nginx: Rename nginx/server to nginx

roles/nginx/templates/nginx-logrotate.sh

@@ -0,0 +1,25 @@
+#!/bin/sh
+
+set -e
+
+umask 022
+
+[ -f /var/run/nginx.pid ] || exit 0
+
+SUFFIX="$(date +%Y%m%d-%H%M%S)"
+LOGS=""
+
+for log in "{{ nginx_logdir }}"/*.log ; do
+    [ -s "$log" ] || continue
+    mv "$log" "${log}.${SUFFIX}"
+    LOGS="${LOGS} ${log}.${SUFFIX}"
+done
+
+[ -z "$LOGS" ] && exit 0
+
+kill -USR1 "$(cat /var/run/nginx.pid)"
+sleep 5
+
+for log in $LOGS ; do
+    gzip "$log"
+done

roles/nginx/templates/nginx.conf.j2

@@ -0,0 +1,73 @@
+
+user {{ nginx_user }};
+worker_processes auto;
+error_log {{ nginx_logdir }}/error.log warn;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    access_log {{ nginx_logdir }}/access.log combined;
+
+    proxy_ssl_certificate {{ tls_certs }}/{{ inventory_hostname }}.crt;
+    proxy_ssl_certificate_key {{ tls_private }}/{{ inventory_hostname }}.key;
+    proxy_ssl_trusted_certificate {{ tls_certs }}/ca.crt;
+    proxy_ssl_protocols TLSv1.2 TLSv1.3;
+    proxy_ssl_server_name on;
+    proxy_ssl_verify on;
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        '' close;
+    }
+    proxy_set_header Connection $connection_upgrade;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Host $host;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_http_version 1.1;
+
+{% if nginx_plaintext is defined %}
+    server {
+        listen 80;
+        listen [::]:80;
+        server_name {{ inventory_hostname }};
+
+        location /.well-known/acme-challenge/ {
+            proxy_pass https://certbot.home.foo.sh/.well-known/acme-challenge/;
+        }
+        location / {
+            return 301 https://$host$request_uri;
+        }
+    }
+{% else %}
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:MozSSL:10m;
+    ssl_session_tickets off;
+    ssl_dhparam {{ tls_certs }}/ffdhe3072.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+    ssl_prefer_server_ciphers off;
+
+    server {
+        listen 443 ssl http2;
+        listen [::]:443 ssl http2;
+        server_name {{ inventory_hostname }};
+
+        ssl_certificate {{ tls_certs }}/{{ inventory_hostname }}-fullchain.crt;
+        ssl_certificate_key {{ tls_private }}/{{ inventory_hostname }}.key;
+
+        ssl_client_certificate {{ tls_certs }}/ca.crt;
+        ssl_verify_client on;
+
+        root /srv/web/{{ inventory_hostname }};
+
+        include /etc/nginx/conf.d/{{ inventory_hostname }}/*.conf;
+    }
+
+    include /etc/nginx/mime.types;
+    include /etc/nginx/conf.d/*.conf;
+{% endif %}
+
+}