diff --git a/tasks/keystone_install.yml b/tasks/keystone_install.yml
index a32b658f..0099e08e 100644
--- a/tasks/keystone_install.yml
+++ b/tasks/keystone_install.yml
@@ -51,6 +51,20 @@
     - ansible_pkg_mgr in ['yum', 'dnf']
     - keystone_sp != {}
 
+- name: Add NGINX repository
+  yum_repository:
+    name: nginx
+    description: 'nginx repo'
+    baseurl: "{{ keystone_nginx_repo }}"
+    gpgkey: "{{ keystone_nginx_gpg_key }}"
+  when:
+    - ansible_pkg_mgr in ['yum', 'dnf']
+    - keystone_web_server == 'nginx'
+  register: add_nginx_repo
+  until: add_nginx_repo is success
+  retries: 5
+  delay: 2
+
 # If the web server being removed was never installed, this task will fail when trying
 # to stop/disable it. The task is therefore set to never fail.
 - name: Ensure other web server is not running/enabled
diff --git a/vars/redhat-7.yml b/vars/redhat-7.yml
index 11d675ad..d6b95c60 100644
--- a/vars/redhat-7.yml
+++ b/vars/redhat-7.yml
@@ -48,6 +48,8 @@ keystone_apache_distro_packages:
 keystone_mod_wsgi_distro_packages:
   - mod_wsgi
 
+keystone_nginx_repo: http://nginx.org/packages/centos/7/$basearch/
+keystone_nginx_gpg_key: http://nginx.org/keys/nginx_signing.key
 keystone_nginx_distro_packages:
   - nginx