Initial version

.ansible-lint

@@ -0,0 +1,15 @@
+---
+skip_list:
+  - git-latest
+  - package-latest
+  - fqcn[action]
+  - fqcn[action-core]
+  - yaml[comments] # TODO how do I restrict this to just require-starting-space?
+  - yaml[line-length]
+  - name # this is covered by yamllint with exceptions on include_role
+  - risky-shell-pipe
+  - schema[tasks] # TODO ansible-lint randomly complains, e.g. it/tftpd
+  - role-name
+  - schema[meta] # TODO ansible-lint believes the official dependency syntax is wrong
+  - meta-no-info # we leave platform empty
+  - var-naming[no-role-prefix] # warns even for include_role vars

.gitattributes

@@ -0,0 +1 @@
+*.yml linguist-detectable=true

.githooks/pre-commit

@@ -0,0 +1,4 @@
+#!/bin/bash
+
+yamllint --strict .
+ansible-lint --strict --offline

.github/workflows/almalinux-8.yml

@@ -0,0 +1,25 @@
+---
+name: AlmaLinux 8
+
+on: # yamllint disable-line rule:truthy
+  push:
+    branches:
+      - main
+      - master
+  pull_request:
+    branches: []
+
+jobs:
+  ansible-ci:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Obtain sources
+        uses: actions/checkout@v3
+      - name: Test Galaxy role
+        run: >
+            CONT_ID=$(podman run --rm -v ${{ github.workspace }}:/repo -v /sys/fs/cgroup:/sys/fs/cgroup:ro
+            --tmpfs /tmp --tmpfs /run --privileged --detach bviktor/ansible-systemd-almalinux:8) &&
+            podman exec ${CONT_ID} /bin/bash -c
+            "if [ -f requirements.yml ]; then ansible-galaxy role install --force -r requirements.yml -p ..; fi &&
+            ANSIBLE_ROLES_PATH=.. ANSIBLE_FORCE_COLOR=true ansible-playbook tests/main.yml" &&
+            podman stop ${CONT_ID}

.github/workflows/almalinux-9.yml

@@ -0,0 +1,25 @@
+---
+name: AlmaLinux 9
+
+on: # yamllint disable-line rule:truthy
+  push:
+    branches:
+      - main
+      - master
+  pull_request:
+    branches: []
+
+jobs:
+  ansible-ci:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Obtain sources
+        uses: actions/checkout@v3
+      - name: Test Galaxy role
+        run: >
+            CONT_ID=$(podman run --rm -v ${{ github.workspace }}:/repo -v /sys/fs/cgroup:/sys/fs/cgroup:ro
+            --tmpfs /tmp --tmpfs /run --privileged --detach bviktor/ansible-systemd-almalinux:9) &&
+            podman exec ${CONT_ID} /bin/bash -c
+            "if [ -f requirements.yml ]; then ansible-galaxy role install --force -r requirements.yml -p ..; fi &&
+            ANSIBLE_ROLES_PATH=.. ANSIBLE_FORCE_COLOR=true ansible-playbook tests/main.yml" &&
+            podman stop ${CONT_ID}

.github/workflows/fedora-38.yml

@@ -0,0 +1,25 @@
+---
+name: Fedora 38
+
+on: # yamllint disable-line rule:truthy
+  push:
+    branches:
+      - main
+      - master
+  pull_request:
+    branches: []
+
+jobs:
+  ansible-ci:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Obtain sources
+        uses: actions/checkout@v3
+      - name: Test Galaxy role
+        run: >
+            CONT_ID=$(podman run --rm -v ${{ github.workspace }}:/repo -v /sys/fs/cgroup:/sys/fs/cgroup:ro
+            --tmpfs /tmp --tmpfs /run --privileged --detach bviktor/ansible-systemd-fedora:38) &&
+            podman exec ${CONT_ID} /bin/bash -c
+            "if [ -f requirements.yml ]; then ansible-galaxy role install --force -r requirements.yml -p ..; fi &&
+            ANSIBLE_ROLES_PATH=.. ANSIBLE_FORCE_COLOR=true ansible-playbook tests/main.yml" &&
+            podman stop ${CONT_ID}

