---
- name: Create unit snippet directory
  file: path=/etc/systemd/system/nginx.service.d state=directory
  tags: web

- name: Customize systemd unit
  copy:
    content: |
      [Service]
      Restart=on-failure
      StartLimitInterval=0
      RestartSec=5
      PrivateDevices=yes
      ProtectSystem=full
      ProtectHome=yes
      NoNewPrivileges=yes
    dest: /etc/systemd/system/nginx.service.d/ansible.conf
  register: nginx_unit
  notify: restart nginx
  tags: web

- name: Reload systemd
  systemd: daemon_reload=True
  when: nginx_unit.changed
  tags: web

- name: Start and enable the service
  service: name=nginx state=started enabled=True
  tags: web