certbot and nginx working

ansible/roles/nginx/files/ssl.conf

@@ -0,0 +1,7 @@
+ssl_session_timeout 1d;
+ssl_session_cache shared:MozSSL:1m;
+ssl_session_tickets off;
+ssl_dhparam ssl/dhparams.pem;
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
+ssl_prefer_server_ciphers off;

ansible/roles/nginx/handlers/main.yaml

@@ -0,0 +1,6 @@
+---
+
+- name: Restart nginx
+  ansible.builtin.service:
+    name: nginx.service
+    state: restarted

ansible/roles/nginx/tasks/main.yaml

@@ -5,3 +5,96 @@
       - nginx
     state: present
     update_cache: true
+
+- name: Create config dirs
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0775"
+  loop:
+    - /etc/nginx/sites-available
+    - /etc/nginx/sites-enabled
+    - /etc/nginx/conf.d
+    - /etc/nginx/ssl
+
+- name: Copy the ssl configuration
+  ansible.builtin.copy:
+    src: ssl.conf
+    dest: /etc/nginx/ssl/ssl.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart nginx
+
+- name: Generate dhparams
+  ansible.builtin.command:
+    argv:
+      - openssl
+      - dhparam
+      - -dsaparam
+      - -outform
+      - PEM
+      - -out
+      - /etc/nginx/ssl/dhparams.pem
+      - 4096
+    creates: /etc/nginx/ssl/dhparams.pem
+  notify: Restart nginx
+
+# - name: Generate dhparams (alternative)
+#   community.crypto.openssl_dhparam:
+#     group: root
+#     mode: "0644"
+#     owner: root
+#     path: /etc/nginx/ssl/dhparams.pem
+#     size: 4096
+#     state: present
+
+- name: Set permissions on dhparams
+  ansible.builtin.file:
+    path: /etc/nginx/ssl/dhparams.pem
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart nginx
+
+- name: Template out nginx base config
+  ansible.builtin.template:
+    src: nginx.conf.j2
+    dest: /etc/nginx/nginx.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart nginx
+
+- name: Template out nginx site configs
+  ansible.builtin.template:
+    src: site.conf.j2
+    dest: /etc/nginx/sites-available/{{ item.name }}.conf
+    owner: root
+    group: root
+    mode: "0644"
+  loop: "{{ nginx_sites }}"
+  notify: Restart nginx
+
+- name: Enable site configs
+  ansible.builtin.file:
+    path: /etc/nginx/sites-enabled/{{ item.name }}.conf
+    src: /etc/nginx/sites-available/{{ item.name }}.conf
+    state: link
+  loop: "{{ nginx_sites }}"
+  notify: Restart nginx
+
+- name: Run certbot role to install certificates
+  ansible.builtin.include_role:
+    name: certbot
+  vars:
+    certbot_domains: "{{ nginx_sites | map(attribute='name') }}"
+    certbot_notify: "Restart nginx"
+
+- name: Start and enable nginx
+  ansible.builtin.service:
+    name: nginx
+    state: started
+    enabled: true

ansible/roles/nginx/templates/nginx.conf.j2

@@ -0,0 +1,48 @@
+user {{ nginx_user }};
+worker_processes auto;
+worker_cpu_affinity auto;
+
+# include extra config
+include /etc/nginx/conf.d/*.conf;
+
+events {
+    multi_accept on;
+    worker_connections 1024;
+}
+
+http {
+    charset utf-8;
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+    server_tokens off;
+    log_not_found off;
+    types_hash_max_size 4096;
+    client_max_body_size 16M;
+
+    # MIME
+    include mime.types;
+    default_type application/octet-stream;
+
+    # Include SSL config
+    include ssl/ssl.conf;
+
+    server {
+        listen 80 default_server;
+        server_name "_";
+        return 444;
+    }
+
+    server {
+        listen 443 ssl http2 default_server;
+        server_name "_";
+        ssl_reject_handshake on;
+    }
+
+    # logging
+    access_log /var/log/nginx/access.log;
+    error_log /var/log/nginx/error.log warn;
+
+    # include sites
+    include /etc/nginx/sites-enabled/*.conf;
+}

ansible/roles/nginx/templates/site.conf.j2

@@ -0,0 +1,17 @@
+server {
+    listen 80;
+    server_name {{ item.name }};
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl http2;
+    server_name {{ item.name }};
+    ssl_certificate     /etc/letsencrypt/live/{{ item.name }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ item.name }}/privkey.pem;
+    location / {
+        proxy_pass http://{{ item.upstream.host }}:{{ item.upstream.port }};
+    }
+}