Prevent crash on Docker+Buster

- fix acme.sh home directory
- Clean crash when acme.sh fails (EXPERIMENTAL)

.travis.yml

@@ -1,19 +1,10 @@
 env:
-  - PLATFORM='docker-debian-jessie'           ANSIBLE_VERSION='ansible>=2.5,<2.6'
-  - PLATFORM='docker-debian-jessie-backports' ANSIBLE_VERSION='ansible>=2.5,<2.6'
-  - PLATFORM='docker-debian-jessie-dotdeb'    ANSIBLE_VERSION='ansible>=2.5,<2.6'
-  - PLATFORM='docker-debian-stretch'          ANSIBLE_VERSION='ansible>=2.5,<2.6'
-  - PLATFORM='docker-debian-stretch-sury'     ANSIBLE_VERSION='ansible>=2.5,<2.6'
-  - PLATFORM='docker-debian-jessie'           ANSIBLE_VERSION='ansible>=2.6,<2.7'
-  - PLATFORM='docker-debian-jessie-backports' ANSIBLE_VERSION='ansible>=2.6,<2.7'
-  - PLATFORM='docker-debian-jessie-dotdeb'    ANSIBLE_VERSION='ansible>=2.6,<2.7'
   - PLATFORM='docker-debian-stretch'          ANSIBLE_VERSION='ansible>=2.6,<2.7'
   - PLATFORM='docker-debian-stretch-sury'     ANSIBLE_VERSION='ansible>=2.6,<2.7'
-  - PLATFORM='docker-debian-jessie'           ANSIBLE_VERSION='ansible>=2.7,<2.8'
+  - PLATFORM='docker-debian-buster'           ANSIBLE_VERSION='ansible>=2.6,<2.7'
-  - PLATFORM='docker-debian-jessie-backports' ANSIBLE_VERSION='ansible>=2.7,<2.8'
-  - PLATFORM='docker-debian-jessie-dotdeb'    ANSIBLE_VERSION='ansible>=2.7,<2.8'
   - PLATFORM='docker-debian-stretch'          ANSIBLE_VERSION='ansible>=2.7,<2.8'
   - PLATFORM='docker-debian-stretch-sury'     ANSIBLE_VERSION='ansible>=2.7,<2.8'
+  - PLATFORM='docker-debian-buster'           ANSIBLE_VERSION='ansible>=2.7,<2.8'
 
 
 matrix:
@@ -24,6 +15,7 @@ sudo: required
 dist: trusty
 
 language: python
+python: 2.7
 
 services:
   - docker

README.md

@@ -22,15 +22,16 @@ Supported OS:
 
 | OS                 | Working | Stable (active support) |
 | ------------------ | ------- | ----------------------- |
-| Debian Jessie (8)  | Yes     | Yes                     |
+| Debian Jessie (8)  | Yes     | Check latest supported version ([1.5.0](https://github.com/HanXHX/ansible-nginx/releases/tag/1.5.0)) |
 | Debian Stretch (9) | Yes     | Yes                     |
+| Debian Buster (10) | Yes     | No                      |
 | FreeBSD 11         | Yes     | No                      |
 | FreeBSD 12         | Yes     | No                      |
 
 Requirements
 ------------
 
-Ansible 2.5+. If you set true to `nginx_backports`, you must install backports repository before lauching this role.
+Ansible 2.6+. If you set true to `nginx_backports`, you must install backports repository before lauching this role.
 
 Role Variables
 --------------

Vagrantfile

@@ -6,11 +6,9 @@
 Vagrant.configure("2") do |config|
 
   vms_debian = [
-    { :name => "debian-jessie", :box => "debian/jessie64", :vars => { "nginx_php": [{"version": "5.6"}] }},
-    { :name => "debian-jessie-backports", :box => "debian/jessie64", :vars => { "nginx_php": [{"version": "5.6"}], "nginx_backports": true }},
-    { :name => "debian-jessie-dotdeb", :box => "debian/jessie64", :vars => { "nginx_php": [{"version": "7.0"}, {"version": "5.6", "upstream_name": "legacy"} ], "dotdeb": true }},
     { :name => "debian-stretch", :box => "debian/stretch64", :vars => { "nginx_php": [{"version": "7.0"}] }},
-    { :name => "debian-stretch-sury", :box => "debian/stretch64", :vars => { "nginx_php": [{"version": "7.1"}], "sury": true }}
+    { :name => "debian-stretch-sury", :box => "debian/stretch64", :vars => { "nginx_php": [{"version": "7.1"}], "sury": true }},
+    { :name => "debian-buster", :box => "debian/buster64", :vars => { "nginx_php": [{"version": "7.3"}] }}
   ]
 
   vms_freebsd = [
@@ -19,11 +17,9 @@ Vagrant.configure("2") do |config|
   ]
 
