vault-cluster

1
---
2
- name: Установка и настройка nginx
3
  hosts: nginx-balancer
4
  become: yes
5
  gather_facts: no
6

7
  tasks:
8

9
    - name: Установка nginx
10
      apt:
11
        name: nginx
12
        state: latest
13
        update_cache: yes
14
        autoclean: yes
15
        autoremove: yes
16

17
    - name: Ensure nginx config file exists
18
      copy:
19
        content: |
20
          upstream vault_servers {
21
            {% for host in upstreams %}
22
            server {{ host }}:8200 max_fails=3 fail_timeout=2s;
23
            {% endfor %}
24
          }
25

26
          server {
27
            listen 9000 ssl http2 default_server;
28
            listen [::]:9000 ssl http2 default_server;
29

30
            ssl_certificate /etc/ssl/vault/vault.crt;
31
            ssl_certificate_key /etc/ssl/vault/vault.key;
32

33
            ssl_protocols TLSv1.3;
34
            ssl_prefer_server_ciphers on;
35
            ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
36
            ssl_ecdh_curve secp384r1;
37
            ssl_session_cache shared:SSL:10m;
38
            ssl_session_tickets off;
39
            ssl_stapling on;
40
            ssl_stapling_verify on;
41
            resolver 8.8.8.8 8.8.4.4 valid=300s;
42
            resolver_timeout 5s;
43
            add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
44
            add_header X-Frame-Options "SAMEORIGIN";
45
            add_header X-Content-Type-Options nosniff;
46
        
47
            location / {
48
              proxy_set_header Host $http_host;
49
              proxy_set_header X-Real-IP $remote_addr;
50
              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
51
              proxy_set_header X-Forwarded-Proto $scheme;
52
              proxy_pass {{ schema }}://vault_servers;
53
            }
54
          
55
          }
56

57
        dest: "/etc/nginx/sites-available/default"
58
        owner: root
59
        group: root
60
        mode: '0644'
61

62
    - name: Проверка синтаксиса конфигурации Nginx
63
      command: nginx -t
64
      register: nginx_check
65
      failed_when: "nginx_check.rc != 0"
66

67
    - name: Перезагружаем Nginx
68
      service:
69
        name: nginx
70
        state: restarted
71
      when: "nginx_check.rc == 0"
72