Vhost static OK (dirty)

templates/etc/nginx/helpers/no-ht.j2

@@ -0,0 +1,10 @@
+#
+# {{ ansible_managed }}
+#
+
+location  ~ /\.ht {
+	deny all;
+}
+
+
+# vim:filetype=nginx

templates/etc/nginx/helpers/php.j2

@@ -0,0 +1,19 @@
+#
+# {{ ansible_managed }}
+#
+
+location ~ \.php$ {
+	fastcgi_pass php;
+	fastcgi_index index.php;
+	fastcgi_intercept_errors on;
+	include fastcgi_params;
+
+	# TODO...
+	# Newrelic custom header: https://docs.newrelic.com/docs/apm/other-features/request-queueing/request-queue-server-configuration-examples
+	#fastcgi_param HTTP_X_REQUEST_START "t=${msec}";
+	# Newrelic custom PHP appname: https://docs.newrelic.com/docs/agents/php-agent/configuration/php-directory-ini-settings#perdir-nginx
+	#fastcgi_param PHP_VALUE "newrelic.appname=${host}";
+}
+
+
+# vim:filetype=nginx

templates/etc/nginx/helpers/ssl-legacy.j2

@@ -0,0 +1,18 @@
+#
+# {{ ansible_managed }}
+#
+
+ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
+ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+ssl_prefer_server_ciphers on;
+ssl_session_cache shared:SSL:10m;
+add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
+add_header X-Frame-Options DENY;
+add_header X-Content-Type-Options nosniff;
+ssl_stapling on;
+ssl_stapling_verify on;
+resolver {{ nginx_resolver.hosts | default(['208.67.222.222', '208.67.220.220']) | join(' ') }} valid={{ nginx_resolver.valid}}s;
+resolver_timeout {{ nginx_resolver.timeout }}s;
+
+
+# vim:filetype=nginx

templates/etc/nginx/helpers/ssl-strong.j2

@@ -0,0 +1,18 @@
+#
+# {{ ansible_managed }}
+#
+
+ssl_ciphers "AES256+EECDH:AES256+EDH";
+ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+ssl_prefer_server_ciphers on;
+ssl_session_cache shared:SSL:10m;
+add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
+add_header X-Frame-Options DENY;
+add_header X-Content-Type-Options nosniff;
+ssl_stapling on;
+ssl_stapling_verify on;
+resolver {{ nginx_resolver.hosts | default(['208.67.222.222', '208.67.220.220']) | join(' ') }} valid={{ nginx_resolver.valid}}s;
+resolver_timeout {{ nginx_resolver.timeout }}s;
+
+
+# vim:filetype=nginx

templates/etc/nginx/helpers/static-expires.j2

@@ -0,0 +1,10 @@
+#
+# {{ ansible_managed }}
+#
+
+location ~* \.(txt|js|css|png|jpg|jpeg|gif|ico|svg)$ {
+	expires 30d;
+	log_not_found off;
+}
+
+# vim:filetype=nginx

templates/etc/nginx/nginx.conf.j2

@@ -0,0 +1,30 @@
+#
+# {{ ansible_managed }}
+#
+
+user {{ nginx_user }};
+worker_processes {{ nginx_worker_processes }};
+pid {{ nginx_pid }}; 
+
+events {
+{% for key, value in nginx_events.iteritems() %}
+{{ "\t%-30s %s" | format(key, value) }};
+{% endfor %}
+}
+
+http {
+	types_hash_max_size 2048;
+	include /etc/nginx/mime.types;
+	default_type application/octet-stream;
+	
+	# From Ansible
+{% for key, value in nginx_http.iteritems() %}
+{{ "\t%-30s %s" | format(key, value) }};
+{% endfor %}
+	# /From Ansible
+
+	include /etc/nginx/conf.d/*.conf;
+	include /etc/nginx/sites-enabled/*;
+}
+
+# vim:filetype=nginx