   conts = [
-    { :name => "docker-debian-jessie", :docker => "hanxhx/vagrant-ansible:debian8", :vars => { "nginx_php" => [{"version" => "5.6"}] }},
-    { :name => "docker-debian-jessie-backports", :docker => "hanxhx/vagrant-ansible:debian8", :vars => { "nginx_php": [{"version": "5.6"}], "nginx_backports": true }},
-    { :name => "docker-debian-jessie-dotdeb", :docker => "hanxhx/vagrant-ansible:debian8", :vars => { "nginx_php": [{"version": "7.0"}, {"version": "5.6", "upstream_name": "legacy"} ], "dotdeb": true }},
     { :name => "docker-debian-stretch", :docker => "hanxhx/vagrant-ansible:debian9", :vars => { "nginx_php": [{"version": "7.0"}] }},
-    { :name => "docker-debian-stretch-sury", :docker => "hanxhx/vagrant-ansible:debian9", :vars => { "nginx_php": [{"version": "7.1"}], "sury": true }}
+    { :name => "docker-debian-stretch-sury", :docker => "hanxhx/vagrant-ansible:debian9", :vars => { "nginx_php": [{"version": "7.1"}], "sury": true }},
+    { :name => "docker-debian-buster", :docker => "hanxhx/vagrant-ansible:debian10", :vars => { "nginx_php": [{"version": "7.3"}] }},
   ]
 
   config.vm.network "private_network", type: "dhcp"
@@ -40,7 +36,7 @@ Vagrant.configure("2") do |config|
         ansible.playbook = "tests/test.yml"
         ansible.verbose = 'vv'
         ansible.become = true
-        ansible.extra_vars = opts[:vars].merge({ "nginx_debug_role": true })
+        ansible.extra_vars = opts[:vars].merge({ "nginx_debug_role": true, is_docker: true })
       end
     end
   end

defaults/main.yml

@@ -115,7 +115,7 @@ nginx_load_modules: []
 #
 nginx_dh: null
 nginx_dh_path: '{{ nginx_ssl_dir }}/dhparam.pem'
-nginx_dh_length: 2048
+nginx_dh_length: 4096
 
 #
 # acme.sh

doc/auth.md

@@ -1,11 +1,6 @@
 Auth Basic management
 =====================
 
-IMPORTANT
----------
-
-If you use this feature with Debian Stretch, you *MUST* use ansible >= 2.3.2! See: [https://github.com/HanXHX/ansible-nginx/issues/28](#28).
-
 Description
 -----------
 

doc/site.md

@@ -19,6 +19,8 @@ Common
 - `redirect_https`: (O) Boolean. Redirect HTTP to HTTPS. If "true", you _MUST_ set `proto` to ```['https']```.
 - `location`: (O) Add new custom locations (it does not overwrite!)
 - `location_order`: (O) Due to non preditive `location` order, you can provide the good order (see test-location.local in [tests/test.yml](../tests/test.yml)).
+- `location_before`: (O) Add new custom locations before generated location by template
+- `location_order_before`: (O) Manages location order for `location_before`
 - `more`: (O) Add more custom infos.
 - `upstream_params`: (O) Add upstream params (useful when you want to pass variables to PHP)
 - `override_try_files`: (O) overrides default try\_files defined in template
@@ -39,7 +41,7 @@ Templates
 ---------
 
 - `_base`: static template
-- `_backuppc`: access to [BackupPC](http://backuppc.sourceforge.net/) (be careful: you need to install [fcgiwrap](https://packages.debian.org/jessie/fcgiwrap))
+- `_backuppc`: access to [BackupPC](http://backuppc.sourceforge.net/) (be careful: you need to install [fcgiwrap](https://packages.debian.org/stretch/fcgiwrap))
 - `_dokuwiki`
 - `_redirect`: should not be called explicitly
 - `_phalcon`: Phalcon PHP Framework

doc/upstream.md

@@ -3,8 +3,6 @@ Upstream management
 
 `nginx_upstreams`: List of dict. An upstream has few keys. See bellow.
 
-Note: Few params are unavailable on old Nginx version. But this role do _not_ put it if your version is too old!
-
 Upstream params
 ---------------
 

handlers/main.yml

@@ -26,10 +26,14 @@
 
 - name: docker reload nginx
   command: service nginx reload
+  args:
+    warn: false
   when: ansible_virtualization_type == 'docker'
 
 - name: docker restart nginx
   command: service nginx restart
+  args:
+    warn: false
   when: ansible_virtualization_type == 'docker'
 
 - name: restart nginx freebsd

meta/main.yml

@@ -4,12 +4,12 @@ galaxy_info:
   description: Nginx for Debian / FreeBSD
   company:
   license: GPLv2
-  min_ansible_version: 2.5
+  min_ansible_version: 2.6
   platforms:
   - name: Debian
     versions:
-    - jessie
     - stretch
+    - buster
   - name: FreeBSD
     versions:
     - 11.0

tasks/htpasswd.yml

@@ -4,7 +4,7 @@
   file:
     path: "{{ nginx_htpasswd_dir }}/{{ item.name }}"
     state: absent
-  with_items: "{{ nginx_htpasswd }}"
+  loop: "{{ nginx_htpasswd }}"
   when: item.state is defined and item.state == 'absent'
   no_log: not nginx_debug_role
 
