ungleich-public/public-health-ch
6
1
Fork 0
Code Issues Pull requests 1 Projects Releases Wiki Activity

Ansible configuration

Browse source
This commit is contained in:
Oleg Lavrovsky 2020-05-16 00:14:14 +02:00
parent 0a6dcf6cc7
commit cfef0647a5
152 changed files with 7022 additions and 117 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
README.md
View file

@ -113,20 +113,15 @@ For an update release with a specific version, use:
ansible-playbook -s ansible/site.yaml -i ansible/inventories/production --tags release -e gitversion=<v*.*.*>
```
Once the basic system set up, i.e. you have an `ansible` user in the sudoers and docker group, and a few basic system packages ready.
For example, on Ubuntu:
```
apt-get install -q -y zip git nginx python-virtualenv python-dev
```
Once the basic system set up, i.e. you have an `ansible` user in the sudoers and docker group, you are ready to run the playbook.
The typical order of deployment is:
- node.yaml
- site.yaml
- docker.yaml
- harden.yaml
- node.yaml
- web.yaml
- wagtail.yaml
- internet.yaml
### Production releases

2
ansible/harden.yaml → ansible/internet.yaml
View file

@ -7,5 +7,5 @@
roles:
- role: dev-sec.os-hardening
- role: dev-sec.ssh-hardening
become: yes
- role: dev-sec.nginx-hardening
- role: jnv.unattended-upgrades

90
ansible/inventories/evolution/group_vars/webservers/vault.yaml
View file

@ -1,46 +1,46 @@
$ANSIBLE_VAULT;1.1;AES256
39623434656631643030663563343865363562353834336262353939666566643961323936316537
6139376161613163626664323564626134333066346265330a636334616466306464316365653038
32646430633039303364366163646430633436366664333064393364663132363535666338666137
3531323636316435640a326135303364623461623434343663343062653434356165356161326365
66663664643463393964653764376264616166306433343761653037616639326538626531663239
37376263303237346131326231656439366430373637653634396139333431636565373630626131
39303661383937346630623830613462393163333032643035313765393030653337363161386364
36623132353033316239326365343064663130333161353835643935613034303838373861323163
62363564343531666665356439326139366463646661636534386334323765636336306136623766
62636534626461326166613934663535633962336130386463633439343434353637396131383633
61343335393463313433356363366639626535346263333635393039376335343965393138323639
32386461626164356666386535393365616539323631303265303833373635646339343031346139
39336332396662636561613636303866303230353866646330306433353938306133336239326431
65383365313336636166353533363439333739373832353839656139306262366230646631363033
62653430396463663232613539353135666465666635316432383230306361376330353938356538
39333566373366323134613262623865383866363163383931386632643131313939346161343438
38353733393938356266353761326635316239373964656535633937643830373161646661333130
36646364646361343336326662346361616239653964646537306366333234313833623337653732
66623238613961303131356632343163323264616664373638653331656561663333306133386630
62333662306234663036333062646635303662646136396666343535383565386664313239656633
32663366323964306362346366393734623630376432373936316362616639363636306439623636
34313165663264653235636632386563323964373863396363303934336138323435333462373033
34373163623864623836646435333730386137383634333066653865666331303438616462366134
63343837373130616638646338643339393432343130323838303837636566626436336538396463
65393332343964663233623634363234643266386634336231303930396463303537373466633565
64393966306161336265393936656364383237363065326130356331643766383166656536643263
32636236333637663737366666616461653939303033643730623137353735663234636438623431
38623931343939376661633438336563383365633336343563646134376230613930626461383133
39616535646166333435363234643939376464323730333263633333616531393666363561633133
36396464383662623439616630633361316339306139393434383932663464653634393064343061
63643338396432326539363166366163373336616137326566643764303361636130613439663036
38376261326333373061653862663833313563363537373534336638656632313033616238393638
63353435613231316439366535656139623366333534303662323839336232646636346166653866
36633138396363616663306535353432313938306535376361353065323935303266386332343730
36346335386238666235333263626265353431616262313537396336353232363964316538303363
36303165313462653336653863343233323336383835336230393836343332376165653866643738
65393734393037303162653930313564303837353631623632343561336561383062613363653238
37353234616333356432643731343535313434613534323835613465656432333735643863386264
61653235333239663739353738323264333930653337323431666461636265383836663539323531
39633761323536306536633064666161383839626437666430613963353430366435383630386232
35646439303031643035616133326433326163333830643436663262633665653365343830653630
37613235623462623937383330656530363033336636653534316235636336636137333537393434
33663664303437396632663630643166393631613566646165386333363035373733393333623365
62313862383432396362363565636361623630313161653436633366323836333566396363313535
39623166313239663638643134613364623934303438313136353562633962336538
66633532633065306238613537323739643935353461666533613435353935386237353935636231
3235643564396462323063353264633436353335633333660a623236313663336361313739363564
63653464316464373031383636326465396436373639646136663466343464323262623136303361
3066653062326230310a393534653837323735393339326434356437373436303634646235396130
65353635323065343132353162636531653339313665656166393238356232633763653730383633
32636134336565666564616434373539353031366261303761613361336664353638303739396265
39666132353966323738623966383439313332323230333462356463353935653635613435393232
34643436313665663362393037636536386634623137623665663464366563393061643335386433
63353138653331623331323634663137346661653264326562396136323033346239643962366466
61313038646233663662363530336365656166646434393737383064653635666361363462633564
33336335636366373061366361333034353466346631353432633738356464653162373237623066
36616264323436343465313837326464363531656135626463366432363266363333346533336339
33643439636562373261663465316134373838323931663539353531643764653338393161653732
34333434373234636265383564623630613235313932303839336438623639626538383061336130
61343866656431303034373130636238336463613963366465663862373232626137383336326161
65323030643735653562313664333363663630613137366136313739373932393235663138333733
36336163313136623238643239613763653864623765343463333532326534306166306437643831
38636537333835643635363237303036336432386439643564623632616639323864386630396339
36663039363462653064623565653364303739643962306531626335393433343334343331663239
37613337373937343565313866396335366338303532613434653062653763376134383935633430
61383463326366626536363839373633363330376135306637386335353237303133386264373436
66666332666665363063316366643331663532323165636634313862663966383531333532663834
39393664616135326661316264643361316337336636366461366265653062633232653766623432
32326131303164623234326232616437666436666562376135656339386239336665336236366664
30353538666330346230303335636361656130633139383334393861393462336265313261313135
65323430376461336238626632316561366636616139643131346631316138613037346435393938
61376639343962393535633637346561643339663363356235646363333932346332343639333930
65653238656636313732316337373432316662626331626134346139396131383764656366316631
38313464353035626561633536656136306432663565356366333732396262353031653561303636
37633634393536363964646533333263346231366664323764306233386333353037333766333839
31396433383331386637613334616665633336623162323161323939646137313535363061306261
34383765633134616637386566376132393862326666626363646132643365633964376138663263
64646635663632626165366333636533393966363935616537616138636538373362633334613036
64396335393264666638333162643866316539663135363263666463643431653631373366323235
35343731313461316335656231373434393533363433336563646131316464666537356530353263
65346361653031336236303439396630613130323536313762356135333863383230333637343261
65326165663239383638393431353936663438366263373238313634653361323037323030363733
38623532393165393962356437303562653163383032656239616135623162353233373263393264
36633363633334643637396338383735376663653436346437656235393766356163383964646136
39306366316439383162653539666636623537643961613432643664653862633430666439626435
32333734323930613930306561623833303562323564363861313035663636376232616366383663
33656464663937323933633231323031303937316438346362383663376236623066653332313636
62306332356462316637653036383761393039643437663339313461613631313037306538653531
36353033663938313831613565623561343132306463393734326334353135363332643866353038
35323835343366393466343564343538313837623334393765323530306135343566

9
ansible/roles/jnv.unattended-upgrades/.editorconfig Normal file
View file

@ -0,0 +1,9 @@
root = true
[*]
indent_style = space
indent_size = 2
end_of_line = lf
charset = utf-8
trim_trailing_whitespace = true
insert_final_newline = true

3
ansible/roles/jnv.unattended-upgrades/.gitignore vendored Normal file
View file

@ -0,0 +1,3 @@
.vagrant/
*~
*.log

16
ansible/roles/jnv.unattended-upgrades/.travis.yml Normal file
View file

@ -0,0 +1,16 @@
sudo: required
language: python
services: docker
cache: pip
install:
- pip install ansible docker
- ansible-galaxy install -r tests/requirements.yml -p tests/roles/
script:
- ansible --version
- tests/test.sh
notifications:
webhooks: https://galaxy.ansible.com/api/v1/notifications/

339
ansible/roles/jnv.unattended-upgrades/LICENSE Normal file
View file

@ -0,0 +1,339 @@
GNU GENERAL PUBLIC LICENSE
Version 2, June 1991
Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble
The licenses for most software are designed to take away your
freedom to share and change it. By contrast, the GNU General Public
License is intended to guarantee your freedom to share and change free
software--to make sure the software is free for all its users. This
General Public License applies to most of the Free Software
Foundation's software and to any other program whose authors commit to
using it. (Some other Free Software Foundation software is covered by
the GNU Lesser General Public License instead.) You can apply it to
your programs, too.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
this service if you wish), that you receive source code or can get it
if you want it, that you can change the software or use pieces of it
in new free programs; and that you know you can do these things.
To protect your rights, we need to make restrictions that forbid
anyone to deny you these rights or to ask you to surrender the rights.
These restrictions translate to certain responsibilities for you if you
distribute copies of the software, or if you modify it.
For example, if you distribute copies of such a program, whether
gratis or for a fee, you must give the recipients all the rights that
you have. You must make sure that they, too, receive or can get the
source code. And you must show them these terms so they know their
rights.
We protect your rights with two steps: (1) copyright the software, and
(2) offer you this license which gives you legal permission to copy,
distribute and/or modify the software.
Also, for each author's protection and ours, we want to make certain
that everyone understands that there is no warranty for this free
software. If the software is modified by someone else and passed on, we
want its recipients to know that what they have is not the original, so
that any problems introduced by others will not reflect on the original
authors' reputations.
Finally, any free program is threatened constantly by software
patents. We wish to avoid the danger that redistributors of a free
program will individually obtain patent licenses, in effect making the
program proprietary. To prevent this, we have made it clear that any
patent must be licensed for everyone's free use or not licensed at all.
The precise terms and conditions for copying, distribution and
modification follow.
GNU GENERAL PUBLIC LICENSE
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
0. This License applies to any program or other work which contains
a notice placed by the copyright holder saying it may be distributed
under the terms of this General Public License. The "Program", below,
refers to any such program or work, and a "work based on the Program"
means either the Program or any derivative work under copyright law:
that is to say, a work containing the Program or a portion of it,
either verbatim or with modifications and/or translated into another
language. (Hereinafter, translation is included without limitation in
the term "modification".) Each licensee is addressed as "you".
Activities other than copying, distribution and modification are not
covered by this License; they are outside its scope. The act of
running the Program is not restricted, and the output from the Program
is covered only if its contents constitute a work based on the
Program (independent of having been made by running the Program).
Whether that is true depends on what the Program does.
1. You may copy and distribute verbatim copies of the Program's
source code as you receive it, in any medium, provided that you
conspicuously and appropriately publish on each copy an appropriate
copyright notice and disclaimer of warranty; keep intact all the
notices that refer to this License and to the absence of any warranty;
and give any other recipients of the Program a copy of this License
along with the Program.
You may charge a fee for the physical act of transferring a copy, and
you may at your option offer warranty protection in exchange for a fee.
2. You may modify your copy or copies of the Program or any portion
of it, thus forming a work based on the Program, and copy and
distribute such modifications or work under the terms of Section 1
above, provided that you also meet all of these conditions:
a) You must cause the modified files to carry prominent notices
stating that you changed the files and the date of any change.
b) You must cause any work that you distribute or publish, that in
whole or in part contains or is derived from the Program or any
part thereof, to be licensed as a whole at no charge to all third
parties under the terms of this License.
c) If the modified program normally reads commands interactively
when run, you must cause it, when started running for such
interactive use in the most ordinary way, to print or display an
announcement including an appropriate copyright notice and a
notice that there is no warranty (or else, saying that you provide
a warranty) and that users may redistribute the program under
these conditions, and telling the user how to view a copy of this
License. (Exception: if the Program itself is interactive but
does not normally print such an announcement, your work based on
the Program is not required to print an announcement.)
These requirements apply to the modified work as a whole. If
identifiable sections of that work are not derived from the Program,
and can be reasonably considered independent and separate works in
themselves, then this License, and its terms, do not apply to those
sections when you distribute them as separate works. But when you
distribute the same sections as part of a whole which is a work based
on the Program, the distribution of the whole must be on the terms of
this License, whose permissions for other licensees extend to the
entire whole, and thus to each and every part regardless of who wrote it.
Thus, it is not the intent of this section to claim rights or contest
your rights to work written entirely by you; rather, the intent is to
exercise the right to control the distribution of derivative or
collective works based on the Program.
In addition, mere aggregation of another work not based on the Program
with the Program (or with a work based on the Program) on a volume of
a storage or distribution medium does not bring the other work under
the scope of this License.
3. You may copy and distribute the Program (or a work based on it,
under Section 2) in object code or executable form under the terms of
Sections 1 and 2 above provided that you also do one of the following:
a) Accompany it with the complete corresponding machine-readable
source code, which must be distributed under the terms of Sections
1 and 2 above on a medium customarily used for software interchange; or,
b) Accompany it with a written offer, valid for at least three
years, to give any third party, for a charge no more than your
cost of physically performing source distribution, a complete
machine-readable copy of the corresponding source code, to be
distributed under the terms of Sections 1 and 2 above on a medium
customarily used for software interchange; or,
c) Accompany it with the information you received as to the offer
to distribute corresponding source code. (This alternative is
allowed only for noncommercial distribution and only if you
received the program in object code or executable form with such
an offer, in accord with Subsection b above.)
The source code for a work means the preferred form of the work for
making modifications to it. For an executable work, complete source
code means all the source code for all modules it contains, plus any
associated interface definition files, plus the scripts used to
control compilation and installation of the executable. However, as a
special exception, the source code distributed need not include
anything that is normally distributed (in either source or binary
form) with the major components (compiler, kernel, and so on) of the
operating system on which the executable runs, unless that component
itself accompanies the executable.
If distribution of executable or object code is made by offering
access to copy from a designated place, then offering equivalent
access to copy the source code from the same place counts as
distribution of the source code, even though third parties are not
compelled to copy the source along with the object code.
4. You may not copy, modify, sublicense, or distribute the Program
except as expressly provided under this License. Any attempt
otherwise to copy, modify, sublicense or distribute the Program is
void, and will automatically terminate your rights under this License.
However, parties who have received copies, or rights, from you under
this License will not have their licenses terminated so long as such
parties remain in full compliance.
5. You are not required to accept this License, since you have not
signed it. However, nothing else grants you permission to modify or
distribute the Program or its derivative works. These actions are
prohibited by law if you do not accept this License. Therefore, by
modifying or distributing the Program (or any work based on the
Program), you indicate your acceptance of this License to do so, and
all its terms and conditions for copying, distributing or modifying
the Program or works based on it.
6. Each time you redistribute the Program (or any work based on the
Program), the recipient automatically receives a license from the
original licensor to copy, distribute or modify the Program subject to
these terms and conditions. You may not impose any further
restrictions on the recipients' exercise of the rights granted herein.
You are not responsible for enforcing compliance by third parties to
this License.
7. If, as a consequence of a court judgment or allegation of patent
infringement or for any other reason (not limited to patent issues),
conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot
distribute so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you
may not distribute the Program at all. For example, if a patent
license would not permit royalty-free redistribution of the Program by
all those who receive copies directly or indirectly through you, then
the only way you could satisfy both it and this License would be to
refrain entirely from distribution of the Program.
If any portion of this section is held invalid or unenforceable under
any particular circumstance, the balance of the section is intended to
apply and the section as a whole is intended to apply in other
circumstances.
It is not the purpose of this section to induce you to infringe any
patents or other property right claims or to contest validity of any
such claims; this section has the sole purpose of protecting the
integrity of the free software distribution system, which is
implemented by public license practices. Many people have made
generous contributions to the wide range of software distributed
through that system in reliance on consistent application of that
system; it is up to the author/donor to decide if he or she is willing
to distribute software through any other system and a licensee cannot
impose that choice.
This section is intended to make thoroughly clear what is believed to
be a consequence of the rest of this License.
8. If the distribution and/or use of the Program is restricted in
certain countries either by patents or by copyrighted interfaces, the
original copyright holder who places the Program under this License
may add an explicit geographical distribution limitation excluding
those countries, so that distribution is permitted only in or among
countries not thus excluded. In such case, this License incorporates
the limitation as if written in the body of this License.
9. The Free Software Foundation may publish revised and/or new versions
of the General Public License from time to time. Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.
Each version is given a distinguishing version number. If the Program
specifies a version number of this License which applies to it and "any
later version", you have the option of following the terms and conditions
either of that version or of any later version published by the Free
Software Foundation. If the Program does not specify a version number of
this License, you may choose any version ever published by the Free Software
Foundation.
10. If you wish to incorporate parts of the Program into other free
programs whose distribution conditions are different, write to the author
to ask for permission. For software which is copyrighted by the Free
Software Foundation, write to the Free Software Foundation; we sometimes
make exceptions for this. Our decision will be guided by the two goals
of preserving the free status of all derivatives of our free software and
of promoting the sharing and reuse of software generally.
NO WARRANTY
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
REPAIR OR CORRECTION.
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.
END OF TERMS AND CONDITIONS
How to Apply These Terms to Your New Programs
If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.
To do so, attach the following notices to the program. It is safest
to attach them to the start of each source file to most effectively
convey the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.
<one line to give the program's name and a brief idea of what it does.>
Copyright (C) <year> <name of author>
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License along
with this program; if not, write to the Free Software Foundation, Inc.,
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
Also add information on how to contact you by electronic and paper mail.
If the program is interactive, make it output a short notice like this
when it starts in an interactive mode:
Gnomovision version 69, Copyright (C) year name of author
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
This is free software, and you are welcome to redistribute it
under certain conditions; type `show c' for details.
