Meilleure gestion des dossiers et htpasswd par location

pull/14/head
Emilien Mantel 2015-12-03 16:32:08 +01:00
parent 0d65cd3c5c
commit c0f2d694e7
9 changed files with 100 additions and 14 deletions

View File

@ -75,3 +75,8 @@ nginx_http:
# Vhosts # Vhosts
# #
nginx_vhosts: [] nginx_vhosts: []
#
# htpasswd
#
nginx_htpasswd: []

19
tasks/htpasswd.yml 100644
View File

@ -0,0 +1,19 @@
---
- name: FILE | Delete htpasswd file
file: >
path={{ nginx_htpasswd_dir }}/{{ item.name }}
state=absent
with_items: nginx_htpasswd
when: item.state is defined and item.state == 'absent'
- name: HTPASSWD | Manage files
htpasswd: >
name={{ item.1.name }}
password={{ item.1.password }}
state={{ item.1.state | default('present') }}
path={{ nginx_htpasswd_dir }}/{{ item.0.name }}
with_subelements:
- nginx_htpasswd
- users
when: item.0.state is not defined or item.0.state == 'present'

4
tasks/legacy.yml 100644
View File

@ -0,0 +1,4 @@
---
- name: FILE | Remove old directories
file: path=/etc/nginx/helpers state=absent

View File

@ -1,7 +1,10 @@
--- ---
- name: APT | Install nginx - name: APT | Install nginx and dependencies
apt: pkg={{ nginx_apt_package }} state=latest update_cache=yes cache_valid_time=3600 apt: pkg={{ item }} state=latest update_cache=yes cache_valid_time=3600
with_items:
- "{{ nginx_apt_package }}"
- python-passlib
- name: SHELL | Get Nginx version - name: SHELL | Get Nginx version
shell: nginx -v 2>&1 | sed -r 's#.*/##;' | cut -d ' ' -f 1 shell: nginx -v 2>&1 | sed -r 's#.*/##;' | cut -d ' ' -f 1
@ -14,11 +17,12 @@
dest=/etc/nginx/nginx.conf dest=/etc/nginx/nginx.conf
notify: reload nginx notify: reload nginx
- name: FILE | Create /etc/nginx/helpers - name: INCLUDE | Fix legacy
file: dest=/etc/nginx/helpers owner=root mode=0755 state=directory include: legacy.yml
- name: FILE | Create /etc/nginx/ssl - name: FILE | Create folders
file: dest=/etc/nginx/ssl owner=root mode=0755 state=directory file: dest={{ item }} owner=root mode=0755 state=directory
with_items: "{{ nginx_dirs }}"
#- name: COMMAND | Creates DH file #- name: COMMAND | Creates DH file
# command: openssl dhparam -out {{ nginx_dh_path }} {{ nginx_dh_length }} # command: openssl dhparam -out {{ nginx_dh_path }} {{ nginx_dh_length }}
@ -28,14 +32,17 @@
- name: TEMPLATE | Deploy all helpers - name: TEMPLATE | Deploy all helpers
template: > template: >
src={{ item }} src={{ item }}
dest=/etc/nginx/helpers/{{ item | basename | regex_replace('\.j2$','') }} dest={{ nginx_helper_dir }}/{{ item | basename | regex_replace('\.j2$','') }}
with_fileglob: '../templates/etc/nginx/helpers/*.j2' with_fileglob: '../templates/etc/nginx/helper/*.j2'
notify: reload nginx notify: reload nginx
- name: INCLUDE | Upstream configuration - name: INCLUDE | Upstream configuration
include: upstream.yml include: upstream.yml
when: nginx_php when: nginx_php
- name: INCLUDE | htpasswd configuration
include: htpasswd.yml
- name: INCLUDE | Vhosts configuration - name: INCLUDE | Vhosts configuration
include: vhost.yml include: vhost.yml

