Added nginx role and variable overrides.

pull/63/head
Ivan Grynenko 8 years ago
parent 628d177365
commit d37da2c09b
  1. 61
      lemp-rhel7/group_vars/all.yml
  2. 39
      lemp-rhel7/roles/ansible-role-nginx/.travis.yml
  3. 122
      lemp-rhel7/roles/ansible-role-nginx/README.md
  4. 68
      lemp-rhel7/roles/ansible-role-nginx/defaults/main.yml
  5. 10
      lemp-rhel7/roles/ansible-role-nginx/handlers/main.yml
  6. 30
      lemp-rhel7/roles/ansible-role-nginx/meta/main.yml
  7. 39
      lemp-rhel7/roles/ansible-role-nginx/tasks/main.yml
  8. 9
      lemp-rhel7/roles/ansible-role-nginx/tasks/setup-Debian.yml
  9. 13
      lemp-rhel7/roles/ansible-role-nginx/tasks/setup-FreeBSD.yml
  10. 14
      lemp-rhel7/roles/ansible-role-nginx/tasks/setup-RedHat.yml
  11. 14
      lemp-rhel7/roles/ansible-role-nginx/tasks/setup-Ubuntu.yml
  12. 26
      lemp-rhel7/roles/ansible-role-nginx/tasks/vhosts.yml
  13. 63
      lemp-rhel7/roles/ansible-role-nginx/templates/nginx.conf.j2
  14. 5
      lemp-rhel7/roles/ansible-role-nginx/templates/nginx.repo.j2
  15. 33
      lemp-rhel7/roles/ansible-role-nginx/templates/vhosts.j2
  16. 1
      lemp-rhel7/roles/ansible-role-nginx/tests/inventory
  17. 6
      lemp-rhel7/roles/ansible-role-nginx/tests/test.yml
  18. 9
      lemp-rhel7/roles/ansible-role-nginx/vars/Debian.yml
  19. 9
      lemp-rhel7/roles/ansible-role-nginx/vars/FreeBSD.yml
  20. 9
      lemp-rhel7/roles/ansible-role-nginx/vars/RedHat.yml
  21. 3
      lemp-rhel7/roles/nginx/handlers/main.yml
  22. 10
      lemp-rhel7/roles/nginx/tasks/main.yml
  23. 44
      lemp-rhel7/roles/nginx/templates/default.conf
  24. 2
      lemp-rhel7/site.yml

@ -59,3 +59,64 @@ php_packages:
- php-xmlrpc
- php-mcrypt
- php-pecl-uploadprogress
# Nginx vhosts configuration
nginx_vhosts:
- listen: "80 default_server"
server_name: "example.com www.example.com"
root: "/var/www/html/example.com"
open_file_cache: "max=2000 inactive=120s"
open_file_cache_valid: "240s"
open_file_cache_min_uses: "5"
open_file_cache_errors: "off"
client_max_body_size: "5m"
client_body_timeout: "60"
index: "index.php index.html index.htm"
error_page: ""
access_log: ""
error_log: ""
extra_parameters: |
location ~ \.php$ {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass unix:/var/run/php5-fpm.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
location = /favicon.ico {
log_not_found off;
access_log off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
location = /backup {
deny all;
}
location ~* \.(txt|log)$ {
allow 127.0.0.1;
deny all;
}
location ~ \..*/.*\.php$ {
return 403;
}
location ~ ^/sites/.*/files/styles/ {
try_files $uri @rewrite;
}
location ~ ^/sites/default/files/ {
try_files $uri @rewrite;
}
location ~* \.(gif|jpg|jpeg|png|ico|bmp|js|css|pdf|doc|webp|woff|ico|js|css)(\?[a-zA-Z0-9\.\-_,])?$ {
expires max;
log_not_found off;
add_header Cache-Control "public";
add_header X-Cache $upstream_cache_status;
}
error_page 403 =404;
location ~ /\. { access_log off; log_not_found off; deny all; }
location ~ ~$ { access_log off; log_not_found off; deny all; }
location ~ /\.ht {
deny all;
}