The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License. Of course, the commands you use may
be called something other than `show w' and `show c'; they could even be
mouse-clicks or menu items--whatever suits your program.
You should also get your employer (if you work as a programmer) or your
school, if any, to sign a "copyright disclaimer" for the program, if
necessary. Here is a sample; alter the names:
Yoyodyne, Inc., hereby disclaims all copyright interest in the program
`Gnomovision' (which makes passes at compilers) written by James Hacker.
<signature of Ty Coon>, 1 April 1989
Ty Coon, President of Vice
This General Public License does not permit incorporating your program into
proprietary programs. If your program is a subroutine library, you may
consider it more useful to permit linking proprietary applications with the
library. If this is what you want to do, use the GNU Lesser General
Public License instead of this License.

180
ansible/roles/jnv.unattended-upgrades/README.md Normal file
View file

@ -0,0 +1,180 @@
# Unattended-Upgrades Role for Ansible
[![Build Status of branch master](https://img.shields.io/travis/jnv/ansible-role-unattended-upgrades/master.svg?style=flat-square)](https://travis-ci.org/jnv/ansible-role-unattended-upgrades)
[![Ansible Role: jnv.unattended-upgrades](https://img.shields.io/ansible/role/8068.svg?style=flat-square)](https://galaxy.ansible.com/jnv/unattended-upgrades/)
Install and setup [unattended-upgrades](https://launchpad.net/unattended-upgrades) for Ubuntu and Debian (since Wheezy), to periodically install security upgrades.
**NOTE:** If you have used version 0.0.1 of the role, you can delete the file `/etc/apt/apt.conf.d/10periodic` as it is not needed anymore. You can use the following one-shot command:
ansible -m file -a "state=absent path=/etc/apt/apt.conf.d/10periodic" <host-pattern>
## Requirements
The role uses [apt module](http://docs.ansible.com/apt_repository_module.html) which has additional dependencies.
If you set `unattended_mail` to an e-mail address, make sure `mailx` command is available and your system is able to send e-mails.
The role requires unattended-upgrades version 0.70 and newer, which is available since Debian Wheezy and Ubuntu 12.04 respectively. This is due to [Origins Patterns](#origins-patterns) usage; if this is not available on your system, you may use [the first version of the role](https://github.com/jnv/ansible-role-unattended-upgrades/tree/v0.1).
### Automatic Reboot
If you enable automatic reboot feature (`unattended_automatic_reboot`), the role will attempt to install `update-notifier-common` package, which is required on some systems for detecting and executing reboot after the upgrade. You may optionally define a specific time for rebooting (`unattended_automatic_reboot_time`).
This feature was broken in Debian Jessie, but eventually was rolled into the unattended-upgrades package; see [the discussion in #6](https://github.com/jnv/ansible-role-unattended-upgrades/issues/6) for more details.
## Disabled Cron Jobs
On some hosts you may find that the unattended-upgrade's cronfile `/etc/cron.daily/apt` file has been renamed to `apt.disabled`. This is possibly provider's decision, to save some CPU cycles. Use [enable-standard-cronjobs](https://github.com/Yannik/ansible-role-enable-standard-cronjobs) role to reenable unattended-upgrades. See also discussion in [#9](https://github.com/jnv/ansible-role-unattended-upgrades/issues/9).
## Role Variables
* `unattended_cache_valid_time`: Update the apt cache if its older than the given time in seconds; passed to the [apt module](https://docs.ansible.com/ansible/latest/apt_module.html) during package installation.
* Default: `3600`
* `unattended_origins_patterns`: array of origins patterns to determine whether the package can be automatically installed, for more details see [Origins Patterns](#origins-patterns) below.
* Default for Debian: `['origin=Debian,codename=${distro_codename},label=Debian-Security']`
* Default for Ubuntu: `['origin=Ubuntu,archive=${distro_codename}-security,label=Ubuntu']`
* `unattended_package_blacklist`: packages which won't be automatically upgraded
* Default: `[]`
* `unattended_autofix_interrupted_dpkg`: whether on unclean dpkg exit to run `dpkg --force-confold --configure -a`
* Default: `true`
* `unattended_minimal_steps`: split the upgrade into the smallest possible chunks so that they can be interrupted with SIGUSR1.
* Default: `true`
* `unattended_install_on_shutdown`: install all unattended-upgrades when the machine is shuting down.
* Default: `false`
* `unattended_mail`: e-mail address to send information about upgrades or problems with unattended upgrades
* Default: `false` (don't send any e-mail)
* `unattended_mail_only_on_error`: send e-mail only on errors, otherwise e-mail will be sent every time there's a package upgrade.
* Default: `false`
* `unattended_remove_unused_dependencies`: do automatic removal of new unused dependencies after the upgrade.
* Default: `false`
* `unattended_automatic_reboot`: Automatically reboot system if any upgraded package requires it, immediately after the upgrade.
* Default: `false`
* `unattended_automatic_reboot_time`: Automatically reboot system if any upgraded package requires it, at the specific time (_HH:MM_) instead of immediately after the upgrade.
* Default: `false`
* `unattended_update_days`: Set the days of the week that updates should be applied. The days can be specified as localized abbreviated or full names. Or as integers where "0" is Sunday, "1" is Monday etc. Example: `{"Mon";"Fri"};`
* Default: disabled
* `unattended_ignore_apps_require_restart`: unattended-upgrades won't automatically upgrade some critical packages requiring restart after an upgrade (i.e. there is `XB-Upgrade-Requires: app-restart` directive in their debian/control file). With this option set to `true`, unattended-upgrades will upgrade these packages regardless of the directive.
* Default: `false`
* `unattended_verbose`: Define verbosity level of APT for periodic runs. The output will be sent to root.
* Possible options:
* `0`: no report
* `1`: progress report
* `2`: + command outputs
* `3`: + trace on
* Default: `0` (no report)
* `unattended_update_package_list`: Do "apt-get update" automatically every n-days (0=disable)
* Default: `1`
* `unattended_download_upgradeable`: Do "apt-get upgrade --download-only" every n-days (0=disable)
* Default: `0`
* `unattended_autoclean_interval`: Do "apt-get autoclean" every n-days (0=disable)
* Default: `7`
* `unattended_clean_interval`: Do "apt-get clean" every n-days (0=disable)
* Default: `0`
* `unattended_random_sleep`: Define maximum for a random interval in seconds after which the apt job starts (only for systems without systemd)
* Default: `1800` (30 minutes)
* `unattended_dpkg_options`: Array of dpkg command-line options used during unattended-upgrades runs, e.g. `["--force-confdef"]`, `["--force-confold"]`
* Default: `[]`
* `unattended_dl_limit`: Limit the download speed in kb/sec using apt bandwidth limit feature.
* Default: disabled
## Origins Patterns
Origins Pattern is a more powerful alternative to the Allowed Origins option used in previous versions of unattended-upgrade.
Pattern is composed from specific keywords:
* `a`,`archive`,`suite` – e.g. `stable`, `trusty-security` (`archive=stable`)
* `c`,`component` – e.g. `main`, `crontrib`, `non-free` (`component=main`)
* `l`,`label` – e.g. `Debian`, `Debian-Security`, `Ubuntu`
* `o`,`origin` – e.g. `Debian`, `Unofficial Multimedia Packages`, `Ubuntu`
* `n`,`codename` – e.g. `jessie`, `jessie-updates`, `trusty` (this is only supported with `unattended-upgrades` >= 0.80)
* `site` – e.g. `http.debian.net`
You can review the available repositories using `apt-cache policy` and debug your choice using `unattended-upgrades -d` command on a target system.
Additionally unattended-upgrades support two macros (variables), derived from `/etc/debian_version`:
* `${distro_id}` – Installed distribution name, e.g. `Debian` or `Ubuntu`.
* `${distro_codename}` – Installed codename, e.g. `jessie` or `trusty`.
Using `${distro_codename}` should be preferred over using `stable` or `oldstable` as a selected, as once `stable` moves to `oldstable`, no security updates will be installed at all, or worse, package from a newer distro release will be installed by accident. The same goes for upgrading your installation from `oldstable` to `stable`, if you forget to change this in your origin patterns, you may not receive the security updates for your newer distro release. With `${distro_codename}`, both cases can never happen.
## Role Usage Example
Example for Ubuntu, with custom [origins patterns](#patterns-examples), blacklisted packages and e-mail notification:
```yaml
- hosts: all
roles:
- role: jnv.unattended-upgrades
unattended_origins_patterns:
- 'origin=Ubuntu,archive=${distro_codename}-security'
- 'o=Ubuntu,a=${distro_codename}-updates'
unattended_package_blacklist: [cowsay, vim]
unattended_mail: 'root@example.com'
```
_Note:_ You don't need to specify `unattended_origins_patterns`, the role will use distribution's default if the variable is not set.
### Patterns Examples
By default, only security updates are allowed for both Ubuntu and Debian. You can add more patterns to allow unattended-updates install more packages automatically, however be aware that automated major updates may potentially break your system.
#### For Debian
```yaml
unattended_origins_patterns:
- 'origin=Debian,codename=${distro_codename},label=Debian-Security' # security updates
- 'o=Debian,codename=${distro_codename},label=Debian' # updates including non-security updates
- 'o=Debian,codename=${distro_codename},a=proposed-updates'
```
On debian wheezy, due to `unattended-upgrades` being `0.79.5`, you cannot use the `codename` directive.
You will have to do archive based matching instead:
```yaml
unattended_origins_patterns:
- 'origin=Debian,a=stable,label=Debian-Security' # security updates
- 'o=Debian,a=stable,l=Debian' # updates including non-security updates
- 'o=Debian,a=proposed-updates'
```
Please be sure to read about the issues regarding this in the origin pattern documentation above.
#### For Ubuntu
In Ubuntu, archive always contains the distribution codename
```yaml
unattended_origins_patterns:
- 'origin=Ubuntu,archive=${distro_codename}-security'
- 'o=Ubuntu,a=${distro_codename}'
- 'o=Ubuntu,a=${distro_codename}-updates'
- 'o=Ubuntu,a=${distro_codename}-proposed-updates'
```
#### For Raspbian
In Raspbian, it is only possible to update all packages from the default repository, including non-security updates, or updating none.
Updating all, including non-security:
```yaml
unattended_origins_patterns:
- 'origin=Raspbian,codename=${distro_codename},label=Raspbian'
```
You can not use the `codename` directive on raspbian wheezy, the same as with debian wheezy above.
To not install any updates on a raspbian host, just set `unattended_origins_patterns` to an empty list:
```
unattended_origins_patterns: []
```
## License
GPLv2

122
ansible/roles/jnv.unattended-upgrades/defaults/main.yml Normal file
View file

@ -0,0 +1,122 @@
---
# Cache update time for apt module
unattended_cache_valid_time: 3600
#Unattended-Upgrade::Origins-Pattern
# Automatically upgrade packages from these origin patterns
# e.g.: 'o=Debian,a=stable', 'o=Debian,a=stable-updates'
#
# Left unset, distribution-specific defaults will be used through
# __unattended_origins_patterns variable only if this variable
# is not provided externally
# REFS https://github.com/ansible/ansible/issues/8121
#unattended_origins_patterns: []
#Unattended-Upgrade::Package-Blacklist
# List of packages to not update
unattended_package_blacklist: []
#Unattended-Upgrade::AutoFixInterruptedDpkg
# On a unclean dpkg exit unattended-upgrades will run
# dpkg --force-confold --configure -a
# The default is true, to ensure updates keep getting installed
unattended_autofix_interrupted_dpkg: true
#Unattended-Upgrade::MinimalSteps
# Split the upgrade into the smallest possible chunks so that
# they can be interrupted with SIGUSR1. This makes the upgrade
# a bit slower but it has the benefit that shutdown while a upgrade
# is running is possible (with a small delay)
unattended_minimal_steps: true
#Unattended-Upgrade::InstallOnShutdown
# Install all unattended-upgrades when the machine is shuting down
# instead of doing it in the background while the machine is running
# This will (obviously) make shutdown slower
unattended_install_on_shutdown: false
#Unattended-Upgrade::Mail
# Send email to this address for problems or packages upgrades
# If empty or unset then no email is sent, make sure that you
# have a working mail setup on your system. A package that provides
# 'mailx' must be installed.
unattended_mail: false
#Unattended-Upgrade::MailOnlyOnError
# Set this value to "true" to get emails only on errors. Default
# is to always send a mail if Unattended-Upgrade::Mail is set
unattended_mail_only_on_error: false
#Unattended-Upgrade::Remove-Unused-Dependencies
# Do automatic removal of new unused dependencies after the upgrade
# (equivalent to apt-get autoremove)
unattended_remove_unused_dependencies: false
#Unattended-Upgrade::Automatic-Reboot
# Automatically reboot *WITHOUT CONFIRMATION* if a
# the file /var/run/reboot-required is found after the upgrade
unattended_automatic_reboot: false
#Unattended-Upgrade::Automatic-Reboot-Time
# If automatic reboot is enabled and needed, reboot at the specific
# time instead of immediately
unattended_automatic_reboot_time: false
#Unattended-Upgrade::IgnoreAppsRequireRestart
# Do upgrade application even if it requires restart after upgrade
# I.e. "XB-Upgrade-Requires: app-restart" is set in the debian/control file
unattended_ignore_apps_require_restart: false
### APT::Periodic configuration
# Snatched from /usr/lib/apt/apt.systemd.daily
#APT::Periodic::Update-Package-Lists "0";
# - Do "apt-get update" automatically every n-days (0=disable)
unattended_update_package_list: 1
#APT::Periodic::Download-Upgradeable-Packages "0";
# - Do "apt-get upgrade --download-only" every n-days (0=disable)
#unattended_download_upgradeable: 0
#APT::Periodic::AutocleanInterval "0";
# - Do "apt-get autoclean" every n-days (0=disable)
unattended_autoclean_interval: 7
#APT::Periodic::CleanInterval "0";
# - Do "apt-get clean" every n-days (0=disable)
#unattended_clean_interval: 0
#APT::Periodic::Verbose "0";
# - Send report mail to root
# 0: no report (or null string)
# 1: progress report (actually any string)
# 2: + command outputs (remove -qq, remove 2>/dev/null, add -d)
# 3: + trace on
#unattended_verbose: 0
## Cron systems only
#APT::Periodic::RandomSleep
# When the apt job starts, it will sleep for a random period between 0
# and APT::Periodic::RandomSleep seconds
# The default value is "1800" so that the script will stall for up to 30
# minutes (1800 seconds) so that the mirror servers are not crushed by
# everyone running their updates all at the same time
# Kept undefined to allow default (1800)
#unattended_random_sleep: 0
#Dpkg::Options
# Provide dpkg options that take effect during unattended upgrades.
# By default no flags are appended. Configuration file changes can
# block installation of certain packages. Passing the flags
# "--force-confdef" and "--force-confold" will ensure updates are applied
# and old configuration files are preserved.
unattended_dpkg_options: []
# unattended_dpkg_options:
# - "--force-confdef"
# - "--force-confold"
# Use apt bandwidth limit feature, this example limits the download speed to 70kb/sec
#unattended_dl_limit: 70

2
ansible/roles/jnv.unattended-upgrades/handlers/main.yml Normal file
View file

@ -0,0 +1,2 @@
---
# handlers file for unattended-upgrades

2
ansible/roles/jnv.unattended-upgrades/meta/.galaxy_install_info Normal file
View file

@ -0,0 +1,2 @@
install_date: Fri May 15 21:54:44 2020
version: v1.8.0

38
ansible/roles/jnv.unattended-upgrades/meta/main.yml Normal file
View file

@ -0,0 +1,38 @@
---
galaxy_info:
author: Jan Vlnas
description: Setup unattended-upgrades on Debian-based systems
license: GPLv2
min_ansible_version: 1.4
platforms:
- name: Ubuntu
versions:
- precise
- raring
- saucy
- trusty
- utopic
- name: Debian
versions:
- wheezy
- jessie
#
# Below are all categories currently available. Just as with
# the platforms above, uncomment those that apply to your role.
#
categories:
#- cloud
#- cloud:ec2
#- cloud:gce
#- cloud:rax
#- database
#- database:nosql
#- database:sql
#- development
#- monitoring
#- networking
#- packaging
- system
#- web
dependencies: []

2
ansible/roles/jnv.unattended-upgrades/tasks/main.yml Normal file
View file

@ -0,0 +1,2 @@
- include: unattended-upgrades.yml
tags: unattended

9
ansible/roles/jnv.unattended-upgrades/tasks/reboot.yml Normal file
View file

@ -0,0 +1,9 @@
---
# Ignored, since newer distros don't need this package
# https://github.com/jnv/ansible-role-unattended-upgrades/issues/6
- name: install update-notifier-common
apt:
pkg: update-notifier-common
state: present
failed_when: false

34
ansible/roles/jnv.unattended-upgrades/tasks/unattended-upgrades.yml Normal file
View file

@ -0,0 +1,34 @@
---
- name: add distribution-specific variables
include_vars: "{{ ansible_distribution }}.yml"
- name: add Debian Wheezy workaround
include_vars: "{{ ansible_distribution }}-{{ ansible_distribution_release }}.yml"
when: (ansible_distribution == "Debian") and (ansible_distribution_release == "wheezy")
- name: install unattended-upgrades
apt:
pkg: unattended-upgrades
state: present
cache_valid_time: "{{unattended_cache_valid_time}}"
update_cache: yes
- name: install reboot dependencies
include: reboot.yml
when: unattended_automatic_reboot|bool
- name: create APT auto-upgrades configuration
template:
src: auto-upgrades.j2
dest: /etc/apt/apt.conf.d/20auto-upgrades
owner: root
group: root
mode: 0644
- name: create unattended-upgrades configuration
template:
src: unattended-upgrades.j2
dest: /etc/apt/apt.conf.d/50unattended-upgrades
owner: root
group: root
mode: 0644

25
ansible/roles/jnv.unattended-upgrades/templates/auto-upgrades.j2 Normal file
View file

@ -0,0 +1,25 @@
APT::Periodic::Unattended-Upgrade "1";
{% if unattended_update_package_list is defined %}
APT::Periodic::Update-Package-Lists "{{unattended_update_package_list}}";
{% endif %}
{% if unattended_download_upgradeable is defined %}
APT::Periodic::Download-Upgradeable-Packages "{{unattended_download_upgradeable}}";
{% endif %}
{% if unattended_autoclean_interval is defined %}
APT::Periodic::AutocleanInterval "{{unattended_autoclean_interval}}";
{% endif %}
{% if unattended_clean_interval is defined %}
APT::Periodic::CleanInterval "{{unattended_clean_interval}}";
{% endif %}
{% if unattended_verbose is defined %}
APT::Periodic::Verbose "{{unattended_verbose}}";
{% endif %}
{% if unattended_random_sleep is defined %}
APT::Periodic::RandomSleep "{{unattended_random_sleep}}";
{% endif %}

104
ansible/roles/jnv.unattended-upgrades/templates/unattended-upgrades.j2 Normal file
View file

@ -0,0 +1,104 @@
// Unattended-Upgrade::Origins-Pattern controls which packages are
// upgraded.
