🔥 Drop Ubuntu 18.04 support and hack CI

- Prevent segfault on nginx-extra package

.github/workflows/ci.yml

@@ -0,0 +1,43 @@
+---
+
+name: ci
+'on':
+  pull_request:
+  push:
+    branches:
+      - master
+
+jobs:
+
+  yaml-lint:
+    name: YAML Lint
+    runs-on: ubuntu-latest
+    steps:
+
+      - name: Fetch code
+        uses: actions/checkout@v3
+
+      - name: Set up Python 3.
+        uses: actions/setup-python@v2
+        with:
+          python-version: '3.x'
+
+      - name: Install test dependencies.
+        run: pip3 install yamllint
+
+      - name: Lint code.
+        run: |
+          yamllint .
+
+  ansible-lint:
+    name: Ansible Lint
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Fetch code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Run ansible-lint
+        uses: ansible/ansible-lint-action@v6.15.0

.github/workflows/galaxy.yml

@@ -0,0 +1,17 @@
+---
+
+name: Deploy on Ansible Galaxy
+
+'on':
+  - push
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: checkout
+        uses: actions/checkout@v2
+      - name: galaxy
+        uses: robertdebock/galaxy-action@1.2.0
+        with:
+          galaxy_api_key: ${{ secrets.galaxy_api_key }}

.github/workflows/molecule.yml

@@ -0,0 +1,43 @@
+---
+
+name: Molecule
+
+'on':
+  pull_request:
+  push:
+    branches:
+      - master
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        scenario:
+          - debian-10
+          - debian-11
+          - debian-12
+          - ubuntu-22.04
+        allowed-to-fail:
+          - false
+        include:
+          - scenario: ubuntu-20.04
+            allowed-to-fail: true
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          path: "${{ github.repository }}"
+
+      - name: Molecule
+        uses: gofrolist/molecule-action@v2.3.19
+        with:
+          molecule_options: --base-config molecule/_shared/base.yml
+          molecule_args: --scenario-name ${{ matrix.scenario }}
+          molecule_working_dir: "HanXHX/ansible-nginx"
+        continue-on-error: ${{ matrix.allowed-to-fail }}
+
+      - name: Fake command
+        run: echo "End of job"

.gitignore

@@ -3,3 +3,4 @@
 *.retry
 *.pyc
 /tests/hanxhx.php
+/.idea

.travis.yml

@@ -1,51 +0,0 @@
----
-
-env:
-  global:
-    - VAGRANT_VERSION='2.2.18'
-  jobs:
-    - PLATFORM='docker-debian-bullseye' ANSIBLE_VERSION='>=2.11,<2.12'
-    - PLATFORM='docker-debian-buster'   ANSIBLE_VERSION='>=2.11,<2.12'
-
-os:
-  - linux
-dist: focal
-
-language: python
-python:
-  - 3.8
-
-services:
-  - docker
-
-before_install:
-  - sudo apt-get -q update
-  - sudo apt-get install -y yamllint
-  - sudo wget -nv https://releases.hashicorp.com/vagrant/${VAGRANT_VERSION}/vagrant_${VAGRANT_VERSION}_x86_64.deb
-  - sudo dpkg -i vagrant_${VAGRANT_VERSION}_x86_64.deb
-
-install:
-  - sudo pip install "ansible-core$ANSIBLE_VERSION"
-  - sudo pip install ansible-lint
-  - ansible-galaxy collection install community.general
-  - ansible-galaxy install -p ./tests hanxhx.php
-
-script:
-  - VAGRANT_DEFAULT_PROVIDER=docker vagrant up $PLATFORM
-  - >
-    VAGRANT_DEFAULT_PROVIDER=docker vagrant provision $PLATFORM
-    | grep -q 'changed=0.*failed=0'
-    && (echo 'Idempotence test: pass' && exit 0)
-    || (echo 'Idempotence test: fail' && exit 1)
-  - VAGRANT_DEFAULT_PROVIDER=docker vagrant status
-  - >
-    yamllint .
-    && (echo 'YAML lint test: pass' && exit 0)
-    || (echo 'YAML lint test: fail' && exit 1)
-  - >
-    ansible-lint -v tests/test.yml
-    && (echo 'Ansible lint test: pass' && exit 0)
-    || (echo 'Ansible lint test: fail' && exit 1)
-
-notifications:
-  webhooks: https://galaxy.ansible.com/api/v1/notifications/

README.md

@@ -1,7 +1,7 @@
 Nginx for Debian/FreeBSD Ansible role
 =====================================
 
-[![Ansible Galaxy](http://img.shields.io/badge/ansible--galaxy-HanXHX.nginx-blue.svg)](https://galaxy.ansible.com/HanXHX/nginx/) [![Build Status](https://app.travis-ci.com/HanXHX/ansible-nginx.svg?branch=master)](https://app.travis-ci.com/HanXHX/ansible-nginx)
+[![Ansible Galaxy](http://img.shields.io/badge/ansible--galaxy-HanXHX.nginx-blue.svg)](https://galaxy.ansible.com/HanXHX/nginx/) ![GitHub Workflow Status (master branch)](https://img.shields.io/github/actions/workflow/status/hanxhx/ansible-nginx/molecule.yml?branch=master)
 
 Install and configure Nginx on Debian/FreeBSD.
 
@@ -20,14 +20,17 @@ Features:
 
 Supported OS:
 
-| OS                   | Working | Stable (active support) |
-| -------------------- | ------- | ----------------------- |
+| OS                   | Working | Stable (active support)                                                                              |
+|----------------------|---------|------------------------------------------------------------------------------------------------------|
 | Debian Jessie (8)    | Yes     | Check latest supported version ([1.5.0](https://github.com/HanXHX/ansible-nginx/releases/tag/1.5.0)) |
 | Debian Stretch (9)   | Yes     | Check latest supported version ([1.9.0](https://github.com/HanXHX/ansible-nginx/releases/tag/1.9.0)) | 
-| Debian Buster (10)   | Yes     | Yes                     |
-| Debian Bullseye (11) | Yes     | Yes                     |
-| FreeBSD 11           | Yes     | No                      |
-| FreeBSD 12           | Yes     | No                      |
+| Debian Buster (10)   | Yes     | Yes                                                                                                  |
+| Debian Bullseye (11) | Yes     | Yes                                                                                                  |
+| Debian Bookworm (12) | Yes     | Not yet :)                                                                                           |
+| FreeBSD 11           | NA      | No                                                                                                   |
+| FreeBSD 12           | NA      | No                                                                                                   |
+| Ubuntu 20.04         | Yes     | Yes                                                                                                  |
+| Ubuntu 22.04         | Yes     | Yes                                                                                                  |
 
 Requirements
 ------------
@@ -66,6 +69,7 @@ FreeBSD:
 - `nginx_pid`: daemon pid file
 - `nginx_events_*`: all variables in events block
 - `nginx_http_*`: all variables in http block
+- `nginx_custom_core`: instructions list (for core, will put data in `/etc/nginx/nginx.conf`)
 - `nginx_custom_http`: instructions list (will put data in `/etc/nginx/conf.d/custom.conf`)
 - `nginx_module_packages`: package list module to install (Debian)
 - `nginx_load_modules`: module list to load (full path), should be used only on FreeBSD
@@ -99,24 +103,35 @@ Fine configuration
 Note
 ----
 
-- Active support for Debian.
-- FreeBSD support is experimental (no Travis). I only test (for the moment) 10.2 (but it can work on other versions).
+- Active support for Debian/Ubuntu.
+- FreeBSD support is experimental. I only test (for the moment) 10.2 (but it can work on other versions).
 
