diff --git a/README.md b/README.md index e276195..7c99169 100644 --- a/README.md +++ b/README.md @@ -113,20 +113,15 @@ For an update release with a specific version, use: ansible-playbook -s ansible/site.yaml -i ansible/inventories/production --tags release -e gitversion= ``` -Once the basic system set up, i.e. you have an `ansible` user in the sudoers and docker group, and a few basic system packages ready. - -For example, on Ubuntu: - -``` -apt-get install -q -y zip git nginx python-virtualenv python-dev -``` +Once the basic system set up, i.e. you have an `ansible` user in the sudoers and docker group, you are ready to run the playbook. The typical order of deployment is: -- node.yaml -- site.yaml - docker.yaml -- harden.yaml +- node.yaml +- web.yaml +- wagtail.yaml +- internet.yaml ### Production releases diff --git a/ansible/harden.yaml b/ansible/internet.yaml similarity index 87% rename from ansible/harden.yaml rename to ansible/internet.yaml index 205152b..7f18f4e 100644 --- a/ansible/harden.yaml +++ b/ansible/internet.yaml @@ -7,5 +7,5 @@ roles: - role: dev-sec.os-hardening - role: dev-sec.ssh-hardening - become: yes - role: dev-sec.nginx-hardening + - role: jnv.unattended-upgrades diff --git a/ansible/inventories/evolution/group_vars/webservers/vault.yaml b/ansible/inventories/evolution/group_vars/webservers/vault.yaml index 1028263..b9fbe6f 100644 --- a/ansible/inventories/evolution/group_vars/webservers/vault.yaml +++ b/ansible/inventories/evolution/group_vars/webservers/vault.yaml @@ -1,46 +1,46 @@ $ANSIBLE_VAULT;1.1;AES256 -39623434656631643030663563343865363562353834336262353939666566643961323936316537 -6139376161613163626664323564626134333066346265330a636334616466306464316365653038 -32646430633039303364366163646430633436366664333064393364663132363535666338666137 -3531323636316435640a326135303364623461623434343663343062653434356165356161326365 -66663664643463393964653764376264616166306433343761653037616639326538626531663239 -37376263303237346131326231656439366430373637653634396139333431636565373630626131 -39303661383937346630623830613462393163333032643035313765393030653337363161386364 -36623132353033316239326365343064663130333161353835643935613034303838373861323163 -62363564343531666665356439326139366463646661636534386334323765636336306136623766 -62636534626461326166613934663535633962336130386463633439343434353637396131383633 -61343335393463313433356363366639626535346263333635393039376335343965393138323639 -32386461626164356666386535393365616539323631303265303833373635646339343031346139 -39336332396662636561613636303866303230353866646330306433353938306133336239326431 -65383365313336636166353533363439333739373832353839656139306262366230646631363033 -62653430396463663232613539353135666465666635316432383230306361376330353938356538 -39333566373366323134613262623865383866363163383931386632643131313939346161343438 -38353733393938356266353761326635316239373964656535633937643830373161646661333130 -36646364646361343336326662346361616239653964646537306366333234313833623337653732 -66623238613961303131356632343163323264616664373638653331656561663333306133386630 -62333662306234663036333062646635303662646136396666343535383565386664313239656633 -32663366323964306362346366393734623630376432373936316362616639363636306439623636 -34313165663264653235636632386563323964373863396363303934336138323435333462373033 -34373163623864623836646435333730386137383634333066653865666331303438616462366134 -63343837373130616638646338643339393432343130323838303837636566626436336538396463 -65393332343964663233623634363234643266386634336231303930396463303537373466633565 -64393966306161336265393936656364383237363065326130356331643766383166656536643263 -32636236333637663737366666616461653939303033643730623137353735663234636438623431 -38623931343939376661633438336563383365633336343563646134376230613930626461383133 -39616535646166333435363234643939376464323730333263633333616531393666363561633133 -36396464383662623439616630633361316339306139393434383932663464653634393064343061 -63643338396432326539363166366163373336616137326566643764303361636130613439663036 -38376261326333373061653862663833313563363537373534336638656632313033616238393638 -63353435613231316439366535656139623366333534303662323839336232646636346166653866 -36633138396363616663306535353432313938306535376361353065323935303266386332343730 -36346335386238666235333263626265353431616262313537396336353232363964316538303363 -36303165313462653336653863343233323336383835336230393836343332376165653866643738 -65393734393037303162653930313564303837353631623632343561336561383062613363653238 -37353234616333356432643731343535313434613534323835613465656432333735643863386264 -61653235333239663739353738323264333930653337323431666461636265383836663539323531 -39633761323536306536633064666161383839626437666430613963353430366435383630386232 -35646439303031643035616133326433326163333830643436663262633665653365343830653630 -37613235623462623937383330656530363033336636653534316235636336636137333537393434 -33663664303437396632663630643166393631613566646165386333363035373733393333623365 -62313862383432396362363565636361623630313161653436633366323836333566396363313535 -39623166313239663638643134613364623934303438313136353562633962336538 +66633532633065306238613537323739643935353461666533613435353935386237353935636231 +3235643564396462323063353264633436353335633333660a623236313663336361313739363564 +63653464316464373031383636326465396436373639646136663466343464323262623136303361 +3066653062326230310a393534653837323735393339326434356437373436303634646235396130 +65353635323065343132353162636531653339313665656166393238356232633763653730383633 +32636134336565666564616434373539353031366261303761613361336664353638303739396265 +39666132353966323738623966383439313332323230333462356463353935653635613435393232 +34643436313665663362393037636536386634623137623665663464366563393061643335386433 +63353138653331623331323634663137346661653264326562396136323033346239643962366466 +61313038646233663662363530336365656166646434393737383064653635666361363462633564 +33336335636366373061366361333034353466346631353432633738356464653162373237623066 +36616264323436343465313837326464363531656135626463366432363266363333346533336339 +33643439636562373261663465316134373838323931663539353531643764653338393161653732 +34333434373234636265383564623630613235313932303839336438623639626538383061336130 +61343866656431303034373130636238336463613963366465663862373232626137383336326161 +65323030643735653562313664333363663630613137366136313739373932393235663138333733 +36336163313136623238643239613763653864623765343463333532326534306166306437643831 +38636537333835643635363237303036336432386439643564623632616639323864386630396339 +36663039363462653064623565653364303739643962306531626335393433343334343331663239 +37613337373937343565313866396335366338303532613434653062653763376134383935633430 +61383463326366626536363839373633363330376135306637386335353237303133386264373436 +66666332666665363063316366643331663532323165636634313862663966383531333532663834 +39393664616135326661316264643361316337336636366461366265653062633232653766623432 +32326131303164623234326232616437666436666562376135656339386239336665336236366664 +30353538666330346230303335636361656130633139383334393861393462336265313261313135 +65323430376461336238626632316561366636616139643131346631316138613037346435393938 +61376639343962393535633637346561643339663363356235646363333932346332343639333930 +65653238656636313732316337373432316662626331626134346139396131383764656366316631 +38313464353035626561633536656136306432663565356366333732396262353031653561303636 +37633634393536363964646533333263346231366664323764306233386333353037333766333839 +31396433383331386637613334616665633336623162323161323939646137313535363061306261 +34383765633134616637386566376132393862326666626363646132643365633964376138663263 +64646635663632626165366333636533393966363935616537616138636538373362633334613036 +64396335393264666638333162643866316539663135363263666463643431653631373366323235 +35343731313461316335656231373434393533363433336563646131316464666537356530353263 +65346361653031336236303439396630613130323536313762356135333863383230333637343261 +65326165663239383638393431353936663438366263373238313634653361323037323030363733 +38623532393165393962356437303562653163383032656239616135623162353233373263393264 +36633363633334643637396338383735376663653436346437656235393766356163383964646136 +39306366316439383162653539666636623537643961613432643664653862633430666439626435 +32333734323930613930306561623833303562323564363861313035663636376232616366383663 +33656464663937323933633231323031303937316438346362383663376236623066653332313636 +62306332356462316637653036383761393039643437663339313461613631313037306538653531 +36353033663938313831613565623561343132306463393734326334353135363332643866353038 +35323835343366393466343564343538313837623334393765323530306135343566 diff --git a/ansible/roles/jnv.unattended-upgrades/.editorconfig b/ansible/roles/jnv.unattended-upgrades/.editorconfig new file mode 100644 index 0000000..c6c8b36 --- /dev/null +++ b/ansible/roles/jnv.unattended-upgrades/.editorconfig @@ -0,0 +1,9 @@ +root = true + +[*] +indent_style = space +indent_size = 2 +end_of_line = lf +charset = utf-8 +trim_trailing_whitespace = true +insert_final_newline = true diff --git a/ansible/roles/jnv.unattended-upgrades/.gitignore b/ansible/roles/jnv.unattended-upgrades/.gitignore new file mode 100644 index 0000000..d9ff546 --- /dev/null +++ b/ansible/roles/jnv.unattended-upgrades/.gitignore @@ -0,0 +1,3 @@ +.vagrant/ +*~ +*.log diff --git a/ansible/roles/jnv.unattended-upgrades/.travis.yml b/ansible/roles/jnv.unattended-upgrades/.travis.yml new file mode 100644 index 0000000..32fdb5d --- /dev/null +++ b/ansible/roles/jnv.unattended-upgrades/.travis.yml @@ -0,0 +1,16 @@ +sudo: required +language: python +services: docker + +cache: pip + +install: + - pip install ansible docker + - ansible-galaxy install -r tests/requirements.yml -p tests/roles/ + +script: + - ansible --version + - tests/test.sh + +notifications: + webhooks: https://galaxy.ansible.com/api/v1/notifications/ diff --git a/ansible/roles/jnv.unattended-upgrades/LICENSE b/ansible/roles/jnv.unattended-upgrades/LICENSE new file mode 100644 index 0000000..d511905 --- /dev/null +++ b/ansible/roles/jnv.unattended-upgrades/LICENSE @@ -0,0 +1,339 @@ + GNU GENERAL PUBLIC LICENSE + Version 2, June 1991 + + Copyright (C) 1989, 1991 Free Software Foundation, Inc., + 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The licenses for most software are designed to take away your +freedom to share and change it. By contrast, the GNU General Public +License is intended to guarantee your freedom to share and change free +software--to make sure the software is free for all its users. This +General Public License applies to most of the Free Software +Foundation's software and to any other program whose authors commit to +using it. (Some other Free Software Foundation software is covered by +the GNU Lesser General Public License instead.) You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +this service if you wish), that you receive source code or can get it +if you want it, that you can change the software or use pieces of it +in new free programs; and that you know you can do these things. + + To protect your rights, we need to make restrictions that forbid +anyone to deny you these rights or to ask you to surrender the rights. +These restrictions translate to certain responsibilities for you if you +distribute copies of the software, or if you modify it. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must give the recipients all the rights that +you have. You must make sure that they, too, receive or can get the +source code. And you must show them these terms so they know their +rights. + + We protect your rights with two steps: (1) copyright the software, and +(2) offer you this license which gives you legal permission to copy, +distribute and/or modify the software. + + Also, for each author's protection and ours, we want to make certain +that everyone understands that there is no warranty for this free +software. If the software is modified by someone else and passed on, we +want its recipients to know that what they have is not the original, so +that any problems introduced by others will not reflect on the original +authors' reputations. + + Finally, any free program is threatened constantly by software +patents. We wish to avoid the danger that redistributors of a free +program will individually obtain patent licenses, in effect making the +program proprietary. To prevent this, we have made it clear that any +patent must be licensed for everyone's free use or not licensed at all. + + The precise terms and conditions for copying, distribution and +modification follow. + + GNU GENERAL PUBLIC LICENSE + TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + + 0. This License applies to any program or other work which contains +a notice placed by the copyright holder saying it may be distributed +under the terms of this General Public License. The "Program", below, +refers to any such program or work, and a "work based on the Program" +means either the Program or any derivative work under copyright law: +that is to say, a work containing the Program or a portion of it, +either verbatim or with modifications and/or translated into another +language. (Hereinafter, translation is included without limitation in +the term "modification".) Each licensee is addressed as "you". + +Activities other than copying, distribution and modification are not +covered by this License; they are outside its scope. The act of +running the Program is not restricted, and the output from the Program +is covered only if its contents constitute a work based on the +Program (independent of having been made by running the Program). +Whether that is true depends on what the Program does. + + 1. You may copy and distribute verbatim copies of the Program's +source code as you receive it, in any medium, provided that you +conspicuously and appropriately publish on each copy an appropriate +copyright notice and disclaimer of warranty; keep intact all the +notices that refer to this License and to the absence of any warranty; +and give any other recipients of the Program a copy of this License +along with the Program. + +You may charge a fee for the physical act of transferring a copy, and +you may at your option offer warranty protection in exchange for a fee. + + 2. You may modify your copy or copies of the Program or any portion +of it, thus forming a work based on the Program, and copy and +distribute such modifications or work under the terms of Section 1 +above, provided that you also meet all of these conditions: + + a) You must cause the modified files to carry prominent notices + stating that you changed the files and the date of any change. + + b) You must cause any work that you distribute or publish, that in + whole or in part contains or is derived from the Program or any + part thereof, to be licensed as a whole at no charge to all third + parties under the terms of this License. + + c) If the modified program normally reads commands interactively + when run, you must cause it, when started running for such + interactive use in the most ordinary way, to print or display an + announcement including an appropriate copyright notice and a + notice that there is no warranty (or else, saying that you provide + a warranty) and that users may redistribute the program under + these conditions, and telling the user how to view a copy of this + License. (Exception: if the Program itself is interactive but + does not normally print such an announcement, your work based on + the Program is not required to print an announcement.) + +These requirements apply to the modified work as a whole. If +identifiable sections of that work are not derived from the Program, +and can be reasonably considered independent and separate works in +themselves, then this License, and its terms, do not apply to those +sections when you distribute them as separate works. But when you +distribute the same sections as part of a whole which is a work based +on the Program, the distribution of the whole must be on the terms of +this License, whose permissions for other licensees extend to the +entire whole, and thus to each and every part regardless of who wrote it. + +Thus, it is not the intent of this section to claim rights or contest +your rights to work written entirely by you; rather, the intent is to +exercise the right to control the distribution of derivative or +collective works based on the Program. + +In addition, mere aggregation of another work not based on the Program +with the Program (or with a work based on the Program) on a volume of +a storage or distribution medium does not bring the other work under +the scope of this License. + + 3. You may copy and distribute the Program (or a work based on it, +under Section 2) in object code or executable form under the terms of +Sections 1 and 2 above provided that you also do one of the following: + + a) Accompany it with the complete corresponding machine-readable + source code, which must be distributed under the terms of Sections + 1 and 2 above on a medium customarily used for software interchange; or, + + b) Accompany it with a written offer, valid for at least three + years, to give any third party, for a charge no more than your + cost of physically performing source distribution, a complete + machine-readable copy of the corresponding source code, to be + distributed under the terms of Sections 1 and 2 above on a medium + customarily used for software interchange; or, + + c) Accompany it with the information you received as to the offer + to distribute corresponding source code. (This alternative is + allowed only for noncommercial distribution and only if you + received the program in object code or executable form with such + an offer, in accord with Subsection b above.) + +The source code for a work means the preferred form of the work for +making modifications to it. For an executable work, complete source +code means all the source code for all modules it contains, plus any +associated interface definition files, plus the scripts used to +control compilation and installation of the executable. However, as a +special exception, the source code distributed need not include +anything that is normally distributed (in either source or binary +form) with the major components (compiler, kernel, and so on) of the +operating system on which the executable runs, unless that component +itself accompanies the executable. + +If distribution of executable or object code is made by offering +access to copy from a designated place, then offering equivalent +access to copy the source code from the same place counts as +distribution of the source code, even though third parties are not +compelled to copy the source along with the object code. + + 4. You may not copy, modify, sublicense, or distribute the Program +except as expressly provided under this License. Any attempt +otherwise to copy, modify, sublicense or distribute the Program is +void, and will automatically terminate your rights under this License. +However, parties who have received copies, or rights, from you under +this License will not have their licenses terminated so long as such +parties remain in full compliance. + + 5. You are not required to accept this License, since you have not +signed it. However, nothing else grants you permission to modify or +distribute the Program or its derivative works. These actions are +prohibited by law if you do not accept this License. Therefore, by +modifying or distributing the Program (or any work based on the +Program), you indicate your acceptance of this License to do so, and +all its terms and conditions for copying, distributing or modifying +the Program or works based on it. + + 6. Each time you redistribute the Program (or any work based on the +Program), the recipient automatically receives a license from the +original licensor to copy, distribute or modify the Program subject to +these terms and conditions. You may not impose any further +restrictions on the recipients' exercise of the rights granted herein. +You are not responsible for enforcing compliance by third parties to +this License. + + 7. If, as a consequence of a court judgment or allegation of patent +infringement or for any other reason (not limited to patent issues), +conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot +distribute so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you +may not distribute the Program at all. For example, if a patent +license would not permit royalty-free redistribution of the Program by +all those who receive copies directly or indirectly through you, then +the only way you could satisfy both it and this License would be to +refrain entirely from distribution of the Program. + +If any portion of this section is held invalid or unenforceable under +any particular circumstance, the balance