From 7b6ecefcdfb5a31ca74a246614c237f0a7384357 Mon Sep 17 00:00:00 2001 From: Darks Date: Thu, 10 Sep 2020 18:38:19 +0200 Subject: [PATCH] Added nginx & uwsgi roles --- .gitignore | 1 + inventory.yml | 1 + nginx.yml | 9 +++ roles/nginx/files/common.conf | 11 +++ roles/nginx/files/conf.d/blockuseragents.conf | 7 ++ roles/nginx/files/conf.d/ddos.conf | 17 +++++ roles/nginx/files/conf.d/header.conf | 6 ++ roles/nginx/files/gzip.conf | 4 ++ roles/nginx/files/nginx.conf | 28 ++++++++ .../files/sites-available/000-default.conf | 22 ++++++ roles/nginx/files/sites-available/bible.conf | 51 +++++++++++++ .../files/sites-available/creativecalc.conf | 57 +++++++++++++++ roles/nginx/files/sites-available/gitea.conf | 41 +++++++++++ .../nginx/files/sites-available/grafana.conf | 37 ++++++++++ .../files/sites-available/mumbleweb.conf | 47 ++++++++++++ roles/nginx/files/sites-available/p7.conf | 42 +++++++++++ roles/nginx/files/sites-available/pc-dev.conf | 72 +++++++++++++++++++ roles/nginx/files/sites-available/pc.conf | 72 +++++++++++++++++++ roles/nginx/files/ssl.conf | 8 +++ roles/nginx/tasks/main.yml | 50 +++++++++++++ roles/nginx/vars/main.yml | 9 +++ roles/uwsgi/files/pc-dev.ini | 9 +++ roles/uwsgi/files/pc.ini | 9 +++ roles/uwsgi/files/uwsgi@.service | 17 +++++ roles/uwsgi/tasks/main.yml | 27 +++++++ roles/uwsgi/vars/main.yml | 2 + uwsgi.yml | 9 +++ 27 files changed, 665 insertions(+) create mode 100644 .gitignore create mode 100644 inventory.yml create mode 100644 nginx.yml create mode 100644 roles/nginx/files/common.conf create mode 100644 roles/nginx/files/conf.d/blockuseragents.conf create mode 100644 roles/nginx/files/conf.d/ddos.conf create mode 100644 roles/nginx/files/conf.d/header.conf create mode 100644 roles/nginx/files/gzip.conf create mode 100644 roles/nginx/files/nginx.conf create mode 100644 roles/nginx/files/sites-available/000-default.conf create mode 100644 roles/nginx/files/sites-available/bible.conf create mode 100644 roles/nginx/files/sites-available/creativecalc.conf create mode 100644 roles/nginx/files/sites-available/gitea.conf create mode 100644 roles/nginx/files/sites-available/grafana.conf create mode 100644 roles/nginx/files/sites-available/mumbleweb.conf create mode 100644 roles/nginx/files/sites-available/p7.conf create mode 100644 roles/nginx/files/sites-available/pc-dev.conf create mode 100644 roles/nginx/files/sites-available/pc.conf create mode 100644 roles/nginx/files/ssl.conf create mode 100644 roles/nginx/tasks/main.yml create mode 100644 roles/nginx/vars/main.yml create mode 100644 roles/uwsgi/files/pc-dev.ini create mode 100644 roles/uwsgi/files/pc.ini create mode 100644 roles/uwsgi/files/uwsgi@.service create mode 100644 roles/uwsgi/tasks/main.yml create mode 100644 roles/uwsgi/vars/main.yml create mode 100644 uwsgi.yml diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..2bfa6a4 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +tests/ diff --git a/inventory.yml b/inventory.yml new file mode 100644 index 0000000..66b946f --- /dev/null +++ b/inventory.yml @@ -0,0 +1 @@ +aperture-labs # Add an entry in your ~/.ssh/config diff --git a/nginx.yml b/nginx.yml new file mode 100644 index 0000000..b224b95 --- /dev/null +++ b/nginx.yml @@ -0,0 +1,9 @@ +--- +- name: Update Nginx configuration + hosts: all + become: yes + become_user: root + become_method: sudo + + roles: + - nginx diff --git a/roles/nginx/files/common.conf b/roles/nginx/files/common.conf new file mode 100644 index 0000000..bfc4424 --- /dev/null +++ b/roles/nginx/files/common.conf @@ -0,0 +1,11 @@ +location ^~ /.well-known/acme-challenge { + alias /var/www/dehydrated; +} + +if ($blockedagent) { + return 403; +} + +if ($request_method !