Template only for now. Deployed manually on luna, not yet integrated
with apollo.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Max files limit causes journald to be too agressive when cleaning up
old logs because it tries to stay under the limit. If there are enough
users on the system that won't happen and it will start removing system
logs way too soon (like after a few hours or days).

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Our ansible.cfg had some settings that were using the default values,
according to ansible documentation.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Uses the nginx config from here:
https://kanboard.net/documentation/nice-urls



Signed-off-by: Florian Pritz <bluewind@xinu.at>

The HSTS header is already added by nginx. If kanboard adds its own the
reply contains a header that contains max-age twice which is invalid.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

This behaves better with non-C compilers, where we do not provide any
environment FLAGS.

It does add -O3, but I think this can be excused as an upstream choice.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

At http://www.archlinux.org/check_network_status.txt (no https)

Instead of looking at the access time of the dirs; that one is
useless for cleaning.

The tasks that use variables need them to be at least defined,
even if empty, to be able to run. Added some defaults.

When using when: on ansible, it already checks if the variable is
set or not. But the variable must still be defined.

To correctly be safe for CVE-2016-1247, we need all nginx log dirs
to be owned by both user and group root. Also, since nginx childs
runs as http user, the directories permissions must be 0755, so the
http user can descent into it. Since the logrotate will create the
log files as http:log, the nginx childs will be able to write to the
logs, but will not be able to create files inside those dirs, fully
preventing CVE-2016-1247.