of the section is intended to +apply and the section as a whole is intended to apply in other +circumstances. + +It is not the purpose of this section to induce you to infringe any +patents or other property right claims or to contest validity of any +such claims; this section has the sole purpose of protecting the +integrity of the free software distribution system, which is +implemented by public license practices. Many people have made +generous contributions to the wide range of software distributed +through that system in reliance on consistent application of that +system; it is up to the author/donor to decide if he or she is willing +to distribute software through any other system and a licensee cannot +impose that choice. + +This section is intended to make thoroughly clear what is believed to +be a consequence of the rest of this License. + + 8. If the distribution and/or use of the Program is restricted in +certain countries either by patents or by copyrighted interfaces, the +original copyright holder who places the Program under this License +may add an explicit geographical distribution limitation excluding +those countries, so that distribution is permitted only in or among +countries not thus excluded. In such case, this License incorporates +the limitation as if written in the body of this License. + + 9. The Free Software Foundation may publish revised and/or new versions +of the General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + +Each version is given a distinguishing version number. If the Program +specifies a version number of this License which applies to it and "any +later version", you have the option of following the terms and conditions +either of that version or of any later version published by the Free +Software Foundation. If the Program does not specify a version number of +this License, you may choose any version ever published by the Free Software +Foundation. + + 10. If you wish to incorporate parts of the Program into other free +programs whose distribution conditions are different, write to the author +to ask for permission. For software which is copyrighted by the Free +Software Foundation, write to the Free Software Foundation; we sometimes +make exceptions for this. Our decision will be guided by the two goals +of preserving the free status of all derivatives of our free software and +of promoting the sharing and reuse of software generally. + + NO WARRANTY + + 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY +FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN +OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES +PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED +OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS +TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE +PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, +REPAIR OR CORRECTION. + + 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR +REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, +INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING +OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED +TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY +YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER +PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE +POSSIBILITY OF SUCH DAMAGES. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +convey the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License along + with this program; if not, write to the Free Software Foundation, Inc., + 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + +Also add information on how to contact you by electronic and paper mail. + +If the program is interactive, make it output a short notice like this +when it starts in an interactive mode: + + Gnomovision version 69, Copyright (C) year name of author + Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, the commands you use may +be called something other than `show w' and `show c'; they could even be +mouse-clicks or menu items--whatever suits your program. + +You should also get your employer (if you work as a programmer) or your +school, if any, to sign a "copyright disclaimer" for the program, if +necessary. Here is a sample; alter the names: + + Yoyodyne, Inc., hereby disclaims all copyright interest in the program + `Gnomovision' (which makes passes at compilers) written by James Hacker. + + , 1 April 1989 + Ty Coon, President of Vice + +This General Public License does not permit incorporating your program into +proprietary programs. If your program is a subroutine library, you may +consider it more useful to permit linking proprietary applications with the +library. If this is what you want to do, use the GNU Lesser General +Public License instead of this License. diff --git a/ansible/roles/jnv.unattended-upgrades/README.md b/ansible/roles/jnv.unattended-upgrades/README.md new file mode 100644 index 0000000..978b832 --- /dev/null +++ b/ansible/roles/jnv.unattended-upgrades/README.md @@ -0,0 +1,180 @@ +# Unattended-Upgrades Role for Ansible + +[![Build Status of branch master](https://img.shields.io/travis/jnv/ansible-role-unattended-upgrades/master.svg?style=flat-square)](https://travis-ci.org/jnv/ansible-role-unattended-upgrades) +[![Ansible Role: jnv.unattended-upgrades](https://img.shields.io/ansible/role/8068.svg?style=flat-square)](https://galaxy.ansible.com/jnv/unattended-upgrades/) + +Install and setup [unattended-upgrades](https://launchpad.net/unattended-upgrades) for Ubuntu and Debian (since Wheezy), to periodically install security upgrades. + +**NOTE:** If you have used version 0.0.1 of the role, you can delete the file `/etc/apt/apt.conf.d/10periodic` as it is not needed anymore. You can use the following one-shot command: + + ansible -m file -a "state=absent path=/etc/apt/apt.conf.d/10periodic" + +## Requirements + +The role uses [apt module](http://docs.ansible.com/apt_repository_module.html) which has additional dependencies. + +If you set `unattended_mail` to an e-mail address, make sure `mailx` command is available and your system is able to send e-mails. + +The role requires unattended-upgrades version 0.70 and newer, which is available since Debian Wheezy and Ubuntu 12.04 respectively. This is due to [Origins Patterns](#origins-patterns) usage; if this is not available on your system, you may use [the first version of the role](https://github.com/jnv/ansible-role-unattended-upgrades/tree/v0.1). + +### Automatic Reboot + +If you enable automatic reboot feature (`unattended_automatic_reboot`), the role will attempt to install `update-notifier-common` package, which is required on some systems for detecting and executing reboot after the upgrade. You may optionally define a specific time for rebooting (`unattended_automatic_reboot_time`). + +This feature was broken in Debian Jessie, but eventually was rolled into the unattended-upgrades package; see [the discussion in #6](https://github.com/jnv/ansible-role-unattended-upgrades/issues/6) for more details. + +## Disabled Cron Jobs + +On some hosts you may find that the unattended-upgrade's cronfile `/etc/cron.daily/apt` file has been renamed to `apt.disabled`. This is possibly provider's decision, to save some CPU cycles. Use [enable-standard-cronjobs](https://github.com/Yannik/ansible-role-enable-standard-cronjobs) role to reenable unattended-upgrades. See also discussion in [#9](https://github.com/jnv/ansible-role-unattended-upgrades/issues/9). + +## Role Variables + +* `unattended_cache_valid_time`: Update the apt cache if its older than the given time in seconds; passed to the [apt module](https://docs.ansible.com/ansible/latest/apt_module.html) during package installation. + * Default: `3600` +* `unattended_origins_patterns`: array of origins patterns to determine whether the package can be automatically installed, for more details see [Origins Patterns](#origins-patterns) below. + * Default for Debian: `['origin=Debian,codename=${distro_codename},label=Debian-Security']` + * Default for Ubuntu: `['origin=Ubuntu,archive=${distro_codename}-security,label=Ubuntu']` +* `unattended_package_blacklist`: packages which won't be automatically upgraded + * Default: `[]` +* `unattended_autofix_interrupted_dpkg`: whether on unclean dpkg exit to run `dpkg --force-confold --configure -a` + * Default: `true` +* `unattended_minimal_steps`: split the upgrade into the smallest possible chunks so that they can be interrupted with SIGUSR1. + * Default: `true` +* `unattended_install_on_shutdown`: install all unattended-upgrades when the machine is shuting down. + * Default: `false` +* `unattended_mail`: e-mail address to send information about upgrades or problems with unattended upgrades + * Default: `false` (don't send any e-mail) +* `unattended_mail_only_on_error`: send e-mail only on errors, otherwise e-mail will be sent every time there's a package upgrade. + * Default: `false` +* `unattended_remove_unused_dependencies`: do automatic removal of new unused dependencies after the upgrade. + * Default: `false` +* `unattended_automatic_reboot`: Automatically reboot system if any upgraded package requires it, immediately after the upgrade. + * Default: `false` +* `unattended_automatic_reboot_time`: Automatically reboot system if any upgraded package requires it, at the specific time (_HH:MM_) instead of immediately after the upgrade. + * Default: `false` +* `unattended_update_days`: Set the days of the week that updates should be applied. The days can be specified as localized abbreviated or full names. Or as integers where "0" is Sunday, "1" is Monday etc. Example: `{"Mon";"Fri"};` + * Default: disabled +* `unattended_ignore_apps_require_restart`: unattended-upgrades won't automatically upgrade some critical packages requiring restart after an upgrade (i.e. there is `XB-Upgrade-Requires: app-restart` directive in their debian/control file). With this option set to `true`, unattended-upgrades will upgrade these packages regardless of the directive. + * Default: `false` +* `unattended_verbose`: Define verbosity level of APT for periodic runs. The output will be sent to root. + * Possible options: + * `0`: no report + * `1`: progress report + * `2`: + command outputs + * `3`: + trace on + * Default: `0` (no report) +* `unattended_update_package_list`: Do "apt-get update" automatically every n-days (0=disable) + * Default: `1` +* `unattended_download_upgradeable`: Do "apt-get upgrade --download-only" every n-days (0=disable) + * Default: `0` +* `unattended_autoclean_interval`: Do "apt-get autoclean" every n-days (0=disable) + * Default: `7` +* `unattended_clean_interval`: Do "apt-get clean" every n-days (0=disable) + * Default: `0` +* `unattended_random_sleep`: Define maximum for a random interval in seconds after which the apt job starts (only for systems without systemd) + * Default: `1800` (30 minutes) +* `unattended_dpkg_options`: Array of dpkg command-line options used during unattended-upgrades runs, e.g. `["--force-confdef"]`, `["--force-confold"]` + * Default: `[]` +* `unattended_dl_limit`: Limit the download speed in kb/sec using apt bandwidth limit feature. + * Default: disabled + +## Origins Patterns + +Origins Pattern is a more powerful alternative to the Allowed Origins option used in previous versions of unattended-upgrade. + +Pattern is composed from specific keywords: + +* `a`,`archive`,`suite` – e.g. `stable`, `trusty-security` (`archive=stable`) +* `c`,`component` – e.g. `main`, `crontrib`, `non-free` (`component=main`) +* `l`,`label` – e.g. `Debian`, `Debian-Security`, `Ubuntu` +* `o`,`origin` – e.g. `Debian`, `Unofficial Multimedia Packages`, `Ubuntu` +* `n`,`codename` – e.g. `jessie`, `jessie-updates`, `trusty` (this is only supported with `unattended-upgrades` >= 0.80) +* `site` – e.g. `http.debian.net` + +You can review the available repositories using `apt-cache policy` and debug your choice using `unattended-upgrades -d` command on a target system. + +Additionally unattended-upgrades support two macros (variables), derived from `/etc/debian_version`: + +* `${distro_id}` – Installed distribution name, e.g. `Debian` or `Ubuntu`. +* `${distro_codename}` – Installed codename, e.g. `jessie` or `trusty`. + +Using `${distro_codename}` should be preferred over using `stable` or `oldstable` as a selected, as once `stable` moves to `oldstable`, no security updates will be installed at all, or worse, package from a newer distro release will be installed by accident. The same goes for upgrading your installation from `oldstable` to `stable`, if you forget to change this in your origin patterns, you may not receive the security updates for your newer distro release. With `${distro_codename}`, both cases can never happen. + +## Role Usage Example + +Example for Ubuntu, with custom [origins patterns](#patterns-examples), blacklisted packages and e-mail notification: + +```yaml +- hosts: all + roles: + - role: jnv.unattended-upgrades + unattended_origins_patterns: + - 'origin=Ubuntu,archive=${distro_codename}-security' + - 'o=Ubuntu,a=${distro_codename}-updates' + unattended_package_blacklist: [cowsay, vim] + unattended_mail: 'root@example.com' +``` + +_Note:_ You don't need to specify `unattended_origins_patterns`, the role will use distribution's default if the variable is not set. + +### Patterns Examples + +By default, only security updates are allowed for both Ubuntu and Debian. You can add more patterns to allow unattended-updates install more packages automatically, however be aware that automated major updates may potentially break your system. + +#### For Debian + +```yaml +unattended_origins_patterns: + - 'origin=Debian,codename=${distro_codename},label=Debian-Security' # security updates + - 'o=Debian,codename=${distro_codename},label=Debian' # updates including non-security updates + - 'o=Debian,codename=${distro_codename},a=proposed-updates' +``` + +On debian wheezy, due to `unattended-upgrades` being `0.79.5`, you cannot use the `codename` directive. + +You will have to do archive based matching instead: + +```yaml +unattended_origins_patterns: + - 'origin=Debian,a=stable,label=Debian-Security' # security updates + - 'o=Debian,a=stable,l=Debian' # updates including non-security updates + - 'o=Debian,a=proposed-updates' +``` + +Please be sure to read about the issues regarding this in the origin pattern documentation above. + +#### For Ubuntu + +In Ubuntu, archive always contains the distribution codename + +```yaml +unattended_origins_patterns: + - 'origin=Ubuntu,archive=${distro_codename}-security' + - 'o=Ubuntu,a=${distro_codename}' + - 'o=Ubuntu,a=${distro_codename}-updates' + - 'o=Ubuntu,a=${distro_codename}-proposed-updates' +``` + + +#### For Raspbian + +In Raspbian, it is only possible to update all packages from the default repository, including non-security updates, or updating none. + +Updating all, including non-security: + +```yaml +unattended_origins_patterns: + - 'origin=Raspbian,codename=${distro_codename},label=Raspbian' +``` + +You can not use the `codename` directive on raspbian wheezy, the same as with debian wheezy above. + +To not install any updates on a raspbian host, just set `unattended_origins_patterns` to an empty list: +``` +unattended_origins_patterns: [] +``` + + +## License + +GPLv2 diff --git a/ansible/roles/jnv.unattended-upgrades/defaults/main.yml b/ansible/roles/jnv.unattended-upgrades/defaults/main.yml new file mode 100644 index 0000000..59fcc69 --- /dev/null +++ b/ansible/roles/jnv.unattended-upgrades/defaults/main.yml @@ -0,0 +1,122 @@ +--- +# Cache update time for apt module +unattended_cache_valid_time: 3600 + +#Unattended-Upgrade::Origins-Pattern +# Automatically upgrade packages from these origin patterns +# e.g.: 'o=Debian,a=stable', 'o=Debian,a=stable-updates' +# +# Left unset, distribution-specific defaults will be used through +# __unattended_origins_patterns variable only if this variable +# is not provided externally +# REFS https://github.com/ansible/ansible/issues/8121 +#unattended_origins_patterns: [] + +#Unattended-Upgrade::Package-Blacklist +# List of packages to not update +unattended_package_blacklist: [] + +#Unattended-Upgrade::AutoFixInterruptedDpkg +# On a unclean dpkg exit unattended-upgrades will run +# dpkg --force-confold --configure -a +# The default is true, to ensure updates keep getting installed +unattended_autofix_interrupted_dpkg: true + +#Unattended-Upgrade::MinimalSteps +# Split the upgrade into the smallest possible chunks so that +# they can be interrupted with SIGUSR1. This makes the upgrade +# a bit slower but it has the benefit that shutdown while a upgrade +# is running is possible (with a small delay) +unattended_minimal_steps: true + +#Unattended-Upgrade::InstallOnShutdown +# Install all unattended-upgrades when the machine is shuting down +# instead of doing it in the background while the machine is running +# This will (obviously) make shutdown slower +unattended_install_on_shutdown: false + +#Unattended-Upgrade::Mail +# Send email to this address for problems or packages upgrades +# If empty or unset then no email is sent, make sure that you +# have a working mail setup on your system. A package that provides +# 'mailx' must be installed. +unattended_mail: false + +#Unattended-Upgrade::MailOnlyOnError +# Set this value to "true" to get emails only on errors. Default +# is to always send a mail if Unattended-Upgrade::Mail is set +unattended_mail_only_on_error: false + +#Unattended-Upgrade::Remove-Unused-Dependencies +# Do automatic removal of new unused dependencies after the upgrade +# (equivalent to apt-get autoremove) +unattended_remove_unused_dependencies: false + +#Unattended-Upgrade::Automatic-Reboot +# Automatically reboot *WITHOUT CONFIRMATION* if a +# the file /var/run/reboot-required is found after the upgrade +unattended_automatic_reboot: false + +#Unattended-Upgrade::Automatic-Reboot-Time +# If automatic reboot is enabled and needed, reboot at the specific +# time instead of immediately +unattended_automatic_reboot_time: false + +#Unattended-Upgrade::IgnoreAppsRequireRestart +# Do upgrade application even if it requires restart after upgrade +# I.e. "XB-Upgrade-Requires: app-restart" is set in the debian/control file +unattended_ignore_apps_require_restart: false + +### APT::Periodic configuration +# Snatched from /usr/lib/apt/apt.systemd.daily + +#APT::Periodic::Update-Package-Lists "0"; +# - Do "apt-get update" automatically every n-days (0=disable) +unattended_update_package_list: 1 + +#APT::Periodic::Download-Upgradeable-Packages "0"; +# - Do "apt-get upgrade --download-only" every n-days (0=disable) +#unattended_download_upgradeable: 0 + +#APT::Periodic::AutocleanInterval "0"; +# - Do "apt-get autoclean" every n-days (0=disable) +unattended_autoclean_interval: 7 + +#APT::Periodic::CleanInterval "0"; +# - Do "apt-get clean" every n-days (0=disable) +#unattended_clean_interval: 0 + +#APT::Periodic::Verbose "0"; +# - Send report mail to root +# 0: no report (or null string) +# 1: progress report (actually any string) +# 2: + command outputs (remove -qq, remove 2>/dev/null, add -d) +# 3: + trace on +#unattended_verbose: 0 + +## Cron systems only + +#APT::Periodic::RandomSleep +# When the apt job starts, it will sleep for a random period between 0 +# and APT::Periodic::RandomSleep seconds +# The default value is "1800" so that the script will stall for up to 30 +# minutes (1800 seconds) so that the mirror servers are not crushed by +# everyone running their updates all at the same time +# Kept undefined to allow default (1800) +#unattended_random_sleep: 0 + +#Dpkg::Options +# Provide dpkg options that take effect during unattended upgrades. +# By default no flags are appended. Configuration file changes can +# block installation of certain packages. Passing the flags +# "--force-confdef" and "--force-confold" will ensure updates are applied +# and old configuration files are preserved. +unattended_dpkg_options: [] + +# unattended_dpkg_options: +# - "--force-confdef" +# - "--force-confold" + + +# Use apt bandwidth limit feature, this example limits the download speed to 70kb/sec +#unattended_dl_limit: 70 \ No newline at end of file diff --git a/ansible/roles/jnv.unattended-upgrades/handlers/main.yml b/ansible/roles/jnv.unattended-upgrades/handlers/main.yml new file mode 100644 index 0000000..c0b5512 --- /dev/null +++ b/ansible/roles/jnv.unattended-upgrades/handlers/main.yml @@ -0,0 +1,2 @@ +--- +# handlers file for unattended-upgrades diff --git a/ansible/roles/jnv.unattended-upgrades/meta/.galaxy_install_info b/ansible/roles/jnv.unattended-upgrades/meta/.galaxy_install_info new file mode 100644 index 0000000..0d4a914 --- /dev/null +++ b/ansible/roles/jnv.unattended-upgrades/meta/.galaxy_install_info @@ -0,0 +1,2 @@ +install_date: Fri May 15 21:54:44 2020 +version: v1.8.0 diff --git a/ansible/roles/jnv.unattended-upgrades/meta/main.yml b/ansible/roles/jnv.unattended-upgrades/meta/main.yml new file mode 100644 index 0000000..90dcd6d --- /dev/null +++ b/ansible/roles/jnv.unattended-upgrades/meta/main.yml @@ -0,0 +1,38 @@ +--- +galaxy_info: + author: Jan Vlnas + description: Setup unattended-upgrades on Debian-based systems + license: GPLv2 + min_ansible_version: 1.4 + platforms: + - name: Ubuntu + versions: + - precise + - raring + - saucy + - trusty + - utopic + - name: Debian + versions: + - wheezy + - jessie + # + # Below are all categories currently available. Just as with + # the platforms above, uncomment those that apply to your role. + # + categories: + #- cloud + #- cloud:ec2 + #- cloud:gce + #- cloud:rax + #- database + #- database:nosql + #- database:sql + #- development + #- monitoring + #- networking + #- packaging + - system + #- web +dependencies: [] + diff --git a/ansible/roles/jnv.unattended-upgrades/tasks/main.yml b/ansible/roles/jnv.unattended-upgrades/tasks/main.yml new file mode 100644 index 0000000..9a924fa --- /dev/null +++ b/ansible/roles/jnv.unattended-upgrades/tasks/main.yml @@ -0,0 +1,2 @@ + - include: unattended-upgrades.yml + tags: unattended diff --git a/ansible/roles/jnv.unattended-upgrades/tasks/reboot.yml b/ansible/roles/jnv.unattended-upgrades/tasks/reboot.yml new file mode 100644 index 0000000..faa7149 --- /dev/null +++ b/ansible/roles/jnv.unattended-upgrades/tasks/reboot.yml @@ -0,0 +1,9 @@ +--- +# Ignored, since newer distros don't need this package +# https://github.com/jnv/ansible-role-unattended-upgrades/issues/6 +- name: install update-notifier-common + apt: + pkg: update-notifier-common + state: present + failed_when: false + diff --git a/ansible/roles/jnv.unattended-upgrades/tasks/unattended-upgrades.yml b/ansible/roles/jnv.unattended-upgrades/tasks/unattended-upgrades.yml new file mode 100644 index 0000000..64c97ab --- /dev/null +++ b/ansible/roles/jnv.unattended-upgrades/tasks/unattended-upgrades.yml @@ -0,0 +1,34 @@ +--- +- name: add distribution-specific variables + include_vars: "{{ ansible_distribution }}.yml" + +- name: add Debian Wheezy workaround + include_vars: "{{ ansible_distribution }}-{{ ansible_distribution_release }}.yml" + when: (ansible_distribution == "Debian") and (ansible_distribution_release == "wheezy") + +- name: install unattended-upgrades + apt: + pkg: unattended-upgrades + state: present + cache_valid_time: "{{unattended_cache_valid_time}}" + update_cache: yes + +- name: install reboot dependencies + include: reboot.yml + when: unattended_automatic_reboot|bool + +- name: create APT auto-upgrades configuration + template: + src: auto-upgrades.j2 + dest: /etc/apt/apt.conf.d/20auto-upgrades + owner: root + group: root + mode: 0644 + +- name: create unattended-upgrades configuration + template: + src: unattended-upgrades.j2 + dest: /etc/apt/apt.conf.d/50unattended-upgrades + owner: root + group: root + mode: 0644 diff --git a/ansible/roles/jnv.unattended-upgrades/templates/auto-upgrades.j2 b/ansible/roles/jnv.unattended-upgrades/templates/auto-upgrades.j2 new file mode 100644 index 0000000..388a028 --- /dev/null +++ b/ansible/roles/jnv.unattended-upgrades/templates/auto-upgrades.j2 @@ -0,0 +1,25 @@ +APT::Periodic::Unattended-Upgrade "1"; + +{% if unattended_update_package_list is defined %} +APT::Periodic::Update-Package-Lists "{{unattended_update_package_list}}"; +{% endif %} + +{% if unattended_download_upgradeable is defined %} +APT::Periodic::Download-Upgradeable-Packages "{{unattended_download_upgradeable}}"; +{% endif %} + +{% if unattended_autoclean_interval is defined %} +APT::Periodic::AutocleanInterval "{{unattended_autoclean_interval}}"; +{% endif %} + +{% if unattended_clean_interval is defined %} +APT::Periodic::CleanInterval "{{unattended_clean_interval}}"; +{% endif %} + +{% if unattended_verbose is defined %} +APT::Periodic::Verbose "{{unattended_verbose}}"; +{% endif %} + +{% if unattended_random_sleep is defined %} +APT::Periodic::RandomSleep "{{unattended_random_sleep}}"; +{% endif %} diff --git a/ansible/roles/jnv.unattended-upgrades/templates/unattended-upgrades.j2 b/ansible/roles/jnv.unattended-upgrades/templates/unattended-upgrades.j2 new file mode 100644 index 0000000..0b0d218 --- /dev/null +++ b/ansible/roles/jnv.unattended-upgrades/templates/unattended-upgrades.j2 @@ -0,0 +1,104 @@ +// Unattended-Upgrade::Origins-Pattern controls which packages are +// upgraded. +Unattended-Upgrade::Origins-Pattern { +{% if unattended_origins_patterns is defined %} + {% for origin in unattended_origins_patterns %} + "{{ origin }}"; + {% endfor %} +{% else %} + {% for origin in __unattended_origins_patterns %} + "{{ origin }}"; + {% endfor %} +{% endif %} +}; + +// List of packages to not update (regexp are supported) +Unattended-Upgrade::Package-Blacklist { +{% for package in unattended_package_blacklist %} + "{{package}}"; +{% endfor %} +}; + +{% if not unattended_autofix_interrupted_dpkg %} +// This option allows you to control if on a unclean dpkg exit +// unattended-upgrades will automatically run +// dpkg --force-confold --configure -a +// The default is true, to ensure updates keep getting installed +Unattended-Upgrade::AutoFixInterruptedDpkg "false"; +{% endif %} + +// Split the upgrade into the smallest possible chunks so that +// they can be interrupted with SIGUSR1. This makes the upgrade +// a bit slower but it has the benefit that shutdown while a upgrade +// is running is possible (with a small delay) +Unattended-Upgrade::MinimalSteps "{{ unattended_minimal_steps | lower }}"; + +{% if unattended_install_on_shutdown %} +// Install all unattended-upgrades when the machine is shuting down +// instead of doing it in the background while the machine is running +// This will (obviously) make shutdown slower +Unattended-Upgrade::InstallOnShutdown "true"; +{% endif %} + +{% if unattended_mail %} +// Send email to this address for problems or packages upgrades +// If empty or unset then no email is sent, make sure that you +// have a working mail setup on your system. A package that provides +// 'mailx' must be installed. +Unattended-Upgrade::Mail "{{unattended_mail}}"; +{% endif %} + +{% if unattended_mail_only_on_error %} +// Set this value to "true" to get emails only on errors. Default +// is to always send a mail if Unattended-Upgrade::Mail is set +Unattended-Upgrade::MailOnlyOnError "true"; +{% endif %} + +{% if unattended_remove_unused_dependencies %} +// Do automatic removal of new unused dependencies after the upgrade +// (equivalent to apt-get autoremove) +Unattended-Upgrade::Remove-Unused-Dependencies "true"; +{% endif %} + +{% if unattended_automatic_reboot %} +// Automatically reboot *WITHOUT CONFIRMATION* if a +// the file /var/run/reboot-required is found after the upgrade +Unattended-Upgrade::Automatic-Reboot "true"; +{% endif %} + +{% if unattended_automatic_reboot_time %} +// If automatic reboot is enabled and needed, reboot at the specific +// time instead of immediately +// Default: "now" +Unattended-Upgrade::Automatic-Reboot-Time "{{ unattended_automatic_reboot_time }}"; +{% endif %} + +{% if unattended_update_days is defined %} +// Set the days of the week that updates should be applied. The days can be specified +// as localized abbreviated or full names. Or as integers where "0" is Sunday, "1" is +// Monday etc. +// Example - apply updates only on Monday and Friday: +// {"Mon";"Fri"}; +Unattended-Upgrade::Update-Days {{ unattended_update_days }}; +{% endif %} + +{% if unattended_ignore_apps_require_restart %} +// Do upgrade application even if it requires restart after upgrade +// I.e. "XB-Upgrade-Requires: app-restart" is set in the debian/control file +Unattended-Upgrade::IgnoreAppsRequireRestart "true"; +{% endif %} + +{% if unattended_dpkg_options %} +// Append options for governing dpkg behavior, e.g. --force-confdef. +Dpkg::Options { +{% for dpkg_option in unattended_dpkg_options %} + "{{ dpkg_option }}"; +{% endfor %} +}; +{% endif %} + +{% if unattended_dl_limit is defined %} +// Use apt bandwidth limit feature, this example limits the download +// speed to 70kb/sec +Acquire::http::Dl-Limit "{{ unattended_dl_limit }}"; +{% endif %} diff --git a/ansible/roles/jnv.unattended-upgrades/tests/ansible.cfg b/ansible/roles/jnv.unattended-upgrades/tests/ansible.cfg new file mode 100644 index 0000000..6abf5b7 --- /dev/null +++ b/ansible/roles/jnv.unattended-upgrades/tests/ansible.cfg @@ -0,0 +1,3 @@ +[defaults] +roles_path = ../../ +retry_files_enabled = False diff --git a/ansible/roles/jnv.unattended-upgrades/tests/inventory b/ansible/roles/jnv.unattended-upgrades/tests/inventory new file mode 100644 index 0000000..42de3a1 --- /dev/null +++ b/ansible/roles/jnv.unattended-upgrades/tests/inventory @@ -0,0 +1 @@ +localhost ansible_connection=local ansible_python_interpreter="/usr/bin/env python" diff --git a/ansible/roles/jnv.unattended-upgrades/tests/requirements.yml b/ansible/roles/jnv.unattended-upgrades/tests/requirements.yml new file mode 100644 index 0000000..562771a --- /dev/null +++ b/ansible/roles/jnv.unattended-upgrades/tests/requirements.yml @@ -0,0 +1,3 @@ +--- +- src: chrismeyersfsu.provision_docker + name: provision_docker diff --git a/ansible/roles/jnv.unattended-upgrades/tests/test.sh b/ansible/roles/jnv.unattended-upgrades/tests/test.sh new file mode 100755 index 0000000..84096bf --- /dev/null +++ b/ansible/roles/jnv.unattended-upgrades/tests/test.sh @@ -0,0 +1,29 @@ +#!