~ ^(GET|PUT|POST)$ ) { + return 444; +} diff --git a/roles/nginx/files/conf.d/blockuseragents.conf b/roles/nginx/files/conf.d/blockuseragents.conf new file mode 100644 index 0000000..00045ba --- /dev/null +++ b/roles/nginx/files/conf.d/blockuseragents.conf @@ -0,0 +1,7 @@ +map $http_user_agent $blockedagent { + default 0; + ~*malicious 1; + ~*backdoor 1; + ~*crawler 1; + ~*spider 1; +} diff --git a/roles/nginx/files/conf.d/ddos.conf b/roles/nginx/files/conf.d/ddos.conf new file mode 100644 index 0000000..e8303f3 --- /dev/null +++ b/roles/nginx/files/conf.d/ddos.conf @@ -0,0 +1,17 @@ +# Slow DDOS Protection + +client_body_timeout 10; +client_header_timeout 10; +keepalive_timeout 5 5; +send_timeout 10; + + +# DDOS Protection + +# Maximum request per IP // 100 per seconde +limit_req_zone $binary_remote_addr zone=flood:10m rate=100r/s; +limit_req zone=flood burst=100 nodelay; + +# Maximum Connection per IP // 100 per seconde +limit_conn_zone $binary_remote_addr zone=ddos:10m; +limit_conn ddos 100; diff --git a/roles/nginx/files/conf.d/header.conf b/roles/nginx/files/conf.d/header.conf new file mode 100644 index 0000000..6470c68 --- /dev/null +++ b/roles/nginx/files/conf.d/header.conf @@ -0,0 +1,6 @@ +# Bad Header Protection +add_header X-Frame-Options SAMEORIGIN; +add_header X-Content-Type-Options nosniff; +add_header X-XSS-Protection "1; mode=block"; +add_header Referrer-Policy "strict-origin-when-cross-origin"; +add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;"; diff --git a/roles/nginx/files/gzip.conf b/roles/nginx/files/gzip.conf new file mode 100644 index 0000000..947c82b --- /dev/null +++ b/roles/nginx/files/gzip.conf @@ -0,0 +1,4 @@ +gzip on; +gzip_vary on; +gzip_types *; +gzip_min_length 1000; diff --git a/roles/nginx/files/nginx.conf b/roles/nginx/files/nginx.conf new file mode 100644 index 0000000..2936307 --- /dev/null +++ b/roles/nginx/files/nginx.conf @@ -0,0 +1,28 @@ +user http; +worker_processes auto; +error_log /var/log/nginx/error.log; +include /etc/nginx/modules-enabled/*.conf; + +events { + multi_accept on; + use epoll; + worker_connections 256; +} + +http { + index index.html index.htm index.php; + + server_tokens off; + + include /etc/nginx/mime.types; + charset_types text/css text/plain text/vnd.wap.wml application/javascript application/json application/rss+xml application/xml; + + sendfile on; + tcp_nopush on; + tcp_nodelay on; + + types_hash_bucket_size 128; + + include /etc/nginx/conf.d/*.conf; + include /etc/nginx/sites-enabled/*; +} diff --git a/roles/nginx/files/sites-available/000-default.conf b/roles/nginx/files/sites-available/000-default.conf new file mode 100644 index 0000000..df236d4 --- /dev/null +++ b/roles/nginx/files/sites-available/000-default.conf @@ -0,0 +1,22 @@ +server { + + listen 127.0.0.1:8080; + + access_log off; + + location /nginx-status { + stub_status on; + } + +} + +server { + listen 80 default_server; + listen [::]:80 default_server; + + server_name _; + + include common.conf; + + return 301 https://www.planet-casio.com; +} diff --git a/roles/nginx/files/sites-available/bible.conf b/roles/nginx/files/sites-available/bible.conf new file mode 100644 index 0000000..5b73269 --- /dev/null +++ b/roles/nginx/files/sites-available/bible.conf @@ -0,0 +1,51 @@ +server { + listen [::]:80; + listen *:80; + + server_name bible.planet-casio.com; + + include common.conf; + + access_log /var/log/nginx/bible_access.log; + error_log /var/log/nginx/bible_error.log; + + location / { + return 301 https://$server_name$request_uri; + } +} + +server { + listen [::]:443 ssl http2; + listen *:443 ssl http2; + + server_name bible.planet-casio.com; + + include common.conf; + include ssl.conf; + + ssl_certificate /etc/dehydrated/certs/bible.planet-casio.com/fullchain.pem; + ssl_certificate_key /etc/dehydrated/certs/bible.planet-casio.com/privkey.pem; + + access_log /var/log/nginx/bible_access.log; + error_log /var/log/nginx/bible_error.log; + + root /home/bible/www; + + location / { + autoindex on; + charset utf8; + rewrite ^/casio(.