diff --git a/defaults/main.yml b/defaults/main.yml index f40af3a..2329088 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -5,16 +5,29 @@ nginx_modsec3_crs_version: v3.4/dev nginx_modsec3_crs3_force_compile: True nginx_modsec3_crs3_block_mode: True nginx_modsec3_crs3_debian_pre_reqs: - - libgeoip-dev - - libcurl4-openssl-dev - liblua5.2-dev - - libyajl-dev - - libxml2-dev - libpcre3-dev - libpcre++-dev - ssdeep - libfuzzy-dev - git + - m4 + - git + - g++ + - apt-utils + - autoconf + - automake + - build-essential + - libcurl4-openssl-dev + - libgeoip-dev + - liblmdb-dev + - libpcre++-dev + - libtool + - libxml2-dev + - libyajl-dev + - pkgconf + - wget + - zlib1g-dev nginx_modsec3_crs3_debian_compiler_reqs: - build-essential @@ -39,3 +52,4 @@ nginx_modsec3_crs3_redhat_compiler_reqs: nginx_official_repo: True nginx_official_repo_mainline: True + diff --git a/tasks/compile.yml b/tasks/compile.yml index 4b67bba..17d5c11 100644 --- a/tasks/compile.yml +++ b/tasks/compile.yml @@ -85,19 +85,19 @@ - "make modules" when: not modsec3_nginx_present or nginx_modsec3_crs3_force_compile -- name: import nginx role Debian/Ubuntu vars - include_vars: - file: "../jdauphant.nginx/vars/Debian.yml" - when: - - ansible_os_family == "Debian" - #- nginx_python_selinux_pkgs is not defined - -- name: import nginx role Redhat/Centos vars - include_vars: - file: "../jdauphant.nginx/vars/Redhat.yml" - when: - - ansible_os_family == "Redhat" - #- nginx_python_selinux_pkgs is not defined +# - name: import nginx role Debian/Ubuntu vars +# include_vars: +# file: "../jdauphant.nginx/vars/Debian.yml" +# when: +# - ansible_os_family == "Debian" +# #- nginx_python_selinux_pkgs is not defined + +# - name: import nginx role Redhat/Centos vars +# include_vars: +# file: "../jdauphant.nginx/vars/Redhat.yml" +# when: +# - ansible_os_family == "Redhat" +# #- nginx_python_selinux_pkgs is not defined - name: Copy Modsecurity-nginx module to Nginx modules folder copy: @@ -106,11 +106,11 @@ remote_src: yes when: not modsec3_nginx_present or nginx_modsec3_crs3_force_compile -- name: Enable module in Nginx - template: - src: 50-mod-http-modsecurity.conf.j2 - dest: "{{ nginx_conf_dir }}/modules-enabled/50-mod-http-modsecurity.conf" - when: not modsec3_nginx_present or nginx_modsec3_crs3_force_compile +# - name: Enable module in Nginx +# template: +# src: 50-mod-http-modsecurity.conf.j2 +# dest: "{{ nginx_conf_dir }}/conf.d/50-mod-http-modsecurity.conf" +# when: not modsec3_nginx_present or nginx_modsec3_crs3_force_compile - name: Create folder for Modsec config and rules file: diff --git a/tasks/main.yml b/tasks/main.yml index 29d1748..f7edcf7 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -33,25 +33,23 @@ state: present when: ansible_os_family == "Redhat" -- name: Run Nginx SElinux tasks - include_role: - name: jdauphant.nginx - tasks_from: selinux.yml - allow_duplicates: yes - when: ansible_selinux and ansible_selinux.status == "enabled" +# - name: Run Nginx SElinux tasks +# include_role: +# name: nginxinc.nginx +# tasks_from: selinux.yml +# allow_duplicates: yes +# when: ansible_selinux and ansible_selinux.status == "enabled" - name: Run Nginx official repo tasks include_role: - name: jdauphant.nginx - tasks_from: nginx-official-repo.yml - allow_duplicates: yes + name: nginxinc.nginx when: nginx_official_repo == True -- name: Run Nginx install packages tasks - include_role: - name: jdauphant.nginx - tasks_from: installation.packages.yml - allow_duplicates: yes +# - name: Run Nginx install packages tasks +# include_role: +# name: jdauphant.nginx +# tasks_from: installation.packages.yml +# allow_duplicates: yes # when: nginx_installation_type == "packages" - name: Get the rpm or apt package facts @@ -97,7 +95,7 @@ - name: Configure Nginx now that the Modsec module is built import_role: - name: jdauphant.nginx + name: nginxinc.nginx_config - name: Check which packages were installed for Debian/Ubuntu shell: dpkg-query -l > /tmp/after.txt @@ -117,3 +115,9 @@ name: "{{ installed.stdout_lines }}" state: absent when: installed is defined and (nginx_modsec3_crs3_keep is undefined or not nginx_modsec3_crs3_keep) + + +- name: Run Nginx official repo tasks + include_role: + name: nginxinc.nginx + when: nginx_official_repo == True \ No newline at end of file