nginx: generate dh params

Signed-off-by: Mattia Rizzolo <mattia@debian.org>

roles/nginx/tasks/setup.yml

@@ -42,6 +42,11 @@
   notify:
     - common.reload-firewall
 
+- name: Generate Diffie-Hellman params
+  command: openssl dhparam -out /etc/nginx/dhparam.pem 4096
+  args:
+    creates: /etc/nginx/dhparam.pem
+
 - name: Add an hook to reload nginx when there are new ssl keys
   template:
     src: reload-nginx

roles/nginx/templates/conf.d/misc.conf

@@ -13,4 +13,4 @@ ssl_session_cache shared:SSL:5m;
 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 ssl_ciphers HIGH:!aNULL:!eNULL:!EXP:!LOW:!MD5;
 ssl_prefer_server_ciphers on;
-#ssl_dhparam dhparams.pem;
+ssl_dhparam dhparams.pem;