Unattended-Upgrade::Origins-Pattern {
{% if unattended_origins_patterns is defined %}
{% for origin in unattended_origins_patterns %}
"{{ origin }}";
{% endfor %}
{% else %}
{% for origin in __unattended_origins_patterns %}
"{{ origin }}";
{% endfor %}
{% endif %}
};
// List of packages to not update (regexp are supported)
Unattended-Upgrade::Package-Blacklist {
{% for package in unattended_package_blacklist %}
"{{package}}";
{% endfor %}
};
{% if not unattended_autofix_interrupted_dpkg %}
// This option allows you to control if on a unclean dpkg exit
// unattended-upgrades will automatically run
// dpkg --force-confold --configure -a
// The default is true, to ensure updates keep getting installed
Unattended-Upgrade::AutoFixInterruptedDpkg "false";
{% endif %}
// Split the upgrade into the smallest possible chunks so that
// they can be interrupted with SIGUSR1. This makes the upgrade
// a bit slower but it has the benefit that shutdown while a upgrade
// is running is possible (with a small delay)
Unattended-Upgrade::MinimalSteps "{{ unattended_minimal_steps | lower }}";
{% if unattended_install_on_shutdown %}
// Install all unattended-upgrades when the machine is shuting down
// instead of doing it in the background while the machine is running
// This will (obviously) make shutdown slower
Unattended-Upgrade::InstallOnShutdown "true";
{% endif %}
{% if unattended_mail %}
// Send email to this address for problems or packages upgrades
// If empty or unset then no email is sent, make sure that you
// have a working mail setup on your system. A package that provides
// 'mailx' must be installed.
Unattended-Upgrade::Mail "{{unattended_mail}}";
{% endif %}
{% if unattended_mail_only_on_error %}
// Set this value to "true" to get emails only on errors. Default
// is to always send a mail if Unattended-Upgrade::Mail is set
Unattended-Upgrade::MailOnlyOnError "true";
{% endif %}
{% if unattended_remove_unused_dependencies %}
// Do automatic removal of new unused dependencies after the upgrade
// (equivalent to apt-get autoremove)
Unattended-Upgrade::Remove-Unused-Dependencies "true";
{% endif %}
{% if unattended_automatic_reboot %}
// Automatically reboot *WITHOUT CONFIRMATION* if a
// the file /var/run/reboot-required is found after the upgrade
Unattended-Upgrade::Automatic-Reboot "true";
{% endif %}
{% if unattended_automatic_reboot_time %}
// If automatic reboot is enabled and needed, reboot at the specific
// time instead of immediately
// Default: "now"
Unattended-Upgrade::Automatic-Reboot-Time "{{ unattended_automatic_reboot_time }}";
{% endif %}
{% if unattended_update_days is defined %}
// Set the days of the week that updates should be applied. The days can be specified
// as localized abbreviated or full names. Or as integers where "0" is Sunday, "1" is
// Monday etc.
// Example - apply updates only on Monday and Friday:
// {"Mon";"Fri"};
Unattended-Upgrade::Update-Days {{ unattended_update_days }};
{% endif %}
{% if unattended_ignore_apps_require_restart %}
// Do upgrade application even if it requires restart after upgrade
// I.e. "XB-Upgrade-Requires: app-restart" is set in the debian/control file
Unattended-Upgrade::IgnoreAppsRequireRestart "true";
{% endif %}
{% if unattended_dpkg_options %}
// Append options for governing dpkg behavior, e.g. --force-confdef.
Dpkg::Options {
{% for dpkg_option in unattended_dpkg_options %}
"{{ dpkg_option }}";
{% endfor %}
};
{% endif %}
{% if unattended_dl_limit is defined %}
// Use apt bandwidth limit feature, this example limits the download
// speed to 70kb/sec
Acquire::http::Dl-Limit "{{ unattended_dl_limit }}";
{% endif %}

3
ansible/roles/jnv.unattended-upgrades/tests/ansible.cfg Normal file
View file

@ -0,0 +1,3 @@
[defaults]
roles_path = ../../
retry_files_enabled = False

1
ansible/roles/jnv.unattended-upgrades/tests/inventory Normal file
View file

@ -0,0 +1 @@
localhost ansible_connection=local ansible_python_interpreter="/usr/bin/env python"

3
ansible/roles/jnv.unattended-upgrades/tests/requirements.yml Normal file
View file

@ -0,0 +1,3 @@
---
- src: chrismeyersfsu.provision_docker
name: provision_docker

29
ansible/roles/jnv.unattended-upgrades/tests/test.sh Executable file
View file

@ -0,0 +1,29 @@
#!/bin/bash
# Exit on any individual command failure
set -e
# Pretty colors.
red='\033[0;31m'
green='\033[0;32m'
neutral='\033[0m'
section() {
echo -e "\033[33;1m$1\033[0m"
}
fold_start() {
echo -e "travis_fold:start:$1\033[33;1m$2\033[0m"
}
fold_end() {
echo -e "\ntravis_fold:end:$1\r"
}
# Ensure we are in the tests dir
cd "$( dirname "${BASH_SOURCE[0]}" )"
section "Syntax check"
ansible-playbook -i inventory --syntax-check test.yml
section "Running role"
ansible-playbook -i inventory test.yml

70
ansible/roles/jnv.unattended-upgrades/tests/test.yml Normal file
View file

@ -0,0 +1,70 @@
---
- name: Bring up Docker containers
hosts: localhost
gather_facts: false
vars:
inventory:
- name: ubuntu_latest
image: "ubuntu:latest"
- name: ubuntu_xenial
image: "ubuntu:xenial"
- name: ubuntu_trusty
image: "ubuntu:trusty"
- name: debian_testing
image: "debian:testing"
- name: debian_stable
image: "debian:stable"
- name: debian_oldstable
image: "debian:oldstable"
roles:
- role: provision_docker
provision_docker_inventory: "{{ inventory }}"
provision_docker_privileged: true
provision_docker_use_docker_connection: true
- name: Test role
hosts: docker_containers
gather_facts: false
pre_tasks:
- name: Provision Python
raw: bash -c "test -e /usr/bin/python || (apt-get -y update && apt-get install -y python-simplejson)"
register: output
changed_when: output.stdout
- setup: # Gather facts
vars:
unattended_autofix_interrupted_dpkg: false
unattended_minimal_steps: true
unattended_install_on_shutdown: true
unattended_automatic_reboot: true
unattended_update_days: '{"Sat"}'
roles:
# Searched for in ../.. (see ansible.cfg)
- ansible-role-unattended-upgrades
tasks:
- name: Idempotency check
include_role:
name: ansible-role-unattended-upgrades
register: idempotency
- fail:
msg: Role failed idempotency check
when: idempotency.changed
- name: Get apt-config variables
shell: apt-config dump
register: aptconfig
- name: Check for registered variables
assert:
that: item in aptconfig.stdout
with_items:
- 'APT::Periodic::Unattended-Upgrade "1"'
- 'Unattended-Upgrade::AutoFixInterruptedDpkg "false"'
- 'Unattended-Upgrade::MinimalSteps "true"'
- 'Unattended-Upgrade::InstallOnShutdown "true"'
- 'Unattended-Upgrade::Automatic-Reboot "true"'
# NOTE: this uses the array syntax, which requires one
# top-level record, then one item per line
- 'Unattended-Upgrade::Update-Days "";'
- 'Unattended-Upgrade::Update-Days:: "Sat";'
- name: Dry run unattended-upgrades
command: /usr/bin/unattended-upgrades --dry-run

11
ansible/roles/jnv.unattended-upgrades/vars/Debian-wheezy.yml Normal file
View file

@ -0,0 +1,11 @@
---
# This workaround for Debian Wheezy which doesn't support ${distro_codename} macro
# See
# https://github.com/jnv/ansible-role-unattended-upgrades/issues/19
# https://github.com/jnv/ansible-role-unattended-upgrades/pull/20
# for details
__unattended_origins_patterns:
- 'origin=Debian,archive=stable,label=Debian-Security'
- 'origin=Debian,archive=oldstable,label=Debian-Security'

3
ansible/roles/jnv.unattended-upgrades/vars/Debian.yml Normal file
View file

@ -0,0 +1,3 @@
---
__unattended_origins_patterns:
- 'origin=Debian,codename=${distro_codename},label=Debian-Security'

3
ansible/roles/jnv.unattended-upgrades/vars/Ubuntu.yml Normal file
View file

@ -0,0 +1,3 @@
---
__unattended_origins_patterns:
- 'origin=Ubuntu,archive=${distro_codename}-security,label=Ubuntu'

28
ansible/roles/nginxinc.nginx/.github/ISSUE_TEMPLATE/bug_report.md vendored Normal file
View file

@ -0,0 +1,28 @@
---
name: Bug report
about: Create a report to help us improve
title: ''
labels: ''
assignees: ''
---
**Describe the bug**
A clear and concise description of what the bug is.
**To reproduce**
Steps to reproduce the behavior:
1. Deploy NGINX role using playbook.yml
2. View output/logs/configuration on '...'
3. See error
**Expected behavior**
A clear and concise description of what you expected to happen.
**Your environment:**
- Version of the NGINX Role or specific commit
- Version of Ansible
- Target deployment platform
**Additional context**
Add any other context about the problem here.

20
ansible/roles/nginxinc.nginx/.github/ISSUE_TEMPLATE/feature_request.md vendored Normal file
View file

@ -0,0 +1,20 @@
---
name: Feature request
about: Suggest an idea for this project
title: ''
labels: ''
assignees: ''
---
**Is your feature request related to a problem? Please describe.**
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
**Describe the solution you'd like**
A clear and concise description of what you want to happen.
**Describe alternatives you've considered**
A clear and concise description of any alternative solutions or features you've considered.
**Additional context**
Add any other context or screenshots about the feature request here.

10
ansible/roles/nginxinc.nginx/.github/pull_request_template.md vendored Normal file
View file

@ -0,0 +1,10 @@
### Proposed changes
Describe the use case and detail of the change. If this PR addresses an issue on GitHub, make sure to include a link to that issue here in this description (not in the title of the PR).
### Checklist
Before creating a PR, run through this checklist and mark each as complete.
- [ ] I have read the [CONTRIBUTING](https://github.com/nginxinc/ansible-role-nginx/blob/master/CONTRIBUTING.md) document
- [ ] I have added Molecule tests that prove my fix is effective or that my feature works
- [ ] I have checked that all unit tests pass after adding my changes
- [ ] If required, I have updated necessary documentation (`defaults/main/` and `README.md`)

15
ansible/roles/nginxinc.nginx/.gitignore vendored Normal file
View file

@ -0,0 +1,15 @@
# Any private crt and keys #
############################
*.crt
*.key
__pycache__
*~
\#*
# OS Specific
Thumbs.db
.DS_Store
.vscode
# Ansible specific
*.retry

56
ansible/roles/nginxinc.nginx/.travis.yml Normal file
View file

@ -0,0 +1,56 @@
---
language: python
services:
- docker
jobs:
include:
- name: "Install Specific Version Test - Debian"
env: scenario=default
- name: "Install Specific Version Test - Alpine"
env: scenario=default_alpine
- name: "Install Specific Version Test - CentOS"
env: scenario=default_centos
- name: "Install Modules Test - Debian"
env: scenario=module
- name: "Install Modules Test - Alpine"
env: scenario=module_alpine
- name: "Install Modules Test - CentOS"
env: scenario=module_centos
- name: "Install Stable Branch and Push Configuration Test - Debian"
env: scenario=stable_push
- name: "Install Stable Branch and Push Configuration Test - Alpine"
env: scenario=stable_push_alpine
- name: "Install Stable Branch and Push Configuration Test - CentOS"
env: scenario=stable_push_centos
- name: "Use Template Setting Test - Debian"
env: scenario=template
- name: "Use Template Setting Test - Alpine"
env: scenario=template_alpine
- name: "Use Template Setting Test - CentOS"
env: scenario=template_centos
- name: "Install Unit Test - Debian"
env: scenario=unit
- name: "Install Unit Test - Alpine"
env: scenario=unit_alpine
- name: "Install Unit Test - CentOS"
env: scenario=unit_centos
- name: "Install from Source Test - Debian"
env: scenario=source
- name: "Install from Source Test - Alpine"
env: scenario=source_alpine
- name: "Install from Source Test - CentOS"
env: scenario=source_centos
before_install:
- sudo apt-get -qq update
install:
- pip install ansible==2.9.6
- pip install molecule[docker]>=3.0.0
- pip install testinfra
- pip install ansible-lint
- pip install flake8
script:
- molecule --version
- ansible --version
- travis_wait 50 molecule test -s $scenario
notifications:
webhooks: https://galaxy.ansible.com/api/v1/notifications/

13
ansible/roles/nginxinc.nginx/.yamllint Normal file
View file

@ -0,0 +1,13 @@
---
extends: default
rules:
braces:
max-spaces-inside: 1
level: error
brackets:
max-spaces-inside: 1
level: error
comments-indentation: disable
line-length: disable
truthy: disable

76
ansible/roles/nginxinc.nginx/CODE_OF_CONDUCT.md Normal file
View file

@ -0,0 +1,76 @@
# Contributor Covenant Code of Conduct
## Our Pledge
In the interest of fostering an open and welcoming environment, we as
contributors and maintainers pledge to making participation in our project and
our community a harassment-free experience for everyone, regardless of age, body
size, disability, ethnicity, sex characteristics, gender identity and expression,
level of experience, education, socio-economic status, nationality, personal
appearance, race, religion, or sexual identity and orientation.
## Our Standards
Examples of behavior that contributes to creating a positive environment
include:
* Using welcoming and inclusive language
* Being respectful of differing viewpoints and experiences
* Gracefully accepting constructive criticism
* Focusing on what is best for the community
* Showing empathy towards other community members
Examples of unacceptable behavior by participants include:
* The use of sexualized language or imagery and unwelcome sexual attention or
advances
* Trolling, insulting/derogatory comments, and personal or political attacks
* Public or private harassment
* Publishing others' private information, such as a physical or electronic
address, without explicit permission
* Other conduct which could reasonably be considered inappropriate in a
professional setting
## Our Responsibilities
Project maintainers are responsible for clarifying the standards of acceptable
behavior and are expected to take appropriate and fair corrective action in
response to any instances of unacceptable behavior.
Project maintainers have the right and responsibility to remove, edit, or
reject comments, commits, code, wiki edits, issues, and other contributions
that are not aligned to this Code of Conduct, or to ban temporarily or
permanently any contributor for other behaviors that they deem inappropriate,
threatening, offensive, or harmful.
## Scope
This Code of Conduct applies both within project spaces and in public spaces
when an individual is representing the project or its community. Examples of
representing a project or community include using an official project e-mail
address, posting via an official social media account, or acting as an appointed
representative at an online or offline event. Representation of a project may be
further defined and clarified by project maintainers.
## Enforcement
Instances of abusive, harassing, or otherwise unacceptable behavior may be
reported by contacting the project team at nginx@nginx.org. All
complaints will be reviewed and investigated and will result in a response that
is deemed necessary and appropriate to the circumstances. The project team is
obligated to maintain confidentiality with regard to the reporter of an incident.
Further details of specific enforcement policies may be posted separately.
Project maintainers who do not follow or enforce the Code of Conduct in good
faith may face temporary or permanent repercussions as determined by other
members of the project's leadership.
## Attribution
This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
[homepage]: https://www.contributor-covenant.org
For answers to common questions about this code of conduct, see
https://www.contributor-covenant.org/faq

72
ansible/roles/nginxinc.nginx/CONTRIBUTING.md Normal file
View file

@ -0,0 +1,72 @@
# Contributing Guidelines
The following is a set of guidelines for contributing to the NGINX Ansible role. We really appreciate that you are considering contributing!
#### Table Of Contents
[Ask a Question](#ask-a-question)
[Getting Started](#getting-started)
[Contributing](#contributing)
[Code Guidelines](#code-guidelines)
* [Git Guidelines](#git-guidelines)
* [Ansible Guidelines](#ansible-guidelines)
[Code of Conduct](https://github.com/nginxinc/ansible-role-nginx/blob/master/CODE_OF_CONDUCT.md)
## Ask a Question
Please open an Issue on GitHub with the label `question`.
## Getting Started
Follow our [Installation Guide](https://github.com/nginxinc/ansible-role-nginx/blob/master/README.md#Installation) to install Ansible and Molecule and get ready to use the NGINX Ansible role.
### Project Structure
* The NGINX Ansible role is written in `yaml` and supports open source NGINX, NGINX Plus, NGINX Amplify, and NGINX Unit.
* The project follows the standard [Ansible role directory structure](https://docs.ansible.com/ansible/latest/user_guide/playbooks_reuse_roles.html)
* The main code is found at `tasks/`
* The main variables can be found at `defaults/main/`
* Configuration templates for NGINX can be found at `templates/`
* [Molecule](https://molecule.readthedocs.io/) tests can be found in `molecule/`.
* CI/CD is done via Travis using `.travis.yml` Deployment yaml files, and Helm files are found at `deployments/`
## Contributing
### Report a Bug
To report a bug, open an issue on GitHub with the label `bug` using the available bug report issue template. Please ensure the issue has not already been reported.
