Don't use set_fact

tasks/main.yml

@@ -1,19 +1,11 @@
 ---
-- ansible.builtin.set_fact:
+- ansible.builtin.include_role:
-    unsecure_server: |
+    name: "{{ next_role }}"
-      location @{{ instance_name | default(ansible_play_name) | replace(" ", "_") }}_neighbor {
+  when: not notls
-              proxy_pass http://{{ neighbor.host }};
-              proxy_set_header Host {{ neighbor.target }};
-              proxy_set_header X-Real-IP $remote_addr;
-              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-      }
-    nginx_acme_challenge: |
-      try_files $uri $uri/ @{{ instance_name | default(ansible_play_name) | replace(" ", "_") }}_neighbor;
-
-- ansible.builtin.set_fact:
-    onlyifnotexist: true
-    server: ""
-  when: notls
 
 - ansible.builtin.include_role:
     name: "{{ next_role }}"
+  vars:
+    onlyifnotexist: true
+    server: ""
+  when: notls

vars/main.yml

@@ -1,2 +1,17 @@
 ---
 next_role: re.nemunai.nginx-config-svc
+
+unsecure_server: |
+  location @{{ instance_name | default(ansible_play_name) | replace(" ", "_") }}_neighbor {
+          proxy_pass http://{{ neighbor.host }};
+          {% if "target" in neighbor %}proxy_set_header Host {{ neighbor.target }};{% endif %}
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  }
+
+  location / {
+          # enforce https
+          return 301 https://$server_name:443$request_uri;
+  }
+nginx_acme_challenge: |
+  try_files $uri $uri/ @{{ instance_name | default(ansible_play_name) | replace(" ", "_") }}_neighbor;