Reverse proxy support

[goetzk]

Hi,

I'm using this role with the following configuration and template to give myself a reverse proxy configuration.
I'm wondering if you are interested in having in built support for reverse proxies like this and if yes which bits you'd like to see made configurable.
Things I'm guessing you'd like to see configurable are listed below but do you have any others?

• listen directives
• client_max_body_size ?
• keepalive_timeout?
• proxy_pass target host+port

If you're interested I'll put together a PR for a more detailed review.

nginx_sites:
  - id: credentials
    name: "example.com"
    ip: x.x.x.x
    state: present
    add_webroot: no
    aliases:
      - "alias.example.com"
    template: templates-shared/nginx-with-https-upgrade.tmpl
    webroot: "/srv/x/webroot"
    # Where the .well-known folder sits in
    wellknown: "/srv/x/letsencrypt"
    redirects:
      - "{{ another.example.com }}"
      - "{{ something.example.com }}.au"
    ssl:
      cert_path: /etc/letsencrypt/live/{{ x }}
      cert_name: fullchain.pem
      key_name: privkey.pem
    rules: []
    append: ''

cat reverse-proxy.j2 
# {{ ansible_managed }}
# HTTPS terminating proxy sitting in front of webapp.
# TODO: Check: Some of this file can probably be removed with no loss in functionality.

# default_server on listen is required to work around bug https://github.com/certbot/certbot/issues/5817#issuecomment-391051737
server {
    server_name {{ item.name }}{% for value in item.aliases|default([]) %} {{ value }}{% endfor %};

    return 301 https://$host$request_uri;

    listen 80 ;
    return 404;
}

server {
    server_name {{ item.name }}{% for value in item.aliases|default([]) %} {{ value }}{% endfor %};

    charset utf-8;
    keepalive_timeout 65;
    client_max_body_size 128M;
    gzip_types text/css application/javascript text/javascript text/plain text/xml application/xml;
    gzip_vary on;

    root {{ item.webroot }};

    # Letsencrypt
    location /.well-known {
        alias {{ item.wellknown }}/.well-known;
    }

    location / {
        proxy_pass http://127.0.0.1:8000/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    listen 443 ssl;
    ssl_certificate {{ item.ssl.cert_path |default(openssl_certs_path) }}/{{ item.ssl.cert_name|default('server.crt') }};
    ssl_certificate_key {{ item.ssl.cert_path |default(openssl_keys_path) }}/{{ item.ssl.key_name|default('server.key') }};

}

[goetzk]

Writing that up I decided to go for the PR anyway and I've opened #12.