From ef430522256013665205cdda05636846cc622251 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Tue, 12 Jul 2016 03:10:33 +0200 Subject: nginx: Don't hard-code the HPKP headers. Instead, lookup the pubkeys and compute the digests on the fly. But never modify the actual header snippet to avoid locking our users out. --- roles/git/tasks/cgit.yml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) (limited to 'roles/git/tasks') diff --git a/roles/git/tasks/cgit.yml b/roles/git/tasks/cgit.yml index 5f4e0e9..1dd2cd6 100644 --- a/roles/git/tasks/cgit.yml +++ b/roles/git/tasks/cgit.yml @@ -96,9 +96,20 @@ notify: - Restart Nginx +- name: Copy HPKP header snippet + # never modify the pined pubkeys as we don't want to lock out our users + template: src=etc/nginx/snippets/git.fripost.org.hpkp-hdr.j2 + dest=/etc/nginx/snippets/git.fripost.org.hpkp-hdr + validate=/bin/false + owner=root group=root + mode=0644 + register: r3 + notify: + - Restart Nginx + - name: Start Nginx service: name=nginx state=started - when: not (r1.changed or r2.changed) + when: not (r1.changed or r2.changed or r3.changed) - meta: flush_handlers -- cgit v1.2.3