From cae3561e42234602bf4f103fcdd0a1cc53f386ff Mon Sep 17 00:00:00 2001
From: Ivan Grynenko <ivan@salsadigital.com.au>
Date: Mon, 13 Jun 2016 13:31:43 +1000
Subject: [PATCH] Adding bigpipe support to nginx.

---
 lemp-rhel7/group_vars/all.yml                          |  3 +++
 lemp-rhel7/roles/ansible-role-nginx/tasks/main.yml     | 10 ++++++++++
 .../roles/ansible-role-nginx/templates/headers.conf.j2 |  7 +++++++
 3 files changed, 20 insertions(+)
 create mode 100644 lemp-rhel7/roles/ansible-role-nginx/templates/headers.conf.j2

diff --git a/lemp-rhel7/group_vars/all.yml b/lemp-rhel7/group_vars/all.yml
index f9580bd..3e8b878 100644
--- a/lemp-rhel7/group_vars/all.yml
+++ b/lemp-rhel7/group_vars/all.yml
@@ -14,6 +14,9 @@ php_date_timezone: "Australia/Melbourne"
 # Default user password for vmuser
 default_user_password: #uVOInGP&p<jfd}bkelLMEH!ZNRg$xiz
 
+# Whether to enable BigPipe
+nginx_bigpipe_enable: yes
+
 # DO NOT MODIFY BELOW THIS LINE.
 
 wp_version: 4.3
diff --git a/lemp-rhel7/roles/ansible-role-nginx/tasks/main.yml b/lemp-rhel7/roles/ansible-role-nginx/tasks/main.yml
index 2363838..b260532 100755
--- a/lemp-rhel7/roles/ansible-role-nginx/tasks/main.yml
+++ b/lemp-rhel7/roles/ansible-role-nginx/tasks/main.yml
@@ -35,5 +35,15 @@
   notify:
     - reload nginx
 
+- name: Copy headers config file in place.
+  template:
+    src: headers.conf.j2
+    dest: "{{ nginx_conf_file_path }}/conf.d"
+    owner: root
+    group: "{{ root_group }}"
+    mode: 0644
+  notify:
+    - reload nginx
+
 - name: Ensure nginx is started and enabled to start at boot.
   service: name=nginx state=started enabled=yes
diff --git a/lemp-rhel7/roles/ansible-role-nginx/templates/headers.conf.j2 b/lemp-rhel7/roles/ansible-role-nginx/templates/headers.conf.j2
new file mode 100644
index 0000000..3dc3b46
--- /dev/null
+++ b/lemp-rhel7/roles/ansible-role-nginx/templates/headers.conf.j2
@@ -0,0 +1,7 @@
+{% if nginx_bigpipe_enable %}
+  add_header X-Accel-Buffering: no;
+{% endif %}
+add_header X-Frame-Options SAMEORIGIN;
+add_header X-Content-Type-Options nosniff;
+add_header X-XSS-Protection "1; mode=block";
+add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";