From 8477c34bb3470341fb8ebb7b18d3d694d2941f3b Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Sat, 12 Oct 2019 05:36:28 +0200
Subject: refactoring nginx config snippets

---
 roles/nginx/defaults/main.yml                               |  8 ++++++++
 roles/nginx/files/conf.d/connection-upgrade.conf            |  6 ++++++
 roles/nginx/files/snippets/hsts.conf                        |  1 +
 roles/nginx/files/snippets/proxy-nobuff.conf                |  4 ++++
 roles/nginx/files/snippets/security-headers.conf            |  4 ++++
 roles/nginx/files/snippets/ssl.conf                         | 10 ++++++++++
 roles/nginx/tasks/main.yml                                  | 13 +++++++++----
 .../templates/generic-proxy-no-buffering-with-acme.conf.j2  | 12 +-----------
 8 files changed, 43 insertions(+), 15 deletions(-)
 create mode 100644 roles/nginx/files/conf.d/connection-upgrade.conf
 create mode 100644 roles/nginx/files/snippets/hsts.conf
 create mode 100644 roles/nginx/files/snippets/proxy-nobuff.conf
 create mode 100644 roles/nginx/files/snippets/security-headers.conf
 create mode 100644 roles/nginx/files/snippets/ssl.conf

(limited to 'roles/nginx')

diff --git a/roles/nginx/defaults/main.yml b/roles/nginx/defaults/main.yml
index 73b10a11..a38a95a0 100644
--- a/roles/nginx/defaults/main.yml
+++ b/roles/nginx/defaults/main.yml
@@ -1,6 +1,14 @@
 ---
 nginx_pkg_variant: nginx-light
 
+nginx_conf_d_files:
+  - connection-upgrade
+
+nginx_snippets:
+  - ssl
+  - hsts
+  - proxy-nobuff
+
 # nginx_vhosts:
 #   example:
 #     template: generic-proxy-no-buffering-with-acme
diff --git a/roles/nginx/files/conf.d/connection-upgrade.conf b/roles/nginx/files/conf.d/connection-upgrade.conf
new file mode 100644
index 00000000..4153effe
--- /dev/null
+++ b/roles/nginx/files/conf.d/connection-upgrade.conf
@@ -0,0 +1,6 @@
+# used for websockets
+# set http_connection to either upgrade or close (as normal)
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
diff --git a/roles/nginx/files/snippets/hsts.conf b/roles/nginx/files/snippets/hsts.conf
new file mode 100644
index 00000000..4ca8396e
--- /dev/null
+++ b/roles/nginx/files/snippets/hsts.conf
@@ -0,0 +1 @@
+add_header Strict-Transport-Security max-age=15768000;
diff --git a/roles/nginx/files/snippets/proxy-nobuff.conf b/roles/nginx/files/snippets/proxy-nobuff.conf
new file mode 100644
index 00000000..b08de70c
--- /dev/null
+++ b/roles/nginx/files/snippets/proxy-nobuff.conf
@@ -0,0 +1,4 @@
+proxy_buffering off;
+proxy_ignore_headers "X-Accel-Buffering";
+proxy_request_buffering off;
+proxy_http_version 1.1;
diff --git a/roles/nginx/files/snippets/security-headers.conf b/roles/nginx/files/snippets/security-headers.conf
new file mode 100644
index 00000000..b94d479d
--- /dev/null
+++ b/roles/nginx/files/snippets/security-headers.conf
@@ -0,0 +1,4 @@
+add_header X-Frame-Options DENY;
+add_header X-Content-Type-Options nosniff;
+add_header X-XSS-Protection "1; mode=block";
+# add_header Content-Security-Policy "default-src 'none'; connect-src 'self'; img-src 'self'; script-src 'self'; style-src 'self'";
diff --git a/roles/nginx/files/snippets/ssl.conf b/roles/nginx/files/snippets/ssl.conf
new file mode 100644
index 00000000..d187a7c0
--- /dev/null
+++ b/roles/nginx/files/snippets/ssl.conf
@@ -0,0 +1,10 @@
+ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AES:!ADH:!AECDH:!MD5;
+ssl_prefer_server_ciphers on;
+
+# openssl dhparam -out /etc/ssl/certs/dhparams.pem 2048
+ssl_dhparam /etc/ssl/dhparams.pem;
+
+ssl_session_cache shared:SSL:10m;
+ssl_session_timeout 10m;
+ssl_session_tickets off;
diff --git a/roles/nginx/tasks/main.yml b/roles/nginx/tasks/main.yml
index fd63954e..57816cea 100644
--- a/roles/nginx/tasks/main.yml
+++ b/roles/nginx/tasks/main.yml
@@ -10,12 +10,17 @@
     state: absent
   notify: restart nginx
 
+- name: install nginx config.d files
+  loop: "{{ nginx_conf_d_files }}"
+  copy:
+    src: "conf.d/{{ item }}.conf"
+    dest: /etc/nginx/conf.d/
+  notify: restart nginx
+
 - name: install nginx config snippets
-  loop:
-    - ssl
-    - hsts
+  loop: "{{ nginx_snippets }}"
   copy:
-    src: "{{ global_files_dir }}/common/nginx-snippets/{{ item }}.conf"
+    src: "snippets/{{ item }}.conf"
     dest: /etc/nginx/snippets/
   notify: restart nginx
 
diff --git a/roles/nginx/templates/generic-proxy-no-buffering-with-acme.conf.j2 b/roles/nginx/templates/generic-proxy-no-buffering-with-acme.conf.j2
index 784b2590..8cad2994 100644
--- a/roles/nginx/templates/generic-proxy-no-buffering-with-acme.conf.j2
+++ b/roles/nginx/templates/generic-proxy-no-buffering-with-acme.conf.j2
@@ -1,10 +1,3 @@
-# used for websockets
-# set http_connection to either upgrade or close (as normal)
-map $http_upgrade $connection_upgrade {
-    default upgrade;
-    ''      close;
-}
-
 server {
     listen 80;
     listen [::]:80;
@@ -29,10 +22,7 @@ server {
     include snippets/hsts.conf;
 
     location / {
-        proxy_buffering off;
-        proxy_ignore_headers "X-Accel-Buffering";
-        proxy_request_buffering off;
-        proxy_http_version 1.1;
+        include snippets/proxy-nobuff.conf;
 
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
-- 
cgit v1.2.3