If you see this page, the nginx web server is successfully installed and -working. Further configuration is required.
- -For online documentation and support please refer to
-nginx.org.
-Commercial support is available at
-nginx.com.
Thank you for using nginx.
- - \ No newline at end of file diff --git a/ansible/roles/nginxinc.nginx/handlers/main.yml b/ansible/roles/nginxinc.nginx/handlers/main.yml index 5d58b86..76a99d9 100644 --- a/ansible/roles/nginxinc.nginx/handlers/main.yml +++ b/ansible/roles/nginxinc.nginx/handlers/main.yml @@ -1,39 +1,39 @@ --- -- name: "(Handler: All OSs) Run NGINX" - block: - - - name: "(Handler: All OSs) Start NGINX" - service: - name: nginx - state: started - enabled: yes - notify: "(Handler: All OSs) Check NGINX" - - - name: "(Handler: All OSs) Reload NGINX" - command: "nginx -s reload" - changed_when: false +- name: (Handler) Systemd daemon-reload + systemd: + daemon_reload: yes +- name: (Handler) Start/reload NGINX + service: + name: nginx + state: reloaded + enabled: yes when: - nginx_start | bool - - not ansible_check_mode + - not ansible_check_mode | bool + listen: (Handler) Run NGINX -- name: "(Handler: All OSs) Start NGINX Amplify Agent" +- name: (Handler) Check NGINX + command: nginx -t + register: config_check + ignore_errors: yes + check_mode: no + changed_when: false + listen: (Handler) Run NGINX + +- name: (Handler) Print NGINX error if syntax check fails + debug: + var: config_check.stderr_lines + failed_when: config_check.rc != 0 + when: + - config_check.stderr_lines is defined + - config_check.rc != 0 + listen: (Handler) Run NGINX + +- name: (Handler) Start NGINX Amplify agent service: name: amplify-agent state: started -- name: "(Handler: Debian/Ubuntu/CentOS/RedHat) Start NGINX Unit" - service: - name: unit - state: started - enabled: yes - -- name: "(Handler: FreeBSD) Start NGINX Unit" - service: - name: unitd - state: started - enabled: yes - -- name: "(Handler: All OSs) Check NGINX" - command: "nginx -t" - changed_when: false +- name: (Handler) Run logrotate + command: logrotate -f /etc/logrotate.d/nginx diff --git a/ansible/roles/nginxinc.nginx/meta/.galaxy_install_info b/ansible/roles/nginxinc.nginx/meta/.galaxy_install_info index 24f861e..935239a 100644 --- a/ansible/roles/nginxinc.nginx/meta/.galaxy_install_info +++ b/ansible/roles/nginxinc.nginx/meta/.galaxy_install_info @@ -1,2 +1,2 @@ -install_date: Fri May 15 21:51:16 2020 -version: 0.14.0 +install_date: Sat Feb 20 13:56:47 2021 +version: 0.19.1 diff --git a/ansible/roles/nginxinc.nginx/meta/main.yml b/ansible/roles/nginxinc.nginx/meta/main.yml index 0a3f86e..9055bb0 100644 --- a/ansible/roles/nginxinc.nginx/meta/main.yml +++ b/ansible/roles/nginxinc.nginx/meta/main.yml @@ -2,7 +2,8 @@ galaxy_info: author: Alessandro Fael Garcia description: Official Ansible role for NGINX - company: NGINX, Inc. + role_name: nginx + company: F5 Networks, Inc. license: Apache License, Version 2.0 @@ -11,19 +12,21 @@ galaxy_info: platforms: - name: Alpine versions: - - all + - any - name: Amazon versions: - - Candidate + - 2018.03 + - name: Amazon Linux 2 + versions: + - any - name: Debian versions: - - jessie - stretch - buster - name: EL versions: - - 6 - 7 + - 8 - name: FreeBSD versions: - 11.2 @@ -32,6 +35,7 @@ galaxy_info: versions: - xenial - bionic + - focal - name: SLES versions: - 12 @@ -40,11 +44,11 @@ galaxy_info: galaxy_tags: - nginx - oss + - opensource - plus - - amplify - - unit - web - server - development + - install dependencies: [] diff --git a/ansible/roles/nginxinc.nginx/molecule/common/Dockerfile.j2 b/ansible/roles/nginxinc.nginx/molecule/common/Dockerfile.j2 index c268a5b..a84fd9d 100644 --- a/ansible/roles/nginxinc.nginx/molecule/common/Dockerfile.j2 +++ b/ansible/roles/nginxinc.nginx/molecule/common/Dockerfile.j2 @@ -17,27 +17,27 @@ ENV {{ var }} {{ value }} RUN \ if [ $(command -v apt-get) ]; then \ apt-get update \ - && apt-get install -y python3 sudo bash ca-certificates iproute2 python3-apt aptitude systemd systemd-sysv procps curl \ + && DEBIAN_FRONTEND=noninteractive apt-get install -y aptitude bash ca-certificates curl iproute2 python-apt python3 python3-apt procps sudo systemd systemd-sysv vim \ && apt-get clean; \ elif [ $(command -v dnf) ]; then \ dnf makecache \ - && dnf --assumeyes install /usr/bin/python3 /usr/bin/python3-config /usr/bin/dnf-3 bash iproute \ + && dnf --assumeyes install bash iproute sudo /usr/bin/dnf-3 /usr/bin/python3 /usr/bin/python3-config vim \ && dnf clean all; \ elif [ $(command -v yum) ]; then \ yum makecache fast \ - && yum install -y /usr/bin/python /usr/bin/python2-config sudo yum-plugin-ovl bash iproute \ + && yum install -y bash iproute sudo /usr/bin/python /usr/bin/python2-config vim yum-plugin-ovl \ && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf \ && yum clean all; \ elif [ $(command -v zypper) ]; then \ zypper refresh \ - && zypper install -y python3 sudo bash iproute2 \ + && zypper install -y bash iproute2 python3 sudo vim \ && zypper clean -a; \ elif [ $(command -v apk) ]; then \ apk update \ - && apk add --no-cache python3 sudo bash ca-certificates curl openrc; \ + && apk add --no-cache bash ca-certificates curl openrc python3 sudo vim; \ echo 'rc_provide="loopback net"' >> /etc/rc.conf; \ elif [ $(command -v xbps-install) ]; then \ xbps-install -Syu \ - && xbps-install -y python3 sudo bash ca-certificates iproute2 \ + && xbps-install -y bash ca-certificates iproute2 python3 sudo vim \ && xbps-remove -O; \ fi diff --git a/ansible/roles/nginxinc.nginx/molecule/common/files/http/default.conf b/ansible/roles/nginxinc.nginx/molecule/common/files/http/default.conf deleted file mode 100755 index 4559b82..0000000 --- a/ansible/roles/nginxinc.nginx/molecule/common/files/http/default.conf +++ /dev/null @@ -1,44 +0,0 @@ -server { - listen 80; - server_name localhost; - - #charset koi8-r; - #access_log /var/log/nginx/host.access.log main; - - location / { - root /usr/share/nginx/html; - index index.html index.htm; - } - - #error_page 404 /404.html; - - # redirect server error pages to the static page /50x.html - # - error_page 500 502 503 504 /50x.html; - location = /50x.html { - root /usr/share/nginx/html; - } - - # proxy the PHP scripts to Apache listening on 127.0.0.1:80 - # - #location ~ \.php$ { - # proxy_pass http://127.0.0.1; - #} - - # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000 - # - #location ~ \.php$ { - # root html; - # fastcgi_pass 127.0.0.1:9000; - # fastcgi_index index.php; - # fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name; - # include fastcgi_params; - #} - - # deny access to .htaccess files, if Apache's document root - # concurs with nginx's one - # - #location ~ /\.ht { - # deny all; - #} -} diff --git a/ansible/roles/nginxinc.nginx/molecule/common/files/nginx.conf b/ansible/roles/nginxinc.nginx/molecule/common/files/nginx.conf deleted file mode 100755 index ba09f41..0000000 --- a/ansible/roles/nginxinc.nginx/molecule/common/files/nginx.conf +++ /dev/null @@ -1,31 +0,0 @@ -user nginx; -worker_processes 4; - -error_log /var/log/nginx/error.log warn; -pid /var/run/nginx.pid; - - -events { - worker_connections 1024; -} - - -http { - include /etc/nginx/mime.types; - default_type application/octet-stream; - - log_format main '$remote_addr - $remote_user [$time_local] "$request" ' - '$status $body_bytes_sent "$http_referer" ' - '"$http_user_agent" "$http_x_forwarded_for"'; - - access_log /var/log/nginx/access.log main; - - sendfile on; - #tcp_nopush on; - - keepalive_timeout 65; - - #gzip on; - - include /etc/nginx/conf.d/*.conf; -} diff --git a/ansible/roles/nginxinc.nginx/molecule/common/files/www/.gitkeep b/ansible/roles/nginxinc.nginx/molecule/common/files/www/.gitkeep deleted file mode 100644 index e69de29..0000000 diff --git a/ansible/roles/nginxinc.nginx/molecule/common/playbook_default.yml b/ansible/roles/nginxinc.nginx/molecule/common/playbook_default.yml deleted file mode 100644 index aa04765..0000000 --- a/ansible/roles/nginxinc.nginx/molecule/common/playbook_default.yml +++ /dev/null @@ -1,20 +0,0 @@ ---- -- name: Converge - hosts: all - pre_tasks: - - name: "Set repo if Alpine" - set_fact: - version: "=1.17.8-r1" - when: ansible_os_family == "Alpine" - - name: "Set repo if Debian" - set_fact: - version: "=1.17.8-1~{{ ansible_distribution_release }}" - when: ansible_os_family == "Debian" - - name: "Set repo if RedHat" - set_fact: - version: "-1.17.8-1.el{{ ansible_distribution_major_version }}.ngx" - when: ansible_os_family == "RedHat" - roles: - - role: ansible-role-nginx - vars: - nginx_version: "{{ version }}" diff --git a/ansible/roles/nginxinc.nginx/molecule/common/playbook_module.yml b/ansible/roles/nginxinc.nginx/molecule/common/playbook_module.yml deleted file mode 100644 index 3f42b42..0000000 --- a/ansible/roles/nginxinc.nginx/molecule/common/playbook_module.yml +++ /dev/null @@ -1,16 +0,0 @@ ---- -- name: Converge - hosts: all - roles: - - role: ansible-role-nginx - vars: - nginx_debug_output: true - - nginx_modules: - njs: true - perl: true - waf: false - geoip: true - image_filter: true - rtmp: true - xslt: true diff --git a/ansible/roles/nginxinc.nginx/molecule/common/playbook_source.yml b/ansible/roles/nginxinc.nginx/molecule/common/playbook_source.yml deleted file mode 100644 index 808fd2f..0000000 --- a/ansible/roles/nginxinc.nginx/molecule/common/playbook_source.yml +++ /dev/null @@ -1,19 +0,0 @@ ---- -- name: Converge - hosts: all - roles: - - role: ansible-role-nginx - vars: - nginx_debug_output: true - - nginx_install_from: source - nginx_branch: mainline - nginx_install_source_build_tools: true - nginx_install_source_pcre: false - nginx_install_source_openssl: true - nginx_install_source_zlib: false - - nginx_main_upload_enable: true - nginx_main_upload_src: files/nginx.conf - nginx_http_upload_enable: true - nginx_http_upload_src: files/http/*.conf diff --git a/ansible/roles/nginxinc.nginx/molecule/common/playbook_stable_push.yml b/ansible/roles/nginxinc.nginx/molecule/common/playbook_stable_push.yml deleted file mode 100644 index c4841ae..0000000 --- a/ansible/roles/nginxinc.nginx/molecule/common/playbook_stable_push.yml +++ /dev/null @@ -1,13 +0,0 @@ ---- -- name: Converge - hosts: all - roles: - - role: ansible-role-nginx - vars: - nginx_debug_output: true - - nginx_branch: stable - nginx_main_upload_enable: true - nginx_main_upload_src: files/nginx.conf - nginx_http_upload_enable: true - nginx_http_upload_src: files/http/*.conf diff --git a/ansible/roles/nginxinc.nginx/molecule/common/playbook_template.yml b/ansible/roles/nginxinc.nginx/molecule/common/playbook_template.yml deleted file mode 100644 index 3ff9e57..0000000 --- a/ansible/roles/nginxinc.nginx/molecule/common/playbook_template.yml +++ /dev/null @@ -1,353 +0,0 @@ ---- -- name: Converge - hosts: all - roles: - - role: ansible-role-nginx - vars: - nginx_debug_output: true - - nginx_main_template_enable: true - nginx_main_template: - template_file: nginx.conf.j2 - conf_file_name: nginx.conf - conf_file_location: /etc/nginx/ - user: nginx - worker_processes: auto - error_log: - location: /var/log/nginx/error.log - level: warn - worker_connections: 1024 - http_enable: true - http_settings: - access_log_format: - - name: main - format: | - '$remote_addr - $remote_user [$time_local] "$request" ' - '$status $body_bytes_sent "$http_referer" ' - '"$http_user_agent" "$http_x_forwarded_for"' - access_log_location: - - name: main - location: /var/log/nginx/access.log - keepalive_timeout: 65 - cache: false - rate_limit: false - keyval: false - server_tokens: "off" - sub_filter: - # sub_filters: [] - last_modified: "off" - once: "on" - types: "text/html" - stream_enable: true - http_global_autoindex: false - - nginx_http_template_enable: true - nginx_http_template: - app: - template_file: http/default.conf.j2 - conf_file_name: default.conf - conf_file_location: /etc/nginx/conf.d/ - servers: - server1: - listen: - listen_localhost: - ip: 0.0.0.0 - port: 80 - opts: - - default_server - server_name: localhost - error_page: /usr/share/nginx/html - client_max_body_size: 512k - proxy_hide_headers: - - X-Powered-By - add_headers: - strict_transport_security: - name: Strict-Transport-Security - value: max-age=15768000; includeSubDomains - always: true - sub_filter: - # sub_filters: [] - last_modified: "off" - once: "on" - types: "text/html" - # custom_options: [] - reverse_proxy: - locations: - frontend: - location: / - proxy_hide_headers: - - X-Powered-By - add_headers: - strict_transport_security: - name: Strict-Transport-Security - value: max-age=15768000; includeSubDomains - always: true - another_header: - name: Fancy-New-Header-To-Test - value: testing=true - always: false - proxy_pass: http://frontend_servers/ - proxy_cache: frontend_proxy_cache - proxy_cache_valid: - - code: 200 - time: 10m - - code: 301 - time: 1m - proxy_temp_path: - path: /var/cache/nginx/proxy/frontend/temp - proxy_cache_lock: false - proxy_cache_min_uses: 3 - proxy_cache_revalidate: false - proxy_cache_use_stale: - - http_403 - - http_404 - proxy_ignore_headers: - - Vary - - Cache-Control - proxy_redirect: false - proxy_set_header: - header_host: - name: Host - value: $host - header_x_real_ip: - name: X-Real-IP - value: $remote_addr - header_x_forwarded_for: - name: X-Forwarded-For - value: $proxy_add_x_forwarded_for - header_x_forwarded_proto: - name: X-Forwarded-Proto - value: $scheme - proxy_buffering: false - client_max_body_size: 5m - sub_filter: - # sub_filters: [] - last_modified: "off" - once: "on" - types: "text/html" - backend: - location: /backend - proxy_pass: http://backend_servers/ - proxy_cache: backend_proxy_cache - proxy_cache_valid: - - time: 10m - proxy_temp_path: - path: /var/cache/nginx/proxy/backend/temp - proxy_cache_lock: true - proxy_cache_min_uses: 2 - proxy_cache_revalidate: true - proxy_cache_use_stale: - - http_500 - - http_502 - - http_503 - proxy_redirect: default - proxy_set_header: - header_host: - name: Host - value: $host - header_x_real_ip: - name: X-Real-IP - value: $remote_addr - header_x_forwarded_for: - name: X-Forwarded-For - value: $proxy_add_x_forwarded_for - header_x_forwarded_proto: - name: X-Forwarded-Proto - value: $scheme - proxy_cookie_path: - path: /web/ - replacement: / - returns: - return301: - location: ^~ /old-path - code: 301 - value: http://$host/new-path - proxy_cache: - proxy_cache_path: - - path: /var/cache/nginx/proxy/frontend - keys_zone: - name: frontend_proxy_cache - size: 5m - levels: "1:2" - max_size: 5g - inactive: 30m - use_temp_path: true - - path: /var/cache/nginx/proxy/backend - keys_zone: - name: backend_proxy_cache - size: 10m - levels: "1:2" - max_size: 10g - inactive: 60m - use_temp_path: true - proxy_temp_path: - path: /var/cache/nginx/proxy/temp - proxy_cache_lock: true - proxy_cache_min_uses: 5 - proxy_cache_revalidate: true - proxy_cache_use_stale: - - error - - timeout - proxy_ignore_headers: - - Expires - upstreams: - frontend_upstream: - name: frontend_servers - lb_method: least_conn - zone_name: frontend_mem_zone - zone_size: 64k - sticky_cookie: false - servers: - frontend_server_1: - address: 0.0.0.0 - port: 8081 - weight: 1 - health_check: max_fails=3 fail_timeout=5s - backend_upstream: - name: backend_servers - lb_method: least_conn - zone_name: backend_mem_zone - zone_size: 64k - sticky_cookie: false - servers: - backend_server_1: - address: 0.0.0.0 - port: 8082 - weight: 1 - health_check: max_fails=3 fail_timeout=5s - frontend: - template_file: http/default.conf.j2 - conf_file_name: frontend_default.conf - conf_file_location: /etc/nginx/conf.d/ - servers: - server1: - listen: - listen_localhost: - port: 8081 - opts: [] - server_name: localhost - error_page: /usr/share/nginx/html - autoindex: false - sub_filter: - sub_filters: - - "'server_hostname' '$hostname'" - - "'server_address' '$server_addr:$server_port'" - - "'server_url' '$request_uri'" - - "'remote_addr' '$remote_addr:$remote_port'" - - "'server_date' '$time_local'" - - "'client_browser' '$http_user_agent'" - - "'request_id' '$request_id'" - - "'nginx_version' '$nginx_version'" - - "'document_root' '$document_root'" - - "'proxied_for_ip' '$http_x_forwarded_for'" - last_modified: "off" - once: "off" - types: "text/html" - web_server: - locations: - frontend_site: - location: / - proxy_hide_headers: - - X-Powered-By - html_file_location: /usr/share/nginx/html - html_file_name: frontend_index.html - autoindex: false - sub_filter: - # sub_filters: [] - last_modified: "off" - once: "off" - types: "text/html" - http_demo_conf: false - backend: - template_file: http/default.conf.j2 - conf_file_name: backend_default.conf - conf_file_location: /etc/nginx/conf.d/ - servers: - server1: - listen: - listen_localhost: - port: 8082 - opts: [] - server_name: localhost - error_page: /usr/share/nginx/html - autoindex: false - sub_filter: - sub_filters: - - "'server_hostname' '$hostname'" - - "'server_address' '$server_addr:$server_port'" - - "'server_url' '$request_uri'" - - "'remote_addr' '$remote_addr:$remote_port'" - - "'server_date' '$time_local'" - - "'client_browser' '$http_user_agent'" - - "'request_id' '$request_id'" - - "'nginx_version' '$nginx_version'" - - "'document_root' '$document_root'" - - "'proxied_for_ip' '$http_x_forwarded_for'" - last_modified: "off" - once: "off" - types: "text/html" - web_server: - locations: - backend_site: - location: / - html_file_location: /usr/share/nginx/html - html_file_name: backend_index.html - autoindex: false - php: - location: ~ \.php$ - html_file_location: /usr/share/nginx/html - autoindex: false - custom_options: - - fastcgi_split_path_info ^(.+\.php)(/.+)$ - - fastcgi_pass unix:/run/php/php7.2-fpm.sock - - fastcgi_index index.php - - include fastcgi_params - - fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name - sub_filter: - # sub_filters: [] - last_modified: "off" - once: "off" - types: "text/html" - http_demo_conf: false - nginx_html_demo_template_enable: true - nginx_html_demo_template: - frontend: - template_file: www/index.html.j2 - html_file_name: frontend_index.html - html_file_location: /usr/share/nginx/html - web_server_name: Frontend - backend: - template_file: www/index.html.j2 - html_file_name: backend_index.html - html_file_location: /usr/share/nginx/html - web_server_name: Backend - - nginx_stream_template_enable: true - nginx_stream_template: - default: - template_file: stream/default.conf.j2 - conf_file_name: default.conf - conf_file_location: /etc/nginx/conf.d/stream - network_streams: - app: - listen_address: 0.0.0.0 - listen_port: 8090 - udp_enable: false - proxy_pass: backend - proxy_timeout: 3s - proxy_connect_timeout: 1s - proxy_protocol: false - health_check_plus: false - upstreams: - backend_upstream: - name: backend - lb_method: least_conn - zone_name: backend - zone_size: 64k - sticky_cookie: false - servers: - backend_server_1: - address: 0.0.0.0 - port: 8091 - weight: 1 - health_check: max_fails=1 fail_timeout=10s diff --git a/ansible/roles/nginxinc.nginx/molecule/common/playbook_unit.yml b/ansible/roles/nginxinc.nginx/molecule/common/playbook_unit.yml deleted file mode 100644 index ee1dcc1..0000000 --- a/ansible/roles/nginxinc.nginx/molecule/common/playbook_unit.yml +++ /dev/null @@ -1,30 +0,0 @@ ---- -- name: Converge - hosts: all - pre_tasks: - - name: "Set module if Alpine" - set_fact: - module: - - "unit-perl" - - "unit-php7" - - "unit-python3" - when: ansible_os_family == "Alpine" - - name: "Set module if Debian/RedHat" - set_fact: - module: - - "unit-perl" - - "unit-php" - - "unit-ruby" - when: ansible_os_family == "Debian" - - name: "Set module if RedHat" - set_fact: - module: - - "unit-php" - - "unit-go" - when: ansible_os_family == "RedHat" - roles: - - role: ansible-role-nginx - vars: - nginx_enable: false - nginx_unit_enable: true - nginx_unit_modules: "{{ module }}" diff --git a/ansible/roles/nginxinc.nginx/molecule/common/playbooks/default_converge.yml b/ansible/roles/nginxinc.nginx/molecule/common/playbooks/default_converge.yml new file mode 100644 index 0000000..3700406 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/common/playbooks/default_converge.yml @@ -0,0 +1,47 @@ +--- +- name: Converge + hosts: all + pre_tasks: + - name: Set repo if Alpine + set_fact: + version: "=1.19.1-r1" + when: ansible_facts['os_family'] == "Alpine" + - name: Set repo if Debian + set_fact: + version: "=1.19.1-1~{{ ansible_facts['distribution_release'] }}" + when: ansible_facts['os_family'] == "Debian" + - name: Set repo if Red Hat + set_fact: + version: "-1.19.1-1.el{{ ansible_facts['distribution_major_version'] }}.ngx" + when: ansible_facts['os_family'] == "RedHat" + - name: Enable NGINX @CentOS-AppStream dnf modules + shell: + args: + cmd: dnf module info nginx | grep -q 'Stream.*\[e\]' && echo -n ENABLED || dnf module enable -y nginx # noqa 204 303 + register: dnf_module_enable + changed_when: dnf_module_enable.stdout != 'ENABLED' + when: ansible_facts['os_family'] == "RedHat" and ansible_facts['distribution_major_version'] is version('8', '==') + tasks: + - name: Install NGINX + include_role: + name: ansible-role-nginx + vars: + nginx_debug_output: true + nginx_selinux: true + nginx_selinux_tcp_ports: + - 80 + - 443 + nginx_version: "{{ version }}" + nginx_configure: false + nginx_logrotate_conf_enable: true + nginx_logrotate_conf: + paths: + - /var/log/nginx/*.log + options: + - daily + - missingok + - rotate 14 + - compress + - delaycompress + - notifempty + - sharedscripts diff --git a/ansible/roles/nginxinc.nginx/molecule/common/playbooks/default_verify.yml b/ansible/roles/nginxinc.nginx/molecule/common/playbooks/default_verify.yml new file mode 100644 index 0000000..8e590fb --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/common/playbooks/default_verify.yml @@ -0,0 +1,24 @@ +--- +- name: Verify + hosts: all + tasks: + - name: Check if NGINX is installed + package: + name: nginx + check_mode: yes + register: install + failed_when: (install is changed) or (install is failed) + + - name: Check if NGINX service is running + service: + name: nginx + state: started + enabled: yes + check_mode: yes + register: service + failed_when: (service is changed) or (service is failed) + + - name: Verify NGINX is up and running + uri: + url: http://localhost + status_code: 200 diff --git a/ansible/roles/nginxinc.nginx/molecule/common/playbooks/module_converge.yml b/ansible/roles/nginxinc.nginx/molecule/common/playbooks/module_converge.yml new file mode 100644 index 0000000..9c68740 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/common/playbooks/module_converge.yml @@ -0,0 +1,26 @@ +--- +- name: Converge + hosts: all + tasks: + - name: Install NGINX modules + include_role: + name: ansible-role-nginx + vars: + nginx_debug_output: true + + nginx_service_modify: true + nginx_service_timeout: 95 + nginx_selinux: true + nginx_selinux_tcp_ports: + - 80 + - 443 + + nginx_modules: + - brotli + - geoip + - image-filter + - name: njs + # version: =1.19.4+0.4.4-1~bionic + state: present + - perl + - xslt diff --git a/ansible/roles/nginxinc.nginx/molecule/common/playbooks/module_verify.yml b/ansible/roles/nginxinc.nginx/molecule/common/playbooks/module_verify.yml new file mode 100644 index 0000000..8e590fb --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/common/playbooks/module_verify.yml @@ -0,0 +1,24 @@ +--- +- name: Verify + hosts: all + tasks: + - name: Check if NGINX is installed + package: + name: nginx + check_mode: yes + register: install + failed_when: (install is changed) or (install is failed) + + - name: Check if NGINX service is running + service: + name: nginx + state: started + enabled: yes + check_mode: yes + register: service + failed_when: (service is changed) or (service is failed) + + - name: Verify NGINX is up and running + uri: + url: http://localhost + status_code: 200 diff --git a/ansible/roles/nginxinc.nginx/molecule/common/playbooks/plus_converge.yml b/ansible/roles/nginxinc.nginx/molecule/common/playbooks/plus_converge.yml new file mode 100644 index 0000000..696ffd8 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/common/playbooks/plus_converge.yml @@ -0,0 +1,32 @@ +--- +- name: Converge + hosts: all + tasks: + - name: Install NGINX + include_role: + name: ansible-role-nginx + vars: + nginx_type: plus + nginx_license: + certificate: license/nginx-repo.crt + key: license/nginx-repo.key + nginx_remove_license: false + nginx_modules: + - auth-spnego + - brotli + - cookie-flag + - encrypted-session + - geoip + - geoip2 + - headers-more + - image-filter + - lua + - modsecurity + - njs + - opentracing + - passenger + - perl + - prometheus + - rtmp + - subs-filter + - xslt diff --git a/ansible/roles/nginxinc.nginx/molecule/common/playbooks/plus_prepare.yml b/ansible/roles/nginxinc.nginx/molecule/common/playbooks/plus_prepare.yml new file mode 100644 index 0000000..594d5ee --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/common/playbooks/plus_prepare.yml @@ -0,0 +1,18 @@ +--- +- name: Prepare + hosts: localhost + gather_facts: false + tasks: + - name: Create ephemeral license certificate file from b64 decoded env var + copy: + content: "{{ lookup('env','NGINX_CRT') | b64decode }}" + dest: ../../../files/license/nginx-repo.crt + force: no + mode: 0444 + + - name: Create ephemeral license key file from b64 decoded env var + copy: + content: "{{ lookup('env','NGINX_KEY') | b64decode }}" + dest: ../../../files/license/nginx-repo.key + force: no + mode: 0444 diff --git a/ansible/roles/nginxinc.nginx/molecule/common/playbooks/plus_verify.yml b/ansible/roles/nginxinc.nginx/molecule/common/playbooks/plus_verify.yml new file mode 100644 index 0000000..2c1c78f --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/common/playbooks/plus_verify.yml @@ -0,0 +1,24 @@ +--- +- name: Verify + hosts: all + tasks: + - name: Check if NGINX is installed + package: + name: nginx-plus + check_mode: yes + register: install + failed_when: (install is changed) or (install is failed) + + - name: Check if NGINX service is running + service: + name: nginx + state: started + enabled: yes + check_mode: yes + register: service + failed_when: (service is changed) or (service is failed) + + - name: Verify NGINX is up and running + uri: + url: http://localhost + status_code: 200 diff --git a/ansible/roles/nginxinc.nginx/molecule/common/playbooks/source_converge.yml b/ansible/roles/nginxinc.nginx/molecule/common/playbooks/source_converge.yml new file mode 100644 index 0000000..534fc85 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/common/playbooks/source_converge.yml @@ -0,0 +1,16 @@ +--- +- name: Converge + hosts: all + tasks: + - name: Install NGINX from source + include_role: + name: ansible-role-nginx + vars: + nginx_debug_output: true + + nginx_install_from: source + nginx_branch: stable + nginx_install_source_build_tools: true + nginx_install_source_pcre: true + nginx_install_source_openssl: true + nginx_install_source_zlib: true diff --git a/ansible/roles/nginxinc.nginx/molecule/common/playbooks/source_verify.yml b/ansible/roles/nginxinc.nginx/molecule/common/playbooks/source_verify.yml new file mode 100644 index 0000000..d69320c --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/common/playbooks/source_verify.yml @@ -0,0 +1,17 @@ +--- +- name: Verify + hosts: all + tasks: + - name: Check if NGINX service is running + service: + name: nginx + state: started + enabled: yes + check_mode: yes + register: service + failed_when: (service is changed) or (service is failed) + + - name: Verify NGINX is up and running + uri: + url: http://localhost + status_code: 200 diff --git a/ansible/roles/nginxinc.nginx/molecule/common/test_default/test_default.py b/ansible/roles/nginxinc.nginx/molecule/common/test_default/test_default.py deleted file mode 100644 index 8d12025..0000000 --- a/ansible/roles/nginxinc.nginx/molecule/common/test_default/test_default.py +++ /dev/null @@ -1,30 +0,0 @@ -import os - -import testinfra.utils.ansible_runner - -testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner( - os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all') - - -def test_nginx_is_installed(host): - ngx = host.package("nginx") - assert ngx.is_installed - - -def test_nginx_running_and_enabled(host): - ngx = host.service("nginx") - assert ngx.is_running - assert ngx.is_enabled - - -def test_hosts_file(host): - ngx = host.file('/etc/hosts') - assert ngx.exists - assert ngx.user == 'root' - assert ngx.group == 'root' - - -def test_endpoint(host): - command = """curl -I http://localhost/""" - cmd = host.run(command) - assert '200 OK' in cmd.stdout diff --git a/ansible/roles/nginxinc.nginx/molecule/common/test_module/test_default.py b/ansible/roles/nginxinc.nginx/molecule/common/test_module/test_default.py deleted file mode 100644 index 8d12025..0000000 --- a/ansible/roles/nginxinc.nginx/molecule/common/test_module/test_default.py +++ /dev/null @@ -1,30 +0,0 @@ -import os - -import testinfra.utils.ansible_runner - -testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner( - os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all') - - -def test_nginx_is_installed(host): - ngx = host.package("nginx") - assert ngx.is_installed - - -def test_nginx_running_and_enabled(host): - ngx = host.service("nginx") - assert ngx.is_running - assert ngx.is_enabled - - -def test_hosts_file(host): - ngx = host.file('/etc/hosts') - assert ngx.exists - assert ngx.user == 'root' - assert ngx.group == 'root' - - -def test_endpoint(host): - command = """curl -I http://localhost/""" - cmd = host.run(command) - assert '200 OK' in cmd.stdout diff --git a/ansible/roles/nginxinc.nginx/molecule/common/test_source/test_default.py b/ansible/roles/nginxinc.nginx/molecule/common/test_source/test_default.py deleted file mode 100644 index 24fcbab..0000000 --- a/ansible/roles/nginxinc.nginx/molecule/common/test_source/test_default.py +++ /dev/null @@ -1,25 +0,0 @@ -import os - -import testinfra.utils.ansible_runner - -testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner( - os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all') - - -def test_nginx_running_and_enabled(host): - ngx = host.service("nginx") - assert ngx.is_running - assert ngx.is_enabled - - -def test_hosts_file(host): - ngx = host.file('/etc/hosts') - assert ngx.exists - assert ngx.user == 'root' - assert ngx.group == 'root' - - -def test_endpoint(host): - command = """curl -I http://localhost/""" - cmd = host.run(command) - assert '200 OK' in cmd.stdout diff --git a/ansible/roles/nginxinc.nginx/molecule/common/test_stable_push/test_default.py b/ansible/roles/nginxinc.nginx/molecule/common/test_stable_push/test_default.py deleted file mode 100644 index c695962..0000000 --- a/ansible/roles/nginxinc.nginx/molecule/common/test_stable_push/test_default.py +++ /dev/null @@ -1,42 +0,0 @@ -import nginx -import os - -import testinfra.utils.ansible_runner - -testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner( - os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all') - - -def test_nginx_is_installed(host): - ngx = host.package("nginx") - assert ngx.is_installed - - -def test_nginx_running_and_enabled(host): - ngx = host.service("nginx") - assert ngx.is_running - assert ngx.is_enabled - - -def test_hosts_file(host): - ngx = host.file('/etc/hosts') - assert ngx.exists - assert ngx.user == 'root' - assert ngx.group == 'root' - - -def test_endpoint(host): - command = """curl -I http://localhost/""" - cmd = host.run(command) - assert '200 OK' in cmd.stdout - - -def test_generated_files(host): - assert host.file('/etc/nginx/conf.d/default.conf').exists - - -def test_default_server(host): - f = host.file('/etc/nginx/conf.d/default.conf') - c = nginx.loads(f.content_string) - lf = c.server.filter('Location', '/') - assert len(lf) == 1 diff --git a/ansible/roles/nginxinc.nginx/molecule/common/test_template/test_default.py b/ansible/roles/nginxinc.nginx/molecule/common/test_template/test_default.py deleted file mode 100644 index 0b79c97..0000000 --- a/ansible/roles/nginxinc.nginx/molecule/common/test_template/test_default.py +++ /dev/null @@ -1,58 +0,0 @@ -import nginx -import os - -import testinfra.utils.ansible_runner - -testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner( - os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all') - - -def test_nginx_is_installed(host): - ngx = host.package("nginx") - assert ngx.is_installed - - -def test_nginx_running_and_enabled(host): - ngx = host.service("nginx") - assert ngx.is_running - assert ngx.is_enabled - - -def test_hosts_file(host): - ngx = host.file('/etc/hosts') - assert ngx.exists - assert ngx.user == 'root' - assert ngx.group == 'root' - - -def test_endpoint(host): - command = """curl -I http://localhost/""" - cmd = host.run(command) - assert '200 OK' in cmd.stdout - - -def test_generated_files(host): - assert host.file('/etc/nginx/conf.d/default.conf').exists - assert host.file('/etc/nginx/conf.d/frontend_default.conf').exists - assert host.file('/etc/nginx/conf.d/backend_default.conf').exists - - -def test_default_server(host): - f = host.file('/etc/nginx/conf.d/default.conf') - c = nginx.loads(f.content_string) - lf = c.server.filter('Location', '/') - assert len(lf) == 1 - lb = c.server.filter('Location', '/backend') - assert len(lb) == 1 - - -def test_client_max_body_size(host): - f = host.file('/etc/nginx/conf.d/default.conf') - c = nginx.loads(f.content_string) - vs = c.server.filter('Key', 'client_max_body_size') - assert len(vs) == 1 - assert vs[0].value == '512k' - lc = c.server.filter('Location', '/') - vl = lc[0].filter('Key', 'client_max_body_size') - assert len(vl) == 1 - assert vl[0].value == '5m' diff --git a/ansible/roles/nginxinc.nginx/molecule/default/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/default/molecule.yml index 9a5c3a6..ad780a3 100644 --- a/ansible/roles/nginxinc.nginx/molecule/default/molecule.yml +++ b/ansible/roles/nginxinc.nginx/molecule/default/molecule.yml @@ -4,8 +4,7 @@ driver: lint: | set -e yamllint . - ansible-lint - flake8 + ansible-lint --force-color platforms: - name: debian-stretch image: debian:stretch-slim @@ -35,10 +34,15 @@ platforms: volumes: - "/sys/fs/cgroup:/sys/fs/cgroup:rw" command: "/sbin/init" + - name: ubuntu-focal + image: ubuntu:focal + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" provisioner: name: ansible playbooks: - converge: ../common/playbook_default.yml -verifier: - name: testinfra - directory: ../common/test_default + converge: ../common/playbooks/default_converge.yml + verify: ../common/playbooks/default_verify.yml diff --git a/ansible/roles/nginxinc.nginx/molecule/default_alpine/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/default_alpine/molecule.yml index 8fea6a0..84342fb 100644 --- a/ansible/roles/nginxinc.nginx/molecule/default_alpine/molecule.yml +++ b/ansible/roles/nginxinc.nginx/molecule/default_alpine/molecule.yml @@ -4,23 +4,8 @@ driver: lint: | set -e yamllint . - ansible-lint - flake8 + ansible-lint --force-color platforms: - - name: alpine-3.8 - image: alpine:3.8 - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/sbin/init" - - name: alpine-3.9 - image: alpine:3.9 - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/sbin/init" - name: alpine-3.10 image: alpine:3.10 dockerfile: ../common/Dockerfile.j2 @@ -35,10 +20,15 @@ platforms: volumes: - "/sys/fs/cgroup:/sys/fs/cgroup:rw" command: "/sbin/init" + - name: alpine-3.12 + image: alpine:3.12 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" provisioner: name: ansible playbooks: - converge: ../common/playbook_default.yml -verifier: - name: testinfra - directory: ../common/test_default + converge: ../common/playbooks/default_converge.yml + verify: ../common/playbooks/default_verify.yml diff --git a/ansible/roles/nginxinc.nginx/molecule/default_centos/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/default_centos/molecule.yml index 11b030f..7ae1cde 100644 --- a/ansible/roles/nginxinc.nginx/molecule/default_centos/molecule.yml +++ b/ansible/roles/nginxinc.nginx/molecule/default_centos/molecule.yml @@ -4,12 +4,8 @@ driver: lint: | set -e yamllint . - ansible-lint - flake8 + ansible-lint --force-color platforms: - - name: centos-6 - image: centos:6 - dockerfile: ../common/Dockerfile.j2 - name: centos-7 image: centos:7 dockerfile: ../common/Dockerfile.j2 @@ -27,7 +23,5 @@ platforms: provisioner: name: ansible playbooks: - converge: ../common/playbook_default.yml -verifier: - name: testinfra - directory: ../common/test_default + converge: ../common/playbooks/default_converge.yml + verify: ../common/playbooks/default_verify.yml diff --git a/ansible/roles/nginxinc.nginx/molecule/module/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/module/molecule.yml index 2e12f7e..d1f3cba 100644 --- a/ansible/roles/nginxinc.nginx/molecule/module/molecule.yml +++ b/ansible/roles/nginxinc.nginx/molecule/module/molecule.yml @@ -4,8 +4,7 @@ driver: lint: | set -e yamllint . - ansible-lint - flake8 + ansible-lint --force-color platforms: - name: debian-stretch image: debian:stretch-slim @@ -35,10 +34,15 @@ platforms: volumes: - "/sys/fs/cgroup:/sys/fs/cgroup:rw" command: "/sbin/init" + - name: ubuntu-focal + image: ubuntu:focal + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" provisioner: name: ansible playbooks: - converge: ../common/playbook_module.yml -verifier: - name: testinfra - directory: ../common/test_module + converge: ../common/playbooks/module_converge.yml + verify: ../common/playbooks/module_verify.yml diff --git a/ansible/roles/nginxinc.nginx/molecule/module_alpine/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/module_alpine/molecule.yml index 8de545e..06140c8 100644 --- a/ansible/roles/nginxinc.nginx/molecule/module_alpine/molecule.yml +++ b/ansible/roles/nginxinc.nginx/molecule/module_alpine/molecule.yml @@ -4,23 +4,8 @@ driver: lint: | set -e yamllint . - ansible-lint - flake8 + ansible-lint --force-color platforms: - - name: alpine-3.8 - image: alpine:3.8 - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/sbin/init" - - name: alpine-3.9 - image: alpine:3.9 - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/sbin/init" - name: alpine-3.10 image: alpine:3.10 dockerfile: ../common/Dockerfile.j2 @@ -35,10 +20,15 @@ platforms: volumes: - "/sys/fs/cgroup:/sys/fs/cgroup:rw" command: "/sbin/init" + - name: alpine-3.12 + image: alpine:3.12 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" provisioner: name: ansible playbooks: - converge: ../common/playbook_module.yml -verifier: - name: testinfra - directory: ../common/test_module + converge: ../common/playbooks/module_converge.yml + verify: ../common/playbooks/module_verify.yml diff --git a/ansible/roles/nginxinc.nginx/molecule/module_centos/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/module_centos/molecule.yml index 0b09e78..aaac71a 100644 --- a/ansible/roles/nginxinc.nginx/molecule/module_centos/molecule.yml +++ b/ansible/roles/nginxinc.nginx/molecule/module_centos/molecule.yml @@ -4,12 +4,8 @@ driver: lint: | set -e yamllint . - ansible-lint - flake8 + ansible-lint --force-color platforms: - - name: centos-6 - image: centos:6 - dockerfile: ../common/Dockerfile.j2 - name: centos-7 image: centos:7 dockerfile: ../common/Dockerfile.j2 @@ -27,7 +23,5 @@ platforms: provisioner: name: ansible playbooks: - converge: ../common/playbook_module.yml -verifier: - name: testinfra - directory: ../common/test_module + converge: ../common/playbooks/module_converge.yml + verify: ../common/playbooks/module_verify.yml diff --git a/ansible/roles/nginxinc.nginx/molecule/unit/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/plus/molecule.yml similarity index 70% rename from ansible/roles/nginxinc.nginx/molecule/unit/molecule.yml rename to ansible/roles/nginxinc.nginx/molecule/plus/molecule.yml index 71585a8..6f3dbd5 100644 --- a/ansible/roles/nginxinc.nginx/molecule/unit/molecule.yml +++ b/ansible/roles/nginxinc.nginx/molecule/plus/molecule.yml @@ -4,8 +4,7 @@ driver: lint: | set -e yamllint . - ansible-lint - flake8 + ansible-lint --force-color platforms: - name: debian-stretch image: debian:stretch-slim @@ -35,7 +34,16 @@ platforms: volumes: - "/sys/fs/cgroup:/sys/fs/cgroup:rw" command: "/sbin/init" + - name: ubuntu-focal + image: ubuntu:focal + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" provisioner: name: ansible playbooks: - converge: ../common/playbook_unit.yml + prepare: ../common/playbooks/plus_prepare.yml + converge: ../common/playbooks/plus_converge.yml + verify: ../common/playbooks/plus_verify.yml diff --git a/ansible/roles/nginxinc.nginx/molecule/unit_alpine/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/plus_alpine/molecule.yml similarity index 63% rename from ansible/roles/nginxinc.nginx/molecule/unit_alpine/molecule.yml rename to ansible/roles/nginxinc.nginx/molecule/plus_alpine/molecule.yml index cd02977..92956e1 100644 --- a/ansible/roles/nginxinc.nginx/molecule/unit_alpine/molecule.yml +++ b/ansible/roles/nginxinc.nginx/molecule/plus_alpine/molecule.yml @@ -4,32 +4,24 @@ driver: lint: | set -e yamllint . - ansible-lint - flake8 + ansible-lint --force-color platforms: - - name: alpine-3.8 - image: alpine:3.8 - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/sbin/init" - - name: alpine-3.9 - image: alpine:3.9 - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/sbin/init" - name: alpine-3.10 - image: alpine:3.10 + image: python:alpine3.10 dockerfile: ../common/Dockerfile.j2 privileged: true volumes: - "/sys/fs/cgroup:/sys/fs/cgroup:rw" command: "/sbin/init" - name: alpine-3.11 - image: alpine:3.11 + image: python:alpine3.11 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: alpine-3.12 + image: alpine:3.12 dockerfile: ../common/Dockerfile.j2 privileged: true volumes: @@ -38,4 +30,6 @@ platforms: provisioner: name: ansible playbooks: - converge: ../common/playbook_unit.yml + prepare: ../common/playbooks/plus_prepare.yml + converge: ../common/playbooks/plus_converge.yml + verify: ../common/playbooks/plus_verify.yml diff --git a/ansible/roles/nginxinc.nginx/molecule/unit_centos/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/plus_centos/molecule.yml similarity index 72% rename from ansible/roles/nginxinc.nginx/molecule/unit_centos/molecule.yml rename to ansible/roles/nginxinc.nginx/molecule/plus_centos/molecule.yml index bd73ca0..40f02db 100644 --- a/ansible/roles/nginxinc.nginx/molecule/unit_centos/molecule.yml +++ b/ansible/roles/nginxinc.nginx/molecule/plus_centos/molecule.yml @@ -4,12 +4,8 @@ driver: lint: | set -e yamllint . - ansible-lint - flake8 + ansible-lint --force-color platforms: - - name: centos-6 - image: centos:6 - dockerfile: ../common/Dockerfile.j2 - name: centos-7 image: centos:7 dockerfile: ../common/Dockerfile.j2 @@ -27,4 +23,6 @@ platforms: provisioner: name: ansible playbooks: - converge: ../common/playbook_unit.yml + prepare: ../common/playbooks/plus_prepare.yml + converge: ../common/playbooks/plus_converge.yml + verify: ../common/playbooks/plus_verify.yml diff --git a/ansible/roles/nginxinc.nginx/molecule/source/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/source/molecule.yml index a2028ed..75efa0f 100644 --- a/ansible/roles/nginxinc.nginx/molecule/source/molecule.yml +++ b/ansible/roles/nginxinc.nginx/molecule/source/molecule.yml @@ -4,8 +4,7 @@ driver: lint: | set -e yamllint . - ansible-lint - flake8 + ansible-lint --force-color platforms: - name: debian-stretch image: debian:stretch-slim @@ -35,10 +34,15 @@ platforms: volumes: - "/sys/fs/cgroup:/sys/fs/cgroup:rw" command: "/sbin/init" + - name: ubuntu-focal + image: ubuntu:focal + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" provisioner: name: ansible playbooks: - converge: ../common/playbook_source.yml -verifier: - name: testinfra - directory: ../common/test_source + converge: ../common/playbooks/source_converge.yml + verify: ../common/playbooks/source_verify.yml diff --git a/ansible/roles/nginxinc.nginx/molecule/source_alpine/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/source_alpine/molecule.yml index a5b2919..a23bdaa 100644 --- a/ansible/roles/nginxinc.nginx/molecule/source_alpine/molecule.yml +++ b/ansible/roles/nginxinc.nginx/molecule/source_alpine/molecule.yml @@ -4,32 +4,24 @@ driver: lint: | set -e yamllint . - ansible-lint - flake8 + ansible-lint --force-color platforms: - - name: alpine-3.8 - image: alpine:3.8 - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/sbin/init" - - name: alpine-3.9 - image: alpine:3.9 - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/sbin/init" - name: alpine-3.10 - image: python:alpine3.10 + image: alpine:3.10 dockerfile: ../common/Dockerfile.j2 privileged: true volumes: - "/sys/fs/cgroup:/sys/fs/cgroup:rw" command: "/sbin/init" - name: alpine-3.11 - image: python:alpine3.11 + image: alpine:3.11 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: alpine-3.12 + image: alpine:3.12 dockerfile: ../common/Dockerfile.j2 privileged: true volumes: @@ -38,7 +30,5 @@ platforms: provisioner: name: ansible playbooks: - converge: ../common/playbook_source.yml -verifier: - name: testinfra - directory: ../common/test_source + converge: ../common/playbooks/source_converge.yml + verify: ../common/playbooks/source_verify.yml diff --git a/ansible/roles/nginxinc.nginx/molecule/source_centos/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/source_centos/molecule.yml index 1fff5be..1e29674 100644 --- a/ansible/roles/nginxinc.nginx/molecule/source_centos/molecule.yml +++ b/ansible/roles/nginxinc.nginx/molecule/source_centos/molecule.yml @@ -4,8 +4,7 @@ driver: lint: | set -e yamllint . - ansible-lint - flake8 + ansible-lint --force-color platforms: - name: centos-7 image: centos:7 @@ -24,7 +23,5 @@ platforms: provisioner: name: ansible playbooks: - converge: ../common/playbook_source.yml -verifier: - name: testinfra - directory: ../common/test_source + converge: ../common/playbooks/source_converge.yml + verify: ../common/playbooks/source_verify.yml diff --git a/ansible/roles/nginxinc.nginx/molecule/stable_push/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/stable_push/molecule.yml deleted file mode 100644 index 40c6990..0000000 --- a/ansible/roles/nginxinc.nginx/molecule/stable_push/molecule.yml +++ /dev/null @@ -1,47 +0,0 @@ ---- -dependency: - name: shell - command: pip install python-nginx -driver: - name: docker -lint: | - set -e - yamllint . - ansible-lint - flake8 -platforms: - - name: debian-stretch - image: debian:stretch-slim - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/sbin/init" - - name: debian-buster - image: debian:buster-slim - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/sbin/init" - - name: ubuntu-xenial - image: ubuntu:xenial - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/sbin/init" - - name: ubuntu-bionic - image: ubuntu:bionic - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/sbin/init" -provisioner: - name: ansible - playbooks: - converge: ../common/playbook_stable_push.yml -verifier: - name: testinfra - directory: ../common/test_stable_push diff --git a/ansible/roles/nginxinc.nginx/molecule/stable_push_alpine/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/stable_push_alpine/molecule.yml deleted file mode 100644 index c2753f3..0000000 --- a/ansible/roles/nginxinc.nginx/molecule/stable_push_alpine/molecule.yml +++ /dev/null @@ -1,47 +0,0 @@ ---- -dependency: - name: shell - command: pip install python-nginx -driver: - name: docker -lint: | - set -e - yamllint . - ansible-lint - flake8 -platforms: - - name: alpine-3.8 - image: alpine:3.8 - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/sbin/init" - - name: alpine-3.9 - image: alpine:3.9 - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/sbin/init" - - name: alpine-3.10 - image: alpine:3.10 - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/sbin/init" - - name: alpine-3.11 - image: alpine:3.11 - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/sbin/init" -provisioner: - name: ansible - playbooks: - converge: ../common/playbook_stable_push.yml -verifier: - name: testinfra - directory: ../common/test_stable_push diff --git a/ansible/roles/nginxinc.nginx/molecule/stable_push_centos/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/stable_push_centos/molecule.yml deleted file mode 100644 index c5f1884..0000000 --- a/ansible/roles/nginxinc.nginx/molecule/stable_push_centos/molecule.yml +++ /dev/null @@ -1,36 +0,0 @@ ---- -dependency: - name: shell - command: pip install python-nginx -driver: - name: docker -lint: | - set -e - yamllint . - ansible-lint - flake8 -platforms: - - name: centos-6 - image: centos:6 - dockerfile: ../common/Dockerfile.j2 - - name: centos-7 - image: centos:7 - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/usr/sbin/init" - - name: centos-8 - image: centos:8 - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/usr/sbin/init" -provisioner: - name: ansible - playbooks: - converge: ../common/playbook_stable_push.yml -verifier: - name: testinfra - directory: ../common/test_stable_push diff --git a/ansible/roles/nginxinc.nginx/molecule/template/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/template/molecule.yml deleted file mode 100644 index 541fee0..0000000 --- a/ansible/roles/nginxinc.nginx/molecule/template/molecule.yml +++ /dev/null @@ -1,47 +0,0 @@ ---- -dependency: - name: shell - command: pip install python-nginx -driver: - name: docker -lint: | - set -e - yamllint . - ansible-lint - flake8 -platforms: - - name: debian-stretch - image: debian:stretch-slim - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/sbin/init" - - name: debian-buster - image: debian:buster-slim - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/sbin/init" - - name: ubuntu-xenial - image: ubuntu:xenial - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/sbin/init" - - name: ubuntu-bionic - image: ubuntu:bionic - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/sbin/init" -provisioner: - name: ansible - playbooks: - converge: ../common/playbook_template.yml -verifier: - name: testinfra - directory: ../common/test_template diff --git a/ansible/roles/nginxinc.nginx/molecule/template_alpine/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/template_alpine/molecule.yml deleted file mode 100644 index a646a5b..0000000 --- a/ansible/roles/nginxinc.nginx/molecule/template_alpine/molecule.yml +++ /dev/null @@ -1,47 +0,0 @@ ---- -dependency: - name: shell - command: pip install python-nginx -driver: - name: docker -lint: | - set -e - yamllint . - ansible-lint - flake8 -platforms: - - name: alpine-3.8 - image: alpine:3.8 - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/sbin/init" - - name: alpine-3.9 - image: alpine:3.9 - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/sbin/init" - - name: alpine-3.10 - image: alpine:3.10 - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/sbin/init" - - name: alpine-3.11 - image: alpine:3.11 - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/sbin/init" -provisioner: - name: ansible - playbooks: - converge: ../common/playbook_template.yml -verifier: - name: testinfra - directory: ../common/test_template diff --git a/ansible/roles/nginxinc.nginx/molecule/template_centos/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/template_centos/molecule.yml deleted file mode 100644 index 3b0f745..0000000 --- a/ansible/roles/nginxinc.nginx/molecule/template_centos/molecule.yml +++ /dev/null @@ -1,36 +0,0 @@ ---- -dependency: - name: shell - command: pip install python-nginx -driver: - name: docker -lint: | - set -e - yamllint . - ansible-lint - flake8 -platforms: - - name: centos-6 - image: centos:6 - dockerfile: ../common/Dockerfile.j2 - - name: centos-7 - image: centos:7 - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/usr/sbin/init" - - name: centos-8 - image: centos:8 - dockerfile: ../common/Dockerfile.j2 - privileged: true - volumes: - - "/sys/fs/cgroup:/sys/fs/cgroup:rw" - command: "/usr/sbin/init" -provisioner: - name: ansible - playbooks: - converge: ../common/playbook_template.yml -verifier: - name: testinfra - directory: ../common/test_template diff --git a/ansible/roles/nginxinc.nginx/tasks/amplify/install-amplify.yml b/ansible/roles/nginxinc.nginx/tasks/amplify/install-amplify.yml index 9204abf..2a06fed 100644 --- a/ansible/roles/nginxinc.nginx/tasks/amplify/install-amplify.yml +++ b/ansible/roles/nginxinc.nginx/tasks/amplify/install-amplify.yml @@ -1,24 +1,23 @@ --- -- import_tasks: setup-debian.yml - when: ansible_os_family == "Debian" +- name: Configure NGINX Amplify agent repository + include_tasks: "{{ role_path }}/tasks/amplify/setup-{{ ansible_facts['os_family'] | lower }}.yml" + when: ansible_facts['os_family'] in ['Debian', 'RedHat'] -- import_tasks: setup-redhat.yml - when: ansible_os_family == "RedHat" - -- name: "(Install: All OSs) Install NGINX Amplify Agent" +- name: Install NGINX Amplify agent package: name: nginx-amplify-agent state: present -- name: "(Setup: All OSs) Copy NGINX Configurator Agent Configuration Template" +- name: Copy NGINX configurator agent configuration template copy: remote_src: yes src: /etc/amplify-agent/agent.conf.default dest: /etc/amplify-agent/agent.conf + mode: 0644 -- name: "(Setup: All OSs) Configure NGINX Amplify Agent API Key" +- name: Configure NGINX Amplify agent API key lineinfile: dest: /etc/amplify-agent/agent.conf regexp: api_key =.* line: "api_key = {{ nginx_amplify_api_key }}" - notify: "(Handler: All OSs) Start NGINX Amplify Agent" + notify: (Handler) Start NGINX Amplify agent diff --git a/ansible/roles/nginxinc.nginx/tasks/amplify/setup-debian.yml b/ansible/roles/nginxinc.nginx/tasks/amplify/setup-debian.yml index 224a076..c8e5d15 100644 --- a/ansible/roles/nginxinc.nginx/tasks/amplify/setup-debian.yml +++ b/ansible/roles/nginxinc.nginx/tasks/amplify/setup-debian.yml @@ -1,5 +1,17 @@ --- -- name: "(Install: Debian/Ubuntu) Add NGINX Amplify Agent Repository" +- name: (Debian/Ubuntu) Add NGINX Amplify agent repository apt_repository: filename: nginx-amplify - repo: deb [arch=amd64] http://packages.amplify.nginx.com/{{ ansible_distribution|lower }}/ {{ ansible_distribution_release|lower }} amplify-agent + repo: "deb [arch=amd64] https://packages.amplify.nginx.com/{{ ansible_facts['distribution'] | lower }}/ + {{ ansible_facts['distribution_release'] | lower }} amplify-agent" + update_cache: yes + mode: 0644 + when: ansible_facts['distribution_release'] != "focal" + +- name: (Ubuntu 20.04) Add NGINX Amplify agent repository + apt_repository: + filename: nginx-amplify + repo: deb [arch=amd64] https://packages.amplify.nginx.com/py3/ubuntu focal amplify-agent + update_cache: yes + mode: 0644 + when: ansible_facts['distribution_release'] == "focal" diff --git a/ansible/roles/nginxinc.nginx/tasks/amplify/setup-redhat.yml b/ansible/roles/nginxinc.nginx/tasks/amplify/setup-redhat.yml index 154da5e..ba332d8 100644 --- a/ansible/roles/nginxinc.nginx/tasks/amplify/setup-redhat.yml +++ b/ansible/roles/nginxinc.nginx/tasks/amplify/setup-redhat.yml @@ -1,8 +1,9 @@ --- -- name: "(Install: CentOS/RedHat/Amazon Linux) Add NGINX Amplify Agent Repository" +- name: (Amazon Linux/CentOS/RHEL) Add NGINX Amplify agent repository yum_repository: name: nginx-amplify - baseurl: http://packages.amplify.nginx.com/{{ (ansible_distribution == "Amazon") | ternary('amzn/', 'centos/') }}/$releasever/$basearch/ + baseurl: http://packages.amplify.nginx.com/{{ (ansible_facts['distribution'] == "Amazon") | ternary('amzn/', 'centos/') }}/$releasever/$basearch/ description: NGINX Amplify Agent enabled: yes gpgcheck: yes + mode: 0644 diff --git a/ansible/roles/nginxinc.nginx/tasks/conf/cleanup-config.yml b/ansible/roles/nginxinc.nginx/tasks/conf/cleanup-config.yml deleted file mode 100644 index 9eb405c..0000000 --- a/ansible/roles/nginxinc.nginx/tasks/conf/cleanup-config.yml +++ /dev/null @@ -1,8 +0,0 @@ ---- -- name: "(Setup: All OSs) Remove NGINX configuration files" - file: - path: "{{ item }}" - state: absent - with_items: - - "{{ nginx_cleanup_config_path }}" - notify: "(Handler: All OSs) Reload NGINX" diff --git a/ansible/roles/nginxinc.nginx/tasks/conf/debug-output.yml b/ansible/roles/nginxinc.nginx/tasks/conf/debug-output.yml deleted file mode 100644 index 6ad7ba1..0000000 --- a/ansible/roles/nginxinc.nginx/tasks/conf/debug-output.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -- name: "(Setup: All OSs) Register NGINX configuration" - command: nginx -T - changed_when: false - register: nginx_configuration - -- name: "(Setup: All OSs) Print NGINX configuration" - debug: - var: nginx_configuration.stdout_lines diff --git a/ansible/roles/nginxinc.nginx/tasks/conf/setup-status.yml b/ansible/roles/nginxinc.nginx/tasks/conf/setup-status.yml deleted file mode 100644 index a69c43e..0000000 --- a/ansible/roles/nginxinc.nginx/tasks/conf/setup-status.yml +++ /dev/null @@ -1,32 +0,0 @@ ---- -- name: "(Setup: NGINX Open Source) Enable NGINX Open Source Status" - blockinfile: - path: "{{ nginx_status_location }}" - create: yes - block: | - server { - listen 127.0.0.1:{{ nginx_status_port | default('80') }}; - location /nginx_status { - stub_status on; - allow 127.0.0.1; - deny all; - } - } - when: nginx_type == "opensource" - notify: "(Handler: All OSs) Reload NGINX" - -- name: "(Setup: NGINX Plus) Enable NGINX Plus Status" - blockinfile: - path: "{{ nginx_status_location }}" - create: yes - block: | - server { - listen 127.0.0.1:{{ nginx_status_port | default('80') }}; - location /status { - status; - allow 127.0.0.1; - deny all; - } - } - when: nginx_type == "plus" - notify: "(Handler: All OSs) Reload NGINX" diff --git a/ansible/roles/nginxinc.nginx/tasks/conf/template-config.yml b/ansible/roles/nginxinc.nginx/tasks/conf/template-config.yml deleted file mode 100644 index 21205f0..0000000 --- a/ansible/roles/nginxinc.nginx/tasks/conf/template-config.yml +++ /dev/null @@ -1,81 +0,0 @@ ---- -- name: "(Setup: All NGINX) Ensure HTML Directory Exists" - file: - path: "{{ item.value.html_file_location | default('/usr/share/nginx/html') }}" - state: directory - with_dict: "{{ nginx_html_demo_template }}" - when: nginx_html_demo_template_enable | bool - -- name: "(Setup: All NGINX) Dynamically Generate HTML Files" - template: - src: "{{ item.value.template_file | default('www/index.html.j2') }}" - dest: "{{ item.value.html_file_location | default('/usr/share/nginx/html') }}/{{ item.value.html_file_name | default('index.html') }}" - backup: yes - with_dict: "{{ nginx_html_demo_template }}" - when: nginx_html_demo_template_enable | bool - -- name: "(Setup: All NGINX) Ensure NGINX Main Directory Exists" - file: - path: "{{ nginx_main_template.conf_file_location | default('/etc/nginx') }}" - state: directory - when: nginx_main_template_enable | bool - -- name: "(Setup: All NGINX) Dynamically Generate NGINX Main Configuration File" - template: - src: "{{ nginx_main_template.template_file | default('nginx.conf.j2') }}" - dest: "{{ nginx_main_template.conf_file_location | default('/etc/nginx') }}/{{ nginx_main_template.conf_file_name | default('nginx.conf') }}" - backup: yes - when: nginx_main_template_enable | bool - notify: "(Handler: All OSs) Reload NGINX" - -- name: "(Setup: All NGINX) Ensure NGINX HTTP Directory Exists" - file: - path: "{{ item.value.conf_file_location | default('/etc/nginx/conf.d/') }}" - state: directory - with_dict: "{{ nginx_http_template }}" - when: nginx_http_template_enable | bool - -- name: "(Setup: All NGINX) Ensure NGINX Proxy Cache Directories Exist" - file: - path: "{{ item.1.path }}" - state: directory - owner: "{{ nginx_main_template.user | default('nginx') }}" - with_subelements: - - "{{ nginx_http_template }}" - - proxy_cache.proxy_cache_path - - skip_missing: true - when: nginx_http_template_enable | bool - -- name: "(Setup: All NGINX) Dynamically Generate NGINX HTTP Configuration Files" - template: - src: "{{ item.value.template_file | default('http/default.conf.j2') }}" - dest: "{{ item.value.conf_file_location | default('/etc/nginx/conf.d/') }}/{{ item.value.conf_file_name | default('default.conf') }}" - backup: yes - with_dict: "{{ nginx_http_template }}" - when: nginx_http_template_enable | bool - notify: "(Handler: All OSs) Reload NGINX" - - -- name: "(Setup: All NGINX) Dynamically Generate NGINX API Configuration File" - template: - src: "{{ nginx_rest_api_template_file | default('http/api.conf.j2') }}" - dest: "{{ nginx_rest_api_file_location | default('/etc/nginx/conf.d/api.conf') }}" - backup: yes - notify: "(Handler: All OSs) Reload NGINX" - when: nginx_rest_api_enable | bool - -- name: "(Setup: All NGINX) Ensure NGINX Stream Directory Exists" - file: - path: "{{ item.value.conf_file_location | default('/etc/nginx/conf.d/stream/') }}" - state: directory - with_dict: "{{ nginx_stream_template }}" - when: nginx_stream_template_enable | bool - -- name: "(Setup: All NGINX) Dynamically Generate NGINX Stream Configuration Files" - template: - src: "{{ item.value.template_file | default('stream/default.conf.j2') }}" - dest: "{{ item.value.conf_file_location | default('/etc/nginx/conf.d/stream/') }}/{{ item.value.conf_file_name | default('default.conf') }}" - backup: yes - with_dict: "{{ nginx_stream_template }}" - notify: "(Handler: All OSs) Reload NGINX" - when: nginx_stream_template_enable | bool diff --git a/ansible/roles/nginxinc.nginx/tasks/conf/upload-config.yml b/ansible/roles/nginxinc.nginx/tasks/conf/upload-config.yml deleted file mode 100644 index 66c68dd..0000000 --- a/ansible/roles/nginxinc.nginx/tasks/conf/upload-config.yml +++ /dev/null @@ -1,92 +0,0 @@ ---- -- name: "(Setup: All NGINX) Ensure NGINX Main Directory Exists" - file: - path: "{{ nginx_main_upload_dest | default('/etc/nginx/') }}" - state: directory - when: nginx_main_upload_enable | bool - -- name: "(Setup: All NGINX) Upload NGINX Main Configuration File" - copy: - src: "{{ nginx_main_upload_src | default('conf/nginx.conf') }}" - dest: "{{ nginx_main_upload_dest | default('/etc/nginx/') }}" - backup: yes - when: nginx_main_upload_enable | bool - notify: "(Handler: All OSs) Reload NGINX" - -- name: "(Setup: All NGINX) Ensure NGINX HTTP Directory Exists" - file: - path: "{{ nginx_http_upload_dest | default('/etc/nginx/conf.d/') }}" - state: directory - when: nginx_http_upload_enable | bool - -- name: "(Setup: All NGINX) Upload NGINX HTTP Configuration Files" - copy: - src: "{{ item }}" - dest: "{{ nginx_http_upload_dest | default('/etc/nginx/conf.d/') }}" - backup: yes - with_fileglob: "{{ nginx_http_upload_src }}" - when: nginx_http_upload_enable | bool - notify: "(Handler: All OSs) Reload NGINX" - -- name: "(Setup: All NGINX) Ensure NGINX Stream Directory Exists" - file: - path: "{{ nginx_stream_upload_dest | default('/etc/nginx/conf.d/') }}" - state: directory - when: nginx_stream_upload_enable | bool - -- name: "(Setup: All NGINX) Upload NGINX Stream Configuration Files" - copy: - src: "{{ item }}" - dest: "{{ nginx_stream_upload_dest | default('/etc/nginx/conf.d/') }}" - backup: yes - with_fileglob: "{{ nginx_stream_upload_src }}" - when: nginx_stream_upload_enable | bool - notify: "(Handler: All OSs) Reload NGINX" - -- name: "(Setup: All NGINX) Ensure NGINX HTML Directory Exists" - file: - path: "{{ nginx_html_upload_dest | default('/usr/share/nginx/html') }}" - state: directory - when: nginx_html_upload_enable | bool - -- name: "(Setup: All NGINX) Upload NGINX HTML Files" - copy: - src: "{{ item }}" - dest: "{{ nginx_html_upload_dest | default('/usr/share/nginx/html') }}" - backup: yes - with_fileglob: "{{ nginx_html_upload_src }}" - when: nginx_html_upload_enable | bool - notify: "(Handler: All OSs) Reload NGINX" - -- name: "(Setup: All NGINX) Ensure SSL Certificate Directory Exists" - file: - path: "{{ nginx_ssl_crt_upload_dest | default('/etc/ssl/certs/') }}" - state: directory - when: nginx_ssl_upload_enable | bool - -- name: "(Setup: All NGINX) Ensure SSL Key Directory Exists" - file: - path: "{{ nginx_ssl_key_upload_dest | default('/etc/ssl/private/') }}" - state: directory - when: nginx_ssl_upload_enable | bool - -- name: "(Setup: All NGINX) Upload NGINX SSL Certificates" - copy: - src: "{{ item }}" - dest: "{{ nginx_ssl_crt_upload_dest | default('/etc/ssl/certs/') }}" - mode: 0640 - decrypt: yes - backup: yes - with_fileglob: "{{ nginx_ssl_crt_upload_src }}" - when: nginx_ssl_upload_enable | bool - -- name: "(Setup: All NGINX) Upload NGINX SSL Keys" - copy: - src: "{{ item }}" - dest: "{{ nginx_ssl_key_upload_dest | default('/etc/ssl/private/') }}" - mode: 0640 - decrypt: yes - backup: yes - with_fileglob: "{{ nginx_ssl_key_upload_src }}" - no_log: yes - when: nginx_ssl_upload_enable | bool diff --git a/ansible/roles/nginxinc.nginx/tasks/config/debug-output.yml b/ansible/roles/nginxinc.nginx/tasks/config/debug-output.yml new file mode 100644 index 0000000..0ea0a41 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/config/debug-output.yml @@ -0,0 +1,12 @@ +--- +- name: Register NGINX config + command: nginx -T + ignore_errors: "{{ ansible_check_mode }}" + check_mode: no + changed_when: false + register: config_full + +- name: Print NGINX config + debug: + var: config_full.stdout_lines + when: config_full.stdout_lines is defined diff --git a/ansible/roles/nginxinc.nginx/tasks/config/modify-systemd.yml b/ansible/roles/nginxinc.nginx/tasks/config/modify-systemd.yml new file mode 100644 index 0000000..cad1b25 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/config/modify-systemd.yml @@ -0,0 +1,37 @@ +--- +- name: Create override directory for NGINX systemd service + file: + path: "{{ nginx_service_overridepath }}" + state: directory + mode: 0755 + +- name: Create override for NGINX systemd service + template: + src: "{{ role_path }}/templates/services/nginx.service.override.conf.j2" + dest: "{{ nginx_service_overridepath }}/{{ nginx_service_overridefilename }}" + owner: root + group: root + mode: 0644 + when: + - not nginx_service_custom | bool + - not nginx_service_clean | bool + notify: (Handler) Systemd daemon-reload + +- name: Customize override for NGINX systemd service + copy: + src: "{{ nginx_service_custom_file }}" + dest: "{{ nginx_service_overridepath }}/{{ nginx_service_overridefilename }}" + owner: root + group: root + mode: 0644 + when: + - nginx_service_custom | bool + - not nginx_service_clean | bool + notify: (Handler) Systemd daemon-reload + +- name: Remove override for NGINX systemd service + file: + path: "{{ nginx_service_overridepath }}" + state: absent + when: nginx_service_clean | bool + notify: (Handler) Systemd daemon-reload diff --git a/ansible/roles/nginxinc.nginx/tasks/config/setup-logrotate.yml b/ansible/roles/nginxinc.nginx/tasks/config/setup-logrotate.yml new file mode 100644 index 0000000..a01c629 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/config/setup-logrotate.yml @@ -0,0 +1,36 @@ +--- +- name: (Alpine Linux) Install logrotate + apk: + name: logrotate + when: ansible_facts['os_family'] == "Alpine" + +- name: (Debian/Ubuntu) Install logrotate + apt: + name: logrotate + state: present + when: ansible_facts['os_family'] == "Debian" + +- name: (Amazon Linux/CentOS/Oracle Linux/RHEL) Install logrotate + yum: + name: logrotate + state: present + when: ansible_facts['os_family'] == "RedHat" + +- name: (SLES) Set up logrotate + block: + - name: (SLES) Configure logrotate repository + zypper_repository: + repo: https://download.opensuse.org/repositories/openSUSE:Leap:42.1/standard/openSUSE:Leap:42.1.repo + + - name: (SLES) Install Logrotate + zypper: + name: logrotate + state: present + when: ansible_facts['os_family'] == "Suse" + +- name: Create logrotate config + template: + src: logrotate/nginx.j2 + dest: /etc/logrotate.d/nginx + mode: 0644 + notify: (Handler) Run logrotate diff --git a/ansible/roles/nginxinc.nginx/tasks/keys/apk-key.yml b/ansible/roles/nginxinc.nginx/tasks/keys/apk-key.yml deleted file mode 100644 index 131634d..0000000 --- a/ansible/roles/nginxinc.nginx/tasks/keys/apk-key.yml +++ /dev/null @@ -1,13 +0,0 @@ ---- -- name: "(Install: APK OSs) Set Default APK NGINX Signing Key URL" - set_fact: - default_keysite: https://nginx.org/keys/nginx_signing.rsa.pub - -- name: "(Install: APK OSs) Set APK NGINX Signing Key URL" - set_fact: - keysite: "{{ nginx_signing_key | default(default_keysite) }}" - -- name: "(Install: APK OSs) Download NGINX Signing Key" - get_url: - url: "{{ keysite }}" - dest: /etc/apk/keys/nginx_signing.rsa.pub diff --git a/ansible/roles/nginxinc.nginx/tasks/keys/apt-key.yml b/ansible/roles/nginxinc.nginx/tasks/keys/apt-key.yml deleted file mode 100644 index ef7f140..0000000 --- a/ansible/roles/nginxinc.nginx/tasks/keys/apt-key.yml +++ /dev/null @@ -1,12 +0,0 @@ ---- -- name: "(Install: APT OSs) Set Default APT NGINX Signing Key URL" - set_fact: - default_keysite: https://nginx.org/keys/nginx_signing.key - -- name: "(Install: APT OSs) Set APT NGINX Signing Key URL" - set_fact: - keysite: "{{ nginx_signing_key | default(default_keysite) }}" - -- name: "(Install: APT OSs) Add APT NGINX Signing Key" - apt_key: - url: "{{ keysite }}" diff --git a/ansible/roles/nginxinc.nginx/tasks/keys/rpm-key.yml b/ansible/roles/nginxinc.nginx/tasks/keys/rpm-key.yml deleted file mode 100644 index 0323d56..0000000 --- a/ansible/roles/nginxinc.nginx/tasks/keys/rpm-key.yml +++ /dev/null @@ -1,14 +0,0 @@ ---- -- name: "(Install: RPM OSs) Set Default RPM NGINX Signing Key" - set_fact: - default_keysite: >- - {{ (ansible_distribution_major_version|int == 6) - | ternary('http://nginx.org/keys/nginx_signing.key', 'https://nginx.org/keys/nginx_signing.key') }} - -- name: "(Install: RPM OSs) Set RPM NGINX Signing Key URL" - set_fact: - keysite: "{{ nginx_signing_key | default(default_keysite) }}" - -- name: "(Install: RPM OSs) Add RPM NGINX Signing Key" - rpm_key: - key: "{{ keysite }}" diff --git a/ansible/roles/nginxinc.nginx/tasks/keys/setup-keys.yml b/ansible/roles/nginxinc.nginx/tasks/keys/setup-keys.yml new file mode 100644 index 0000000..fb9dccc --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/keys/setup-keys.yml @@ -0,0 +1,31 @@ +--- +- name: (Alpine Linux) Set up signing key + block: + - name: (Alpine Linux) Set up NGINX signing key URL + set_fact: + keysite: "{{ nginx_signing_key | default(nginx_default_signing_key_rsa_pub) }}" + + - name: (Alpine Linux) Download NGINX signing key + get_url: + url: "{{ keysite }}" + dest: /etc/apk/keys/nginx_signing.rsa.pub + mode: 0400 + when: ansible_facts['os_family'] == "Alpine" + +- name: (Debian/Red Hat/SLES OSs) Set up NGINX signing key URL + set_fact: + keysite: "{{ nginx_signing_key | default(nginx_default_signing_key_pgp) }}" + when: ansible_facts['os_family'] != "Alpine" + +- name: (Debian/Ubuntu) Add NGINX signing key + apt_key: + id: 573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62 + url: "{{ keysite }}" + when: ansible_facts['os_family'] == "Debian" + +- name: (Amazon Linux/CentOS/Oracle Linux/RHEL/SLES) Add NGINX signing key + rpm_key: + fingerprint: 573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62 + key: "{{ keysite }}" + validate_certs: "{{ (ansible_facts['distribution_major_version'] is version('6', '==')) | ternary('no', 'yes') }}" + when: ansible_facts['os_family'] in ['RedHat', 'Suse'] diff --git a/ansible/roles/nginxinc.nginx/tasks/main.yml b/ansible/roles/nginxinc.nginx/tasks/main.yml index ead4e9b..59a2865 100644 --- a/ansible/roles/nginxinc.nginx/tasks/main.yml +++ b/ansible/roles/nginxinc.nginx/tasks/main.yml @@ -1,85 +1,88 @@ --- -- import_tasks: prerequisites/install-prerequisites.yml +- name: Check whether you are using a supported NGINX distribution + assert: + that: (nginx_type == "opensource" and ansible_facts['distribution'] in nginx_distributions) + or (nginx_type == "plus" and ansible_facts['distribution'] in nginx_plus_distributions) + success_msg: "Your OS, {{ ansible_facts['distribution'] }} is supported by NGINX {{ (nginx_type=='plus') | ternary('Plus', 'Open Source') }}" + fail_msg: "Your OS, {{ ansible_facts['distribution'] }} is not supported by NGINX {{ (nginx_type=='plus') | ternary('Plus', 'Open Source') }}" + when: + - nginx_install | bool + - (nginx_install_from == "nginx_repository" or nginx_type == "plus") + ignore_errors: yes + tags: nginx_check_support + +- name: Set up prerequisites + include_tasks: "{{ role_path }}/tasks/prerequisites/prerequisites.yml" tags: nginx_prerequisites -- import_tasks: keys/apt-key.yml - when: - - ansible_os_family == "Debian" - - nginx_install_from == "nginx_repository" - or nginx_amplify_enable - or nginx_unit_enable - tags: nginx_aptkey +- name: Set up signing keys + include_tasks: "{{ role_path }}/tasks/keys/setup-keys.yml" + when: (nginx_install | bool and nginx_install_from == "nginx_repository") + or nginx_amplify_enable | bool + tags: nginx_key -- import_tasks: keys/rpm-key.yml - when: - - ansible_os_family == "RedHat" - or ansible_os_family == "Suse" - - nginx_install_from == "nginx_repository" - or nginx_amplify_enable - or nginx_unit_enable - tags: nginx_rpmkey - -- import_tasks: keys/apk-key.yml - when: ansible_os_family == "Alpine" - tags: nginx_apkkey - -- name: "(Install: Debian/Ubuntu/CentOS/RedHat/FreeBSD) Install NGINX" +- name: Install and Configure NGINX block: + - name: Install NGINX + block: + - name: Install NGINX Open Source + include_tasks: "{{ role_path }}/tasks/opensource/install-oss.yml" + when: nginx_type == "opensource" + tags: nginx_install_oss - - import_tasks: opensource/install-oss.yml - when: nginx_type == "opensource" - tags: nginx_install_oss + - name: Set up NGINX Plus license + include_tasks: "{{ role_path }}/tasks/plus/setup-license.yml" + when: + - nginx_type == "plus" + - nginx_setup_license | bool + tags: nginx_setup_license - - import_tasks: plus/install-plus.yml - when: nginx_type == "plus" - tags: nginx_install_plus + - name: Install NGINX Plus + include_tasks: "{{ role_path }}/tasks/plus/install-{{ ansible_facts['os_family'] | lower }}.yml" + when: nginx_type == "plus" + tags: nginx_install_plus - - import_tasks: conf/cleanup-config.yml - when: nginx_cleanup_config | bool - tags: nginx_cleanup_config + - name: Install NGINX modules + include_tasks: "{{ role_path }}/tasks/modules/install-modules.yml" + when: + - nginx_modules is defined + - nginx_modules | length > 0 + tags: nginx_install_modules - - import_tasks: conf/upload-config.yml - when: nginx_main_upload_enable - or nginx_http_upload_enable - or nginx_stream_upload_enable - or nginx_html_upload_enable - or nginx_ssl_upload_enable - tags: nginx_upload_config + - name: Remove NGINX Plus license + include_tasks: "{{ role_path }}/tasks/plus/remove-license.yml" + when: + - nginx_type == "plus" + - nginx_remove_license | bool + tags: nginx_remove_license - - import_tasks: conf/template-config.yml - when: nginx_main_template_enable - or nginx_http_template_enable - or nginx_stream_template_enable - or nginx_rest_api_enable - tags: nginx_template_config + - name: Modify systemd parameters + include_tasks: "{{ role_path }}/tasks/config/modify-systemd.yml" + when: + - ansible_facts['service_mgr'] == "systemd" + - nginx_service_modify | bool + tags: nginx_modify_systemd + when: nginx_install | bool + tags: nginx_install - - import_tasks: conf/setup-status.yml - when: nginx_status_enable | bool - tags: nginx_setup_status + - name: Ensure NGINX is running + meta: flush_handlers - - import_tasks: modules/install-modules.yml - when: true in nginx_modules.values() - tags: nginx_install_modules - - - import_tasks: conf/debug-output.yml + - name: Debug NGINX output + include_tasks: "{{ role_path }}/tasks/config/debug-output.yml" when: nginx_debug_output | bool tags: nginx_debug_output - - import_tasks: plus/delete-license.yml - when: - - nginx_type == "plus" - - nginx_delete_license - tags: nginx_delete_license - + - name: Configure logrotate for NGINX + include_tasks: "{{ role_path }}/tasks/config/setup-logrotate.yml" + when: nginx_logrotate_conf_enable | bool + tags: nginx_logrotate_config when: nginx_enable | bool -- import_tasks: amplify/install-amplify.yml +- name: Install NGINX Amplify + include_tasks: "{{ role_path }}/tasks/amplify/install-amplify.yml" when: - nginx_amplify_enable | bool - nginx_amplify_api_key is defined - nginx_amplify_api_key | length > 0 tags: nginx_install_amplify - -- import_tasks: unit/install-unit.yml - when: nginx_unit_enable | bool - tags: nginx_install_unit diff --git a/ansible/roles/nginxinc.nginx/tasks/modules/install-geoip.yml b/ansible/roles/nginxinc.nginx/tasks/modules/install-geoip.yml deleted file mode 100644 index 124d0f0..0000000 --- a/ansible/roles/nginxinc.nginx/tasks/modules/install-geoip.yml +++ /dev/null @@ -1,29 +0,0 @@ ---- -- name: "(Install: CentOS) Install GeoIP Required CentOS Dependencies" - yum: - name: - - epel-release - when: ansible_distribution == "CentOS" - -- name: "(Install: All OSs) Install NGINX Open Source GeoIP Module" - package: - name: "nginx-module-geoip{{ nginx_version | default('') }}" - state: present - when: nginx_type == "opensource" - -- name: "(Install: All OSs) Install NGINX Plus GeoIP Module" - package: - name: "nginx-plus-module-geoip{{ nginx_version | default('') }}" - state: present - when: nginx_type == "plus" - -- name: "(Setup: All NGINX) Load NGINX GeoIP Module" - lineinfile: - path: /etc/nginx/nginx.conf - insertbefore: BOF - line: "{{ item }}" - with_items: - - load_module modules/ngx_http_geoip_module.so; - - load_module modules/ngx_stream_geoip_module.so; - when: not nginx_main_template_enable - notify: "(Handler: All OSs) Reload NGINX" diff --git a/ansible/roles/nginxinc.nginx/tasks/modules/install-image-filter.yml b/ansible/roles/nginxinc.nginx/tasks/modules/install-image-filter.yml deleted file mode 100644 index bbce180..0000000 --- a/ansible/roles/nginxinc.nginx/tasks/modules/install-image-filter.yml +++ /dev/null @@ -1,20 +0,0 @@ ---- -- name: "(Install: All OSs) Install NGINX Open Source Image Filter Module" - package: - name: "nginx-module-image-filter{{ nginx_version | default('') }}" - state: present - when: nginx_type == "opensource" - -- name: "(Install: All OSs) Install NGINX Plus Image Filter Module" - package: - name: "nginx-plus-module-image-filter{{ nginx_version | default('') }}" - state: present - when: nginx_type == "plus" - -- name: "(Setup: All NGINX) Load NGINX Image Filter Module" - lineinfile: - path: /etc/nginx/nginx.conf - insertbefore: BOF - line: load_module modules/ngx_http_image_filter_module.so; - when: not nginx_main_template_enable - notify: "(Handler: All OSs) Reload NGINX" diff --git a/ansible/roles/nginxinc.nginx/tasks/modules/install-modules.yml b/ansible/roles/nginxinc.nginx/tasks/modules/install-modules.yml index d055fe4..51e6c87 100644 --- a/ansible/roles/nginxinc.nginx/tasks/modules/install-modules.yml +++ b/ansible/roles/nginxinc.nginx/tasks/modules/install-modules.yml @@ -1,28 +1,33 @@ --- -- import_tasks: install-njs.yml - when: nginx_modules.njs | default(false) - -- import_tasks: install-perl.yml - when: nginx_modules.perl | default(false) - -- import_tasks: install-geoip.yml +- name: (CentOS) Install GeoIP dependencies + yum: + name: epel-release when: - - nginx_modules.geoip | default(false) - - ansible_os_family != "RedHat" - - ansible_distribution_major_version != "8" + - ansible_facts['distribution'] == "CentOS" + - '"geoip" in nginx_modules' -- import_tasks: install-image-filter.yml - when: nginx_modules.image_filter | default(false) - -- import_tasks: install-rtmp.yml +- name: Install NGINX modules + package: + name: "nginx-{{ (nginx_type == 'plus') | ternary('plus-', '') }}module-{{ item.name | default(item) }}\ + {{ item.version | default(nginx_version) | default('') }}" + state: "{{ item.state | default('present') }}" + loop: "{{ nginx_modules }}" when: - - nginx_modules.rtmp | default(false) - - nginx_type == "plus" - -- import_tasks: install-xslt.yml - when: nginx_modules.xslt | default(false) - -- import_tasks: install-waf.yml - when: - - nginx_modules.waf | default(false) - - nginx_type == "plus" + - (item.name | default(item) in nginx_modules_list and nginx_type == 'opensource') + or (item.name | default(item) in nginx_plus_modules_list and nginx_type == 'plus') + - not (item.name | default(item) == "auth-spnego") + or not (ansible_facts['os_family'] == "Alpine" and (ansible_facts['distribution_version'] | regex_search('^[0-9]+\\.[0-9]+') is version('3.8', '=='))) + - not (item.name | default(item) == "geoip") + or not ((ansible_facts['os_family'] == "RedHat" and ansible_facts['distribution_major_version'] is version('8', '==')) + or (ansible_facts['os_family'] == "FreeBSD")) + - not (item.name | default(item) == "brotli") + or not ((ansible_facts['os_family'] == "Alpine") + or (ansible_facts['os_family'] == "RedHat" and ansible_facts['distribution_major_version'] is version('8', '<')) + or (ansible_facts['os_family'] == "Debian" and ansible_facts['distribution_major_version'] is version('9', '==')) + or (ansible_facts['os_family'] == "Suse" and ansible_facts['distribution_major_version'] is version('12', '<')) + or (ansible_facts['distribution'] == "Amazon") + or (ansible_facts['distribution'] == "OracleLinux")) + - not (item.name | default(item) == "geoip2") or not (ansible_facts['os_family'] == "Suse") + - not (item.name | default(item) == "opentracing") + or not ((ansible_facts['os_family'] == "Suse" and ansible_facts['distribution_major_version'] is version('12', '==')) + or (ansible_facts['os_family'] == "RedHat" and ansible_facts['distribution_major_version'] is version('6', '=='))) diff --git a/ansible/roles/nginxinc.nginx/tasks/modules/install-njs.yml b/ansible/roles/nginxinc.nginx/tasks/modules/install-njs.yml deleted file mode 100644 index f0a2a8a..0000000 --- a/ansible/roles/nginxinc.nginx/tasks/modules/install-njs.yml +++ /dev/null @@ -1,23 +0,0 @@ ---- -- name: "(Install: All OSs) Install NGINX Open Source JavaScript Module" - package: - name: "nginx-module-njs{{ nginx_version | default('') }}" - state: present - when: nginx_type == "opensource" - -- name: "(Install: All OSs) Install NGINX Plus JavaScript Module" - package: - name: "nginx-plus-module-njs{{ nginx_version | default('') }}" - state: present - when: nginx_type == "plus" - -- name: "(Setup: All NGINX) Load NGINX JavaScript Module" - lineinfile: - path: /etc/nginx/nginx.conf - insertbefore: BOF - line: "{{ item }}" - with_items: - - load_module modules/ngx_http_js_module.so; - - load_module modules/ngx_stream_js_module.so; - when: not nginx_main_template_enable - notify: "(Handler: All OSs) Reload NGINX" diff --git a/ansible/roles/nginxinc.nginx/tasks/modules/install-perl.yml b/ansible/roles/nginxinc.nginx/tasks/modules/install-perl.yml deleted file mode 100644 index eb8fac3..0000000 --- a/ansible/roles/nginxinc.nginx/tasks/modules/install-perl.yml +++ /dev/null @@ -1,25 +0,0 @@ ---- -- name: "(Install: All OSs) Install Perl Dependency" - package: - name: perl - state: present - -- name: "(Install: All OSs) Install NGINX Open Source Perl Module" - package: - name: "nginx-module-perl{{ nginx_version | default('') }}" - state: present - when: nginx_type == "opensource" - -- name: "(Install: All OSs) Install NGINX Plus Perl Module" - package: - name: "nginx-plus-module-perl{{ nginx_version | default('') }}" - state: present - when: nginx_type == "plus" - -- name: "(Setup: All NGINX) Load NGINX Perl Module" - lineinfile: - path: /etc/nginx/nginx.conf - insertbefore: BOF - line: load_module modules/ngx_http_perl_module.so; - when: not nginx_main_template_enable - notify: "(Handler: All OSs) Reload NGINX" diff --git a/ansible/roles/nginxinc.nginx/tasks/modules/install-rtmp.yml b/ansible/roles/nginxinc.nginx/tasks/modules/install-rtmp.yml deleted file mode 100644 index 77b1dfd..0000000 --- a/ansible/roles/nginxinc.nginx/tasks/modules/install-rtmp.yml +++ /dev/null @@ -1,13 +0,0 @@ ---- -- name: "(Install: All OSs) Install NGINX Plus RTMP Module" - package: - name: "nginx-plus-module-rtmp{{ nginx_version | default('') }}" - state: present - -- name: "(Setup: All NGINX) Load NGINX RTMP Module" - lineinfile: - path: /etc/nginx/nginx.conf - insertbefore: BOF - line: load_module modules/ngx_rtmp_module.so; - when: not nginx_main_template_enable - notify: "(Handler: All OSs) Reload NGINX" diff --git a/ansible/roles/nginxinc.nginx/tasks/modules/install-waf.yml b/ansible/roles/nginxinc.nginx/tasks/modules/install-waf.yml deleted file mode 100644 index 806cfd3..0000000 --- a/ansible/roles/nginxinc.nginx/tasks/modules/install-waf.yml +++ /dev/null @@ -1,13 +0,0 @@ ---- -- name: "(Install: All OSs) Install NGINX Plus WAF Module" - package: - name: "nginx-plus-module-modsecurity{{ nginx_version | default('') }}" - state: present - -- name: "(Setup: NGINX Plus) Load NGINX Plus WAF Module" - lineinfile: - path: /etc/nginx/nginx.conf - insertbefore: BOF - line: load_module modules/ngx_http_modsecurity_module.so; - when: not nginx_main_template_enable - notify: "(Handler: All OSs) Reload NGINX" diff --git a/ansible/roles/nginxinc.nginx/tasks/modules/install-xslt.yml b/ansible/roles/nginxinc.nginx/tasks/modules/install-xslt.yml deleted file mode 100644 index d73f552..0000000 --- a/ansible/roles/nginxinc.nginx/tasks/modules/install-xslt.yml +++ /dev/null @@ -1,20 +0,0 @@ ---- -- name: "(Install: All OSs) Install NGINX Open Source XSLT Module" - package: - name: "nginx-module-xslt{{ nginx_version | default('') }}" - state: present - when: nginx_type == "opensource" - -- name: "(Install: All OSs) Install NGINX Plus XSLT Module" - package: - name: "nginx-plus-module-xslt{{ nginx_version | default('') }}" - state: present - when: nginx_type == "plus" - -- name: "(Setup: All NGINX) Load NGINX XSLT Module" - lineinfile: - path: /etc/nginx/nginx.conf - insertbefore: BOF - line: load_module modules/ngx_http_xslt_filter_module.so; - when: not nginx_main_template_enable - notify: "(Handler: All OSs) Reload NGINX" diff --git a/ansible/roles/nginxinc.nginx/tasks/opensource/install-alpine.yml b/ansible/roles/nginxinc.nginx/tasks/opensource/install-alpine.yml new file mode 100644 index 0000000..a884a9d --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/opensource/install-alpine.yml @@ -0,0 +1,15 @@ +--- +- name: (Alpine Linux) Configure NGINX repository + lineinfile: + path: /etc/apk/repositories + insertafter: EOF + line: "{{ nginx_repository | default(nginx_default_repository_alpine) }}" + +- name: (Alpine Linux) Install NGINX + apk: + name: "nginx{{ nginx_version | default('') }}" + repository: "{{ nginx_repository | default(nginx_default_repository_alpine) }}" + state: "{{ nginx_state }}" + update_cache: yes + ignore_errors: "{{ ansible_check_mode }}" + notify: (Handler) Run NGINX diff --git a/ansible/roles/nginxinc.nginx/tasks/opensource/install-bsd.yml b/ansible/roles/nginxinc.nginx/tasks/opensource/install-bsd.yml new file mode 100644 index 0000000..de78d65 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/opensource/install-bsd.yml @@ -0,0 +1,78 @@ +--- +- name: (FreeBSD) Update ports + block: + - name: (FreeBSD) Fetch ports + command: portsnap fetch --interactive + args: + creates: /var/db/portsnap/INDEX + + - name: (FreeBSD) Extract ports + command: portsnap extract + args: + creates: /usr/ports + when: + - ansible_facts['system'] == "FreeBSD" + - nginx_bsd_update_ports | bool + +- name: (FreeBSD) Install NGINX + block: + - name: (FreeBSD) Install NGINX package + pkgng: + name: "www/nginx{{ nginx_version | default('') }}" + state: "{{ nginx_state }}" + when: nginx_bsd_install_packages | bool + notify: (Handler) Run NGINX + + - name: (FreeBSD) Install NGINX port + portinstall: + name: "www/nginx{{ nginx_version | default('') }}" + use_packages: "{{ nginx_bsd_portinstall_use_packages | default(omit) }}" + state: "{{ nginx_state }}" + when: not nginx_bsd_install_packages | bool + notify: (Handler) Run NGINX + when: ansible_facts['system'] == "FreeBSD" + +- name: (OpenBSD) Install NGINX + block: + - name: (OpenBSD) Install NGINX package + openbsd_pkg: + name: "nginx{{ nginx_version | default('') }}" + build: no + state: "{{ nginx_state }}" + when: nginx_bsd_install_packages | bool + notify: (Handler) Run NGINX + + - name: (OpenBSD) Install NGINX port + openbsd_pkg: + name: "nginx{{ nginx_version | default('') }}" + build: yes + state: "{{ nginx_state }}" + when: not nginx_bsd_install_packages | bool + notify: (Handler) Run NGINX + when: ansible_facts['system'] == "OpenBSD" + +- name: (NetBSD) Install NGINX + block: + - name: (NetBSD) Install NGINX package + command: "pkg_add www/nginx{{ nginx_version | default('') }}" + when: nginx_bsd_install_packages | bool + notify: (Handler) Run NGINX + + - name: (NetBSD) Install NGINX port + fail: + msg: "{{ ansible_facts['system'] }} Install NGINX port not implemented." + when: not nginx_bsd_install_packages | bool + when: ansible_facts['system'] == "NetBSD" + +- name: (DragonFlyBSD/HardenedBSD) Install NGINX + block: + - name: (DragonFlyBSD/HardenedBSD) Install NGINX package + command: "pkg install www/nginx{{ nginx_version | default('') }}" + when: nginx_bsd_install_packages | bool + notify: (Handler) Run NGINX + + - name: (DragonFlyBSD/HardenedBSD) Install NGINX port + fail: + msg: "{{ ansible_facts['system'] }} Install NGINX port not implemented." + when: not nginx_bsd_install_packages | bool + when: ansible_facts['system'] in ['DragonFlyBSD', 'HardenedBSD'] diff --git a/ansible/roles/nginxinc.nginx/tasks/opensource/install-debian.yml b/ansible/roles/nginxinc.nginx/tasks/opensource/install-debian.yml new file mode 100644 index 0000000..8f1253c --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/opensource/install-debian.yml @@ -0,0 +1,15 @@ +--- +- name: (Debian/Ubuntu) Configure NGINX repository + apt_repository: + filename: nginx + repo: "{{ item }}" + update_cache: yes + mode: 0644 + loop: "{{ nginx_repository | default(nginx_default_repository_debian) }}" + +- name: (Debian/Ubuntu) Install NGINX + apt: + name: "nginx{{ nginx_version | default('') }}" + state: "{{ nginx_state }}" + ignore_errors: "{{ ansible_check_mode }}" + notify: (Handler) Run NGINX diff --git