enable ssl for nginx

By setting NGINX_ENABLE_SSL ssl this will be enabled in
the nginx configuration for those roles that support
it, currently just the lms and cms.

To use a custom key/cert set the following vars:

* NGINX_SSL_CERTIFICATE
* NGINX_SSL_KEY

Note that there is only one ssl certificate and key
per nginx install, this is because of the way nginx
is setup (independent of the other roles).

We could enable it for different roles though they would
share the same certificate.

playbooks/roles/edxapp/defaults/main.yml

@@ -83,8 +83,11 @@ EDXAPP_RABBIT_HOSTNAME: 'localhost'
 EDXAPP_XML_MAPPINGS: {}
 
 EDXAPP_LMS_NGINX_PORT: 18000
+EDXAPP_LMS_SSL_NGINX_PORT: 48000
+
 EDXAPP_LMS_PREVIEW_NGINX_PORT: 18020
 EDXAPP_CMS_NGINX_PORT: 18010
+EDXAPP_CMS_SSL_NGINX_PORT: 48010
 
 EDXAPP_LANG: 'en_US.UTF-8'
 EDXAPP_TIME_ZONE: 'America/New_York'

playbooks/roles/nginx/defaults/main.yml

@@ -3,6 +3,18 @@
 # Set global htaccess for nginx
 NGINX_HTPASSWD_USER: !!null
 NGINX_HTPASSWD_PASS: !!null
+NGINX_ENABLE_SSL: True
+# Set these to real paths on your
+# filesystem, otherwise nginx will
+# use a self-signed snake-oil cert
+#
+# To use a certificate chain add the contents
+# to your certificate:
+#
+# cat www.example.com.crt bundle.crt > www.example.com.chained.crt
+
+NGINX_SSL_CERTIFICATE: 'ssl-cert-snakeoil.pem'
+NGINX_SSL_KEY: 'ssl-cert-snakeoil.key'
 
 nginx_app_dir: "{{ COMMON_APP_DIR }}/nginx"
 nginx_data_dir: "{{ COMMON_DATA_DIR }}/nginx"

playbooks/roles/nginx/tasks/main.yml

@@ -75,6 +75,21 @@
     path={{ nginx_log_dir}} state=directory
     owner={{ common_web_user }} group={{ common_web_user }}
 
+- name: nginx | copy ssl cert
+  copy: >
+    src={{ NGINX_SSL_CERTIFICATE }}
+    dest=/etc/ssl/certs/{{ item|basename }}
+    owner=root group=root mode=0644
+  when: NGINX_ENABLE_SSL and NGINX_SSL_CERTIFICATE != 'ssl-cert-snakeoil.pem'
+
+- name: nginx | copy ssl key
+  copy: >
+    src={{ NGINX_SSL_KEY }}
+    dest=/etc/ssl/private/{{ item|basename }}
+    owner=root group=ssl-cert mode=0640
+  when: NGINX_ENABLE_SSL and NGINX_SSL_KEY != 'ssl-cert-snakeoil.key'
+
+
 # removing default link
 - name: nginx | Removing default nginx config and restart (enabled)
   file: path={{ nginx_sites_enabled_dir }}/default state=absent

playbooks/roles/nginx/templates/cms.j2

@@ -7,7 +7,18 @@ upstream cms-backend {
 server {
   # CMS configuration file for nginx, templated by ansible
       
+  {% if NGINX_ENABLE_SSL %}
+
   listen {{EDXAPP_CMS_NGINX_PORT}};
+  listen {{EDXAPP_CMS_SSL_NGINX_PORT}} ssl;
+
+  ssl_certificate /etc/ssl/certs/{{ NGINX_SSL_CERTIFICATE|basename }};
+  ssl_certificate_key /etc/ssl/private/{{ NGINX_SSL_KEY|basename }};
+
+  {% else %}
+  listen {{EDXAPP_CMS_NGINX_PORT}} default;
+  {% endif %}
+
 
   server_name studio.*;
 

playbooks/roles/nginx/templates/lms.j2

@@ -7,7 +7,17 @@ upstream lms-backend {
 server {
   # LMS configuration file for nginx, templated by ansible
 
+  {% if NGINX_ENABLE_SSL %}
+
+  listen {{EDXAPP_LMS_NGINX_PORT}} default;
+  listen {{EDXAPP_LMS_SSL_NGINX_PORT}} default ssl;
+
+  ssl_certificate /etc/ssl/certs/{{ NGINX_SSL_CERTIFICATE|basename }};
+  ssl_certificate_key /etc/ssl/private/{{ NGINX_SSL_KEY|basename }};
+
+  {% else %}
   listen {{EDXAPP_LMS_NGINX_PORT}} default;
+  {% endif %}
 
   access_log {{ nginx_log_dir }}/access.log;
   error_log {{ nginx_log_dir }}/error.log error;