Merge pull request #332 from edx/jarv/nginx-refactor

Jarv/nginx refactor

playbooks/edx-east/edx_continuous_integration.yml

@@ -7,8 +7,17 @@
     migrate_db: "yes"
     openid_workaround: True
   roles:
+    - ansible_debug
     - common
-    - nginx
+    - role: nginx
+      nginx_sites:
+      - cms
+      - lms
+      - lms-preview
+      - ora
+      - xqueue
+      - xserver
+      #- discern
     - edxlocal
     - edxapp
     - { role: 'rabbitmq', rabbitmq_ip: '127.0.0.1' }
@@ -27,3 +36,4 @@
     - { role: "xqueue", update_users: True }
     - xserver
     - ora
+    #- discern

playbooks/edx-east/edx_dev2.yml

@@ -16,7 +16,11 @@
   roles:
     - common
     - datadog
-    - nginx
+    - role: nginx
+      nginx_sites:
+      - lms
+      - cms
+      - lms-preview
     - role: 'edxapp'
       EDXAPP_LMS_NGINX_PORT: 80
       EDXAPP_CMS_NGINX_PORT: 80
@@ -31,7 +35,11 @@
   roles:
     - common
     - datadog
-    - nginx
+    - role: nginx
+      nginx_sites:
+      - lms
+      - cms
+      - lms-preview
     - role: 'edxapp'
       edxapp_lms_env: 'lms.envs.load_test'
       celery_worker: True

playbooks/edx-east/edx_feanilsandbox.yml

@@ -8,7 +8,11 @@
   roles:
     - common
     - datadog
-    - nginx
+    - role: nginx
+      nginx_sites:
+      - lms
+      - cms
+      - lms-preview 
     - role: 'edxapp'
       edxapp_lms_env: 'lms.envs.load_test'
       edx_platform_commit: 'release'
@@ -22,7 +26,11 @@
   roles:
     - common
     - datadog
-    - nginx
+    - role: nginx
+      nginx_sites:
+      - lms
+      - cms
+      - lms-preview 
     - role: 'edxapp'
       edxapp_lms_env: 'lms.envs.load_test'
       celery_worker: True
@@ -35,7 +43,9 @@
     - "{{ secure_dir }}/vars/users.yml"
   roles:
     - common
-    - nginx
+    - role: nginx
+      nginx_sites:
+      - xserver 
     - xserver
     - splunkforwarder
 - hosts: tag_aws_cloudformation_stack-name_feanilsandbox:&tag_group_rabbitmq
@@ -55,6 +65,8 @@
     - "{{ secure_dir }}/vars/users.yml"
   roles:
     - common
-    - nginx
+    - role: nginx
+      nginx_sites:
+      - xqueue
     - xqueue
     - splunkforwarder

playbooks/edx-east/edx_sandbox.yml

@@ -13,7 +13,11 @@
     mysql5_workaround: True
   roles:
     - common
-    - nginx
+    - role: nginx
+      nginx_sites:
+      - lms
+      - cms
+      - lms-preview
     - edxlocal
     - edxapp
     - rabbitmq

playbooks/edx-west/cme-prod-app.yml

@@ -24,7 +24,7 @@
     secure_dir: '../../../edx-secret/ansible'
     # this indicates the path to site-specific (with precedence)
     # things like nginx template files
-    local_dir:  '{{ secure_dir }}/local'
+    local_dir:  '../../../../../../edx-secret/ansible/local'
     not_prod: true
   vars_files:
     - "{{ secure_dir }}/vars/edxapp_cme_vars.yml"
@@ -32,7 +32,12 @@
     - "{{ secure_dir }}/vars/edxapp_prod_users.yml"
   roles:
     - common
-    - {'role': 'nginx', 'nginx_conf': true}
+    - role: nginx
+      nginx_conf: true
+      nginx_sites:
+      - lms
+      - cms
+      - lms-preview
     - {'role': 'edxapp', 'openid_workaround': true, 'template_subdir': 'cme'}
     # run this role last
     # - in_production

playbooks/edx-west/edxapp_rolling_example.yml

@@ -15,7 +15,11 @@
         state: 'absent'
   roles:
     - common
-    - nginx 
+    - role: nginx 
+      nginx_sites:
+      - lms
+      - cms
+      - lms-preview
     - edxapp
     - ruby
   post_tasks:

playbooks/edx-west/prod-app.yml

@@ -26,7 +26,11 @@
     - "{{ secure_dir }}/vars/shib_prod_vars.yml"
   roles:
     - common
-    - nginx
+    - role: nginx
+      nginx_sites:
+      - lms
+      - cms
+      - lms-preview
     - edxapp
     - apache
     - shibboleth

playbooks/edx-west/prod-ora.yml

@@ -18,5 +18,7 @@
     - "{{ secure_dir }}/vars/edxapp_prod_users.yml"
   roles:
     - common
-    - nginx
+    - role: nginx
+      nginx_sites:
+      - ora
     - ora

playbooks/edx-west/prod-xqueue.yml

@@ -15,5 +15,7 @@
     - "{{ secure_dir }}/vars/edxapp_prod_users.yml"
   roles:
     - common
-    - nginx
+    - role: nginx
+      nginx_sites:
+      - xqueue
     - xqueue

