From 6bbdee9dc9333e94d13e8653ee3bb5626aa754b5 Mon Sep 17 00:00:00 2001 From: Joshua Hull Date: Sun, 15 Jan 2023 10:49:21 +0100 Subject: nginx: add common role for nginx esmil: - disable access log and log errors to syslog (journal really) use journalctl -u nginx to see the errors - hoist some configuration values into ansible variables - add tags and use a handler to reload nginx on configuration changes - make nginx do its DNS queries against our local resolved this enables nginx to use DNSSEC and DoT - don't start nginx before the network is up. if it can't do dns lookups ssl_stapling will be ignored --- roles/nginx/defaults/main.yml | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 roles/nginx/defaults/main.yml (limited to 'roles/nginx/defaults') diff --git a/roles/nginx/defaults/main.yml b/roles/nginx/defaults/main.yml new file mode 100644 index 0000000..914dde8 --- /dev/null +++ b/roles/nginx/defaults/main.yml @@ -0,0 +1,7 @@ +--- +nginx_worker_connections: 768 + +nginx_ssl_protocols: 'TLSv1.2 TLSv1.3' +nginx_ssl_ciphers: 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384' + +# vim: set ts=2 sw=2 et: -- cgit v1.2.1