servers-for-hackers / ansible-ssl-example Goto Github PK

I was looking through your example and noticed that you are copying the contents of the keys into temporary files, moving them in place, then removing the temp files. Couldn't you use the content property on the copy task instead to avoid having to create the temp files?

I happened by this repository, and have a couple of comments which might be helpful:

1. The mode parameter for the file module is in octal, so it should say mode=0755 instead of mode=755 for /etc/ssl/sfh.
2. 755 for the ssl directory containing the private key is too permissive IMO, it should be 700. Note that e.g. nginx workers don't need access to this directory, only the initial daemon.