### Suggest an Enhancement
To suggest an enhancement, please create an issue on GitHub with the label `enhancement` using the available feature issue template.
### Open a Pull Request
* Fork the repo, create a branch, submit a PR when your changes are tested and ready for review
* Fill in [our pull request template](https://github.com/nginxinc/ansible-role-nginx/blob/master/.github/PULL_REQUEST_TEMPLATE.md)
Note: if you’d like to implement a new feature, please consider creating a feature request issue first to start a discussion about the feature.
## Code Guidelines
### Git Guidelines
* Keep a clean, concise and meaningful git commit history on your branch (within reason), rebasing locally and squashing before submitting a PR
* Follow the guidelines of writing a good commit message as described here <https://chris.beams.io/posts/git-commit/> and summarised in the next few points
* In the subject line, use the present tense ("Add feature" not "Added feature")
* In the subject line, use the imperative mood ("Move cursor to..." not "Moves cursor to...")
* Limit the subject line to 72 characters or less
* Reference issues and pull requests liberally after the subject line
* Add more detailed description in the body of the git message (`git commit -a` to give you more space and time in your text editor to write a good message instead of `git commit -am`)
### Ansible Guidelines
* Run `molecule lint` over your code to automatically resolve a lot of `yaml` and Ansible style issues.
* Run `molecule test --all` on your code to catch any other issues.
* Follow these guides on some good practices for Ansible:
* <https://www.ansible.com/blog/ansible-best-practices-essentials>
* <https://docs.ansible.com/ansible/latest/user_guide/playbooks_best_practices.html>

201
ansible/roles/nginxinc.nginx/LICENSE Normal file
View file

@ -0,0 +1,201 @@
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by Licensor and
subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding those notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS
APPENDIX: How to apply the Apache License to your work.
To apply the Apache License to your work, attach the following
boilerplate notice, with the fields enclosed by brackets "[]"
replaced with your own identifying information. (Don't include
the brackets!) The text should be enclosed in the appropriate
comment syntax for the file format. We also recommend that a
file or class name and description of purpose be included on the
same "printed page" as the copyright notice for easier
identification within third-party archives.
Copyright [yyyy] [name of copyright owner]
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

414
ansible/roles/nginxinc.nginx/README.md Normal file
View file

@ -0,0 +1,414 @@
Ansible NGINX Role
==================
[![Ansible Galaxy](https://img.shields.io/badge/galaxy-nginxinc.nginx-5bbdbf.svg)](https://galaxy.ansible.com/nginxinc/nginx)
[![Build Status](https://travis-ci.org/nginxinc/ansible-role-nginx.svg?branch=master)](https://travis-ci.org/nginxinc/ansible-role-nginx)
This role installs NGINX Open Source, NGINX Plus, the NGINX Amplify agent, or NGINX Unit on your target host.
**Note:** This role is still in active development. There may be unidentified issues and the role variables may change as development continues.
Requirements
------------
**Ansible**
This role was developed and tested with [maintained](https://docs.ansible.com/ansible/latest/reference_appendices/release_and_maintenance.html#release-status) versions of Ansible. Backwards compatibility is not guaranteed.
Instructions on how to install Ansible can be found in the [Ansible website](https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html).
**Molecule**
Molecule is used to test the various functionailities of the role. Instructions on how to install Molecule can be found in the [Molecule website](https://molecule.readthedocs.io/en/latest/installation.html).
Installation
------------
**Ansible Galaxy**
Use `ansible-galaxy install nginxinc.nginx` to install the latest stable release of the role on your system.
**Git**
Use `git clone https://github.com/nginxinc/ansible-role-nginx.git` to pull the latest edge commit of the role from GitHub.
Platforms
---------
The NGINX Ansible role supports all platforms supported by [NGINX Open Source](https://nginx.org/en/linux_packages.html#mainline), [NGINX Plus](https://www.nginx.com/products/technical-specs/), the [NGINX Amplify agent](https://github.com/nginxinc/nginx-amplify-doc/blob/master/amplify-faq.md#21-what-operating-systems-are-supported), and [NGINX Unit](https://unit.nginx.org/installation/#official-packages):
**NGINX Open Source**
```yaml
Alpine:
versions:
- 3.8
- 3.9
- 3.10
- 3.11
CentOS:
versions:
- 6
- 7
- 8
Debian:
versions:
- stretch
- buster
FreeBSD:
versions:
- 11.2+
- 12
RedHat:
versions:
- 6
- 7.4+
- 8
SUSE/SLES:
versions:
- 12
- 15
Ubuntu:
versions:
- xenial
- bionic
```
**NGINX Plus**
```yaml
Alpine:
versions:
- 3.8
- 3.9
- 3.10
- 3.11
Amazon Linux:
versions:
- 2018.03
Amazon Linux 2:
versions:
- LTS
CentOS:
versions:
- 6.5+
- 7.4+
- 8
Debian:
versions:
- stretch
- buster
FreeBSD:
versions:
- 11.2+
- 12
Oracle Linux:
versions:
- 6.5+
- 7.4+
RedHat:
versions:
- 6.5+
- 7.4+
- 8
SUSE/SLES:
versions:
- 12
- 15
Ubuntu:
versions:
- xenial
- bionic
```
**NGINX Amplify Agent**
```yaml
Amazon Linux:
versions:
- 2017.09
CentOS:
versions:
- 6
- 7
Debian:
versions:
- jessie
- stretch
Ubuntu:
versions:
- xenial
- bionic
RedHat:
versions:
- 6
- 7
```
**NGINX Unit**
```yaml
CentOS:
versions:
- 6
- 7
RedHat:
versions:
- 6
- 7
Debian:
versions:
- jessie
- stretch
- buster
Ubuntu:
versions:
- xenial
- bionic
Amazon Linux:
versions:
- 2018.03
Amazon Linux 2:
versions:
- 2
FreeBSD:
versions:
- 10
- 11
```
Role Variables
--------------
This role has multiple variables. The descriptions and defaults for all these variables can be found in the directory **`defaults/main`** in the following files:
- **[defaults/main/main.yml](./defaults/main/main.yml):** NGINX installation variables
- **[defaults/main/amplify.yml](./defaults/main/amplify.yml):** NGINX Amplify agent installation variables
- **[defaults/main/template.yml](./defaults/main/template.yml):** NGINX configuration templating variables
- **[defaults/main/upload.yml](./defaults/main/upload.yml):** NGINX configuration/HTML/SSL upload variables
- **[defaults/main/linux.yml](./defaults/main/linux.yml):** Linux installation variables
- **[defaults/main/bsd.yml](./defaults/main/bsd.yml):** BSD installation variables
- **[defaults/main/unit.yml](./defaults/main/unit.yml):** NGINX Unit installation variables
Dependencies
------------
None
Example Playbook
----------------
This is a sample playbook file for deploying the Ansible Galaxy NGINX role in a localhost and installing the open source version of NGINX.
```yaml
---
- hosts: localhost
become: true
roles:
- role: nginxinc.nginx
```
This is a sample playbook file for deploying the Ansible Galaxy NGINX role to a dynamic inventory containing the `nginx` tag.
```yaml
---
- hosts: tag_nginx
remote_user: root
roles:
- role: nginxinc.nginx
```
This is a sample playbook file for deploying the Ansible Galaxy NGINX role in a localhost and installing the open source version of NGINX as a simple web server.
```yaml
---
- hosts: localhost
become: true
roles:
- role: nginxinc.nginx
vars:
nginx_http_template_enable: true
nginx_http_template:
default:
template_file: http/default.conf.j2
conf_file_name: default.conf
conf_file_location: /etc/nginx/conf.d/
servers:
server1:
listen:
listen_localhost:
# ip: 0.0.0.0
port: 80
server_name: localhost
error_page: /usr/share/nginx/html
autoindex: false
web_server:
locations:
default:
location: /
html_file_location: /usr/share/nginx/html
html_file_name: index.html
autoindex: false
http_demo_conf: false
```
This is a sample playbook file for deploying the Ansible Galaxy NGINX role in a localhost and installing the open source version of NGINX as a reverse proxy.
```yaml
---
- hosts: localhost
become: true
roles:
- role: nginxinc.nginx
vars:
nginx_http_template_enable: true
nginx_http_template:
default:
template_file: http/default.conf.j2
conf_file_name: default.conf
conf_file_location: /etc/nginx/conf.d/
servers:
server1:
listen:
listen_localhost:
# ip: 0.0.0.0
port: 80
opts:
- default_server
server_name: localhost
error_page: /usr/share/nginx/html
autoindex: false
reverse_proxy:
locations:
frontend:
location: /
proxy_pass: http://frontend_servers
backend:
location: /backend
proxy_pass: http://backend_servers
upstreams:
upstream_1:
name: frontend_servers
lb_method: least_conn
zone_name: frontend
zone_size: 64k
sticky_cookie: false
servers:
frontend_server_1:
address: 0.0.0.0
port: 8081
weight: 1
health_check: max_fails=3 fail_timeout=5s
upstream_2:
name: backend_servers
lb_method: least_conn
zone_name: backend
zone_size: 64k
sticky_cookie: false
servers:
backend_server_1:
address: 0.0.0.0
port: 8082
weight: 1
health_check: max_fails=3 fail_timeout=5s
frontend:
template_file: http/default.conf.j2
conf_file_name: frontend_default.conf
conf_file_location: /etc/nginx/conf.d/
servers:
server1:
listen:
listen_localhost:
ip: 0.0.0.0
port: 8081
ssl: false
opts: []
server_name: localhost
error_page: /usr/share/nginx/html
autoindex: false
web_server:
locations:
frontend_site:
location: /
proxy_hide_headers:
- X-Powered-By
html_file_location: /usr/share/nginx/html
html_file_name: index.html
autoindex: false
http_demo_conf: false
backend:
template_file: http/default.conf.j2
conf_file_name: backend_default.conf
conf_file_location: /etc/nginx/conf.d/
servers:
server1:
listen:
listen_localhost:
ip: 0.0.0.0
port: 8082
ssl: false
opts: []
server_name: localhost
error_page: /usr/share/nginx/html
autoindex: false
web_server:
locations:
backend_site:
location: /
html_file_location: /usr/share/nginx/html
html_file_name: index.html
autoindex: false
http_demo_conf: false
```
This is a sample playbook file for deploying the Ansible Galaxy NGINX role in a localhost and installing NGINX Plus.
```yaml
---
- hosts: localhost
become: true
roles:
- role: nginxinc.nginx
vars:
nginx_type: plus
```
This is a sample playbook file for deploying the Ansible Galaxy NGINX role in a localhost to install NGINX Unit and the PHP/Perl NGINX Unit language modules.
```yaml
---
- hosts: localhost
become: true
roles:
- role: nginxinc.nginx
vars:
nginx_enable: false
nginx_unit_enable: true
nginx_unit_modules:
- unit-php
- unit-perl
```
To run any of the above sample playbooks create a `setup-nginx.yml` file and paste the contents. Executing the Ansible Playbook is then as simple as executing `ansible-playbook setup-nginx.yml`.
Alternatively, you can also clone this repository instead of installing it from Ansible Galaxy. If you decide to do so, replace the role variable in the previous sample playbooks from `nginxinc.nginx` to `ansible-role-nginx`.
Other NGINX Roles
-----------------
You can find an Ansible collection of roles to help you install and configure NGINX Controller [here](https://github.com/nginxinc/ansible-collection-nginx_controller)
License
-------
[Apache License, Version 2.0](https://github.com/nginxinc/ansible-role-nginx/blob/master/LICENSE)
Author Information
------------------
[Alessandro Fael Garcia](https://github.com/alessfg)
[Grzegorz Dzien](https://github.com/gdzien)
&copy; [NGINX, Inc.](https://www.nginx.com/) 2018 - 2020

7
ansible/roles/nginxinc.nginx/defaults/main/amplify.yml Normal file
View file

@ -0,0 +1,7 @@
---
# Install NGINX Amplify.
# Use your NGINX Amplify API key.
# Requires access to either the NGINX stub status or the NGINX Plus REST API.
# Default is null.
nginx_amplify_enable: false
nginx_amplify_api_key: null

26
ansible/roles/nginxinc.nginx/defaults/main/bsd.yml Normal file
View file

@ -0,0 +1,26 @@
---
# Supported distributions
nginx_bsd_systems: ['FreeBSD', 'NetBSD', 'OpenBSD', 'DragonFlyBSD', 'HardenedBSD']
# Supported distributions NGINX Plus
# https://docs.nginx.com/nginx/technical-specs/
nginx_plus_bsd_systems: ['FreeBSD']
# Choose to install BSD packages or ports.
# Options are True for packages or False for ports.
# Default is True.
nginx_bsd_install_packages: true
# Choose to update BSD ports collection.
# Options are True for update or False for do not update.
# Default is True.
nginx_bsd_update_ports: true
# Choose to install packages built from BSD ports collection if
# available.
# Options are True for use packages or False for do not use packages.
# Default is True.
nginx_bsd_portinstall_use_packages: true
# FreeBSD extra packages
nginx_freebsd_extra_packages: ['security/ca_root_nss']

13
ansible/roles/nginxinc.nginx/defaults/main/linux.yml Normal file
View file

@ -0,0 +1,13 @@
---
# Supported distributions
nginx_linux_families: ['Alpine', 'Debian', 'RedHat', 'Suse']
# Supported distributions NGINX Plus
# https://docs.nginx.com/nginx/technical-specs/
# RedHat={Amazon,CentOS,OracleLinux,RHEL} Debian={Ubuntu,Debian}
nginx_plus_linux_families: ['Alpine', 'Debian', 'RedHat', 'Suse']
# Default locations and versions for install from source
pcre_version: pcre-8.43
zlib_version: zlib-1.2.11
openssl_version: openssl-1.1.1c

93
ansible/roles/nginxinc.nginx/defaults/main/main.yml Normal file
View file

@ -0,0 +1,93 @@
---
# Install NGINX.
# Default is true.
nginx_enable: true
# Start NGINX service.
# Default is true.
nginx_start: true
# Print NGINX configuration file to terminal after executing playbook.
nginx_debug_output: false
# Specify which type of NGINX you want to install.
# Options are 'opensource' or 'plus'.
# Default is 'opensource'.
nginx_type: opensource
# Specify which version of NGINX you want to install.
# Default is empty.
# nginx_version: "=19-1~bionic"
# For Plus and modules you'll need a wilcard like below (which installs plus-20 and modules)
# nginx_version: "-20*"
# Specify whether you want to maintain your version of NGINX, upgrade to the latest version, or remove NGINX.
# Can be used with `nginx_version` to achieve fine tune control on which version of NGINX is installed/used on each playbook execution.
# Using 'present' will install the latest version (or 'nginx_version') of NGINX on a fresh install.
# Using 'latest' will upgrade NGINX to the latest version (that matches your 'nginx_version') of NGINX on every playbook execution.
# Using 'absent' will remove NGINX from your system.
# Default is present.
nginx_state: present
# Specify repository origin for NGINX Open Source.
# Options are 'nginx_repository', 'source' or 'os_repository'.
# Only works if 'nginx_type' is set to 'opensource'.
# Default is nginx_repository.
nginx_install_from: nginx_repository
# Specify source install options for NGINX Open Source.
# Options represent whether to install from source also
# or to install from packages (default). These only apply
# if 'nginx_install_from' is set to 'source'
# For the tools, true means we will isntall from a package
# and false means install from source.
# 'nginx_install_source_build_tools' will install compiler
# and build tools from packages. If false, you need to have
# these present.
nginx_install_source_build_tools: true
nginx_install_source_pcre: false
nginx_install_source_openssl: true
nginx_install_source_zlib: false
# Choose where to fetch the NGINX signing key from.
# Default is the official NGINX signing key host.
# nginx_signing_key: http://nginx.org/keys/nginx_signing.key
# Specify source repository for NGINX Open Source.
# Only works if 'install_from' is set to 'nginx_repository'.
# Defaults are the official NGINX repositories.
# nginx_repository: deb https://nginx.org/packages/mainline/debian/ stretch nginx
# Specify which branch of NGINX Open Source you want to install.
# Options are 'mainline' or 'stable'.
# Only works if 'install_from' is set to 'nginx_repository' or 'source'.
# Default is mainline.
nginx_branch: mainline
# Location of your NGINX Plus license in your local machine.
# Default is the files folder within the NGINX Ansible role.
nginx_license:
certificate: license/nginx-repo.crt
key: license/nginx-repo.key
# Remove NGINX Plus license and repository after installation for security purposes.
# Default is false.
nginx_delete_license: false
# Install NGINX JavaScript, Perl, ModSecurity WAF (NGINX Plus only), GeoIP, Image-Filter, RTMP Media Streaming (NGINX Plus only), and/or XSLT modules.
