bundlewrap/bundles/nginx/items.py

directories = {
    '/etc/nginx/sites': {
        'purge': True,
        'triggers': {
            'svc_systemd:nginx:restart',
        },
    },
    '/var/www': {},
}

files = {
    '/etc/nginx/nginx.conf': {
        'content_type': 'mako',
        'context': node.metadata['nginx'],
        'triggers': {
            'svc_systemd:nginx:restart',
        },
    },
    '/etc/nginx/fastcgi.conf': {
        'triggers': {
            'svc_systemd:nginx:restart',
        },
    },
    '/etc/nginx/sites/stub_status': {
        'triggers': {
            'svc_systemd:nginx:restart',
        },
    },
    '/usr/local/share/icinga/plugins/check_nginx_status': {
        'mode': '0755',
    },
}

actions = {
    'nginx-generate-dhparam': {
        'command': 'openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048',
        'unless': 'test -f /etc/ssl/certs/dhparam.pem',
    },
}

svc_systemd = {
    'nginx': {
        'needs': {
            'action:nginx-generate-dhparam',
            'pkg_apt:nginx',
        },
    },
}

# Always redirect all traffic to HTTPS, except if there is only one
# vhost and this vhost has ssl disabled.
install_port80_redirect = True
if len(node.metadata.get('nginx/vhosts', {})) == 1:
    vhost_name = list(node.metadata['nginx']['vhosts'].keys())[0]
    if node.metadata.get('nginx/vhosts/{}/ssl'.format(vhost_name), 'letsencrypt') == False:
        install_port80_redirect = False

if install_port80_redirect:
    files['/etc/nginx/sites/000-port80.conf'] = {
        'source': 'port80.conf',
        'triggers': {
            'svc_systemd:nginx:restart',
        },
    }

for vhost, config in node.metadata.get('nginx/vhosts', {}).items():
    if not 'domain' in config:
        config['domain'] = vhost

    files['/etc/nginx/sites/{}'.format(vhost)] = {
        'source': 'site_template',
        'content_type': 'mako',
        'context': {
            'vhost': vhost,
            'php_version': node.metadata.get('php/version', ''),
            **config,
        },
        'needs': set(),
        'triggers': {
            'svc_systemd:nginx:restart',
        },
    }

    if not 'webroot' in config:
        directories['/var/www/{}'.format(vhost)] = {}

        if node.has_bundle('zfs'):
            directories['/var/www/{}'.format(vhost)]['needs'] = {
                'bundle:zfs',
            }

        directories['/var/www/{}'.format(vhost)].update(config.get('webroot_config', {}))

    if config.get('ssl', 'letsencrypt') == 'letsencrypt':
        files['/etc/nginx/sites/{}'.format(vhost)]['needs'].add('action:letsencrypt_ensure-some-certificate_{}'.format(config['domain']))