inventory.yml

@@ -1,5 +1,5 @@
 paddone:
-  hosts: 192.168.199.102
+  hosts: paddone.cose.belle
 
 cicles:
   hosts: 192.168.199.105
@@ -11,7 +11,7 @@ frontend:
   hosts: 172.172.0.3
 
 test:
-  hosts: 45.156.24.144
+  hosts: jolly.roger
   vars:
     ansible_user: debian
 

roles/stable/nginx/tasks/certbot.yml

@@ -17,6 +17,6 @@
 
 - name: Generate certificate if needed
   become: yes
-  command: /snap/bin/certbot --nginx --non-interactive --agree-tos
+  command: certbot-auto --nginx --non-interactive --agree-tos
       --domains {{ servers | items2dict(key_name='server_name', value_name='server_name') | join(',') }}
       --email {{certbot_email}}

roles/stable/nginx/tasks/main.yml

@@ -4,19 +4,6 @@
   apt:
     name: nginx
 
-- name: Default Configuration
-  become: yes
-  template:
-    src: default.j2
-    dest: /etc/nginx/sites-available/default
-
-- name: Link Default NGINX Configuration
-  become: yes
-  file:
-    src: "/etc/nginx/sites-available/default"
-    dest: "/etc/nginx/sites-enabled/default"
-    state: link
-
 - name: Configure Reverse Proxies
   become: yes
   template:

roles/stable/nginx/templates/default.j2

@@ -1,6 +1,7 @@
 
 	# cache
-	proxy_cache_path /tmp levels=1:2 keys_zone=STATIC:10m	inactive=24h  max_size=10g use_temp_path=off;
+	# proxy_cache_path /tmp levels=1:2 keys_zone=STATIC:10m	inactive=24h  max_size=1g;
+  keepalive 30;
 
 	# redirect all http traffic to https
 	server {

roles/stable/nginx/templates/reverse_proxy.conf.j2

@@ -1,3 +1,4 @@
+# nginx ssl file
 
 server {
   listen 80;
@@ -11,10 +12,12 @@ server {
     proxy_pass {{item.proxy_pass}};
     proxy_http_version 1.1;
 
+    # hide client ip to backend
+    proxy_set_header X-Real-IP         42.42.42.42;
 
-    # set host
+    # set host 
     proxy_set_header Host              $host;
-    proxy_set_header X-Forwarded-For   42.42.42.42;
+    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
     proxy_set_header X-Forwarded-Proto $scheme;
     proxy_set_header X-Forwarded-Host  $host;
     proxy_set_header X-Forwarded-Port  $server_port;
@@ -24,7 +27,7 @@ server {
     proxy_set_header Connection        "upgrade";
 
     # cache
-    proxy_cache STATIC;
+    # proxy_cache {{item.server_name}}
   }
 }
 

vars/frontend.yml

@@ -7,4 +7,8 @@ servers:
     proxy_pass: http://192.168.199.105:8080
     custom_config: |
       sendfile             on;
-      client_max_body_size 500m;
+      client_max_body_size 80m;
+
+  - gancio:
+    server_name: sblinda.cisti.org
+    proxy_pass: http://192.168.199.104:8000