Initial

roles/nginxinc.nginx_unit/tasks/prerequisites/install-dependencies.yml

@@ -0,0 +1,26 @@
+---
+- name: (Debian/Ubuntu) Install dependencies
+  apt:
+    name: "{{ nginx_unit_debian_dependencies }}"
+    update_cache: yes
+  when: ansible_facts['os_family'] == "Debian"
+
+- name: (Amazon Linux/CentOS/RHEL) Install dependencies
+  yum:
+    name: "{{ nginx_unit_redhat_dependencies }}"
+  when: ansible_facts['os_family'] == "RedHat"
+
+- name: (FreeBSD) Install dependencies
+  block:
+    - name: (FreeBSD) Install dependencies using package(s)
+      pkgng:
+        name: "{{ nginx_unit_freebsd_dependencies }}"
+      when: nginx_bsd_install_packages | bool
+
+    - name: (FreeBSD) Install dependencies using port(s)
+      portinstall:
+        name: "{{ item }}"
+        use_packages: "{{ nginx_unit_bsd_portinstall_use_packages | default(omit) }}"
+      loop: "{{ nginx_unit_freebsd_dependencies }}"
+      when: not nginx_bsd_install_packages | bool
+  when: ansible_facts['distribution'] == "FreeBSD"

roles/nginxinc.nginx_unit/tasks/prerequisites/prerequisites.yml

@@ -0,0 +1,19 @@
+---
+- name: Install dependencies
+  include_tasks: "{{ role_path }}/tasks/prerequisites/install-dependencies.yml"
+
+- name: Set up SELinux
+  block:
+    - name: Check if SELinux is enabled
+      debug:
+        msg: You need to enable SELinux, if it was disabled you need to reboot
+      when: ansible_facts['selinux'] is undefined
+
+    - name: Configure SELinux
+      include_tasks: "{{ role_path }}/tasks/prerequisites/setup-selinux.yml"
+      when: ansible_facts['selinux']['mode'] is defined
+  when:
+    - nginx_unit_selinux | bool
+    - "'selinux' in ansible_facts"
+    - ansible_facts['os_family'] in ['RedHat']
+    - ansible_facts['distribution'] not in ['Amazon']

roles/nginxinc.nginx_unit/tasks/prerequisites/setup-selinux.yml

@@ -0,0 +1,57 @@
+---
+- name: (CentOS/RHEL) Install dependencies
+  block:
+    - name: (CentOS/RHEL 6/7) Install dependencies
+      yum:
+        name:
+          - policycoreutils-python
+          - setools
+      when: ansible_facts['distribution_major_version'] is version('8', '!=')
+
+    - name: (CentOS/RHEL 8) Install dependencies
+      yum:
+        name:
+          - libselinux-utils
+          - policycoreutils
+          - selinux-policy-targeted
+      when: ansible_facts['distribution_major_version'] is version('8', '==')
+  when: ansible_facts['os_family'] == "RedHat"
+
+- name: Set SELinux mode to permissive
+  selinux:
+    state: permissive
+    policy: targeted
+
+- name: Allow SELinux HTTP network connections
+  seboolean:
+    name: httpd_can_network_connect
+    state: yes
+    persistent: yes
+
+- name: Allow SELinux HTTP network connections
+  seboolean:
+    name: httpd_can_network_relay
+    state: yes
+    persistent: yes
+
+- name: Allow SELinux TCP connections on specific ports
+  seport:
+    ports: "{{ nginx_unit_selinux_tcp_ports }}"
+    proto: tcp
+    setype: http_port_t
+    state: present
+  when: nginx_unit_selinux_tcp_ports is defined
+
+- name: Allow SELinux UDP connections on specific ports
+  seport:
+    ports: "{{ nginx_unit_selinux_udp_ports }}"
+    proto: udp
+    setype: http_port_t
+    state: present
+  when: nginx_unit_selinux_udp_ports is defined
+
+- name: Set SELinux mode to enforcing
+  selinux:
+    state: enforcing
+    policy: targeted
+  when: nginx_unit_selinux_enforcing | bool