set file permissions

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

tasks/main.yml

@@ -11,6 +11,7 @@
   template:
     src: "hardening.conf.j2"
     dest: "/etc/nginx/conf.d/90.hardening.conf"
+    mode: '0600'
     owner: "root"
     group: "root"
   notify: restart nginx
@@ -21,6 +22,9 @@
     regexp: '^\s*server_tokens'
     line: "    server_tokens {{ nginx_server_tokens }};"
     insertafter: "http {"
+    mode: '0640'
+    owner: "root"
+    group: "root"
   notify: restart nginx
 
 - name: change ssl_protocols in main nginx.conf
@@ -29,6 +33,9 @@
     regexp: '^\s*ssl_protocols'
     line: "    ssl_protocols {{ nginx_ssl_protocols }};"
     insertafter: "http {"
+    mode: '0640'
+    owner: "root"
+    group: "root"
   notify: restart nginx
 
 - name: change ssl_prefer_server_ciphers in main nginx.conf
@@ -37,6 +44,9 @@
     regexp: '^\s*ssl_prefer_server_ciphers'
     line: "    ssl_prefer_server_ciphers {{ nginx_ssl_prefer_server_ciphers }};"
     insertafter: "http {"
+    mode: '0640'
+    owner: "root"
+    group: "root"
   notify: restart nginx
 
 - name: change client_max_body_size in main nginx.conf
@@ -45,6 +55,9 @@
     regexp: '^\s*client_max_body_size'
     line: "    client_max_body_size {{ nginx_client_max_body_size }};"
     insertafter: "http {"
+    mode: '0640'
+    owner: "root"
+    group: "root"
   notify: restart nginx
 
 - name: change client_body_buffer_size in main nginx.conf
@@ -53,6 +66,9 @@
     regexp: '^\s*client_body_buffer_size'
     line: "    client_body_buffer_size {{ nginx_client_body_buffer_size }};"
     insertafter: "http {"
+    mode: '0640'
+    owner: "root"
+    group: "root"
   notify: restart nginx
 
 - name: change keepalive_timeout in main nginx.conf
@@ -61,6 +77,9 @@
     regexp: '^\s*keepalive_timeout'
     line: "    keepalive_timeout {{ nginx_keepalive_timeout }};"
     insertafter: "http {"
+    mode: '0640'
+    owner: "root"
+    group: "root"
   notify: restart nginx
 
 - name: remove default.conf