Upgrade baseline to Debian Stretch.

6 files changed, 18 insertions, 17 deletions

diff --git a/roles/common-web/files/etc/nginx/sites-available/default b/roles/common-web/files/etc/nginx/sites-available/default
index 6cbea18..63c7910 100644
--- a/roles/common-web/files/etc/nginx/sites-available/default
+++ b/roles/common-web/files/etc/nginx/sites-available/default
@@ -1,12 +1,12 @@
 server {
-    listen      80 default_server;
-    listen [::]:80 default_server;
+	listen 80 default_server;
+	listen [::]:80 default_server;
 
     access_log /var/log/nginx/access.log;
     error_log /var/log/nginx/error.log info;
 
     # serve ACME challenges on all virtual hosts
     # /!\ need to be served individually for each explicit virtual host as well!
     include snippets/acme-challenge.conf;
     include snippets/headers.conf;
 }
diff --git a/roles/common-web/files/etc/nginx/snippets/fastcgi-php-ssl.conf b/roles/common-web/files/etc/nginx/snippets/fastcgi-php-ssl.conf
index ebf3aa0..aa82ca6 100644
--- a/roles/common-web/files/etc/nginx/snippets/fastcgi-php-ssl.conf
+++ b/roles/common-web/files/etc/nginx/snippets/fastcgi-php-ssl.conf
@@ -1,10 +1,10 @@
 # PHP only.
 # Credits to http://claylo.com/post/7617674014/ssl-php-fpm-and-nginx
 
 include snippets/fastcgi-php.conf;
 
-fastcgi_param HTTPS					on;
-fastcgi_param SSL_PROTOCOL			$ssl_protocol;
-fastcgi_param SSL_CIPHER			$ssl_cipher;
-fastcgi_param SSL_SESSION_ID		$ssl_session_id;
-fastcgi_param SSL_CLIENT_VERIFY		$ssl_client_verify;
+fastcgi_param HTTPS             on;
+fastcgi_param SSL_PROTOCOL      $ssl_protocol;
+fastcgi_param SSL_CIPHER        $ssl_cipher;
+fastcgi_param SSL_SESSION_ID    $ssl_session_id;
+fastcgi_param SSL_CLIENT_VERIFY $ssl_client_verify;
diff --git a/roles/common-web/files/etc/nginx/snippets/fastcgi-php.conf b/roles/common-web/files/etc/nginx/snippets/fastcgi-php.conf
index 5823909..9668bb8 100644
--- a/roles/common-web/files/etc/nginx/snippets/fastcgi-php.conf
+++ b/roles/common-web/files/etc/nginx/snippets/fastcgi-php.conf
@@ -1,10 +1,10 @@
 # cf. http://wiki.nginx.org/Pitfalls#Passing_Uncontrolled_Requests_to_PHP
-try_files $uri $uri/ =404;
+try_files $fastcgi_script_name =404;
 
-include 		snippets/fastcgi.conf;
+include snippets/fastcgi.conf;
 # required if PHP was built with --enable-force-cgi-redirect
-fastcgi_param	REDIRECT_STATUS	200;
+fastcgi_param REDIRECT_STATUS 200;
 
-fastcgi_intercept_errors 	on;
-fastcgi_read_timeout 		14400; 
-fastcgi_pass				unix:/var/run/php5-fpm.sock;
+fastcgi_intercept_errors on;
+fastcgi_read_timeout     14400;
+fastcgi_pass             unix:/var/run/php/php7.0-fpm.sock;
diff --git a/roles/common-web/files/etc/nginx/snippets/fastcgi.conf b/roles/common-web/files/etc/nginx/snippets/fastcgi.conf
index 80132ec..ee058da 100644
--- a/roles/common-web/files/etc/nginx/snippets/fastcgi.conf
+++ b/roles/common-web/files/etc/nginx/snippets/fastcgi.conf
@@ -1,23 +1,24 @@
 fastcgi_param   QUERY_STRING        $query_string;
 fastcgi_param   REQUEST_METHOD      $request_method;
 fastcgi_param   CONTENT_TYPE        $content_type;
 fastcgi_param   CONTENT_LENGTH      $content_length;
 