*)$ /common/casio$1 permanent; + rewrite ^/hardware(.*)$ /common/hardware$1 permanent; + rewrite ^/renesas(.*)$ /common/renesas$1 permanent; + rewrite ^/misc(.*)$ /common/misc$1 permanent; + rewrite ^/user_manuals(.*)$ /common/user_manuals$1 permanent; + } + + location /yatis/.git/ { + deny all; + } + + location /cakeisalie5/websaves/graph100.com/forum/ { + charset ISO-8859; + } +} diff --git a/roles/nginx/files/sites-available/creativecalc.conf b/roles/nginx/files/sites-available/creativecalc.conf new file mode 100644 index 0000000..06c079a --- /dev/null +++ b/roles/nginx/files/sites-available/creativecalc.conf @@ -0,0 +1,57 @@ +server { + listen [::]:80; + listen *:80; + + server_name creativecalc.fr www.creativecalc.fr; + + include common.conf; + + access_log /var/log/nginx/creativecalc_access.log; + error_log /var/log/nginx/creativecalc_error.log; + + location / { + return 301 https://$server_name$request_uri; + } +} + +server { + listen [::]:443 ssl http2; + listen *:443 ssl http2; + + server_name creativecalc.fr; + + include common.conf; + include ssl.conf; + + ssl_certificate /etc/dehydrated/certs/creativecalc.fr/fullchain.pem; + ssl_certificate_key /etc/dehydrated/certs/creativecalc.fr/privkey.pem; + + access_log /var/log/nginx/creativecalc_access.log; + error_log /var/log/nginx/creativecalc_error.log; + + location / { + return 301 https://www.creativecalc.fr$request_uri; + } +} + +server { + listen [::]:443 ssl http2; + listen *:443 ssl http2; + + server_name www.creativecalc.fr; + + include common.conf; + include ssl.conf; + + ssl_certificate /etc/dehydrated/certs/creativecalc.fr/fullchain.pem; + ssl_certificate_key /etc/dehydrated/certs/creativecalc.fr/privkey.pem; + + access_log /var/log/nginx/creativecalc_access.log; + error_log /var/log/nginx/creativecalc_error.log; + + root /home/creativecalc/www; + + location /assets/fonts { + expires 365d; + } +} diff --git a/roles/nginx/files/sites-available/gitea.conf b/roles/nginx/files/sites-available/gitea.conf new file mode 100644 index 0000000..a98d7da --- /dev/null +++ b/roles/nginx/files/sites-available/gitea.conf @@ -0,0 +1,41 @@ +server { + listen [::]:80; + listen *:80; + + server_name gitea.planet-casio.com git.planet-casio.com; + + include common.conf; + + access_log /var/log/nginx/gitea_access.log; + error_log /var/log/nginx/gitea_error.log; + + location / { + return 301 https://$server_name$request_uri; + } +} + +server { + listen [::]:443 ssl http2; + listen *:443 ssl http2; + + server_name gitea.planet-casio.com git.planet-casio.com; + + include common.conf; + include ssl.conf; + + ssl_certificate /etc/dehydrated/certs/gitea.planet-casio.com/fullchain.pem; + ssl_certificate_key /etc/dehydrated/certs/gitea.planet-casio.com/privkey.pem; + + access_log /var/log/nginx/gitea_access.log; + error_log /var/log/nginx/gitea_error.log; + + if ($http_host != "gitea.planet-casio.com") { + rewrite ^ https://gitea.planet-casio.com$request_uri permanent; + } + + location / { + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_pass http://127.0.0.1:3001; + } +} diff --git a/roles/nginx/files/sites-available/grafana.conf