109 lines
3.0 KiB
YAML
109 lines
3.0 KiB
YAML
---
|
|
- name: Installation et configuration de Nginx
|
|
hosts: nginx
|
|
become: true
|
|
gather_facts: true
|
|
|
|
tasks:
|
|
- name: Installer Nginx
|
|
ansible.builtin.apt:
|
|
name: nginx
|
|
state: present
|
|
update_cache: yes
|
|
|
|
- name: Créer le répertoire frontend
|
|
ansible.builtin.file:
|
|
path: "{{ nginx_frontend_path }}"
|
|
state: directory
|
|
owner: www-data
|
|
group: www-data
|
|
mode: "0755"
|
|
|
|
- name: Créer le répertoire de logs
|
|
ansible.builtin.file:
|
|
path: /var/log/nginx
|
|
state: directory
|
|
owner: www-data
|
|
group: adm
|
|
mode: "0755"
|
|
|
|
- name: Supprimer la config par défaut
|
|
ansible.builtin.file:
|
|
path: /etc/nginx/sites-enabled/default
|
|
state: absent
|
|
|
|
- name: Créer la configuration Nginx
|
|
ansible.builtin.template:
|
|
src: ./templates/nginx.conf.j2
|
|
dest: /etc/nginx/sites-available/{{ nginx_app_name }}
|
|
notify: Recharger Nginx
|
|
|
|
- name: Activer la configuration
|
|
ansible.builtin.file:
|
|
src: /etc/nginx/sites-available/{{ nginx_app_name }}
|
|
dest: /etc/nginx/sites-enabled/{{ nginx_app_name }}
|
|
state: link
|
|
notify: Recharger Nginx
|
|
|
|
- name: Configurer Nginx global settings
|
|
lineinfile:
|
|
path: /etc/nginx/nginx.conf
|
|
regexp: "{{ item.regexp }}"
|
|
line: "{{ item.line }}"
|
|
insertafter: "http {"
|
|
loop:
|
|
- {
|
|
regexp: '^\s*server_tokens',
|
|
line: " server_tokens off;",
|
|
}
|
|
- {
|
|
regexp: '^\s*client_max_body_size',
|
|
line: " client_max_body_size {{ nginx_max_body_size }};",
|
|
}
|
|
notify: Recharger Nginx
|
|
|
|
- name: Tester la configuration Nginx
|
|
command: nginx -t
|
|
register: nginx_test
|
|
changed_when: false
|
|
|
|
- name: Afficher le résultat du test
|
|
debug:
|
|
var: nginx_test.stderr_lines
|
|
|
|
- name: Démarrer Nginx
|
|
ansible.builtin.systemd:
|
|
name: nginx
|
|
state: started
|
|
enabled: yes
|
|
|
|
- name: Configurer UFW - Autoriser HTTP
|
|
ansible.builtin.ufw:
|
|
rule: allow
|
|
port: "80"
|
|
proto: tcp
|
|
when: nginx_enable_firewall | default(true)
|
|
|
|
- name: Configurer UFW - Bloquer accès direct au backend
|
|
ansible.builtin.ufw:
|
|
rule: deny
|
|
port: "{{ backend_port }}"
|
|
proto: tcp
|
|
from_ip: any
|
|
when: nginx_enable_firewall | default(true)
|
|
|
|
- name: Configurer le tunnel
|
|
ansible.builtin.template:
|
|
src: tunnel.conf.j2
|
|
dest: /etc/tunnel.conf
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
notify: Recharger Nginx
|
|
|
|
handlers:
|
|
- name: Recharger Nginx
|
|
systemd:
|
|
name: nginx
|
|
state: reloaded
|