---
- name: Check if frontend.conf exists
  ansible.builtin.stat:
    path: /etc/nginx/conf.d/frontend.conf
  register: frontend_conf_file

- name: Update security headers
  ansible.builtin.blockinfile:
    backup: true
    block: "{{ lookup('file', 'nginx_secured_headers.txt') }}"
    create: false
    insertafter: "location / {"
    path: /etc/nginx/conf.d/frontend.conf
  notify: Reload Nginx
  when: frontend_conf_file.stat.exists

- name: Ensure nginx config is valid
  ansible.builtin.command: /usr/sbin/nginx -t
  changed_when: false
  when: frontend_conf_file.stat.exists
