Unify nginx configuration

This creates a simple base configuration skeleton, that other configuration can be easily loaded into.

ansible/roles/gateway/files/nginx.conf

@@ -1,56 +1,16 @@
-worker_processes auto;
+log_format access '$remote_addr [$time_local] '
+                '$protocol $status $bytes_sent $bytes_received '
+                '$session_time "$ssl_preread_server_name" '
+                '"$upstream_bytes_sent" "$upstream_bytes_received" "$upstream_connect_time"';
 
-events {
-    worker_connections  1024;
-}
-
-
-http {
-    include       /etc/nginx/mime.types;
-    default_type  application/octet-stream;
-
-    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
-    #                  '$status $body_bytes_sent "$http_referer" '
-    #                  '"$http_user_agent" "$http_x_forwarded_for"';
-
-    #access_log  logs/access.log  main;
-
-    sendfile        on;
-    #tcp_nopush     on;
-
-    #keepalive_timeout  0;
-    keepalive_timeout  65;
-
-    #gzip  on;
-
-    server_tokens off;
-
-    server {
-        listen 80;
-        server_name _;
-        return 308 https://$host$request_uri;
-    }
-}
-
-stream {
-
-    log_format access '$remote_addr [$time_local] '
-                    '$protocol $status $bytes_sent $bytes_received '
-                    '$session_time "$ssl_preread_server_name" '
-                    '"$upstream_bytes_sent" "$upstream_bytes_received" "$upstream_connect_time"';
-
-    log_format ips '$remote_addr [$time_local] $ssl_preread_server_name';
-
-
-    access_log /var/log/nginx/access.log access;
-    access_log /var/log/nginx/ips.log ips;
-
-    ssl_preread on;
-
-    server {
-        listen 443;
-        listen 8448;
-        proxy_pass {{ wireguard.clients.ingress.ip }}:8443;
-        proxy_protocol on;
-    }
+log_format ips '$remote_addr [$time_local] $ssl_preread_server_name';
+
+access_log /var/log/nginx/access.log access;
+access_log /var/log/nginx/ips.log ips;
+
+server {
+    listen 443;
+    listen 8448;
+    proxy_pass {{ wireguard.clients.ingress.ip }}:8443;
+    proxy_protocol on;
 }

ansible/roles/gateway/tasks/nginx.yml

@@ -1,26 +1,14 @@
-- name: Install nginx
-  package:
-    name: nginx
-  become: true
-
 - name: Nginx config
   template:
     src: files/nginx.conf
-    dest: /etc/nginx/nginx.conf
-    validate: nginx -t -c %s
+    dest: /etc/nginx/stream.d/gateway.conf
     mode: "0644"
   become: true
   register: nginx_config
 
-- name: Enable Nginx
+- name: Reload Nginx
   service:
     name: nginx
-    enabled: true
-  become: true
-
-- name: Restart Nginx
-  service:
-    name: nginx
-    state: restarted
+    state: reloaded
   become: true
   when: nginx_config.changed