main.yml

- name: enable modsecurity and syncing the blacklist
  block:
    - name: load modsecurity inside nginx.conf
      lineinfile:
        path: /etc/nginx/nginx.conf
        insertbefore: BOF
        line: "load_module modules/ngx_http_modsecurity_module.so;"

    - name: create the /etc/modsecurity directory
      file: path=/etc/modsecurity state=directory

    - name: copy the blacklist.py script
      copy: src=files/blacklist.py dest=/etc/modsecurity/blacklist.py

    - name: copy the whitelist
      copy: src=files/whitelist.txt dest=/etc/modsecurity/whitelist.txt

    - name: ensure the blacklist source file is present
      file: path="{{ nginx_modsecurity_blacklist_source }}" owner=www-data state=touch

    - name: sync the blacklist for the first time
      shell: python /etc/modsecurity/blacklist.py {{ nginx_modsecurity_blacklist_source }}
      notify:
      - reload nginx

    - name: set up a cronjob to sync the blacklist
      cron:
        name: "sync blacklist"
        minute: "0"
        hour: "*/3"
        job: "python /etc/modsecurity/blacklist.py {{ nginx_modsecurity_blacklist_source }} \
              && service nginx reload \
              && echo $(date -Iseconds) > /etc/modsecurity/last_sync_at.txt"
  when: nginx_modsecurity_enabled
  tags:
  - nginx_site

- name: make sure the sync blacklist cron is disabled
  cron:
    name: "sync blacklist"
    state: absent
  when: not nginx_modsecurity_enabled
  tags:
  - nginx_site

- name: create sites-server-includes directories
  file: path=/etc/nginx/sites-server-includes state=directory
  tags:
  - nginx_site
  - deploy

- name: removing any old nginx server include template
  file: path=/etc/nginx/sites-server-includes/{{ app_name }}_include state=absent
  tags:
  - nginx_site
  - deploy

- name: setup nginx server include templates
  template: src="{{ item }}" dest=/etc/nginx/sites-server-includes/{{ app_name }}_include
  with_first_found:
    - files:
      - "templates/server_includes/{{ app_name }}_include.conf"
      skip: true
  notify:
  - reload nginx
  tags:
  - nginx_site
  - deploy

- name: setup nginx template
  template: src={{item}} dest=/etc/nginx/sites-available/{{ app_name }}
  with_first_found:
  - "roles/{{ app_name }}/templates/nginx.conf"
  - "templates/{{ app_name }}_site.conf"
  - "templates/site.conf"
  notify:
  - reload nginx
  register: nginx_template_state
  tags:
  - nginx_site
  - deploy

- name: enable nginx conf
  file: src=/etc/nginx/sites-available/{{ app_name }} dest=/etc/nginx/sites-enabled/{{ app_name }} state=link
  notify:
  - reload nginx
  tags:
  - nginx_site
  - deploy

# The following 3 tasks are there for the purpose of avoiding to call flush_handlers
# while still being able to handle reloading nginx on subsequent runs of an initially
# failed playbook run. Using flush_handlers can mess up the handler order.
- name: remember that nginx needs to reload
  file: path=/tmp/nginx_template_changed state=touch
  when: nginx_template_state.changed
  tags:
  - nginx_site
  - deploy

- name: check if nginx needs to reload
  stat: path=/tmp/nginx_template_changed
  register: nginx_template_changed
  tags:
  - nginx_site
  - deploy

- name: force reloading nginx in case the playbook run was interrupted
  command: /bin/true
  when: nginx_template_changed.stat.exists
  notify:
  - reload nginx
  - clean up nginx_template_changed file
  tags:
  - nginx_site
  - deploy