roles/nginx/templates/nginx.conf.j2

@@ -27,7 +27,8 @@ http {
 
     #gzip  on;
     resolver 127.0.0.11 valid=30;
-    ssl_certificate /etc/nginx/{{ base_domain }}.crt;
+    {% if self_signed == true %}
-    ssl_certificate_key /etc/nginx/{{ base_domain }}.key;
+    include /etc/nginx/snippets/self-signed.conf;
+    {% endif %}
     include /etc/nginx/conf.d/*.conf;
 }

roles/nginx/templates/snippets/self-signed.conf.j2

@@ -0,0 +1,2 @@
+ssl_certificate /etc/ssl/{{ base_domain }}.crt;
+ssl_certificate_key /etc/ssl/{{ base_domain }}.key;