{% if ansible_os_family == "RedHat" %} include /usr/share/nginx/modules/mod-http-xslt-filter.conf; {% endif %} user {{ nginx_user }}; worker_processes auto; error_log {{ nginx_logdir }}/error.log; events { worker_connections 1024; } http { log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" $host'; access_log {{ nginx_logdir }}/access.log main; ssl on; ssl_session_timeout 1d; ssl_session_cache shared:MozSSL:10m; ssl_session_tickets off; ssl_protocols {{ tls_protocols }}; ssl_ciphers {{ tls_ciphers }}; ssl_prefer_server_ciphers off; server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name {{ inventory_hostname }}; ssl_certificate {{ tls_certs }}/{{ inventory_hostname }}-fullchain.crt; ssl_certificate_key {{ tls_private }}/{{ inventory_hostname }}.key; ssl_client_certificate {{ tls_certs }}/ca.crt; ssl_verify_client on; root /srv/web/{{ inventory_hostname }}; include /etc/nginx/conf.d/{{ inventory_hostname }}/*.conf; } include /etc/nginx/mime.types; include /etc/nginx/conf.d/*.conf; }