.github/workflows/fedora-39.yml

@@ -0,0 +1,25 @@
+---
+name: Fedora 39
+
+on: # yamllint disable-line rule:truthy
+  push:
+    branches:
+      - main
+      - master
+  pull_request:
+    branches: []
+
+jobs:
+  ansible-ci:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Obtain sources
+        uses: actions/checkout@v3
+      - name: Test Galaxy role
+        run: >
+            CONT_ID=$(podman run --rm -v ${{ github.workspace }}:/repo -v /sys/fs/cgroup:/sys/fs/cgroup:ro
+            --tmpfs /tmp --tmpfs /run --privileged --detach bviktor/ansible-systemd-fedora:39) &&
+            podman exec ${CONT_ID} /bin/bash -c
+            "if [ -f requirements.yml ]; then ansible-galaxy role install --force -r requirements.yml -p ..; fi &&
+            ANSIBLE_ROLES_PATH=.. ANSIBLE_FORCE_COLOR=true ansible-playbook tests/main.yml" &&
+            podman stop ${CONT_ID}

.github/workflows/lint.yml

@@ -0,0 +1,23 @@
+---
+name: Lint
+
+on: # yamllint disable-line rule:truthy
+  push:
+    branches:
+      - main
+      - master
+  pull_request:
+    branches: []
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Obtain sources
+        uses: actions/checkout@v3
+      - name: Lint sources
+        run: >
+            podman run --rm -v ${{ github.workspace }}:/repo bviktor/ansible-systemd-lint:latest /bin/bash -c
+            "git config --global --add safe.directory /repo &&
+            yamllint --strict . &&
+            ansible-lint --strict"

.github/workflows/ubuntu-18.04.yml

@@ -0,0 +1,25 @@
+---
+name: Ubuntu 18.04
+
+on: # yamllint disable-line rule:truthy
+  push:
+    branches:
+      - main
+      - master
+  pull_request:
+    branches: []
+
+jobs:
+  ansible-ci:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Obtain sources
+        uses: actions/checkout@v3
+      - name: Test Galaxy role
+        run: >
+            CONT_ID=$(podman run --rm -v ${{ github.workspace }}:/repo -v /sys/fs/cgroup:/sys/fs/cgroup:ro
+            --tmpfs /tmp --tmpfs /run --privileged --detach bviktor/ansible-systemd-ubuntu:18.04) &&
+            podman exec ${CONT_ID} /bin/bash -c
+            "if [ -f requirements.yml ]; then ansible-galaxy role install --force -r requirements.yml -p ..; fi &&
+            ANSIBLE_ROLES_PATH=.. ANSIBLE_FORCE_COLOR=true ansible-playbook tests/main.yml" &&
+            podman stop ${CONT_ID}

.github/workflows/ubuntu-20.04.yml

@@ -0,0 +1,25 @@
+---
+name: Ubuntu 20.04
+
+on: # yamllint disable-line rule:truthy
+  push:
+    branches:
+      - main
+      - master
+  pull_request:
+    branches: []
+
+jobs:
+  ansible-ci:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Obtain sources
+        uses: actions/checkout@v3
+      - name: Test Galaxy role
+        run: >
+            CONT_ID=$(podman run --rm -v ${{ github.workspace }}:/repo -v /sys/fs/cgroup:/sys/fs/cgroup:ro
+            --tmpfs /tmp --tmpfs /run --privileged --detach bviktor/ansible-systemd-ubuntu:20.04) &&
+            podman exec ${CONT_ID} /bin/bash -c
+            "if [ -f requirements.yml ]; then ansible-galaxy role install --force -r requirements.yml -p ..; fi &&
+            ANSIBLE_ROLES_PATH=.. ANSIBLE_FORCE_COLOR=true ansible-playbook tests/main.yml" &&
+            podman stop ${CONT_ID}

