---
# nginx als vorgelagerter Reverse Proxy (Konzept 7.2/7.2a/9). Nur inkludiert
# wenn enable_nginx_proxy: true.

- name: nginx installieren
  ansible.builtin.apt:
    name: nginx
    state: present
    update_cache: true

- name: Default-vHost entfernen
  ansible.builtin.file:
    path: /etc/nginx/sites-enabled/default
    state: absent

- name: Proxy-Header-Snippet ausrollen (import)
  ansible.builtin.import_tasks: snippets.yml

- name: Jumphost-vHost-Konfiguration ausrollen
  ansible.builtin.template:
    src: jumphost.conf.j2
    dest: /etc/nginx/sites-available/jumphost.conf
    owner: root
    group: root
    mode: "0644"
  notify: reload nginx

- name: vHost aktivieren
  ansible.builtin.file:
    src: /etc/nginx/sites-available/jumphost.conf
    dest: /etc/nginx/sites-enabled/jumphost.conf
    state: link
  notify: reload nginx

- name: Zugriff des nginx-Users auf den App-Unix-Socket sicherstellen
  ansible.builtin.user:
    name: www-data
    groups: "{{ jumphost_app_group }}"
    append: true

- name: nginx aktivieren und starten
  ansible.builtin.service:
    name: nginx
    state: started
    enabled: true