<commit_before>---


- hosts: [web_masters, web_slaves]
  roles:
    - { role: java, sudo: True, java_versions: 'oracle-java8-installer' }
    - role: nginx
      sudo: true
      keep_only_specified: False
      nginx_worker_rlimit_nofile: 200000
      nginx_max_clients: 2048
      nginx_http_params:
        - sendfile "on"
        - access_log "/var/log/nginx/access.log"
        - proxy_cache_path {{nginx_cache_dir}} levels=1:2 keys_zone=one:10m
        - proxy_temp_path {{nginx_cache_dir}}/tmp
        # for nginx debugging
        # - error_log "/var/log/nginx/debug_error.log" debug
      nginx_ssl_crt: kaif.io.crt
      nginx_ssl_key: kaif.io.key
      nginx_dhparam: kaif.io.dhparam.pem
      nginx_ssl_crt_content: "{{inv_nginx_ssl_crt_content}}"
      nginx_ssl_key_content: "{{inv_nginx_ssl_key_content}}"
      nginx_dhparam_pem_content: "{{inv_nginx_dhparam_pem_content}}"
      nginx_sites:
        stub_status:
          - listen 80
          - server_name localhost
          - location /nginx_status {
              stub_status on;
              access_log off;
              allow 127.0.0.1;
              deny all;
            }
        kaif_80:
          - listen 80
          - server_name .kaif.io
          - location ~ ^/v1.+ {
              deny all;
            }
          - location ~ ^/oauth.+ {
              deny all;
            }
          - location / {
              return 301 https://kaif.io$request_uri;
            }
        kaif_www:
          - listen 443 ssl http2
          - server_name www.kaif.io
          - return 301 https://kaif.io$request_uri
        kaif:
          - server_name kaif.io localdev.kaif.io
          ### ssl
          # temporary disable spdy because nginx 1.7.10 not work in safari 8
          # - listen 443 ssl spdy
          - listen 443 ssl http2
          - ssl_protocols TLSv1 TLSv1.1 TLSv1.2
          - ssl_prefer_server_ciphers on
          # mozilla recommended:
          - ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:AES:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK'
          - ssl_dhparam /etc/nginx_pki/{{nginx_dhparam}}
          - ssl_certificate /etc/nginx_pki/{{nginx_ssl_crt}}
          - ssl_certificate_key /etc/nginx_pki/{{nginx_ssl_key}}
          - ssl_stapling on
          - ssl_stapling_verify on
          - ssl_trusted_certificate /etc/nginx_pki/comodo-bundle.crt
          - resolver 8.8.4.4 8.8.8.8 valid=300s
          - resolver_timeout 10s
          - ssl_session_cache builtin:1000 shared:SSL:10m
          - ssl_session_timeout 10m
          - proxy_redirect http:// $scheme://
          ### security<commit_msg>remove nginx ssl_session_cache builtin for memory efficiency<commit_after>---


- hosts: [web_masters, web_slaves]
  roles:
    - { role: java, sudo: True, java_versions: 'oracle-java8-installer' }
    - role: nginx
      sudo: true
      keep_only_specified: False
      nginx_worker_rlimit_nofile: 200000
      nginx_max_clients: 2048
      nginx_http_params:
        - sendfile "on"
        - access_log "/var/log/nginx/access.log"
        - proxy_cache_path {{nginx_cache_dir}} levels=1:2 keys_zone=one:10m
        - proxy_temp_path {{nginx_cache_dir}}/tmp
        # for nginx debugging
        # - error_log "/var/log/nginx/debug_error.log" debug
      nginx_ssl_crt: kaif.io.crt
      nginx_ssl_key: kaif.io.key
      nginx_dhparam: kaif.io.dhparam.pem
      nginx_ssl_crt_content: "{{inv_nginx_ssl_crt_content}}"
      nginx_ssl_key_content: "{{inv_nginx_ssl_key_content}}"
      nginx_dhparam_pem_content: "{{inv_nginx_dhparam_pem_content}}"
      nginx_sites:
        stub_status:
          - listen 80
          - server_name localhost
          - location /nginx_status {
              stub_status on;
              access_log off;
              allow 127.0.0.1;
              deny all;
            }
        kaif_80:
          - listen 80
          - server_name .kaif.io
          - location ~ ^/v1.+ {
              deny all;
            }
          - location ~ ^/oauth.+ {
              deny all;
            }
          - location / {
              return 301 https://kaif.io$request_uri;
            }
        kaif_www:
          - listen 443 ssl http2
          - server_name www.kaif.io
          - return 301 https://kaif.io$request_uri
        kaif:
          - server_name kaif.io localdev.kaif.io
          ### ssl
          # temporary disable spdy because nginx 1.7.10 not work in safari 8
          # - listen 443 ssl spdy
          - listen 443 ssl http2
          - ssl_protocols TLSv1 TLSv1.1 TLSv1.2
          - ssl_prefer_server_ciphers on
          # mozilla recommended:
          - ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:AES:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK'
          - ssl_dhparam /etc/nginx_pki/{{nginx_dhparam}}
          - ssl_certificate /etc/nginx_pki/{{nginx_ssl_crt}}
          - ssl_certificate_key /etc/nginx_pki/{{nginx_ssl_key}}
          - ssl_stapling on
          - ssl_stapling_verify on
          - ssl_trusted_certificate /etc/nginx_pki/comodo-bundle.crt
          - resolver 8.8.4.4 8.8.8.8 valid=300s
          - resolver_timeout 10s
          - ssl_session_cache shared:SSL:10m
          - ssl_session_timeout 10m
          - proxy_redirect http:// $scheme://
          ### security
{'fraction_non_alphanumeric': 0.11077749683944374, 'fraction_numerical': 0.06131479140328698, 'mean_word_length': 2.0933528836754642, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 4, 'lorem ipsum': 0, 'www.': 4, 'xml': 0}, 'pii_count': 6, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4992036', 'n_tokens_mistral': 2778, 'n_tokens_neox': 2361, 'n_words': 312}