.github/workflows/ubuntu-22.04.yml

@@ -0,0 +1,25 @@
+---
+name: Ubuntu 22.04
+
+on: # yamllint disable-line rule:truthy
+  push:
+    branches:
+      - main
+      - master
+  pull_request:
+    branches: []
+
+jobs:
+  ansible-ci:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Obtain sources
+        uses: actions/checkout@v3
+      - name: Test Galaxy role
+        run: >
+            CONT_ID=$(podman run --rm -v ${{ github.workspace }}:/repo -v /sys/fs/cgroup:/sys/fs/cgroup:ro
+            --tmpfs /tmp --tmpfs /run --privileged --detach bviktor/ansible-systemd-ubuntu:22.04) &&
+            podman exec ${CONT_ID} /bin/bash -c
+            "if [ -f requirements.yml ]; then ansible-galaxy role install --force -r requirements.yml -p ..; fi &&
+            ANSIBLE_ROLES_PATH=.. ANSIBLE_FORCE_COLOR=true ansible-playbook tests/main.yml" &&
+            podman stop ${CONT_ID}

.yamllint

@@ -0,0 +1,10 @@
+---
+extends: default
+
+rules:
+  braces:
+    max-spaces-inside: 1
+  comments:
+    min-spaces-from-content: 1
+    require-starting-space: false
+  line-length: disable

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Viktor Berke
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,77 @@
+# noobient.nginx
+
+## Synopsys
+
+This role installs nginx and configures hosts.
+
+## Parameters
+
+| Name | Required | Example | Description |
+|---|---|---|---|
+| `domain` | yes | `foo.com` | Domain to host. |
+| `mode` | yes | `wordpress` | Hosting mode. Possible values are `dirlist`, `php`, `proxy`, `redirect`, `static`, `wordpress`. |
+| `path` | no | `/var/www/html/noobient.com` | Document root. Defaults to `/var/www/html/<domain>` for `php`, `static`, and `wordpress`, ignored otherwise. |
+| `www_mode` | no | `redirect` | Possible values are `redirect` and `serve`, to redirect `www.<domain>` requests to `<domain>` or serve them as is, respectively. Defaults to `redirect`. Ignored when `mode` is set to `redirect`. |
+| `new_domain` | no | `foobar.com` | New domain to redirect to. Mandatory for `redirect`, ignored otherwise. |
+| `ssl_disabled` | no | `true` | `true` or `false`. Defaults to `false`. |
+| `ssl_key` | no | `/etc/acme/noobient.com/noobient.com.key` | Full path to SSL key file. Defaults to `/etc/acme/<domain>/<domain>.key`. Ignored if `ssl_disabled` is `true`. |
+| `ssl_cert` | no | `/etc/acme/noobient.com/fullchain.cer` | Full path to SSL full chain file. Defaults to `/etc/acme/<domain>/fulllchain.cer`. Ignored if `ssl_disabled` is `true`. |
+| `host_port` | no | `8888` | Listen on custom port. Defaults to `80` when `ssl_disabled` is `true`, or `443` otherwise. |
+| `proxy_port` | no | `9999` | Port of the app being proxied, when `mode` is set to `proxy`, ignored otherwise. Defaults to `8080`. |
+
+## Examples
+
+```yml
+# Barebones
+- include_role:
+    name: noobient.nginx
+  vars:
+    domain: foo.com
+    mode: wordpress
+
+# Serve static pages both on foo.com and www.foo.com, with custom content path
+- include_role:
+    name: noobient.nginx
+  vars:
+    domain: foo.com
+    mode: static
+    path: /data/content/foo.com
+    www_mode: serve
+
+# Redirect foo.com and www.foo.com to bar.com without SSL
+- include_role:
+    name: noobient.nginx
+  vars:
+    domain: foo.com
+    mode: redirect
+    new_domain: bar.com
+    ssl_disabled: true
+
+# Proxy the app running on port 9999, use custom SSL paths, and serve on port 8888
+- include_role:
+    name: noobient.nginx
+  vars:
+    domain: foo.com
+    mode: proxy
+    ssl_key: /opt/acme/privkey.pem
+    ssl_cert: /opt/acme/fullchain.pem
+    host_port: 8888
+    proxy_port: 9999
+```
+
+## Return Values
+
+N/A
+
+## Support
+
+| Platform | Support | Status |
+|---|---|---|
+| Linter | ✅ | [![Lint](https://github.com/noobient/ansible-galaxy-nginx/actions/workflows/lint.yml/badge.svg)](https://github.com/noobient/ansible-galaxy-nginx/actions/workflows/lint.yml) |
+| AlmaLinux 8 | ✅ | [![AlmaLinux 8](https://github.com/noobient/ansible-galaxy-nginx/actions/workflows/almalinux-8.yml/badge.svg)](https://github.com/noobient/ansible-galaxy-nginx/actions/workflows/almalinux-8.yml) |
+| AlmaLinux 9 | ✅ | [![AlmaLinux 9](https://github.com/noobient/ansible-galaxy-nginx/actions/workflows/almalinux-9.yml/badge.svg)](https://github.com/noobient/ansible-galaxy-nginx/actions/workflows/almalinux-9.yml) |
+| Fedora 38 | ✅ | [![Fedora 38](https://github.com/noobient/ansible-galaxy-nginx/actions/workflows/fedora-38.yml/badge.svg)](https://github.com/noobient/ansible-galaxy-nginx/actions/workflows/fedora-38.yml) |
+| Fedora 39 | ✅ | [![Fedora 39](https://github.com/noobient/ansible-galaxy-nginx/actions/workflows/fedora-39.yml/badge.svg)](https://github.com/noobient/ansible-galaxy-nginx/actions/workflows/fedora-39.yml) |
+| Ubuntu 18.04 | ✅ | [![Ubuntu 18.04](https://github.com/noobient/ansible-galaxy-nginx/actions/workflows/ubuntu-18.04.yml/badge.svg)](https://github.com/noobient/ansible-galaxy-nginx/actions/workflows/ubuntu-18.04.yml) |
+| Ubuntu 20.04 | ✅ | [![Ubuntu 20.04](https://github.com/noobient/ansible-galaxy-nginx/actions/workflows/ubuntu-20.04.yml/badge.svg)](https://github.com/noobient/ansible-galaxy-nginx/actions/workflows/ubuntu-20.04.yml) |
+| Ubuntu 22.04 | ✅ | [![Ubuntu 22.04](https://github.com/noobient/ansible-galaxy-nginx/actions/workflows/ubuntu-22.04.yml/badge.svg)](https://github.com/noobient/ansible-galaxy-nginx/actions/workflows/ubuntu-22.04.yml) |

