.gitignore

@@ -22,3 +22,6 @@ tests/_output/*
 !/var/log/.gitkeep
 /.php_cs.cache
 tests/*/_generated/*
+
+# Vagrant machines for testing
+.vagrant/

.gitlab-ci.yml

-before_script:
-  - '[[ -d /srv/soutien/ ]] || mkdir -p /srv/soutien/'
-  - 'which git || (apt-get update -yq && apt-get install git -yqq)'
-stages:
-  - test
-  - cleanup_test
-  - deploy
-
-job test:
-  stage: test
-  variables:
-    GIT_SUBMODULE_STRATEGY: normal
-    SQL_HOST: "localhost"
-    SQL_PORT: "3306"
-    SQL_DATABASE: "test_$CI_BUILD_REF"
-    SQL_USER: "soutien"
-    SQL_PASSWORD: "soutien"
-    PHINX_PASSWORD: "$SQL_PASSWORD"
-    PHINX_USER: "$SQL_USER"
-    PHINX_DATABASE: "test_$CI_BUILD_REF"
-    PHINX_HOST: "$SQL_HOST"
-    PHINX_PORT: "$SQL_PORT"
-    SYSADMIN: "gitlab@email.com"
-    FDNNURL1: "https://secure.fd2n.org/fd2n/cb"
-    FDNNURL2: "https://secure.fdn2.org/fdn2/don"
-    BASE_DOMAIN: "dev.laquadrature.net"
-    SITE_ID: "XXXXXXXX"
-    CERTIFICATE: "XXXXXXXXXXXXXXXXXXXXXXXXx"
-    CTX_MODE: "TEST"
-    PIPLOME_PATH: "/var/www/site/pdf/"
-    PIPLOME_URL: "https://www.laquadrature.net/pdf/"
-    CAMPAIGN_START_DATE: "2016-11-10"
-    CAMPAIGN_BUDGET: "321000"
-    LOGS: "./"
-    SMTP_HOST: "smtp.example.com"
-    SMTP_PORT: "25"
-    SMTP_SECURITY: "none"
-    SMTP_USER: "user"
-    SMTP_PW: "password"
-    DEBUG: "0"
-    ENV: "test"
-  script:
-    - echo "SQL_PASSWORD=${SQL_PASSWORD}" > app/env
-    - echo "SQL_USER=${SQL_USER}" >> app/env
-    - echo "SQL_DATABASE=${SQL_DATABASE}" >> app/env
-    - make install
-    - make server-start
-    - make -k test
-    - make server-stop
-    - mysql -u $SQL_USER -p$SQL_PASSWORD -e "DROP DATABASE $SQL_DATABASE"
-  tags:
-    - preprod
-
-cleanup test:
-  stage: cleanup_test
-  variables:
-    SQL_DATABASE: "test_$CI_BUILD_REF"
-    SQL_USER: "soutien"
-    SQL_PASSWORD: "soutien"
-  script:
-    - make server-stop
-    - mysql -u $SQL_USER -p$SQL_PASSWORD -e "DROP DATABASE $SQL_DATABASE"
-  when: on_failure
-  tags:
-    - preprod
-
-job install:
-  stage: deploy
-  environment: preprod
-  variables:
-    PHINX_ENVIRONMENT: "development"
-    PROD_HOME: "/home/don/don/"
-  script:
-    - chmod a+x ci/install.sh
-    - ./ci/install.sh
-  stage: deploy
-  tags:
-    - preprod
-  only:
-    - preprod
-
-job deploy:
-  stage: deploy
-  environment: production
-  variables:
-    PHINX_ENVIRONMENT: "production"
-    PROD_HOME: "/home/don/don/"
-  script:
-    - chmod a+x ci/install.sh
-    - ./ci/install.sh
-  stage: deploy
-  tags:
-    - prod
-  only:
-    - master

.gitmodules

 [submodule "www/static/pi-billion"]
 	path = www/static/pi-billion
 	url = https://git.laquadrature.net/lqdn-interne/pi-billion.git
+[submodule "ansible/don-lqdn"]
+	path = ansible/don-lqdn
+	url = https://git.laquadrature.net/lqdn-interne/piops-roles/don-lqdn
+	branch = main

