fix redirect https : show port only if not 443

On a multiple name vhost with redirect_https, redirection is done with
the origin name not the main name.

README.md

@@ -55,6 +55,11 @@ FreeBSD:
 - `nginx_custom_http`: instructions list (will put data in `/etc/nginx/conf.d/custom.conf`)
 - `nginx_dyn_modules`: dynamic module list to load
 
+About modules
+-------------
+
+Last updates from Debian backports loads modules from /etc/nginx/modules-enabled directory. Disabling/Enabling is not supported anymore. Please wait further update.
+
 Fine configuration
 ------------------
 

doc/vhost.md

@@ -23,7 +23,7 @@ Common
 - `upstream_params`: (O) Add upstream params (useful when you want to pass variables to PHP)
 - `override_try_files`: (O) overrides default try\_files defined in template
 - `manage_local_content`: (O) Boolean. Set to false if you do not want to manage local content (images, css...). This option is useless if you use `_proxy` template or `redirect_to` feature.
-- `htpasswd`: (O) References name key in `nginx_htpasswd`. Enable auth basic on all vhost.
+- `htpasswd`: (O) References name key in `nginx_htpasswd`. Enable auth basic on all vhost. Set "false" to disable.
 - `proto`: (O) list of protocol used. Default is a list with "http". If you need http and https, you must set a list with "http" and "https". You can only set "https" without http support.
 - `ssl_name`: (D) name of the key used when using TLS/SSL. Optional when `proto` contains "https". If you don't set this value, it will search by `name`.
 - `ssl_template` (O) "strong" (default) or "legacy". You can disable SSL helpers and add your own directives by setting "false".

tasks/dyn_modules.yml

@@ -13,4 +13,13 @@
   with_items: "{{ nginx_dyn_modules }}"
   when:  ansible_distribution == 'Debian'
 
+- name: FILE | Creates modules directories
+  file: >
+    path="{{ nginx_etc_dir}}/{{ item }}"
+    state=directory
+    mode=0755
+    owner=root
+    group=root
+  with_items: ['modules-available', 'modules-enabled']
+
 # TODO: manage freebsd

tasks/htpasswd.yml

@@ -6,6 +6,7 @@
     state=absent
   with_items: "{{ nginx_htpasswd }}"
   when: item.state is defined and item.state == 'absent'
+  no_log: true
 
 - name: HTPASSWD | Manage files
   htpasswd: >

templates/etc/nginx/nginx.conf.j2

@@ -6,9 +6,7 @@ user {{ nginx_user }};
 worker_processes {{ nginx_worker_processes }};
 pid {{ nginx_pid }};
 {% if nginx_version.stdout | version_compare('1.9.11', 'ge') %}
-{% for module in nginx_dyn_modules -%}
+include {{ nginx_etc_dir }}/modules-enabled/*.conf;
-load_module "modules/ngx_{{ module }}_module.so";
-{% endfor %}
 {% endif %}
 
 events {

templates/etc/nginx/sites-available/_base.j2

@@ -5,14 +5,16 @@
 {% set __http_proxy_protocol_port = item.http_proxy_protocol_port | default([]) %}
 {% set __https_proxy_protocol_port = item.https_proxy_protocol_port | default([]) %}
 {% set __location = item.location | default({}) %}
-{% set __headers = item.headers | default({'X-Frame-Options': 'DENY always', 'X-Content-Type-Options': 'nosniff always' }) %}
+{% set __headers = item.headers | default(nginx_servers_default_headers) %}
 {% set __ssl_name = item.ssl_name | default(item.name if item.name is string else item.name[0]) %}
 {% set __location_order = item.location_order | default(__location.keys()) %}
 {% macro htpasswd(htpasswd_name, indent=1) -%}
-{% for ht in nginx_htpasswd if ht.name == htpasswd_name %}
+{%- if htpasswd_name != false %}
+{%- for ht in nginx_htpasswd if ht.name == htpasswd_name %}
 {{ "\t" * indent }}auth_basic "{{ ht.description }}";
 {{ "\t" * indent }}auth_basic_user_file {{ nginx_htpasswd_dir }}/{{ ht.name }};
-{% endfor%}
+{%- endfor %}
+{%- endif %}
 {%- endmacro %}
 {% macro ssl(ssl_name) %}
 {% for sn in nginx_ssl_pairs if sn.name == ssl_name %}
@@ -20,6 +22,16 @@
 	ssl_certificate_key {{ nginx_ssl_dir + '/' + ssl_name + '/' + ssl_name + '.key' if sn.dest_key is not defined else sn.dest_key }};
 {% endfor %}
 {%- endmacro %}
+{% macro httpsredirect(name) %}
+server {
+{% for port in __listen %}
+	listen {{ port }}{% if port | int in __http_proxy_protocol_port %} proxy_protocol{% endif %};
+{% endfor %}
+	server_name {{ name }};
+	return 301 https://{{ name }}{% if '443' not in __listen_ssl and 443 not in __listen_ssl %}:{{ __listen_ssl[0] }}{% endif %}$request_uri;
+}
+{% endmacro %}
+
 #
 # {{ ansible_managed }}
 #
@@ -69,7 +81,7 @@ server {
 {% block template_headers %}
 	# --> Custom headers
 {% for key, value in __headers.iteritems() %}
-	add_header {{ key }} {{ value | replace(' always', '') }}{% if nginx_version.stdout | version_compare('1.7.5', 'ge') and ' always' in value %} always{% endif %};
+	add_header {{ key }} "{{ value | replace(' always', '') }}"{% if nginx_version.stdout | version_compare('1.7.5', 'ge') and ' always' in value %} always{% endif %};
 {% endfor %}
 	# <-- Custom headers
 {% endblock %}
@@ -140,15 +152,14 @@ server {
 #
 # Redirect HTTP to HTTPS
 #
-server {
+{% if item.name is string %}
-{% for port in __listen %}
+{{ httpsredirect(item.name) }}
-	listen {{ port }}{% if nginx_default_vhost == __main_name %} default_server{% endif %}{% if port | int in __http_proxy_protocol_port %} proxy_protocol{% endif %};
+{% else %}
+{% for i in item.name %}
+{{ httpsredirect(i) }}
 {% endfor %}
-	server_name {% if item.name is string %}{{ item.name }}{% else %}{{ "\n\t\t" }}{{ item.name | join("\n\t\t") }}{% endif %};
-	return 301 https://{{ __main_name }}{% if '443' not in __listen_ssl %}:{{ __listen_ssl[0] }}{% endif %}$request_uri;
-}
 {% endif %}
-
+{% endif %}
 