@ -0,0 +1,39 @@
---
sudo: required
language: python
python: "2.7"
env:
- SITE=test.yml
before_install:
- sudo apt-get update -qq
- sudo apt-get install -y curl
install:
# Install Ansible.
- pip install ansible
# Add ansible.cfg to pick up roles path.
- "{ echo '[defaults]'; echo 'roles_path = ../'; } >> ansible.cfg"
script:
# Check the role/playbook's syntax.
- "ansible-playbook -i tests/inventory tests/$SITE --syntax-check"
# Run the role/playbook with ansible-playbook.
- "ansible-playbook -i tests/inventory tests/$SITE --connection=local --sudo"
# Run the role/playbook again, checking to make sure it's idempotent.
- >
ansible-playbook -i tests/inventory tests/$SITE --connection=local --sudo
| grep -q 'changed=0.*failed=0'
&& (echo 'Idempotence test: pass' && exit 0)
|| (echo 'Idempotence test: fail' && exit 1)
# TODO - get the test working. Probably need to add a virtual host.
# Request a page via Nginx, to make sure Nginx is running and responds.
# - "curl http://localhost/"
notifications:
webhooks: https://galaxy.ansible.com/api/v1/notifications/

@ -0,0 +1,122 @@
# Ansible Role: Nginx
[![Build Status](https://travis-ci.org/geerlingguy/ansible-role-nginx.svg?branch=master)](https://travis-ci.org/geerlingguy/ansible-role-nginx)
Installs Nginx on RedHat/CentOS or Debian/Ubuntu Linux, or FreeBSD servers.
This role installs and configures the latest version of Nginx from the Nginx yum repository (on RedHat-based systems) or via apt (on Debian-based systems) or pkgng (on FreeBSD systems). You will likely need to do extra setup work after this role has installed Nginx, like adding your own [virtualhost].conf file inside `/etc/nginx/conf.d/`, describing the location and options to use for your particular website.
## Requirements
None.
## Role Variables
Available variables are listed below, along with default values (see `defaults/main.yml`):
nginx_vhosts: []
A list of vhost definitions (server blocks) for Nginx virtual hosts. If left empty, you will need to supply your own virtual host configuration. See the commented example in `defaults/main.yml` for available server options. If you have a large number of customizations required for your server definition(s), you're likely better off managing the vhost configuration file yourself, leaving this variable set to `[]`.
nginx_vhosts:
- listen: "80 default_server"
server_name: "example.com"
root: "/var/www/example.com"
index: "index.php index.html index.htm"
error_page: ""
access_log: ""
error_log: ""
extra_parameters: |
location ~ \.php$ {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass unix:/var/run/php5-fpm.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
An example of a fully-populated nginx_vhosts entry, using a `|` to declare a block of syntax for the `extra_parameters`.
nginx_remove_default_vhost: false
Whether to remove the 'default' virtualhost configuration supplied by Nginx. Useful if you want the base `/` URL to be directed at one of your own virtual hosts configured in a separate .conf file.
nginx_upstreams: []
If you are configuring Nginx as a load balancer, you can define one or more upstream sets using this variable. In addition to defining at least one upstream, you would need to configure one of your server blocks to proxy requests through the defined upstream (e.g. `proxy_pass http://myapp1;`). See the commented example in `defaults/main.yml` for more information.
nginx_user: "nginx"
The user under which Nginx will run. Defaults to `nginx` for RedHat, and `www-data` for Debian.
nginx_worker_processes: "1"
nginx_worker_connections: "1024"
nginx_multi_accept: "off"
`nginx_worker_processes` should be set to the number of cores present on your machine. Connections (find this number with `grep processor /proc/cpuinfo | wc -l`). `nginx_worker_connections` is the number of connections per process. Set this higher to handle more simultaneous connections (and remember that a connection will be used for as long as the keepalive timeout duration for every client!). You can set `nginx_multi_accept` to `on` if you want Nginx to accept all connections immediately.
nginx_error_log: "/var/log/nginx/error.log warn"
nginx_access_log: "/var/log/nginx/access.log main buffer=16k"
Configuration of the default error and access logs. Set to `off` to disable a log entirely.
nginx_sendfile: "on"
nginx_tcp_nopush: "on"
nginx_tcp_nodelay: "on"
TCP connection options. See [this blog post](https://t37.net/nginx-optimization-understanding-sendfile-tcp_nodelay-and-tcp_nopush.html) for more information on these directives.
nginx_keepalive_timeout: "65"
nginx_keepalive_requests: "100"
Nginx keepalive settings. Timeout should be set higher (10s+) if you have more polling-style traffic (AJAX-powered sites especially), or lower (<10s) if you have a site where most users visit a few pages and don't send any further requests.
nginx_client_max_body_size: "64m"
This value determines the largest file upload possible, as uploads are passed through Nginx before hitting a backend like `php-fpm`. If you get an error like `client intended to send too large body`, it means this value is set too low.
nginx_server_names_hash_bucket_size: "64"
If you have many server names, or have very long server names, you might get an Nginx error on startup requiring this value to be increased.
nginx_proxy_cache_path: ""
Set as the `proxy_cache_path` directive in the `nginx.conf` file. By default, this will not be configured (if left as an empty string), but if you wish to use Nginx as a reverse proxy, you can set this to a valid value (e.g. `"/var/cache/nginx keys_zone=cache:32m"`) to use Nginx's cache (further proxy configuration can be done in individual server configurations).
nginx_extra_http_options: ""
Extra lines to be inserted in the top-level `http` block in `nginx.conf`. The value should be defined literally (as you would insert it directly in the `nginx.conf`, adhering to the Nginx configuration syntax - such as `;` for line termination, etc.), for example:
nginx_extra_http_options: |
proxy_buffering off;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
nginx_default_release: ""
(For Debian/Ubuntu only) Allows you to set a different repository for the installation of Nginx. As an example, if you are running Debian's wheezy release, and want to get a newer version of Nginx, you can install the `wheezy-backports` repository and set that value here, and Ansible will use that as the `-t` option while installing Nginx.
nginx_ppa_use: false
nginx_ppa_version: stable
(For Ubuntu only) Allows you to use the official Nginx PPA instead of the system's package. You can set the version to `stable` or `development`.
## Dependencies
None.
## Example Playbook
- hosts: server
roles:
- { role: geerlingguy.nginx }
## License
MIT / BSD
## Author Information
This role was created in 2014 by [Jeff Geerling](http://jeffgeerling.com/), author of [Ansible for DevOps](http://ansiblefordevops.com/).

