Multi-cloud & platform-agnosticLive-tested

Nginx (verified role)

Name: Nginx (verified role)
Brand: IaC Bazaar
SKU: ansible-nginx
Price: 29.00 USD
Availability: InStock

Verified wrapper around geerlingguy.nginx pinned at 3.3.0 plus an IaC Bazaar hardening overlay (server_tokens off, security headers, default-vhost removal); live-tested for idempotence and functionally verified: systemd unit active, HTTP 200, headers present, no version leak.

ansibleWeb Servers

Verification

Live-tested

Really deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.

Conformance

Static validation (yamllint · ansible-lint)

Provenance

SHA-256 checksum
Cosign signature

Functional

Live-tested - applied, verified, destroyed

Last verified 2026-06-10 · how we verify

Verify this download

cosign · sha-256

Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.

# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub

# 2. This module's Sigstore bundle
curl -o ansible-nginx-1.0.0.sigstore.json \
  https://www.iac-bazaar.com/api/artifacts/ansible-nginx/signature

# 3. Verify the tarball you downloaded
cosign verify-blob \
  --key cosign.pub \
  --bundle ansible-nginx-1.0.0.sigstore.json \
  ansible-nginx-1.0.0.tar.gz
# → Verified OK

# 4. (optional) confirm the checksum too
echo "781e48690ecf8dcc04c7e2c5fec41e06291c4977c3e5b9cb0d217d5f533e749a  ansible-nginx-1.0.0.tar.gz" | sha256sum -c

Signature bundle Public key Machine-readable receipt How we verify

Documentation

nginx-hardened

Hardened nginx as a verified wrapper around the upstream open-source role geerlingguy.nginx, pinned to an exact version in requirements.yml and installed unmodified. On top of upstream, this role:

removes the default vhost and serves a single configurable vhost on port 80 (real content, so the live test asserts a genuine HTTP 200);
turns server_tokens off (no nginx version in the Server header or on error pages);
deploys /etc/nginx/conf.d/zz-hardening.conf with security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, plus any extras you define) — all configurable via nginx_hardened_* defaults;
validates the config (nginx -t) and reloads nginx via handlers on change.

Live-tested with podman (converge → idempotence → functional verify → destroy) on the Rocky Linux 10 image with real systemd. The verify stage asserts the systemd unit is active, the vhost answers 200 with our page, the security headers are present, and the Server header leaks no version.

Upstream attribution and the full upstream MIT license are in ATTRIBUTION.md.

License

Wrapper (this role's tasks, templates, defaults, tests): MIT, © IaC Bazaar. Upstream geerlingguy.nginx: MIT, © Jeff Geerling — see ATTRIBUTION.md.

Usage code & full reference unlock after purchase

The complete copy-paste usage, the full input/output reference, and operational notes ship with your licence - shown here and bundled in the download.

Install
Variables
Test