
+{{ conf }}
+{% endfor %} 

templates/etc/nginx/sites-available/website.j2

@@ -0,0 +1,80 @@
+{% if website.pre_options is defined %}
+{{ website.pre_options }}
+{% endif %}
+server {
+{% if website.domain is iterable and (website.domain is not mapping and website.domain is not string) %}
+        server_name {{ website.domain | join(' ') }};
+        
+{% else %}
+        server_name {{ website.domain }};
+{% endif %}
+{% if website.root is not defined %}
+        root {{ www_root }}/{{ website.domain }}/{{ website.subroot | default('') }};
+{% elif website.root != 'noroot' %}
+        root {{ website.root }};
+{% endif %}
+{% if website.index is not defined %}
+        index index.html index.php index.htm;
+{% elif website.index != 'noindex' %}
+        index {{ website.index | join(' ') }};
+{% endif %}
+
+{% if website.options is defined %}
+{% for key in website.options.keys() %}
+        {{ key }} {{ website.options[key] }};
+{% endfor %}
+{% endif %}
+
+{% if website.mappings is defined %}
+{% for key in website.mappings.keys() %}
+        {{ key }} {{ website.mappings[key] | indent(width=12, first=False) }}
+{% endfor %}
+{% endif %}
+
+{% if website.add_header is defined %}
+{% for header in website.add_header %}
+        add_header {{ header }};
+{% endfor %}
+{% endif %}
+
+{% for www_location in website.locations | default(default_locations) %}
+        location {{ www_location.location | default('/') }} {
+                {{ www_location.options | default('try_files $uri $uri/ =404;') | indent(width=16, first=False) }}
+        }
+{% endfor %}
+
+        listen {% if use_ssl is defined and use_ssl %}443 ssl{% else %}{{ website.port | default(80) }}{% endif %}{% if website.port_option is defined and website.port_option != '' %}{{ website.port_option }}{% endif %};
+        listen [::]:{% if use_ssl is defined and use_ssl %}443 ssl{% else %}{{ website.port | default(80) }}{% endif %}{% if website.port_option is defined and website.port_option != '' %}{{ website.port_option }}{% endif %};
+{% if use_ssl is defined and use_ssl %}
+        ssl_certificate /etc/letsencrypt/live/{% if website.domain is not string and website.domain is iterable %}{{ website.domain[0] }}{% else %}{{ website.domain }}{% endif %}/fullchain.pem;
+        ssl_certificate_key /etc/letsencrypt/live/{% if website.domain is not string and website.domain is iterable %}{{ website.domain[0] }}{% else %}{{ website.domain }}{% endif %}/privkey.pem;
+        include /etc/letsencrypt/options-ssl-nginx.conf;
+        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+{% endif %}
+}
+{% if use_ssl is defined and use_ssl %}
+server {
+{% if website.domain is iterable and website.domain is not string %}
+{% for domain in website.domain %}
+        if ($host = {{ domain }}) {
+                return 301 https://$host$request_uri;
+        }
+{% endfor %}
+{% else %}
+        if ($host = {{ website.domain }}) {
+                return 301 https://$host$request_uri;
+        }
+{% endif %}
+        listen {{ website.port | default(80) }};
+        listen [::]:{{ website.port | default(80) }};
+{% if website.domain is iterable and (website.domain is not mapping and website.domain is not string) %}
+        server_name {{ website.domain | join(' ') }};
+{% else %}
+        server_name {{ website.domain }};
+{% endif %}
+        return 404;
+}
+{% endif %}
+{% if website.post_options is defined %}
+{{ website.post_options }}
+{% endif %}

templates/etc/nginx/streams-available/stream.j2

@@ -0,0 +1,19 @@
+{% if stream.pre_options is defined %}
+{{ stream.pre_options }}
+{% endif %}
+server {
+        listen {{ stream.port | default(8080) }} {% if use_ssl is defined and use_ssl %}ssl{% endif %}{% if stream.port_option is defined and stream.port_option != '' %}{{ stream.port_option }}{% endif %};
+        listen [::]:{{ stream.port | default(8080) }} {% if use_ssl is defined and use_ssl %}ssl{% endif %}{% if stream.port_option is defined and stream.port_option != '' %}{{ stream.port_option }}{% endif %};
+
+{% if stream.options is defined %}
+{% for key in stream.options.keys() %}
+        {{ key }} {{ stream.options[key] }};
+{% endfor %}
+{% endif %}
+
+{% if use_ssl is defined and use_ssl %}
+        ssl_certificate /etc/letsencrypt/live/{% if stream.domain is not string and stream.domain is iterable %}{{ stream.domain[0] }}{% else %}{{ stream.domain }}{% endif %}/fullchain.pem;
+        ssl_certificate_key /etc/letsencrypt/live/{% if stream.domain is not string and stream.domain is iterable %}{{ stream.domain[0] }}{% else %}{{ stream.domain }}{% endif %}/privkey.pem;
+        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+{% endif %}
+}

templates/index.html.j2

@@ -0,0 +1,10 @@
+<html>
+    <head>
+        <title>{{ website.domain }}</title>
+    </head>
+    <body>
+        <h1>Hello World!</h1>
+        <p>This is the initial template for {{ website.domain }}, setup was successfull!</p>
+        <p>Farewell, my old friend.</p>
+    </body>
+</html>

vars/main.yml

@@ -0,0 +1,7 @@
+---
+nginx_root_dir: /etc/nginx
+default_docroot: /var/www
+
+default_locations:
+  - location: "/"
+    options: "try_files $uri $uri/ =404;"