# Default is false.
nginx_modules:
njs: false
perl: false
waf: false
geoip: false
image_filter: false
rtmp: false
xslt: false
# Remove previously existing NGINX configuration files.
# Use a list of paths you wish to remove.
# Default is false.
nginx_cleanup_config: false
nginx_cleanup_config_path:
- /etc/nginx/conf.d

369
ansible/roles/nginxinc.nginx/defaults/main/template.yml Normal file
View file

@ -0,0 +1,369 @@
---
# Enable creating dynamic templated NGINX HTML demo websites.
nginx_html_demo_template_enable: false
nginx_html_demo_template:
default:
template_file: www/index.html.j2
html_file_name: index.html
html_file_location: /usr/share/nginx/html
web_server_name: Default
# Enable creating dynamic templated NGINX configuration files.
# Defaults are the values found in a fresh NGINX installation.
nginx_main_template_enable: false
nginx_main_template:
template_file: nginx.conf.j2
conf_file_name: nginx.conf
conf_file_location: /etc/nginx/
user: nginx
worker_processes: auto
# worker_rlimit_nofile: 1024
error_log:
location: /var/log/nginx/error.log
level: warn
worker_connections: 1024
http_enable: true
http_settings:
access_log_format:
- name: main
format: |-
'$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"'
access_log_location:
- name: main
location: /var/log/nginx/access.log
tcp_nopush: true
tcp_nodelay: true
keepalive_timeout: 65
cache: false
rate_limit: false
keyval: false
# server_tokens: "off"
http_global_autoindex: false
sub_filter:
# sub_filters: []
last_modified: "off"
once: "on"
types: "text/html"
# http_custom_options: []
stream_enable: false
# stream_custom_options: []
# auth_request_http: /auth
# auth_request_set_http:
# name: $auth_user
# value: $upstream_http_x_user
# Enable creating dynamic templated NGINX HTTP configuration files.
# Defaults will not produce a valid configuration. Instead they are meant to showcase
# the options available for templating. Each key represents a new configuration file.
nginx_http_template_enable: false
nginx_http_template:
default:
template_file: http/default.conf.j2
conf_file_name: default.conf
conf_file_location: /etc/nginx/conf.d/
servers:
server1:
listen:
listen_localhost:
ip: localhost # Wrap in square brackets for IPv6 addresses
port: 8081
ssl: true
opts: [] # Listen opts like http2 which will be added (ssl is automatically added if you specify 'ssl:').
server_name: localhost
include_files: []
error_page: /usr/share/nginx/html
access_log:
- name: main
location: /var/log/nginx/access.log
error_log:
location: /var/log/nginx/error.log
level: warn
root: /usr/share/nginx/html
# https_redirect: $host
autoindex: false
auth_basic: null
auth_basic_user_file: null
try_files: $uri $uri/index.html $uri.html =404
# auth_request: /auth
# auth_request_set:
# name: $auth_user
# value: $upstream_http_x_user
client_max_body_size: 1m
proxy_hide_headers: [] # A list of headers which shouldn't be passed to the application
add_headers:
strict_transport_security:
name: Strict-Transport-Security
value: max-age=15768000; includeSubDomains
always: true
# header_name:
# name: Header-X
# value: Value-X
# always: false
ssl:
cert: /etc/ssl/certs/default.crt
key: /etc/ssl/private/default.key
dhparam: /etc/ssl/private/dh_param.pem
protocols: TLSv1 TLSv1.1 TLSv1.2
ciphers: HIGH:!aNULL:!MD5
prefer_server_ciphers: true
session_cache: none
session_timeout: 5m
disable_session_tickets: false
trusted_cert: /etc/ssl/certs/root_CA_cert_plus_intermediates.crt
stapling: true
stapling_verify: true
sub_filter:
# sub_filters: []
last_modified: "off"
once: "on"
types: "text/html"
# custom_options: []
web_server:
locations:
default:
location: /
include_files: []
proxy_hide_headers: [] # A list of headers which shouldn't be passed to the application
add_headers:
strict_transport_security:
name: Strict-Transport-Security
value: max-age=15768000; includeSubDomains
always: true
# header_name:
# name: Header-X
# value: Value-X
# always: false
html_file_location: /usr/share/nginx/html
html_file_name: index.html
autoindex: false
auth_basic: null
auth_basic_user_file: null
try_files: $uri $uri/index.html $uri.html =404
# auth_request: /auth
# auth_request_set:
# name: $auth_user
# value: $upstream_http_x_user
client_max_body_size: 1m
# returns:
# return302:
# code: 302
# url: https://sso.somehost.local/?url=https://$http_host$request_uri
sub_filter:
# sub_filters: []
last_modified: "off"
once: "on"
types: "text/html"
# custom_options: []
http_demo_conf: false
reverse_proxy:
locations:
backend:
location: /
include_files: []
proxy_hide_headers: [] # A list of headers which shouldn't be passed to the application
add_headers:
strict_transport_security:
name: Strict-Transport-Security
value: max-age=15768000; includeSubDomains
always: true
# header_name:
# name: Header-X
# value: Value-X
# always: false
proxy_connect_timeout: null
proxy_pass: http://backend
# rewrites:
# - /foo(.*) /$1 break
# proxy_pass_request_body: off
# allows:
# - 192.168.1.0/24
# denies:
# - all
proxy_set_header:
header_host:
name: Host
value: $host
header_x_real_ip:
name: X-Real-IP
value: $remote_addr
header_x_forwarded_for:
name: X-Forwarded-For
value: $proxy_add_x_forwarded_for
header_x_forwarded_proto:
name: X-Forwarded-Proto
value: $scheme
# header_upgrade:
# name: Upgrade
# value: $http_upgrade
# header_connection:
# name: Connection
# value: "Upgrade"
# header_random:
# name: RandomName
# value: RandomValue
# internal: false
# proxy_store: off
# proxy_store_acccess: user:rw
proxy_read_timeout: null
proxy_send_timeout: null
proxy_ssl:
cert: /etc/ssl/certs/proxy_default.crt
key: /etc/ssl/private/proxy_default.key
trusted_cert: /etc/ssl/certs/proxy_ca.crt
protocols: TLSv1 TLSv1.1 TLSv1.2
ciphers: HIGH:!aNULL:!MD5
verify: false
verify_depth: 1
session_reuse: true
proxy_cache: backend_proxy_cache
proxy_cache_valid:
- code: 200
time: 10m
- code: 301
time: 1m
proxy_temp_path:
path: /var/cache/nginx/proxy/backend/temp
proxy_cache_lock: false
proxy_cache_min_uses: 3
proxy_cache_revalidate: false
proxy_cache_use_stale:
- http_403
- http_404
proxy_ignore_headers:
- Vary
- Cache-Control
proxy_cookie_path:
path: /web/
replacement: /
proxy_buffering: false
proxy_http_version: 1.0
websocket: false
auth_basic: null
auth_basic_user_file: null
try_files: $uri $uri/index.html $uri.html =404
# auth_request: /auth
# auth_request_set:
# name: $auth_user
# value: $upstream_http_x_user
# returns:
# return302:
# code: 302
# url: https://sso.somehost.local/?url=https://$http_host$request_uri
sub_filter:
# sub_filters: []
last_modified: "off"
once: "on"
types: "text/html"
# custom_options: []
health_check_plus: false
returns:
return301:
location: /
code: 301
value: http://$host$request_uri
proxy_cache:
proxy_cache_path:
- path: /var/cache/nginx/proxy/backend
keys_zone:
name: backend_proxy_cache
size: 10m
levels: "1:2"
max_size: 10g
inactive: 60m
use_temp_path: true
proxy_temp_path:
path: /var/cache/nginx/proxy/temp
proxy_cache_valid:
- code: 200
time: 10m
- code: 301
time: 1m
proxy_cache_lock: true
proxy_cache_min_uses: 5
proxy_cache_revalidate: true
proxy_cache_use_stale:
- error
- timeout
proxy_ignore_headers:
- Expires
upstreams:
upstream1:
name: backend
lb_method: least_conn
zone_name: backend_mem_zone
zone_size: 64k
sticky_cookie: false
servers:
server1:
address: localhost
port: 8081
weight: 1
health_check: max_fails=1 fail_timeout=10s
# custom_options: []
# custom_options: []
# Enable NGINX status data.
# Will enable 'stub_status' in NGINX Open Source and 'status' in NGINX Plus.
# Note - 'status' has been deprecated since NGINX Plus R13.
# Default is false.
nginx_status_enable: false
nginx_status_location: /etc/nginx/conf.d/stub_status.conf
nginx_status_port: 80
# Enable NGINX Plus REST API, write access to the REST API, and NGINX Plus dashboard.
# Requires NGINX Plus.
# Default is false.
nginx_rest_api_enable: false
nginx_rest_api_template_file: http/api.conf.j2
nginx_rest_api_file_location: /etc/nginx/conf.d/api.conf
nginx_rest_api_port: 80
nginx_rest_api_write: false
nginx_rest_api_dashboard: false
# Enable creating dynamic templated NGINX stream configuration files.
# Defaults will not produce a valid configuration. Instead they are meant to showcase
# the options available for templating. Each key represents a new configuration file.
nginx_stream_template_enable: false
nginx_stream_template:
default:
template_file: stream/default.conf.j2
conf_file_name: default.conf
conf_file_location: /etc/nginx/conf.d/stream/
network_streams:
default:
listen_address: localhost
listen_port: 80
udp_enable: false
include_files: []
proxy_pass: backend
proxy_timeout: 3s
proxy_connect_timeout: 1s
proxy_protocol: false
proxy_ssl:
cert: /etc/ssl/certs/proxy_default.crt
key: /etc/ssl/private/proxy_default.key
trusted_cert: /etc/ssl/certs/proxy_ca.crt
protocols: TLSv1 TLSv1.1 TLSv1.2
ciphers: HIGH:!aNULL:!MD5
verify: false
verify_depth: 1
session_reuse: true
health_check_plus: false
# custom_options: []
upstreams:
upstream1:
name: backend
lb_method: least_conn
zone_name: backend
zone_size: 64k
sticky_cookie: false
servers:
server1:
address: localhost
port: 8080
weight: 1
health_check: max_fails=1 fail_timeout=10s
# custom_options: []
# custom_options: []

6
ansible/roles/nginxinc.nginx/defaults/main/unit.yml Normal file
View file

@ -0,0 +1,6 @@
---
# Install NGINX Unit and NGINX Unit modules.
# Use a list of supported NGINX Unit modules.
# Default is false.
nginx_unit_enable: false
nginx_unit_modules: null

26
ansible/roles/nginxinc.nginx/defaults/main/upload.yml Normal file
View file

@ -0,0 +1,26 @@
---
# Enable uploading NGINX configuration files to your system.
# Default for uploading files is false.
# Default location of files is the files folder within the NGINX Ansible role.
# Upload the main NGINX configuration file.
nginx_main_upload_enable: false
nginx_main_upload_src: conf/nginx.conf
nginx_main_upload_dest: /etc/nginx/
# Upload HTTP NGINX configuration files.
nginx_http_upload_enable: false
nginx_http_upload_src: conf/http/*.conf
nginx_http_upload_dest: /etc/nginx/conf.d/
# Upload Stream NGINX configuration files.
nginx_stream_upload_enable: false
nginx_stream_upload_src: conf/stream/*.conf
nginx_stream_upload_dest: /etc/nginx/conf.d/
# Upload HTML files.
nginx_html_upload_enable: false
nginx_html_upload_src: www/*
nginx_html_upload_dest: /usr/share/nginx/html
# Upload SSL certificates and keys.
nginx_ssl_upload_enable: false
nginx_ssl_crt_upload_src: ssl/*.crt
nginx_ssl_crt_upload_dest: /etc/ssl/certs/
nginx_ssl_key_upload_src: ssl/*.key
nginx_ssl_key_upload_dest: /etc/ssl/private/

0
ansible/roles/nginxinc.nginx/files/conf/http/.gitkeep Normal file
View file

0
ansible/roles/nginxinc.nginx/files/conf/stream/.gitkeep Normal file
View file

0
ansible/roles/nginxinc.nginx/files/license/.gitkeep Normal file
View file

16
ansible/roles/nginxinc.nginx/files/services/nginx.conf.upstart Normal file
View file

@ -0,0 +1,16 @@
description "nginx - small, powerful, scalable web/proxy server"
start on filesystem and static-network-up
stop on runlevel [016]
expect fork
respawn
pre-start script
[ -x /usr/sbin/nginx ] || { stop; exit 0; }
/usr/sbin/nginx -q -t -g 'daemon on; master_process on;' || { stop; exit 0; }
end script
exec /usr/sbin/nginx -g 'daemon on; master_process on;'
pre-stop exec /usr/sbin/nginx -s quit

70
ansible/roles/nginxinc.nginx/files/services/nginx.openrc Normal file
View file

@ -0,0 +1,70 @@
#!/sbin/openrc-run
description="Nginx http and reverse proxy server"
extra_commands="checkconfig"
extra_started_commands="reload reopen upgrade"
cfgfile=${cfgfile:-/etc/nginx/nginx.conf}
pidfile=/var/run/nginx.pid
command=/usr/sbin/nginx
command_args="-c $cfgfile"
required_files="$cfgfile"
depend() {
need net
use dns logger netmount
}
start_pre() {
$command $command_args -t -q
}
checkconfig() {
ebegin "Checking $RC_SVCNAME configuration"
start_pre
eend $?
}
reload() {
ebegin "Reloading $RC_SVCNAME configuration"
start_pre && start-stop-daemon --signal HUP --pidfile $pidfile
eend $?
}
reopen() {
ebegin "Reopening $RC_SVCNAME log files"
start-stop-daemon --signal USR1 --pidfile $pidfile
eend $?
}
upgrade() {
start_pre || return 1
ebegin "Upgrading $RC_SVCNAME binary"
einfo "Sending USR2 to old binary"
start-stop-daemon --signal USR2 --pidfile $pidfile
einfo "Sleeping 3 seconds before pid-files checking"
sleep 3
if [ ! -f $pidfile.oldbin ]; then
eerror "File with old pid ($pidfile.oldbin) not found"
return 1
fi
if [ ! -f $pidfile ]; then
eerror "New binary failed to start"
return 1
fi
einfo "Sleeping 3 seconds before WINCH"
sleep 3 ; start-stop-daemon --signal 28 --pidfile $pidfile.oldbin
einfo "Sending QUIT to old binary"
start-stop-daemon --signal QUIT --pidfile $pidfile.oldbin
einfo "Upgrade completed"
eend $? "Upgrade failed"
}

15
ansible/roles/nginxinc.nginx/files/services/nginx.systemd Normal file
View file

@ -0,0 +1,15 @@
[Unit]
Description=nginx - high performance web server
Documentation=http://nginx.org/en/docs/
After=network-online.target remote-fs.target nss-lookup.target
Wants=network-online.target
[Service]
Type=forking
PIDFile=/var/run/nginx.pid
ExecStart=/usr/sbin/nginx -c /etc/nginx/nginx.conf
ExecReload=/bin/kill -s HUP $MAINPID
ExecStop=/bin/kill -s TERM $MAINPID
[Install]
WantedBy=multi-user.target

196
ansible/roles/nginxinc.nginx/files/services/nginx.sysvinit Normal file
View file

@ -0,0 +1,196 @@
#!/bin/sh
### BEGIN INIT INFO
# Provides: nginx
# Required-Start: $local_fs $remote_fs $network $syslog $named
# Required-Stop: $local_fs $remote_fs $network $syslog $named
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: starts the nginx web server
# Description: starts nginx using start-stop-daemon
### END INIT INFO
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
DAEMON=/usr/sbin/nginx
NAME=nginx
DESC=nginx
# Include nginx defaults if available
if [ -r /etc/default/nginx ]; then
. /etc/default/nginx
fi
STOP_SCHEDULE="${STOP_SCHEDULE:-QUIT/5/TERM/5/KILL/5}"
test -x $DAEMON || exit 0
. /lib/init/vars.sh
. /lib/lsb/init-functions
# Try to extract nginx pidfile
PID=$(cat /etc/nginx/nginx.conf | grep -Ev '^\s*#' | awk 'BEGIN { RS="[;{}]" } { if ($1 == "pid") print $2 }' | head -n1)
if [ -z "$PID" ]; then
PID=/run/nginx.pid
fi
if [ -n "$ULIMIT" ]; then
# Set ulimit if it is set in /etc/default/nginx
ulimit $ULIMIT
fi
start_nginx() {
# Start the daemon/service
#
# Returns:
# 0 if daemon has been started
# 1 if daemon was already running
# 2 if daemon could not be started
start-stop-daemon --start --quiet --pidfile $PID --exec $DAEMON --test > /dev/null \
|| return 1
start-stop-daemon --start --quiet --pidfile $PID --exec $DAEMON -- \
$DAEMON_OPTS 2>/dev/null \
|| return 2
}
test_config() {
# Test the nginx configuration
$DAEMON -t $DAEMON_OPTS >/dev/null 2>&1
}
stop_nginx() {
# Stops the daemon/service
#
# Return
# 0 if daemon has been stopped
# 1 if daemon was already stopped
# 2 if daemon could not be stopped
# other if a failure occurred
start-stop-daemon --stop --quiet --retry=$STOP_SCHEDULE --pidfile $PID --name $NAME
RETVAL="$?"
sleep 1
return "$RETVAL"
}
reload_nginx() {
# Function that sends a SIGHUP to the daemon/service
start-stop-daemon --stop --signal HUP --quiet --pidfile $PID --name $NAME
return 0
}
rotate_logs() {
# Rotate log files
start-stop-daemon --stop --signal USR1 --quiet --pidfile $PID --name $NAME
return 0
}
upgrade_nginx() {
# Online upgrade nginx executable
# http://nginx.org/en/docs/control.html
#
# Return
# 0 if nginx has been successfully upgraded
# 1 if nginx is not running
# 2 if the pid files were not created on time
# 3 if the old master could not be killed
if start-stop-daemon --stop --signal USR2 --quiet --pidfile $PID --name $NAME; then
# Wait for both old and new master to write their pid file
while [ ! -s "${PID}.oldbin" ] || [ ! -s "${PID}" ]; do
cnt=`expr $cnt + 1`
if [ $cnt -gt 10 ]; then
return 2
fi
sleep 1
done
# Everything is ready, gracefully stop the old master
if start-stop-daemon --stop --signal QUIT --quiet --pidfile "${PID}.oldbin" --name $NAME; then
return 0
else
return 3
fi
else
return 1
fi
}
case "$1" in
start)
log_daemon_msg "Starting $DESC" "$NAME"
start_nginx
case "$?" in
0|1) log_end_msg 0 ;;
2) log_end_msg 1 ;;
esac
;;
stop)
log_daemon_msg "Stopping $DESC" "$NAME"
stop_nginx
case "$?" in
0|1) log_end_msg 0 ;;
2) log_end_msg 1 ;;
esac
;;
restart)
log_daemon_msg "Restarting $DESC" "$NAME"
# Check configuration before stopping nginx
if ! test_config; then
log_end_msg 1 # Configuration error
exit $?
fi
stop_nginx
case "$?" in
0|1)
start_nginx
case "$?" in
0) log_end_msg 0 ;;
1) log_end_msg 1 ;; # Old process is still running
*) log_end_msg 1 ;; # Failed to start
esac
;;
*)
# Failed to stop
log_end_msg 1
;;
esac
;;
reload|force-reload)
log_daemon_msg "Reloading $DESC configuration" "$NAME"
# Check configuration before stopping nginx
#
# This is not entirely correct since the on-disk nginx binary
# may differ from the in-memory one, but that's not common.
# We prefer to check the configuration and return an error
# to the administrator.
if ! test_config; then
log_end_msg 1 # Configuration error
exit $?
fi
reload_nginx
log_end_msg $?
