second commit

ansible/roles/nginx_proxy/tasks/main.yml

@@ -0,0 +1,45 @@
+---
+# nginx als vorgelagerter Reverse Proxy (Konzept 7.2/7.2a/9). Nur inkludiert
+# wenn enable_nginx_proxy: true.
+
+- name: nginx installieren
+  ansible.builtin.apt:
+    name: nginx
+    state: present
+    update_cache: true
+
+- name: Default-vHost entfernen
+  ansible.builtin.file:
+    path: /etc/nginx/sites-enabled/default
+    state: absent
+
+- name: Proxy-Header-Snippet ausrollen (import)
+  ansible.builtin.import_tasks: snippets.yml
+
+- name: Jumphost-vHost-Konfiguration ausrollen
+  ansible.builtin.template:
+    src: jumphost.conf.j2
+    dest: /etc/nginx/sites-available/jumphost.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify: reload nginx
+
+- name: vHost aktivieren
+  ansible.builtin.file:
+    src: /etc/nginx/sites-available/jumphost.conf
+    dest: /etc/nginx/sites-enabled/jumphost.conf
+    state: link
+  notify: reload nginx
+
+- name: Zugriff des nginx-Users auf den App-Unix-Socket sicherstellen
+  ansible.builtin.user:
+    name: www-data
+    groups: "{{ jumphost_app_group }}"
+    append: true
+
+- name: nginx aktivieren und starten
+  ansible.builtin.service:
+    name: nginx
+    state: started
+    enabled: true

ansible/roles/nginx_proxy/tasks/snippets.yml

@@ -0,0 +1,20 @@
+---
+# Wird von tasks/main.yml importiert (siehe include_tasks unten ergaenzen,
+# falls Snippet-Datei separat gepflegt werden soll). Der Einfachheit halber
+# hier als eigenstaendiger Task-Block gehalten.
+- name: Snippet-Verzeichnis anlegen
+  ansible.builtin.file:
+    path: /etc/nginx/snippets
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Proxy-Header-Snippet ausrollen
+  ansible.builtin.template:
+    src: jumphost_proxy_headers.conf.j2
+    dest: /etc/nginx/snippets/jumphost_proxy_headers.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify: reload nginx