Makefile

@@ -6,9 +6,9 @@ include app/env
 export $(shell sed 's/=.*//' app/env)
 endif
 
-MYSQL_CONNECTION_STRING = -h$(SQL_HOST) -u$(SQL_USER)
+MYSQL_CONNECTION_STRING = --user=$(SQL_USER)
 ifdef SQL_PASSWORD
-	MYSQL_CONNECTION_STRING += -p$(SQL_PASSWORD)
+	MYSQL_CONNECTION_STRING += --password=$(SQL_PASSWORD)
 endif
 
 help:
@@ -67,12 +67,12 @@ coverage: ## Launch functional tests with coverage.
 	@./vendor/bin/codecept run functional --coverage-html
 
 server-start: server-stop ## Launch a local server
-	@php -S 127.0.0.1:8000 -t ./www/ >> ./log/server.log &
-	@echo "\033[32mServer running. (http://127.0.0.1:8000)\033[0m"
+	@php -S 0.0.0.0:8000 -t ./www/ >> ./log/server.log &
+	@echo "\033[32mServer running. (http://0.0.0.0:8000)\033[0m"
 
 server-stop: ## Stop local server if running
-	-@ps -aux | grep "[p]hp -S 127.0.0.1:8000" | grep -v grep | awk '{print $$2}' | xargs -r -n 1 kill
-	@echo "\033[32mServer stopped. (http://127.0.0.1:8000)\033[0m"
+	-@ps -aux | grep "[p]hp -S 0.0.0.0:8000" | grep -v grep | awk '{print $$2}' | xargs -r -n 1 kill
+	@echo "\033[32mServer stopped. (http://0.0.0.0:8000)\033[0m"
 
 cs-fix: ## Fix CS
 	@vendor/bin/php-cs-fixer fix

README.en.md

+We're looking for contributors to help us translate the French version of the README. If you want to help, send us an email or open a pull request. Thanks :D

README.md

-# LQDN soutien
+# ![](www/static/img/cochon-01.png) Site de Don de La Quadrature Du Net
 
-This is a php application based on Fat-Free-Framework and a MySQL database that handles donations and presents offered to donors to La Quadrature du Net
+Ce site web, écrit en PHP avec le framework Fat-Free-Framework pour nous permettre de gérer les donnations et les contreparties pour La Quadrature Du Net. ( English below )
 
-It's used as our primary donation platform, and uses our bank's payment system (cheaper) to get one-time or recurring payments recorded into the donation platform.
+## Conception
 
-## Installation (quick)
+Ce site à été conçu de zéro, par des bénévoles, des salariés et des membres de La Quadrature Du Net.
 
-In order to install this project, run `make doctor` to check that everything is fine.
+## Installation
 
-Then you can run `make install` to install the project. Follow instructions if needed.
-To install the DB, you need to run `make reset-db` (it will remove your local DB if it exists).
+Vous aurez besoin de ;
 
-Once everything if fine, you can run a simple PHP server with `make server-start`
+- Un serveur Linux ( Debian de préférence ), avec...
+    - PHP 7.4+
+    - Mysql/MariaDB
 
-You have those accounts to test:
+Cela n'est pas nécessaire pour le développement du site.
 
-* alice@example.org / password
-* bob@example.org / password
+### En production
 
-To access to the admin (`/admin`) use `admin`/`password`
+Afin de faciliter le déployement, vous pouvez utiliser une recette Ansible pour le déployement en production. [Vous pouvez la consulter ici](https://git.laquadrature.net/lqdn-interne/piops-roles/don-lqdn).
 
-## Contributing
+Autrement, vous aurez besoin de :
 
-Before submitting a PR, makes sure tests are OK: `make test`
+##### Téléchargement
 
-# Detailed dependencies, installation ...
+Vous pouvez obtenir les dernières version du site de don sur [la page des publication.](https://git.laquadrature.net/lqdn-interne/don/-/releases)
 
-## Dependencies
+##### Configuration du serveur
 
-This software depends on a few software :
+L'installation des dépendances se fait via [Composer](https://getcomposer.org/).
 
-* **composer** (to install php dependencies) see https://getcomposer.org/
-* a **mysql client** (to inject the database schema)
-* a **mysql server** (no need for it to be local)
-* **pdftk** to generate pi-plomes (pdf with pi's decimals offered to our donors)
-* **texlive-latex-base** for the `pdflatex` binary for the piplomes (only required in production or for people debugging the piplomes code)
+##### Configuration des paramètres du site web
 
-and for developers you may also need :
+Vous aurez besoin de remplir les variables du fichier `.env` dans le dossier `app/`. Dupliquez le fichier `env.sample`, renommez le en `.env` et remplissez le.
 
-* **xgettext** to manage translations, use:
-  * `make messages.pot` to update PO files from source code.
-  * `make translations` to compile MO files from PO files when translations are ready.
+##### Serveur web
 
-This software uses:
+Vous pouvez vous inspirer de la configuration décrite dans `ansible/configuration.test.yml` pour votre serveur Nginx.
 