 Dependencies
 ------------
 
-None
+See: [requirements.yml](requirements.yml).
 
 
-If you need to dev this role locally
-------------------------------------
+If you need to dev this role locally on Vagrant
+------------------------------------------------
 
 Before use vagrant, run once:
 
-```
+```commandline
 ansible-galaxy install -p ./tests/ HanXHX.php,master
 ```
 
+If you need to dev this role locally with molecule
+--------------------------------------------------
+
+Check available scenarios in [molecule](molecule) directory.
+
+With `debian-12` scenario:
+
+```commandline
+molecule -v -c molecule/_shared/base.yml verify -s debian-12
+```
+
 Example Playbook
 ----------------
 

defaults/main.yml

@@ -84,6 +84,7 @@ nginx_http_gzip_disable: '"msie6"'
 # Custom global configuration
 #
 nginx_custom_http: []
+nginx_custom_core: []
 
 #
 # Nginx default

doc/ssl.md

@@ -8,7 +8,7 @@ Variables
 
 - `nginx_dh`: DH content
 - `nginx_dh_length`: DH key length (default is 2048)
-- `nginx_dh_path`: file localation
+- `nginx_dh_path`: file location
 - `nginx_ssl_dir`: directory where you install your SSL/TLS keys
 - `nginx_ssl_pairs`
 
@@ -20,7 +20,7 @@ Note: `name` is used to deploy key/cert. With defaults values dans `name` = "foo
 
 ### Content mode
 
-Key/Cert content is stored in variable. Usefull with vault.
+Key/Cert content is stored in variable. Useful with vault.
 
 - `key`: content of the private key
 - `cert`: content of the public key
@@ -36,7 +36,7 @@ You can use these variables if you use another task/role to manages your certifi
 
 Create a self-signed pair and deploy it. Do not use this feature in production.
 
-- `self_signed`: set true to use this featrure
+- `self_signed`: set true to use this feature
 - `force`: optional feature (default: false), force regen pair (not idempotent)
 
 ### Acme
@@ -45,7 +45,7 @@ Uses acme.sh to create free certificates. It uses HTTP-01 challenge. Use this fe
 
 - `acme`: set true to use this feature. It uses `name` (can be a string or string list).
 
-Have a look to [acme configuratuion](acme.md configuration).
+Have a look to [acme configuration](acme.md configuration).
 
 Tips
 ----

handlers/main.yml

@@ -1,46 +1,14 @@
 ---
 
 - name: Reload nginx
-  ansible.builtin.command: nginx -t
-  notify:
-    - Real-reload nginx
-    - Docker reload nginx
-
-- name: Restart nginx
-  ansible.builtin.command: nginx -t
-  notify:
-    - Real-restart nginx
-    - Docker restart nginx
-
-- name: Real-reload nginx
   ansible.builtin.service:
     name: nginx
     state: reloaded
-  when: ansible_virtualization_type != 'docker'
 
-- name: Real-restart nginx
+- name: Restart nginx
   ansible.builtin.service:
     name: nginx
     state: restarted
-  when: ansible_virtualization_type != 'docker'
-
-- name: Docker reload nginx
-  ansible.builtin.command: service nginx reload
-  args:
-    warn: false
-  when: ansible_virtualization_type == 'docker'
-
-- name: Docker restart nginx
-  ansible.builtin.command: service nginx restart
-  args:
-    warn: false
-  when: ansible_virtualization_type == 'docker'
-
-- name: Restart nginx freebsd
-  ansible.builtin.service:
-    name: nginx
-    state: restarted
-  when: ansible_distribution == "FreeBSD"
 
 - name: Setup
   ansible.builtin.setup:

meta/main.yml

@@ -13,6 +13,11 @@ galaxy_info:
       versions:
         - buster
         - bullseye
+        - bookworm
+    - name: Ubuntu
+      versions:
+        - focal
+        - jammy
     - name: FreeBSD
       versions:
         - '11.0'

molecule/_shared/Dockerfile.j2

@@ -0,0 +1,19 @@
+# Molecule managed
+
+{% if item.registry is defined %}
+FROM {{ item.registry.url }}/{{ item.image }}
+{% else %}
+FROM {{ item.image }}
+{% endif %}
+
+{% if item.env is defined %}
+{% for var, value in item.env.items() %}
+{% if value %}
+ENV {{ var }} {{ value }}
+{% endif %}
+{% endfor %}
+{% endif %}
+
+RUN apt-get update && \
+	apt-get install -y python3 sudo bash ca-certificates iproute2 python-apt-common \
+	&& apt-get clean

molecule/_shared/base.yml

@@ -0,0 +1,39 @@
+---
+
+scenario:
+  test_sequence:
+    - dependency
+    - syntax
+    - create
+    - prepare
+    - converge
+    - idempotence
+    - verify
+    - destroy
+dependency:
+  name: galaxy
+  options:
+    requirements-file: ./molecule/_shared/requirements.yml
+    role-file: ./molecule/_shared/requirements.yml
+driver:
+  name: docker
+role_name_check: 1
+provisioner:
+  name: ansible
+  env:
+    ANSIBLE_FILTER_PLUGINS: "../../filter_plugins"
+  config_options:
+    defaults:
+      deprecation_warnings: false
+      callback_whitelist: timer,profile_tasks
+      fact_caching: jsonfile
+      fact_caching_connection: ./cache
+      forks: 100
+    connection:
+      pipelining: true
+  playbooks:
+    converge: ../_shared/converge.yml
+    prepare: ../_shared/prepare.yml
+    verify: ../_shared/verify.yml
+verifier:
+  name: ansible

molecule/_shared/converge.yml

@@ -0,0 +1,20 @@
+---
+
+- name: Converge
+  hosts: all
+  gather_facts: true
+  vars_files:
+    - vars/misc.yml
+  vars:
+    nginx_debug_role: true
+  tasks:
+    - name: SHELL | Get ngrok public address
+      ansible.builtin.shell: set -o pipefail && curl 'http://127.0.0.1:4040/api/tunnels/command_line' 2> /dev/null | jq -r '.public_url' | cut -d '/' -f 3
+      args:
+        executable: /bin/bash
+      register: ngrok
+      changed_when: false