@@ -12,10 +12,7 @@
   htpasswd:
     name: "{{ item.1.name }}"
     password: "{{ item.1.password }}"
-    state: "{{ item.1.state | default('present') }}"
     path: "{{ nginx_htpasswd_dir }}/{{ item.0.name }}"
-  with_subelements:
+  loop: "{{ nginx_htpasswd | subelements('users') }}"
-    - "{{ nginx_htpasswd }}"
-    - users
   when: item.0.state is not defined or item.0.state == 'present'
   no_log: not nginx_debug_role

tasks/install_Debian.yml

@@ -1,5 +1,10 @@
 ---
 
+- name: SET_FACT | Bypass https://github.com/ansible/ansible/issues/19874
+  set_fact:
+    ansible_distribution_release: 'buster'
+  when: ansible_facts.distribution_major_version == "buster/sid"
+
 - name: APT | Update cache
   apt:
     update_cache: yes
@@ -23,9 +28,6 @@
   apt:
     pkg: "{{ nginx_module_packages }}"
     state: present
-  when:
-    ansible_distribution_major_version is version('9', 'ge') or
-    nginx_backports
 
 - name: APT | Install python-passlib
   apt:
@@ -50,7 +52,7 @@
       update: no
 
   - name: SHELL | Install acme.sh
-    shell: ./acme.sh --install --home {{ nginx_acmesh_dir }} --cert-home {{ nginx_acmesh_dir }}
+    shell: ./acme.sh --install --home "{{ nginx_acmesh_dir }}"
     args:
       chdir: "{{ nginx_acmesh_git_dir }}"
       creates: "{{ nginx_acmesh_dir }}"

tasks/install_FreeBSD.yml

@@ -4,7 +4,7 @@
   pkgng:
     name: "{{ item }}"
     state: present
-  with_items:
+  loop:
     - acme.sh
     - "{{ nginx_pkgng_package }}"
     - py27-passlib
@@ -40,7 +40,7 @@
   file:
     path: "{{ nginx_etc_dir }}/{{ item }}"
     state: directory
-  with_items:
+  loop:
     - conf.d
     - sites-available
     - sites-enabled

tasks/main.yml

@@ -4,27 +4,27 @@
   include_vars: "{{ ansible_distribution }}.yml"
   tags: ['nginx::site', 'nginx::ssl']
 
-- name: INCLUDE | Install
+- name: INCLUDE_TASKS | Install
-  include: "install_{{ ansible_distribution }}.yml"
+  include_tasks: "install_{{ ansible_distribution }}.yml"
   tags: ['nginx::site', 'nginx::ssl']
 
-- name: INCLUDE | Prepare
+- name: IMPORT_TASKS| Prepare
-  include: prepare.yml
+  import_tasks: prepare.yml
   tags: ['nginx::site', 'nginx::ssl']
 
-- name: INCLUDE | Install
+- name: IMPORT_TASKS| Install
-  include: config.yml
+  import_tasks: config.yml
 
-- name: INCLUDE | Upstream configuration
+- name: IMPORT_TASKS| Upstream configuration
-  include: upstream.yml
+  import_tasks: upstream.yml
 
-- name: INCLUDE | htpasswd configuration
+- name: IMPORT_TASKS| htpasswd configuration
-  include: htpasswd.yml
+  import_tasks: htpasswd.yml
 
-- name: INCLUDE | SSL configuration
+- name: IMPORT_TASKS| SSL configuration
-  include: ssl/main.yml
+  import_tasks: ssl/main.yml
   tags: ['nginx::ssl']
 
-- name: INCLUDE | Sites configuration
+- name: IMPORT_TASKS| Sites configuration
-  include: site.yml
+  import_tasks: site.yml
   tags: ['nginx::site']

tasks/prepare.yml

@@ -26,7 +26,7 @@
     owner: "{{ item.owner }}"
     mode: "{{ item.mode }}"
     state: directory
-  with_items: "{{ nginx_dirs }}"
+  loop: "{{ nginx_dirs }}"
 
 - name: FILE | Create ansible facts dir
   file:

tasks/site.yml

@@ -4,7 +4,7 @@
   fail:
     msg: "Forbidden keyword default on site {{ item | nginx_site_name }}"
   when: item.filename is defined and item.filename == 'default'
-  with_items: "{{ nginx_sites }}"
+  loop: "{{ nginx_sites }}"
   loop_control:
     label: "{{ item | nginx_site_name }}"
 
@@ -14,7 +14,7 @@
   when:
     ((item.proto is defined and 'http' in item.proto) or (item.proto is not defined)) and
     (item.redirect_http is defined and item.redirect_http)
-  with_items: "{{ nginx_sites }}"
+  loop: "{{ nginx_sites }}"
   loop_control:
     label: "{{ item | nginx_site_name }}"
 