-* **PHP5.6** currently (migration to PHP7.x is in the pipe)
-* **phinx** to inject database schema and initial data / accounts into MySQL see https://phinx.org/ 
-* **php-cs-fixer** to check php code for errors and fix coding standard issues, see https://github.com/FriendsOfPHP/PHP-CS-Fixer
-* **doctrine/dbal** as ORM see https://github.com/doctrine/dbal 
-* **f3 framework** as main view / controller framework. see https://fatfreeframework.com/
+##### Connexion à la banque
 
-Look at `app/` folder for most Controllers, and `app/routes.ini` for the application routes (the URLs)
+> À completer
 
-# Production deployment (not finished)
+##### Gestion
 
-* `app/env` must contains the proper values : database connection, bank visa payment codes, and ENV=production at the bottom.
-* point your Nginx or Apache with PHP5.6 to the `www/` folder, and either allow Rewrite Rules (a2enmod rewrite) or point every URL not being a file to index.php (see below for an nginx sample)
-* use AND FORCE https usage, it's 2018, people ;) 
+Il existe des comptes de test par défaut, n'oubliez pas de les supprimer avant la mise en production !
 
-Nginx configuration sample:
+- `alice@example.org` : `password`
+
+- `bob@example.org` : `password`
+
+Il existe aussi un compte administrateur de test. Vous pouvez accéder à l'interface d'administration via le chemin `https://<url du site>/admin`.
+
+* `admin` : `password`
+
+### En test
+
+Afin de faciliter les test, nous avons inclus un fichier Vagrant, qui permet de lancer une machine virtuelle pré-configurée avec toutes les dépendances nécessaire pour tester le site de don, à l'exception du mode de banque pour le moment ( mais rien n'empêche que vous le mettiez en place. )
+
+Afin de lancer la machine de développement, vous pouvez ;
+
+- Installer Vagrant si ce n'est pas déjà fait,
+- Lancer `vagrant up`. Ça prendra un peu de temps la première fois.
+- Vous avez maintenant une machine virtuelle accessible via ssh avec `vagrant ssh`, et vous pouvez voir le site de don sur `localhost:8282`.
+- Vous pouvez faire vos modifications directement dans le dossier du dépôt, car il est lié sur la machine virtuelle, sous le chemin `/vagrant`.
+
+Le déployement se fait dans la machine virtuelle de test, au moyen de la recette ansible [don-lqdn](https://git.laquadrature.net/lqdn-interne/piops-roles/don-lqdn), que vous pouvez lire directement dans le dossier `ansible/`
+
+## Développement
+
+Quand vous lancez les tests avec Vagrant, vous avez accès au site de don dans sa version définie par le playbook. Par défaut, c'est la version sur `master`.
+
+Vous pouvez aussi travailer sur votre version locale en modifiant les variables du playbook dans `ansible/configuration.test.yml`. Modifiez la variable `root` de la configuration nginx de la façon suivante ;
 
 ```
-location ~ \.php$ {
-    include fastcgi_params;
-    fastcgi_pass unix:/run/php5.sock;
-}
-location / {
-   # try to serve file directly, fallback to index.php
-   try_files $uri /index.php$is_args$args;
-}
-```			
+root: /vagrant/www
+```
+
+### Documentation
+
+Vous pouvez consulter la documentation relative au développement et au déployement de ce site web dans le dossier `doc/` ou en [cliquant ici.](doc/README.md)
+
+## Contributions
+
+Les contributions sont bienvenues ! Pour commencer, vous pouvez regarder les tickets ouvert sur le dépôt. Certaines sont marqués comme étant "besoin d'aide", et ne demandent que vous pour être résoluts !
+
+Afin de faciliter le développement collaboratif, vous pouvez commencer par commenter le ticket qui vous intéresse, et expliquer ce que vous comptez faire.
+
+Sinon, vous pouvez aussi ouvrir un ticket pour proposer des améliorations, des suggestions, ou autre.
+
+Vous pouvez ensuite ouvrir une merge request, et une fois relue, elle sera mise en place ! À ce stade, merci beaucoup :)
+
+## Licence
+
+Ce site web est placé sur licence *GNU Affero General Public License v3.0.*.
 
+----
 
+[ 🇬🇧 Read the english version by clicking this link.](README.en.md)

Vagrantfile

+# -*- mode: ruby -*-
+# vi: set ft=ruby :
+
+# All Vagrant configuration is done below. The "2" in Vagrant.configure
+# configures the configuration version (we support older styles for
+# backwards compatibility). Please don't change it unless you know what
+# you're doing.
+Vagrant.configure("2") do |config|
+  # The most common configuration options are documented and commented below.
+  # For a complete reference, please see the online documentation at
+  # https://docs.vagrantup.com.
+
+  # Every Vagrant development environment requires a box. You can search for
+  # boxes at https://vagrantcloud.com/search.
+  config.vm.box = "debian/bullseye64"
+  