 fastcgi_param   SCRIPT_FILENAME     $document_root$fastcgi_script_name;
 fastcgi_param   SCRIPT_NAME         $fastcgi_script_name;
 fastcgi_param   PATH_INFO           $fastcgi_path_info;
+fastcgi_param   REQUEST_SCHEME      $scheme;
 fastcgi_param   REQUEST_URI         $request_uri;
 fastcgi_param   DOCUMENT_URI        $document_uri;
 fastcgi_param   DOCUMENT_ROOT       $document_root;
 fastcgi_param   SERVER_PROTOCOL     $server_protocol;
 
 fastcgi_param   GATEWAY_INTERFACE   CGI/1.1;
 fastcgi_param   SERVER_SOFTWARE     nginx/$nginx_version;
 
 fastcgi_param   REMOTE_ADDR         $remote_addr;
 fastcgi_param   REMOTE_PORT         $remote_port;
 fastcgi_param   SERVER_ADDR         $server_addr;
 fastcgi_param   SERVER_PORT         $server_port;
 fastcgi_param   SERVER_NAME         $server_name;
 
-fastcgi_param   HTTPS               $https;
+fastcgi_param   HTTPS               $https if_not_empty;
diff --git a/roles/common-web/files/etc/nginx/snippets/ssl.conf b/roles/common-web/files/etc/nginx/snippets/ssl.conf
index 09082e7..d3ccd9e 100644
--- a/roles/common-web/files/etc/nginx/snippets/ssl.conf
+++ b/roles/common-web/files/etc/nginx/snippets/ssl.conf
@@ -1,22 +1,22 @@
 # https://wiki.mozilla.org/Security/Server_Side_TLS
-# https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=nginx-1.6.2&openssl=1.0.1k&hsts=yes&profile=intermediate
+# https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=nginx-1.10.3&openssl=1.1.0j&hsts=yes&profile=intermediate
 
 # certs sent to the client in SERVER HELLO are concatenated in ssl_certificate
 # ~$ cat /etc/nginx/ssl/srvcert.pem /usr/share/lacme/lets-encrypt-x3-cross-signed.pem | sudo tee /etc/nginx/ssl/srvcert.chained.pem
 
 ssl on;
 
 ssl_session_timeout 1d;
 ssl_session_cache shared:SSL:50m;
 ssl_session_tickets off;
 
 # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
 ssl_dhparam /etc/ssl/dhparams.pem;
 
 # intermediate configuration. tweak to your needs.
 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
 ssl_prefer_server_ciphers on;
 
 # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
 add_header Strict-Transport-Security 'max-age=15768000; includeSubDomains';
diff --git a/roles/common-web/tasks/main.yml b/roles/common-web/tasks/main.yml
index 02b7134..e2eb3ee 100644
--- a/roles/common-web/tasks/main.yml
+++ b/roles/common-web/tasks/main.yml
@@ -1,27 +1,27 @@
 - name: Install Nginx
-  apt: pkg=nginx
+  apt: pkg=nginx-light
 
 - name: Limit Nginx logging
   lineinfile: "dest=/etc/logrotate.d/nginx create=yes
                regexp='^\\s*rotate\\s'
-               line='\trotate 1'"
+               line='\trotate 7'"
   tags:
     - logrotate
 
 - name: Copy fastcgi parameters, acme-challenge and SSL configuration snippets
   copy: src=etc/nginx/snippets/{{ item }}
         dest=/etc/nginx/snippets/{{ item }}
         owner=root group=root
         mode=0644
   register: r1
   with_items:
     - fastcgi.conf
     - fastcgi-php.conf
     - fastcgi-php-ssl.conf
     - ssl.conf
     - headers.conf
     - acme-challenge.conf
   notify:
     - Restart Nginx
 
 - name: Copy /etc/nginx/sites-available/default