make nginx config explicit

4 files changed, 173 insertions, 1 deletions

diff --git a/roles/nginx/files/fastcgi_params b/roles/nginx/files/fastcgi_params
new file mode 100644
index 0000000..765b6f0
--- /dev/null
+++ b/roles/nginx/files/fastcgi_params
@@ -0,0 +1,24 @@
+fastcgi_param  QUERY_STRING       $query_string;
+fastcgi_param  REQUEST_METHOD     $request_method;
+fastcgi_param  CONTENT_TYPE       $content_type;
+fastcgi_param  CONTENT_LENGTH     $content_length;
+
+fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
+fastcgi_param  REQUEST_URI        $request_uri;
+fastcgi_param  DOCUMENT_URI       $document_uri;
+fastcgi_param  DOCUMENT_ROOT      $document_root;
+fastcgi_param  SERVER_PROTOCOL    $server_protocol;
+fastcgi_param  REQUEST_SCHEME     $scheme;
+fastcgi_param  HTTPS              $https if_not_empty;
+
+fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
+fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;
+
+fastcgi_param  REMOTE_ADDR        $remote_addr;
+fastcgi_param  REMOTE_PORT        $remote_port;
+fastcgi_param  SERVER_ADDR        $server_addr;
+fastcgi_param  SERVER_PORT        $server_port;
+fastcgi_param  SERVER_NAME        $server_name;
+
+# PHP only, required if PHP was built with --enable-force-cgi-redirect
+fastcgi_param  REDIRECT_STATUS    200;
diff --git a/roles/nginx/files/mime.types b/roles/nginx/files/mime.types
new file mode 100644
index 0000000..1334642
--- /dev/null
+++ b/roles/nginx/files/mime.types
@@ -0,0 +1,98 @@
+types {
+	text/html																				html htm shtml;
+	text/css																				css;
+	text/xml																				xml;
+	image/gif																				gif;
+	image/jpeg																			jpeg jpg;
+	application/javascript													js;
+	application/atom+xml														atom;
+	application/rss+xml															rss;
+
+	text/mathml																			mml;
+	text/plain																			txt;
+	text/vnd.sun.j2me.app-descriptor								jad;
+	text/vnd.wap.wml																wml;
+	text/x-component																htc;
+
+	image/avif																			avif;
+	image/png																				png;
+	image/svg+xml																		svg svgz;
+	image/tiff																			tif tiff;
+	image/vnd.wap.wbmp															wbmp;
+	image/webp																			webp;
+	image/x-icon																		ico;
+	image/x-jng																			jng;
+	image/x-ms-bmp																	bmp;
+
+	font/woff																				woff;
+	font/woff2																			woff2;
+
+	application/java-archive												jar war ear;
+	application/json																json;
+	application/mac-binhex40												hqx;
+	application/msword															doc;
+	application/pdf																	pdf;
+	application/postscript													ps eps ai;
+	application/rtf																	rtf;
+	application/vnd.apple.mpegurl										m3u8;
+	application/vnd.google-earth.kml+xml						kml;
+	application/vnd.google-earth.kmz								kmz;
+	application/vnd.ms-excel												xls;
+	application/vnd.ms-fontobject										eot;
+	application/vnd.ms-powerpoint										ppt;
+	application/vnd.oasis.opendocument.graphics			odg;
+	application/vnd.oasis.opendocument.presentation	odp;
+	application/vnd.oasis.opendocument.spreadsheet	ods;
+	application/vnd.oasis.opendocument.text					odt;
+	application/vnd.openxmlformats-officedocument.presentationml.presentation
+																							 		pptx;
+	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
+																							 		xlsx;
+	application/vnd.openxmlformats-officedocument.wordprocessingml.document
+																							 		docx;
+	application/vnd.wap.wmlc												wmlc;
