Add Nginx support to roundcube role

webapps/roundcube/defaults/main.yml

@@ -1,4 +1,5 @@
 ---
 roundcube_host: "roundcube.{{ ansible_fqdn }}"
+roundcube_webserver: apache
 roundcube_imap_host: "localhost"
 roundcube_imap_port: 143

webapps/roundcube/handlers/main.yml

@@ -3,3 +3,13 @@
   systemd:
     name: imapproxy
     state: restarted
+
+- name: reload apache2
+  service:
+    name: apache2
+    state: reloaded
+
+- name: reload nginx
+  service:
+    name: nginx
+    state: reloaded

webapps/roundcube/tasks/main.yml

@@ -85,24 +85,41 @@
   tags:
   - roundcube
 
-- name: deploy roundcube vhost
+- name: deploy apache roundcube vhost
   template:
     src: apache2.conf.j2
     dest: /etc/apache2/sites-available/rouncube.conf
     mode: "0640"
   notify: reload apache2
+  when: roundcube_webserver == "apache"
   tags:
   - roundcube
 
-- name: enable roundcube vhost
+- name: enable apache roundcube vhost
   file:
     src: /etc/apache2/sites-available/rouncube.conf
     dest: /etc/apache2/sites-enabled/rouncube.conf
     state: link
   notify: reload apache2
+  when: roundcube_webserver == "apache"
   tags:
   - roundcube
 
+- name: deploy Nginx roundcube vhost
+  template:
+    src: nginx.conf.j2
+    dest: /etc/nginx/sites-available/rouncube.conf
+  when: roundcube_webserver == "nginx"
+  notify: reload nginx
+
+- name: enable Nginx roundcube vhost
+  file:
+    src: "/etc/nginx/sites-available/rouncube.conf"
+    dest: "/etc/nginx/sites-enabled/rouncube.conf"
+    state: link
+  when: roundcube_webserver == "nginx" 
+  notify: reload nginx
+
 - name: enable roundcube link in default site index
   lineinfile:
     dest: /var/www/index.html

webapps/roundcube/templates/nginx.conf.j2

@@ -0,0 +1,49 @@
+server {
+        listen 80;
+        server_name {{ roundcube_host }};
+        return 301 https://{{ roundcube_host }}$request_uri;
+}
+
+server {
+        listen 443 ssl;
+        server_name {{ roundcube_host }};
+        access_log /var/log/nginx/.{{ roundcube_host }}.access.log;
+	error_log  /var/log/nginx/.{{ roundcube_host }}.error.log;
+
+        root /var/lib/roundcube/;
+        index index.php;
+
+        location / {
+                try_files $uri $uri/ /index.php?q=$uri&$args;
+        }
+
+        location ~ ^/(README.md|INSTALL|LICENSE|CHANGELOG|UPGRADING)$ {
+                deny all;
+        }
+
+        location ~ ^/(config|temp|logs)/ {
+                deny all;
+        }
+
+        location ~ /\. {
+                deny all;
+                access_log off;
+                log_not_found off;
+        }
+
+        location ~ \.php$ {
+                try_files $uri =404;
+                fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
+                fastcgi_index index.php;
+                fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+                include fastcgi_params;
+        }
+        ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
+        ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
+        ssl_prefer_server_ciphers On;
+        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+        ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS;
+        ssl_session_cache shared:SSL:20m;
+        ssl_session_timeout 10m;
+        add_header Strict-Transport-Security "max-age=31536000";
+}