r/nginx: Fix applying on Buildroot systems

There are a few minor differences between the way Fedora and Buildroot
package *nginx*:

* Fedora uses a user named *nginx* while buildroot uses *www-data*
* Buildroot uses a Debian-like configuration layout (with
  `sites-enabled` and `modules-enabled` directories)

This commit adjusts the *nginx* Ansible role to compensate for these
differences, eschewing Buildroot's configuration layout for the one used
by Fedora/Red Hat.

roles/nginx/tasks/main.yml

@@ -55,6 +55,17 @@
   - 'certs/nginx/{{ inventory_hostname }}/ca.crt'
   notify: reload nginx
 
+- name: ensure nginx configuration directories exist
+  file:
+    path: '{{ item }}'
+    mode: u=rwx,go=rx
+    owner: root
+    group: root
+    state: directory
+  loop:
+  - /etc/nginx
+  - /etc/nginx/conf.d
+  - /etc/nginx/default.d
 - name: ensure nginx is configured
   template:
     src: nginx.conf.j2
@@ -70,6 +81,7 @@
     state: enabled
     permanent: no
     immediate: yes
+  when: host_uses_firewalld|d(true)
   with_items:
   - http
   - https

roles/nginx/templates/nginx.conf.j2

@@ -2,7 +2,7 @@
 #   * Official English Documentation: http://nginx.org/en/docs/
 #   * Official Russian Documentation: http://nginx.org/ru/docs/
 
-user nginx;
+user {{ nginx_user }};
 worker_processes auto;
 error_log /var/log/nginx/error.log;
 {% if nginx_log_syslog|bool %}

roles/nginx/vars/CentOS-8.yml

@@ -1,2 +1,3 @@
+nginx_user: nginx
 nginx_default_ssl_ciphers:
 - PROFILE=SYSTEM

roles/nginx/vars/Fedora.yml

@@ -1,2 +1,3 @@
+nginx_user: nginx
 nginx_default_ssl_ciphers:
 - PROFILE=SYSTEM

roles/nginx/vars/defaults.yml

@@ -1,3 +1,4 @@
+nginx_user: www-data
 nginx_default_ssl_ciphers:
 - HIGH
 - '!aNULL'