---

- name: Set ServerSignature.
  lineinfile: dest=/etc/apache2/conf-available/security.conf regexp="^ServerSignature " line="ServerSignature Off" state=present

- name: Set ServerTokens.
  lineinfile: dest=/etc/apache2/conf-available/security.conf regexp="^ServerTokens " line="ServerTokens Prod" state=present

# Deflate is an "essential" module, requiring forced disable.
- name: Disable deflate module to mitigate BREACH attack.
  command: /usr/sbin/a2dismod -f deflate

- name: Disable CGI module.
  apache2_module: state=absent name=cgi

- name: Enable SSL module.
  apache2_module: state=present name=ssl

---

- name: Set ServerSignature.
  lineinfile: dest=/etc/apache2/conf-available/security.conf regexp="^ServerSignature " line="ServerSignature Off" state=present

- name: Set ServerTokens.
  lineinfile: dest=/etc/apache2/conf-available/security.conf regexp="^ServerTokens " line="ServerTokens Prod" state=present

- name: Check for deflate module.
  stat: path=/etc/apache2/mods-enabled/deflate.load
  register: mod_deflate

# Deflate is an "essential" module, requiring forced disable.
- name: Disable deflate module to mitigate BREACH attack.
  command: /usr/sbin/a2dismod -f deflate
  when: mod_deflate.stat.exists == True

- name: Disable CGI module.
  apache2_module: state=absent name=cgi

- name: Enable SSL module.
  apache2_module: state=present name=ssl

Check for deflate module so disabling can be skipped.
Check for deflate module so disabling can be skipped.
