Adds site templates

diff --git a/manifests/init.pp b/manifests/init.pp
index a17f847895542bd35139457726ac17f79f6a653f..d1966d8c8184e03681adb816c3c61c6aebd6a091 100644 (file)
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -21,10 +21,11 @@ class nginx inherits nginx::base {
 
   # Default site
   nginx::site { "default":
-    ensure  => present,
-    ssl     => absent,
-    source  => 'template',
-    certbot => false,
+    ensure   => present,
+    ssl      => absent,
+    source   => 'template',
+    template => 'default',
+    certbot  => false,
   }
 
   # Domain site

diff --git a/manifests/site/config.pp b/manifests/site/config.pp
index 991a70bb256abd6dd82e5745b0ffef560180fe33..8e1f71bfcfa6b7021c0841f3de176fd3d4169c00 100644 (file)
--- a/manifests/site/config.pp
+++ b/manifests/site/config.pp
@@ -1,6 +1,8 @@
 define nginx::site::config(
-  $ensure  = present,
-  $source  = 'file',
+  $ensure   = present,
+  $source   = 'file',
+  $template = 'site',
+  $backend  = 'weblocal',
 ){
   case $source {
     'file': {
@@ -16,7 +18,7 @@ define nginx::site::config(
     }
     'template': {
       file { "/etc/nginx/sites-available/$name":
-        content => template("nginx/$name.erb"),
+        content => template("nginx/${template}.erb"),
         owner   => "root",
         group   => "root",
         mode    => 0644,

diff --git a/templates/site-ssl.erb b/templates/site-ssl.erb
new file mode 100644 (file)
index 0000000..888c969
--- /dev/null
+++ b/templates/site-ssl.erb
@@ -0,0 +1,27 @@
+server {
+  listen      443 ssl http2;
+  server_name *.<%= name %> <%= name %>;
+
+  ssl on;
+  ssl_certificate     /etc/letsencrypt/live/<%= name %>/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/<%= name %>/privkey.pem;
+
+  ssl_session_timeout 5m;
+
+  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+  ssl_ciphers ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA;
+  ssl_prefer_server_ciphers on;
+  ssl_dhparam /etc/ssl/dhparams/dhparams_2048.pem;
+
+  # enable HSTS header
+  add_header Strict-Transport-Security "max-age=15768000; includeSubdomains; preload";
+
+  location / {
+    # preserve http header and set forwarded proto
+    proxy_set_header Host $http_host;
+    proxy_set_header X-Forwarded-Proto https;
+
+    # default proxy pass
+    proxy_pass       http://<%= backend %>:80;
+  }
+}

diff --git a/templates/site.erb b/templates/site.erb
new file mode 100644 (file)
index 0000000..15d1600
--- /dev/null
+++ b/templates/site.erb
@@ -0,0 +1,12 @@
+server {
+  listen       80;
+  server_name  *.<%= name %> <%= name %>;
+
+  location /.well-known/acme-challenge {
+    root /var/spool/certbot/<%= name %>;
+  }
+
+  location / {
+    return 301 https://$host$request_uri;
+  }
+}