+  config.vm.define "don-debian64"
+
+  # Disable automatic box update checking. If you disable this, then
+  # boxes will only be checked for updates when the user runs
+  # `vagrant box outdated`. This is not recommended.
+  # config.vm.box_check_update = false
+
+  # Create a forwarded port mapping which allows access to a specific port
+  # within the machine from a port on the host machine. In the example below,
+  # accessing "localhost:8080" will access port 80 on the guest machine.
+  # NOTE: This will enable public access to the opened port
+  # config.vm.network "forwarded_port", guest: 80, host: 3141
+  # config.vm.network "forwarded_port", guest: 8000, host: 3141
+
+  # Create a forwarded port mapping which allows access to a specific port
+  # within the machine from a port on the host machine and only allow access
+  # via 127.0.0.1 to disable public access
+  config.vm.network "forwarded_port", guest: 80, host: 8282, host_ip: "127.0.0.1"
+
+  # Create a private network, which allows host-only access to the machine
+  # using a specific IP.
+  # config.vm.network "private_network", ip: "192.168.56.42"
+
+  # Create a public network, which generally matched to bridged network.
+  # Bridged networks make the machine appear as another physical device on
+  # your network.
+  # config.vm.network "public_network"
+
+  # Share an additional folder to the guest VM. The first argument is
+  # the path on the host to the actual folder. The second argument is
+  # the path on the guest to mount the folder. And the optional third
+  # argument is a set of non-required options.
+
+  # Si vous voulez avoir la possibilité de faire des modifications directement
+  # dans le dossier local, et voir les modifications sans avoir besoin de faire
+  # `vagrant provision`, vous pouvez décommenter la ligne ci-dessous avant de
+  # faire `vagrant up && vagrant provision`.
+
+  config.vm.synced_folder "./", "/home/don/don", owner: 998, group: 33
+
+  config.vm.provision "ansible" do |ansible|
+    ansible.playbook = "ansible/playbook.yml"
+  end
+end

ansible/ansible-role-nginx/.ansible-lint

+skip_list:
+  - 'yaml'
+  - 'role-name'

ansible/ansible-role-nginx/.github/FUNDING.yml

+# These are supported funding model platforms
+---
+github: geerlingguy
+patreon: geerlingguy

ansible/ansible-role-nginx/.github/stale.yml

+# Configuration for probot-stale - https://github.com/probot/stale
+
+# Number of days of inactivity before an Issue or Pull Request becomes stale
+daysUntilStale: 90
+
+# Number of days of inactivity before an Issue or Pull Request with the stale label is closed.
+# Set to false to disable. If disabled, issues still need to be closed manually, but will remain marked as stale.
+daysUntilClose: 30
+
+# Only issues or pull requests with all of these labels are check if stale. Defaults to `[]` (disabled)
+onlyLabels: []
+
+# Issues or Pull Requests with these labels will never be considered stale. Set to `[]` to disable
+exemptLabels:
+  - bug
+  - pinned
+  - security
+  - planned
+
+# Set to true to ignore issues in a project (defaults to false)
+exemptProjects: false
+
+# Set to true to ignore issues in a milestone (defaults to false)
+exemptMilestones: false
+
+# Set to true to ignore issues with an assignee (defaults to false)
+exemptAssignees: false
+
+# Label to use when marking as stale
+staleLabel: stale
+
+# Limit the number of actions per hour, from 1-30. Default is 30
+limitPerRun: 30
+
+pulls:
+  markComment: |-
+    This pull request has been marked 'stale' due to lack of recent activity. If there is no further activity, the PR will be closed in another 30 days. Thank you for your contribution!
+
+    Please read [this blog post](https://www.jeffgeerling.com/blog/2020/enabling-stale-issue-bot-on-my-github-repositories) to see the reasons why I mark pull requests as stale.
+
+  unmarkComment: >-
+    This pull request is no longer marked for closure.
+
+  closeComment: >-
+    This pull request has been closed due to inactivity. If you feel this is in error, please reopen the pull request or file a new PR with the relevant details.
+
+issues:
+  markComment: |-
+    This issue has been marked 'stale' due to lack of recent activity. If there is no further activity, the issue will be closed in another 30 days. Thank you for your contribution!
+
+    Please read [this blog post](https://www.jeffgeerling.com/blog/2020/enabling-stale-issue-bot-on-my-github-repositories) to see the reasons why I mark issues as stale.
+
+  unmarkComment: >-
+    This issue is no longer marked for closure.
+
+  closeComment: >-
+    This issue has been closed due to inactivity. If you feel this is in error, please reopen the issue or file a new issue with the relevant details.