@ -0,0 +1,68 @@
---
# Used only for Debian/Ubuntu installation, as the -t option for apt.
nginx_default_release: ""
# Use the official Nginx PPA for Ubuntu, and the version to use if so.
nginx_ppa_use: false
nginx_ppa_version: stable
# The name of the nginx apt/yum package to install.
nginx_package_name: "nginx"
nginx_worker_processes: "auto"
nginx_worker_connections: "1024"
nginx_multi_accept: "off"
nginx_error_log: "/var/log/nginx/error.log warn"
nginx_access_log: "/var/log/nginx/access.log main buffer=16k"
nginx_sendfile: "on"
nginx_tcp_nopush: "on"
nginx_tcp_nodelay: "on"
nginx_keepalive_timeout: "65"
nginx_keepalive_requests: "100"
nginx_client_max_body_size: "64m"
nginx_server_names_hash_bucket_size: "64"
nginx_proxy_cache_path: ""
nginx_extra_conf_options: ""
# Example extra main options, used within the main nginx's context:
# nginx_extra_conf_options: |
# env VARIABLE;
# include /etc/nginx/main.d/*.conf;
nginx_extra_http_options: ""
# Example extra http options, printed inside the main server http config:
# nginx_extra_http_options: |
# proxy_buffering off;
# proxy_set_header X-Real-IP $remote_addr;
# proxy_set_header X-Scheme $scheme;
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# proxy_set_header Host $http_host;
nginx_remove_default_vhost: false
nginx_vhosts: []
# Example vhost below, showing all available options:
# - listen: "80 default_server" # default: "80 default_server"
# server_name: "example.com" # default: N/A
# root: "/var/www/example.com" # default: N/A
# index: "index.html index.htm" # default: "index.html index.htm"
#
# # Properties that are only added if defined:
# error_page: ""
# access_log: ""
# error_log: ""
# extra_parameters: "" # Can be used to add extra config blocks (multiline).
nginx_upstreams: []
# - name: myapp1
# strategy: "ip_hash" # "least_conn", etc.
# servers: {
# "srv1.example.com",
# "srv2.example.com weight=3",
# "srv3.example.com"
# }

@ -0,0 +1,10 @@
---
- name: restart nginx
service: name=nginx state=restarted
- name: validate nginx configuration
command: nginx -t -c /etc/nginx/nginx.conf
changed_when: False
- name: reload nginx
service: name=nginx state=reloaded

@ -0,0 +1,30 @@
---
dependencies: []
galaxy_info:
author: geerlingguy
description: Nginx installation for Linux and FreeBSD.
company: "Midwestern Mac, LLC"
license: "license (BSD, MIT)"
min_ansible_version: 1.8
platforms:
- name: EL
versions:
- 6
- 7
- name: Debian
versions:
- all
- name: Ubuntu
versions:
- all
- name: FreeBSD
versions:
- 10.3
- 10.2
- 10.1
- 10.0
- 9.3
galaxy_tags:
- development
- web

