ansible-role-nginx/tasks/modules/install-waf.yml

---
- name: "(Install: All OSs) Install NGINX Plus WAF Module"
  package:
    name: nginx-plus-module-modsecurity
    state: present
  when: waf

- name: "(Setup: NGINX Plus) Load NGINX Plus WAF Module"
  lineinfile:
    path: /etc/nginx/nginx.conf
    insertbefore: BOF
    line: load_module modules/ngx_http_modsecurity_module.so;
  notify: "(Handler: All OSs) Reload NGINX"