IaC Bazaar
Get startedBrowse modules
Menu
Multi-cloud & platform-agnosticLive-testedattested

Nginx (verified role)

Verified wrapper around geerlingguy.nginx pinned at 3.3.0 plus an IaC Bazaar hardening overlay (server_tokens off, security headers, default-vhost removal); live-tested for idempotence and functionally verified: systemd unit active, HTTP 200, headers present, no version leak.

ansibleWeb Servers

Verification

Live-tested

Really deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.

Conformance

  • Static validation (yamllint · ansible-lint)

Provenance

Functional

  • Live-tested - applied, verified, destroyed

Last verified 2026-06-10 · how we verify

Verify this download

cosign · sha-256

Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.

# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://iac-bazaar.ae/cosign.pub

# 2. This module's Sigstore bundle
curl -o ansible-nginx-1.0.0.sigstore.json \
  https://iac-bazaar.ae/api/artifacts/ansible-nginx/signature

# 3. Verify the tarball you downloaded
cosign verify-blob \
  --key cosign.pub \
  --bundle ansible-nginx-1.0.0.sigstore.json \
  ansible-nginx-1.0.0.tar.gz
# → Verified OK

# 4. (optional) confirm the checksum too
echo "781e48690ecf8dcc04c7e2c5fec41e06291c4977c3e5b9cb0d217d5f533e749a  ansible-nginx-1.0.0.tar.gz" | sha256sum -c
Signature bundlePublic keyMachine-readable receiptHow we verify

Cite it in your README

badge · attribution

Paste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.

README.md, GitLab, Gitea
[![IaC Bazaar: live-tested](https://www.iac-bazaar.com/api/artifacts/ansible-nginx/badge)](https://www.iac-bazaar.com/catalog/ansible-nginx?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)

Ansible role 1.0.0, live-tested on IaC Bazaar: [Nginx (verified role)](https://www.iac-bazaar.com/catalog/ansible-nginx?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)

```yaml
# Nginx (verified role): https://www.iac-bazaar.com/catalog/ansible-nginx (download from your IaC Bazaar account)
```

Preview:IaC Bazaar: live-tested

Documentation

nginx-hardened

Hardened nginx as a verified wrapper around the upstream open-source role geerlingguy.nginx, pinned to an exact version in requirements.yml and installed unmodified. On top of upstream, this role:

  • removes the default vhost and serves a single configurable vhost on port 80 (real content, so the live test asserts a genuine HTTP 200);
  • turns server_tokens off (no nginx version in the Server header or on error pages);
  • deploys /etc/nginx/conf.d/zz-hardening.conf with security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, plus any extras you define) — all configurable via nginx_hardened_* defaults;
  • validates the config (nginx -t) and reloads nginx via handlers on change.

Live-tested with podman (converge → idempotence → functional verify → destroy) on the Rocky Linux 10 image with real systemd. The verify stage asserts the systemd unit is active, the vhost answers 200 with our page, the security headers are present, and the Server header leaks no version.

Upstream attribution and the full upstream MIT license are in ATTRIBUTION.md.

License

Wrapper (this role's tasks, templates, defaults, tests): MIT, © IaC Bazaar. Upstream geerlingguy.nginx: MIT, © Jeff Geerling — see ATTRIBUTION.md.

Usage code & full reference need an account

The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.

  • Install
  • Variables
  • Test
Create a free accountSign in

Related modules

Live-tested

ansible-varnish

Varnish from AppStream as a loopback HTTP cache with health-probed backends and PURGE limited to the addresses you list. Its VCL is checked before it lands, with -j none because the compiler cannot read root's temp files, and reloaded so the cache survives. The live test sees MISS then HIT with one origin request, a working purge and a refused one. Original role, live-tested on Rocky Linux 10.

View module
Live-tested

ansible-httpd-tls

httpd with mod_ssl from AppStream on EL 10: one TLS site, an explicit protocol floor and cipher list, HSTS, and the plain port doing nothing but redirecting. The live test reads the site with the certificate the role installed, checks the headers, and is refused when it asks for a cipher outside the list. Original role, live-tested on Rocky Linux 10.

View module
Live-tested

ansible-caddy-https

Caddy with HTTPS on: the package serves plain HTTP with a Server header and an admin API any local process can use. This role gives private names a certificate from Caddy's own CA (public ones get Let's Encrypt), redirects HTTP, sends HSTS and the security headers, drops Server, turns the admin API off, and serves files or proxies an upstream. Original role, live-tested on Rocky Linux 10.

View module
Live-tested

ansible-php-fpm

php-fpm from AppStream on EL 10: one pool on a unix socket, open_basedir closed around its own tree, and the process-spawning functions removed. The live test runs PHP through the socket, is refused a read outside the tree, watches a call to a removed function stop the request, and finds nothing listening on TCP. Original role, live-tested on Rocky Linux 10.

View module