main.yml

---

- name: DebOps pre_tasks hook
  include: "{{ lookup('task_src', 'nginx/pre_main.yml') }}"

- name: Check if nginx is installed
  stat: path=/usr/sbin/nginx
  register: nginx_register_installed

- include: passenger.yml
  when: nginx_flavor == 'passenger'

- include: nginx_org_packages.yml
  when: nginx_flavor == 'nginx.org'

- name: Install nginx packages
  apt:
    name: '{{ item }}'
    state: 'present'
    install_recommends: False
  with_flattened:
    - '{{ nginx_flavor_package_map[nginx_flavor] }}'
    - '{{ nginx_base_packages }}'

- name: Create default nginx directories
  file:
    path: '{{ item }}'
    state: 'directory'
    owner: 'root'
    group: 'root'
    mode: '0755'
  with_items:
    - '/etc/nginx/site-default.d'
    - '/etc/nginx/sites-available'
    - '/etc/nginx/sites-enabled'
    - '/etc/nginx/snippets'

- name: Divert default.conf in case nginx nginx.org flavor is used
  command: dpkg-divert --quiet --local --divert /etc/nginx/conf.d/default.conf.dpkg-divert
           --rename /etc/nginx/conf.d/default.conf
  args:
    creates: '/etc/nginx/conf.d/default.conf.dpkg-divert'
  when: nginx_flavor == 'nginx.org'

- include: passenger_config.yml
  when: nginx_flavor == 'passenger'

- name: Restart nginx on first install to bypass missing pid bug
  service:
    name: 'nginx'
    state: 'restarted'
  when: ((nginx_register_installed is defined and nginx_register_installed) and
         not nginx_register_installed.stat.exists)

- name: Check nginx version
  shell: /usr/sbin/nginx -v 2>&1 | sed -e 's#^.*/##'
  register: nginx_register_version
  changed_when: False
  tags: [ 'role::nginx:servers' ]

- name: Define nginx version
  set_fact:
    nginx_version: '{{ nginx_register_version.stdout | default("0.0") }}'
  tags: [ 'role::nginx:servers' ]

- name: Get list of nameservers configured in /etc/resolv.conf
  shell: "grep -E '^nameserver\\s' /etc/resolv.conf | awk '{print $2}'"
  register: nginx_register_nameservers
  changed_when: False
  tags: [ 'role::nginx:servers' ]

- name: Convert list of nameservers to Ansible list
  set_fact:
    nginx_ocsp_resolvers: "{{ nginx_register_nameservers.stdout_lines }}"
  when: ((nginx_register_nameservers.stdout is defined and nginx_register_nameservers.stdout) and
         (nginx_ocsp_resolvers is undefined or
         (nginx_ocsp_resolvers is defined and not nginx_ocsp_resolvers)))
  tags: [ 'role::nginx:servers' ]

- name: Ensure that webadmins privileged group exists
  group:
    name: '{{ nginx_privileged_group }}'
    state: 'present'
    system: True

- name: Create directory for webadmins configuration
  file:
    path: '/etc/nginx/sites-local'
    state: 'directory'
    owner: 'root'
    group: '{{ nginx_privileged_group }}'
    mode: '0775'

- name: Allow webadmins to reload nginx using sudo
  template:
    src: 'etc/sudoers.d/nginx_webadmins.j2'
    dest: '/etc/sudoers.d/nginx_webadmins'
    owner: 'root'
    group: 'root'
    mode: '0440'

- name: Divert original /etc/nginx/nginx.conf
  command: dpkg-divert --quiet --local --divert /etc/nginx/nginx.conf.dpkg-divert
           --rename /etc/nginx/nginx.conf
  args:
    creates: '/etc/nginx/nginx.conf.dpkg-divert'

- name: Setup /etc/nginx/nginx.conf
  template:
    src: 'etc/nginx/nginx.conf.j2'
    dest: '/etc/nginx/nginx.conf'
    owner: 'root'
    group: 'root'
    mode: '0644'
  notify: [ 'Test nginx and reload' ]

