8 files changed, 117 insertions, 0 deletions
diff --git a/roles/nginx/defaults/main.yml b/roles/nginx/defaults/main.yml
new file mode 100644
index 0000000..00cd5b8
--- /dev/null
+++ b/roles/nginx/defaults/main.yml
@@ -0,0 +1,2 @@
+---
+letsencrypt_validation_dir: "/var/lib/letsencrypt"
diff --git a/roles/nginx/files/certbot-renewal.service b/roles/nginx/files/certbot-renewal.service
new file mode 100644
index 0000000..0439b2a
--- /dev/null
+++ b/roles/nginx/files/certbot-renewal.service
@@ -0,0 +1,7 @@
+[Unit]
+Description=Let's Encrypt renewal
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/certbot renew
+ExecStartPost=/bin/systemctl reload nginx.service
diff --git a/roles/nginx/files/certbot-renewal.timer b/roles/nginx/files/certbot-renewal.timer
new file mode 100644
index 0000000..94c8b8b
--- /dev/null
+++ b/roles/nginx/files/certbot-renewal.timer
@@ -0,0 +1,10 @@
+[Unit]
+Description=Twice daily renewal of Let's Encrypt's certificates
+
+[Timer]
+OnCalendar=0/12:00:00
+RandomizedDelaySec=1h
+Persistent=true
+
+[Install]
+WantedBy=timers.target
diff --git a/roles/nginx/handlers/main.yml b/roles/nginx/handlers/main.yml
new file mode 100644
index 0000000..03a91e1
--- /dev/null
+++ b/roles/nginx/handlers/main.yml
@@ -0,0 +1,10 @@
+---
+
+- name: restart nginx
+  service: name=nginx state=restarted
+
+- name: reload nginx
+  service: name=nginx state=reloaded
+
+- name: daemon reload
+  command: systemctl daemon-reload
diff --git a/roles/nginx/tasks/main.yml b/roles/nginx/tasks/main.yml
new file mode 100644
index 0000000..7d8024b
--- /dev/null
+++ b/roles/nginx/tasks/main.yml
@@ -0,0 +1,36 @@
+---
+
+- name: Install nginx
+  package:
+    name: nginx, certbot
+    state: present
+
+- name: Configure nginx
+  template: src=nginx.conf.j2 dest=/etc/nginx/nginx.conf owner=root group=root mode=0644
+  notify:
+    - restart nginx
+
+- name: Create snippets directory
+  file: state=directory path=/etc/nginx/snippets owner=root group=root mode=0755
+
+- name: Copy snippets
+  template: src={{ item }} dest=/etc/nginx/snippets owner=root group=root mode=0644
+  with_items:
+    - letsencrypt.conf
+    - sslsettings.conf
+  notify:
+    - reload nginx
+
+- name: Create nginx.d directory
+  file: state=directory path=/etc/nginx/nginx.d owner=root group=root mode=0755
+
+- name: Install letsencrypt renewal service
+  copy: src={{ item }} dest=/etc/systemd/system/{{ item }} owner=root group=root mode=0644
+  with_items:
+    - certbot-renewal.service
+    - certbot-renewal.timer
+  notify:
+    - daemon reload
+
+- name: Enable nginx
+  service: name=nginx enabled=yes
diff --git a/roles/nginx/templates/letsencrypt.conf b/roles/nginx/templates/letsencrypt.conf
new file mode 100644
index 0000000..99dd6c6
--- /dev/null
+++ b/roles/nginx/templates/letsencrypt.conf
@@ -0,0 +1,5 @@
+location /.well-known/acme-challenge {
+    root {{ letsencrypt_validation_dir }};
+    default_type "text/plain";
+    try_files $uri =404;
+}
diff --git a/roles/nginx/templates/nginx.conf.j2 b/roles/nginx/templates/nginx.conf.j2
new file mode 100644
index 0000000..00b2789
--- /dev/null
+++ b/roles/nginx/templates/nginx.conf.j2
@@ -0,0 +1,29 @@
+user http;
+worker_processes auto;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    include       mime.types;
+    default_type  application/octet-stream;
+
+    log_format  main  '$remote_addr $host $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for" $request_time';
+
+    sendfile        on;
+    keepalive_timeout  65;
+    client_max_body_size 16M;
+
+    gzip on;
+    gzip_comp_level 6;
+    gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
+
+    index  index.php index.html index.htm;
+
+    include snippets/sslsettings.conf;
+
+    include nginx.d/*.conf;
+}
diff --git a/roles/nginx/templates/sslsettings.conf b/roles/nginx/templates/sslsettings.conf
new file mode 100644
index 0000000..761c554
--- /dev/null
+++ b/roles/nginx/templates/sslsettings.conf
@@ -0,0 +1,18 @@
+ssl_session_timeout 1d;
+ssl_session_cache shared:SSL:50m;
+ssl_session_tickets off;
+
+ssl_protocols TLSv1.2;
+ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
+ssl_prefer_server_ciphers on;
+
+# HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
+add_header Strict-Transport-Security max-age=15768000;
+
+# OCSP Stapling ---
+# fetch OCSP records from URL in ssl_certificate and cache them
+ssl_stapling on;
+ssl_stapling_verify on;
+
+resolver 8.8.8.8 8.8.4.4 valid=300s;
+resolver_timeout 5s;