Add SSL certificate to homepage

and rewrite some tasks

ansible/configuration.yml

@@ -71,9 +71,7 @@
     - geerlingguy.php
     - geerlingguy.mysql
 
-    - role: static-site
+    - role: homepage
-      static_site_name: anwinged
-      static_site_domain: anwinged.ru
 
     - role: static-site
       static_site_name: s2photo

ansible/roles/homepage/meta/main.yml

@@ -0,0 +1,15 @@
+---
+dependencies:
+  - role: ssl-certificate
+    cert_type: letsencrypt
+    cert_name: '{{ homepage_name }}'
+    cert_email: anwinged@ya.ru
+    cert_domains:
+      - '{{ homepage_domain }}'
+      - 'www.{{ homepage_domain }}'
+
+  - role: static-site
+    static_site_name: '{{ homepage_name }}'
+    static_site_domain: '{{ homepage_domain }}'
+    static_site_dir: '{{ homepage_dir }}'
+    static_site_template: homepage.conf.j2

ansible/roles/homepage/templates/homepage.conf.j2

@@ -0,0 +1,31 @@
+server {
+    server_name www.{{ homepage_domain }};
+    return 301 $scheme://{{ homepage_domain }}$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name {{ homepage_domain }};
+
+    ssl on;
+    ssl_certificate         {{ vars[homepage_name + "_ssl_certificate"] }};
+    ssl_certificate_key     {{ vars[homepage_name + "_ssl_key"] }};
+    ssl_trusted_certificate {{ vars[homepage_name + "_ssl_certificate"] }};
+
+    ssl_session_cache shared:SSL:50m;
+    ssl_session_timeout 5m;
+    ssl_stapling on;
+    ssl_stapling_verify on;
+
+    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+    ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
+
+    ssl_dhparam {{ vars[homepage_name + "_ssl_dhparam"] }};
+    ssl_prefer_server_ciphers on;
+
+    location / {
+        root {{ homepage_dir }}/current;
+        index index.html;
+        try_files $uri $uri/ =404;
+    }
+}

ansible/roles/homepage/vars/main.yml

@@ -0,0 +1,4 @@
+---
+homepage_name: anwinged_homepage
+homepage_domain: anwinged.ru
+homepage_dir: /var/www/anwinged

ansible/roles/static-site/defaults/main.yml

@@ -0,0 +1,5 @@
+---
+static_site_name: ''
+static_site_dir: '/var/www/{{ static_site_name }}'
+static_site_web_root: '{{ static_site_dir }}/current'
+static_site_template: site.conf.j2

ansible/roles/static-site/tasks/main.yml

@@ -1,13 +1,13 @@
 ---
-- name: "Create nginx config for {{ static_site_name }}."
+- name: "Create nginx config for {{ static_site_name }} from {{ static_site_template }}."
   template:
-    src: site.conf.j2
+    src: '{{ static_site_template }}'
     dest: "/etc/nginx/sites-enabled/{{ static_site_name }}.conf"
   notify: restart nginx
 
 - name: "Create root folder for {{ static_site_name }}."
   file:
-    path: "/var/www/{{ static_site_name }}"
+    path: "{{ static_site_dir }}"
     state: directory
     owner: "{{ deploy_user }}"
     group: www-data

ansible/roles/static-site/templates/site.conf.j2

@@ -8,7 +8,7 @@ server {
     server_name {{ static_site_domain }};
 
     location / {
-        root /var/www/{{ static_site_name }}/current;
+        root {{ static_site_web_root }};
         index index.html;
         try_files $uri $uri/ =404;
     }

ansible/roles/symfony-app/templates/app.conf.j2

@@ -2,7 +2,7 @@ server {
     server_name {{ app_domains | join(" ") }};
 
     {% if app_cert %}
-        listen 443 ssl http2 deferred;
+        listen 443 ssl http2;
     {% else %}
         listen 80;
     {% endif %}