 {% if item.redirect_from is defined and item.redirect_from is iterable %}
 #

templates/etc/nginx/sites-available/_nagios3.j2

@@ -16,9 +16,9 @@
 {% for key, value in __headers.iteritems() %}
 {% if key == "X-Frame-Options" %}
 	# X-Frame-Options forced by Ansible
-	add_header {{ key }} SAMEORIGIN{% if nginx_version.stdout | version_compare('1.7.5', 'ge') %} always{% endif %};
+	add_header {{ key }} "SAMEORIGIN"{% if nginx_version.stdout | version_compare('1.7.5', 'ge') %} always{% endif %};
 {% else %}
-	add_header {{ key }} {{ value | replace(' always', '') }}{% if nginx_version.stdout | version_compare('1.7.5', 'ge') and ' always' in value %} always{% endif %};
+	add_header {{ key }} "{{ value | replace(' always', '') }}"{% if nginx_version.stdout | version_compare('1.7.5', 'ge') and ' always' in value %} always{% endif %};
 {% endif %}
 {% endfor %}
 	# <-- Custom headers

tests/test.yml

@@ -147,6 +147,8 @@
         location:
           '/hello':
             - htpasswd: 'hello'
+          '/public':
+            - htpasswd: false
         use_error_log: true
       - name: 'test-htpasswd-all.local'
         template: '_base'
@@ -210,6 +212,14 @@
         template: '_base'
         ssl_name: 'test-ssl.local'
         redirect_https: true
+      - name:
+          - 'test-ssl-redirect-many.local'
+          - 'test-ssl-redirect-many2.local'
+        listen_ssl: [8443]
+        proto: ['https']
+        template: '_base'
+        ssl_name: 'test-ssl.local'
+        redirect_https: true
       - name: 'test-ssl-proxy-protocol.local'
         proto: ['http', 'https']
         listen: [80, 20080]
@@ -372,14 +382,16 @@
         - 'test-ssl-predeployed.local'
         - 'test-ssl.local'
     - name: -- VERIFY SSL REDIRECT --
-      command: "curl -v --insecure -H 'Host: {{ item }}' http://127.0.0.1/"
+      command: "curl -v -H 'Host: {{ item.name }}' http://127.0.0.1/"
       changed_when: false
       register: sslredirok
-      failed_when: >
+      failed_when: "'< Location: https://{{ item.name }}{{ ':' + item.port if item.port is defined else '' }}/' not in sslredirok.stderr"
-        sslredirok.stderr.find('< Location') == -1 and
-        sslredirok.stderr.find('https://{{ item }}/') == -1
       with_items:
-        - 'test-ssl-redirect.local'
+        - name: 'test-ssl-redirect.local'
+        - name: 'test-ssl-redirect-many.local'
+          port: '8443'
+        - name: 'test-ssl-redirect-many2.local'
+          port: '8443'
 
 # --------------------------------
 # Default vhosts

vars/main.yml

@@ -39,5 +39,10 @@ nginx_templates_no_dir:
   - '_owncloud'
   - '_proxy'
 
+nginx_servers_default_headers:
+  'X-Frame-Options': 'DENY always'
+  'X-Content-Type-Options': 'nosniff always'
+  'X-XSS-Protection': '1; mode=block'
+
 nginx_upstream_php56: 'php56'
 nginx_upstream_php70: 'php70'