@@ -53,11 +53,11 @@
   file:
     path: "{{ nginx_etc_dir }}/{{ item.1 }}/{{ item.0 | nginx_site_filename }}"
     state: absent
-  with_nested:
+  loop: "{{ nginx_sites | product(dirs) | list }}"
-    - "{{ nginx_sites }}"
-    - ['sites-available', 'sites-enabled']
   notify: ['reload nginx', 'restart nginx freebsd']
   when: item.0.state is defined and item.0.state == 'absent'
+  vars:
+    dirs: ['sites-available', 'sites-enabled']
   loop_control:
     label: "{{ nginx_etc_dir }}/{{ item.1 }}/{{ item.0 | nginx_site_filename }}"
 
@@ -66,7 +66,7 @@
     src: "{{ nginx_etc_dir }}/sites-available/{{ item | nginx_site_filename }}"
     dest: "{{ nginx_etc_dir }}/sites-enabled/{{ item | nginx_site_filename }}"
     state: link
-  with_items: "{{ nginx_sites }}"
+  loop: "{{ nginx_sites }}"
   notify: ['reload nginx', 'restart nginx freebsd']
   when: >
     item.state is not defined or item.state == 'present'
@@ -77,7 +77,7 @@
   file:
     path: "{{ nginx_etc_dir}}/sites-enabled/{{ item | nginx_site_filename }}"
     state: absent
-  with_items: "{{ nginx_sites }}"
+  loop: "{{ nginx_sites }}"
   notify: ['reload nginx', 'restart nginx freebsd']
   when: item.state is defined and item.state == 'disabled'
   loop_control:

tasks/ssl/acme.yml

@@ -7,66 +7,87 @@
 - name: STAT | Check if certificates are already installed
   stat:
     path: "{{ nginx_ssl_dir }}/{{ item | nginx_site_name }}/{{ item | nginx_site_name }}.crt"
-  with_items: "{{ nginx_ssl_pairs }}"
+  loop: "{{ nginx_ssl_pairs }}"
   when: item.acme is defined and item.acme
   register: acme_installed_certs
 
 - name: SET_FACT | Assign var with certificates to create
   set_fact:
     acme_create: "{{ acme_create | default([]) + [ (item.item) ] }}"
-  with_items: "{{ acme_installed_certs.results }}"
+  loop: "{{ acme_installed_certs.results }}"
   when: item.skipped is not defined and not item.stat.exists
 
-- name: TEMPLATE | Create fake site
+- name: BLOCK | Start acme
+  block:
+
+  - name: TEMPLATE | Create fake site
     template:
       src: "etc/nginx/conf.d/FAKESITE.conf.j2"
       dest: "{{ nginx_etc_dir }}/conf.d/FAKESITE_{{ item | nginx_site_name }}.conf"
-  with_items: "{{ acme_create }}"
+    loop: "{{ acme_create }}"
     register: fake_site
 
-- name: FILE | Delete current site if needed
+  - name: FILE | Delete current site if needed
     file:
       path: "{{ nginx_etc_dir }}/sites-enabled/{{ item | nginx_site_name }}"
       state: absent
-  with_items: "{{ acme_create }}"
+    loop: "{{ acme_create }}"
     when: fake_site.changed
 
-- name: SERVICE | Restart nginx
+  - name: SERVICE | Restart nginx
     service:
       name: nginx
       state: restarted
     when: fake_site.changed and ansible_virtualization_type != 'docker'
 
-- name: COMMAND | Restart nginx
+  - name: COMMAND | Restart nginx
     command: service nginx restart
     args:
       warn: false
     when: fake_site.changed and ansible_virtualization_type == 'docker'
 
-- name: SHELL | Get certificates
+  - name: SHELL | Get certificates
-  shell: '{{ nginx_acmesh_bin }} --issue{% if item.name is string %} -d {{ item.name }}{% else %}{% for name in item.name %} -d {{ name }}{% endfor %}{% endif %} --nginx {% if nginx_acmesh_test %}--test{% endif %}'
+    shell: '{{ nginx_acmesh_bin }} --home {{ nginx_acmesh_dir }} --issue{% if item.name is string %} -d {{ item.name }}{% else %}{% for name in item.name %} -d {{ name }}{% endfor %}{% endif %} --nginx {% if nginx_acmesh_test %}--test{% endif %}'
     args:
-    creates: "/root/.acme.sh/{{ item | nginx_site_name }}/{{ item | nginx_site_name }}.key"
+      creates: "{{ nginx_acmesh_dir }}/{{ item | nginx_site_name }}/{{ item | nginx_site_name }}.key"
-  with_items: "{{ acme_create }}"
+    loop: "{{ acme_create }}"
     register: acme_get
     failed_when: acme_get.rc != 0 and acme_get.rc != 2
     no_log: not nginx_debug_role
 
-- name: FILE | Create SSL dir per site
+  - name: FILE | Create SSL dir per site
     file:
       path: "{{ nginx_ssl_dir }}/{{ item | nginx_site_name }}"
-  with_items: "{{ acme_create }}"
+    loop: "{{ acme_create }}"
 
