From bcc1e84553dcbb2cb63f0e990b386269b5c87940 Mon Sep 17 00:00:00 2001
From: Ivan Grynenko <ivan@salsadigital.com.au>
Date: Mon, 13 Jun 2016 13:31:43 +1000
Subject: [PATCH] Adding bigpipe support to nginx.

---
 tasks/main.yml            | 10 ++++++++++
 templates/headers.conf.j2 |  7 +++++++
 2 files changed, 17 insertions(+)
 create mode 100644 templates/headers.conf.j2

diff --git a/tasks/main.yml b/tasks/main.yml
index 2363838..b260532 100755
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -35,5 +35,15 @@
   notify:
     - reload nginx
 
+- name: Copy headers config file in place.
+  template:
+    src: headers.conf.j2
+    dest: "{{ nginx_conf_file_path }}/conf.d"
+    owner: root
+    group: "{{ root_group }}"
+    mode: 0644
+  notify:
+    - reload nginx
+
 - name: Ensure nginx is started and enabled to start at boot.
   service: name=nginx state=started enabled=yes
diff --git a/templates/headers.conf.j2 b/templates/headers.conf.j2
new file mode 100644
index 0000000..3dc3b46
--- /dev/null
+++ b/templates/headers.conf.j2
@@ -0,0 +1,7 @@
+{% if nginx_bigpipe_enable %}
+  add_header X-Accel-Buffering: no;
+{% endif %}
+add_header X-Frame-Options SAMEORIGIN;
+add_header X-Content-Type-Options nosniff;
+add_header X-XSS-Protection "1; mode=block";
+add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";