ansible/ansible-role-nginx/.github/workflows/ci.yml

+---
+name: CI
+'on':
+  pull_request:
+  push:
+    branches:
+      - master
+  schedule:
+    - cron: "0 6 * * 3"
+
+defaults:
+  run:
+    working-directory: 'geerlingguy.nginx'
+
+jobs:
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the codebase.
+        uses: actions/checkout@v2
+        with:
+          path: 'geerlingguy.nginx'
+
+      - name: Set up Python 3.
+        uses: actions/setup-python@v2
+        with:
+          python-version: '3.x'
+
+      - name: Install test dependencies.
+        run: pip3 install yamllint
+
+      - name: Lint code.
+        run: |
+          yamllint .
+
+  molecule:
+    name: Molecule
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        distro:
+          - rockylinux8
+          - ubuntu2004
+          - ubuntu1804
+          - debian10
+
+    steps:
+      - name: Check out the codebase.
+        uses: actions/checkout@v2
+        with:
+          path: 'geerlingguy.nginx'
+
+      - name: Set up Python 3.
+        uses: actions/setup-python@v2
+        with:
+          python-version: '3.x'
+
+      - name: Install test dependencies.
+        run: pip3 install ansible molecule[docker] docker
+
+      - name: Run Molecule tests.
+        run: molecule test
+        env:
+          PY_COLORS: '1'
+          ANSIBLE_FORCE_COLOR: '1'
+          MOLECULE_DISTRO: ${{ matrix.distro }}

ansible/ansible-role-nginx/.github/workflows/release.yml

+---
+# This workflow requires a GALAXY_API_KEY secret present in the GitHub
+# repository or organization.
+#
+# See: https://github.com/marketplace/actions/publish-ansible-role-to-galaxy
+# See: https://github.com/ansible/galaxy/issues/46
+
+name: Release
+'on':
+  push:
+    tags:
+      - '*'
+
+defaults:
+  run:
+    working-directory: 'geerlingguy.nginx'
+
+jobs:
+
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the codebase.
+        uses: actions/checkout@v2
+        with:
+          path: 'geerlingguy.nginx'
+
+      - name: Set up Python 3.
+        uses: actions/setup-python@v2
+        with:
+          python-version: '3.x'
+
+      - name: Install Ansible.
+        run: pip3 install ansible-core
+
+      - name: Trigger a new import on Galaxy.
+        run: >-
+          ansible-galaxy role import --api-key ${{ secrets.GALAXY_API_KEY }}
+          $(echo ${{ github.repository }} | cut -d/ -f1) $(echo ${{ github.repository }} | cut -d/ -f2)

ansible/ansible-role-nginx/.gitignore

+*.retry
+*/__pycache__
+*.pyc
+.cache
+

ansible/ansible-role-nginx/.yamllint

+---
+extends: default
+
+rules:
+  line-length:
+    max: 120
+    level: warning
+
+ignore: |
+  .github/stale.yml
+  .travis.yml

ansible/ansible-role-nginx/LICENSE

+The MIT License (MIT)
+
+Copyright (c) 2017 Jeff Geerling
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

ansible/ansible-role-nginx/README.md

+# Ansible Role: Nginx
+
+[![CI](https://github.com/geerlingguy/ansible-role-nginx/workflows/CI/badge.svg?event=push)](https://github.com/geerlingguy/ansible-role-nginx/actions?query=workflow%3ACI)
+
+**Note:** Please consider using the official [NGINX Ansible role](https://github.com/nginxinc/ansible-role-nginx) from NGINX, Inc.
+
+Installs Nginx on RedHat/CentOS, Debian/Ubuntu, Archlinux, FreeBSD or OpenBSD servers.
+
+This role installs and configures the latest version of Nginx from the Nginx yum repository (on RedHat-based systems), apt (on Debian-based systems), pacman (Archlinux), pkgng (on FreeBSD systems) or pkg_add (on OpenBSD systems). You will likely need to do extra setup work after this role has installed Nginx, like adding your own [virtualhost].conf file inside `/etc/nginx/conf.d/`, describing the location and options to use for your particular website.
+
+## Requirements
+
+None.
+
+## Role Variables
+
+Available variables are listed below, along with default values (see `defaults/main.yml`):
+
+
+    nginx_listen_ipv6: true
+
+Whether or not to listen on IPv6 (applied to all vhosts managed by this role).
+
+    nginx_vhosts: []
+
+A list of vhost definitions (server blocks) for Nginx virtual hosts. Each entry will create a separate config file named by `server_name`. If left empty, you will need to supply your own virtual host configuration. See the commented example in `defaults/main.yml` for available server options. If you have a large number of customizations required for your server definition(s), you're likely better off managing the vhost configuration file yourself, leaving this variable set to `[]`.
+
+    nginx_vhosts:
+      - listen: "443 ssl http2"
+        server_name: "example.com"
+        server_name_redirect: "www.example.com"