+
+    - name: Include role
+      ansible.builtin.include_role:
+        name: "hanxhx.nginx"

molecule/_shared/file/test.crt

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDHTCCAgWgAwIBAgIJAJzUwbFlhyxIMA0GCSqGSIb3DQEBCwUAMCUxIzAhBgNV
+BAMMGnRlc3Qtc3NsLXByZWRlcGxveWVkLmxvY2FsMB4XDTE2MDExMjE2MDUxNVoX
+DTI2MDEwOTE2MDUxNVowJTEjMCEGA1UEAwwadGVzdC1zc2wtcHJlZGVwbG95ZWQu
+bG9jYWwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDm4q94vffiU89G
+GO7rjDfr3C32tH9sM5sXqJT+7N5BLYLF0iSRIvy33MtwFu//TV3f+8nLlQuHYVVk
+L6NEvaL8lh+nRexCQ/y+aXMh7lMhuwPXGgPR1LXsTqyDXbmV9c7k/Kwx5qHAcOb9
+d9YzmcOSO4M9v3WMl/4Zw2J7zNYruypxNBgFEwFx3NJ3AztACMYoVOIR5mS8ARX6
+xea4ddii1F41Vch+eiCGP9VZwDhEujhjy9PXvdBtYNwggM6d82Df9wwaFyIW5DU4
+PhpgAngvE2keY0GLy/LaXa6LAW+TCfPMRT2RtDuvqWr+useWF+O3n81TZqM/G7LV
+9iPxkkRNAgMBAAGjUDBOMB0GA1UdDgQWBBSzXW5UY02/S0xrrobZCVOhas6VeDAf
+BgNVHSMEGDAWgBSzXW5UY02/S0xrrobZCVOhas6VeDAMBgNVHRMEBTADAQH/MA0G
+CSqGSIb3DQEBCwUAA4IBAQC0+Tr0w9aG4f3LG3+WRGKfMopKICNEkA7JrPrvVUq8
+7UgtdrpOUZAL5AKxVVo1rHDdoL/VpjdqHdhyPzaSUl8hppCFsWmdQh4wLKGoyvcN
+AqSGpXTeLSoFJ357F2OIQpXm2lfT2fVGebwyCNFkwpp7klFnmOusSl2/v5Y5cz+A
+WvWrDg3jsNglx3mNLVcjbOSnen2PsZSmcVo27D0el6oDju8jjstyJ+Dvu0WP+CDL
+s/VolFdbei7d4r2dj86OZ/BCZurltyc0wI3NMOdUuA7q4f1MPTRu7qr/ua5ItK92
+Avc+Gjn/Y/aIhzKpPicJQDK6FzxjfhCc8xtk0EjB4IpP
+-----END CERTIFICATE-----

molecule/_shared/file/test.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDm4q94vffiU89G
+GO7rjDfr3C32tH9sM5sXqJT+7N5BLYLF0iSRIvy33MtwFu//TV3f+8nLlQuHYVVk
+L6NEvaL8lh+nRexCQ/y+aXMh7lMhuwPXGgPR1LXsTqyDXbmV9c7k/Kwx5qHAcOb9
+d9YzmcOSO4M9v3WMl/4Zw2J7zNYruypxNBgFEwFx3NJ3AztACMYoVOIR5mS8ARX6
+xea4ddii1F41Vch+eiCGP9VZwDhEujhjy9PXvdBtYNwggM6d82Df9wwaFyIW5DU4
+PhpgAngvE2keY0GLy/LaXa6LAW+TCfPMRT2RtDuvqWr+useWF+O3n81TZqM/G7LV
+9iPxkkRNAgMBAAECggEAEEeZkczrRpUcP1gQuKEZbFMJFqUhevKkk+V6JAN1pGje
+GK65j1ZFNX2nBo9Hetvsq5doYidvOat+RuMpAvbQIDlBoBzJDN8YWiC7UoAocm9q
+VOdrr4btEO13MogQRuefH/xE8/vMGfKcBvFFNDw6UvxJQ7hVRIWPECf7sLj/vPOC
+OpMKghxcabQqidMPKyyHVPhQjuIvqW/SqBFpD+Ul0Ja1QGdx+p+/EwVmXnei6Kr8
+/ypULreHqIlBLD6McfFehxDV0m5U7qXb5xK3zdUurIhZixKLjbdRrorNInfEvlOh
+vDy+hsF5GSzvn9dRrMAy/QcRPpXU47VNYZ5BfdCBTQKBgQD8VCbdpG5siXSlIjZd
+xypgK1ttp8udTPWC1trnAc+Ku9O+cGmvABxYJA1iR/GDpSfMxglB7OhSecywKrr+
+S7Yjs9e/dyBmvF7U15JJaGp+db2Ct64z7MvqkwSJ5a0qrrZJRFetDdqdH9FPvURs
+B147jbKsPiGcljjXbZlOBHJH9wKBgQDqPqoA3VqYOmvR7Ei8/skY2EOpFpOhSNko
+ARFwUsDNHRk677URH97TCHq5UrwubfCeIcIptXHrMfaTsfq8vPLPykReIMRaknxf
+DULJPHSoeBLrCAZmaWF1JVyYhrLhHNAzQ3u7a/kYIJm87FEZy3Ml6FSZmIGbRBqx
+zqZYKoHs2wKBgQD469tbk7cLg556uYGAidYYAS20w29uwlkAtgxFD9g6OIjuud7I
+MQfFO+uoJOjwwaC9ti+zxY56roVq1PybmP0Zw3T3AQIJ15KFzhQWLte/4U8PATzt
+JJEV2+sCTn3COZDCPpVvttcPYjAOxdwV5j7j6Sl2GeT2oIt6mjg+asyCiQKBgQDk
+LPxu8TBRfv8OMqs8Jrf/EpL9/7b48bxOwpOZJZMXelPcXCm1r6TfTrA1HAmg9Ijh
+kKLQ/CUm5Ll7b3B+L1Qa4r2sLyD11SF/eaxn2BMPFD/hYCTT160ObsF+9h8DN4z7
+kq3RiMDRJth69nuds9fLwj++ipcdhr62G0VgNq/u5wKBgCz/I5J3tPNjrU9YampR
+0gNnUkUfJWbiVMsG9uwL9l0L/ZzQHvELJ523QXQ0v/e/szHCyoX319u8HEQlC0Jw
+Twlj81HDZzruDUB/mcH6Ee3zHKOmmF6ma+CgoYJJElKW89MUttPdmkH2J1QqLz+7
+EGREwqjr8/wm22DzKNiyDXJ0
+-----END PRIVATE KEY-----

molecule/_shared/prepare.yml

@@ -0,0 +1,15 @@
+---
+
+- name: Prepare
+  hosts: all
+  gather_facts: true
+  vars_files:
+    - vars/misc.yml
+
+  tasks:
+
+    - name: INCLUDE_TASKS | Pre tasks related to OS
+      ansible.builtin.include_tasks: "../../tests/includes/pre_{{ ansible_os_family }}.yml"
+
+    - name: INCLUDE_TASKS | Pre_tasks common
+      ansible.builtin.include_tasks: "../../tests/includes/pre_common.yml"

molecule/_shared/requirements.yml

@@ -0,0 +1,7 @@
+---
+
+roles:
+  - name: hanxhx.php
+
+collections:
+  - community.general

molecule/_shared/templates/custom_template.conf.j2

@@ -0,0 +1,16 @@
+# {{ ansible_managed }} - custom template
+
+server {
+	listen 80;
+	listen 8888 http2;
+	listen 9999 http2 proxy_protocol;
+	server_name {{ item.name }};
+
+	index index.html index.htm;
+
+	root {{ item.root }};
+
+	location / {
+		try_files $uri $uri/ =404;
+	}
+}

molecule/_shared/vars/misc.yml

@@ -0,0 +1,259 @@
+---
+
+# Force SysVinit, since systemd won't work in a Docker container
+ansible_service_mgr: "sysvinit"
+
+# ----------------------------------------
+# Copied from {role_dir}/tests/group_vars/all.yml
+# ----------------------------------------
+
+# Internal vars
+int_ansible_ssl_dir: '/etc/ansible-ssl'
+# Role vars
+nginx_worker_processes: 1    # Ansible+FreeBSD can't detect CPU number
+nginx_apt_package: 'nginx-extras'
+nginx_module_packages: ['libnginx-mod-http-headers-more-filter']
+nginx_custom_core:
+  - 'worker_rlimit_nofile 4242;'
+
+nginx_upstreams:
+  - name: 'test'
+    servers:
+      - path: '127.0.0.1:80'
+        max_conns: 150
+        weight: 10
+        down: false
+  - name: 'test-absent'
+    servers:
+      - path: '127.0.0.1:80'
+        max_conns: 150
+        weight: 10
+        down: false
+    state: 'absent'
+
+nginx_htpasswd:
+  - name: 'hello'
+    description: 'Please login!'
+    users:
+      - name: 'hx'
+        password: 'asdfg'
+        state: 'absent'
+      - name: 'hanx'
+        password: 'qwerty'
+  - name: 'deleteme'
+    description: 'Please login!'
+    users: []
+    state: 'absent'
+
+nginx_acmesh: true
+nginx_acmesh_test: true
+
+nginx_ssl_pairs:
+  - name: '{{ ngrok.stdout }}'
+    acme: true
+  - name: 'test-ssl-selfsigned.local'
+    self_signed: true
+    force: false
+  - name:
+      - 'test-ssl-predeployed.local'
