rework all

ansible/roles/site_setup/tasks/configure.yml

@@ -0,0 +1,25 @@
+---
+- name: Create site directories
+  file:
+    path: "/var/www/html/{{ site_name }}"
+    state: directory
+    mode: '0755'
+  tags: configure
+
+- name: Deploy site content
+  template:
+    src: site_index.html.j2
+    dest: "/var/www/html/{{ site_name }}/index.html"
+  tags: configure
+
+- name: Configure Nginx for {{ site_name }}
+  template:
+    src: nginx_site.conf.j2
+    dest: "/etc/nginx/conf.d/{{ site_name }}.conf"
+  tags: configure
+
+- name: Restart Nginx
+  service:
+    name: nginx
+    state: restarted
+  tags: configure

ansible/roles/site_setup/tasks/firewall.yml

@@ -0,0 +1,29 @@
+---
+- name: Start and enable firewalld
+  service:
+    name: firewalld
+    state: started
+    enabled: true
+  tags: firewall
+
+- name: Open port 80 for HTTP
+  ansible.builtin.firewalld:
+    port: 80/tcp
+    permanent: true
+    state: enabled
+    immediate: yes
+  tags: firewall
+
+- name: Open port 443 for HTTPS
+  ansible.builtin.firewalld:
+    port: 443/tcp
+    permanent: true
+    state: enabled
+    immediate: yes
+  tags: firewall
+
+- name: Reload firewalld to apply changes
+  ansible.builtin.service:
+    name: firewalld
+    state: reloaded
+  tags: firewall

ansible/roles/site_setup/tasks/generate_ssl.yml

@@ -0,0 +1,24 @@
+---
+- name: Ensure SSL directory exists
+  file:
+    path: /etc/nginx/ssl
+    state: directory
+    mode: '0755'
+  tags: ssl
+
+- name: Generate self-signed SSL certificate
+  openssl_certificate:
+    path: /etc/nginx/ssl/{{ proxy_name }}.crt
+    privatekey_path: /etc/nginx/ssl/{{ proxy_name }}.key
+    common_name: "{{ proxy_name }}"
+    state: present
+    selfsigned: yes
+    owner: root
+    group: root
+    mode: '0644'
+    subject:
+      - organizationName: "Example Company"
+      - organizationalUnitName: "IT"
+      - localityName: "City"
+      - countryName: "US"
+  tags: ssl

ansible/roles/site_setup/tasks/install.yml

@@ -0,0 +1,8 @@
+---
+- name: Install Nginx
+  zypper:
+    name: nginx
+    state: present
+    force: yes
+    update_cache: yes
+  tags: install

ansible/roles/site_setup/tasks/main.yml

@@ -0,0 +1,12 @@
+---
+- import_tasks: install.yml
+  tags: install
+
+- import_tasks: configure.yml
+  tags: configure
+
+- import_tasks: proxy.yml
+  tags: proxy
+
+- import_tasks: firewall.yml
+  tags: firewall

ansible/roles/site_setup/tasks/proxy.yml

@@ -0,0 +1,26 @@
+---
+- name: Configure Nginx load balancer with SSL
+  template:
+    src: nginx_proxy_ssl.conf.j2
+    dest: "/etc/nginx/conf.d/proxy.conf"
+  tags: proxy
+
+- name: Ensure SSL directory exists
+  file:
+    path: /etc/nginx/ssl
+    state: directory
+    mode: '0755'
+  tags: proxy
+
+- name: Copy Diffie-Hellman parameters
+  copy:
+    src: dhparam.pem
+    dest: /etc/nginx/ssl/dhparam.pem
+    mode: '0600'
+  tags: proxy
+
+- name: Restart Nginx after configuration
+  service:
+    name: nginx
+    state: restarted
+  tags: proxy

ansible/roles/site_setup/templates/nginx_proxy.conf.j2

@@ -0,0 +1,31 @@
+upstream backend_servers {
+    server {{ backend_ip_1 }}:80;
+    server {{ backend_ip_2 }}:80;
+}
+
+server {
+    listen 80;
+    server_name {{ proxy_name }};
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl;
+    server_name {{ proxy_name }};
+
+    ssl_certificate /etc/nginx/ssl/{{ proxy_name }}.crt;
+    ssl_certificate_key /etc/nginx/ssl/{{ proxy_name }}.key;
+    ssl_dhparam /etc/nginx/ssl/dhparam.pem;
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384";
+
+    location / {
+        proxy_pass http://backend_servers;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}

ansible/roles/site_setup/templates/nginx_site.conf.j2

@@ -0,0 +1,9 @@
+server {
+    listen 80;
+    server_name {{ site_name }};
+
+    location / {
+        root /var/www/html/{{ site_name }};
+        index index.html;
+    }
+}

ansible/roles/site_setup/templates/site_index.html.j2

@@ -0,0 +1,10 @@
+<html>
+<head>
+<meta charset="UTF-8">
+<title>{{ site_name }}</title>
+</head>
+<body>
+<h1>{{ site_name }}</h1>
+<p>{{ additional_content }}</p>
+</body>
+</html>

ansible/roles/site_setup/vars/main.yml

@@ -0,0 +1,6 @@
+---
+site_name: "example_site"
+proxy_name: "proxy_server"
+backend_ip_1: "192.168.0.61"
+backend_ip_2: "192.168.0.62"
+additional_content: "Welcome to {{ site_name }}"