b/roles/nginx/files/sites-available/grafana.conf new file mode 100644 index 0000000..641fa12 --- /dev/null +++ b/roles/nginx/files/sites-available/grafana.conf @@ -0,0 +1,37 @@ +server { + listen [::]:80; + listen *:80; + + server_name grafana.planet-casio.com; + + include common.conf; + + access_log /var/log/nginx/grafana_access.log; + error_log /var/log/nginx/grafana_error.log; + + location / { + return 301 https://$server_name$request_uri; + } +} + +server { + listen [::]:443 ssl http2; + listen *:443 ssl http2; + + server_name grafana.planet-casio.com; + + include common.conf; + include ssl.conf; + + ssl_certificate /etc/dehydrated/certs/grafana.planet-casio.com/fullchain.pem; + ssl_certificate_key /etc/dehydrated/certs/grafana.planet-casio.com/privkey.pem; + + access_log /var/log/nginx/grafana_access.log; + error_log /var/log/nginx/grafana_error.log; + + location / { + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_pass http://127.0.0.1:3000; + } +} diff --git a/roles/nginx/files/sites-available/mumbleweb.conf b/roles/nginx/files/sites-available/mumbleweb.conf new file mode 100644 index 0000000..66b60c0 --- /dev/null +++ b/roles/nginx/files/sites-available/mumbleweb.conf @@ -0,0 +1,47 @@ +server { + listen [::]:80; + listen *:80; + + server_name mumble.planet-casio.com; + + include common.conf; + + access_log /var/log/nginx/mumbleweb_access.log; + error_log /var/log/nginx/mumbleweb_error.log; + + location / { + return 301 https://$server_name$request_uri; + } +} + +server { + listen [::]:443 ssl; + listen *:443 ssl; + + server_name mumble.planet-casio.com; + + include common.conf; + include ssl.conf; + + ssl_certificate /etc/dehydrated/certs/mumble.planet-casio.com/fullchain.pem; + ssl_certificate_key /etc/dehydrated/certs/mumble.planet-casio.com/privkey.pem; + + access_log /var/log/nginx/mumbleweb_access.log; + error_log /var/log/nginx/mumbleweb_error.log; + + location / { + root /usr/local/lib/node_modules/mumble-web/dist; + } + + location /client { + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + proxy_pass http://localhost:64737; + } +} + +map $http_upgrade $connection_upgrade { + default upgrade; + '' close; +} diff --git a/roles/nginx/files/sites-available/p7.conf b/roles/nginx/files/sites-available/p7.conf new file mode 100644 index 0000000..ef89c17 --- /dev/null +++ b/roles/nginx/files/sites-available/p7.conf @@ -0,0 +1,42 @@ +server { + listen [::]:80; + listen *:80; + + server_name p7.planet-casio.com; + + include common.conf; + + access_log /var/log/nginx/p7_access.log; + error_log /var/log/nginx/p7_error.log; + + location / { + return 301 https://$server_name$request_uri; + } +} + +server { + listen [::]:443 ssl http2; + listen *:443 ssl http2; + + server_name p7.planet-casio.com; + + include common.conf; + include ssl.conf; + + ssl_certificate /etc/dehydrated/certs/p7.planet-casio.com/fullchain.pem; + ssl_certificate_key /etc/dehydrated/certs/p7.planet-casio.com/privkey.pem; + + access_log /var/log/nginx/p7_access.log; + error_log /var/log/nginx/p7_error.log; + + root /home/p7/www; + + location /pub { + alias /home/p7/pub; + autoindex on; + } + + location / { + index fr.html; + } +} diff --git a/roles/nginx/files/sites-available/pc-dev.conf b/roles/nginx/files/sites-available/pc-dev.conf new file mode 100644 index 0000000..b796e2a --- /dev/null +++ b/roles/nginx/files/sites-available/pc-dev.conf @@ -0,0 +1,72 @@ +server { + listen [::]:80; + listen *:80; + +# server_name dev.planet-casio.com; + server_name v5.planet-casio.com; + + include common.conf; + + access_log /var/log/nginx/pc-dev_access.log; + error_log /var/log/nginx/pc-dev_error.log; + + location / { + return 301 https://$server_name$request_uri; + } +} + +server { + listen [::]:443 ssl http2; + listen *:443 ssl http2; + +# server_name dev.planet-casio.com; + server_name v5.planet-casio.com; + + include common.conf; + include ssl.conf; + + ssl_certificate /etc/dehydrated/certs/v5.planet-casio.com/fullchain.pem; + ssl_certificate_key /etc/dehydrated/certs/v5.planet-casio.com/privkey.pem; + + access_log /var/log/nginx/pc-dev_access.log; + error_log /var/log/nginx/pc-dev_error.log; + + root /home/pc-dev/www; + + # Serve files from /static as static files + location /static { + alias /home/pc-dev/www/app/static; + try_files $uri =404; + expires 7d; + add_header Cache-Control "public"; + include gzip.conf; + } + + # Serve avatars + location /avatar { + root /home/pc-dev/data; + try_files $uri /avatar/default_avatar.png =404; + expires max; + add_header Cache-Control "public"; + include gzip.conf; + } + + # Serve files + location /fichiers { + alias /home/pc-dev/data/fichiers; + try_files $uri =404; + expires 7d; + add_header Cache-Control "public"; + include gzip.conf; + } + + # Pass everything else to the application + location / { + try_files @fake @application; + } + + location @application { + include uwsgi_params; + uwsgi_pass unix:/run/uwsgi.pc-dev/socket; + } +} diff --git a/roles/nginx/files/sites-available/pc.conf b/roles/nginx/files/sites-available/pc.conf new file mode 100644 index 0000000..3cc4fb6 --- /dev/null +++ b/roles/nginx/files/sites-available/pc.conf @@ -0,0 +1,72 @@ +server { + listen [::]:80; + listen *:80; + +# server_name v5.planet-casio.com; + server_name www.planet-casio.com; + + include common.conf; + + access_log /var/log/nginx/pc_access.log; + error_log /var/log/nginx/pc_error.log; + + location / { + return 301 https://$server_name$request_uri; + } +} + +server { + listen [::]:443 ssl http2; + listen *:443 ssl http2; + +# server_name v5.planet-casio.com; + server_name www.planet-casio.com; + + include common.conf; + include ssl.conf; + + ssl_certificate /etc/dehydrated/certs/v5.planet-casio.com/fullchain.pem; + ssl_certificate_key /etc/dehydrated/certs/v5.planet-casio.com/privkey.pem; + + access_log /var/log/nginx/pc_access.log; + error_log /var/log/nginx/pc_error.log; + + root /home/pc/www; + + # Serve files from /static as static files + location /static { + alias /home/pc/www/app/static; + try_files $uri =404; + expires 7d; + add_header Cache-Control "public"; + include gzip.conf; + } + + # Serve avatars + location /avatar { + root /home/pc/data; + try_files $uri /avatar/default_avatar.png =404; + expires max; + add_header Cache-Control "public"; + include gzip.conf; + } + + # Serve files + location /fichiers { + alias /home/pc/data/fichiers; + try_files $uri =404; + expires 7d; + add_header Cache-Control "public"; + include gzip.conf; + } + + # Pass everything else to the application + location / { + try_files @fake @application; + } + + location @application { + include uwsgi_params; + uwsgi_pass unix:/run/uwsgi.pc/socket; + } +} diff --git a/roles/nginx/files/ssl.conf b/roles/nginx/files/ssl.conf new file mode 100644 index 0000000..34eb42d --- /dev/null +++ b/roles/nginx/files/ssl.conf @@ -0,0 +1,8 @@ +ssl_prefer_server_ciphers on; +ssl_protocols TLSv1.3 TLSv1.2; +ssl_ciphers 'ECDHE+CHACHA20:ECDHE+AESGCM'; +ssl_session_cache shared:SSL:10m; +ssl_session_timeout 5m; +ssl_dhparam /etc/ssl/ssl.dh/dhparam.pem; +ssl_stapling on; +ssl_stapling_verify on; diff --git a/roles/nginx/tasks/main.yml b/roles/nginx/tasks/main.yml new file mode 100644 index 0000000..d125e6b --- /dev/null +++ b/roles/nginx/tasks/main.yml @@ -0,0 +1,50 @@ +--- +- name: "Install nginx" + pacman: + name: "nginx" + state: present + +- name: "Make configuration structure" + file: + path: "/etc/nginx/{{}}" + state: directory + loop: + - "conf.d" + - "sites-available" + - "sites-enabled" + +- name: "Copy common files" + copy: + src: '{{ item }}' + dest: '/etc/nginx/' + owner: 'root' + mode: 0644 + with_fileglob: '*.conf' + +- name: "Copy conf.d" + copy: + src: '{{ item }}' + dest: '/etc/nginx/sites-available/' + owner: 'root' + mode: 0644 + with_fileglob: 'conf.d/*.conf' + +- name: "Copy sites-available" + copy: + src: '{{ item }}' + dest: '/etc/nginx/sites-available/' + owner: 'root' + mode: 0644 + with_fileglob: 'sites-available/*.conf' + +- name: "Enable sites" + file: + src: "/etc/nginx/sites-available/{{ item }}.conf" + dest: "/etc/nginx/sites-enabled/{{ item }}.conf" + state: link + loop: "{{ sites_enabled }}" + +- name: "Restarting nginx" + service: + name: "nginx" + state: reloaded diff --git a/roles/nginx/vars/main.yml b/roles/nginx/vars/main.yml new file mode 100644 index 0000000..da02ab1 --- /dev/null +++ b/roles/nginx/vars/main.yml @@ -0,0 +1,9 @@ +sites_enabled: + - "000-default" + - "bible" + - "creativecalc" + - "gitea" + - "grafana" + - "mumbleweb" + - "p7" + - "pc-dev" diff --git a/roles/uwsgi/files/pc-dev.ini b/roles/uwsgi/files/pc-dev.ini new file mode 100644 index 0000000..22c8a7d --- /dev/null +++ b/roles/uwsgi/files/pc-dev.ini @@ -0,0 +1,9 @@ +[uwsgi] +uid = pc-dev +gid = pc-dev +socket = /run/uwsgi.pc-dev/socket +chmod-socket = 770 +manage-script-name = true +mount = /=app:app +master = true +plugins = python diff --git a/roles/uwsgi/files/pc.ini b/roles/uwsgi/files/pc.ini new file mode 100644 index 0000000..69bd6e2 --- /dev/null +++ b/roles/uwsgi/files/pc.ini @@ -0,0 +1,9 @@ +[uwsgi] +uid = pc +gid = pc +socket = /run/uwsgi.pc/socket +chmod-socket = 770 +manage-script-name = true +mount = /=app:app +master = true +plugins = python diff --git a/roles/uwsgi/files/uwsgi@.service b/roles/uwsgi/files/uwsgi@.service new file mode 100644 index 0000000..1ab300f --- /dev/null +++ b/roles/uwsgi/files/uwsgi@.service @@ -0,0 +1,17 @@ +[Unit] +Description=uWSGI service unit +After=syslog.target + +[Service] +ExecStart=/usr/bin/uwsgi --ini /etc/uwsgi/%i.ini +ExecReload=/bin/kill -HUP $MAINPID +ExecStop=/bin/kill -INT $MAINPID +Restart=always +Type=notify +StandardError=syslog +NotifyAccess=all +KillSignal=SIGQUIT +WorkingDirectory=/home/%i/www/ + +[Install] +WantedBy=multi-user.target diff --git a/roles/uwsgi/tasks/main.yml b/roles/uwsgi/tasks/main.yml new file mode 100644 index 0000000..b0de8d4 --- /dev/null +++ b/roles/uwsgi/tasks/main.yml @@ -0,0 +1,27 @@ +--- +- name: "Install uwsgi" + pacman: + name: "uwsgi" + state: present + +- name: "Copy ini files" + copy: + src: '{{ item }}' + dest: '/etc/uwsgi/' + owner: 'root' + mode: 0644 + with_fileglob: '*.ini' + +- name: "Copy systemd service" + copy: + src: '{{ item }}' + dest: '/etc/systemd/system/' + owner: 'root' + mode: 0644 + with_fileglob: '*.service' + +- name: "Restarting uwsgi" + service: + name: "uwsgi@{{ item }}" + state: restarted + loop: "{{ environments }}" diff --git a/roles/uwsgi/vars/main.yml b/roles/uwsgi/vars/main.yml new file mode 100644 index 0000000..04b4100 --- /dev/null +++ b/roles/uwsgi/vars/main.yml @@ -0,0 +1,2 @@ +environments: + - "pc-dev" diff --git a/uwsgi.yml b/uwsgi.yml new file mode 100644 index 0000000..127e7fd --- /dev/null +++ b/uwsgi.yml @@ -0,0 +1,9 @@ +--- +- name: Update uwsgi configuration + hosts: all + become: yes + become_user: root + become_method: sudo + + roles: + - uwsgi