;;
configtest|testconfig)
log_daemon_msg "Testing $DESC configuration"
test_config
log_end_msg $?
;;
status)
status_of_proc -p $PID "$DAEMON" "$NAME" && exit 0 || exit $?
;;
upgrade)
log_daemon_msg "Upgrading binary" "$NAME"
upgrade_nginx
log_end_msg $?
;;
rotate)
log_daemon_msg "Re-opening $DESC log files" "$NAME"
rotate_logs
log_end_msg $?
;;
*)
echo "Usage: $NAME {start|stop|restart|reload|force-reload|status|configtest|rotate|upgrade}" >&2
exit 3
;;
esac

196
ansible/roles/nginxinc.nginx/files/services/nginx.upstart Normal file
View file

@ -0,0 +1,196 @@
#!/bin/sh
### BEGIN INIT INFO
# Provides: nginx
# Required-Start: $local_fs $remote_fs $network $syslog $named
# Required-Stop: $local_fs $remote_fs $network $syslog $named
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: starts the nginx web server
# Description: starts nginx using start-stop-daemon
### END INIT INFO
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
DAEMON=/usr/sbin/nginx
NAME=nginx
DESC=nginx
# Include nginx defaults if available
if [ -r /etc/default/nginx ]; then
. /etc/default/nginx
fi
STOP_SCHEDULE="${STOP_SCHEDULE:-QUIT/5/TERM/5/KILL/5}"
test -x $DAEMON || exit 0
. /lib/init/vars.sh
. /lib/lsb/init-functions
# Try to extract nginx pidfile
PID=$(cat /etc/nginx/nginx.conf | grep -Ev '^\s*#' | awk 'BEGIN { RS="[;{}]" } { if ($1 == "pid") print $2 }' | head -n1)
if [ -z "$PID" ]; then
PID=/run/nginx.pid
fi
if [ -n "$ULIMIT" ]; then
# Set ulimit if it is set in /etc/default/nginx
ulimit $ULIMIT
fi
start_nginx() {
# Start the daemon/service
#
# Returns:
# 0 if daemon has been started
# 1 if daemon was already running
# 2 if daemon could not be started
start-stop-daemon --start --quiet --pidfile $PID --exec $DAEMON --test > /dev/null \
|| return 1
start-stop-daemon --start --quiet --pidfile $PID --exec $DAEMON -- \
$DAEMON_OPTS 2>/dev/null \
|| return 2
}
test_config() {
# Test the nginx configuration
$DAEMON -t $DAEMON_OPTS >/dev/null 2>&1
}
stop_nginx() {
# Stops the daemon/service
#
# Return
# 0 if daemon has been stopped
# 1 if daemon was already stopped
# 2 if daemon could not be stopped
# other if a failure occurred
start-stop-daemon --stop --quiet --retry=$STOP_SCHEDULE --pidfile $PID --name $NAME
RETVAL="$?"
sleep 1
return "$RETVAL"
}
reload_nginx() {
# Function that sends a SIGHUP to the daemon/service
start-stop-daemon --stop --signal HUP --quiet --pidfile $PID --name $NAME
return 0
}
rotate_logs() {
# Rotate log files
start-stop-daemon --stop --signal USR1 --quiet --pidfile $PID --name $NAME
return 0
}
upgrade_nginx() {
# Online upgrade nginx executable
# http://nginx.org/en/docs/control.html
#
# Return
# 0 if nginx has been successfully upgraded
# 1 if nginx is not running
# 2 if the pid files were not created on time
# 3 if the old master could not be killed
if start-stop-daemon --stop --signal USR2 --quiet --pidfile $PID --name $NAME; then
# Wait for both old and new master to write their pid file
while [ ! -s "${PID}.oldbin" ] || [ ! -s "${PID}" ]; do
cnt=`expr $cnt + 1`
if [ $cnt -gt 10 ]; then
return 2
fi
sleep 1
done
# Everything is ready, gracefully stop the old master
if start-stop-daemon --stop --signal QUIT --quiet --pidfile "${PID}.oldbin" --name $NAME; then
return 0
else
return 3
fi
else
return 1
fi
}
case "$1" in
start)
log_daemon_msg "Starting $DESC" "$NAME"
start_nginx
case "$?" in
0|1) log_end_msg 0 ;;
2) log_end_msg 1 ;;
esac
;;
stop)
log_daemon_msg "Stopping $DESC" "$NAME"
stop_nginx
case "$?" in
0|1) log_end_msg 0 ;;
2) log_end_msg 1 ;;
esac
;;
restart)
log_daemon_msg "Restarting $DESC" "$NAME"
# Check configuration before stopping nginx
if ! test_config; then
log_end_msg 1 # Configuration error
exit $?
fi
stop_nginx
case "$?" in
0|1)
start_nginx
case "$?" in
0) log_end_msg 0 ;;
1) log_end_msg 1 ;; # Old process is still running
*) log_end_msg 1 ;; # Failed to start
esac
;;
*)
# Failed to stop
log_end_msg 1
;;
esac
;;
reload|force-reload)
log_daemon_msg "Reloading $DESC configuration" "$NAME"
# Check configuration before stopping nginx
#
# This is not entirely correct since the on-disk nginx binary
# may differ from the in-memory one, but that's not common.
# We prefer to check the configuration and return an error
# to the administrator.
if ! test_config; then
log_end_msg 1 # Configuration error
exit $?
fi
reload_nginx
log_end_msg $?
;;
configtest|testconfig)
log_daemon_msg "Testing $DESC configuration"
test_config
log_end_msg $?
;;
status)
status_of_proc -p $PID "$DAEMON" "$NAME" && exit 0 || exit $?
;;
upgrade)
log_daemon_msg "Upgrading binary" "$NAME"
upgrade_nginx
log_end_msg $?
;;
rotate)
log_daemon_msg "Re-opening $DESC log files" "$NAME"
rotate_logs
log_end_msg $?
;;
*)
echo "Usage: $NAME {start|stop|restart|reload|force-reload|status|configtest|rotate|upgrade}" >&2
exit 3
;;
esac

0
ansible/roles/nginxinc.nginx/files/ssl/.gitkeep Normal file
View file

25
ansible/roles/nginxinc.nginx/files/www/index.html Normal file
View file

@ -0,0 +1,25 @@
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
body {
width: 35em;
margin: 0 auto;
font-family: Tahoma, Verdana, Arial, sans-serif;
}
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>
<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>
<p><em>Thank you for using nginx.</em></p>
</body>
</html>

39
ansible/roles/nginxinc.nginx/handlers/main.yml Normal file
View file

@ -0,0 +1,39 @@
---
- name: "(Handler: All OSs) Run NGINX"
block:
- name: "(Handler: All OSs) Start NGINX"
service:
name: nginx
state: started
enabled: yes
notify: "(Handler: All OSs) Check NGINX"
- name: "(Handler: All OSs) Reload NGINX"
command: "nginx -s reload"
changed_when: false
when:
- nginx_start | bool
- not ansible_check_mode
- name: "(Handler: All OSs) Start NGINX Amplify Agent"
service:
name: amplify-agent
state: started
- name: "(Handler: Debian/Ubuntu/CentOS/RedHat) Start NGINX Unit"
service:
name: unit
state: started
enabled: yes
- name: "(Handler: FreeBSD) Start NGINX Unit"
service:
name: unitd
state: started
enabled: yes
- name: "(Handler: All OSs) Check NGINX"
command: "nginx -t"
changed_when: false

2
ansible/roles/nginxinc.nginx/meta/.galaxy_install_info Normal file
View file

@ -0,0 +1,2 @@
install_date: Fri May 15 21:51:16 2020
version: 0.14.0

50
ansible/roles/nginxinc.nginx/meta/main.yml Normal file
View file

@ -0,0 +1,50 @@
---
galaxy_info:
author: Alessandro Fael Garcia
description: Official Ansible role for NGINX
company: NGINX, Inc.
license: Apache License, Version 2.0
min_ansible_version: 2.9
platforms:
- name: Alpine
versions:
- all
- name: Amazon
versions:
- Candidate
- name: Debian
versions:
- jessie
- stretch
- buster
- name: EL
versions:
- 6
- 7
- name: FreeBSD
versions:
- 11.2
- 12.0
- name: Ubuntu
versions:
- xenial
- bionic
- name: SLES
versions:
- 12
- 15
galaxy_tags:
- nginx
- oss
- plus
- amplify
- unit
- web
- server
- development
dependencies: []

43
ansible/roles/nginxinc.nginx/molecule/common/Dockerfile.j2 Normal file
View file

@ -0,0 +1,43 @@
# Molecule managed
{% if item.registry is defined %}
FROM {{ item.registry.url }}/{{ item.image }}
{% else %}
FROM {{ item.image }}
{% endif %}
{% if item.env is defined %}
{% for var, value in item.env.items() %}
{% if value %}
ENV {{ var }} {{ value }}
{% endif %}
{% endfor %}
{% endif %}
RUN \
if [ $(command -v apt-get) ]; then \
apt-get update \
&& apt-get install -y python3 sudo bash ca-certificates iproute2 python3-apt aptitude systemd systemd-sysv procps curl \
&& apt-get clean; \
elif [ $(command -v dnf) ]; then \
dnf makecache \
&& dnf --assumeyes install /usr/bin/python3 /usr/bin/python3-config /usr/bin/dnf-3 bash iproute \
&& dnf clean all; \
elif [ $(command -v yum) ]; then \
yum makecache fast \
&& yum install -y /usr/bin/python /usr/bin/python2-config sudo yum-plugin-ovl bash iproute \
&& sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf \
&& yum clean all; \
elif [ $(command -v zypper) ]; then \
zypper refresh \
&& zypper install -y python3 sudo bash iproute2 \
&& zypper clean -a; \
elif [ $(command -v apk) ]; then \
apk update \
&& apk add --no-cache python3 sudo bash ca-certificates curl openrc; \
echo 'rc_provide="loopback net"' >> /etc/rc.conf; \
elif [ $(command -v xbps-install) ]; then \
xbps-install -Syu \
&& xbps-install -y python3 sudo bash ca-certificates iproute2 \
&& xbps-remove -O; \
fi

44
ansible/roles/nginxinc.nginx/molecule/common/files/http/default.conf Executable file
View file

@ -0,0 +1,44 @@
server {
listen 80;
server_name localhost;
#charset koi8-r;
#access_log /var/log/nginx/host.access.log main;
location / {
root /usr/share/nginx/html;
index index.html index.htm;
}
#error_page 404 /404.html;
# redirect server error pages to the static page /50x.html
#
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/share/nginx/html;
}
# proxy the PHP scripts to Apache listening on 127.0.0.1:80
#
#location ~ \.php$ {
# proxy_pass http://127.0.0.1;
#}
# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
#
#location ~ \.php$ {
# root html;
# fastcgi_pass 127.0.0.1:9000;
# fastcgi_index index.php;
# fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
# include fastcgi_params;
#}
# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
#location ~ /\.ht {
# deny all;
#}
}

31
ansible/roles/nginxinc.nginx/molecule/common/files/nginx.conf Executable file
View file

@ -0,0 +1,31 @@
user nginx;
worker_processes 4;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
#gzip on;
include /etc/nginx/conf.d/*.conf;
}

0
ansible/roles/nginxinc.nginx/molecule/common/files/www/.gitkeep Normal file
View file

20
ansible/roles/nginxinc.nginx/molecule/common/playbook_default.yml Normal file
View file

@ -0,0 +1,20 @@
---
- name: Converge
hosts: all
pre_tasks:
- name: "Set repo if Alpine"
set_fact:
version: "=1.17.8-r1"
when: ansible_os_family == "Alpine"
- name: "Set repo if Debian"
set_fact:
version: "=1.17.8-1~{{ ansible_distribution_release }}"
when: ansible_os_family == "Debian"
- name: "Set repo if RedHat"
set_fact:
version: "-1.17.8-1.el{{ ansible_distribution_major_version }}.ngx"
when: ansible_os_family == "RedHat"
roles:
- role: ansible-role-nginx
vars:
nginx_version: "{{ version }}"

16
ansible/roles/nginxinc.nginx/molecule/common/playbook_module.yml Normal file
View file

@ -0,0 +1,16 @@
---
- name: Converge
hosts: all
roles:
- role: ansible-role-nginx
vars:
nginx_debug_output: true
nginx_modules:
njs: true
perl: true
waf: false
geoip: true
image_filter: true
rtmp: true
xslt: true

19
ansible/roles/nginxinc.nginx/molecule/common/playbook_source.yml Normal file
View file

@ -0,0 +1,19 @@
---
- name: Converge
hosts: all
roles:
- role: ansible-role-nginx
vars:
nginx_debug_output: true
nginx_install_from: source
nginx_branch: mainline
nginx_install_source_build_tools: true
nginx_install_source_pcre: false
nginx_install_source_openssl: true
nginx_install_source_zlib: false
nginx_main_upload_enable: true
nginx_main_upload_src: files/nginx.conf
nginx_http_upload_enable: true
nginx_http_upload_src: files/http/*.conf

13
ansible/roles/nginxinc.nginx/molecule/common/playbook_stable_push.yml Normal file
View file

@ -0,0 +1,13 @@
---
- name: Converge
hosts: all
roles:
- role: ansible-role-nginx
vars:
nginx_debug_output: true
nginx_branch: stable
nginx_main_upload_enable: true
nginx_main_upload_src: files/nginx.conf
nginx_http_upload_enable: true
nginx_http_upload_src: files/http/*.conf

353
ansible/roles/nginxinc.nginx/molecule/common/playbook_template.yml Normal file
View file

@ -0,0 +1,353 @@
---
- name: Converge
hosts: all
roles:
- role: ansible-role-nginx
vars:
nginx_debug_output: true
nginx_main_template_enable: true
nginx_main_template:
template_file: nginx.conf.j2
conf_file_name: nginx.conf
conf_file_location: /etc/nginx/
user: nginx
worker_processes: auto
error_log:
location: /var/log/nginx/error.log
level: warn
worker_connections: 1024
http_enable: true
http_settings:
access_log_format:
- name: main
format: |
'$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"'
access_log_location:
- name: main
location: /var/log/nginx/access.log
keepalive_timeout: 65
cache: false
rate_limit: false
keyval: false
server_tokens: "off"
sub_filter:
# sub_filters: []
last_modified: "off"
once: "on"
types: "text/html"
stream_enable: true
http_global_autoindex: false
nginx_http_template_enable: true
nginx_http_template:
app:
template_file: http/default.conf.j2
conf_file_name: default.conf
conf_file_location: /etc/nginx/conf.d/
servers:
server1:
listen:
listen_localhost:
ip: 0.0.0.0
port: 80
opts:
- default_server
server_name: localhost
error_page: /usr/share/nginx/html
client_max_body_size: 512k
proxy_hide_headers:
- X-Powered-By
add_headers:
strict_transport_security:
name: Strict-Transport-Security
value: max-age=15768000; includeSubDomains
always: true
sub_filter:
# sub_filters: []
last_modified: "off"
once: "on"
types: "text/html"
# custom_options: []
reverse_proxy:
locations:
frontend:
location: /
proxy_hide_headers:
- X-Powered-By
add_headers:
strict_transport_security:
name: Strict-Transport-Security
value: max-age=15768000; includeSubDomains
always: true
another_header:
name: Fancy-New-Header-To-Test
value: testing=true
always: false
proxy_pass: http://frontend_servers/
proxy_cache: frontend_proxy_cache
proxy_cache_valid:
- code: 200
time: 10m
- code: 301
time: 1m
proxy_temp_path:
path: /var/cache/nginx/proxy/frontend/temp
proxy_cache_lock: false
proxy_cache_min_uses: 3
proxy_cache_revalidate: false
proxy_cache_use_stale:
- http_403
- http_404
proxy_ignore_headers:
- Vary
- Cache-Control
proxy_redirect: false
proxy_set_header:
header_host:
name: Host
value: $host
header_x_real_ip:
name: X-Real-IP
value: $remote_addr
header_x_forwarded_for:
name: X-Forwarded-For
value: $proxy_add_x_forwarded_for
header_x_forwarded_proto:
name: X-Forwarded-Proto
value: $scheme
proxy_buffering: false
client_max_body_size: 5m
sub_filter:
# sub_filters: []
last_modified: "off"
once: "on"
types: "text/html"
backend:
location: /backend
proxy_pass: http://backend_servers/
proxy_cache: backend_proxy_cache
proxy_cache_valid:
- time: 10m
proxy_temp_path:
path: /var/cache/nginx/proxy/backend/temp
proxy_cache_lock: true
proxy_cache_min_uses: 2
proxy_cache_revalidate: true
proxy_cache_use_stale:
- http_500
- http_502
- http_503
proxy_redirect: default
proxy_set_header:
header_host:
name: Host
value: $host
header_x_real_ip:
name: X-Real-IP
value: $remote_addr
header_x_forwarded_for:
name: X-Forwarded-For
value: $proxy_add_x_forwarded_for
header_x_forwarded_proto:
name: X-Forwarded-Proto
value: $scheme
proxy_cookie_path:
path: /web/
replacement: /
returns:
return301:
location: ^~ /old-path
code: 301
value: http://$host/new-path
proxy_cache:
proxy_cache_path:
- path: /var/cache/nginx/proxy/frontend
keys_zone:
name: frontend_proxy_cache
size: 5m
levels: "1:2"
max_size: 5g
inactive: 30m
use_temp_path: true
- path: /var/cache/nginx/proxy/backend
keys_zone:
name: backend_proxy_cache
size: 10m
levels: "1:2"
max_size: 10g
inactive: 60m
use_temp_path: true
proxy_temp_path:
path: /var/cache/nginx/proxy/temp
proxy_cache_lock: true
proxy_cache_min_uses: 5
proxy_cache_revalidate: true
proxy_cache_use_stale:
- error
- timeout
proxy_ignore_headers:
- Expires
upstreams:
frontend_upstream:
name: frontend_servers
lb_method: least_conn
zone_name: frontend_mem_zone
zone_size: 64k
sticky_cookie: false
servers:
frontend_server_1:
address: 0.0.0.0
port: 8081
weight: 1
health_check: max_fails=3 fail_timeout=5s
backend_upstream:
name: backend_servers
lb_method: least_conn
zone_name: backend_mem_zone
zone_size: 64k
sticky_cookie: false
servers:
backend_server_1:
address: 0.0.0.0
port: 8082
weight: 1
health_check: max_fails=3 fail_timeout=5s
frontend:
template_file: http/default.conf.j2
conf_file_name: frontend_default.conf
conf_file_location: /etc/nginx/conf.d/
servers:
server1:
listen:
listen_localhost:
port: 8081
opts: []
server_name: localhost
error_page: /usr/share/nginx/html
autoindex: false
sub_filter:
sub_filters:
- "'server_hostname' '$hostname'"
- "'server_address' '$server_addr:$server_port'"
- "'server_url' '$request_uri'"
- "'remote_addr' '$remote_addr:$remote_port'"
- "'server_date' '$time_local'"
- "'client_browser' '$http_user_agent'"
- "'request_id' '$request_id'"
- "'nginx_version' '$nginx_version'"
- "'document_root' '$document_root'"
- "'proxied_for_ip' '$http_x_forwarded_for'"
last_modified: "off"
once: "off"
types: "text/html"
web_server:
locations:
frontend_site:
location: /
proxy_hide_headers:
- X-Powered-By
html_file_location: /usr/share/nginx/html
html_file_name: frontend_index.html
autoindex: false
sub_filter:
# sub_filters: []
last_modified: "off"
once: "off"
types: "text/html"
http_demo_conf: false
backend:
template_file: http/default.conf.j2
conf_file_name: backend_default.conf
conf_file_location: /etc/nginx/conf.d/
servers:
server1:
listen:
listen_localhost:
port: 8082
opts: []