- name: Generate custom nginx snippets
  template:
    src: 'etc/nginx/snippets/{{ item }}.conf.j2'
    dest: '/etc/nginx/snippets/{{ item }}.conf'
    owner: 'root'
    group: 'root'
    mode: '0644'
  with_items: [ 'acme-challenge' ]
  notify: [ 'Test nginx and reload' ]

  # Remove temporary old files if they are present
- name: Remove remnants of dpkg-diverted configuration
  command: rm -f /etc/nginx/fastcgi_params.dpkg-divert /etc/nginx/fastcgi_params.dpkg-divert.lock
  args:
    removes: '/etc/nginx/fastcgi_params.dpkg-divert.lock'
  notify: [ 'Test nginx and reload' ]

- name: Disable default nginx site
  file:
    path: '/etc/nginx/sites-enabled/default'
    state: 'absent'
  notify: [ 'Test nginx and reload' ]

- name: Manage local server definitions - create symlinks
  file:
    src: '/etc/nginx/sites-local/{{ item.0 }}'
    path: '/etc/nginx/sites-enabled/{{ item.1 }}'
    state: 'link'
    owner: 'root'
    group: 'root'
    mode: '0644'
  with_together:
    - '{{ nginx_local_servers.values() }}'
    - '{{ nginx_local_servers.keys() }}'
  notify: [ 'Test nginx and reload' ]
  when: ((nginx_local_servers is defined and nginx_local_servers) and
         (item.0 is defined and item.0))

- name: Manage local server definitions - remove symlinks
  file:
    path: '/etc/nginx/sites-enabled/{{ item.1 }}'
    state: 'absent'
  with_together:
    - '{{ nginx_local_servers.values() }}'
    - '{{ nginx_local_servers.keys() }}'
  notify: [ 'Test nginx and reload' ]
  when: ((nginx_local_servers is defined and nginx_local_servers) and
         (item.0 is undefined or (item.0 is defined and not item.0)))

  # If nginx local facts are not present, assume that configuration
  # is being reset and move all symlinks out of the way to prevent
  # accidental failures because of old wrong configuration files
- name: Remove all configuration symlinks during config reset
  shell: rm -f /etc/nginx/sites-enabled/*
  args:
    creates: '/etc/ansible/facts.d/nginx.fact'
    warn: False

- name: Make sure that Ansible local facts directory is present
  file:
    path: '/etc/ansible/facts.d'
    state: 'directory'
    owner: 'root'
    group: 'root'
    mode: '0755'

- name: Save nginx local facts
  template:
    src: 'etc/ansible/facts.d/nginx.fact.j2'
    dest: '/etc/ansible/facts.d/nginx.fact'
    owner: 'root'
    group: 'root'
    mode: '0644'
  register: nginx_register_local_facts

- name: Gather facts if they were modified
  action: setup
  when: nginx_register_local_facts.changed

- include: nginx_htpasswd.yml

- include: nginx_configs.yml

- include: nginx_servers.yml
  tags: [ 'role::nginx:servers' ]

- name: Make sure that PKI hook directory exists
  file:
    path: '{{ nginx_pki_hook_path }}'
    state: 'directory'
    owner: 'root'
    group: 'root'
    mode: '0755'
  when: nginx_pki | bool

- name: Manage PKI nginx hook
  template:
    src: 'etc/pki/hooks/nginx.j2'
    dest: '{{ nginx_pki_hook_path + "/" + nginx_pki_hook_name }}'
    owner: 'root'
    group: 'root'
    mode: '0755'
  when: nginx_pki | bool

- name: Save nginx local facts
  template:
    src: 'etc/ansible/facts.d/nginx.fact.j2'
    dest: '/etc/ansible/facts.d/nginx.fact'
    owner: 'root'
    group: 'root'
    mode: '0644'
  register: nginx_register_local_facts

- name: Gather facts if they were modified
  action: setup
  when: nginx_register_local_facts.changed

- name: DebOps post_tasks hook
  include: "{{ lookup('task_src', 'nginx/post_main.yml') }}"