/bin/bash + +# Exit on any individual command failure +set -e + +# Pretty colors. +red='\033[0;31m' +green='\033[0;32m' +neutral='\033[0m' + +section() { + echo -e "\033[33;1m$1\033[0m" +} + +fold_start() { + echo -e "travis_fold:start:$1\033[33;1m$2\033[0m" +} + +fold_end() { + echo -e "\ntravis_fold:end:$1\r" +} + +# Ensure we are in the tests dir +cd "$( dirname "${BASH_SOURCE[0]}" )" + +section "Syntax check" +ansible-playbook -i inventory --syntax-check test.yml +section "Running role" +ansible-playbook -i inventory test.yml diff --git a/ansible/roles/jnv.unattended-upgrades/tests/test.yml b/ansible/roles/jnv.unattended-upgrades/tests/test.yml new file mode 100644 index 0000000..45d5485 --- /dev/null +++ b/ansible/roles/jnv.unattended-upgrades/tests/test.yml @@ -0,0 +1,70 @@ +--- +- name: Bring up Docker containers + hosts: localhost + gather_facts: false + vars: + inventory: + - name: ubuntu_latest + image: "ubuntu:latest" + - name: ubuntu_xenial + image: "ubuntu:xenial" + - name: ubuntu_trusty + image: "ubuntu:trusty" + - name: debian_testing + image: "debian:testing" + - name: debian_stable + image: "debian:stable" + - name: debian_oldstable + image: "debian:oldstable" + roles: + - role: provision_docker + provision_docker_inventory: "{{ inventory }}" + provision_docker_privileged: true + provision_docker_use_docker_connection: true + +- name: Test role + hosts: docker_containers + gather_facts: false + pre_tasks: + - name: Provision Python + raw: bash -c "test -e /usr/bin/python || (apt-get -y update && apt-get install -y python-simplejson)" + register: output + changed_when: output.stdout + - setup: # Gather facts + vars: + unattended_autofix_interrupted_dpkg: false + unattended_minimal_steps: true + unattended_install_on_shutdown: true + unattended_automatic_reboot: true + unattended_update_days: '{"Sat"}' + roles: + # Searched for in ../.. (see ansible.cfg) + - ansible-role-unattended-upgrades + tasks: + - name: Idempotency check + include_role: + name: ansible-role-unattended-upgrades + register: idempotency + - fail: + msg: Role failed idempotency check + when: idempotency.changed + + - name: Get apt-config variables + shell: apt-config dump + register: aptconfig + - name: Check for registered variables + assert: + that: item in aptconfig.stdout + with_items: + - 'APT::Periodic::Unattended-Upgrade "1"' + - 'Unattended-Upgrade::AutoFixInterruptedDpkg "false"' + - 'Unattended-Upgrade::MinimalSteps "true"' + - 'Unattended-Upgrade::InstallOnShutdown "true"' + - 'Unattended-Upgrade::Automatic-Reboot "true"' + # NOTE: this uses the array syntax, which requires one + # top-level record, then one item per line + - 'Unattended-Upgrade::Update-Days "";' + - 'Unattended-Upgrade::Update-Days:: "Sat";' + + - name: Dry run unattended-upgrades + command: /usr/bin/unattended-upgrades --dry-run diff --git a/ansible/roles/jnv.unattended-upgrades/vars/Debian-wheezy.yml b/ansible/roles/jnv.unattended-upgrades/vars/Debian-wheezy.yml new file mode 100644 index 0000000..57afa2d --- /dev/null +++ b/ansible/roles/jnv.unattended-upgrades/vars/Debian-wheezy.yml @@ -0,0 +1,11 @@ +--- + +# This workaround for Debian Wheezy which doesn't support ${distro_codename} macro +# See +# https://github.com/jnv/ansible-role-unattended-upgrades/issues/19 +# https://github.com/jnv/ansible-role-unattended-upgrades/pull/20 +# for details + +__unattended_origins_patterns: + - 'origin=Debian,archive=stable,label=Debian-Security' + - 'origin=Debian,archive=oldstable,label=Debian-Security' diff --git a/ansible/roles/jnv.unattended-upgrades/vars/Debian.yml b/ansible/roles/jnv.unattended-upgrades/vars/Debian.yml new file mode 100644 index 0000000..706a604 --- /dev/null +++ b/ansible/roles/jnv.unattended-upgrades/vars/Debian.yml @@ -0,0 +1,3 @@ +--- +__unattended_origins_patterns: + - 'origin=Debian,codename=${distro_codename},label=Debian-Security' diff --git a/ansible/roles/jnv.unattended-upgrades/vars/Ubuntu.yml b/ansible/roles/jnv.unattended-upgrades/vars/Ubuntu.yml new file mode 100644 index 0000000..85a6bf3 --- /dev/null +++ b/ansible/roles/jnv.unattended-upgrades/vars/Ubuntu.yml @@ -0,0 +1,3 @@ +--- +__unattended_origins_patterns: + - 'origin=Ubuntu,archive=${distro_codename}-security,label=Ubuntu' diff --git a/ansible/roles/nginxinc.nginx/.github/ISSUE_TEMPLATE/bug_report.md b/ansible/roles/nginxinc.nginx/.github/ISSUE_TEMPLATE/bug_report.md new file mode 100644 index 0000000..5d86399 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/.github/ISSUE_TEMPLATE/bug_report.md @@ -0,0 +1,28 @@ +--- +name: Bug report +about: Create a report to help us improve +title: '' +labels: '' +assignees: '' + +--- + +**Describe the bug** +A clear and concise description of what the bug is. + +**To reproduce** +Steps to reproduce the behavior: +1. Deploy NGINX role using playbook.yml +2. View output/logs/configuration on '...' +3. See error + +**Expected behavior** +A clear and concise description of what you expected to happen. + +**Your environment:** + - Version of the NGINX Role or specific commit + - Version of Ansible + - Target deployment platform + +**Additional context** +Add any other context about the problem here. diff --git a/ansible/roles/nginxinc.nginx/.github/ISSUE_TEMPLATE/feature_request.md b/ansible/roles/nginxinc.nginx/.github/ISSUE_TEMPLATE/feature_request.md new file mode 100644 index 0000000..bbcbbe7 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/.github/ISSUE_TEMPLATE/feature_request.md @@ -0,0 +1,20 @@ +--- +name: Feature request +about: Suggest an idea for this project +title: '' +labels: '' +assignees: '' + +--- + +**Is your feature request related to a problem? Please describe.** +A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] + +**Describe the solution you'd like** +A clear and concise description of what you want to happen. + +**Describe alternatives you've considered** +A clear and concise description of any alternative solutions or features you've considered. + +**Additional context** +Add any other context or screenshots about the feature request here. diff --git a/ansible/roles/nginxinc.nginx/.github/pull_request_template.md b/ansible/roles/nginxinc.nginx/.github/pull_request_template.md new file mode 100644 index 0000000..d2cf8ae --- /dev/null +++ b/ansible/roles/nginxinc.nginx/.github/pull_request_template.md @@ -0,0 +1,10 @@ +### Proposed changes +Describe the use case and detail of the change. If this PR addresses an issue on GitHub, make sure to include a link to that issue here in this description (not in the title of the PR). + +### Checklist +Before creating a PR, run through this checklist and mark each as complete. + +- [ ] I have read the [CONTRIBUTING](https://github.com/nginxinc/ansible-role-nginx/blob/master/CONTRIBUTING.md) document +- [ ] I have added Molecule tests that prove my fix is effective or that my feature works +- [ ] I have checked that all unit tests pass after adding my changes +- [ ] If required, I have updated necessary documentation (`defaults/main/` and `README.md`) diff --git a/ansible/roles/nginxinc.nginx/.gitignore b/ansible/roles/nginxinc.nginx/.gitignore new file mode 100644 index 0000000..489ae98 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/.gitignore @@ -0,0 +1,15 @@ +# Any private crt and keys # +############################ +*.crt +*.key +__pycache__ +*~ +\#* + +# OS Specific +Thumbs.db +.DS_Store +.vscode + +# Ansible specific +*.retry \ No newline at end of file diff --git a/ansible/roles/nginxinc.nginx/.travis.yml b/ansible/roles/nginxinc.nginx/.travis.yml new file mode 100644 index 0000000..3a3dfd5 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/.travis.yml @@ -0,0 +1,56 @@ +--- +language: python +services: + - docker +jobs: + include: + - name: "Install Specific Version Test - Debian" + env: scenario=default + - name: "Install Specific Version Test - Alpine" + env: scenario=default_alpine + - name: "Install Specific Version Test - CentOS" + env: scenario=default_centos + - name: "Install Modules Test - Debian" + env: scenario=module + - name: "Install Modules Test - Alpine" + env: scenario=module_alpine + - name: "Install Modules Test - CentOS" + env: scenario=module_centos + - name: "Install Stable Branch and Push Configuration Test - Debian" + env: scenario=stable_push + - name: "Install Stable Branch and Push Configuration Test - Alpine" + env: scenario=stable_push_alpine + - name: "Install Stable Branch and Push Configuration Test - CentOS" + env: scenario=stable_push_centos + - name: "Use Template Setting Test - Debian" + env: scenario=template + - name: "Use Template Setting Test - Alpine" + env: scenario=template_alpine + - name: "Use Template Setting Test - CentOS" + env: scenario=template_centos + - name: "Install Unit Test - Debian" + env: scenario=unit + - name: "Install Unit Test - Alpine" + env: scenario=unit_alpine + - name: "Install Unit Test - CentOS" + env: scenario=unit_centos + - name: "Install from Source Test - Debian" + env: scenario=source + - name: "Install from Source Test - Alpine" + env: scenario=source_alpine + - name: "Install from Source Test - CentOS" + env: scenario=source_centos +before_install: + - sudo apt-get -qq update +install: + - pip install ansible==2.9.6 + - pip install molecule[docker]>=3.0.0 + - pip install testinfra + - pip install ansible-lint + - pip install flake8 +script: + - molecule --version + - ansible --version + - travis_wait 50 molecule test -s $scenario +notifications: + webhooks: https://galaxy.ansible.com/api/v1/notifications/ diff --git a/ansible/roles/nginxinc.nginx/.yamllint b/ansible/roles/nginxinc.nginx/.yamllint new file mode 100644 index 0000000..99e8630 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/.yamllint @@ -0,0 +1,13 @@ +--- +extends: default + +rules: + braces: + max-spaces-inside: 1 + level: error + brackets: + max-spaces-inside: 1 + level: error + comments-indentation: disable + line-length: disable + truthy: disable diff --git a/ansible/roles/nginxinc.nginx/CODE_OF_CONDUCT.md b/ansible/roles/nginxinc.nginx/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..5f08ef3 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/CODE_OF_CONDUCT.md @@ -0,0 +1,76 @@ +# Contributor Covenant Code of Conduct + +## Our Pledge + +In the interest of fostering an open and welcoming environment, we as +contributors and maintainers pledge to making participation in our project and +our community a harassment-free experience for everyone, regardless of age, body +size, disability, ethnicity, sex characteristics, gender identity and expression, +level of experience, education, socio-economic status, nationality, personal +appearance, race, religion, or sexual identity and orientation. + +## Our Standards + +Examples of behavior that contributes to creating a positive environment +include: + +* Using welcoming and inclusive language +* Being respectful of differing viewpoints and experiences +* Gracefully accepting constructive criticism +* Focusing on what is best for the community +* Showing empathy towards other community members + +Examples of unacceptable behavior by participants include: + +* The use of sexualized language or imagery and unwelcome sexual attention or + advances +* Trolling, insulting/derogatory comments, and personal or political attacks +* Public or private harassment +* Publishing others' private information, such as a physical or electronic + address, without explicit permission +* Other conduct which could reasonably be considered inappropriate in a + professional setting + +## Our Responsibilities + +Project maintainers are responsible for clarifying the standards of acceptable +behavior and are expected to take appropriate and fair corrective action in +response to any instances of unacceptable behavior. + +Project maintainers have the right and responsibility to remove, edit, or +reject comments, commits, code, wiki edits, issues, and other contributions +that