-- name: SHELL | Install certificates
+  - name: SHELL | Install certificates
-  shell: '{{ nginx_acmesh_bin }} --install-cert -d {{ item | nginx_site_name }} --fullchain-file {{ nginx_ssl_dir }}/{{ item | nginx_site_name }}/{{ item | nginx_site_name }}.crt --key-file {{ nginx_ssl_dir }}/{{ item | nginx_site_name }}/{{ item | nginx_site_name }}.key --reloadcmd "service nginx restart"'
+    shell: '{{ nginx_acmesh_bin }} --home {{ nginx_acmesh_dir }} --install-cert -d {{ item | nginx_site_name }} --fullchain-file {{ nginx_ssl_dir }}/{{ item | nginx_site_name }}/{{ item | nginx_site_name }}.crt --key-file {{ nginx_ssl_dir }}/{{ item | nginx_site_name }}/{{ item | nginx_site_name }}.key --reloadcmd "service nginx restart"'
     args:
       creates: "{{ nginx_ssl_dir }}/{{ item | nginx_site_name }}/{{ item | nginx_site_name }}.key"
-  with_items: "{{ nginx_ssl_pairs }}"
+    loop: "{{ nginx_ssl_pairs }}"
     when: item.acme is defined and item.acme
     notify: restart nginx
 
-- name: FILE | Delete fake sites
+  rescue:
+
+  - name: FILE | Delete acme.sh files
+    file:
+      path: "{{ nginx_acmesh_dir }}/{{ item | nginx_site_name }}/"
+      state: absent
+    loop: "{{ nginx_ssl_pairs }}"
+
+  - name: FAIL | Explicit
+    fail:
+      msg: "Something is bad... Auto crash!"
+
+  always:
+
+  - name: FILE | Delete fake sites
     file:
       path: "{{ nginx_etc_dir }}/conf.d/FAKESITE_{{ item | nginx_site_name }}.conf"
       state: absent
-  with_items: "{{ acme_create }}"
+    loop: "{{ acme_create }}"
+    notify: restart nginx
+
+  - name: META | Flush handlers
+    meta: flush_handlers

tasks/ssl/main.yml

@@ -1,8 +1,8 @@
 ---
 
-- name: INCLUDE | standard.yml
+- name: IMPORT_TASKS | standard.yml
-  include: standard.yml
+  import_tasks: standard.yml
 
-- name: INCLUDE | acme.yml
+- name: IMPORT_TASKS | acme.yml
-  include: acme.yml
+  import_tasks: acme.yml
   when: nginx_acmesh

tasks/ssl/standard.yml

@@ -1,13 +1,25 @@
 ---
 
-- name: COMMAND | Generate DH file
+- block:
+
+  - name: STAT | Get info ajout DH file
+    stat:
+      path: "{{ nginx_dh_path }}"
+      get_checksum: no
+    register: stat_dh_file
+
+  - name: SHELL | Get info about DH file
+    shell: openssl dhparam -in {{ nginx_dh_path }} -text -noout 2>&1 | awk '/DH Parameters/ { print substr($3, 2) }'
+    changed_when: false
+    register: dh_info
+    when: stat_dh_file.stat.exists
+
+  - name: COMMAND | Generate DH file
     command: openssl dhparam -out {{ nginx_dh_path }} {{ nginx_dh_length }}
-  args:
+    when: not stat_dh_file.stat.exists or (dh_info.stdout | int != nginx_dh_length | int)
-    creates: "{{ nginx_dh_path }}"
-  when: nginx_dh is not string
     notify: restart nginx
-  async: 1000
+
-  register: dh
+  when: nginx_dh is not string
 
 - name: COPY | Deploy DH file from vars
   copy:
@@ -20,7 +32,7 @@
   file:
     path: "{{ nginx_ssl_dir + '/' + item | nginx_site_name }}"
     state: directory
-  with_items: "{{ nginx_ssl_pairs }}"
+  loop: "{{ nginx_ssl_pairs }}"
   when: item.dest_key is not defined or item.dest_cert is not defined
   no_log: not nginx_debug_role
 
@@ -29,7 +41,7 @@
     content: "{{ item.key }}"
     dest: "{{ nginx_ssl_dir + '/' + item | nginx_site_name + '/' + item | nginx_site_name + '.key' if item.dest_key is not defined else item.dest_key }}"
     mode: 0640
-  with_items: "{{ nginx_ssl_pairs }}"
+  loop: "{{ nginx_ssl_pairs }}"
   when: item.key is defined
   notify: restart nginx
   no_log: not nginx_debug_role
@@ -39,7 +51,7 @@
     content: "{{ item.cert }}"
     dest: "{{ nginx_ssl_dir + '/' + item | nginx_site_name + '/' + item | nginx_site_name + '.crt' if item.dest_cert is not defined else item.dest_cert }}"
     mode: 0644
-  with_items: "{{ nginx_ssl_pairs }}"
+  loop: "{{ nginx_ssl_pairs }}"
   when: item.cert is defined
   notify: restart nginx
   no_log: not nginx_debug_role
@@ -49,15 +61,7 @@
   args:
     chdir: "{{ nginx_ssl_dir + '/' + item | nginx_site_name }}"
     creates: "{% if item.force is defined and item.force %}/tmp/dummy{% else %}{{ nginx_ssl_dir + '/' + item | nginx_site_name + '/' + item | nginx_site_name + '.crt' }}{% endif %}"
-  with_items: "{{ nginx_ssl_pairs }}"
+  loop: "{{ nginx_ssl_pairs }}"
   when: item.self_signed is defined
   notify: restart nginx
   no_log: not nginx_debug_role
-
-- name: Check DH command status
-  async_status:
-    jid: "{{ dh.ansible_job_id }}"
-  register: job_result
-  until: job_result.finished
-  retries: 30
-  when: not ansible_check_mode and nginx_dh is not string

