82 lines
2.2 KiB
YAML
82 lines
2.2 KiB
YAML
---
|
|
- name: install prerequisites for nginx repository
|
|
ansible.builtin.apt:
|
|
name:
|
|
- curl
|
|
- gnupg2
|
|
- ca-certificates
|
|
- lsb-release
|
|
- debian-archive-keyring
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: check if nginx keyring already exists
|
|
ansible.builtin.stat:
|
|
path: /usr/share/keyrings/nginx-archive-keyring.gpg
|
|
register: nginx_keyring
|
|
|
|
- name: download nginx gpg key
|
|
ansible.builtin.get_url:
|
|
url: https://nginx.org/keys/nginx_signing.key
|
|
dest: /tmp/nginx_signing.key
|
|
mode: '0644'
|
|
when: not nginx_keyring.stat.exists
|
|
|
|
- name: dearmor nginx gpg key
|
|
ansible.builtin.command:
|
|
cmd: gpg --dearmor --yes -o /usr/share/keyrings/nginx-archive-keyring.gpg /tmp/nginx_signing.key
|
|
when: not nginx_keyring.stat.exists
|
|
|
|
- name: ensure /root/.gnupg exists
|
|
ansible.builtin.file:
|
|
path: /root/.gnupg
|
|
state: directory
|
|
mode: '0700'
|
|
owner: root
|
|
group: root
|
|
|
|
- name: verify nginx signing key fingerprint
|
|
ansible.builtin.command:
|
|
cmd: gpg --dry-run --quiet --no-keyring --import --import-options import-show /usr/share/keyrings/nginx-archive-keyring.gpg
|
|
register: nginx_key_check
|
|
changed_when: false
|
|
|
|
- name: check nginx signing key fingerprint
|
|
ansible.builtin.fail:
|
|
msg: "nginx signing key fingerprint mismatch! Got: {{ nginx_key_check.stdout }}"
|
|
when: "'573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62' not in nginx_key_check.stdout"
|
|
|
|
- name: add nginx apt repository
|
|
ansible.builtin.copy:
|
|
dest: /etc/apt/sources.list.d/nginx.list
|
|
content: >-
|
|
deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg]
|
|
https://nginx.org/packages/{{ 'mainline/' if (nginx_use_mainline | default(false)) else '' }}debian
|
|
{{ ansible_facts['distribution_release'] }} nginx
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
register: nginx_repo_file
|
|
|
|
- name: set up repository pinning for nginx
|
|
ansible.builtin.copy:
|
|
dest: /etc/apt/preferences.d/99nginx
|
|
content: |
|
|
Package: *
|
|
Pin: origin nginx.org
|
|
Pin: release o=nginx
|
|
Pin-Priority: 900
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
|
|
- name: update apt cache
|
|
ansible.builtin.apt:
|
|
update_cache: true
|
|
when: nginx_repo_file.changed
|
|
|
|
- name: install nginx
|
|
ansible.builtin.apt:
|
|
name: nginx
|
|
state: present
|