+        root: "/var/www/example.com"
+        index: "index.php index.html index.htm"
+        error_page: ""
+        access_log: ""
+        error_log: ""
+        state: "present"
+        template: "{{ nginx_vhost_template }}"
+        filename: "example.com.conf"
+        extra_parameters: |
+          location ~ \.php$ {
+              fastcgi_split_path_info ^(.+\.php)(/.+)$;
+              fastcgi_pass unix:/var/run/php5-fpm.sock;
+              fastcgi_index index.php;
+              fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+              include fastcgi_params;
+          }
+          ssl_certificate     /etc/ssl/certs/ssl-cert-snakeoil.pem;
+          ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
+          ssl_protocols       TLSv1.1 TLSv1.2;
+          ssl_ciphers         HIGH:!aNULL:!MD5;
+
+An example of a fully-populated nginx_vhosts entry, using a `|` to declare a block of syntax for the `extra_parameters`.
+
+Please take note of the indentation in the above block. The first line should be a normal 2-space indent. All other lines should be indented normally relative to that line. In the generated file, the entire block will be 4-space indented. This style will ensure the config file is indented correctly.
+
+      - listen: "80"
+        server_name: "example.com www.example.com"
+        return: "301 https://example.com$request_uri"
+        filename: "example.com.80.conf"
+
+An example of a secondary vhost which will redirect to the one shown above.
+
+*Note: The `filename` defaults to the first domain in `server_name`, if you have two vhosts with the same domain, eg. a redirect, you need to manually set the `filename` so the second one doesn't override the first one*
+
+    nginx_remove_default_vhost: false
+
+Whether to remove the 'default' virtualhost configuration supplied by Nginx. Useful if you want the base `/` URL to be directed at one of your own virtual hosts configured in a separate .conf file.
+
+    nginx_upstreams: []
+
+If you are configuring Nginx as a load balancer, you can define one or more upstream sets using this variable. In addition to defining at least one upstream, you would need to configure one of your server blocks to proxy requests through the defined upstream (e.g. `proxy_pass http://myapp1;`). See the commented example in `defaults/main.yml` for more information.
+
+    nginx_user: "nginx"
+
+The user under which Nginx will run. Defaults to `nginx` for RedHat, `www-data` for Debian and `www` on FreeBSD and OpenBSD.
+
+    nginx_worker_processes: "{{ ansible_processor_vcpus|default(ansible_processor_count) }}"
+    nginx_worker_connections: "1024"
+    nginx_multi_accept: "off"
+
+`nginx_worker_processes` should be set to the number of cores present on your machine (if the default is incorrect, find this number with `grep processor /proc/cpuinfo | wc -l`). `nginx_worker_connections` is the number of connections per process. Set this higher to handle more simultaneous connections (and remember that a connection will be used for as long as the keepalive timeout duration for every client!). You can set `nginx_multi_accept` to `on` if you want Nginx to accept all connections immediately.
+
+    nginx_error_log: "/var/log/nginx/error.log warn"
+    nginx_access_log: "/var/log/nginx/access.log main buffer=16k flush=2m"
+
+Configuration of the default error and access logs. Set to `off` to disable a log entirely.
+
+    nginx_sendfile: "on"
+    nginx_tcp_nopush: "on"
+    nginx_tcp_nodelay: "on"
+
+TCP connection options. See [this blog post](https://t37.net/nginx-optimization-understanding-sendfile-tcp_nodelay-and-tcp_nopush.html) for more information on these directives.
+
+    nginx_keepalive_timeout: "65"
+    nginx_keepalive_requests: "100"
+
+Nginx keepalive settings. Timeout should be set higher (10s+) if you have more polling-style traffic (AJAX-powered sites especially), or lower (<10s) if you have a site where most users visit a few pages and don't send any further requests.
+
+    nginx_server_tokens: "on"
+
+Nginx server_tokens settings. Controls whether nginx responds with it's version in HTTP headers. Set to `"off"` to disable.
+
+    nginx_client_max_body_size: "64m"
+
+This value determines the largest file upload possible, as uploads are passed through Nginx before hitting a backend like `php-fpm`. If you get an error like `client intended to send too large body`, it means this value is set too low.
+
+    nginx_server_names_hash_bucket_size: "64"
+
+If you have many server names, or have very long server names, you might get an Nginx error on startup requiring this value to be increased.
+
+    nginx_proxy_cache_path: ""
+