tasks/upstream.yml

@@ -25,6 +25,6 @@
   file:
     path: "{{ nginx_etc_dir }}/conf.d/upstream-{{ item.name }}.conf"
     state: absent
-  with_items: "{{ nginx_upstreams }}"
+  loop: "{{ nginx_upstreams }}"
   when: item.state is defined and item.state == 'absent'
   notify: reload nginx

templates/etc/nginx/helper/ssl-legacy.j2

@@ -3,12 +3,13 @@
 #
 
 ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:ECDHE-RSA-AES128-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA128:DHE-RSA-AES128-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA128:ECDHE-RSA-AES128-SHA384:ECDHE-RSA-AES128-SHA128:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA128:DHE-RSA-AES128-SHA128:DHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA384:AES128-GCM-SHA128:AES128-SHA128:AES128-SHA128:AES128-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
-ssl_protocols TLSv1 TLSv1.1 TLSv1.2{% if nginx_version.stdout is version('1.13.0', 'ge') %} TLSv1.3{% endif %};
+ssl_protocols TLSv1.1 TLSv1.2{% if nginx_version.stdout is version('1.13.0', 'ge') %} TLSv1.3{% endif %};
 ssl_prefer_server_ciphers on;
 ssl_session_cache shared:SSL:10m;
-add_header Strict-Transport-Security "max-age=63072000; includeSubDomains"{% if nginx_version.stdout is version('1.7.5', 'ge') %} always{% endif %};
+ssl_session_tickets off;
 ssl_stapling on;
 ssl_stapling_verify on;
+add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
 resolver {{ nginx_resolver_hosts | join(' ') }} valid={{ nginx_resolver_valid }};
 resolver_timeout {{ nginx_resolver_timeout }};
 ssl_dhparam {{ nginx_dh_path }};

templates/etc/nginx/helper/ssl-strong.j2

@@ -2,13 +2,16 @@
 # {{ ansible_managed }}
 #
 
-ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
+ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384";
-ssl_protocols TLSv1 TLSv1.1 TLSv1.2{% if nginx_version.stdout is version('1.13.0', 'ge') %} TLSv1.3{% endif %};
+ssl_protocols TLSv1.2{% if nginx_version.stdout is version('1.13.0', 'ge') %} TLSv1.3{% endif %};
 ssl_prefer_server_ciphers on;
+ssl_ecdh_curve secp384r1;
+ssl_session_timeout 10m;
 ssl_session_cache shared:SSL:10m;
-add_header Strict-Transport-Security "max-age=63072000; includeSubDomains"{% if nginx_version.stdout is version('1.7.5', 'ge') %} always{% endif %};
+ssl_session_tickets off;
 ssl_stapling on;
 ssl_stapling_verify on;
+add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
 resolver {{ nginx_resolver_hosts | join(' ') }} valid={{ nginx_resolver_valid }};
 resolver_timeout {{ nginx_resolver_timeout }};
 ssl_dhparam {{ nginx_dh_path }};

templates/etc/nginx/nginx.conf.j2

@@ -5,9 +5,7 @@
 user {{ nginx_user }};
 worker_processes {{ nginx_worker_processes }};
 pid {{ nginx_pid }};
-{% if nginx_version.stdout is version('1.9.11', 'ge') %}
 include {{ nginx_etc_dir }}/modules-enabled/*.conf;
-{% endif %}
 
 events {
 	worker_connections {{ nginx_events_worker_connections }};

