73 lines
2.1 KiB
Markdown
73 lines
2.1 KiB
Markdown
|
Overview
|
||
|
|
========
|
||
|
|
|
||
|
|
Role for using nginx. Sets up ssl certs in known locations and inactive
|
||
|
|
template for application use.
|
||
|
|
|
||
|
|
|
||
|
|
Role options
|
||
|
|
------------
|
||
|
|
* `update_ssl_certs` - Only push the SSL key and PEM files and restart Nginx
|
||
|
|
|
||
|
|
|
||
|
|
SSL
|
||
|
|
---
|
||
|
|
This role will copy over key/crt by default.
|
||
|
|
It can be disabled by setting `httpd_no_ssl` to true
|
||
|
|
|
||
|
|
You will still need to configure the application to use ssl. A reference template templates/example_ssl.conf.j2 is provided
|
||
|
|
|
||
|
|
The script will look for keys and certs in the paths specified by the
|
||
|
|
`httpd_ssl_key_file`, `httpd_ssl_crt_file` and `httpd_ssl_pem_file` variables.
|
||
|
|
|
||
|
|
If that fails, it will attempt to create key/crt pair if there isn't one already installed.
|
||
|
|
|
||
|
|
If a pem file exists in the location specified by `httpd_ssl_pem_file`,
|
||
|
|
it will be copied across as `ssl.pem`. Applications that required the certificate
|
||
|
|
chain should point at `/etc/nginx/conf.d/ssl.pem`.
|
||
|
|
|
||
|
|
Caveats
|
||
|
|
-------
|
||
|
|
The key, crt and pem will always be stored on the host under `/etc/nginx/conf.d/{{
|
||
|
|
inventory_hostname }}.{key,crt,pem}` due to the multi-sourcing nature of the setup.
|
||
|
|
Use `httpd_no_ssl` and setup as desired if it deviates from what is covered here.
|
||
|
|
|
||
|
|
Logrotate
|
||
|
|
---------
|
||
|
|
|
||
|
|
A default template is configured.
|
||
|
|
|
||
|
|
SELinux
|
||
|
|
-------
|
||
|
|
|
||
|
|
selinux contexts are application specific. Enable the following as needed by your setup:
|
||
|
|
|
||
|
|
```
|
||
|
|
httpd_can_network_relay
|
||
|
|
httpd_can_network_memcache
|
||
|
|
httpd_can_network_connect *
|
||
|
|
httpd_can_network_connect_db *
|
||
|
|
httpd_can_sendmail
|
||
|
|
```
|
||
|
|
|
||
|
|
- * commonly used items enabled by default
|
||
|
|
|
||
|
|
Handlers
|
||
|
|
--------
|
||
|
|
|
||
|
|
restart nginx - restart the nginx service
|
||
|
|
|
||
|
|
Variables
|
||
|
|
---------
|
||
|
|
|
||
|
|
* `service_name` - canonical name for service
|
||
|
|
* `httpd_no_ssl` - don't set up ssl
|
||
|
|
* `httpd_ssl_key_file` - local path to use as source for ssl.key file
|
||
|
|
* `httpd_ssl_crt_file` - local path to use as source for ssl.crt file
|
||
|
|
* `httpd_ssl_pem_file` - local path to use as source for ssl.pem file
|
||
|
|
* `ssl_fast_dh` - whether to use a speedy method to generate Diffie Hellman
|
||
|
|
parameters
|
||
|
|
* `ssl_intermediate_ca_pattern` - pattern to check if certificate is
|
||
|
|
self-signed
|
||
|
|
* `ssl_self_signed_string` - location and CN settings for self signed cert
|