+      - 'test-multiple-name.local'    # Hack: tests for acme with multiple name, without using acme
+    dest_key: "{{ int_ansible_ssl_dir }}/test.key"
+    dest_cert: "{{ int_ansible_ssl_dir }}/test.crt"
+  - name: 'test-ssl.local'
+    key: |
+      -----BEGIN RSA PRIVATE KEY-----
+      MIIEpAIBAAKCAQEAvavrJWFp3Al2VwRgKx+4Y2mbRRvoxvyd2pyN0xMJ/tCJscaG
+      8s60v6WZ9FcCOeMkSI2DXsk4z7pbQdQn0h2GDr/5MOJkPAVWSWEN46tpaLZ3v0zp
+      88ZIbnEk1G0PsdFuW/pnLsakPlAMrl1VArFsV6YsatLt30UIYYcRO97StkoOehCx
+      A5w+XqtfHZeQZ0/DS81633gwYUcMuSTUFZ60r7ge1/m77DTSKg3rTVk5sebP8cjS
+      +aWHvxP/GyvvDsT+3gjRJx2/5O3JkfH0zaOsaU2Avj0PR0c5rhynrNO/l1k+GJJB
+      cbBrM+yA8Ofzp4oXUrCfaIq3RuL3Pd+khcKsiwIDAQABAoIBAQCPpAMQ7BUfbosQ
+      m1+5SOx7XR8Z12kSSX3CcY12rJSFRakB2TeZ6rE38lIFmV82N67iw0kaH4nGx3sU
+      /3aoyXMc+IXfX5RJYEFYkQfTw5ywkH9fgQAsfZ2dBlK+DVo1cEYDoj9CTW1VQ4pX
+      Ape+0l8agd5hiBxdWgpe0ctbbARnx584viLiA/iPBDNxKi9zEYw+WP7hSj5QWahr
+      a09tubcC4L6tjvv8CoZTRSKfCW64vWRDvE6vmA+zJN9Arc1WTYzF1KO1Gybwf8h7
+      stJb191smAgGDFhKo0j58ncyAnrS1k4mapm86QQhlfIA6DKvvC0qm3KdQns5b7HM
+      PyzW0hwBAoGBAO2mTVTOsziom9vtBwM0nRMMEgynR2X3EKMJz2mjcCf66f1F+aQ5
+      DvQFM2V8S2s1nGnPh8NKKZ8DxW1NKuR4qx82zeAXpUs9ibHxOnw4YRC485zqc2Wt
+      fSO1OEDYeKyzWP1nGGtCntYUXzJnWn/wz0mBGKzLKTuLwyFIKx1b7bybAoGBAMxR
+      N+lT57rX6d4GUqcgNOuWMZ/D8egnE5+hsoiFnHOisRLOgUgBBSy4rwAZx+rdHYT+
+      RO11L1PLYEzyvnO0f13R+N7aqKwNXDSzZGA+jb4pjkVidIC2smG/JYKJH5Z+kakw
+      mwMKP0wdRZJsCaMgScHmWJS8d6Ox/XJJoWrTWTbRAoGAWJlEgVaiaIArwz1F/QLz
+      gHNik0cWDkSi9jWlFxwwpycbbypUXM5M7dq2g6JoN6sACk6trbgLdlYgl5RKZm06
+      VuPGs0H9hOSHXkix5jfasDJT2G9r4D9ixRo9w6cwriobBjYWW3612tgzeYYgrkwn
+      655uhZUkZSfA8rqGIGbyZfsCgYAf5WH8G+wmIATTc1s92epJCOZwUY+XNVp75itP
+      4sPczX4lOHW4PuiG5cH0GxI5mRE9rNAn3c5on2xGNvMCbyAfDmNyruH8Eg3d8E9w
+      MvO/xw79x/P2EA9i8QszCKMUxGeK6RqZ6+SbxkoRJKqQe77n9UTI228179hoGhSH
+      77ySsQKBgQC8SSZn6a8PpSIIFXB9WCFMwfGFYbUz0wvpaeZP8GKx3BEzMeJqSUaJ
+      hrQgpwQXkueeamlCQcvV3AUCoBRWTYRLDrWiUIXuIgikDWBFp6TBvTnVRI7iktly
+      fNED7jXOSjJqnFmdkZlAI5V8dM++mVYVykJD6jcaVRQvxqFLrhSaRg==
+      -----END RSA PRIVATE KEY-----
+    cert: |
+      -----BEGIN CERTIFICATE-----
+      MIIDBTCCAe2gAwIBAgIJALKJfbk5vuieMA0GCSqGSIb3DQEBBQUAMBkxFzAVBgNV
+      BAMMDnRlc3Qtc3NsLmxvY2FsMB4XDTE2MDExMTE2NDI0NFoXDTI2MDEwODE2NDI0
+      NFowGTEXMBUGA1UEAwwOdGVzdC1zc2wubG9jYWwwggEiMA0GCSqGSIb3DQEBAQUA
+      A4IBDwAwggEKAoIBAQC9q+slYWncCXZXBGArH7hjaZtFG+jG/J3anI3TEwn+0Imx
+      xobyzrS/pZn0VwI54yRIjYNeyTjPultB1CfSHYYOv/kw4mQ8BVZJYQ3jq2lotne/
+      TOnzxkhucSTUbQ+x0W5b+mcuxqQ+UAyuXVUCsWxXpixq0u3fRQhhhxE73tK2Sg56
+      ELEDnD5eq18dl5BnT8NLzXrfeDBhRwy5JNQVnrSvuB7X+bvsNNIqDetNWTmx5s/x
+      yNL5pYe/E/8bK+8OxP7eCNEnHb/k7cmR8fTNo6xpTYC+PQ9HRzmuHKes07+XWT4Y
+      kkFxsGsz7IDw5/OnihdSsJ9oirdG4vc936SFwqyLAgMBAAGjUDBOMB0GA1UdDgQW
+      BBRaSF1L+ivPhmIVGQjtviBqZWDS9DAfBgNVHSMEGDAWgBRaSF1L+ivPhmIVGQjt
+      viBqZWDS9DAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQCjrgB9+Zuq
+      Rx7T2mRUl4jf75dLabuBQD0ePALTtvNyBSghhzSr90mE7GlFOYAv0JsmEa3R1LVF
+      wLPIdrIhNHpt7hN0PkhUlfgmxBnRSCfhpiq4xxsDVFM7ehtDz4+dv1LUDMXo07+E
+      f24g9aqmypiFzHisUQrYIhtQmHxRpKyGp6kDAW9qNxg6k/Um00aHdYfuD9ER4ksR
+      f8Hto7f+vssKxCRY2OZXqq13PxEwC5+hgAUkTdrycA/moXFuHJi3lCnCND7sSzvG
+      tXBggOusyFZFC4bs2m+V+Z+RN+tK2c/c0nq5HR8MV5HwIm4Z8GoT2/0BfJ00cgWL
+      lVz0gDBfdH8f
+      -----END CERTIFICATE-----
+
+nginx_custom_http:
+  - 'add_header X-ansible 1;'
+  - 'geoip_country {% if ansible_os_family == "Debian" %}/usr/share/GeoIP/GeoIP.dat{% else %}/usr/local/share/GeoIP/GeoIP.dat{% endif %};'
+  - 'map $geoip_country_code $allowed_country {'
+  - '    default yes;'
+  - '    MA no;'
+  - '    DZ no;'
+  - '    TN no;'
+  - '}'
+
+nginx_default_site: 'test.local'
+nginx_default_site_ssl: 'test-ssl-predeployed.local'
+
+nginx_sites:
+  - name:
+      - 'test.local'
+      - 'test-alias.local'
+      - 'test2-alias.local'
+    template: '_base'
+    filename: 'first-test'
+    override_try_files: '$uri/ $uri =404'
+    headers:
+      'X-Frame-Options': 'deny always'
+      'X-ansible-default': '1'
+    manage_local_content: false
+    use_error_log: true
+    more:
+      - 'autoindex off;'
+    location:
+      '/test':
+        - 'return 403;'
+      '/gunther':
+        - 'return 404;'
+      '/status':
+        - 'stub_status on;'
+        - 'access_log off;'
+        - 'allow 127.0.0.1;'
+        - 'deny all;'
+  - name: 'test-htpasswd.local'
+    template: '_base'
+    location_before:
+      '/hello':
+        - htpasswd: 'hello'
+    location:
+      '/public':
+        - htpasswd: false
+    use_error_log: true
+  - name: 'test-htpasswd-all.local'
+    template: '_base'
+    htpasswd: 'hello'
+  - name: 'test-location.local'
+    template: '_base'
+    location_before:
+      '/b':
+        - 'alias /var/tmp;'
+      '/c':
+        - 'alias /var/tmp;'
+    location:
+      '/':
+        - 'alias /var/tmp;'
+      '/a':
+        - 'alias /var/tmp;'
+    location_order_before:
+      - '/b'
+      - '/c'
+    location_order:
+      - '/'
+      - '/a'
+  - name: 'test-php.local'
+    php_upstream: "manual"
+    upstream_params:
+      - 'fastcgi_param FOO bar;'
+    redirect_from:
+      - 'www.test-php.local'
+    template: '_php'
+    use_error_log: true
+    use_access_log: true
+  - name: 'test-php-index.local'
+    template: '_php_index'
+    php_upstream: 'hx_unix'