templates/etc/nginx/sites-available/COMMON.j2

@@ -0,0 +1,26 @@
+{% if item.ssl is defined and item.ssl.use is defined and item.ssl.use %}
+	listen {{ item.listen | default('443') }};
+#	server_name {{ item.name | join(' ')}}; # TODO: gérer plusieurs vhosts
+	server_name {{ item.name }};
+	ssl on;
+	ssl_certificate {{ nginx_ssl_dir }}/{{ item.name }}/{{ item.name }}.crt;
+	ssl_certificate_key {{ nginx_ssl_dir }}/{{ item.name }}/{{ item.name }}.key;
+	include /etc/nginx/helpers/ssl-{{ item.ssl.template | default('strong') }};
+{% else %}
+	listen {{ item.listen | default('80') }};
+#	server_name {{ item.name | join(' ')}}; # TODO: gérer plusieurs vhosts
+	server_name {{ item.name }};
+{% endif %}
+
+	root {{ nginx_root }}/{{ item.name }}/public;
+
+{% if item.use_access_log is defined and item.use_access_log %}
+	access_log {{ nginx_log_dir }}/{{ item.name }}_access.log combined;
+{% else %}
+	access_log off;
+{% endif %}
+{% if item.use_error_log is defined and item.use_error_log %}
+	error_log {{ nginx_log_dir }}/{{ item.name }}_error.log {{ nginx_error_log_level }};
+{% else %}
+	error_log off;
+{% endif %}

templates/etc/nginx/sites-available/REDIRECT.j2

@@ -0,0 +1,6 @@
+{% if item.redirect_server_name is defined %}
+server {
+	server_name {{ item.redirect_server_name | join(' ') }};
+	return 301 {% if item.ssl.use %}https{% else %}http{% endif %}://{{ item.server_name[0] }}$request_uri;
+}
+{% endif %}

templates/etc/nginx/sites-available/simple-php.j2

@@ -0,0 +1,19 @@
+#
+# {{ ansible_managed }}
+#
+
+server {
+{% include 'COMMON.j2' %}
+
+	index index.htm index.html index.php;
+	location / {
+		try_files $uri $uri/ /index.php;
+	}
+	include /etc/nginx/helpers/php;
+	include /etc/nginx/helpers/no-ht;
+	include /etc/nginx/helpers/static-expires;
+}
+
+{% include 'REDIRECT.j2' %}
+
+# vim:filetype=nginx

templates/etc/nginx/sites-available/static.j2

@@ -0,0 +1,19 @@
+#
+# {{ ansible_managed }}
+#
+
+server {
+{% include 'COMMON.j2' %}
+
+	index index.htm index.html;
+
+	location / {
+		try_files $uri $uri/ =404;
+	}
+	include /etc/nginx/helpers/static-expires;
+	include /etc/nginx/helpers/no-ht;
+}
+
+{% include 'REDIRECT.j2' %}
+
+# vim:filetype=nginx

templates/etc/nginx/sites-available/wordpress.j2

@@ -0,0 +1,20 @@
+#
+# {{ ansible_managed }}
+#
+
+server {
+{% include 'COMMON.j2' %}
+
+	index index.htm index.html index.php;
+
+	location / {
+		try_files $uri $uri/ /index.php?q=$uri&$args;
+	}
+	include /etc/nginx/helpers/static-expires;
+	include /etc/nginx/helpers/no-ht;
+	include /etc/nginx/helpers/php;
+}
+
+{% include 'REDIRECT.j2' %}
+
+# vim:filetype=nginx

templates/etc/nginx/upstream/php.conf.j2

@@ -0,0 +1,26 @@
+#
+# {{ ansible_managed }}
+#
+
+{% if nginx_php_method == 'unix' %}
+upstream php {
+	{% for item in php_fpm_unix_sockets %}
+	server unix:{{ item }};
+	{% endfor %}
+}
+{% elif nginx_php_method == 'tcp' %}
+upstream php {
+	{% if nginx_cluster_php_method is defined %}
+	{{ nginx_cluster_php_method }};
+	{% endif %}
+	{% for item in nginx_cluster_servers %}
+	server {{ item.host }}:{{ item.port }} weight={{ item.weight | default('100') }} max_fails={{ item.max_fails | default('5') }} fail_timeout={{ item.fail_timeout | default('10s') }};
+	{% endfor %}
+}
+{% else %}
+#
+# Bad configuration...
+#
+{% endif%}
+
+# vim:filetype=nginx

templates/etc/nginx/upstream/php_tcp.j2

@@ -0,0 +1,14 @@
+#
+# {{ ansible_managed }}
+#
+
+upstream php {
+	{% if nginx_cluster_php_method is defined %}
+	{{ nginx_cluster_php_method }};
+	{% endif %}
+	{% for item in nginx_cluster_servers %}
+	server {{ item.host }}:{{ item.port }} weight={{ item.weight | default('100') }} max_fails={{ item.max_fails | default('5') }} fail_timeout={{ item.fail_timeout | default('10s') }};
+	{% endfor %}
+}
+
+# vim:filetype=nginx