main.yml (2060B)
1 --- 2 # Webserver role 3 4 - name: Install Nginx 5 apt: 6 name: nginx 7 state: present 8 update_cache: true 9 when: ansible_facts["os_family"] == 'Debian' 10 11 - name: Install certbot base package 12 apt: 13 name: certbot 14 state: present 15 update_cache: true 16 when: ansible_facts["os_family"] == 'Debian' 17 18 - name: Install certbot nginx plugin 19 apt: 20 name: python3-certbot-nginx 21 state: present 22 update_cache: true 23 when: ansible_facts["os_family"] == 'Debian' 24 25 - name: Remove default nginx configuration 26 file: 27 path: /etc/nginx/sites-enabled/default 28 state: absent 29 30 - name: Setup extended log format 31 copy: 32 src: etc/nginx/conf.d/log-format-apm.conf 33 dest: /etc/nginx/conf.d/log-format-apm.conf 34 owner: root 35 group: root 36 mode: "0644" 37 38 - name: Setup global HTTP2/HTTP3 configuration 39 copy: 40 src: etc/nginx/conf.d/http2-http3.conf 41 dest: /etc/nginx/conf.d/http2-http3.conf 42 owner: root 43 group: root 44 mode: "0644" 45 46 - name: Setup per-server HTTP2/HTTP3 listen options 47 copy: 48 src: etc/nginx/conf.d/listen.conf.inc 49 dest: /etc/nginx/conf.d/listen.conf.inc 50 owner: root 51 group: root 52 mode: "0644" 53 54 - name: Check nginx config 55 ansible.builtin.command: nginx -c /etc/nginx/nginx.conf -t 56 register: result 57 changed_when: false 58 ignore_errors: true 59 60 - name: Clear all sites if nginx is misconfigured 61 when: result is failed 62 block: 63 - name: Locate enabled sites 64 find: 65 path: "/etc/nginx/sites-enabled" 66 file_type: "link" 67 register: cleanup 68 ignore_errors: true 69 - name: Delete enabled sites 70 file: 71 path: "{{ item.path }}" 72 state: absent 73 with_items: "{{ cleanup.files }}" 74 ignore_errors: true 75 - name: Report that the sites were cleared 76 ansible.builtin.debug: 77 msg: >- 78 Cleared all enabled sites, as the nginx config is broken. 79 They are re-created further down in this play. 80 81 - name: Ensure Nginx service is enabled and started 82 service: 83 name: nginx 84 state: started 85 enabled: true