+  - name: 'test-php-index2.local'
+    template: '_php_index2'
+    php_upstream: 'hx_ip'
+  - name: 'test-proxy.local'
+    listen:
+      - 8080
+    template: '_proxy'
+    upstream_name: 'test'
+    headers:
+      'X-proxyfied': '1'
+  - name: 'deleted.local'
+    state: 'absent'
+  - name: 'redirect-to.local'
+    redirect_to: 'http://test.local'
+  - name: 'test-ssl.local'
+    proto: ['http', 'https']
+    template: '_base'
+  - name:
+      - 'test-ssl-selfsigned.local'
+      - 'www.test-ssl-selfsigned.local'
+    proto: ['http', 'https']
+    template: '_base'
+    hsts: 'max-age=1664;'
+  - name: 'test-ssl-predeployed.local'
+    proto: ['http', 'https']
+    template: '_base'
+    ssl_name: 'test-ssl-predeployed.local'
+    headers:
+      'X-ansible-default': '1'
+    ssl_template: false
+  - name: 'test-ssl-redirect.local'
+    proto: ['https']
+    template: '_base'
+    ssl_name: 'test-ssl.local'
+    redirect_https: true
+  - name:
+      - 'test-ssl-redirect-many.local'
+      - 'test-ssl-redirect-many2.local'
+    listen_ssl: [8443]
+    proto: ['https']
+    template: '_base'
+    ssl_name: 'test-ssl.local'
+    redirect_https: true
+    redirect_from:
+      - 'www.test-ssl-redirect-many.local'
+      - 'www.test-ssl-redirect-many2.local'
+  - name: 'test-ssl-proxy-protocol.local'
+    proto: ['http', 'https']
+    listen_proxy_protocol: [20080]
+    listen_proxy_protocol_ssl: [20443]
+    template: '_base'
+    ssl_name: 'test-ssl.local'
+    headers:
+      'X-Proxy-Protocol': '1'
+  - name: '{{ ngrok.stdout }}'
+    proto: ['http', 'https']
+    listen_proxy_protocol: [21080]
+    listen_proxy_protocol_ssl: [21443]
+    template: '_base'
+    ssl_name: '{{ ngrok.stdout }}'
+    headers:
+      'X-acme': '1'
+  - name: 'test-custom-template.local'
+    custom_template: 'templates/custom_template.conf.j2'
+    root: '/tmp/custom-template'
+
+nginx_php: "{{ [{'upstream_name': 'manual', 'sockets': [{'host': '127.0.0.1', 'port': '9636'}]}] }}"
+nginx_dh_length: 1024

molecule/_shared/verify.yml

@@ -0,0 +1,19 @@
+---
+
+- name: Verify
+  hosts: all
+  gather_facts: true
+  vars_files:
+    - vars/misc.yml
+  vars:
+    nginx_root: "/srv/www"
+  tasks:
+    - name: SHELL | Get ngrok public address
+      ansible.builtin.shell: set -o pipefail && curl 'http://127.0.0.1:4040/api/tunnels/command_line' 2> /dev/null | jq -r '.public_url' | cut -d '/' -f 3
+      args:
+        executable: /bin/bash
+      register: ngrok
+      changed_when: false
+
+    - name: INCLUDE_TASKS | Post_tasks common
+      ansible.builtin.include_tasks: "../../tests/includes/post_common.yml"

molecule/debian-10/molecule.yml

@@ -0,0 +1,13 @@
+---
+
+platforms:
+  - name: debian-10
+    image: dokken/debian-10
+    command: /lib/systemd/systemd
+    dockerfile: ../_shared/Dockerfile.j2
+    capabilities:
+      - SYS_ADMIN
+    cgroupns_mode: host
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    privileged: true

molecule/debian-11/molecule.yml

@@ -0,0 +1,13 @@
+---
+
+platforms:
+  - name: debian-11
+    image: dokken/debian-11
+    command: /lib/systemd/systemd
+    dockerfile: ../_shared/Dockerfile.j2
+    capabilities:
+      - SYS_ADMIN
+    cgroupns_mode: host
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    privileged: true

molecule/debian-12/molecule.yml

@@ -0,0 +1,13 @@
+---
+
+platforms:
+  - name: debian-12
+    image: dokken/debian-12
+    command: /lib/systemd/systemd
+    dockerfile: ../_shared/Dockerfile.j2
+    capabilities:
+      - SYS_ADMIN
+    cgroupns_mode: host
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    privileged: true

molecule/ubuntu-20.04/molecule.yml

@@ -0,0 +1,20 @@
+---
+
+platforms:
+  - name: ubuntu-20.04
+    image: dokken/ubuntu-20.04
+    command: /lib/systemd/systemd
+    dockerfile: ../_shared/Dockerfile.j2
+    capabilities:
+      - SYS_ADMIN
+    cgroupns_mode: host
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    privileged: true
+
+# Segfault on Ubuntu 20.04 with `nginx-extras` package...
+provisioner:
+  inventory:
+    host_vars:
+      ubuntu-20.04:
+        nginx_apt_package: 'nginx-full'

molecule/ubuntu-22.04/molecule.yml

@@ -0,0 +1,13 @@
+---
+
+platforms:
+  - name: ubuntu-22.04
+    image: dokken/ubuntu-22.04
+    command: /lib/systemd/systemd
+    dockerfile: ../_shared/Dockerfile.j2
+    capabilities:
+      - SYS_ADMIN
+    cgroupns_mode: host
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    privileged: true

requirements.yml

@@ -0,0 +1,4 @@
+---
+
+collections:
+  - community.general

tasks/install/Debian.yml

@@ -14,7 +14,7 @@
 - name: APT | Install nginx and dependencies
   ansible.builtin.apt:
     pkg: "{{ nginx_apt_package }}"
-    default_release: "{{ ansible_distribution_release + '-backports' if nginx_backports else ansible_distribution_release }}"
+    default_release: "{{ ansible_distribution_release + '-backports' if (nginx_backports and ansible_distribution == 'Debian') else ansible_distribution_release }}"
 
 - name: APT | Install nginx modules
   ansible.builtin.apt:

tasks/install/FreeBSD.yml

@@ -21,20 +21,17 @@
       ansible.builtin.command: touch /usr/local/etc/fdfs/http.conf
       args:
         creates: /usr/local/etc/fdfs/http.conf
-      register: fd1
+      notify: Restart nginx
 
     - name: LINEINFILE | Tune fdfs
-      ansible.builtin.lineinansible.builtin.file:
+      ansible.builtin.lineinfile:
         regexp: ^load_fdfs_parameters_from_tracker
         line: load_fdfs_parameters_from_tracker=false
         path: /usr/local/etc/fdfs/mod_fastdfs.conf
-      register: fd2
+      notify: Restart nginx
 
-    - name: SERVICE | Restart nginx when fdfs is tuned
-      ansible.builtin.service:
-        name: nginx
-        state: restarted
-      when: fd1.changed or fd2.changed
+    - name: META | Flush handlers (Restart nginx when fdfs is tuned)
+      ansible.builtin.meta: flush_handlers
 
 - name: FILE | Create configuration dir (like Debian)
   ansible.builtin.file:

tasks/install/main.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: INCLUDE_TASKS | Install
-  ansible.builtin.include_tasks: "{{ ansible_distribution }}.yml"
+  ansible.builtin.include_tasks: "{{ ansible_os_family }}.yml"
 
 - name: IMPORT_TASKS | acme
   ansible.builtin.import_tasks: "acme.yml"

tasks/main.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: INCLUDE_VARS | Related to OS
-  ansible.builtin.include_vars: "{{ ansible_distribution }}.yml"
+  ansible.builtin.include_vars: "{{ ansible_os_family }}.yml"
   tags: ['nginx::site', 'nginx::ssl']
 
 - name: INCLUDE_TASKS | Install

tasks/site.yml

@@ -49,7 +49,7 @@
     mode: 0644
     owner: root
     group: root
-  notify: ['Reload nginx', 'Restart nginx freebsd']
+  notify: 'Reload nginx'
   when: (item.state is not defined or item.state != 'absent') and item.custom_template is not defined
   loop: "{{ nginx_sites }}"
   loop_control:
@@ -62,7 +62,7 @@
     mode: 0644
     owner: root
     group: root
-  notify: ['Reload nginx', 'Restart nginx freebsd']
+  notify: 'Reload nginx'
   when: (item.state is not defined or item.state != 'absent') and item.custom_template is defined
   loop: "{{ nginx_sites }}"
   loop_control:
@@ -73,7 +73,7 @@
     path: "{{ nginx_etc_dir }}/{{ item.1 }}/{{ item.0 | nginx_site_filename }}"
     state: absent
   loop: "{{ nginx_sites | product(dirs) | list }}"
-  notify: ['Reload nginx', 'Restart nginx freebsd']
+  notify: 'Reload nginx'
   when: item.0.state is defined and item.0.state == 'absent'
   vars:
     dirs: ['sites-available', 'sites-enabled']
@@ -86,7 +86,7 @@
     dest: "{{ nginx_etc_dir }}/sites-enabled/{{ item | nginx_site_filename }}"
     state: link
   loop: "{{ nginx_sites }}"
-  notify: ['Reload nginx', 'Restart nginx freebsd']
+  notify: 'Reload nginx'
   when: >
     item.state is not defined or item.state == 'present'
   loop_control:
@@ -97,7 +97,7 @@
     path: "{{ nginx_etc_dir }}/sites-enabled/{{ item | nginx_site_filename }}"
     state: absent
   loop: "{{ nginx_sites }}"
-  notify: ['Reload nginx', 'Restart nginx freebsd']
+  notify: 'Reload nginx'
   when: item.state is defined and item.state == 'disabled'
   loop_control:
     label: "{{ item | nginx_site_name }}"
@@ -106,7 +106,7 @@
   ansible.builtin.file:
     path: "{{ nginx_etc_dir }}/sites-enabled/default"
     state: absent
-  notify: ['Reload nginx', 'Restart nginx freebsd']
+  notify: 'Reload nginx'
   when: nginx_default_site is not none
 
 - name: FILE | Auto set default site
@@ -114,7 +114,7 @@
     src: "{{ nginx_etc_dir }}/sites-available/default"
     dest: "{{ nginx_etc_dir }}/sites-enabled/default"
     state: link
-  notify: ['Reload nginx', 'Restart nginx freebsd']
+  notify: 'Reload nginx'
   when: nginx_default_site is none
 
 - name: TEMPLATE | Deploy facts

tasks/ssl/acme.yml

@@ -29,25 +29,27 @@
         group: root
       loop: "{{ acme_create }}"
       register: fake_site
+      notify: Restart nginx
 
-    - name: FILE | Delete current site if needed
+    - name: TEMPLATE | Create fake site
+      ansible.builtin.template:
+        src: "etc/nginx/conf.d/FAKESITE.conf.j2"
+        dest: "/tmp/FAKESITE_{{ item | nginx_site_name }}.conf"
+        mode: 0644
+        owner: root
+        group: root
+      loop: "{{ acme_create }}"
+
+    - name: FILE | Delete current site if needed  # noqa: no-handler
       ansible.builtin.file:
         path: "{{ nginx_etc_dir }}/sites-enabled/{{ item | nginx_site_name }}"
         state: absent
       loop: "{{ acme_create }}"
       when: fake_site.changed
+      notify: Restart nginx
 
-    - name: SERVICE | Restart nginx
-      ansible.builtin.service:
-        name: nginx
-        state: restarted
-      when: fake_site.changed and ansible_virtualization_type != 'docker'
-
-    - name: COMMAND | Restart nginx
-      ansible.builtin.command: service nginx restart
-      args:
-        warn: false
-      when: fake_site.changed and ansible_virtualization_type == 'docker'
+    - name: META | Ensure nginx is restarted if needed
+      ansible.builtin.meta: flush_handlers
 
     - name: COMMAND | Get certificates
       ansible.builtin.command: |

tasks/ssl/standard.yml

@@ -4,22 +4,26 @@
   when: nginx_dh is not string
   block:
 
-  - name: STAT | Get info about DH file
-    ansible.builtin.stat:
-      path: "{{ nginx_dh_path }}"
-      get_checksum: false
-    register: stat_dh_file
+    - name: STAT | Get info about DH file
+      ansible.builtin.stat:
+        path: "{{ nginx_dh_path }}"
+        get_checksum: false
+      register: stat_dh_file
 
-  - name: SHELL | Get info about DH file
-    ansible.builtin.shell: openssl dhparam -in {{ nginx_dh_path }} -text -noout 2>&1 | awk '/DH Parameters/ { print substr($3, 2) }'
-    changed_when: false