@ -0,0 +1,39 @@
---
# Variable setup.
- name: Include OS-specific variables.
include_vars: "{{ ansible_os_family }}.yml"
- name: Define nginx_user.
set_fact:
nginx_user: "{{ __nginx_user }}"
when: nginx_user is not defined
# Setup/install tasks.
- include: setup-RedHat.yml
when: ansible_os_family == 'RedHat'
- include: setup-Ubuntu.yml
when: ansible_distribution == 'Ubuntu'
- include: setup-Debian.yml
when: ansible_os_family == 'Debian'
- include: setup-FreeBSD.yml
when: ansible_os_family == 'FreeBSD'
# Vhost configuration.
- include: vhosts.yml
# Nginx setup.
- name: Copy nginx configuration in place.
template:
src: nginx.conf.j2
dest: "{{ nginx_conf_file_path }}"
owner: root
group: "{{ root_group }}"
mode: 0644
notify:
- reload nginx
- name: Ensure nginx is started and enabled to start at boot.
service: name=nginx state=started enabled=yes

@ -0,0 +1,9 @@
---
- name: Update apt cache.
apt: update_cache=yes cache_valid_time=86400
- name: Ensure nginx is installed.
apt:
name: "{{ nginx_package_name }}"
state: installed
default_release: "{{ nginx_default_release }}"

@ -0,0 +1,13 @@
---
- name: Update pkg cache.
shell: pkg update -f
- name: Ensure nginx is installed.
pkgng:
name: "{{ nginx_package_name }}"
state: present
- name: Create logs directory.
file:
path: /var/log/nginx
state: directory

@ -0,0 +1,14 @@
---
- name: Enable nginx repo.
template:
src: nginx.repo.j2
dest: /etc/yum.repos.d/nginx.repo
owner: root
group: root
mode: 0644
- name: Ensure nginx is installed.
yum:
name: "{{ nginx_package_name }}"
state: installed
enablerepo: nginx

@ -0,0 +1,14 @@
---
- name: Add PPA for Nginx.
apt_repository:
repo: 'ppa:nginx/{{ nginx_ppa_version }}'
state: present
update_cache: yes
register: nginx_ppa_added
when: nginx_ppa_use
- name: Ensure nginx will reinstall if the PPA was just added.
apt:
name: nginx
state: absent
when: nginx_ppa_added.changed

@ -0,0 +1,26 @@
---
- name: Remove default nginx vhost config file (if configured).
file:
path: "{{ nginx_default_vhost_path }}"
state: absent
when: nginx_remove_default_vhost
notify:
- reload nginx
- name: Add managed vhost config file (if any vhosts are configured).
template:
src: vhosts.j2
dest: "{{ nginx_vhost_path }}/vhosts.conf"
mode: 0644
when: nginx_vhosts|length > 0
notify:
- reload nginx
- name: Remove managed vhost config file (if no vhosts are configured).
file:
path: "{{ nginx_vhost_path }}/vhosts.conf"
state: absent
when: nginx_vhosts|length == 0
notify:
- reload nginx

@ -0,0 +1,63 @@
user {{ nginx_user }};
error_log {{ nginx_error_log }};
pid {{ nginx_pidfile }};
worker_processes {{ nginx_worker_processes }};
events {
worker_connections {{ nginx_worker_connections }};
multi_accept {{ nginx_multi_accept }};
}
{% if nginx_extra_conf_options %}
{{ nginx_extra_conf_options }}
{% endif %}
http {
include {{ nginx_mime_file_path }};
default_type application/octet-stream;
server_names_hash_bucket_size {{ nginx_server_names_hash_bucket_size }};
client_max_body_size {{ nginx_client_max_body_size }};
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log {{ nginx_access_log }};
sendfile {{ nginx_sendfile }};
tcp_nopush {{ nginx_tcp_nopush }};
tcp_nodelay {{ nginx_tcp_nodelay }};
keepalive_timeout {{ nginx_keepalive_timeout }};
keepalive_requests {{ nginx_keepalive_requests }};
#gzip on;
{% if nginx_proxy_cache_path %}
proxy_cache_path {{ nginx_proxy_cache_path }};
{% endif %}
{% if nginx_extra_http_options %}
{{ nginx_extra_http_options }}
{% endif %}
{% for upstream in nginx_upstreams %}
upstream {{ upstream.name }} {
{% if upstream.strategy is defined %}
{{ upstream.strategy }};
{% endif %}
{% for server in upstream.servers %}
server {{ server }};
{% endfor %}
}
{% endfor %}
include {{ nginx_conf_path }}/*.conf;
{% if nginx_conf_path != nginx_vhost_path %}
include {{ nginx_vhost_path }}/*;
{% endif %}
}