templates/etc/nginx/sites-available/_base.j2

@@ -5,9 +5,32 @@
 {% set __http_proxy_protocol_port = item.http_proxy_protocol_port | default([]) %}
 {% set __https_proxy_protocol_port = item.https_proxy_protocol_port | default([]) %}
 {% set __location = item.location | default({}) %}
+{% set __location_before = item.location_before | default({}) %}
 {% set __headers = item.headers | default(nginx_servers_default_headers) %}
 {% set __ssl_name = item.ssl_name | default(item.name if item.name is string else item.name[0]) %}
 {% set __location_order = item.location_order | default(__location.keys()) %}
+{% set __location_order_before = item.location_order_before | default(__location_before.keys()) %}
+{% macro server_name(name) %}
+{% if name is string %}{{ name }}{% else %}{{ name | join(" ") }}{% endif %}
+{% endmacro %}
+{% macro locations(list, order) %}
+{% if order | length > 0 %}
+	# --> Custom locations
+{% for location in order %}
+	location {{ location }} {
+{% set opts = list[location] %}
+{% for opt in opts %}
+{% if opt.htpasswd is defined %}
+{{ htpasswd(opt.htpasswd, 2) }}
+{% else %}
+	{{ opt }}
+{% endif %}
+{% endfor  %}
+	}
+{% endfor %}
+	# <-- Custom locations
+{% endif %}
+{% endmacro %}
 {% macro htpasswd(htpasswd_name, indent=1) -%}
 {%- if htpasswd_name != false %}
 {%- for ht in nginx_htpasswd if ht.name == htpasswd_name %}
@@ -27,7 +50,7 @@ server {
 {% for port in __listen %}
 	listen {{ port }}{% if port | int in __http_proxy_protocol_port %} proxy_protocol{% endif %};
 {% endfor %}
-	server_name {{ name }};
+	server_name {{ server_name(name) }};
 	location / {
 		return 301 https://{{ name }}{% if '443' not in __listen_ssl and 443 not in __listen_ssl %}:{{ __listen_ssl[0] }}{% endif %}$request_uri;
 	}
@@ -56,7 +79,7 @@ server {
 	include {{ nginx_helper_dir + '/ssl-' + item.ssl_template | default('strong') }};
 {% endif %}
 {% endif %}
-	server_name {% if item.name is string %}{{ item.name }}{% else %}{{ "\n\t\t"  }}{{ item.name | join("\n\t\t") }}{% endif %};
+	server_name {{ server_name(item.name) }};
 {% block root %}
 {% if item.root is defined %}
 	root {{ item.root }};
@@ -83,15 +106,17 @@ server {
 {% block template_headers %}
 	# --> Custom headers
 {% for key, value in __headers.iteritems() %}
-	add_header {{ key }} "{{ value | replace(' always', '') }}"{% if nginx_version.stdout is version('1.7.5', 'ge') and ' always' in value %} always{% endif %};
+	add_header {{ key }} "{{ value }}";
 {% endfor %}
 	# <-- Custom headers
 {% endblock %}
 
+{{ locations(__location_before, __location_order_before) }}
+
 {% if not __location.has_key('/') %}
 	location / {
 {% block template_try_files %}
-		try_files {{ override_try_files | default('$uri $uri/ =404') }};
+		try_files {{ item.override_try_files | default('$uri $uri/ =404') }};
 {% endblock %}
 	}
 {% endif %}
@@ -101,19 +126,7 @@ server {
 {% block template_custom_location %}
 {% endblock %}
 
-{% if __location_order | length > 0 %}
+{{ locations(__location, __location_order) }}
-	# --> Custom locations
-{% for location in __location_order %}
-	location {{ location }} {
-{% set opts = __location[location] %}
-{% for opt in opts %}
-{% if opt.htpasswd is defined %}{{ htpasswd(opt.htpasswd, 2) }}{% else %}
-		{{ opt }}
-{% endif %}
-{% endfor  %}
-	}
-{% endfor %}	# <-- Custom locations
-{% endif %}
 
 {% block template_local_content %}
 {% if item.manage_local_content is not defined or item.manage_local_content %}
@@ -171,7 +184,7 @@ server {
 {% for port in __listen %}
 	listen {{ port }}{% if port | int in __http_proxy_protocol_port %} proxy_protocol{% endif %};
 {% endfor %}
-	server_name {% if item.redirect_from is string %}{{ item.redirect_from }}{% else %}{{ "\n\t\t" }}{{ item.redirect_from | join("\n\t\t") }}{% endif %};
+	server_name {{ server_name(item.redirect_from) }};
 	location / {
 		return 301 $scheme://{{ item.name if item.name is string else item.name[0] }}$request_uri;
 	}
@@ -186,7 +199,7 @@ server {
 {% if item.ssl_template is not defined or item.ssl_template != false %}
 	include {{ nginx_helper_dir + '/ssl-' + item.ssl_template | default('strong') }};
 {% endif %}
-	server_name {% if item.redirect_from is string %}{{ item.redirect_from }}{% else %}{{ "\n\t\t" }}{{ item.redirect_from | join("\n\t\t") }}{% endif %};
+	server_name {{ server_name(item.redirect_from) }};
 	location / {
 		return 301 https://{{ item.name if item.name is string else item.name[0] }}{% if '443' not in __listen_ssl and 443 not in __listen_ssl %}:{{ __listen_ssl[0] }}{% endif %}$request_uri;
 	}

templates/etc/nginx/sites-available/_php.j2

@@ -16,7 +16,7 @@
 {% endblock %}
 
 {% block template_try_files %}
-		try_files {{ override_try_files | default('$uri $uri/ =404') }};
+		try_files {{ item.override_try_files | default('$uri $uri/ =404') }};
 {% endblock %}
 
 {% block template_upstream_location %}

templates/etc/nginx/sites-available/_php_index2.j2

@@ -1,7 +1,7 @@
 {% extends "_php.j2" %}
 
 {% block template_try_files %}
-		try_files {{ override_try_files | default('$uri $uri/ /index.php') }};
+		try_files {{ item.override_try_files | default('$uri $uri/ /index.php') }};
 {% endblock %}
 
 {% block template_upstream_location %}

tests/includes/post_Debian.yml

@@ -1,6 +1,6 @@
 ---
 
-- name: APT | Install webapps
+- name: APT | Install webapps and related tools
   apt:
     pkg: "{{ packages }}"
     state: present
@@ -8,8 +8,12 @@
   vars:
     packages:
       - backuppc
+      - samba-common-bin
+      - smbclient
 
 - name: SERVICE | Ensure backuppc is started
   service:
     name: backuppc
     state: started
+  register: b
+  failed_when: b.failed and 'Another BackupPC is running' not in b.msg

tests/includes/post_FreeBSD.yml

@@ -2,10 +2,8 @@
 
 #- name: APT | Install web apps
 #  pkgng:
-#    pkg: "{{ item }}"
+#    name: "backuppc"
 #    state: present
-#  with_items:
-#    - backuppc
 #
 #- name: COMMAND | Activate backuppc config
 #  command: >

tests/includes/pre_Debian.yml

@@ -6,25 +6,6 @@
     state: present
   when: nginx_backports
 
-- block:
-
-  - name: APT | Install DotDeb key
-    apt_key:
-      url: 'http://www.dotdeb.org/dotdeb.gpg'
-      state: present
-
-  - name: APT_REPOSITORY | Install dotdeb (PHP 7)
-    apt_repository:
-      repo: 'deb http://packages.dotdeb.org {{ ansible_distribution_release }} all'
-      state: present
-
-  - name: LINEFILEFILE | Dotdeb priority (prevent install nginx from dotdeb)
-    copy:
-      content: "Package: *\nPin: release o=packages.dotdeb.org\nPin-Priority: 100"
-      dest: /etc/apt/preferences
-
-  when: ansible_distribution_release == 'jessie' and dotdeb | default(false)
-
 - block:
 
   - name: APT | Install apt-transport-https
@@ -53,6 +34,7 @@
     packages:
       - cron
       - curl
+      - daemonize
       - fcgiwrap
       - jq
       - nghttp2
@@ -60,10 +42,6 @@
       - vim
       - unzip
 
-- name: APT | Install daemonize from Stretch
-  apt:
-    deb: http://ftp.us.debian.org/debian/pool/main/d/daemonize/daemonize_1.7.7-1+b1_amd64.deb
-
 - name: APT | Install PHP
   apt:
     pkg: "{{ item.version | php_fpm_package }}"

tests/test.yml

@@ -2,11 +2,11 @@
 
 - hosts: all
   pre_tasks:
-    - name: INCLUDE | Pre_tasks related to OS version
+    - name: INCLUDE_TASKS | Pre_tasks related to OS version
-      include: "includes/pre_{{ ansible_distribution }}.yml"
+      include_tasks: "includes/pre_{{ ansible_distribution }}.yml"
 
-    - name: INCLUDE | Pre_tasks common
+    - name: IMPORT_TASKS | Pre_tasks common
-      include: "includes/pre_common.yml"
+      import_tasks: "includes/pre_common.yml"
 
     - name: FILE | Create an internal SSL dir
       file:
@@ -144,7 +144,7 @@
           - 'test2-alias.local'
         template: '_base'
         filename : 'first-test'
-        override_try_files: '$uri $uri index.htm index.html'
+        override_try_files: '$uri $uri /index.htm /index.html'
         headers:
           'X-Frame-Options': 'deny always'
           'X-ansible-default': '1'
@@ -164,9 +164,10 @@
             - 'deny all;'
       - name: 'test-htpasswd.local'
         template: '_base'
-        location:
+        location_before:
           '/hello':
             - htpasswd: 'hello'
+        location:
           '/public':
             - htpasswd: false
         use_error_log: true
@@ -175,20 +176,22 @@
         htpasswd: 'hello'
       - name: 'test-location.local'
         template: '_base'
+        location_before:
+          '/b':
+            - 'alias /var/tmp;'
+          '/c':
+            - 'alias /var/tmp;'
         location:
           '/':
             - 'alias /var/tmp;'
           '/a':
             - 'alias /var/tmp;'
-          '/b':
+        location_order_before:
-            - 'alias /var/tmp;'
+          - '/b'
-          '/c':
+          - '/c'
-            - 'alias /var/tmp;'
         location_order:
           - '/'
           - '/a'
-          - '/b'
-          - '/c'
       - name: 'test-php.local'
         php_version: "{{ nginx_php.1.version if nginx_php.1 is defined else nginx_php.0.version }}"
         upstream_params:
@@ -266,8 +269,8 @@
 # --------------------------------
 # Apps
 # --------------------------------
-    - name: INCLUDE | Post_tasks related to OS version
+    - name: INCLUDE_TASKS | Post_tasks related to OS version
-      include: "includes/post_{{ ansible_distribution }}.yml"
+      include_tasks: "includes/post_{{ ansible_distribution }}.yml"
 
 # --------------------------------
 # Deploy index files