playbooks/edx-west/stage-app.yml

@@ -17,7 +17,11 @@
     - "{{ secure_dir }}/vars/shib_stage_vars.yml"
   roles:
     - common
-    - nginx
+    - role: nginx
+      nginx_sites:
+      - lms
+      - cms
+      - lms-preview
     - edxapp
     - apache
     - shibboleth

playbooks/edx-west/stage-debug.yml

@@ -12,7 +12,11 @@
     #- "{{ secure_dir }}/vars/shib_stage_vars.yml"
   roles:
     - common
-    - nginx
+    - role: nginx
+      nginx_sites:
+      - lms
+      - cms
+      - lms-preview
     - edxapp
     - ansible_debug
     #- apache

playbooks/edx-west/stage-ora.yml

@@ -10,6 +10,8 @@
     - "{{ secure_dir }}/vars/edxapp_stage_users.yml"
   roles:
     - common
-    - nginx
+    - role: nginx
+      nginx_sites:
+      - ora
     - ora
 

playbooks/edx-west/stage-xqueue.yml

@@ -10,7 +10,9 @@
     - "{{ secure_dir }}/vars/edxapp_stage_users.yml"
   roles:
     - common
-    - nginx
+    - role: nginx
+      nginx_sites:
+      - xqueue
     - xqueue
 
 #- hosts: tag_aws_cloudformation_stack-name_feanilpractice:&tag_group_edxapp

playbooks/edx_jenkins_tests.yml

@@ -14,7 +14,14 @@
     - "{{ secure_dir }}/vars/edx_jenkins_tests.yml"
   roles:
     - common
-    - nginx
+    - role: nginx
+      nginx_sites:
+      - lms
+      - cms
+      - lms-preview
+      - xqueue
+      - xserver
+      - ora
     - edxlocal
     - edxapp
     - xqueue

playbooks/edx_provision_test.yml

@@ -26,7 +26,13 @@
     - "{{ secure_dir }}/vars/edx_jenkins_tests.yml"
   roles:
     - common
-    - nginx
+    - role: nginx
+      nginx_sites:
+      - lms
+      - cms
+      - lms-preview
+      - xserver
+      - xqueue
     - edxlocal
     - edxapp
     - xqueue

playbooks/edx_sandbox.yml

@@ -23,7 +23,12 @@
     openid_workaround: True
   roles:
     - common
-    - nginx
+    - role: nginx
+      nginx_sites:
+      - lms
+      - cms
+      - lms-preview
+      - ora
     - edxlocal
     - edxapp
     - { role: 'rabbitmq', rabbitmq_ip: '127.0.0.1' }

playbooks/edxapp_ref.yml

@@ -5,7 +5,11 @@
     - "{{ secure_dir }}/vars/edxapp_ref_users.yml"
   roles:
     - common
-    - nginx
+    - role: nginx
+      nginx_sites:
+      - lms
+      - cms
+      - lms-preview
     - gunicorn
     - edxapp
     - ruby

playbooks/edxapp_rolling_example.yml

@@ -15,7 +15,11 @@
         state: 'absent'
   roles:
     - common
-    - nginx 
+    - role: nginx 
+      nginx_sites:
+      - lms
+      - cms
+      - lms-preview
     - edxapp
     - ruby
   post_tasks:

playbooks/roles/common/handlers/main.yml

@@ -2,3 +2,9 @@
 - name: common | restart rsyslogd
   service: name=rsyslog state=restarted
   sudo: True
+
+- name: common | restart logrotate
+  service: name=logrotate state=restarted
+  sudo: True
+
+

playbooks/roles/discern/defaults/main.yml

+DISCERN_NGINX_PORT: 18070
+DISCERN_BASIC_AUTH: False
+
 discern_source_repo: https://github.com/edx/discern.git
 ease_source_repo: https://github.com/edx/ease.git
 ease_dir: $app_base_dir/ease
@@ -6,7 +9,7 @@ discern_settings: discern.aws
 nltk_data_dir: /usr/share/nltk_data
 ease_branch: master
 discern_branch: dev
-nginx_listen_port: 80
-gunicorn_port: 7999
+discern_gunicorn_port: 8070
+discern_gunicorn_host: 127.0.0.1
 discern_user: discern
 site_name: discern

playbooks/roles/discern/handlers/main.yml

@@ -4,6 +4,3 @@
 
 - name: discern | restart celery
   service: name=celery state=restarted
-
-- name: discern | restart nginx
-  service: name=nginx state=restarted

playbooks/roles/discern/tasks/main.yml

@@ -109,20 +109,3 @@
 #Have this separate from the other three because it doesn't take the noinput flag
 - name: discern | django update_index for discern
   shell: ${venv_dir}/bin/python {{discern_dir}}/manage.py update_index --settings={{discern_settings}} --pythonpath={{discern_dir}}
-
-- name: discern | create nginx directory and set perms
-  file: path=/etc/nginx/sites-available owner=root group=edx mode=2775 state=directory
-
-#Install nginx sites available
-#remove default link, render template, link template to sites-enabled to activate
-- name: discern | Removing default nginx config
-  file: path=/etc/nginx/sites-enabled/default state=absent
-  notify: discern | restart nginx
-
-- name: discern | render nginx sites available
-  template: src=nginx-discern.j2 dest=/etc/nginx/sites-available/{{ site_name }}
-  notify: discern | restart nginx
-
-- name: discern | Creating nginx config link {{ site_name }}
-  file: src=/etc/nginx/sites-available/{{ site_name }} dest=/etc/nginx/sites-enabled/{{ site_name }} state=link owner=root group=root
-  notify: discern | restart nginx

playbooks/roles/discern/templates/discern.conf.j2

@@ -11,11 +11,12 @@ respawn limit 3 30
 
 env PID=/var/run/gunicorn/discern.pid
 env WORKERS={{ ansible_processor_cores * 2 }}
-env PORT={{ gunicorn_port }}
+env PORT={{ discern_gunicorn_port }}
+env ADDRESS={{ discern_gunicorn_host }}
 env LANG=en_US.UTF-8
 env DJANGO_SETTINGS_MODULE={{discern_settings}}
 
 chdir {{discern_dir}}
 setuid {{discern_user}}
 
-exec {{venv_dir}}/bin/gunicorn --preload -b 127.0.0.1:$PORT -w $WORKERS --timeout=30 --pythonpath={{discern_dir}} discern.wsgi
+exec {{venv_dir}}/bin/gunicorn --preload -b $ADDRESS:$PORT -w $WORKERS --timeout=30 --pythonpath={{discern_dir}} discern.wsgi
\ No newline at end of file

playbooks/roles/edxapp/defaults/main.yml

@@ -82,6 +82,10 @@ EDXAPP_LMS_NGINX_PORT: 80
 EDXAPP_LMS_PREVIEW_NGINX_PORT: 18020
 EDXAPP_CMS_NGINX_PORT: 18010
 
+EDXAPP_LMS_BASIC_AUTH: False
+EDXAPP_CMS_BASIC_AUTH: False
+EDXAPP_LMS_PREVIEW_BASIC_AUTH: False
+
 
 #-------- Everything below this line is internal to the role ------------
 
@@ -234,23 +238,19 @@ lms_preview_env_config:
 edx_platform_code_dir: "{{ app_base_dir }}/edx-platform"
 
 
-# gunicorn ports, these shouldn't need to be overridden
-edxapp_cms_app_port: 8010
-edxapp_lms_app_port: 8000
-edxapp_lms_preview_app_port: 8020
-
-
-
+# gunicorn ports/hosts, these shouldn't need to be overridden
+edxapp_cms_gunicorn_port: 8010
+edxapp_cms_gunicorn_host: 127.0.0.1
+edxapp_lms_gunicorn_port: 8000
+edxapp_lms_gunicorn_host: 127.0.0.1
+edxapp_lms_preview_gunicorn_port: 8020
+edxapp_lms_preview_gunicorn_host: 127.0.0.1
 
-edxapp_cms_app_address: 127.0.0.1
-edxapp_lms_app_address: 127.0.0.1
-edxapp_lms_preview_app_address: 127.0.0.1
 
 # These vars are for creating the application json config
 # files.  There are two for each service that uses the
 # 'edx-platform' code.  Defining them will create the upstart
-# job and nginx configuration for the corresponding service.
-# It will also enable the corresponding section in the
+# job.  It will also enable the corresponding section in the
 # 'edxapp' upstart job.
 
 service_variants_enabled:

playbooks/roles/edxapp/tasks/cms.yml

 # requires:
 #  - group_vars/all
 #  - common/tasks/main.yml
-#  - nginx/tasks/main.yml
 ---
 - name: create cms application config
   template: src=cms.env.json.j2 dest=$app_base_dir/cms.env.json mode=640 owner=www-data group=adm
@@ -19,12 +18,6 @@
   - update
   - deploy
 
-- include: ../../nginx/tasks/nginx_site.yml state=link site_name=cms
-  when: celery_worker is not defined
-  
-- include: ../../nginx/tasks/nginx_site.yml state=link site_name=cms-backend
-  when: celery_worker is not defined
-
 - name: Create CMS log target directory
   file: path={{log_base_dir}}/cms state=directory owner=syslog group=syslog mode=2750
   tags:

playbooks/roles/edxapp/tasks/lms-preview.yml

 # requires:
 #  - group_vars/all
 #  - common/tasks/main.yml
-#  - nginx/tasks/main.yml
 ---
 - name: create lms application config
   template: src=lms-preview.env.json.j2 dest=$app_base_dir/lms-preview.env.json mode=640 owner=www-data group=adm
@@ -26,11 +25,5 @@
   - update
   - deploy
 
-- include: ../../nginx/tasks/nginx_site.yml state=link site_name=lms-preview
-  when: celery_worker is not defined
-
-- include: ../../nginx/tasks/nginx_site.yml state=link site_name=lms-preview-backend
-  when: celery_worker is not defined
-
 # Creates LMS Preview upstart file
 - include: upstart.yml basename=lms-preview

playbooks/roles/edxapp/tasks/lms.yml

@@ -24,12 +24,6 @@
   - update
   - deploy
 
-- include: ../../nginx/tasks/nginx_site.yml state=link site_name=lms
-  when: celery_worker is not defined
-
-- include: ../../nginx/tasks/nginx_site.yml state=link site_name=lms-backend
-  when: celery_worker is not defined
-
 # Creates LMS upstart file
 - include: upstart.yml basename=lms
   when: celery_worker is not defined

playbooks/roles/edxapp/tasks/main.yml

 # requires:
 #  - group_vars/all
 #  - common/tasks/main.yml
-#  - nginx/tasks/main.yml
 ---
 - name: Change permissions on datadir
   file: path={{ app_base_dir }}/data state=directory owner=www-data group=www-data

playbooks/roles/edxapp/templates/cms.conf.j2

@@ -16,8 +16,8 @@ env WORKERS={{ ansible_processor|length * worker_core_mult.cms }}
 {% else %}
 env WORKERS={{ worker_core_mult.cms }}
 {% endif %}
-env PORT={{edxapp_cms_app_port}}
-env ADDRESS={{edxapp_cms_app_address}}
+env PORT={{edxapp_cms_gunicorn_port}}
+env ADDRESS={{edxapp_cms_gunicorn_host}}
 env LANG=en_US.UTF-8
 env DJANGO_SETTINGS_MODULE=cms.envs.aws
 env SERVICE_VARIANT="cms"

playbooks/roles/edxapp/templates/lms-preview.conf.j2

@@ -17,8 +17,8 @@ env WORKERS={{ ansible_processor|length * worker_core_mult.lms_preview }}
 {% else %}
 env WORKERS={{ worker_core_mult.lms_preview }}
 {% endif %}
-env PORT={{edxapp_lms_preview_app_port}}
-env ADDRESS={{edxapp_lms_preview_app_address}}
+env PORT={{edxapp_lms_preview_gunicorn_port}}
+env ADDRESS={{edxapp_lms_preview_gunicorn_host}}
 env LANG=en_US.UTF-8
 env DJANGO_SETTINGS_MODULE=lms.envs.aws
 env SERVICE_VARIANT="lms-preview"

playbooks/roles/edxapp/templates/lms.conf.j2

@@ -14,8 +14,8 @@ env WORKERS={{ ansible_processor|length * worker_core_mult.lms }}
 {% else %}
 env WORKERS={{ worker_core_mult.lms }}
 {% endif %}
-env PORT={{edxapp_lms_app_port}}
-env ADDRESS={{edxapp_lms_app_address}}
+env PORT={{edxapp_lms_gunicorn_port}}
+env ADDRESS={{edxapp_lms_gunicorn_host}}
 env LANG=en_US.UTF-8
 env DJANGO_SETTINGS_MODULE={{ edxapp_lms_env }}
 env SERVICE_VARIANT="lms"

playbooks/roles/edxlocal/tasks/main.yml

@@ -2,7 +2,6 @@
 # requires:
 #  - group_vars/all
 #  - common/tasks/main.yml
-#  - nginx/tasks/main.yml
 #
 #  This installs mysql-server-5.5 though
 #  in production we use mysql-5.1.62.

playbooks/roles/forum/tasks/test.yml

 ---
 
 - name: forum | test that the required service are listening
-  wait_for: port={{ item.port }} host={{ item.host }} timeout=10
+  wait_for: port={{ item.port }} host={{ item.host }} timeout=30
   with_items: "{{ forum_services }}"
   tags:
   - forum

playbooks/roles/nginx/defaults/main.yml

@@ -4,6 +4,18 @@ pkgs:
   nginx:
     state: installed
 
+nginx_xserver_gunicorn_hosts:
+  - 127.0.0.1
+nginx_xqueue_gunicorn_hosts:
+  - 127.0.0.1
+nginx_ora_gunicorn_hosts:
+  - 127.0.0.1
+nginx_lms_gunicorn_hosts:
+  - 127.0.0.1
+nginx_lms_preview_gunicorn_hosts:
+  - 127.0.0.1
+nginx_cms_gunicorn_hosts:
+  - 127.0.0.1
 
 nginx_cfg:
   #   - link - turn on

playbooks/roles/nginx/handlers/main.yml

 ---
 - name: nginx | restart nginx
   service: name=nginx state=restarted
-  sudo: True
+
+- name: nginx | reload nginx
+  service: name=nginx state=reloaded

playbooks/roles/nginx/tasks/main.yml

@@ -11,16 +11,36 @@
 - name: nginx | Server configuration file
   copy: src={{secure_dir}}/files/nginx.conf dest=/etc/nginx/nginx.conf owner=root group=root mode=0644
   when: nginx_conf is defined
-  notify: nginx | restart nginx
+  notify: nginx | reload nginx
   tags:
   - nginx
   - install
 
-# Standard configuration that is common across all roles
-# Default values for these variables are set in group_vars/all
-# Note: remove spaces in {{..}}, otherwise you will get a template parsing error.
-- include: nginx_site.yml state={{nginx_cfg.sites_enabled.edx_release}} site_name=edx-release
-- include: nginx_site.yml state={{nginx_cfg.sites_enabled.basic_auth}} site_name=basic-auth
+- name: nginx | Creating common nginx configuration
+  template: src=edx-release.j2 dest=/etc/nginx/sites-available/edx-release owner=root group=root mode=0600
+  notify: nginx | reload nginx
+  tags:
+  - nginx
+
+- name: nginx | Creating link for common nginx configuration
+  file: src=/etc/nginx/sites-available/edx-release dest=/etc/nginx/sites-enabled/edx-release state=link owner=root group=root
+  notify: nginx | reload nginx
+  tags:
+  - nginx
+
+- name: nginx | Copying nginx configs for {{ nginx_sites }}
+  template: src={{ item }}.j2 dest=/etc/nginx/sites-available/{{ item }} owner=root group=root mode=0600
+  notify: nginx | reload nginx
+  with_items: nginx_sites
+  tags:
+  - nginx
+
+- name: nginx | Creating nginx config links for {{ nginx_sites }}
+  file: src=/etc/nginx/sites-available/{{ item  }} dest=/etc/nginx/sites-enabled/{{ item }} state=link owner=root group=root
+  notify: nginx | reload nginx
+  with_items: nginx_sites
+  tags:
+  - nginx
 
 - name: nginx | Write out default htpasswd file
   copy: content={{ nginx_cfg.htpasswd }} dest=/etc/nginx/nginx.htpasswd owner=www-data group=www-data mode=0600
@@ -38,7 +58,7 @@
 # removing default link
 - name: nginx | Removing default nginx config and restart (enabled)
   file: path=/etc/nginx/sites-enabled/default state=absent
-  notify: nginx | restart nginx
+  notify: nginx | reload nginx
   tags:
   - nginx
   - update
@@ -47,29 +67,25 @@
 
 - name: nginx | Set up nginx access log rotation
   template: dest=/etc/logrotate.d/nginx-access src=edx_logrotate_nginx_access.j2 owner=root group=root mode=644
+  notify: common | restart logrotate
   tags:
   - logging
   - update
 
 - name: nginx | Set up nginx access log rotation
   template: dest=/etc/logrotate.d/nginx-error src=edx_logrotate_nginx_error.j2 owner=root group=root mode=644
+  notify: common | restart logrotate
   tags:
   - logging
   - update
 
 - name: nginx | Removing default nginx config (available)
   file: path=/etc/nginx/sites-available/default state=absent
+  notify: nginx | reload nginx
   tags:
   - nginx
   - update
   
-- name: nginx | Register the fact that nginx has run
-  command: echo True
-  register: nginx_role_run
-  tags:
-  - nginx
-  - update
-
 # If tasks that notify restart nginx don't change the state of the remote system
 # their corresponding notifications don't get run.  If nginx has been stopped for
 # any reason, this will ensure that it is started up again.

playbooks/roles/nginx/tasks/nginx_site.yml

-# Requires nginx package
----
-- name: nginx | Copying nginx config {{ site_name }}
-  template: src={{ item }} dest=/etc/nginx/sites-available/{{ site_name }} owner=root group=root mode=0600
-  first_available_file:
-  - "{{ local_dir }}/nginx/templates/{{ template_subdir }}/{{ site_name }}.j2"
-  - "{{ local_dir }}/nginx/templates/{{ site_name }}.j2"
-  # seems like paths in first_available_file must be relative to the playbooks dir
-  - "roles/nginx/templates/{{ site_name }}.j2" 
-  notify: nginx | restart nginx
-  when: nginx_role_run is defined
-  tags:
-  - nginx
-  - lms
-  - cms
-  - nginx-env
-  - update
-  - deploy
-
-- name: nginx | Creating nginx config link {{ site_name }}
-  file: src=/etc/nginx/sites-available/{{ site_name }} dest=/etc/nginx/sites-enabled/{{ site_name }} state={{ state }} owner=root group=root
-  notify: nginx | restart nginx
-  when: nginx_role_run is defined
-  tags:
-  - nginx
-  - lms
-  - cms
-  - nginx-env
-  - update
-  - deploy

playbooks/roles/nginx/templates/basic-auth.j2

-server {
-  listen 80;
-  location / {
      auth_basic            "Restricted";
      auth_basic_user_file  /etc/nginx/nginx.htpasswd;
-     root {{app_base_dir}}/main_static;
+     root {{ app_base_dir }}/main_static;
      index index.html
      proxy_set_header X-Forwarded-Proto https;
-  }
-}

playbooks/roles/nginx/templates/cms-backend.j2

-upstream cms-backend {
-    # For a TCP configuration:
-    server 127.0.0.1:8010 fail_timeout=0;
-}

playbooks/roles/nginx/templates/cms.j2

+upstream cms-backend {
+    {% for host in nginx_cms_gunicorn_hosts %}
+        server {{ host }}:{{ edxapp_cms_gunicorn_port }} fail_timeout=0;
+    {% endfor %}
+}
+
 server {
   # CMS configuration file for nginx, templated by ansible
       
@@ -26,6 +32,9 @@ server {
   }
 
   location / {
+    {% if  EDXAPP_CMS_BASIC_AUTH %}
+        {% include "basic-auth.j2" %}
+    {% endif %}
     try_files $uri @proxy_to_cms_app;
   }
 

playbooks/roles/discern/templates/nginx-discern.j2 → playbooks/roles/nginx/templates/discern.j2

 server {
-    listen {{nginx_listen_port}};
+    listen {{ DISCERN_NGINX_PORT }};
     server_name localhost;
 
     set $my_host $http_host;
@@ -9,7 +9,7 @@ server {
 
     # https://docs.djangoproject.com/en/dev/howto/static-files/#serving-static-files-in-production
     location /static/ { # STATIC_URL
-        alias {{discern_dir}}/staticfiles/;
+        alias {{ discern_dir }}/staticfiles/;
         expires 1m;
 	autoindex on;
     }
@@ -20,6 +20,9 @@ server {
     }
 
     location / {
+        {% if  DISCERN_BASIC_AUTH %}
+            {% include "basic-auth.j2" %}
+        {% endif %}
         proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
         proxy_set_header X-Forwarded-Port $http_x_forwarded_port;
         proxy_set_header X-Forwarded-For $http_x_forwarded_for;

playbooks/roles/nginx/templates/edx-release.j2

 server {
     listen 8099 default_server;
 
-    server_name mitx_release.*;
-
     location = /versions.html {
         alias {{ nginx_cfg.version_html }};
     }

playbooks/roles/nginx/templates/lms-backend.j2

-upstream lms-backend {
-    # For a TCP configuration:
-    server 127.0.0.1:8000 fail_timeout=0;
-}

playbooks/roles/nginx/templates/lms-preview-backend.j2

-upstream lms-preview-backend {
-    # For a TCP configuration:
-    server 127.0.0.1:8020 fail_timeout=0;
-}

playbooks/roles/nginx/templates/lms-preview.j2

+upstream lms-preview-backend {
+    {% for host in nginx_lms_preview_gunicorn_hosts %}
+        server {{ host }}:{{ edxapp_lms_preview_gunicorn_port }} fail_timeout=0;
+    {% endfor %}
+}
+
 server {
   # LMS-preview configuration file for nginx, templated by ansible
 
@@ -23,6 +29,10 @@ server {
   }
 
   location / {
+
+    {% if  EDXAPP_LMS_PREVIEW_BASIC_AUTH %}
+        {% include "basic-auth.j2" %}
+    {% endif %}
     try_files $uri @proxy_to_lms-preview_app;
   }
 

playbooks/roles/nginx/templates/lms.j2

+upstream lms-backend {
+    {% for host in nginx_lms_gunicorn_hosts %}
+        server {{ host }}:{{ edxapp_lms_gunicorn_port }} fail_timeout=0;
+    {% endfor %}
+}
+
 server {
   # LMS configuration file for nginx, templated by ansible
 
@@ -25,6 +31,10 @@ server {
   }
 
   location / {
+
+    {% if  EDXAPP_LMS_BASIC_AUTH %}
+        {% include "basic-auth.j2" %}
+    {% endif %}
     try_files $uri @proxy_to_lms_app;
   }
 

playbooks/roles/nginx/templates/ora.j2

 upstream app_server {
-    # For a TCP configuration:
-    server 127.0.0.1:{{ ora_gunicorn_port }} fail_timeout=0;
+    {% for host in nginx_ora_gunicorn_hosts %}
+        server {{ host }}:{{ ora_gunicorn_port }} fail_timeout=0;
+    {% endfor %}
 }
 
 server {
-  listen {{ ora_nginx_port}} default_server;
+  listen {{ ORA_NGINX_PORT }} default_server;
 
   location / {
 
+    {% if  ORA_BASIC_AUTH %}
+        {% include "basic-auth.j2" %}
+    {% endif %}
     try_files $uri @proxy_to_app;
   }
 

playbooks/roles/nginx/templates/xqueue.j2

 upstream xqueue_app_server {
-    # For a TCP configuration:
-    server 127.0.0.1:{{ xqueue_gunicorn_port }} fail_timeout=0;
+    {% for host in nginx_xqueue_gunicorn_hosts %}
+        server {{ host }}:{{ xqueue_gunicorn_port }} fail_timeout=0;
+    {% endfor %}
 }
 
 server {
-  listen {{ xqueue_nginx_port }} default_server;
+  listen {{ XQUEUE_NGINX_PORT }} default_server;
 
   location / {
+    {% if  XQUEUE_BASIC_AUTH %}
+        {% include "basic-auth.j2" %}
+    {% endif %}
     try_files $uri @proxy_to_app;
   }
 

playbooks/roles/xserver/templates/simple-proxy.j2 → playbooks/roles/nginx/templates/xserver.j2

@@ -9,14 +9,18 @@
 # Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
 ##
 upstream xserver_app_server {
-    # For a TCP configuration:
-    server 127.0.0.1:{{ xserver_port }} fail_timeout=0;
+    {% for host in nginx_xserver_gunicorn_hosts %}
+        server {{ host }}:{{ xserver_gunicorn_port }} fail_timeout=0;
+    {% endfor %}
 }
 
 server {
-  listen {{ xserver_nginx_port }} default_server;
+  listen {{ XSERVER_NGINX_PORT }} default_server;
 
   location / {
+    {% if  XSERVER_BASIC_AUTH %}
+        {% include "basic-auth.j2" %}
+    {% endif %}
     try_files $uri @proxy_to_app;
   }
 

playbooks/roles/ora/defaults/main.yml

 # vars for the ORA role
 ---
+ORA_NGINX_PORT: 18060
+ORA_BASIC_AUTH: False
+
 ora_code_dir: "{{ app_base_dir }}/edx-ora"
 # Default nginx listen port
 # These should be overrided if you want
@@ -9,8 +12,8 @@ ora_user_home: "/opt/edx-ora"
 ora_venv_dir: "{{ ora_user_home }}/virtualenvs/{{ ora_user }}"
 ease_venv_dir: "{{ ora_venv_dir }}"
 ora_gunicorn_workers: 4
-ora_nginx_port: 18091
-ora_gunicorn_port: 8091
+ora_gunicorn_port: 8060
+ora_gunicorn_host: 127.0.0.1
 
 # ora_env_config and ora_auth_config
 # should be overridden for your

playbooks/roles/ora/tasks/deploy.yml

@@ -53,10 +53,6 @@
   - ora
   - deploy
 
-# Install nginx site
-- include: ../../nginx/tasks/nginx_site.yml state=link site_name=ora
-
-
 # Do A Checkout
 - name: ora | git checkout ora repo into $app_base_dir
   git: dest={{ora_code_dir}} repo={{ora_source_repo}} version={{ora_version}}

playbooks/roles/ora/tasks/main.yml

 # requires:
 #  - group_vars/all
 #  - common/tasks/main.yml
-#  - nginx/tasks/main.yml
 ---
 - name: ora | create the ora application user
   user: name={{ ora_user }}

playbooks/roles/ora/templates/edx-ora.conf.j2

@@ -12,6 +12,7 @@ respawn limit 3 30
 env PID=/var/run/gunicorn/edx-ora.pid
 env WORKERS={{ ora_gunicorn_workers }}
 env PORT={{ ora_gunicorn_port }}
+env ADDRESS={{ ora_gunicorn_host }}
 env LANG=en_US.UTF-8
 env DJANGO_SETTINGS_MODULE=edx_ora.aws
 env SERVICE_VARIANT=ora
@@ -22,4 +23,4 @@ end script
 chdir {{ ora_code_dir }}
 setuid {{ ora_user }}
 
-exec {{ ora_venv_dir}}/bin/gunicorn --preload -b 127.0.0.1:$PORT -w $WORKERS --timeout=90 --pythonpath={{ ora_code_dir}} edx_ora.wsgi
+exec {{ ora_venv_dir}}/bin/gunicorn --preload -b $ADDRESS:$PORT -w $WORKERS --timeout=90 --pythonpath={{ ora_code_dir}} edx_ora.wsgi

playbooks/roles/xqueue/defaults/main.yml

 # variables common to the xqueue role, automatically loaded
 # when the role is included
 ---
+XQUEUE_NGINX_PORT: 18040
+XQUEUE_BASIC_AUTH: False
+
 xqueue_code_dir: "{{ app_base_dir }}/xqueue"
 
 # Default nginx listen port
 # These should be overrided if you want
 # to serve all content on port 80
 xqueue_code_dir: "{{ app_base_dir }}/xqueue"
-xqueue_nginx_port: 18040
 xqueue_gunicorn_port: 8040
+xqueue_gunicorn_host: 127.0.0.1
 
 xqueue_user: "xqueue"
 xqueue_user_home: "/opt/xqueue"

playbooks/roles/xqueue/tasks/deploy.yml

@@ -23,21 +23,6 @@
   - xqueue
   - deploy
 
-- name: xqueue | creating xqueue upstart script
-  template: src=xqueue.conf.j2 dest=/etc/init/xqueue.conf mode=0640 owner=root group=adm
-  tags:
-  - xqueue
-  - deploy
-
-- name: xqueue | create xqueue consumer upstart script
-  template: src=xqueue_consumer.conf.j2 dest=/etc/init/xqueue_consumer.conf mode=0640 owner=root group=adm
-  tags:
-  - xqueue
-  - deploy
-
-# Install nginx site
-- include: ../../nginx/tasks/nginx_site.yml state=link site_name=xqueue
-
 # Do A Checkout
 - name: xqueue | git checkout xqueue repo into {{app_base_dir}}
   git: dest={{xqueue_code_dir}} repo={{xqueue_source_repo}} version={{xqueue_version}}

playbooks/roles/xqueue/tasks/main.yml

 # requires:
 #  - group_vars/all
 #  - common/tasks/main.yml
-#  - nginx/tasks/main.yml
 ---
 # Check out xqueue repo to {{xqueue_code_dir}}
 - name: xqueue | install git and its recommends
@@ -55,4 +54,19 @@
     encoding=utf8
   when: xqueue_create_db is defined and xqueue_create_db|lower == "yes"
 
+- name: xqueue | creating xqueue upstart script
+  template: src=xqueue.conf.j2 dest=/etc/init/xqueue.conf mode=0640 owner=root group=adm
+  tags:
+  - xqueue
+  - deploy
+
+- name: xqueue | create xqueue consumer upstart script
+  template: src=xqueue_consumer.conf.j2 dest=/etc/init/xqueue_consumer.conf mode=0640 owner=root group=adm
+  tags:
+  - xqueue
+  - deploy
+
+
+
+
 - include: deploy.yml

playbooks/roles/xqueue/templates/xqueue.conf.j2

@@ -13,6 +13,7 @@ env WORKERS={{ ansible_processor|length * 2 }}
 env WORKERS=2
 {% endif %}
 env PORT={{ xqueue_gunicorn_port }}
+env ADDRESS={{ xqueue_gunicorn_host }}
 env LANG=en_US.UTF-8
 env DJANGO_SETTINGS_MODULE=xqueue.aws_settings
 env SERVICE_VARIANT="xqueue"
@@ -21,4 +22,4 @@ env SERVICE_VARIANT="xqueue"
 chdir {{ xqueue_code_dir }}
 setuid {{ xqueue_user }}
 