@ -0,0 +1,5 @@
[nginx]
name=nginx repo
baseurl=http://nginx.org/packages/centos/{{ ansible_distribution_major_version }}/$basearch/
gpgcheck=0
enabled=1

@ -0,0 +1,33 @@
{% for vhost in nginx_vhosts %}
server {
listen {{ vhost.listen | default('80 default_server') }};
{% if vhost.server_name is defined %}
server_name {{ vhost.server_name }};
{% endif %}
{% if vhost.root is defined %}
root {{ vhost.root }};
{% endif %}
index {{ vhost.index | default('index.html index.htm') }};
{% if vhost.error_page is defined %}
error_page {{ vhost.error_page }};
{% endif %}
{% if vhost.access_log is defined %}
access_log {{ vhost.access_log }};
{% endif %}
{% if vhost.error_log is defined %}
error_log {{ vhost.error_log }} error;
{% endif %}
{% if vhost.return is defined %}
return {{ vhost.return }};
{% endif %}
{% if vhost.extra_parameters is defined %}
{{ vhost.extra_parameters }}
{% endif %}
}
{% endfor %}

@ -0,0 +1,6 @@
---
- hosts: localhost
remote_user: root
roles:
- role: ansible-role-nginx
nginx_use_ppa: true

@ -0,0 +1,9 @@
---
root_group: root
nginx_conf_path: /etc/nginx/conf.d
nginx_conf_file_path: /etc/nginx/nginx.conf
nginx_mime_file_path: /etc/nginx/mime.types
nginx_pidfile: /run/nginx.pid
nginx_vhost_path: /etc/nginx/sites-enabled
nginx_default_vhost_path: /etc/nginx/sites-enabled/default
__nginx_user: "www-data"

@ -0,0 +1,9 @@
---
root_group: wheel
nginx_conf_path: /usr/local/etc/nginx/conf.d
nginx_conf_file_path: /usr/local/etc/nginx/nginx.conf
nginx_mime_file_path: /usr/local/etc/nginx/mime.types
nginx_pidfile: /var/run/nginx.pid
nginx_vhost_path: /usr/local/etc/nginx/sites-enabled
nginx_default_vhost_path: /usr/local/etc/nginx/sites-enabled/default
__nginx_user: "www"

@ -0,0 +1,9 @@
---
root_group: root
nginx_conf_path: /etc/nginx/conf.d
nginx_conf_file_path: /etc/nginx/nginx.conf
nginx_mime_file_path: /etc/nginx/mime.types
nginx_pidfile: /var/run/nginx.pid
nginx_vhost_path: /etc/nginx/conf.d
nginx_default_vhost_path: /etc/nginx/conf.d/default.conf
__nginx_user: "nginx"

@ -1,3 +0,0 @@
---
- name: restart nginx
service: name=nginx state=restarted enabled=yes

@ -1,10 +0,0 @@
---
- name: Install nginx
yum: name=nginx state=present
- name: Copy nginx configuration for wordpress
template: src=default.conf dest=/etc/nginx/conf.d/default.conf
notify: restart nginx
- name: http service state
service: name=nginx state=started enabled=yes

@ -1,44 +0,0 @@
server {
listen {{ nginx_port }} default_server;
server_name {{ server_hostname }};
root /srv/wordpress/ ;
client_max_body_size 64M;
# Deny access to any files with a .php extension in the uploads directory
location ~* /(?:uploads|files)/.*\.php$ {
deny all;
}
location ~ /\. {
access_log off; log_not_found off; deny all;
}
location ~ ~$ {
access_log off; log_not_found off; deny all;
}
location ~ /\.ht {
deny all;
}
location / {
index index.php index.html index.htm;
try_files $uri $uri/ /index.php?$args;
}
location ~* \.(jpg|jpeg|gif|css|png|js|ico|html|woff|woff2|svg|js)$ {
expires max;
access_log off;
}
location ~ \.php$ {
try_files $uri =404;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_index index.php;
fastcgi_pass unix:/var/run/php-fpm/wordpress.sock;
fastcgi_param SCRIPT_FILENAME
$document_root$fastcgi_script_name;
include fastcgi_params;
}
}

@ -7,5 +7,5 @@
roles:
- common
- mariadb
- nginx
- ansible-role-nginx
- ansible-role-php