Clément Désiles
aa78e238aa
- nginx: nginx-prometheus-exporter gated by nginx_exporter_enabled, deploys loopback-only stub_status (8090), exporter on 9113 - postgres: postgres_exporter gated by postgres_exporter_enabled, creates postgres_exporter role with pg_monitor, exporter on 9187 - valkey: redis_exporter gated by valkey_exporter_enabled, adds read-only ACL user to users.acl, exporter on 9121 Each exporter follows the nut pattern (tasks/exporter.yml included from main.yml, OS vars, 0600 secret env files, password asserts).
54 lines
1.9 KiB
YAML
54 lines
1.9 KiB
YAML
---
|
|
# Nginx configuration directory for service vhosts
|
|
nginx_conf_dir: /etc/nginx/conf.d
|
|
|
|
# Nginx stream configuration directory (TCP/UDP proxies)
|
|
nginx_streams_dir: /etc/nginx/streams.d
|
|
|
|
# Worker processes (auto = number of CPU cores)
|
|
nginx_worker_processes: auto
|
|
|
|
# Worker connections
|
|
nginx_worker_connections: 1024
|
|
|
|
# Client max body size (for file uploads)
|
|
nginx_client_max_body_size: 100M
|
|
|
|
# SSL configuration (volontarily omit TLSv1.2 here)
|
|
nginx_ssl_protocols: TLSv1.3
|
|
|
|
# Catch-all default_server (rejects unknown SNI / Host with 444).
|
|
# Prevents leaking the first-loaded vhost's cert to unrelated requests.
|
|
nginx_default_server_enabled: true
|
|
nginx_default_ssl_cert: /etc/nginx/ssl/default.crt
|
|
nginx_default_ssl_key: /etc/nginx/ssl/default.key
|
|
|
|
# Logging configuration
|
|
# Backend: 'file' (traditional /var/log/nginx/*.log) or 'journald' (systemd journal)
|
|
nginx_log_backend: journald
|
|
|
|
# Logrotate configuration (only used when nginx_log_backend: file)
|
|
nginx_logrotate_rotate: 14 # Keep 14 days of logs
|
|
nginx_logrotate_frequency: daily # daily|weekly|monthly
|
|
nginx_logrotate_compress: true # Compress rotated logs
|
|
|
|
# Forwarder configuration (transparent proxy to other hosts)
|
|
# Example:
|
|
# nginx_forwarder:
|
|
# "blog.hello.com":
|
|
# forward_to: "you.domain.org"
|
|
# http: true # Forward port 80 (default: true)
|
|
# https: true # Forward port 443 (default: true)
|
|
nginx_forwarder: {}
|
|
|
|
# Let's Encrypt / Certbot configuration
|
|
# acme_email: "" # Required for Let's Encrypt - intentionally undefined
|
|
# Set this variable to enable Certbot installation and certificate management
|
|
|
|
# Prometheus exporter (optional, via nginx-prometheus-exporter)
|
|
# Scrapes a loopback-only stub_status endpoint this role deploys.
|
|
nginx_exporter_enabled: false
|
|
nginx_exporter_listen_address: "127.0.0.1:9113"
|
|
nginx_exporter_stub_status_listen: "127.0.0.1:8090"
|
|
nginx_exporter_scrape_uri: "http://127.0.0.1:8090/stub_status"
|