server_name: localhost
error_page: /usr/share/nginx/html
autoindex: false
sub_filter:
sub_filters:
- "'server_hostname' '$hostname'"
- "'server_address' '$server_addr:$server_port'"
- "'server_url' '$request_uri'"
- "'remote_addr' '$remote_addr:$remote_port'"
- "'server_date' '$time_local'"
- "'client_browser' '$http_user_agent'"
- "'request_id' '$request_id'"
- "'nginx_version' '$nginx_version'"
- "'document_root' '$document_root'"
- "'proxied_for_ip' '$http_x_forwarded_for'"
last_modified: "off"
once: "off"
types: "text/html"
web_server:
locations:
backend_site:
location: /
html_file_location: /usr/share/nginx/html
html_file_name: backend_index.html
autoindex: false
php:
location: ~ \.php$
html_file_location: /usr/share/nginx/html
autoindex: false
custom_options:
- fastcgi_split_path_info ^(.+\.php)(/.+)$
- fastcgi_pass unix:/run/php/php7.2-fpm.sock
- fastcgi_index index.php
- include fastcgi_params
- fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name
sub_filter:
# sub_filters: []
last_modified: "off"
once: "off"
types: "text/html"
http_demo_conf: false
nginx_html_demo_template_enable: true
nginx_html_demo_template:
frontend:
template_file: www/index.html.j2
html_file_name: frontend_index.html
html_file_location: /usr/share/nginx/html
web_server_name: Frontend
backend:
template_file: www/index.html.j2
html_file_name: backend_index.html
html_file_location: /usr/share/nginx/html
web_server_name: Backend
nginx_stream_template_enable: true
nginx_stream_template:
default:
template_file: stream/default.conf.j2
conf_file_name: default.conf
conf_file_location: /etc/nginx/conf.d/stream
network_streams:
app:
listen_address: 0.0.0.0
listen_port: 8090
udp_enable: false
proxy_pass: backend
proxy_timeout: 3s
proxy_connect_timeout: 1s
proxy_protocol: false
health_check_plus: false
upstreams:
backend_upstream:
name: backend
lb_method: least_conn
zone_name: backend
zone_size: 64k
sticky_cookie: false
servers:
backend_server_1:
address: 0.0.0.0
port: 8091
weight: 1
health_check: max_fails=1 fail_timeout=10s

30
ansible/roles/nginxinc.nginx/molecule/common/playbook_unit.yml Normal file
View file

@ -0,0 +1,30 @@
---
- name: Converge
hosts: all
pre_tasks:
- name: "Set module if Alpine"
set_fact:
module:
- "unit-perl"
- "unit-php7"
- "unit-python3"
when: ansible_os_family == "Alpine"
- name: "Set module if Debian/RedHat"
set_fact:
module:
- "unit-perl"
- "unit-php"
- "unit-ruby"
when: ansible_os_family == "Debian"
- name: "Set module if RedHat"
set_fact:
module:
- "unit-php"
- "unit-go"
when: ansible_os_family == "RedHat"
roles:
- role: ansible-role-nginx
vars:
nginx_enable: false
nginx_unit_enable: true
nginx_unit_modules: "{{ module }}"

30
ansible/roles/nginxinc.nginx/molecule/common/test_default/test_default.py Normal file
View file

@ -0,0 +1,30 @@
import os
import testinfra.utils.ansible_runner
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
def test_nginx_is_installed(host):
ngx = host.package("nginx")
assert ngx.is_installed
def test_nginx_running_and_enabled(host):
ngx = host.service("nginx")
assert ngx.is_running
assert ngx.is_enabled
def test_hosts_file(host):
ngx = host.file('/etc/hosts')
assert ngx.exists
assert ngx.user == 'root'
assert ngx.group == 'root'
def test_endpoint(host):
command = """curl -I http://localhost/"""
cmd = host.run(command)
assert '200 OK' in cmd.stdout

30
ansible/roles/nginxinc.nginx/molecule/common/test_module/test_default.py Normal file
View file

@ -0,0 +1,30 @@
import os
import testinfra.utils.ansible_runner
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
def test_nginx_is_installed(host):
ngx = host.package("nginx")
assert ngx.is_installed
def test_nginx_running_and_enabled(host):
ngx = host.service("nginx")
assert ngx.is_running
assert ngx.is_enabled
def test_hosts_file(host):
ngx = host.file('/etc/hosts')
assert ngx.exists
assert ngx.user == 'root'
assert ngx.group == 'root'
def test_endpoint(host):
command = """curl -I http://localhost/"""
cmd = host.run(command)
assert '200 OK' in cmd.stdout

25
ansible/roles/nginxinc.nginx/molecule/common/test_source/test_default.py Normal file
View file

@ -0,0 +1,25 @@
import os
import testinfra.utils.ansible_runner
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
def test_nginx_running_and_enabled(host):
ngx = host.service("nginx")
assert ngx.is_running
assert ngx.is_enabled
def test_hosts_file(host):
ngx = host.file('/etc/hosts')
assert ngx.exists
assert ngx.user == 'root'
assert ngx.group == 'root'
def test_endpoint(host):
command = """curl -I http://localhost/"""
cmd = host.run(command)
assert '200 OK' in cmd.stdout

42
ansible/roles/nginxinc.nginx/molecule/common/test_stable_push/test_default.py Normal file
View file

@ -0,0 +1,42 @@
import nginx
import os
import testinfra.utils.ansible_runner
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
def test_nginx_is_installed(host):
ngx = host.package("nginx")
assert ngx.is_installed
def test_nginx_running_and_enabled(host):
ngx = host.service("nginx")
assert ngx.is_running
assert ngx.is_enabled
def test_hosts_file(host):
ngx = host.file('/etc/hosts')
assert ngx.exists
assert ngx.user == 'root'
assert ngx.group == 'root'
def test_endpoint(host):
command = """curl -I http://localhost/"""
cmd = host.run(command)
assert '200 OK' in cmd.stdout
def test_generated_files(host):
assert host.file('/etc/nginx/conf.d/default.conf').exists
def test_default_server(host):
f = host.file('/etc/nginx/conf.d/default.conf')
c = nginx.loads(f.content_string)
lf = c.server.filter('Location', '/')
assert len(lf) == 1

58
ansible/roles/nginxinc.nginx/molecule/common/test_template/test_default.py Normal file
View file

@ -0,0 +1,58 @@
import nginx
import os
import testinfra.utils.ansible_runner
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
def test_nginx_is_installed(host):
ngx = host.package("nginx")
assert ngx.is_installed
def test_nginx_running_and_enabled(host):
ngx = host.service("nginx")
assert ngx.is_running
assert ngx.is_enabled
def test_hosts_file(host):
ngx = host.file('/etc/hosts')
assert ngx.exists
assert ngx.user == 'root'
assert ngx.group == 'root'
def test_endpoint(host):
command = """curl -I http://localhost/"""
cmd = host.run(command)
assert '200 OK' in cmd.stdout
def test_generated_files(host):
assert host.file('/etc/nginx/conf.d/default.conf').exists
assert host.file('/etc/nginx/conf.d/frontend_default.conf').exists
assert host.file('/etc/nginx/conf.d/backend_default.conf').exists
def test_default_server(host):
f = host.file('/etc/nginx/conf.d/default.conf')
c = nginx.loads(f.content_string)
lf = c.server.filter('Location', '/')
assert len(lf) == 1
lb = c.server.filter('Location', '/backend')
assert len(lb) == 1
def test_client_max_body_size(host):
f = host.file('/etc/nginx/conf.d/default.conf')
c = nginx.loads(f.content_string)
vs = c.server.filter('Key', 'client_max_body_size')
assert len(vs) == 1
assert vs[0].value == '512k'
lc = c.server.filter('Location', '/')
vl = lc[0].filter('Key', 'client_max_body_size')
assert len(vl) == 1
assert vl[0].value == '5m'

44
ansible/roles/nginxinc.nginx/molecule/default/molecule.yml Normal file
View file

@ -0,0 +1,44 @@
---
driver:
name: docker
lint: |
set -e
yamllint .
ansible-lint
flake8
platforms:
- name: debian-stretch
image: debian:stretch-slim
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: debian-buster
image: debian:buster-slim
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: ubuntu-xenial
image: ubuntu:xenial
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: ubuntu-bionic
image: ubuntu:bionic
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
provisioner:
name: ansible
playbooks:
converge: ../common/playbook_default.yml
verifier:
name: testinfra
directory: ../common/test_default

44
ansible/roles/nginxinc.nginx/molecule/default_alpine/molecule.yml Normal file
View file

@ -0,0 +1,44 @@
---
driver:
name: docker
lint: |
set -e
yamllint .
ansible-lint
flake8
platforms:
- name: alpine-3.8
image: alpine:3.8
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: alpine-3.9
image: alpine:3.9
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: alpine-3.10
image: alpine:3.10
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: alpine-3.11
image: alpine:3.11
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
provisioner:
name: ansible
playbooks:
converge: ../common/playbook_default.yml
verifier:
name: testinfra
directory: ../common/test_default

33
ansible/roles/nginxinc.nginx/molecule/default_centos/molecule.yml Normal file
View file

@ -0,0 +1,33 @@
---
driver:
name: docker
lint: |
set -e
yamllint .
ansible-lint
flake8
platforms:
- name: centos-6
image: centos:6
dockerfile: ../common/Dockerfile.j2
- name: centos-7
image: centos:7
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/usr/sbin/init"
- name: centos-8
image: centos:8
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/usr/sbin/init"
provisioner:
name: ansible
playbooks:
converge: ../common/playbook_default.yml
verifier:
name: testinfra
directory: ../common/test_default

44
ansible/roles/nginxinc.nginx/molecule/module/molecule.yml Normal file
View file

@ -0,0 +1,44 @@
---
driver:
name: docker
lint: |
set -e
yamllint .
ansible-lint
flake8
platforms:
- name: debian-stretch
image: debian:stretch-slim
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: debian-buster
image: debian:buster-slim
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: ubuntu-xenial
image: ubuntu:xenial
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: ubuntu-bionic
image: ubuntu:bionic
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
provisioner:
name: ansible
playbooks:
converge: ../common/playbook_module.yml
verifier:
name: testinfra
directory: ../common/test_module

44
ansible/roles/nginxinc.nginx/molecule/module_alpine/molecule.yml Normal file
View file

@ -0,0 +1,44 @@
---
driver:
name: docker
lint: |
set -e
yamllint .
ansible-lint
flake8
platforms:
- name: alpine-3.8
image: alpine:3.8
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: alpine-3.9
image: alpine:3.9
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: alpine-3.10
image: alpine:3.10
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: alpine-3.11
image: alpine:3.11
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
provisioner:
name: ansible
playbooks:
converge: ../common/playbook_module.yml
verifier:
name: testinfra
directory: ../common/test_module

33
ansible/roles/nginxinc.nginx/molecule/module_centos/molecule.yml Normal file
View file

@ -0,0 +1,33 @@
---
driver:
name: docker
lint: |
set -e
yamllint .
ansible-lint
flake8
platforms:
- name: centos-6
image: centos:6
dockerfile: ../common/Dockerfile.j2
- name: centos-7
image: centos:7
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/usr/sbin/init"
- name: centos-8
image: centos:8
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/usr/sbin/init"
provisioner:
name: ansible
playbooks:
converge: ../common/playbook_module.yml
verifier:
name: testinfra
directory: ../common/test_module

44
ansible/roles/nginxinc.nginx/molecule/source/molecule.yml Normal file
View file

@ -0,0 +1,44 @@
---
driver:
name: docker
lint: |
set -e
yamllint .
ansible-lint
flake8
platforms:
- name: debian-stretch
image: debian:stretch-slim
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: debian-buster
image: debian:buster-slim
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: ubuntu-xenial
image: ubuntu:xenial
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: ubuntu-bionic
image: ubuntu:bionic
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
provisioner:
name: ansible
playbooks:
converge: ../common/playbook_source.yml
verifier:
name: testinfra
directory: ../common/test_source

44
ansible/roles/nginxinc.nginx/molecule/source_alpine/molecule.yml Normal file
View file

@ -0,0 +1,44 @@
---
driver:
name: docker
lint: |
set -e
yamllint .
ansible-lint
flake8
platforms:
- name: alpine-3.8
image: alpine:3.8
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: alpine-3.9
image: alpine:3.9
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: alpine-3.10
image: python:alpine3.10
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: alpine-3.11
image: python:alpine3.11
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
provisioner:
name: ansible
playbooks:
converge: ../common/playbook_source.yml
verifier:
name: testinfra
directory: ../common/test_source

30
ansible/roles/nginxinc.nginx/molecule/source_centos/molecule.yml Normal file
View file

@ -0,0 +1,30 @@
---
driver:
name: docker
lint: |
set -e
yamllint .
ansible-lint
flake8
platforms:
- name: centos-7
image: centos:7
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/usr/sbin/init"
- name: centos-8
image: centos:8
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/usr/sbin/init"
provisioner:
name: ansible
playbooks:
converge: ../common/playbook_source.yml
verifier:
name: testinfra
directory: ../common/test_source

47
ansible/roles/nginxinc.nginx/molecule/stable_push/molecule.yml Normal file
View file

@ -0,0 +1,47 @@
---
dependency:
name: shell
command: pip install python-nginx
driver:
name: docker
lint: |
set -e
yamllint .
ansible-lint
flake8
platforms:
- name: debian-stretch
image: debian:stretch-slim
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: debian-buster
image: debian:buster-slim
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: ubuntu-xenial
image: ubuntu:xenial
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: ubuntu-bionic
image: ubuntu:bionic
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
provisioner:
name: ansible
playbooks:
converge: ../common/playbook_stable_push.yml
verifier:
name: testinfra
directory: ../common/test_stable_push

47
ansible/roles/nginxinc.nginx/molecule/stable_push_alpine/molecule.yml Normal file
View file

@ -0,0 +1,47 @@
---
dependency:
name: shell
command: pip install python-nginx
driver:
name: docker
lint: |
set -e
yamllint .
ansible-lint
flake8
platforms:
- name: alpine-3.8
image: alpine:3.8
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: alpine-3.9
image: alpine:3.9
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: alpine-3.10
image: alpine:3.10
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: alpine-3.11
image: alpine:3.11
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
provisioner:
name: ansible
playbooks:
converge: ../common/playbook_stable_push.yml
verifier:
name: testinfra
directory: ../common/test_stable_push

36
ansible/roles/nginxinc.nginx/molecule/stable_push_centos/molecule.yml Normal file
View file

@ -0,0 +1,36 @@
---
dependency:
name: shell
command: pip install python-nginx
driver:
name: docker
lint: |
set -e
yamllint .
ansible-lint
flake8
platforms:
- name: centos-6
image: centos:6
dockerfile: ../common/Dockerfile.j2
- name: centos-7
image: centos:7
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/usr/sbin/init"
- name: centos-8
image: centos:8
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/usr/sbin/init"
provisioner:
name: ansible
playbooks:
converge: ../common/playbook_stable_push.yml
verifier:
name: testinfra
directory: ../common/test_stable_push

47
ansible/roles/nginxinc.nginx/molecule/template/molecule.yml Normal file
View file

@ -0,0 +1,47 @@
---
dependency:
name: shell
command: pip install python-nginx
driver:
name: docker
lint: |
set -e
yamllint .
ansible-lint
flake8
platforms:
- name: debian-stretch
image: debian:stretch-slim
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: debian-buster
image: debian:buster-slim
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: ubuntu-xenial
image: ubuntu:xenial
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: ubuntu-bionic
image: ubuntu:bionic
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
provisioner:
name: ansible
playbooks:
converge: ../common/playbook_template.yml
verifier:
name: testinfra
directory: ../common/test_template

47
ansible/roles/nginxinc.nginx/molecule/template_alpine/molecule.yml Normal file
View file

@ -0,0 +1,47 @@
---
dependency:
name: shell
command: pip install python-nginx
driver:
name: docker
lint: |
set -e
yamllint .
ansible-lint
flake8
platforms:
- name: alpine-3.8
image: alpine:3.8
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: alpine-3.9
image: alpine:3.9
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: alpine-3.10
image: alpine:3.10
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: alpine-3.11
image: alpine:3.11
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
provisioner:
name: ansible
playbooks:
converge: ../common/playbook_template.yml
verifier:
name: testinfra
directory: ../common/test_template

36
ansible/roles/nginxinc.nginx/molecule/template_centos/molecule.yml Normal file
View file

@ -0,0 +1,36 @@
---
dependency:
name: shell
command: pip install python-nginx
driver:
name: docker
lint: |
set -e
yamllint .
