Add a reverse proxy template

README.md

@@ -77,6 +77,27 @@ Here is a list of all the default variables for this role, which are also availa
 #     append: ''
 #
 
+# nginx_proxies:
+#   - id: foo (required)
+#     name: foo.com (required)
+#     aliases: []
+#     ip: '*'
+#     port: 80
+#     state: present
+#     template: path/to/template.j2
+#     wellknown: folder which .well-known sits within (required)
+#     ssl:
+#       upgrade: yes
+#       key_name: mykey.key
+#       key_path: path/to/key
+#       cert_name: mycert.crt
+#       cert_path: path/to/cert
+#     proxy_pass:
+#       target: 127.0.0.1
+#       target_port: 8000
+#     extra_headers: []
+
+
 # dependencies packages to install package
 nginx_dependencies:
   - ca-certificates

tasks/main.yml

@@ -22,6 +22,15 @@
     - manage
     - nginx-manage
 
+- import_tasks: proxies.yml
+  when: nginx_proxies
+  tags:
+    - web
+    - nginx
+    - manage
+    - nginx-manage
+    - proxies
+
 - import_tasks: service.yml
   tags:
     - web

tasks/proxies.yml

@@ -0,0 +1,30 @@
+---
+
+- name: Configuring proxies
+  template:
+    src: "{{ item.template|default('etc/nginx/sites-available/reverse-proxy.j2') }}"
+    dest: "/etc/nginx/sites-available/{{ item.id }}"
+    owner: root
+    group: root
+    mode: "0644"
+  with_items: "{{ nginx_proxies }}"
+  notify: reload nginx
+
+- name: Enabling proxies
+  file:
+    src: "/etc/nginx/sites-available/{{ item.id }}"
+    dest: "/etc/nginx/sites-enabled/{{ item.id }}"
+    state: link
+  when: item.state is not defined or item.state == 'present'
+  with_items: "{{ nginx_proxies }}"
+  notify: reload nginx
+
+- name: Disabling proxies
+  file:
+    src: "/etc/nginx/sites-available/{{ item.id }}"
+    dest: "/etc/nginx/sites-enabled/{{ item.id }}"
+    state: absent
+  when: item.state is defined and item.state == 'absent'
+  with_items: "{{ nginx_proxies }}"
+  notify: restart nginx
+

templates/etc/nginx/sites-available/reverse-proxy.j2

@@ -0,0 +1,55 @@
+# {{ ansible_managed }}
+
+# HTTPS terminating proxy sitting in front of webapp.
+
+# default_server on listen is required to work around bug https://github.com/certbot/certbot/issues/5817#issuecomment-391051737
+{% if item.ssl.upgrade is defined() %}
+server {
+    server_name {{ item.name }}{% for value in item.aliases|default([]) %} {{ value }}{% endfor %};
+
+    return 301 https://$host$request_uri;
+
+    listen {{ item.ip|default('*') }}:{{item.port|default(80)}};
+
+    access_log /var/log/nginx/{{ item.id }}-access-http.log;
+    error_log /var/log/nginx/{{ item.id }}-error-http.log;
+    return 404;
+}
+{% endif %}
+
+server {
+    server_name {{ item.name }}{% for value in item.aliases|default([]) %} {{ value }}{% endfor %};
+
+    charset utf-8;
+    keepalive_timeout {{ nginx_keepalive_timeout }};
+    client_max_body_size 128M;
+    gzip_types text/css application/javascript text/javascript text/plain text/xml application/xml;
+    gzip_vary on;
+
+    # Letsencrypt
+    location /.well-known {
+        alias {{ item.wellknown }}/.well-known;
+    }
+
+    location / {
+        proxy_pass http://{{ item.proxy_pass.target }}:{{ item.proxy_pass.target_port }}/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        {% if item.extra_headers is defined() %}
+          {% for value in item.extra_headers %}
+          proxy_set_header {{ value }}
+          {% endfor %}
+        {% endif %}
+    }
+
+    listen 443 ssl;
+    ssl_certificate {{ item.ssl.cert_path |default(openssl_certs_path) }}/{{ item.ssl.cert_name|default('server.crt') }};
+    ssl_certificate_key {{ item.ssl.cert_path |default(openssl_keys_path) }}/{{ item.ssl.key_name|default('server.key') }};
+
+    access_log /var/log/nginx/{{ item.id }}-access-https.log;
+    error_log /var/log/nginx/{{ item.id }}-error-https.log;
+
+}
+