+Set as the `proxy_cache_path` directive in the `nginx.conf` file. By default, this will not be configured (if left as an empty string), but if you wish to use Nginx as a reverse proxy, you can set this to a valid value (e.g. `"/var/cache/nginx keys_zone=cache:32m"`) to use Nginx's cache (further proxy configuration can be done in individual server configurations).
+
+    nginx_extra_http_options: ""
+
+Extra lines to be inserted in the top-level `http` block in `nginx.conf`. The value should be defined literally (as you would insert it directly in the `nginx.conf`, adhering to the Nginx configuration syntax - such as `;` for line termination, etc.), for example:
+
+    nginx_extra_http_options: |
+      proxy_buffering    off;
+      proxy_set_header   X-Real-IP $remote_addr;
+      proxy_set_header   X-Scheme $scheme;
+      proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header   Host $http_host;
+
+See the template in `templates/nginx.conf.j2` for more details on the placement.
+
+    nginx_extra_conf_options: ""
+
+Extra lines to be inserted in the top of `nginx.conf`. The value should be defined literally (as you would insert it directly in the `nginx.conf`, adhering to the Nginx configuration syntax - such as `;` for line termination, etc.), for example:
+
+    nginx_extra_conf_options: |
+      worker_rlimit_nofile 8192;
+
+See the template in `templates/nginx.conf.j2` for more details on the placement.
+
+    nginx_log_format: |-
+      '$remote_addr - $remote_user [$time_local] "$request" '
+      '$status $body_bytes_sent "$http_referer" '
+      '"$http_user_agent" "$http_x_forwarded_for"'
+
+Configures Nginx's [`log_format`](http://nginx.org/en/docs/http/ngx_http_log_module.html#log_format). options.
+
+    nginx_default_release: ""
+
+(For Debian/Ubuntu only) Allows you to set a different repository for the installation of Nginx. As an example, if you are running Debian's wheezy release, and want to get a newer version of Nginx, you can install the `wheezy-backports` repository and set that value here, and Ansible will use that as the `-t` option while installing Nginx.
+
+    nginx_ppa_use: false
+    nginx_ppa_version: stable
+
+(For Ubuntu only) Allows you to use the official Nginx PPA instead of the system's package. You can set the version to `stable` or `development`.
+
+    nginx_yum_repo_enabled: true
+
+(For RedHat/CentOS only) Set this to `false` to disable the installation of the `nginx` yum repository. This could be necessary if you want the default OS stable packages, or if you use Satellite.
+
+    nginx_service_state: started
+    nginx_service_enabled: yes
+
+By default, this role will ensure Nginx is running and enabled at boot after Nginx is configured. You can use these variables to override this behavior if installing in a container or further control over the service state is required.
+
+## Overriding configuration templates
+
+If you can't customize via variables because an option isn't exposed, you can override the template used to generate the virtualhost configuration files or the `nginx.conf` file.
+
+```yaml
+nginx_conf_template: "nginx.conf.j2"
+nginx_vhost_template: "vhost.j2"
+```
+
+If necessary you can also set the template on a per vhost basis.
+
+```yaml
+nginx_vhosts:
+  - listen: "80 default_server"
+    server_name: "site1.example.com"
+    root: "/var/www/site1.example.com"
+    index: "index.php index.html index.htm"
+    template: "{{ playbook_dir }}/templates/site1.example.com.vhost.j2"
+  - server_name: "site2.example.com"
+    root: "/var/www/site2.example.com"
+    index: "index.php index.html index.htm"
+    template: "{{ playbook_dir }}/templates/site2.example.com.vhost.j2"
+```
+
+You can either copy and modify the provided template, or extend it with [Jinja2 template inheritance](http://jinja.pocoo.org/docs/2.9/templates/#template-inheritance) and override the specific template block you need to change.
+
+### Example: Configure gzip in nginx configuration
+
+Set the `nginx_conf_template` to point to a template file in your playbook directory.
+
+```yaml
+nginx_conf_template: "{{ playbook_dir }}/templates/nginx.conf.j2"
+```
+
+Create the child template in the path you configured above and extend `geerlingguy.nginx` template file relative to your `playbook.yml`.
+
+```
+{% extends 'roles/geerlingguy.nginx/templates/nginx.conf.j2' %}
+
+{% block http_gzip %}
+    gzip on;
+    gzip_proxied any;
+    gzip_static on;
+    gzip_http_version 1.0;
+    gzip_disable "MSIE [1-6]\.";
+    gzip_vary on;
+    gzip_comp_level 6;
+    gzip_types
+        text/plain
+        text/css
+        text/xml
+        text/javascript
+        application/javascript
+        application/x-javascript
