vagrant-easyredmine/roles/easyredmine/tasks/nginx.yml

- get_url:
    url: https://oss-binaries.phusionpassenger.com/yum/definitions/el-passenger.repo
    dest: /etc/yum.repos.d/passenger.repo
  become: yes

- rpm_key:
    key: https://packagecloud.io/gpg.key
  become: yes

# this makecache is mostly because I can not find any other way to fully
# import the GPG. key for the Passenger repo. 'rpm_key' is not
# sufficient.
# The use of /usr/bin/env is a hack to avoid Ansible's "Consider using
# yum module..." warnings when it sees 'yum' as the primary command.
- command: /usr/bin/env yum -q makecache -y --disablerepo='*' --enablerepo='passenger*'
  become: yes
  changed_when: False

- yum:
    name: epel-release
  become: yes

- name: install nginx, passenger
  yum:
    name: '{{ item }}'
  become: yes
  with_items:
    - nginx
    - passenger

- stat:
    path: '{{ dharam_pem_path }}'
  register: dharam_pem

# https://michael.lustfield.net/nginx/getting-a-perfect-ssl-labs-score
- name: generate new Diffie-Hellman group
  command: 'openssl dhparam -out {{ dharam_pem_path }} 2048'
  become: yes
  notify: restart nginx
  when: dharam_pem.stat.exists == False

- template:
    dest: '/etc/nginx/conf.d/easyredmine.conf'
    src: easyredmine.conf.j2
  become: yes
  notify: restart nginx

- template:
    dest: '/etc/nginx/nginx.conf'
    src: nginx.conf.j2
  become: yes
  notify: restart nginx

- template:
    dest: /etc/nginx/conf.d/passenger.conf
    src: passenger.conf.j2
  become: yes
  notify: restart nginx

- copy:
    dest: '/etc/pki/tls/certs/{{ ansible_fqdn }}.pem'
    src: '{{ nginx_pem }}'
  become: yes
  notify: restart nginx

- service:
    name: nginx
    state: started
    enabled: yes
  become: yes