+	application/wasm																wasm;
+	application/x-7z-compressed											7z;
+	application/x-cocoa															cco;
+	application/x-java-archive-diff									jardiff;
+	application/x-java-jnlp-file										jnlp;
+	application/x-makeself													run;
+	application/x-perl															pl pm;
+	application/x-pilot															prc pdb;
+	application/x-rar-compressed										rar;
+	application/x-redhat-package-manager						rpm;
+	application/x-sea																sea;
+	application/x-shockwave-flash										swf;
+	application/x-stuffit														sit;
+	application/x-tcl																tcl tk;
+	application/x-x509-ca-cert											der pem crt;
+	application/x-xpinstall													xpi;
+	application/xhtml+xml														xhtml;
+	application/xspf+xml														xspf;
+	application/zip																	zip;
+
+	application/octet-stream												bin exe dll;
+	application/octet-stream												deb;
+	application/octet-stream												dmg;
+	application/octet-stream												iso img;
+	application/octet-stream												msi msp msm;
+
+	audio/midi																			mid midi kar;
+	audio/mpeg																			mp3;
+	audio/ogg																				ogg;
+	audio/x-m4a																			m4a;
+	audio/x-realaudio																ra;
+
+	video/3gpp																			3gpp 3gp;
+	video/mp2t																			ts;
+	video/mp4																				mp4;
+	video/mpeg																			mpeg mpg;
+	video/quicktime																	mov;
+	video/webm																			webm;
+	video/x-flv																			flv;
+	video/x-m4v																			m4v;
+	video/x-mng																			mng;
+	video/x-ms-asf																	asx asf;
+	video/x-ms-wmv																	wmv;
+	video/x-msvideo																	avi;
+}
diff --git a/roles/nginx/files/nginx.conf b/roles/nginx/files/nginx.conf
new file mode 100644
index 0000000..ed0d4bb
--- /dev/null
+++ b/roles/nginx/files/nginx.conf
@@ -0,0 +1,36 @@
+user nginx;
+worker_processes auto;
+pcre_jit on;
+error_log /var/log/nginx/error.log warn;
+
+events {
+	worker_connections 1024;
+}
+
+http {
+	include /etc/nginx/mime.types;
+	default_type application/octet-stream;
+	server_tokens off;
+	client_max_body_size 1m;
+	sendfile on;
+	tcp_nopush on;
+	ssl_protocols TLSv1.2 TLSv1.3;
+	ssl_prefer_server_ciphers on;
+	ssl_session_cache shared:SSL:2m;
+	ssl_session_timeout 1h;
+	gzip on;
+	gzip_vary on;
+	gzip_proxied any;
+	gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
+	gzip_comp_level 6;
+	charset utf-8;
+	map $http_upgrade $connection_upgrade {
+		default upgrade;
+		'' close;
+	}
+	log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+		'$status $body_bytes_sent "$http_referer" '
+		'"$http_user_agent" "$http_x_forwarded_for"';
+	access_log /var/log/nginx/access.log main;
+		include /etc/nginx/http.d/*.conf;
+}
diff --git a/roles/nginx/tasks/main.yml b/roles/nginx/tasks/main.yml
index 39154fd..4c9354f 100644
--- a/roles/nginx/tasks/main.yml
+++ b/roles/nginx/tasks/main.yml
@@ -3,11 +3,25 @@
     name: nginx
 
 - name: Remove default nginx site config
-  register: default_nginx_site
   ansible.builtin.file:
     path: /etc/nginx/http.d/default.conf
     state: absent
 
+- name: Install nginx config
+  ansible.builtin.copy:
+    src: nginx.conf
+    dest: /etc/nginx/nginx.conf
+
+- name: Install fastcgi_params
+  ansible.builtin.copy:
+    src: fastcgi_params
+    dest: /etc/nginx/fastcgi_params
+
+- name: Install mime.types
+  ansible.builtin.copy:
+    src: mime.types
+    dest: /etc/nginx/mime.types
+
 - name: Start nginx service and configure to restart on boot
   ansible.builtin.service:
     name: nginx