commit 43b6c31b6eb77ffa780394f8f97bca570bdb5fde Author: Knut Ahlers Date: Mon Dec 25 11:46:51 2017 +0100 Initial version Signed-off-by: Knut Ahlers diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..57bc88a --- /dev/null +++ b/LICENSE @@ -0,0 +1,202 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + diff --git a/README.md b/README.md new file mode 100644 index 0000000..a19441b --- /dev/null +++ b/README.md @@ -0,0 +1,14 @@ +# luzifer-ansible / nginx-letsencrypt + +This role installs nginx and [nginx-letsencrypt](https://github.com/Luzifer/nginx-letsencrypt) on the host and writes the nginx configuration to be used. + +## Requirements + +- Debian >= 8 (jessie) +- Ubuntu >= 16.04 (xenial) + +## Usage + +See the [Ansible Galaxy Intro](https://galaxy.ansible.com/intro) for usage of roles within Ansible Galaxy. + +For configuration variables and how to use them see [defaults/main.yml](defaults/main.yml). diff --git a/defaults/main.yml b/defaults/main.yml new file mode 100644 index 0000000..f29a7d2 --- /dev/null +++ b/defaults/main.yml @@ -0,0 +1,10 @@ +--- + +nginx_letsencrypt_buffer: 720h +nginx_letsencrypt_email: mail@example.com +nginx_letsencrypt_log_level: debug +nginx_letsencrypt_port: 5002 +nginx_letsencrypt_storage_dir: /data/ssl +nginx_letsencrypt_version: v0.1.4 + +... diff --git a/meta/main.yml b/meta/main.yml new file mode 100644 index 0000000..7bf7f29 --- /dev/null +++ b/meta/main.yml @@ -0,0 +1,38 @@ +--- +galaxy_info: + author: Knut Ahlers + description: | + Install and configure nginx and nginx-letsencrypt wrapper on host + + license: Apache + min_ansible_version: 2.3 + + platforms: + - name: Ubuntu + versions: + - xenial + - name: Debian + versions: + - jessie + - stretch + + categories: + #- cloud + #- cloud:ec2 + #- cloud:gce + #- cloud:rax + #- clustering + #- database + #- database:nosql + #- database:sql + #- development + #- monitoring + #- networking + #- packaging + #- system + - web + +dependencies: [] + # List your role dependencies here, one per line. + # Be sure to remove the '[]' above if you add dependencies + # to this list. diff --git a/tasks/main.yml b/tasks/main.yml new file mode 100644 index 0000000..f38fb69 --- /dev/null +++ b/tasks/main.yml @@ -0,0 +1,60 @@ +--- + +- name: Install nginx package + apt: + name: nginx + +- name: Ensure nginx service is disabled and stopped + systemd: + name: nginx + enabled: false + state: stopped + +- name: Get current nginx-letsencrypt version + shell: "/usr/local/bin/nginx-letsencrypt --version || true" + check_mode: no + register: nginx_letsencrypt_version_cmd + +- name: Download nginx-letsencrypt release + get_url: + url: "https://github.com/Luzifer/nginx-letsencrypt/releases/download/{{ nginx_letsencrypt_version }}/nginx-letsencrypt_linux_amd64" + dest: /usr/local/bin/nginx-letsencrypt + force: true + mode: 0755 + when: nginx_letsencrypt_version not in nginx_letsencrypt_version_cmd.stdout + register: nginx_letsencrypt_binary + +- name: Install modified nginx config + template: + src: nginx.conf.j2 + dest: /etc/nginx/nginx.conf + +- name: Install system.d service + copy: + content: | + [Unit] + Description=nginx wrapper with LetsEncrypt certificate management + After=network-online.target + Requires=network-online.target + + [Service] + Restart=always + ExecStart=/usr/local/bin/nginx-letsencrypt \ + --email {{ nginx_letsencrypt_email }} \ + --nginx-config /etc/nginx/nginx.conf \ + --storage-dir {{ nginx_letsencrypt_storage_dir }} \ + --log-level {{ nginx_letsencrypt_log_level }} \ + --buffer {{ nginx_letsencrypt_buffer }} \ + --listen-http :{{ nginx_letsencrypt_port }} + + [Install] + WantedBy=multi-user.target + dest: /etc/systemd/system/nginx-letsencrypt.service + register: nginx_letsencrypt_service + +- name: Restart and enable nginx-letsencrypt service + systemd: + name: nginx-letsencrypt + enabled: true + state: restarted + when: nginx_letsencrypt_binary.changed or nginx_letsencrypt_service.changed diff --git a/templates/nginx.conf.j2 b/templates/nginx.conf.j2 new file mode 100644 index 0000000..74afdbf --- /dev/null +++ b/templates/nginx.conf.j2 @@ -0,0 +1,126 @@ +include /etc/nginx/modules-enabled/*.conf; + +user {{ nginx_letsencrypt_config.user | default('www-data') }}; +worker_processes {{ nginx_letsencrypt_config.worker_processes | default('auto') }}; +pid {{ nginx_letsencrypt_config.pid_file | default('/run/nginx.pid') }}; + +events { + worker_connections {{ nginx_letsencrypt_config.worker_connections | default('768') }}; + multi_accept {{ nginx_letsencrypt_config.multi_accept | default('off') }}; +} + +http { + + ## + # Basic Settings + ## + + resolver {{ nginx_letsencrypt_config.resolver | default('127.0.0.1 ipv6=off') }}; + sendfile {{ nginx_letsencrypt_config.sendfile | default('on') }}; + tcp_nopush {{ nginx_letsencrypt_config.tcp_nopush | default('on') }}; + tcp_nodelay {{ nginx_letsencrypt_config.tcp_nodelay | default('on') }}; + keepalive_timeout {{ nginx_letsencrypt_config.keepalive_timeout | default('65') }}; + types_hash_max_size {{ nginx_letsencrypt_config.types_hash_max_size | default('2048') }}; + server_tokens {{ nginx_letsencrypt_config.server_tokens | default('off') }}; + + include /etc/nginx/mime.types; + default_type application/octet-stream; + + ## + # SSL Settings + ## + + ssl_protocols {{ nginx_letsencrypt_config.ssl_protocols | default('TLSv1.2') }}; + ssl_ciphers {{ nginx_letsencrypt_config.ssl_ciphers | default('ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256') }}; + ssl_prefer_server_ciphers {{ nginx_letsencrypt_config.ssl_prefer_server_ciphers | default('on') }}; + ssl_buffer_size {{ nginx_letsencrypt_config.ssl_buffer_size | default('8k') }}; + ssl_stapling {{ nginx_letsencrypt_config.ssl_stapling | default('on') }}; + ssl_stapling_verify {{ nginx_letsencrypt_config.ssl_stapling_verify | default('on') }}; + + ## + # Logging Settings + ## + + log_format combined_w_host '$remote_addr - $remote_user [$time_local] ' + '"$request" $status $body_bytes_sent ' + '"$http_referer" "$http_user_agent" "$http_host"'; + + access_log /var/log/nginx/access.log combined_w_host; + error_log /var/log/nginx/error.log; + + ## + # Gzip Settings + ## + + gzip {{ nginx_letsencrypt_config.gzip | default('on') }}; + gzip_disable {{ nginx_letsencrypt_config.gzip_disable | default('"msie6"') }}; + gzip_comp_level {{ nginx_letsencrypt_config.gzip_comp_level | default('1') }}; + gzip_proxied {{ nginx_letsencrypt_config.gzip_proxied | default('off') }}; + gzip_min_length {{ nginx_letsencrypt_config.gzip_min_length | default('20') }}; + gzip_vary {{ nginx_letsencrypt_config.gzip_vary | default('off') }}; + gzip_types {{ nginx_letsencrypt_config.gzip_types | default('text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript')}}; + + ## + # Custom settings + ## + +{% if nginx_letsencrypt_config.http_lines is defined %} +{% for line in nginx_letsencrypt_config.http_lines %} + {{ line }} +{% endfor %} +{% endif %} + + ## + # Plain HTTP forwarder / ACME challenge forwarder + ## + + server { + listen 80 default_server; + listen [::]:80 default_server; + + # Forward acme challenges to nginx-letsencrypt daemon + location ~ /.well-known/acme-challenge { + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $remote_addr; + proxy_pass http://127.0.0.1:{{ nginx_letsencrypt_port }}; + } + + location / { + return 301 https://$host$request_uri; + } + } + + ### + # Custom servers + ### +{% for server in nginx_letsencrypt_config.servers %} + + server { +{% for listen in server.listen %} + listen {{ listen }}; +{% endfor %} + server_name {{ server.server_names | default([server.server_name]) | join(' ') }}; +{% if server.server_lines is defined %} + +{% for line in server.server_lines %} + {{ line }} +{% endfor %} +{% endif %} +{% for location in server.locations | default([]) %} + + location {{ location.path }} { +{% for line in location.location_lines %} + {{ line }} +{% endfor %} +{% if location.target is defined %} + + return 301 {{ location.target }}{{ location.target_path | default('$request_uri') }}; +{% endif %} + } +{% endfor %} + } +{% endfor %} + +} + +# vim: set ft=nginx: