From c4dcf12a0adb58c374874108ca1e76d3c5cb8d07 Mon Sep 17 00:00:00 2001
From: Jan Dittberner <jan@dittberner.info>
Date: Sun, 20 Aug 2017 13:56:10 +0200
Subject: [PATCH] Move webserver configuration to nginx state

---
 states/nginx/init.sls                         | 49 +++++++++++++++++++
 .../{webserver => nginx}/nginx-logformat.conf |  0
 .../{webserver => nginx}/nginx-security.conf  |  0
 states/{webserver => nginx}/nginx-ssl.conf    |  2 +-
 states/webserver/init.sls                     | 49 -------------------
 5 files changed, 50 insertions(+), 50 deletions(-)
 rename states/{webserver => nginx}/nginx-logformat.conf (100%)
 rename states/{webserver => nginx}/nginx-security.conf (100%)
 rename states/{webserver => nginx}/nginx-ssl.conf (79%)

diff --git a/states/nginx/init.sls b/states/nginx/init.sls
index cd47736..891869b 100644
--- a/states/nginx/init.sls
+++ b/states/nginx/init.sls
@@ -36,3 +36,52 @@ nginx-common:
     - group: root
     - mode: 0750
     - makedirs: True
+
+generate-dhparam-nginx:
+  cmd.run:
+    - name: openssl dhparam -out {{ nginx_ssl_keydir }}/dhparams.pem 2048
+    - umask: 022
+    - runas: root
+    - timeout: 300
+    - output_loglevel: debug
+    - creates: {{ nginx_ssl_keydir }}/dhparams.pem
+    - require:
+      - file: {{ nginx_ssl_keydir }}
+    - require_in:
+      - file: /etc/nginx/conf.d/ssl.conf
+    - watch_in:
+      - service: nginx
+
+/etc/nginx/conf.d/ssl.conf:
+  file.managed:
+    - user: root
+    - group: root
+    - mode: 0644
+    - source: salt://nginx/nginx-ssl.conf
+    - template: jinja
+    - require:
+      - pkg: nginx
+    - watch_in:
+      - service: nginx
+
+/etc/nginx/snippets/security.conf:
+  file.managed:
+    - user: root
+    - group: root
+    - mode: 0644
+    - source: salt://nginx/nginx-security.conf
+    - require:
+      - pkg: nginx
+    - watch_in:
+      - service: nginx
+
+/etc/nginx/conf.d/logformat.conf:
+  file.managed:
+    - user: root
+    - group: root
+    - mode: 0644
+    - source: salt://nginx/nginx-logformat.conf
+    - require:
+      - pkg: nginx
+    - watch_in:
+      - service: nginx
diff --git a/states/webserver/nginx-logformat.conf b/states/nginx/nginx-logformat.conf
similarity index 100%
rename from states/webserver/nginx-logformat.conf
rename to states/nginx/nginx-logformat.conf
diff --git a/states/webserver/nginx-security.conf b/states/nginx/nginx-security.conf
similarity index 100%
rename from states/webserver/nginx-security.conf
rename to states/nginx/nginx-security.conf
diff --git a/states/webserver/nginx-ssl.conf b/states/nginx/nginx-ssl.conf
similarity index 79%
rename from states/webserver/nginx-ssl.conf
rename to states/nginx/nginx-ssl.conf
index 305f31d..fcc6bfb 100644
--- a/states/webserver/nginx-ssl.conf
+++ b/states/nginx/nginx-ssl.conf
@@ -4,7 +4,7 @@ ssl_ciphers kEECDH+AESGCM:kEECDH+AES:kEECDH:EDH+AESGCM:kEDH+AES:kEDH:AESGCM:ALL:
 ssl_prefer_server_ciphers on;
 ssl_session_cache shared:SSL:10m;
 
-ssl_dhparam {{ salt['pillar.get']('nginx:sslcertdir', '/etc/nginx/ssl/certs') }}/dhparams.pem;
+ssl_dhparam {{ salt['pillar.get']('nginx:sslkeydir', '/etc/nginx/ssl/private') }}/dhparams.pem;
 
 # OCSP stapling
 ssl_stapling on;
diff --git a/states/webserver/init.sls b/states/webserver/init.sls
index 4b0dd00..06ec756 100644
--- a/states/webserver/init.sls
+++ b/states/webserver/init.sls
@@ -1,51 +1,2 @@
 include:
   - nginx
-
-/etc/nginx/conf.d/logformat.conf:
-  file.managed:
-    - user: root
-    - group: root
-    - mode: 0644
-    - source: salt://webserver/nginx-logformat.conf
-    - require:
-      - pkg: nginx
-    - watch_in:
-      - service: nginx
-
-{% set ssldir = salt['pillar.get']('nginx:sslcertdir', '/etc/nginx/ssl/certs') %}
-
-generate-dhparam-nginx:
-  cmd.run:
-    - name: openssl dhparam -out {{ ssldir }}/dhparams.pem 2048
-    - umask: 022
-    - runas: root
-    - timeout: 300
-    - output_loglevel: debug
-    - creates: {{ ssldir }}/dhparams.pem
-    - require_in:
-      - file: /etc/nginx/conf.d/ssl.conf
-    - watch_in:
-      - service: nginx
-
-/etc/nginx/conf.d/ssl.conf:
-  file.managed:
-    - user: root
-    - group: root
-    - mode: 0644
-    - source: salt://webserver/nginx-ssl.conf
-    - template: jinja
-    - require:
-      - pkg: nginx
-    - watch_in:
-      - service: nginx
-
-/etc/nginx/snippets/security.conf:
-  file.managed:
-    - user: root
-    - group: root
-    - mode: 0644
-    - source: salt://webserver/nginx-security.conf
-    - require:
-      - pkg: nginx
-    - watch_in:
-      - service: nginx