-    register: dh_info
-    when: stat_dh_file.stat.exists
+    - name: SHELL | Get info about DH file
+      ansible.builtin.shell: |
+        set -o pipefail &&
+        openssl dhparam -in {{ nginx_dh_path }} -text -noout 2>&1 | awk '/DH Parameters/ { print substr($3, 2) }'
+      args:
+        executable: /bin/bash
+      changed_when: false
+      register: dh_info
+      when: stat_dh_file.stat.exists
 
-  - name: COMMAND | Generate DH file
-    ansible.builtin.command: openssl dhparam -out {{ nginx_dh_path }} {{ nginx_dh_length }}
-    when: not stat_dh_file.stat.exists or (dh_info.stdout | int != nginx_dh_length | int)
-    notify: Restart nginx
+    - name: COMMAND | Generate DH file  # noqa: no-changed-when
+      ansible.builtin.command: openssl dhparam -out {{ nginx_dh_path }} {{ nginx_dh_length }}
+      when: not stat_dh_file.stat.exists or (dh_info.stdout | int != nginx_dh_length | int)
+      notify: Restart nginx
 
 - name: COPY | Deploy DH file from vars
   ansible.builtin.copy:

templates/etc/nginx/helper/ssl-legacy.j2

@@ -1,16 +1,23 @@
 #
 # {{ ansible_managed }}
-#
+# See: https://ssl-config.mozilla.org/#server=nginx&version=1.18.0&config=intermediate&openssl=1.1.1n&hsts=false&guideline=5.7
 
-ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:ECDHE-RSA-AES128-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA128:DHE-RSA-AES128-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA128:ECDHE-RSA-AES128-SHA384:ECDHE-RSA-AES128-SHA128:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA128:DHE-RSA-AES128-SHA128:DHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA384:AES128-GCM-SHA128:AES128-SHA128:AES128-SHA128:AES128-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
-ssl_protocols TLSv1.1 TLSv1.2{% if nginx_version.stdout is version('1.13.0', 'ge') %} TLSv1.3{% endif %};
-ssl_prefer_server_ciphers on;
-ssl_session_cache shared:SSL:10m;
+ssl_session_timeout 1d;
+ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
 ssl_session_tickets off;
-ssl_stapling on;
-ssl_stapling_verify on;
-resolver {{ nginx_resolver_hosts | join(' ') }} valid={{ nginx_resolver_valid }};
-resolver_timeout {{ nginx_resolver_timeout }};
+
 ssl_dhparam {{ nginx_dh_path }};
 
+# intermediate configuration
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
+ssl_prefer_server_ciphers off;
+
+# OCSP stapling
+ssl_stapling on;
+ssl_stapling_verify on;
+
+# Replace with the IP address of your resolver
+resolver {{ nginx_resolver_hosts | join(' ') }} valid={{ nginx_resolver_valid }};
+
 # vim:filetype=nginx

templates/etc/nginx/helper/ssl-strong.j2

@@ -1,18 +1,21 @@
 #
 # {{ ansible_managed }}
-#
+# See: https://ssl-config.mozilla.org/#server=nginx&version=1.18.0&config=modern&openssl=1.1.1n&hsts=false&guideline=5.7
 
-ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384";
-ssl_protocols TLSv1.2{% if nginx_version.stdout is version('1.13.0', 'ge') %} TLSv1.3{% endif %};
-ssl_prefer_server_ciphers on;
-ssl_ecdh_curve secp384r1;
-ssl_session_timeout 10m;
-ssl_session_cache shared:SSL:10m;
+ssl_session_timeout 1d;
+ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
 ssl_session_tickets off;
+
+# modern configuration
+ssl_protocols TLSv1.3;
+ssl_prefer_server_ciphers off;
+
+# OCSP stapling
 ssl_stapling on;
 ssl_stapling_verify on;
+
+# Replace with the IP address of your resolver
 resolver {{ nginx_resolver_hosts | join(' ') }} valid={{ nginx_resolver_valid }};
 resolver_timeout {{ nginx_resolver_timeout }};
-ssl_dhparam {{ nginx_dh_path }};
 
 # vim:filetype=nginx

templates/etc/nginx/nginx.conf.j2

@@ -5,6 +5,9 @@
 user {{ nginx_user }};
 worker_processes {{ nginx_worker_processes }};
 pid {{ nginx_pid }};
+{% for i in nginx_custom_core %}
+{{ i }}
+{% endfor %}
 include {{ nginx_etc_dir }}/modules-enabled/*.conf;
 
 events {

tests/group_vars/all.yml

@@ -6,6 +6,8 @@ int_ansible_ssl_dir: '/etc/ansible-ssl'
 nginx_worker_processes: 1    # Ansible+FreeBSD can't detect CPU number
 nginx_apt_package: 'nginx-extras'
 nginx_module_packages: ['libnginx-mod-http-headers-more-filter']
+nginx_custom_core:
+  - 'worker_rlimit_nofile 4242;'
 
 nginx_upstreams:
   - name: 'test'
@@ -102,7 +104,7 @@ nginx_ssl_pairs:
 
 nginx_custom_http:
   - 'add_header X-ansible 1;'
-  - 'geoip_country {% if ansible_distribution == "Debian" %}/usr/share/GeoIP/GeoIP.dat{% else %}/usr/local/share/GeoIP/GeoIP.dat{% endif %};'
+  - 'geoip_country {% if ansible_os_family == "Debian" %}/usr/share/GeoIP/GeoIP.dat{% else %}/usr/local/share/GeoIP/GeoIP.dat{% endif %};'
   - 'map $geoip_country_code $allowed_country {'
   - '    default yes;'
   - '    MA no;'
@@ -246,5 +248,5 @@ nginx_sites:
     custom_template: 'templates/custom_template.conf.j2'
     root: '/tmp/custom-template'
 
-nginx_php: "{{ [{'upstream_name': 'manual', 'sockets': [{'host': '127.0.0.1', 'port': '9636' }] }] }}"
+nginx_php: "{{ [{'upstream_name': 'manual', 'sockets': [{'host': '127.0.0.1', 'port': '9636'}]}] }}"
 nginx_dh_length: 1024

tests/includes/post_common.yml

@@ -244,14 +244,12 @@
   ansible.builtin.shell: set -o pipefail && curl -I --haproxy-protocol http://test-ssl-proxy-protocol.local:20080 | grep -qi 'X-Proxy-Protocol'
   args:
     executable: /bin/bash
-    warn: false
   changed_when: false
 
 - name: SHELL | Check HTTPS proxy protocol
   ansible.builtin.shell: set -o pipefail && curl -I --haproxy-protocol -k https://test-ssl-proxy-protocol.local:20443 | grep -qi 'X-Proxy-Protocol'