View File

@ -67,7 +67,13 @@ server {
{% for location, opts in __location.iteritems() %} {% for location, opts in __location.iteritems() %}
location {{ location }} { location {{ location }} {
{% for opt in opts %} {% for opt in opts %}
{% if opt.htpasswd is defined %}{% for ht in nginx_htpasswd %}{% if ht.name == opt.htpasswd %}
auth_basic "{{ ht.description }}";
auth_basic_user_file {{ nginx_htpasswd_dir }}/{{ opt.htpasswd }};
{% endif %}{% endfor %}
{% else %}
{{ opt }} {{ opt }}
{% endif %}
{% endfor %} {% endfor %}
} }
{% endfor %} # <-- Custom locations {% endfor %} # <-- Custom locations
@ -86,15 +92,12 @@ server {
} }
{# {#
# HTTPS
#server {
ssl on; ssl on;
ssl_certificate {{ nginx_ssl_dir }}/{{ item.name }}/{{ item.name }}.crt; ssl_certificate {{ nginx_ssl_dir }}/{{ item.name }}/{{ item.name }}.crt;
ssl_certificate_key {{ nginx_ssl_dir }}/{{ item.name }}/{{ item.name }}.key; ssl_certificate_key {{ nginx_ssl_dir }}/{{ item.name }}/{{ item.name }}.key;
include /etc/nginx/helpers/ssl-{{ item.ssl.template | default('strong') }}; include {{ nginx_helper_dir }}/ssl-{{ item.ssl.template | default('strong') }};
#}
# HTTPS
#server {
#} #}
{% if item.redirect_from is defined and item.redirect_from is iterable %} {% if item.redirect_from is defined and item.redirect_from is iterable %}

View File

@ -15,6 +15,19 @@
max_conns: 150 max_conns: 150
weight: 10 weight: 10
down: false down: false
nginx_htpasswd:
- name: 'hello'
description: 'Please login!'
users:
- name: 'hx'
password: 'asdfg'
state: 'absent'
- name: 'hanx'
password: 'qwerty'
- name: 'deleteme'
description: 'Please login!'
users: []
state: 'absent'
nginx_vhosts: nginx_vhosts:
- name: - name:
- 'test.local' - 'test.local'
@ -30,6 +43,16 @@
- 'return 403;' - 'return 403;'
'/gunther': '/gunther':
- 'return 404;' - 'return 404;'
- name: 'test-htpasswd.local'
template: '_base'
location:
'/hello':
- htpasswd: 'hello'
- 'default_type "text/html; charset=UTF-8";'
- 'echo hello;'
- name: 'test-htpasswd-all.local'
template: '_base'
htpasswd: 'hello'
- name: 'test-location.local' - name: 'test-location.local'
template: '_base' template: '_base'
location: location:
@ -78,3 +101,18 @@
changed_when: false changed_when: false
register: r register: r
failed_when: r.stdout.find('301 Moved Permanently') == -1 failed_when: r.stdout.find('301 Moved Permanently') == -1
- name: -- VERIFY AUTH BASIC NONE --
command: "curl -H 'Host: test-htpasswd.local' http://127.0.0.1/hello"
changed_when: false
register: authnone
failed_when: authnone.stdout.find('401 Authorization Required') == -1
- name: -- VERIFY AUTH BASIC FAIL --
command: "curl -u fail:fail -H 'Host: test-htpasswd.local' http://127.0.0.1/hello"
changed_when: false
register: authfail
failed_when: authfail.stdout.find('401 Authorization Required') == -1
- name: -- VERIFY AUTH BASIC OK --
command: "curl -u hanx:qwerty -H 'Host: test-htpasswd.local' http://127.0.0.1/hello"
changed_when: false
register: authok
failed_when: authok.stdout.find('hello') == -1

View File

@ -23,3 +23,13 @@ nginx_upstream_server_params:
# - key: 'resolve' # - key: 'resolve'
# is_bool: true # is_bool: true
# min_version: '1.5.12' # min_version: '1.5.12'
nginx_dirs:
- "{{ nginx_htpasswd_dir }}"
- "{{ nginx_ssl_dir }}"
- "{{ nginx_helper_dir }}"
nginx_htpasswd_dir: '/etc/nginx/htpasswd'
nginx_ssl_dir: '/etc/nginx/ssl'
nginx_helper_dir: '/etc/nginx/helper'