ansible-lint
flake8
platforms:
- name: centos-6
image: centos:6
dockerfile: ../common/Dockerfile.j2
- name: centos-7
image: centos:7
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/usr/sbin/init"
- name: centos-8
image: centos:8
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/usr/sbin/init"
provisioner:
name: ansible
playbooks:
converge: ../common/playbook_template.yml
verifier:
name: testinfra
directory: ../common/test_template

41
ansible/roles/nginxinc.nginx/molecule/unit/molecule.yml Normal file
View file

@ -0,0 +1,41 @@
---
driver:
name: docker
lint: |
set -e
yamllint .
ansible-lint
flake8
platforms:
- name: debian-stretch
image: debian:stretch-slim
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: debian-buster
image: debian:buster-slim
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: ubuntu-xenial
image: ubuntu:xenial
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: ubuntu-bionic
image: ubuntu:bionic
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
provisioner:
name: ansible
playbooks:
converge: ../common/playbook_unit.yml

41
ansible/roles/nginxinc.nginx/molecule/unit_alpine/molecule.yml Normal file
View file

@ -0,0 +1,41 @@
---
driver:
name: docker
lint: |
set -e
yamllint .
ansible-lint
flake8
platforms:
- name: alpine-3.8
image: alpine:3.8
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: alpine-3.9
image: alpine:3.9
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: alpine-3.10
image: alpine:3.10
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
- name: alpine-3.11
image: alpine:3.11
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/sbin/init"
provisioner:
name: ansible
playbooks:
converge: ../common/playbook_unit.yml

30
ansible/roles/nginxinc.nginx/molecule/unit_centos/molecule.yml Normal file
View file

@ -0,0 +1,30 @@
---
driver:
name: docker
lint: |
set -e
yamllint .
ansible-lint
flake8
platforms:
- name: centos-6
image: centos:6
dockerfile: ../common/Dockerfile.j2
- name: centos-7
image: centos:7
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/usr/sbin/init"
- name: centos-8
image: centos:8
dockerfile: ../common/Dockerfile.j2
privileged: true
volumes:
- "/sys/fs/cgroup:/sys/fs/cgroup:rw"
command: "/usr/sbin/init"
provisioner:
name: ansible
playbooks:
converge: ../common/playbook_unit.yml

24
ansible/roles/nginxinc.nginx/tasks/amplify/install-amplify.yml Normal file
View file

@ -0,0 +1,24 @@
---
- import_tasks: setup-debian.yml
when: ansible_os_family == "Debian"
- import_tasks: setup-redhat.yml
when: ansible_os_family == "RedHat"
- name: "(Install: All OSs) Install NGINX Amplify Agent"
package:
name: nginx-amplify-agent
state: present
- name: "(Setup: All OSs) Copy NGINX Configurator Agent Configuration Template"
copy:
remote_src: yes
src: /etc/amplify-agent/agent.conf.default
dest: /etc/amplify-agent/agent.conf
- name: "(Setup: All OSs) Configure NGINX Amplify Agent API Key"
lineinfile:
dest: /etc/amplify-agent/agent.conf
regexp: api_key =.*
line: "api_key = {{ nginx_amplify_api_key }}"
notify: "(Handler: All OSs) Start NGINX Amplify Agent"

5
ansible/roles/nginxinc.nginx/tasks/amplify/setup-debian.yml Normal file
View file

@ -0,0 +1,5 @@
---
- name: "(Install: Debian/Ubuntu) Add NGINX Amplify Agent Repository"
apt_repository:
filename: nginx-amplify
repo: deb [arch=amd64] http://packages.amplify.nginx.com/{{ ansible_distribution|lower }}/ {{ ansible_distribution_release|lower }} amplify-agent

8
ansible/roles/nginxinc.nginx/tasks/amplify/setup-redhat.yml Normal file
View file

@ -0,0 +1,8 @@
---
- name: "(Install: CentOS/RedHat/Amazon Linux) Add NGINX Amplify Agent Repository"
yum_repository:
name: nginx-amplify
baseurl: http://packages.amplify.nginx.com/{{ (ansible_distribution == "Amazon") | ternary('amzn/', 'centos/') }}/$releasever/$basearch/
description: NGINX Amplify Agent
enabled: yes
gpgcheck: yes

8
ansible/roles/nginxinc.nginx/tasks/conf/cleanup-config.yml Normal file
View file

@ -0,0 +1,8 @@
---
- name: "(Setup: All OSs) Remove NGINX configuration files"
file:
path: "{{ item }}"
state: absent
with_items:
- "{{ nginx_cleanup_config_path }}"
notify: "(Handler: All OSs) Reload NGINX"

9
ansible/roles/nginxinc.nginx/tasks/conf/debug-output.yml Normal file
View file

@ -0,0 +1,9 @@
---
- name: "(Setup: All OSs) Register NGINX configuration"
command: nginx -T
changed_when: false
register: nginx_configuration
- name: "(Setup: All OSs) Print NGINX configuration"
debug:
var: nginx_configuration.stdout_lines

32
ansible/roles/nginxinc.nginx/tasks/conf/setup-status.yml Normal file
View file

@ -0,0 +1,32 @@
---
- name: "(Setup: NGINX Open Source) Enable NGINX Open Source Status"
blockinfile:
path: "{{ nginx_status_location }}"
create: yes
block: |
server {
listen 127.0.0.1:{{ nginx_status_port | default('80') }};
location /nginx_status {
stub_status on;
allow 127.0.0.1;
deny all;
}
}
when: nginx_type == "opensource"
notify: "(Handler: All OSs) Reload NGINX"
- name: "(Setup: NGINX Plus) Enable NGINX Plus Status"
blockinfile:
path: "{{ nginx_status_location }}"
create: yes
block: |
server {
listen 127.0.0.1:{{ nginx_status_port | default('80') }};
location /status {
status;
allow 127.0.0.1;
deny all;
}
}
when: nginx_type == "plus"
notify: "(Handler: All OSs) Reload NGINX"

81
ansible/roles/nginxinc.nginx/tasks/conf/template-config.yml Normal file
View file

@ -0,0 +1,81 @@
---
- name: "(Setup: All NGINX) Ensure HTML Directory Exists"
file:
path: "{{ item.value.html_file_location | default('/usr/share/nginx/html') }}"
state: directory
with_dict: "{{ nginx_html_demo_template }}"
when: nginx_html_demo_template_enable | bool
- name: "(Setup: All NGINX) Dynamically Generate HTML Files"
template:
src: "{{ item.value.template_file | default('www/index.html.j2') }}"
dest: "{{ item.value.html_file_location | default('/usr/share/nginx/html') }}/{{ item.value.html_file_name | default('index.html') }}"
backup: yes
with_dict: "{{ nginx_html_demo_template }}"
when: nginx_html_demo_template_enable | bool
- name: "(Setup: All NGINX) Ensure NGINX Main Directory Exists"
file:
path: "{{ nginx_main_template.conf_file_location | default('/etc/nginx') }}"
state: directory
when: nginx_main_template_enable | bool
- name: "(Setup: All NGINX) Dynamically Generate NGINX Main Configuration File"
template:
src: "{{ nginx_main_template.template_file | default('nginx.conf.j2') }}"
dest: "{{ nginx_main_template.conf_file_location | default('/etc/nginx') }}/{{ nginx_main_template.conf_file_name | default('nginx.conf') }}"
backup: yes
when: nginx_main_template_enable | bool
notify: "(Handler: All OSs) Reload NGINX"
- name: "(Setup: All NGINX) Ensure NGINX HTTP Directory Exists"
file:
path: "{{ item.value.conf_file_location | default('/etc/nginx/conf.d/') }}"
state: directory
with_dict: "{{ nginx_http_template }}"
when: nginx_http_template_enable | bool
- name: "(Setup: All NGINX) Ensure NGINX Proxy Cache Directories Exist"
file:
path: "{{ item.1.path }}"
state: directory
owner: "{{ nginx_main_template.user | default('nginx') }}"
with_subelements:
- "{{ nginx_http_template }}"
- proxy_cache.proxy_cache_path
- skip_missing: true
when: nginx_http_template_enable | bool
- name: "(Setup: All NGINX) Dynamically Generate NGINX HTTP Configuration Files"
template:
src: "{{ item.value.template_file | default('http/default.conf.j2') }}"
dest: "{{ item.value.conf_file_location | default('/etc/nginx/conf.d/') }}/{{ item.value.conf_file_name | default('default.conf') }}"
backup: yes
with_dict: "{{ nginx_http_template }}"
when: nginx_http_template_enable | bool
notify: "(Handler: All OSs) Reload NGINX"
- name: "(Setup: All NGINX) Dynamically Generate NGINX API Configuration File"
template:
src: "{{ nginx_rest_api_template_file | default('http/api.conf.j2') }}"
dest: "{{ nginx_rest_api_file_location | default('/etc/nginx/conf.d/api.conf') }}"
backup: yes
notify: "(Handler: All OSs) Reload NGINX"
when: nginx_rest_api_enable | bool
- name: "(Setup: All NGINX) Ensure NGINX Stream Directory Exists"
file:
path: "{{ item.value.conf_file_location | default('/etc/nginx/conf.d/stream/') }}"
state: directory
with_dict: "{{ nginx_stream_template }}"
when: nginx_stream_template_enable | bool
- name: "(Setup: All NGINX) Dynamically Generate NGINX Stream Configuration Files"
template:
src: "{{ item.value.template_file | default('stream/default.conf.j2') }}"
dest: "{{ item.value.conf_file_location | default('/etc/nginx/conf.d/stream/') }}/{{ item.value.conf_file_name | default('default.conf') }}"
backup: yes
with_dict: "{{ nginx_stream_template }}"
notify: "(Handler: All OSs) Reload NGINX"
when: nginx_stream_template_enable | bool

92
ansible/roles/nginxinc.nginx/tasks/conf/upload-config.yml Normal file
View file

@ -0,0 +1,92 @@
---
- name: "(Setup: All NGINX) Ensure NGINX Main Directory Exists"
file:
path: "{{ nginx_main_upload_dest | default('/etc/nginx/') }}"
state: directory
when: nginx_main_upload_enable | bool
- name: "(Setup: All NGINX) Upload NGINX Main Configuration File"
copy:
src: "{{ nginx_main_upload_src | default('conf/nginx.conf') }}"
dest: "{{ nginx_main_upload_dest | default('/etc/nginx/') }}"
backup: yes
when: nginx_main_upload_enable | bool
notify: "(Handler: All OSs) Reload NGINX"
- name: "(Setup: All NGINX) Ensure NGINX HTTP Directory Exists"
file:
path: "{{ nginx_http_upload_dest | default('/etc/nginx/conf.d/') }}"
state: directory
when: nginx_http_upload_enable | bool
- name: "(Setup: All NGINX) Upload NGINX HTTP Configuration Files"
copy:
src: "{{ item }}"
dest: "{{ nginx_http_upload_dest | default('/etc/nginx/conf.d/') }}"
backup: yes
with_fileglob: "{{ nginx_http_upload_src }}"
when: nginx_http_upload_enable | bool
notify: "(Handler: All OSs) Reload NGINX"
- name: "(Setup: All NGINX) Ensure NGINX Stream Directory Exists"
file:
path: "{{ nginx_stream_upload_dest | default('/etc/nginx/conf.d/') }}"
state: directory
when: nginx_stream_upload_enable | bool
- name: "(Setup: All NGINX) Upload NGINX Stream Configuration Files"
copy:
src: "{{ item }}"
dest: "{{ nginx_stream_upload_dest | default('/etc/nginx/conf.d/') }}"
backup: yes
with_fileglob: "{{ nginx_stream_upload_src }}"
when: nginx_stream_upload_enable | bool
notify: "(Handler: All OSs) Reload NGINX"
- name: "(Setup: All NGINX) Ensure NGINX HTML Directory Exists"
file:
path: "{{ nginx_html_upload_dest | default('/usr/share/nginx/html') }}"
state: directory
when: nginx_html_upload_enable | bool
- name: "(Setup: All NGINX) Upload NGINX HTML Files"
copy:
src: "{{ item }}"
dest: "{{ nginx_html_upload_dest | default('/usr/share/nginx/html') }}"
backup: yes
with_fileglob: "{{ nginx_html_upload_src }}"
when: nginx_html_upload_enable | bool
notify: "(Handler: All OSs) Reload NGINX"
- name: "(Setup: All NGINX) Ensure SSL Certificate Directory Exists"
file:
path: "{{ nginx_ssl_crt_upload_dest | default('/etc/ssl/certs/') }}"
state: directory
when: nginx_ssl_upload_enable | bool
- name: "(Setup: All NGINX) Ensure SSL Key Directory Exists"
file:
path: "{{ nginx_ssl_key_upload_dest | default('/etc/ssl/private/') }}"
state: directory
when: nginx_ssl_upload_enable | bool
- name: "(Setup: All NGINX) Upload NGINX SSL Certificates"
copy:
src: "{{ item }}"
dest: "{{ nginx_ssl_crt_upload_dest | default('/etc/ssl/certs/') }}"
mode: 0640
decrypt: yes
backup: yes
with_fileglob: "{{ nginx_ssl_crt_upload_src }}"
when: nginx_ssl_upload_enable | bool
- name: "(Setup: All NGINX) Upload NGINX SSL Keys"
copy:
src: "{{ item }}"
dest: "{{ nginx_ssl_key_upload_dest | default('/etc/ssl/private/') }}"
mode: 0640
decrypt: yes
backup: yes
with_fileglob: "{{ nginx_ssl_key_upload_src }}"
no_log: yes
when: nginx_ssl_upload_enable | bool

13
ansible/roles/nginxinc.nginx/tasks/keys/apk-key.yml Normal file
View file

@ -0,0 +1,13 @@
---
- name: "(Install: APK OSs) Set Default APK NGINX Signing Key URL"
set_fact:
default_keysite: https://nginx.org/keys/nginx_signing.rsa.pub
- name: "(Install: APK OSs) Set APK NGINX Signing Key URL"
set_fact:
keysite: "{{ nginx_signing_key | default(default_keysite) }}"
- name: "(Install: APK OSs) Download NGINX Signing Key"
get_url:
url: "{{ keysite }}"
dest: /etc/apk/keys/nginx_signing.rsa.pub

12
ansible/roles/nginxinc.nginx/tasks/keys/apt-key.yml Normal file
View file

@ -0,0 +1,12 @@
---
- name: "(Install: APT OSs) Set Default APT NGINX Signing Key URL"
set_fact:
default_keysite: https://nginx.org/keys/nginx_signing.key
- name: "(Install: APT OSs) Set APT NGINX Signing Key URL"
set_fact:
keysite: "{{ nginx_signing_key | default(default_keysite) }}"
- name: "(Install: APT OSs) Add APT NGINX Signing Key"
apt_key:
url: "{{ keysite }}"

14
ansible/roles/nginxinc.nginx/tasks/keys/rpm-key.yml Normal file
View file

@ -0,0 +1,14 @@
---
- name: "(Install: RPM OSs) Set Default RPM NGINX Signing Key"
set_fact:
default_keysite: >-
{{ (ansible_distribution_major_version|int == 6)
| ternary('http://nginx.org/keys/nginx_signing.key', 'https://nginx.org/keys/nginx_signing.key') }}
- name: "(Install: RPM OSs) Set RPM NGINX Signing Key URL"
set_fact:
keysite: "{{ nginx_signing_key | default(default_keysite) }}"
- name: "(Install: RPM OSs) Add RPM NGINX Signing Key"
rpm_key:
key: "{{ keysite }}"

85
ansible/roles/nginxinc.nginx/tasks/main.yml Normal file
View file

@ -0,0 +1,85 @@
---
- import_tasks: prerequisites/install-prerequisites.yml
tags: nginx_prerequisites
- import_tasks: keys/apt-key.yml
when:
- ansible_os_family == "Debian"
- nginx_install_from == "nginx_repository"
or nginx_amplify_enable
or nginx_unit_enable
tags: nginx_aptkey
- import_tasks: keys/rpm-key.yml
when:
- ansible_os_family == "RedHat"
or ansible_os_family == "Suse"
- nginx_install_from == "nginx_repository"
or nginx_amplify_enable
or nginx_unit_enable
tags: nginx_rpmkey
- import_tasks: keys/apk-key.yml
when: ansible_os_family == "Alpine"
tags: nginx_apkkey
- name: "(Install: Debian/Ubuntu/CentOS/RedHat/FreeBSD) Install NGINX"
block:
- import_tasks: opensource/install-oss.yml
when: nginx_type == "opensource"
tags: nginx_install_oss
- import_tasks: plus/install-plus.yml
when: nginx_type == "plus"
tags: nginx_install_plus
- import_tasks: conf/cleanup-config.yml
when: nginx_cleanup_config | bool
tags: nginx_cleanup_config
- import_tasks: conf/upload-config.yml
when: nginx_main_upload_enable
or nginx_http_upload_enable
or nginx_stream_upload_enable
or nginx_html_upload_enable
or nginx_ssl_upload_enable
tags: nginx_upload_config
- import_tasks: conf/template-config.yml
when: nginx_main_template_enable
or nginx_http_template_enable
or nginx_stream_template_enable
or nginx_rest_api_enable
tags: nginx_template_config
- import_tasks: conf/setup-status.yml
when: nginx_status_enable | bool
tags: nginx_setup_status
- import_tasks: modules/install-modules.yml
when: true in nginx_modules.values()
tags: nginx_install_modules
- import_tasks: conf/debug-output.yml
when: nginx_debug_output | bool
tags: nginx_debug_output
- import_tasks: plus/delete-license.yml
when:
- nginx_type == "plus"
- nginx_delete_license
tags: nginx_delete_license
when: nginx_enable | bool
- import_tasks: amplify/install-amplify.yml
when:
- nginx_amplify_enable | bool
- nginx_amplify_api_key is defined
- nginx_amplify_api_key | length > 0
tags: nginx_install_amplify
- import_tasks: unit/install-unit.yml
when: nginx_unit_enable | bool
tags: nginx_install_unit

Some files were not shown because too many files have changed in this diff Show more