+        application/json
+        application/xml
+        application/xml+rss
+        application/xhtml+xml
+        application/x-font-ttf
+        application/x-font-opentype
+        image/svg+xml
+        image/x-icon;
+    gzip_buffers 16 8k;
+    gzip_min_length 512;
+{% endblock %}
+```
+
+## Dependencies
+
+None.
+
+## Example Playbook
+
+    - hosts: server
+      roles:
+        - { role: geerlingguy.nginx }
+
+## License
+
+MIT / BSD
+
+## Author Information
+
+This role was created in 2014 by [Jeff Geerling](https://www.jeffgeerling.com/), author of [Ansible for DevOps](https://www.ansiblefordevops.com/).

ansible/ansible-role-nginx/defaults/main.yml

+---
+# Used only for Debian/Ubuntu installation, as the -t option for apt.
+nginx_default_release: ""
+
+# Used only for Redhat installation, enables source Nginx repo.
+nginx_yum_repo_enabled: true
+
+# Use the official Nginx PPA for Ubuntu, and the version to use if so.
+nginx_ppa_use: false
+nginx_ppa_version: stable
+
+# The name of the nginx package to install.
+nginx_package_name: "nginx"
+
+nginx_service_state: started
+nginx_service_enabled: true
+
+nginx_conf_template: "nginx.conf.j2"
+nginx_vhost_template: "vhost.j2"
+
+nginx_worker_processes: >-
+  "{{ ansible_processor_vcpus | default(ansible_processor_count) }}"
+nginx_worker_connections: "1024"
+nginx_multi_accept: "off"
+
+nginx_error_log: "/var/log/nginx/error.log warn"
+nginx_access_log: "/var/log/nginx/access.log main buffer=16k flush=2m"
+
+nginx_sendfile: "on"
+nginx_tcp_nopush: "on"
+nginx_tcp_nodelay: "on"
+
+nginx_keepalive_timeout: "65"
+nginx_keepalive_requests: "100"
+
+nginx_server_tokens: "on"
+
+nginx_client_max_body_size: "64m"
+
+nginx_server_names_hash_bucket_size: "64"
+
+nginx_proxy_cache_path: ""
+
+nginx_extra_conf_options: ""
+# Example extra main options, used within the main nginx's context:
+#   nginx_extra_conf_options: |
+#     env VARIABLE;
+#     include /etc/nginx/main.d/*.conf;
+
+nginx_extra_http_options: ""
+# Example extra http options, printed inside the main server http config:
+#    nginx_extra_http_options: |
+#      proxy_buffering    off;
+#      proxy_set_header   X-Real-IP $remote_addr;
+#      proxy_set_header   X-Scheme $scheme;
+#      proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+#      proxy_set_header   Host $http_host;
+
+nginx_remove_default_vhost: false
+
+# Listen on IPv6 (default: true)
+nginx_listen_ipv6: true
+
+nginx_vhosts: []
+# Example vhost below, showing all available options:
+# - listen: "80" # default: "80"
+#   server_name: "example.com" # default: N/A
+#   root: "/var/www/example.com" # default: N/A
+#   index: "index.html index.htm" # default: "index.html index.htm"
+#   filename: "example.com.conf" # Can be used to set the vhost filename.
+#
+#   # Properties that are only added if defined:
+#   server_name_redirect: "www.example.com" # default: N/A
+#   error_page: ""
+#   access_log: ""
+#   error_log: ""
+#   extra_parameters: "" # Can be used to add extra config blocks (multiline).
+#   template: "" # Can be used to override the `nginx_vhost_template` per host.
+#   state: "absent" # To remove the vhost configuration.
+
+nginx_upstreams: []
+# - name: myapp1
+#   strategy: "ip_hash" # "least_conn", etc.
+#   keepalive: 16 # optional
+#   servers:
+#     - "srv1.example.com"
+#     - "srv2.example.com weight=3"
+#     - "srv3.example.com"
+
+nginx_log_format: |-
+  '$remote_addr - $remote_user [$time_local] "$request" '
+  '$status $body_bytes_sent "$http_referer" '
+  '"$http_user_agent" "$http_x_forwarded_for"'

ansible/ansible-role-nginx/handlers/main.yml

+---
+- name: restart nginx
+  service: name=nginx state=restarted
+
+- name: validate nginx configuration
+  command: nginx -t -c /etc/nginx/nginx.conf
+  changed_when: false
+
+- name: reload nginx
+  service: name=nginx state=reloaded

ansible/ansible-role-nginx/meta/main.yml

+---
+dependencies: []
+
+galaxy_info:
+  role_name: nginx
+  author: geerlingguy
+  description: Nginx installation for Linux, FreeBSD and OpenBSD.
+  company: "Midwestern Mac, LLC"
+  license: "license (BSD, MIT)"
+  min_ansible_version: 2.4
+  platforms:
+    - name: EL
+      versions:
+        - 7
+        - 8
+    - name: Debian
+      versions:
+        - all
+    - name: Ubuntu
+      versions:
+        - trusty
+        - xenial
+        - focal
+    - name: Archlinux
+      versions:
+        - all
+    - name: FreeBSD
+      versions:
+        - 10.3
+        - 10.2
+        - 10.1
+        - 10.0
+        - 9.3
+    - name: OpenBSD
+      versions:
+        - 5.9
+        - 6.0
+  galaxy_tags:
+    - development
+    - web
+    - nginx
+    - reverse
+    - proxy
+    - load
+    - balancer