1
0
Fork 0
mirror of https://github.com/DO1JLR/ansible_role_nginx.git synced 2024-08-16 16:19:48 +02:00

Support generation of dhparam

Note: Default length is 2048 bits, but can be changed by var
This commit is contained in:
Raoul 2020-12-24 19:52:31 +01:00
parent 642aa37a60
commit f14aad6fc0
No known key found for this signature in database
GPG key ID: C7493D73B67C1842
3 changed files with 28 additions and 12 deletions

View file

@ -22,3 +22,6 @@ snippet_files:
#default_robots_file: 'robots_disallow_all.txt' #default_robots_file: 'robots_disallow_all.txt'
nginx__dhparam_size: 2048

View file

@ -1,9 +1,9 @@
ssl_protocols TLSv1.2 TLSv1.3; ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on; ssl_prefer_server_ciphers on;
ssl_dhparam /etc/nginx/private/dhparam.pem;
#ssl_stapling on; #ssl_stapling on;
#ssl_stapling_verify on; #ssl_stapling_verify on;
#resolver 8.8.8.8 1.1.1.1 valid=300s; #resolver 8.8.8.8 1.1.1.1 valid=300s;
#resolver_timeout 3s; #resolver_timeout 3s;
#ssl_dhparam /etc/ssl/private/site.dh;

View file

@ -14,16 +14,29 @@
- nginx - nginx
#- name: Create strong dhparams - name: Create 'private' directory
# openssl_dhparam: file:
# path: '/etc/nginx/dhparam.pem' path: '/etc/nginx/private'
# size: 4096 state: directory
# notify: owner: root
# - Reload nginx group: root
# tags: mode: 'u=rwx,g=rx,o=rx'
# - configuration tags:
# - nginx - configuration
# - dhparam - nginx
- dhparam
- name: Create new dhparam of size '{{ nginx__dhparam_size }}'
openssl_dhparam:
path: '/etc/nginx/private/dhparam.pem'
size: '{{ nginx__dhparam_size | mandatory }}'
notify:
- Reload nginx
tags:
- configuration
- nginx
- dhparam
- name: Create 'sites-available' directory - name: Create 'sites-available' directory