handlers/main.yml

@@ -0,0 +1,4 @@
+---
+- name: Reload nginx # noqa no-changed-when
+  shell:
+    cmd: nginx -t && systemctl restart nginx.service

meta/main.yml

@@ -0,0 +1,9 @@
+---
+galaxy_info:
+  role_name: nginx
+  author: Viktor Berke
+  description: Install and configure nginx
+  license: license (MIT)
+  min_ansible_version: '2.10'
+  platforms: []
+  galaxy_tags: []

meta/requirements.yml

@@ -0,0 +1,2 @@
+---
+- name: noobient.selinux_cil

requirements.yml

@@ -0,0 +1,2 @@
+---
+- src: noobient.selinux_cil

tasks/config.yml

@@ -0,0 +1,38 @@
+---
+# dsaparam: https://security.stackexchange.com/questions/95178/diffie-hellman-parameters-still-calculating-after-24-hours
+- name: Create dhparam file
+  command:
+    cmd: "openssl dhparam -dsaparam -out {{ nginx_root }}/dh4096.pem 4096"
+    creates: "{{ nginx_root }}/dh4096.pem"
+  notify: Reload nginx
+
+- name: Deploy nginx config files
+  template:
+    src: "{{ ng_conf_item }}.j2"
+    dest: "{{ nginx_root }}/{{ ng_conf_item }}"
+    owner: root
+    group: root
+    mode: '0644'
+    backup: true
+  loop:
+    - dos.conf
+    - nginx.conf
+    - php.conf
+    - ssl.conf
+  loop_control:
+    loop_var: ng_conf_item
+  notify: Reload nginx
+
+- name: Create enabled host folder
+  file:
+    path: "{{ nginx_root }}/conf.d-enabled"
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+
+- include_role:
+    name: noobient.selinux_cil
+  vars:
+    module: noobient-nginx
+  register: noobient_nginx_configured