ansible-role-nginx/tasks/modules/install-waf.yml

---
- name: "(Install: All OSs) Install NGINX Plus WAF Module"
  package:
    name: "nginx-plus-module-modsecurity{{ nginx_version | default('') }}"
    state: present

- name: "(Setup: NGINX Plus) Load NGINX Plus WAF Module"
  lineinfile:
    path: /etc/nginx/nginx.conf
    insertbefore: BOF
    line: load_module modules/ngx_http_modsecurity_module.so;
  when: not nginx_main_template_enable | bool
  notify: "(Handler: All OSs) Reload NGINX"