a/ansible/roles/nginxinc.nginx/tasks/opensource/install-oss-bsd.yml b/ansible/roles/nginxinc.nginx/tasks/opensource/install-oss-bsd.yml deleted file mode 100644 index b8b5997..0000000 --- a/ansible/roles/nginxinc.nginx/tasks/opensource/install-oss-bsd.yml +++ /dev/null @@ -1,103 +0,0 @@ ---- -- name: "(Install: FreeBSD) Update ports" - block: - - - name: "(Install: FreeBSD) Fetch Ports" - command: portsnap fetch --interactive - args: - creates: /var/db/portsnap/INDEX - - - name: "(Install: FreeBSD) Extract Ports" - command: portsnap extract - args: - creates: /usr/ports - - when: - - ansible_system == 'FreeBSD' - - nginx_bsd_update_ports - -- name: "(Install: FreeBSD)" - block: - - - name: "(Install: FreeBSD) Install NGINX package" - pkgng: - name: "www/nginx{{ nginx_version | default('') }}" - state: "{{ nginx_state }}" - when: nginx_bsd_install_packages - notify: "(Handler: All OSs) Start NGINX" - - - name: "(Install: FreeBSD) Install NGINX port" - portinstall: - name: "www/nginx{{ nginx_version | default('') }}" - use_packages: "{{ nginx_bsd_portinstall_use_packages | default(omit) }}" - state: "{{ nginx_state }}" - when: not nginx_bsd_install_packages - notify: "(Handler: All OSs) Start NGINX" - - when: ansible_system == 'FreeBSD' - -- name: "(Install: OpenBSD)" - block: - - - name: "(Install: OpenBSD) Install NGINX package" - openbsd_pkg: - name: "nginx{{ nginx_version | default('') }}" - build: false - state: "{{ nginx_state }}" - when: nginx_bsd_install_packages - notify: "(Handler: All OSs) Start NGINX" - - - name: "(Install: OpenBSD) Install NGINX port" - openbsd_pkg: - name: "nginx{{ nginx_version | default('') }}" - build: true - state: "{{ nginx_state }}" - when: not nginx_bsd_install_packages - notify: "(Handler: All OSs) Start NGINX" - - when: ansible_system == 'OpenBSD' - -- name: "(Install: NetBSD)" - block: - - - name: "(Install: NetBSD) Install NGINX package" - command: "pkg_add www/nginx{{ nginx_version | default('') }}" - when: nginx_bsd_install_packages - notify: "(Handler: All OSs) Start NGINX" - - - name: "(Install: NetBSD) Install NGINX port" - fail: - msg: "{{ ansible_system }} Install NGINX port not implemented." - when: not nginx_bsd_install_packages - - when: ansible_system == 'NetBSD' - -- name: "(Install: DragonFlyBSD)" - block: - - - name: "(Install: DragonFlyBSD) Install NGINX package" - command: "pkg install www/nginx{{ nginx_version | default('') }}" - when: nginx_bsd_install_packages - notify: "(Handler: All OSs) Start NGINX" - - - name: "(Install: DragonFlyBSD) Install NGINX port" - fail: - msg: "{{ ansible_system }} Install NGINX port not implemented." - when: not nginx_bsd_install_packages - - when: ansible_system == 'DragonFlyBSD' - -- name: "(Install: HardenedBSD)" - block: - - - name: "(Install: HardenedBSD) Install NGINX package" - command: "pkg install www/nginx{{ nginx_version | default('') }}" - when: nginx_bsd_install_packages - notify: "(Handler: All OSs) Start NGINX" - - - name: "(Install: HardenedBSD) Install NGINX port" - fail: - msg: "{{ ansible_system }} Install NGINX port not implemented." - when: not nginx_bsd_install_packages - - when: ansible_system == 'HardenedBSD' diff --git a/ansible/roles/nginxinc.nginx/tasks/opensource/install-oss-linux.yml b/ansible/roles/nginxinc.nginx/tasks/opensource/install-oss-linux.yml deleted file mode 100644 index 3525e63..0000000 --- a/ansible/roles/nginxinc.nginx/tasks/opensource/install-oss-linux.yml +++ /dev/null @@ -1,28 +0,0 @@ ---- -- name: "(Install: Linux) Configure NGINX repo" - block: - - - import_tasks: setup-alpine.yml - when: ansible_os_family == "Alpine" - - - import_tasks: setup-debian.yml - when: ansible_os_family == "Debian" - - - import_tasks: setup-redhat.yml - when: ansible_os_family == "RedHat" - - - import_tasks: setup-suse.yml - when: ansible_os_family == "Suse" - - when: nginx_install_from == "nginx_repository" - -- name: "(Install: Linux) Install NGINX from source" - import_tasks: setup-source.yml - when: nginx_install_from == "source" - -- name: "(Install: Linux) Install NGINX package" - package: - name: "nginx{{ nginx_version | default('') }}" - state: "{{ nginx_state }}" - when: nginx_install_from == "os_repository" - notify: "(Handler: All OSs) Start NGINX" diff --git a/ansible/roles/nginxinc.nginx/tasks/opensource/install-oss.yml b/ansible/roles/nginxinc.nginx/tasks/opensource/install-oss.yml index a2b8584..1a573ad 100644 --- a/ansible/roles/nginxinc.nginx/tasks/opensource/install-oss.yml +++ b/ansible/roles/nginxinc.nginx/tasks/opensource/install-oss.yml @@ -1,8 +1,22 @@ --- -- name: "(Install: OSS Linux)" - import_tasks: install-oss-linux.yml - when: ansible_os_family in nginx_linux_families +- name: Install NGINX in Linux systems + block: + - name: Install NGINX from repository + include_tasks: "{{ role_path }}/tasks/opensource/install-{{ ansible_facts['os_family'] | lower }}.yml" + when: nginx_install_from == "nginx_repository" -- name: "(Install: OSS BSD)" - import_tasks: install-oss-bsd.yml - when: ansible_system in nginx_bsd_systems + - name: Install NGINX from source + include_tasks: "{{ role_path }}/tasks/opensource/install-source.yml" + when: nginx_install_from == "source" + + - name: Install NGINX from package + package: + name: "nginx{{ nginx_version | default('') }}" + state: "{{ nginx_state }}" + when: nginx_install_from == "os_repository" + notify: (Handler) Run NGINX + when: ansible_facts['system'] | lower is not search('bsd') + +- name: Install NGINX in Unix systems + include_tasks: "{{ role_path }}/tasks/opensource/install-bsd.yml" + when: ansible_facts['system'] | lower is search('bsd') diff --git a/ansible/roles/nginxinc.nginx/tasks/opensource/install-redhat.yml b/ansible/roles/nginxinc.nginx/tasks/opensource/install-redhat.yml new file mode 100644 index 0000000..6fc1691 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/opensource/install-redhat.yml @@ -0,0 +1,34 @@ +--- +- name: (CentOS/RHEL 6/7) Configure NGINX repository + yum_repository: + name: nginx + baseurl: "{{ nginx_repository | default(nginx_default_repository_redhat) }}" + description: NGINX Repository + enabled: yes + gpgcheck: yes + mode: 0644 + when: ansible_facts['distribution_major_version'] is version('8', '<') + +- name: (CentOS/RHEL 8) Configure NGINX repository + blockinfile: + path: /etc/yum.repos.d/nginx.repo + create: yes + block: | + [nginx] + baseurl = {{ nginx_repository | default(nginx_default_repository_redhat) }} + enabled = 1 + gpgcheck = 1 + name = NGINX Repository + module_hotfixes = true + mode: 0644 + when: ansible_facts['distribution_major_version'] is version('8', '==') + +- name: (CentOS/RHEL) Install NGINX + yum: + name: "nginx{{ nginx_version | default('') }}" + state: "{{ nginx_state }}" + disablerepo: "*" + enablerepo: nginx + update_cache: yes + ignore_errors: "{{ ansible_check_mode }}" + notify: (Handler) Run NGINX diff --git a/ansible/roles/nginxinc.nginx/tasks/opensource/install-source.yml b/ansible/roles/nginxinc.nginx/tasks/opensource/install-source.yml new file mode 100644 index 0000000..af2cf8d --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/opensource/install-source.yml @@ -0,0 +1,450 @@ +--- +- name: Check for build tools + block: + - name: (CentOS/RHEL 8) Setup Python 3 + block: + - name: (CentOS/RHEL 8) Install Python 3 + yum: + name: + - python3 + - python3-pip + - python3-devel + update_cache: yes + + - name: (Centos/RHEL 8) Set Python 3 as default + alternatives: + name: python + path: /usr/bin/python3 + link: /usr/bin/python + when: + - ansible_facts['os_family'] == "RedHat" + - ansible_facts['distribution_major_version'] is version('8', '==') + + - name: (Centos/RHEL) Install build tools + yum: + name: + - "@Development tools" + - ca-certificates + - gcc + - gd + - gd-devel + - glibc + - glibc-common + - perl-core + - wget + - zlib-devel + update_cache: yes + when: ansible_facts['os_family'] == "RedHat" + + - name: (Debian) Install backports repo for 'buster' + apt_repository: + filename: buster-backports + repo: deb http://ftp.us.debian.org/debian buster-backports main + update_cache: yes + mode: 0644 + when: ansible_facts['distribution_release'] == "buster" + + - name: (Debian/Ubuntu) Install build tools + apt: + name: + - build-essential + - checkinstall + - libtemplate-perl + - python3-minimal + - perl + - tar + - zlib1g-dev + update_cache: yes + when: ansible_facts['os_family'] == "Debian" + + - name: (Alpine Linux) Install build tools + apk: + name: + - alpine-sdk + - build-base + - git + - openrc + - perl + - python3 + - linux-headers + - tar + - wget + update_cache: yes + when: ansible_facts['os_family'] == "Alpine" + + - name: (Alpine Linux) Enable OpenRC + copy: + content: "" + dest: /run/openrc/softlevel + force: no + owner: root + mode: 0644 + when: ansible_facts['os_family'] == "Alpine" + when: nginx_install_source_build_tools | bool + +- name: Check for source installs + block: + - name: Check for PCRE install + stat: + path: /tmp/{{ pcre_version }} + register: pcre_result + + - name: Check for ZLib install + stat: + path: /tmp/{{ zlib_version }} + register: zlib_result + + - name: Check for OpenSSL install + stat: + path: /tmp/{{ openssl_version }} + register: openssl_result + +- name: (CentOS/RHEL) Install PCRE dependency from package + yum: + name: pcre-devel + update_cache: yes + when: + - nginx_install_source_pcre | bool + - ansible_facts['os_family'] == "RedHat" + +- name: (Debian/Ubuntu) Install PCRE dependency from package + apt: + name: libpcre3-dev + update_cache: yes + when: + - nginx_install_source_pcre | bool + - ansible_facts['os_family'] == "Debian" + +- name: (Alpine Linux) Install PCRE dependency from package + apk: + name: pcre-dev + update_cache: yes + when: + - nginx_install_source_pcre | bool + - ansible_facts['os_family'] == "Alpine" + +- name: Install PCRE dependence from source + block: + - name: Download PCRE dependency + get_url: + url: "https://ftp.pcre.org/pub/pcre/{{ pcre_version }}.tar.gz" + dest: "/tmp/{{ pcre_version }}.tar.gz" + mode: 0600 + validate_certs: "{{ (ansible_facts['os_family'] == 'RedHat' and ansible_facts['distribution_major_version'] is version('6', '==')) + | ternary('no', 'yes') }}" + register: pcre_source + + - name: Unpack PCRE dependency + unarchive: + copy: no + dest: /tmp/ + src: "{{ pcre_source.dest }}" + mode: 0700 + + - name: Configure PCRE dependency + command: ./configure + args: + chdir: "/tmp/{{ pcre_version }}" + + - name: Make PCRE dependency + make: + chdir: "/tmp/{{ pcre_version }}" + + - name: Install PCRE dependency + make: + chdir: "/tmp/{{ pcre_version }}" + target: install + when: + - not pcre_result.stat.exists | bool + - not nginx_install_source_pcre | bool + - not ansible_check_mode | bool + +- name: (Centos/RHEL) Install ZLib dependency from package + yum: + name: zlib-devel + update_cache: yes + when: + - nginx_install_source_zlib | bool + - ansible_facts['os_family'] == "RedHat" + +- name: (Debian/Ubuntu) Install ZLib dependency from package + apt: + name: zlib1g-dev + update_cache: true + when: + - nginx_install_source_zlib | bool + - ansible_facts['os_family'] == "Debian" + +- name: (Alpine Linux) Install ZLib dependency from package + apk: + name: zlib-dev + update_cache: yes + when: + - nginx_install_source_zlib | bool + - ansible_facts['os_family'] == "Alpine" + +- name: Install ZLib dependency from source + block: + - name: Download ZLib dependency + get_url: + url: "https://zlib.net/{{ zlib_version }}.tar.gz" + dest: "/tmp/{{ zlib_version }}.tar.gz" + mode: 0600 + validate_certs: "{{ (ansible_facts['os_family'] == 'RedHat' and ansible_facts['distribution_major_version'] is version('6', '==')) + | ternary('no', 'yes') }}" + register: zlib_source + + - name: Unpack ZLib dependency + unarchive: + copy: no + dest: /tmp/ + src: "{{ zlib_source.dest }}" + mode: 0700 + + - name: Configure ZLib dependency + command: ./configure + args: + chdir: "/tmp/{{ zlib_version }}" + + - name: Make ZLib dependency + make: + chdir: "/tmp/{{ zlib_version }}" + + - name: Install ZLib dependency + make: + chdir: "/tmp/{{ zlib_version }}" + target: install + when: + - not zlib_result.stat.exists | bool + - not nginx_install_source_zlib | bool + - not ansible_check_mode | bool + +- name: (CentOS/RHEL) Install OpenSSL dependency from package + yum: + name: openssl-devel + update_cache: yes + when: + - nginx_install_source_openssl | bool + - ansible_facts['os_family'] == "RedHat" + +- name: (Debian/Ubuntu) Install OpenSSL dependency from package + apt: + name: libssl-dev + update_cache: yes + when: + - nginx_install_source_openssl | bool + - ansible_facts['os_family'] == "Debian" + +- name: (Alpine Linux) Install OpenSSL dependency from package + apk: + name: openssl-dev + update_cache: yes + when: + - nginx_install_source_openssl | bool + - ansible_facts['os_family'] == "Alpine" + +- name: Install OpenSSL dependency from source + block: + - name: Download OpenSSL dependency + get_url: + url: "https://www.openssl.org/source/{{ openssl_version }}.tar.gz" + dest: "/tmp/{{ openssl_version }}.tar.gz" + mode: 0600 + validate_certs: "{{ (ansible_facts['os_family'] == 'RedHat' and ansible_facts['distribution_major_version'] is version('6', '==')) + | ternary('no', 'yes') }}" + register: openssl_source + + - name: Unpack OpenSSL dependency + unarchive: + copy: no + dest: /tmp/ + src: "{{ openssl_source.dest }}" + mode: 0700 + + - name: Configure OpenSSL dependency + command: ./config --prefix=/usr/local/openssl --openssldir=/usr/local/openssl shared zlib + args: + chdir: "/tmp/{{ openssl_version }}" + + - name: Make OpenSSL dependency + make: + chdir: "/tmp/{{ openssl_version }}" + + - name: Install OpenSSL dependency + make: + chdir: "/tmp/{{ openssl_version }}" + target: install + when: + - not openssl_result.stat.exists | bool + - not nginx_install_source_openssl | bool + - not ansible_check_mode | bool + +- name: Get NGINX version + block: + - name: Fetch NGINX version + uri: + url: https://trac.nginx.org/nginx/browser + return_content: yes + validate_certs: "{{ (ansible_facts['os_family'] == 'RedHat' and ansible_facts['distribution_major_version'] is version('6', '==')) + | ternary('no', 'yes') }}" + check_mode: no + register: nginx_versions + + - name: Set NGINX mainline version + set_fact: + nginx_version: "{{ nginx_versions.content | regex_search('release[^<]*') | regex_replace('release', 'nginx') }}" + when: nginx_branch == "mainline" + + - name: Set NGINX stable version 1/2 + set_fact: + nginx_version: "{{ nginx_versions.content | regex_search('stable[^<]*') | regex_replace('stable', 'release') }}" + when: nginx_branch == "stable" + + - name: Set NGINX stable version 2/2 + set_fact: + nginx_version: "{{ nginx_versions.content | regex_search(nginx_version + '[^<]*') | regex_replace('release', 'nginx') }}" + when: nginx_branch == "stable" + + - name: Set NGINX download filename + set_fact: + nginx_download_name: "{{ nginx_version }}" + + - name: Check for NGINX install + stat: + path: /usr/sbin/nginx + follow: yes + register: nginx_result + +- name: Add NGINX user + user: + name: nginx + +- name: Install NGINX + block: + - name: Download NGINX + get_url: + url: "https://nginx.org/download/{{ nginx_download_name }}.tar.gz" + dest: "/tmp/{{ nginx_download_name }}.tar.gz" + mode: 0600 + validate_certs: "{{ (ansible_facts['os_family'] == 'RedHat' and ansible_facts['distribution_major_version'] is version('6', '==')) + | ternary('no', 'yes') }}" + register: nginx_source + + - name: Unpack NGINX + unarchive: + copy: no + dest: /tmp/ + src: "{{ nginx_source.dest }}" + mode: 0755 + + - name: Configure NGINX + command: >- + ./configure + --conf-path=/etc/nginx/nginx.conf + --error-log-path=/var/log/nginx/error.log + --http-log-path=/var/log/nginx/access.log + --lock-path=/var/lock/nginx.lock + --modules-path=/usr/lib/nginx/modules + --prefix=/usr + --pid-path=/var/run/nginx.pid + --with-http_ssl_module + --with-mail=dynamic + --with-stream + {{ nginx_install_source_pcre | ternary('', '--with-pcre=../' + pcre_version) }} + {{ nginx_install_source_zlib | ternary('', '--with-zlib=../' + zlib_version) }} + {{ nginx_install_source_openssl | ternary('', '--with-openssl=../' + openssl_version) }} + args: + chdir: "/tmp/{{ nginx_version }}" + register: nginx_configure + + - name: Make NGINX + make: + chdir: "/tmp/{{ nginx_version }}" + + - name: Install NGINX + make: + chdir: "/tmp/{{ nginx_version }}" + target: install + + - name: Upload systemd NGINX service file + copy: + src: services/nginx.systemd + dest: /lib/systemd/system/nginx.service + owner: root + group: root + mode: 0644 + when: ansible_facts['service_mgr'] == "systemd" + + - name: Enable systemd NGINX service file + systemd: + daemon_reload: yes + name: nginx + state: restarted + enabled: yes + when: ansible_facts['service_mgr'] == "systemd" + notify: "(Handler) Run NGINX" + + - name: Upload upstart NGINX service file + copy: + src: services/nginx.upstart + dest: /etc/init.d/nginx + owner: root + group: root + mode: 0755 + when: ansible_facts['service_mgr'] == "upstart" + + - name: Upload Upstart NGINX service conf file + copy: + src: services/nginx.conf.upstart + dest: /etc/init/nginx.conf + owner: root + group: root + mode: 0644 + when: ansible_facts['service_mgr'] == "upstart" + + - name: Enable Upstart NGINX service reload + command: initctl reload-configuration + when: ansible_facts['service_mgr'] == "upstart" + + - name: Start Upstart NGINX service reload + command: nginx + when: ansible_facts['service_mgr'] == "upstart" + notify: "(Handler) Run NGINX" + + - name: Upload SysVinit NGINX service file + copy: + src: services/nginx.sysvinit + dest: /etc/init.d/nginx + owner: root + group: root + mode: 0755 + when: ansible_facts['service_mgr'] == "sysvinit" + notify: "(Handler) Run NGINX" + + - name: Upload OpenRC NGINX service file + copy: + src: services/nginx.openrc + dest: /etc/init.d/nginx + owner: root + group: root + mode: 0755 + when: ansible_facts['service_mgr'] == "openrc" + + - name: Enable OpenRC NGINX service + command: rc-update add nginx default + when: ansible_facts['service_mgr'] == "openrc" + notify: (Handler) Run NGINX + when: + - not nginx_result.stat.exists | bool + - not ansible_check_mode | bool + +- name: Cleanup downloads + file: + path: "{{ item }}" + state: absent + loop: + - "{{ pcre_source.dest }}" + - "{{ zlib_source.dest }}" + - "{{ openssl_source.dest }}" + - "{{ nginx_source.dest }}" + when: item is defined diff --git a/ansible/roles/nginxinc.nginx/tasks/opensource/install-suse.yml b/ansible/roles/nginxinc.nginx/tasks/opensource/install-suse.yml new file mode 100644 index 0000000..37e0e21 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/opensource/install-suse.yml @@ -0,0 +1,14 @@ +--- +- name: (SLES) Configure NGINX repository + zypper_repository: + name: "nginx-{{ nginx_branch }}" + repo: "{{ nginx_repository | default(nginx_default_repository_suse) }}" + +- name: (SLES) Install NGINX + zypper: + name: "nginx{{ nginx_version | default('') }}" + state: "{{ nginx_state }}" + disable_recommends: no + update_cache: yes + ignore_errors: "{{ ansible_check_mode }}" + notify: (Handler) Run NGINX diff --git a/ansible/roles/nginxinc.nginx/tasks/opensource/setup-alpine.yml b/ansible/roles/nginxinc.nginx/tasks/opensource/setup-alpine.yml deleted file mode 100644 index f5aa5b9..0000000 --- a/ansible/roles/nginxinc.nginx/tasks/opensource/setup-alpine.yml +++ /dev/null @@ -1,29 +0,0 @@ ---- -- name: "(Install: Alpine) Set Default APK NGINX Repository" - set_fact: - default_repository: >- - https://nginx.org/packages/{{ (nginx_branch == 'mainline') - | ternary('mainline/', '') }}alpine/v{{ ansible_distribution_version.split('.')[0] }}.{{ ansible_distribution_version.split('.')[1] }}/main - -- name: "(Install: Alpine) Set APK NGINX Repository" - set_fact: - repository: "{{ nginx_repository | default(default_repository) }}" - -- name: "(Install: Alpine) Add NGINX Repository" - lineinfile: - path: /etc/apk/repositories - insertafter: EOF - line: "{{ repository }}" - -- name: "(Install: Alpine) Install Required Alpine Dependencies" - apk: - name: - - openssl - - pcre - -- name: "(Install: Alpine) Install NGINX" - apk: - name: "nginx{{ nginx_version | default('') }}" - repository: "{{ repository }}" - state: "{{ nginx_state }}" - notify: "(Handler: All OSs) Start NGINX" diff --git a/ansible/roles/nginxinc.nginx/tasks/opensource/setup-debian.yml b/ansible/roles/nginxinc.nginx/tasks/opensource/setup-debian.yml deleted file mode 100644 index a289956..0000000 --- a/ansible/roles/nginxinc.nginx/tasks/opensource/setup-debian.yml +++ /dev/null @@ -1,26 +0,0 @@ ---- -- name: "(Install: Debian/Ubuntu) Set Default APT NGINX Repository" - set_fact: - default_repository: - - >- - deb [arch=amd64] https://nginx.org/packages/{{ (nginx_branch == 'mainline') - | ternary('mainline/', '') }}{{ ansible_distribution | lower }}/ {{ ansible_distribution_release }} nginx - - >- - deb-src [arch=amd64] https://nginx.org/packages/{{ (nginx_branch == 'mainline') - | ternary('mainline/', '') }}{{ ansible_distribution | lower }}/ {{ ansible_distribution_release }} nginx - -- name: "(Install: Debian/Ubuntu) Set APT NGINX Repository" - set_fact: - repository: "{{ nginx_repository | default(default_repository) }}" - -- name: "(Install: Debian/Ubuntu) Add NGINX Repository" - apt_repository: - repo: "{{ item }}" - with_items: - - "{{ repository }}" - -- name: "(Install: Debian/Ubuntu) Install NGINX" - apt: - name: "nginx{{ nginx_version | default('') }}" - state: "{{ nginx_state }}" - notify: "(Handler: All OSs) Start NGINX" diff --git a/ansible/roles/nginxinc.nginx/tasks/opensource/setup-redhat.yml b/ansible/roles/nginxinc.nginx/tasks/opensource/setup-redhat.yml deleted file mode 100644 index 45b19b4..0000000 --- a/ansible/roles/nginxinc.nginx/tasks/opensource/setup-redhat.yml +++ /dev/null @@ -1,31 +0,0 @@ ---- -- name: "(Install: CentOS/RedHat) Set Default YUM NGINX Repository" - set_fact: - default_repository: >- - https://nginx.org/packages/{{ (nginx_branch == 'mainline') - | ternary('mainline/', '') }}{{ (ansible_distribution == "RedHat") - | ternary('rhel', 'centos') }}/{{ ansible_distribution_major_version }}/$basearch/ - -- name: "(Install: CentOS/RedHat) Set YUM NGINX Repository" - set_fact: - repository: "{{ nginx_repository | default(default_repository) }}" - -- name: "(Install: CentOS/RedHat) Add NGINX Repository" - yum_repository: - name: nginx - baseurl: "{{ repository }}" - description: NGINX Repository - enabled: yes - gpgcheck: yes - -- name: "(Install: CentOS/RedHat) Install Required CentOS/RedHat Dependencies" - yum: - name: openssl - -- name: "(Install: CentOS/RedHat) Install NGINX" - yum: - name: "nginx{{ nginx_version | default('') }}" - state: "{{ nginx_state }}" - disablerepo: "*" - enablerepo: "nginx" - notify: "(Handler: All OSs) Start NGINX" diff --git a/ansible/roles/nginxinc.nginx/tasks/opensource/setup-source.yml b/ansible/roles/nginxinc.nginx/tasks/opensource/setup-source.yml deleted file mode 100644 index f194daf..0000000 --- a/ansible/roles/nginxinc.nginx/tasks/opensource/setup-source.yml +++ /dev/null @@ -1,437 +0,0 @@ ---- -- name: "(Install: Linux) Check for build tools" - when: nginx_install_source_build_tools - block: - - - name: "(Install: Linux) Install Python - Centos/RHEL" - package: - name: - - python3 - - python3-pip - - python3-devel - state: present - when: ansible_os_family == "RedHat" - - - name: "(Install: Linux) Set Python3 default - Centos/RHEL" - alternatives: - name: python - path: /usr/bin/python3 - link: /usr/bin/python - when: ansible_os_family == "RedHat" and ansible_distribution_major_version == "8" - - - name: "(Install: Linux) Install Build Tools - Centos/RHEL" - package: - name: - - "@Development tools" - - gcc - - glibc - - glibc-common - - gd - - gd-devel - - perl-core - - wget - - ca-certificates - - zlib-devel - state: present - when: ansible_os_family == "RedHat" - - - name: "(Install: Linux) Install backports repo for Buster" - apt_repository: - repo: deb http://ftp.us.debian.org/debian buster-backports main - when: ansible_distribution_release == "buster" - - - name: "(Install: Linux) Install Build Tools - Debian/Ubuntu" - package: - name: - - python-minimal - - build-essential - - perl - - tar - - checkinstall - - zlib1g-dev - - libtemplate-perl - state: present - when: ansible_os_family == "Debian" - - - name: "(Install: Linux) Install Build Tools - Alpine" - package: - name: - - python - - alpine-sdk - - build-base - - git - - wget - - perl - - linux-headers - - tar - - openrc - state: present - when: ansible_os_family == "Alpine" - - - name: "(Install: Linux) Enable openrc - Alpine" - copy: - content: "" - dest: /run/openrc/softlevel - force: no - owner: root - mode: 0644 - when: ansible_os_family == "Alpine" - -- name: "(Install: Linux) Check for Source Installs" - block: - - - name: "(Install: Linux) Check for PCRE Install" - stat: - path: /tmp/{{ pcre_version }} - register: pcre_result - - - name: "(Install: Linux) Check for zlib Install" - stat: - path: /tmp/{{ zlib_version }} - register: zlib_result - - - name: "(Install: Linux) Check for openssl Install" - stat: - path: /tmp/{{ openssl_version }} - register: openssl_result - -- name: "(Install: Linux) Install PCRE Dependency: Package: Centos/RHEL" - when: nginx_install_source_pcre and ansible_os_family == "RedHat" - package: - name: pcre-devel - state: present - -- name: "(Install: Linux) Install PCRE Dependency: Package: Debian/Ubuntu" - when: nginx_install_source_pcre and ansible_os_family == "Debian" - package: - name: libpcre3–dev - state: present - -- name: "(Install: Linux) Install PCRE Dependency: Package: Alpine" - when: nginx_install_source_pcre and ansible_os_family == "Alpine" - package: - name: pcre-dev - state: present - -- name: "(Install: Linux) Install PCRE Dependency: Source" - when: not pcre_result.stat.exists and not nginx_install_source_pcre - block: - - - name: "(Install: Linux) Install PCRE Dependency: Download" - get_url: - url: "http://ftp.pcre.org/pub/pcre/{{ pcre_version }}.tar.gz" - dest: "/tmp/{{ pcre_version }}.tar.gz" - register: pcre_source - - - name: "(Install: Linux) Install PCRE Dependency: Unpack" - unarchive: - copy: no - dest: /tmp/ - src: "{{ pcre_source.dest }}" - register: pcre_source_unpack - - - name: "(Install: Linux) Install PCRE Dependency: Configure" - command: "./configure" - args: - chdir: "/tmp/{{ pcre_version }}" - register: pcre_configure - - - name: "(Install: Linux) Install PCRE Dependency: Install" - make: - chdir: "/tmp/{{ pcre_version }}" - - - name: "(Install: Linux) Install PCRE Dependency: Install" - make: - chdir: "/tmp/{{ pcre_version }}" - target: install - -- name: "(Install: Linux) Install zlib Dependency: Package: Centos/RHEL" - when: nginx_install_source_zlib and ansible_os_family == "RedHat" - package: - name: zlib-devel - state: present - -- name: "(Install: Linux) Install zlib Dependency: Package: Debian/Ubuntu" - when: nginx_install_source_zlib and ansible_os_family == "Debian" - package: - name: zlib1g-dev - state: present - -- name: "(Install: Linux) Install zlib Dependency: Package: Alpine" - when: nginx_install_source_zlib and ansible_os_family == "Alpine" - package: - name: zlib-dev - state: present - -- name: "(Install: Linux) Install zlib Dependency: Source" - when: not zlib_result.stat.exists and not nginx_install_source_zlib - block: - - - name: "(Install: Linux) Install zlib Dependency: Download" - get_url: - url: "http://zlib.net/{{ zlib_version }}.tar.gz" - dest: "/tmp/{{ zlib_version }}.tar.gz" - register: zlib_source - - - name: "(Install: Linux) Install zlib Dependency: Unpack" - unarchive: - copy: no - dest: /tmp/ - src: "{{ zlib_source.dest }}" - register: zlib_source_unpack - - - name: "(Install: Linux) Install zlib Dependency: Configure" - command: "./configure" - args: - chdir: "/tmp/{{ zlib_version }}" - register: zlib_configure - - - name: "(Install: Linux) Install zlib Dependency: Install" - make: - chdir: "/tmp/{{ zlib_version }}" - - - name: "(Install: Linux) Install zlib Dependency: Install" - make: - chdir: "/tmp/{{ zlib_version }}" - target: install - -- name: "(Install: Linux) Install OpenSSL Dependency: Package: Centos/RHEL" - when: nginx_install_source_openssl and ansible_os_family == "RedHat" - package: - name: openssl-devel - state: present - -- name: "(Install: Linux) Install OpenSSL Dependency: Package: Debian/Ubuntu" - when: nginx_install_source_openssl and ansible_os_family == "Debian" - package: - name: libssl-dev - state: present - -- name: "(Install: Linux) Install OpenSSL Dependency: Package: Alpine" - when: nginx_install_source_openssl and ansible_os_family == "Alpine" - package: - name: openssl-dev - state: present - -- name: "(Install: Linux) Install OpenSSL Dependency: Source" - when: not openssl_result.stat.exists and not nginx_install_source_openssl - block: - - - name: "(Install: Linux) Install OpenSSL Dependency: Download" - get_url: - url: "http://www.openssl.org/source/{{ openssl_version }}.tar.gz" - dest: "/tmp/{{ openssl_version }}.tar.gz" - register: openssl_source - - - name: "(Install: Linux) Install OpenSSL Dependency: Unpack" - unarchive: - copy: no - dest: /tmp/ - src: "{{ openssl_source.dest }}" - register: openssl_source_unpack - - - name: "(Install: Linux) Install OpenSSL Dependency: Configure" - command: "./config --prefix=/usr" - args: - chdir: "/tmp/{{ openssl_version }}" - register: openssl_configure - - - name: "(Install: Linux) Install OpenSSL Dependency: Make" - make: - chdir: "/tmp/{{ openssl_version }}" - - - name: "(Install: Linux) Install OpenSSL Dependency: Install" - make: - chdir: "/tmp/{{ openssl_version }}" - target: install - -- name: "(Install: Linux) Install NGINX: Get NGINX version" - block: - - - name: "(Install: Linux) Install NGINX: Get NGINX mainline version" - shell: - args: - cmd: curl --stderr - https://trac.nginx.org/nginx/browser | grep release | head -1 | sed -e 's:.*