-exec {{ xqueue_venv_dir }}/bin/gunicorn --preload -b 127.0.0.1:$PORT -w $WORKERS --timeout=300 --pythonpath={{ xqueue_code_dir }} xqueue.wsgi
+exec {{ xqueue_venv_dir }}/bin/gunicorn --preload -b $ADDRESS:$PORT -w $WORKERS --timeout=300 --pythonpath={{ xqueue_code_dir }} xqueue.wsgi

playbooks/roles/xserver/defaults/main.yml

 # Variables for the xserver.
 ---
 
+XSERVER_NGINX_PORT: 18050
+XSERVER_BASIC_AUTH: False
+
 RABBIT_RUN_URL: ''
 RABBIT_GRADER_ROOT: ''
 RABBIT_LOGGING_ENV: 'sandbox'
@@ -34,8 +37,8 @@ xserver_sandbox_venv_dir: "{{ venv_dir }}_apparmor_sandbox"
 
 xserver_requirements_file: "{{ xserver_code_dir }}/requirements.txt"
 
-xserver_port: 8050
-xserver_nginx_port: 18050
+xserver_gunicorn_port: 8050
+xserver_gunicorn_host: 8050
 
 xserver_debian_pkgs:
   - build-essential

playbooks/roles/xserver/handlers/main.yml

-
-- name: xserver | restart nginx
-  service: name=nginx state=restarted
-

playbooks/roles/xserver/tasks/main.yml

@@ -53,6 +53,4 @@
 - name: xserver | upload ssh script
   copy: src=git_ssh.sh dest=/tmp/git_ssh.sh force=yes owner=root group=adm mode=750
 
-- include: nginx.yml
-
 - include: deploy.yml

playbooks/roles/xserver/tasks/nginx.yml

-- name: xserver | add xserver nginx configuration
-  template: src=simple-proxy.j2 dest=/etc/nginx/sites-available/simple-proxy
-  notify:
-  - xserver | restart nginx
-
-- name: xserver | enable xserver nginx configuration
-  file: src=/etc/nginx/sites-available/simple-proxy dest=/etc/nginx/sites-enabled/simple-proxy state=link
-  notify:
-  - xserver | restart nginx

playbooks/roles/xserver/templates/xserver.conf.j2

@@ -13,7 +13,8 @@ env PID=/var/tmp/xserver.pid
 env NEW_RELIC_CONFIG_FILE={{ app_base_dir }}/newrelic.ini
 env NEWRELIC={{ venv_dir }}/bin/newrelic-admin
 env WORKERS={{ ansible_processor|length }}
-env PORT={{ xserver_port }}
+env PORT={{ xserver_gunicorn_port }}
+env ADDRESS={{ xserver_gunicorn_host }}
 env LANG=en_US.UTF-8
 env DJANGO_SETTINGS_MODULE=xserver_aws_settings
 env SERVICE_VARIANT="xserver"
@@ -22,5 +23,5 @@ env SERVICE_VARIANT="xserver"
 chdir {{ xserver_code_dir }}
 setuid www-data
 
-exec {{ venv_dir }}/bin/gunicorn --preload -b 127.0.0.1:$PORT -w $WORKERS --timeout=30 --pythonpath={{ xserver_code_dir }} pyxserver_wsgi:application
+exec {{ venv_dir }}/bin/gunicorn --preload -b $ADDRESS:$PORT -w $WORKERS --timeout=30 --pythonpath={{ xserver_code_dir }} pyxserver_wsgi:application
 

playbooks/vagrant-fullstack.yml

@@ -9,7 +9,13 @@
     - "group_vars/all"
   roles:
     - common
-    - nginx
+    - role: nginx
+      nginx_sites:
+      - lms
+      - cms
+      - lms-preview
+      - xserver
+      - xqueue
     - edxlocal
     - edxapp
     - { role: 'rabbitmq', rabbitmq_ip: '127.0.0.1' }
@@ -26,4 +32,4 @@
       virtualenv_user_home: "{{ xqueue_user_home }}"
       virtualenv_name: "{{ xqueue_user }}"
     - { role: "xqueue", update_users: True }
-    - xserver
+    - xserver
\ No newline at end of file

playbooks/vagrant-shortstack-xml.yml

@@ -9,6 +9,10 @@
     - "group_vars/all"
   roles:
     - common
-    - nginx
+    - role: nginx
+      nginx_sites:
+      - lms
+      - cms
+      - lms-preview
     - edxlocal
     - { role: 'edxapp', EDXAPP_LMS_NGINX_PORT: 18030, EDXAPP_LMS_XML_NGINX_PORT: 80 }

playbooks/vagrant-shortstack.yml

@@ -9,7 +9,11 @@
     - "group_vars/all"
   roles:
     - common
-    - nginx
+    - role: nginx
+      nginx_sites:
+      - lms
+      - cms
+      - lms-preview
     - edxlocal
     - edxapp
     - oraclejdk