main.yml

---
- hosts: all, !strfry
  become: true

  roles:
    - role: nginxinc.nginx_core.nginx
      when: ansible_os_family != 'Archlinux'

  tasks:
    - import_tasks: install-Archlinux.yml
      when: ansible_os_family == 'Archlinux'

    - name: Configure nginx
      ansible.builtin.import_role:
        name: nginx_core.nginx_config
      vars:
        # https://github.com/nginxinc/ansible-role-nginx-config/blob/main/defaults/main/template.yml
        nginx_config_main_template_enable: true
        nginx_config_main_template:
          template_file: nginx.conf.j2
          deployment_location: /etc/nginx/nginx.conf
          backup: false
          config:
            main: # https://nginx.org/en/docs/ngx_core_module.html
              user:
                username: nginx
                group: nginx
              worker_processes: auto
              error_log:
                file: /var/log/nginx/error.log
                level: notice
                # nginx on Arch will throw an error: "pid" directive is duplicate
                #pid: /var/run/nginx.pid
            http: # https://nginx.org/en/docs/http/ngx_http_core_module.html
              default_type: application/octet-stream
              sendfile: true
              server_tokens: false
              tcp_nodelay: true
              tcp_nopush: true
              include:
                - /etc/nginx/mime.types
                - /etc/nginx/http.conf
                - /etc/nginx/conf.d/*.conf

        # Each dictionary in the top level list/array represents a new configuration file.
        nginx_config_http_template_enable: true
        nginx_config_http_template:
          - template_file: http/default.conf.j2
            deployment_location: /etc/nginx/http.conf
            backup: false
            config:
              core:
                default_type: application/octet-stream
                sendfile: true
                server_tokens: false
                tcp_nodelay: true
                tcp_nopush: true
                resolver: # required for oscp stapling
                  address: 
                  - '1.1.1.1'
                  - '8.8.8.8'
                resolver_timeout: 10s
              log:
                format:
                  - name: main
                    format: |
                      '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"  "$realip_remote_addr"'
              gzip: # https://nginx.org/en/docs/http/ngx_http_gzip_module.html
                enable: true
                comp_level: 3
                disable: "msie6"
                min_length: 1100
                proxied: any
                types:
                  - text/plain
                  - text/css 
                  - application/x-javascript 
                  - text/xml 
                  - application/xml
                vary: true

          - template_file: http/default.conf.j2
            deployment_location: "/etc/nginx/conf.d/mappings.conf"
            backup: false
            config:
              map:
                mappings: # https://nginx.org/en/docs/http/websocket.html
                  - string: $http_upgrade
                    variable: $connection_upgrade
                    content:
                      - value: default
                        new_value: upgrade
                      - value: "''"
                        new_value: close

#         - template_file: http/default.conf.j2
#           deployment_location: "/etc/nginx/conf.d/default.conf"
#           backup: false
#           config:
#             servers:
#               - core:
#                   server_name: _
#                   listen:
#                     - address: "{{ ansible_default_ipv4.address|default(ansible_all_ipv4_addresses[0]) }}:80"
#                 locations:
#                   - location: /
#                     rewrite:
#                       return:
#                         code: 404