   args:
     executable: /bin/bash
-    warn: false
   changed_when: false
 
 # --------------------------------
@@ -262,4 +260,3 @@
   args:
     executable: /bin/bash
   changed_when: false
-  when: nginx_auto_config_httpv2 and 'http_v2' in nginx_modules

tests/includes/pre_Debian.yml

@@ -1,13 +1,13 @@
 ---
 
 - name: APT_REPOSITORY | Install backports
-  apt_repository:
+  ansible.builtin.apt_repository:
     repo: 'deb http://httpredir.debian.org/debian {{ ansible_distribution_release }}-backports main'
     state: present
-  when: nginx_backports
+  when: nginx_backports is defined and nginx_backports
 
 - name: APT | Install needed packages
-  apt:
+  ansible.builtin.apt:
     pkg: "{{ packages }}"
     update_cache: true
     cache_valid_time: 3600
@@ -24,7 +24,7 @@
       - unzip
 
 - name: APT | Install PHP
-  apt:
+  ansible.builtin.apt:
     pkg: "{{ pkgs }}"
     update_cache: true
     cache_valid_time: 3600
@@ -35,40 +35,39 @@
       - php-fpm
 
 - name: SHELL | Get current PHP version
-  shell: php --version | awk '/^PHP/ { print $2 }' | grep -o -E '^.{3}'
+  ansible.builtin.shell: php --version | awk '/^PHP/ { print $2 }' | grep -o -E '^.{3}'
   changed_when: false
   register: cur_php_version
 
 # Bypasses Ansible+Docker issue. With service module... php is not really started!
 - name: COMMAND | Force start PHP
-  command: "service php{{ cur_php_version.stdout }}-fpm start"
+  ansible.builtin.command: "service php{{ cur_php_version.stdout }}-fpm start"
   args:
     creates: "/run/php/php{{ cur_php_version.stdout }}-fpm.pid"
-    warn: false
 
 - name: GET_URL | Download ngrok
-  get_url:
-    url: "https://bin.equinox.io/c/4VmDzA7iaHb/ngrok-stable-linux-amd64.zip"
+  ansible.builtin.get_url:
+    url: "https://bin.equinox.io/c/bNyj1mQVY4c/ngrok-v3-stable-linux-amd64.tgz"
     dest: "/tmp/ngrok.zip"
 
 - name: UNARCHIVE | Uncompress ngrok
-  unarchive:
+  ansible.builtin.unarchive:
     src: "/tmp/ngrok.zip"
     dest: "/tmp"
     remote_src: true
 
 - name: SET_FACT | ngrok_path
-  set_fact:
+  ansible.builtin.set_fact:
     ngrok_path: '/tmp/ngrok'
 
 - name: USER | Create PHP User foo
-  user:
+  ansible.builtin.user:
     name: foo
     system: true
 
-- name: INCLUDE_ROLE | hanxhx.php
-  include_role:
-    name: "{{ playbook_dir }}/hanxhx.php"
+- name: INCLUDE_ROLE | hanxhx.php  # TODO: repair vagrant
+  ansible.builtin.include_role:
+    name: "hanxhx.php"
   vars:
     php_version: "{{ cur_php_version.stdout }}"
     php_autoremove_default_pool: false

tests/includes/pre_common.yml

@@ -1,34 +1,24 @@
 ---
 
-- name: SHELL | Start ngrok
-  shell: daemonize -l /tmp/ngrok.lock {{ ngrok_path }} http 80 -bind-tls=false
+- name: COMMAND | Start ngrok
+  ansible.builtin.command: daemonize -l /tmp/ngrok.lock {{ ngrok_path }} http 80 --scheme http
   failed_when: false
   changed_when: ngrok.stderr.find("Can't lock the lock file") == -1
   register: ngrok
 
-- name: WAIT_FOR | ngrok started
-  wait_for:
+- name: WAIT_FOR | ngrok started  # noqa: no-handler
+  ansible.builtin.wait_for:
     delay: 2
     port: 4040
   when: ngrok.changed
 
 - name: SHELL | Get ngrok public address
-  shell: set -o pipefail && curl 'http://127.0.0.1:4040/api/tunnels/command_line' 2> /dev/null | jq -r '.public_url' | cut -d '/' -f 3
+  ansible.builtin.shell: set -o pipefail && curl 'http://127.0.0.1:4040/api/tunnels/command_line' 2> /dev/null | jq -r '.public_url' | cut -d '/' -f 3
   args:
     executable: /bin/bash
-    warn: false
   register: ngrok
   changed_when: false
 
-- name: LINEINFILE | Tune vimrc
-  lineinfile:
-    line: "set mouse="
-    dest: "{{ item }}/.vimrc"
-    create: true
-  loop:
-    - /root
-    - /home/vagrant
-
 - name: FILE | Create an internal SSL dir
   ansible.builtin.file:
     path: "{{ int_ansible_ssl_dir }}"
@@ -37,21 +27,16 @@
     owner: root
     group: root
 
-- name: COPY | Deploy test certificate
+- name: COPY | Deploy test cert/key
   ansible.builtin.copy:
-    src: "file/test.crt"
-    dest: "{{ int_ansible_ssl_dir }}/test.crt"
-    mode: 0640
-    owner: root
-    group: root
-
-- name: COPY | Deploy test key
-  ansible.builtin.copy:
-    src: "file/test.key"
-    dest: "{{ int_ansible_ssl_dir }}/test.key"
+    src: "file/{{ item }}"
+    dest: "{{ int_ansible_ssl_dir }}/{{ item }}"
     mode: 0640
     owner: root
     group: root
+  loop:
+    - 'test.key'
+    - 'test.crt'
 
 - name: COPY | Add all hosts in /etc/hosts
   ansible.builtin.copy:

tests/test.yml

@@ -1,10 +1,10 @@
 ---
 
-- name: Launch tests
+- name: Launch tests  # noqa: role-name[path]
   hosts: all
   pre_tasks:
     - name: INCLUDE_TASKS | Pre_tasks related to OS version
-      ansible.builtin.include_tasks: "includes/pre_{{ ansible_distribution }}.yml"
+      ansible.builtin.include_tasks: "includes/pre_{{ ansible_os_family }}.yml"
 
     - name: IMPORT_TASKS | Pre_tasks common
       ansible.builtin.import_tasks: "includes/pre_common.yml"
@@ -14,7 +14,7 @@
 
   post_tasks:
     - name: INCLUDE_TASKS | Post_tasks related to OS version
-      ansible.builtin.include_tasks: "includes/post_{{ ansible_distribution }}.yml"
+      ansible.builtin.include_tasks: "includes/post_{{ ansible_os_family }}.yml"
 
     - name: IMPORT_TASKS | Post_tasks common
       ansible.builtin.import_tasks: "includes/post_common.yml"