From c2e93c2370de9a0948b07e5768c7ac572d299c63 Mon Sep 17 00:00:00 2001 From: Tharre Date: Tue, 24 Apr 2018 20:44:16 +0200 Subject: Initial commit --- roles/nginx/defaults/main.yml | 2 ++ roles/nginx/files/certbot-renewal.service | 7 ++++++ roles/nginx/files/certbot-renewal.timer | 10 +++++++++ roles/nginx/handlers/main.yml | 10 +++++++++ roles/nginx/tasks/main.yml | 36 +++++++++++++++++++++++++++++++ roles/nginx/templates/letsencrypt.conf | 5 +++++ roles/nginx/templates/nginx.conf.j2 | 29 +++++++++++++++++++++++++ roles/nginx/templates/sslsettings.conf | 18 ++++++++++++++++ 8 files changed, 117 insertions(+) create mode 100644 roles/nginx/defaults/main.yml create mode 100644 roles/nginx/files/certbot-renewal.service create mode 100644 roles/nginx/files/certbot-renewal.timer create mode 100644 roles/nginx/handlers/main.yml create mode 100644 roles/nginx/tasks/main.yml create mode 100644 roles/nginx/templates/letsencrypt.conf create mode 100644 roles/nginx/templates/nginx.conf.j2 create mode 100644 roles/nginx/templates/sslsettings.conf (limited to 'roles/nginx') diff --git a/roles/nginx/defaults/main.yml b/roles/nginx/defaults/main.yml new file mode 100644 index 0000000..00cd5b8 --- /dev/null +++ b/roles/nginx/defaults/main.yml @@ -0,0 +1,2 @@ +--- +letsencrypt_validation_dir: "/var/lib/letsencrypt" diff --git a/roles/nginx/files/certbot-renewal.service b/roles/nginx/files/certbot-renewal.service new file mode 100644 index 0000000..0439b2a --- /dev/null +++ b/roles/nginx/files/certbot-renewal.service @@ -0,0 +1,7 @@ +[Unit] +Description=Let's Encrypt renewal + +[Service] +Type=oneshot +ExecStart=/usr/bin/certbot renew +ExecStartPost=/bin/systemctl reload nginx.service diff --git a/roles/nginx/files/certbot-renewal.timer b/roles/nginx/files/certbot-renewal.timer new file mode 100644 index 0000000..94c8b8b --- /dev/null +++ b/roles/nginx/files/certbot-renewal.timer @@ -0,0 +1,10 @@ +[Unit] +Description=Twice daily renewal of Let's Encrypt's certificates + +[Timer] +OnCalendar=0/12:00:00 +RandomizedDelaySec=1h +Persistent=true + +[Install] +WantedBy=timers.target diff --git a/roles/nginx/handlers/main.yml b/roles/nginx/handlers/main.yml new file mode 100644 index 0000000..03a91e1 --- /dev/null +++ b/roles/nginx/handlers/main.yml @@ -0,0 +1,10 @@ +--- + +- name: restart nginx + service: name=nginx state=restarted + +- name: reload nginx + service: name=nginx state=reloaded + +- name: daemon reload + command: systemctl daemon-reload diff --git a/roles/nginx/tasks/main.yml b/roles/nginx/tasks/main.yml new file mode 100644 index 0000000..7d8024b --- /dev/null +++ b/roles/nginx/tasks/main.yml @@ -0,0 +1,36 @@ +--- + +- name: Install nginx + package: + name: nginx, certbot + state: present + +- name: Configure nginx + template: src=nginx.conf.j2 dest=/etc/nginx/nginx.conf owner=root group=root mode=0644 + notify: + - restart nginx + +- name: Create snippets directory + file: state=directory path=/etc/nginx/snippets owner=root group=root mode=0755 + +- name: Copy snippets + template: src={{ item }} dest=/etc/nginx/snippets owner=root group=root mode=0644 + with_items: + - letsencrypt.conf + - sslsettings.conf + notify: + - reload nginx + +- name: Create nginx.d directory + file: state=directory path=/etc/nginx/nginx.d owner=root group=root mode=0755 + +- name: Install letsencrypt renewal service + copy: src={{ item }} dest=/etc/systemd/system/{{ item }} owner=root group=root mode=0644 + with_items: + - certbot-renewal.service + - certbot-renewal.timer + notify: + - daemon reload + +- name: Enable nginx + service: name=nginx enabled=yes diff --git a/roles/nginx/templates/letsencrypt.conf b/roles/nginx/templates/letsencrypt.conf new file mode 100644 index 0000000..99dd6c6 --- /dev/null +++ b/roles/nginx/templates/letsencrypt.conf @@ -0,0 +1,5 @@ +location /.well-known/acme-challenge { + root {{ letsencrypt_validation_dir }}; + default_type "text/plain"; + try_files $uri =404; +} diff --git a/roles/nginx/templates/nginx.conf.j2 b/roles/nginx/templates/nginx.conf.j2 new file mode 100644 index 0000000..00b2789 --- /dev/null +++ b/roles/nginx/templates/nginx.conf.j2 @@ -0,0 +1,29 @@ +user http; +worker_processes auto; + +events { + worker_connections 1024; +} + +http { + include mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr $host $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for" $request_time'; + + sendfile on; + keepalive_timeout 65; + client_max_body_size 16M; + + gzip on; + gzip_comp_level 6; + gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript; + + index index.php index.html index.htm; + + include snippets/sslsettings.conf; + + include nginx.d/*.conf; +} diff --git a/roles/nginx/templates/sslsettings.conf b/roles/nginx/templates/sslsettings.conf new file mode 100644 index 0000000..761c554 --- /dev/null +++ b/roles/nginx/templates/sslsettings.conf @@ -0,0 +1,18 @@ +ssl_session_timeout 1d; +ssl_session_cache shared:SSL:50m; +ssl_session_tickets off; + +ssl_protocols TLSv1.2; +ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256'; +ssl_prefer_server_ciphers on; + +# HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months) +add_header Strict-Transport-Security max-age=15768000; + +# OCSP Stapling --- +# fetch OCSP records from URL in ssl_certificate and cache them +ssl_stapling on; +ssl_stapling_verify on; + +resolver 8.8.8.8 8.8.4.4 valid=300s; +resolver_timeout 5s; -- cgit v1.2.3-70-g09d2