ansible-taler-exchange

commit 09d91cb418e92ed4592e393e6b0e99caea8cd008
parent c416ef11cce47fb225d1f0de3490310748123111
Author: Florian Dold <dold@taler.net>
Date:   Sat,  5 Sep 2026 20:12:09 +0200

Nginx: preserve enabled sites when configuration is invalid

Fail configuration validation without deleting enabled virtual hosts.
Validate before handler restarts and notify the handler when shared
nginx configuration changes.

Diffstat:
M
roles/monitoring/handlers/main.yml
 | 
9
++++++++-
M
roles/webserver/handlers/main.yml
 | 
11
+++++++++--
M
roles/webserver/tasks/main.yml
 | 
29
+++++------------------------

3 files changed, 22 insertions(+), 27 deletions(-)
diff --git a/roles/monitoring/handlers/main.yml b/roles/monitoring/handlers/main.yml
@@ -1,5 +1,12 @@
 ---
-- name: Restart nginx
+- name: Validate nginx before restart
+  ansible.builtin.command: nginx -c /etc/nginx/nginx.conf -t
+  changed_when: false
+  check_mode: false
+  listen: Restart nginx
+
+- name: Restart validated nginx
   ansible.builtin.service:
     name: nginx
     state: restarted
+  listen: Restart nginx
diff --git a/roles/webserver/handlers/main.yml b/roles/webserver/handlers/main.yml
@@ -1,5 +1,12 @@
 ---
-- name: Restart nginx
-  service:
+- name: Validate nginx before restart
+  ansible.builtin.command: nginx -c /etc/nginx/nginx.conf -t
+  changed_when: false
+  check_mode: false
+  listen: Restart nginx
+
+- name: Restart validated nginx
+  ansible.builtin.service:
     name: nginx
     state: restarted
+  listen: Restart nginx
diff --git a/roles/webserver/tasks/main.yml b/roles/webserver/tasks/main.yml
@@ -26,6 +26,7 @@
   file:
     path: /etc/nginx/sites-enabled/default
     state: absent
+  notify: Restart nginx
 
 - name: Setup extended log format
   copy:
@@ -34,6 +35,7 @@
     owner: root
     group: root
     mode: "0644"
+  notify: Restart nginx
 
 - name: Setup global HTTP2/HTTP3 configuration
   copy:
@@ -42,6 +44,7 @@
     owner: root
     group: root
     mode: "0644"
+  notify: Restart nginx
 
 - name: Setup per-server HTTP2/HTTP3 listen options
   copy:
@@ -50,34 +53,12 @@
     owner: root
     group: root
     mode: "0644"
+  notify: Restart nginx
 
-- name: Check nginx config
+- name: Validate nginx configuration without removing enabled sites
   ansible.builtin.command: nginx -c /etc/nginx/nginx.conf -t
-  register: result
   changed_when: false
   check_mode: false
-  ignore_errors: true
-
-- name: Clear all sites if nginx is misconfigured
-  when: result is failed
-  block:
-    - name: Locate enabled sites
-      find:
-        path: "/etc/nginx/sites-enabled"
-        file_type: "link"
-      register: cleanup
-      ignore_errors: true
-    - name: Delete enabled sites
-      file:
-        path: "{{ item.path }}"
-        state: absent
-      with_items: "{{ cleanup.files }}"
-      ignore_errors: true
-    - name: Report that the sites were cleared
-      ansible.builtin.debug:
-        msg: >-
-          Cleared all enabled sites, as the nginx config is broken.
-          They are re-created further down in this play.
 
 - name: Ensure Nginx service is enabled and started
   service: