---
  - name: Install SELinux management dependencies
    yum: name={{ item }} state=present
    with_items:
      - libselinux-python
      - libsemanage-python

  - name: Enable SELinux enforcing for enhanced security
    selinux: policy=targeted state=enforcing

  - name: Restart server so that SELinux is running
    shell: sleep 2 && shutdown -r now "Reboot triggered by Ansible"
    async: 1
    poll: 0
    ignore_errors: true

  - name: Wait for server to come back online
    local_action:
      module: wait_for
       host={{ inventory_hostname }}
       port=22
       delay=10
       state=started

  # It's possible to get a list of available SELinux booleans using the command 'getsebool -a'
  - name: Set required SELinux boolean values
    seboolean: name={{ item }} state=yes persistent=yes
    with_items:
      - httpd_can_network_connect
      - httpd_can_network_connect_db
      - httpd_enable_cgi
      - httpd_setrlimit

---
  - name: Install SELinux management dependencies
    yum: name={{ item }} state=present
    with_items:
      - libselinux-python
      - libsemanage-python

  - name: Enable SELinux enforcing for enhanced security
    selinux: policy=targeted state=enforcing

  - name: Restart server so that SELinux is running
    shell: sleep 2 && shutdown -r now "Reboot triggered by Ansible"
    async: 1
    poll: 0
    ignore_errors: true

  - name: Wait for server to come back online
    local_action:
      module: wait_for
       host={{ inventory_hostname }}
       port=22
       delay=10
       state=started

  # It's possible to get a list of available SELinux booleans using the command 'getsebool -a'
  - name: Set required SELinux boolean values
    seboolean: name={{ item }} state=yes persistent=yes
    with_items:
      - httpd_can_network_connect
      - httpd_can_network_connect_db
      - httpd_enable_cgi
      - httpd_setrlimit

  # This prevents us from having to give Nginx access to var_t context.
  - name: Set /var/www SELinux context to httpd_config_t
    file: path=/var/www recurse=yes setype=httpd_config_t

Allow Nginx to access the /var/www directory
Allow Nginx to access the /var/www directory