are not aligned to this Code of Conduct, or to ban temporarily or +permanently any contributor for other behaviors that they deem inappropriate, +threatening, offensive, or harmful. + +## Scope + +This Code of Conduct applies both within project spaces and in public spaces +when an individual is representing the project or its community. Examples of +representing a project or community include using an official project e-mail +address, posting via an official social media account, or acting as an appointed +representative at an online or offline event. Representation of a project may be +further defined and clarified by project maintainers. + +## Enforcement + +Instances of abusive, harassing, or otherwise unacceptable behavior may be +reported by contacting the project team at nginx@nginx.org. All +complaints will be reviewed and investigated and will result in a response that +is deemed necessary and appropriate to the circumstances. The project team is +obligated to maintain confidentiality with regard to the reporter of an incident. +Further details of specific enforcement policies may be posted separately. + +Project maintainers who do not follow or enforce the Code of Conduct in good +faith may face temporary or permanent repercussions as determined by other +members of the project's leadership. + +## Attribution + +This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, +available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html + +[homepage]: https://www.contributor-covenant.org + +For answers to common questions about this code of conduct, see +https://www.contributor-covenant.org/faq diff --git a/ansible/roles/nginxinc.nginx/CONTRIBUTING.md b/ansible/roles/nginxinc.nginx/CONTRIBUTING.md new file mode 100644 index 0000000..b71585a --- /dev/null +++ b/ansible/roles/nginxinc.nginx/CONTRIBUTING.md @@ -0,0 +1,72 @@ +# Contributing Guidelines + +The following is a set of guidelines for contributing to the NGINX Ansible role. We really appreciate that you are considering contributing! + +#### Table Of Contents + +[Ask a Question](#ask-a-question) + +[Getting Started](#getting-started) + +[Contributing](#contributing) + +[Code Guidelines](#code-guidelines) +* [Git Guidelines](#git-guidelines) +* [Ansible Guidelines](#ansible-guidelines) + +[Code of Conduct](https://github.com/nginxinc/ansible-role-nginx/blob/master/CODE_OF_CONDUCT.md) + +## Ask a Question + +Please open an Issue on GitHub with the label `question`. + +## Getting Started + +Follow our [Installation Guide](https://github.com/nginxinc/ansible-role-nginx/blob/master/README.md#Installation) to install Ansible and Molecule and get ready to use the NGINX Ansible role. + +### Project Structure + +* The NGINX Ansible role is written in `yaml` and supports open source NGINX, NGINX Plus, NGINX Amplify, and NGINX Unit. +* The project follows the standard [Ansible role directory structure](https://docs.ansible.com/ansible/latest/user_guide/playbooks_reuse_roles.html) + * The main code is found at `tasks/` + * The main variables can be found at `defaults/main/` + * Configuration templates for NGINX can be found at `templates/` + * [Molecule](https://molecule.readthedocs.io/) tests can be found in `molecule/`. + * CI/CD is done via Travis using `.travis.yml` Deployment yaml files, and Helm files are found at `deployments/` + +## Contributing + +### Report a Bug + +To report a bug, open an issue on GitHub with the label `bug` using the available bug report issue template. Please ensure the issue has not already been reported. + +### Suggest an Enhancement + +To suggest an enhancement, please create an issue on GitHub with the label `enhancement` using the available feature issue template. + +### Open a Pull Request + +* Fork the repo, create a branch, submit a PR when your changes are tested and ready for review +* Fill in [our pull request template](https://github.com/nginxinc/ansible-role-nginx/blob/master/.github/PULL_REQUEST_TEMPLATE.md) + +Note: if you’d like to implement a new feature, please consider creating a feature request issue first to start a discussion about the feature. + +## Code Guidelines + +### Git Guidelines + +* Keep a clean, concise and meaningful git commit history on your branch (within reason), rebasing locally and squashing before submitting a PR +* Follow the guidelines of writing a good commit message as described here and summarised in the next few points + * In the subject line, use the present tense ("Add feature" not "Added feature") + * In the subject line, use the imperative mood ("Move cursor to..." not "Moves cursor to...") + * Limit the subject line to 72 characters or less + * Reference issues and pull requests liberally after the subject line + * Add more detailed description in the body of the git message (`git commit -a` to give you more space and time in your text editor to write a good message instead of `git commit -am`) + +### Ansible Guidelines + +* Run `molecule lint` over your code to automatically resolve a lot of `yaml` and Ansible style issues. +* Run `molecule test --all` on your code to catch any other issues. +* Follow these guides on some good practices for Ansible: + * + * diff --git a/ansible/roles/nginxinc.nginx/LICENSE b/ansible/roles/nginxinc.nginx/LICENSE new file mode 100644 index 0000000..261eeb9 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/LICENSE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/ansible/roles/nginxinc.nginx/README.md b/ansible/roles/nginxinc.nginx/README.md new file mode 100644 index 0000000..5cc122b --- /dev/null +++ b/ansible/roles/nginxinc.nginx/README.md @@ -0,0 +1,414 @@ +Ansible NGINX Role +================== + +[![Ansible Galaxy](https://img.shields.io/badge/galaxy-nginxinc.nginx-5bbdbf.svg)](https://galaxy.ansible.com/nginxinc/nginx) +[![Build Status](https://travis-ci.org/nginxinc/ansible-role-nginx.svg?branch=master)](https://travis-ci.org/nginxinc/ansible-role-nginx) + +This role installs NGINX Open Source, NGINX Plus, the NGINX Amplify agent, or NGINX Unit on your target host. + +**Note:** This role is still in active development. There may be unidentified issues and the role variables may change as development continues. + +Requirements +------------ + +**Ansible** + +This role was developed and tested with [maintained](https://docs.ansible.com/ansible/latest/reference_appendices/release_and_maintenance.html#release-status) versions of Ansible. Backwards compatibility is not guaranteed. + +Instructions on how to install Ansible can be found in the [Ansible website](https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html). + +**Molecule** + +Molecule is used to test the various functionailities of the role. Instructions on how to install Molecule can be found in the [Molecule website](https://molecule.readthedocs.io/en/latest/installation.html). + +Installation +------------ + +**Ansible Galaxy** + +Use `ansible-galaxy install nginxinc.nginx` to install the latest stable release of the role on your system. + +**Git** + +Use `git clone https://github.com/nginxinc/ansible-role-nginx.git` to pull the latest edge commit of the role from GitHub. + +Platforms +--------- + +The NGINX Ansible role supports all platforms supported by [NGINX Open Source](https://nginx.org/en/linux_packages.html#mainline), [NGINX Plus](https://www.nginx.com/products/technical-specs/), the [NGINX Amplify agent](https://github.com/nginxinc/nginx-amplify-doc/blob/master/amplify-faq.md#21-what-operating-systems-are-supported), and [NGINX Unit](https://unit.nginx.org/installation/#official-packages): + +**NGINX Open Source** + +```yaml +Alpine: + versions: + - 3.8 + - 3.9 + - 3.10 + - 3.11 +CentOS: + versions: + - 6 + - 7 + - 8 +Debian: + versions: + - stretch + - buster +FreeBSD: + versions: + - 11.2+ + - 12 +RedHat: + versions: + - 6 + - 7.4+ + - 8 +SUSE/SLES: + versions: + - 12 + - 15 +Ubuntu: + versions: + - xenial + - bionic +``` + +**NGINX Plus** + +```yaml +Alpine: + versions: + - 3.8 + - 3.9 + - 3.10 + - 3.11 +Amazon Linux: + versions: + - 2018.03 +Amazon Linux 2: + versions: + - LTS +CentOS: + versions: + - 6.5+ + - 7.4+ + - 8 +Debian: + versions: + - stretch + - buster +FreeBSD: + versions: + - 11.2+ + - 12 +Oracle Linux: + versions: + - 6.5+ + - 7.4+ +RedHat: + versions: + - 6.5+ + - 7.4+ + - 8 +SUSE/SLES: + versions: + - 12 + - 15 +Ubuntu: + versions: + - xenial + - bionic +``` + +**NGINX Amplify Agent** + +```yaml +Amazon Linux: + versions: + - 2017.09 +CentOS: + versions: + - 6 + - 7 +Debian: + versions: + - jessie + - stretch +Ubuntu: + versions: + - xenial + - bionic +RedHat: + versions: + - 6 + - 7 +``` + +**NGINX Unit** + +```yaml +CentOS: + versions: + - 6 + - 7 +RedHat: + versions: + - 6 + - 7 +Debian: + versions: + - jessie + - stretch + - buster +Ubuntu: + versions: + - xenial + - bionic +Amazon Linux: + versions: + - 2018.03 +Amazon Linux 2: + versions: + - 2 +FreeBSD: + versions: + - 10 + - 11 +``` + +Role Variables +-------------- + +This role has multiple variables. The descriptions and defaults for all these variables can be found in the directory **`defaults/main`** in the following files: + +- **[defaults/main/main.yml](./defaults/main/main.yml):** NGINX installation variables +- **[defaults/main/amplify.yml](./defaults/main/amplify.yml):** NGINX Amplify agent installation variables +- **[defaults/main/template.yml](./defaults/main/template.yml):** NGINX configuration templating variables +- **[defaults/main/upload.yml](./defaults/main/upload.yml):** NGINX configuration/HTML/SSL upload variables +- **[defaults/main/linux.yml](./defaults/main/linux.yml):** Linux installation variables +- **[defaults/main/bsd.yml](./defaults/main/bsd.yml):** BSD installation variables +- **[defaults/main/unit.yml](./defaults/main/unit.yml):** NGINX Unit installation variables + +Dependencies +------------ + +None + +Example Playbook +---------------- + +This is a sample playbook file for deploying the Ansible Galaxy NGINX role in a localhost and installing the open source version of NGINX. + +```yaml +--- +- hosts: localhost + become: true + roles: + - role: nginxinc.nginx +``` + +This is a sample playbook file for deploying the Ansible Galaxy NGINX role to a dynamic inventory containing the `nginx` tag. + +```yaml +--- +- hosts: tag_nginx + remote_user: root + roles: + - role: nginxinc.nginx +``` + +This is a sample playbook file for deploying the Ansible Galaxy NGINX role in a localhost and installing the open source version of NGINX as a simple web server. + +```yaml +--- +- hosts: localhost + become: true + roles: + - role: nginxinc.nginx + vars: + nginx_http_template_enable: true + nginx_http_template: + default: + template_file: http/default.conf.j2 + conf_file_name: default.conf + conf_file_location: /etc/nginx/conf.d/ + servers: + server1: + listen: + listen_localhost: + # ip: 0.0.0.0 + port: 80 + server_name: localhost + error_page: /usr/share/nginx/html + autoindex: false + web_server: + locations: + default: + location: / + html_file_location: /usr/share/nginx/html + html_file_name: index.html + autoindex: false + http_demo_conf: false +``` + +This is a sample playbook file for deploying the Ansible Galaxy NGINX role in a localhost and installing the open source version of NGINX as a reverse proxy. + +```yaml +--- +- hosts: localhost + become: true + roles: + - role: nginxinc.nginx + vars: + nginx_http_template_enable: true + nginx_http_template: + default: + template_file: http/default.conf.j2 + conf_file_name: default.conf + conf_file_location: /etc/nginx/conf.d/ + servers: + server1: + listen: + listen_localhost: + # ip: 0.0.0.0 + port: 80 + opts: + - default_server + server_name: localhost + error_page: /usr/share/nginx/html + autoindex: false + reverse_proxy: + locations: + frontend: + location: / + proxy_pass: http://frontend_servers + backend: + location: /backend + proxy_pass: http://backend_servers + upstreams: + upstream_1: + name: frontend_servers + lb_method: least_conn + zone_name: frontend + zone_size: 64k + sticky_cookie: false + servers: + frontend_server_1: + address: 0.0.0.0 + port: 8081 + weight: 1 + health_check: max_fails=3 fail_timeout=5s + upstream_2: + name: backend_servers + lb_method: least_conn + zone_name: backend + zone_size: 64k + sticky_cookie: false + servers: + backend_server_1: + address: 0.0.0.0 + port: 8082 + weight: 1 + health_check: max_fails=3 fail_timeout=5s + frontend: + template_file: http/default.conf.j2 + conf_file_name: frontend_default.conf + conf_file_location: /etc/nginx/conf.d/ + servers: + server1: + listen: + listen_localhost: + ip: 0.0.0.0 + port: 8081 + ssl: false + opts: [] + server_name: localhost + error_page: /usr/share/nginx/html + autoindex: false + web_server: + locations: + frontend_site: + location: / + proxy_hide_headers: + - X-Powered-By + html_file_location: /usr/share/nginx/html + html_file_name: index.html + autoindex: false + http_demo_conf: false + backend: + template_file: http/default.conf.j2 + conf_file_name: backend_default.conf + conf_file_location: /etc/nginx/conf.d/ + servers: + server1: + listen: + listen_localhost: + ip: 0.0.0.0 + port: 8082 + ssl: false + opts: [] + server_name: localhost + error_page: /usr/share/nginx/html + autoindex: false + web_server: + locations: + backend_site: + location: / + html_file_location: /usr/share/nginx/html + html_file_name: index.html + autoindex: false + http_demo_conf: false +``` + + +This is a sample playbook file for deploying the Ansible Galaxy NGINX role in a localhost and installing NGINX Plus. + +```yaml +--- +- hosts: localhost + become: true + roles: + - role: nginxinc.nginx + vars: + nginx_type: plus +``` + +This is a sample playbook file for deploying the Ansible Galaxy NGINX role in a localhost to install NGINX Unit and the PHP/Perl NGINX Unit language modules. + +```yaml +--- +- hosts: localhost + become: true + roles: + - role: nginxinc.nginx + vars: + nginx_enable: false + nginx_unit_enable: true + nginx_unit_modules: + - unit-php + - unit-perl +``` + +To run any of the above sample playbooks create a `setup-nginx.yml` file and paste the contents. Executing the Ansible Playbook is then as simple as executing `ansible-playbook setup-nginx.yml`. + +Alternatively, you can also clone this repository instead of installing it from Ansible Galaxy. If you decide to do so, replace the role variable in the previous sample playbooks from `nginxinc.nginx` to `ansible-role-nginx`. + +Other NGINX Roles +----------------- + +You can find an Ansible collection of roles to help you install and configure NGINX Controller [here](https://github.com/nginxinc/ansible-collection-nginx_controller) + +License +------- + +[Apache License, Version 2.0](https://github.com/nginxinc/ansible-role-nginx/blob/master/LICENSE) + +Author Information +------------------ + +[Alessandro Fael Garcia](https://github.com/alessfg) + +[Grzegorz Dzien](https://github.com/gdzien) + +© [NGINX, Inc.](https://www.nginx.com/) 2018 - 2020 diff --git a/ansible/roles/nginxinc.nginx/defaults/main/amplify.yml b/ansible/roles/nginxinc.nginx/defaults/main/amplify.yml new file mode 100644 index 0000000..6e041c9 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/defaults/main/amplify.yml @@ -0,0 +1,7 @@ +--- +# Install NGINX Amplify. +# Use your NGINX Amplify API key. +# Requires access to either the NGINX stub status or the NGINX Plus REST API. +# Default is null. +nginx_amplify_enable: false +nginx_amplify_api_key: null diff --git a/ansible/roles/nginxinc.nginx/defaults/main/bsd.yml b/ansible/roles/nginxinc.nginx/defaults/main/bsd.yml new file mode 100644 index 0000000..941f3ba --- /dev/null +++ b/ansible/roles/nginxinc.nginx/defaults/main/bsd.yml @@ -0,0 +1,26 @@ +--- +# Supported distributions +nginx_bsd_systems: ['FreeBSD', 'NetBSD', 'OpenBSD', 'DragonFlyBSD', 'HardenedBSD'] + +# Supported distributions NGINX Plus +# https://docs.nginx.com/nginx/technical-specs/ +nginx_plus_bsd_systems: ['FreeBSD'] + +# Choose to install BSD packages or ports. +# Options are True for packages or False for ports. +# Default is True. +nginx_bsd_install_packages: true + +# Choose to update BSD ports collection. +# Options are True for update or False for do not update. +# Default is True. +nginx_bsd_update_ports: true + +# Choose to install packages built from BSD ports collection if +# available. +# Options are True for use packages or False for do not use packages. +# Default is True. +nginx_bsd_portinstall_use_packages: true + +# FreeBSD extra packages +nginx_freebsd_extra_packages: ['security/ca_root_nss'] diff --git a/ansible/roles/nginxinc.nginx/defaults/main/linux.yml b/ansible/roles/nginxinc.nginx/defaults/main/linux.yml new file mode 100644 index 0000000..0be7b2f --- /dev/null +++ b/ansible/roles/nginxinc.nginx/defaults/main/linux.yml @@ -0,0 +1,13 @@ +--- +# Supported distributions +nginx_linux_families: ['Alpine', 'Debian', 'RedHat', 'Suse'] + +# Supported distributions NGINX Plus +# https://docs.nginx.com/nginx/technical-specs/ +# RedHat={Amazon,CentOS,OracleLinux,RHEL} Debian={Ubuntu,Debian} +nginx_plus_linux_families: ['Alpine', 'Debian', 'RedHat', 'Suse'] + +# Default locations and versions for install from source +pcre_version: pcre-8.43 +zlib_version: zlib-1.2.11 +openssl_version: openssl-1.1.1c diff --git a/ansible/roles/nginxinc.nginx/defaults/main/main.yml b/ansible/roles/nginxinc.nginx/defaults/main/main.yml new file mode 100644 index 0000000..7d1dbe6 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/defaults/main/main.yml @@ -0,0 +1,93 @@ +--- +# Install NGINX. +# Default is true. +nginx_enable: true + +# Start NGINX service. +# Default is true. +nginx_start: true + +# Print NGINX configuration file to terminal after executing playbook. +nginx_debug_output: false + +# Specify which type of NGINX you want to install. +# Options are 'opensource' or 'plus'. +# Default is 'opensource'. +nginx_type: opensource + +# Specify which version of NGINX you want to install. +# Default is empty. +# nginx_version: "=19-1~bionic" +# For Plus and modules you'll need a wilcard like below (which installs plus-20 and modules) +# nginx_version: "-20*" + +# Specify whether you want to maintain your version of NGINX, upgrade to the latest version, or remove NGINX. +# Can be used with `nginx_version` to achieve fine tune control on which version of NGINX is installed/used on each playbook execution. +# Using 'present' will install the latest version (or 'nginx_version') of NGINX on a fresh install. +# Using 'latest' will upgrade NGINX to the latest version (that matches your 'nginx_version') of NGINX on every playbook execution. +# Using 'absent' will remove NGINX from your system. +# Default is present. +nginx_state: present + +# Specify repository origin for NGINX Open Source. +# Options are 'nginx_repository', 'source' or 'os_repository'. +# Only works if 'nginx_type' is set to 'opensource'. +# Default is nginx_repository. +nginx_install_from: nginx_repository + +# Specify source install options for NGINX Open Source. +# Options represent whether to install from source also +# or to install from packages (default). These only apply +# if 'nginx_install_from' is set to 'source' +# For the tools, true means we will isntall from a package +# and false means install from source. +# 'nginx_install_source_build_tools' will install compiler +# and build tools from packages. If false, you need to have +# these present. +nginx_install_source_build_tools: true +nginx_install_source_pcre: false +nginx_install_source_openssl: true +nginx_install_source_zlib: false + +# Choose where to fetch the NGINX signing key from. +# Default is the official NGINX signing key host. +# nginx_signing_key: http://nginx.org/keys/nginx_signing.key + +# Specify source repository for NGINX Open Source. +# Only works if 'install_from' is set to 'nginx_repository'. +# Defaults are the official NGINX repositories. +# nginx_repository: deb https://nginx.org/packages/mainline/debian/ stretch nginx + +# Specify which branch of NGINX Open Source you want to install. +# Options are 'mainline' or 'stable'. +# Only works if 'install_from' is set to 'nginx_repository' or 'source'. +# Default is mainline. +nginx_branch: mainline + +# Location of your NGINX Plus license in your local machine. +# Default is the files folder within the NGINX Ansible role. +nginx_license: + certificate: license/nginx-repo.crt + key: license/nginx-repo.key + +# Remove NGINX Plus license and repository after installation for security purposes. +# Default is false. +nginx_delete_license: false + +# Install NGINX JavaScript, Perl, ModSecurity WAF (NGINX Plus only), GeoIP, Image-Filter, RTMP Media Streaming (NGINX Plus only), and/or XSLT modules. +# Default is false. +nginx_modules: + njs: false + perl: false + waf: false + geoip: false + image_filter: false + rtmp: false + xslt: false + +# Remove previously existing NGINX configuration files. +# Use a list of paths you wish to remove. +# Default is false. +nginx_cleanup_config: false +nginx_cleanup_config_path: + - /etc/nginx/conf.d diff --git a/ansible/roles/nginxinc.nginx/defaults/main/template.yml b/ansible/roles/nginxinc.nginx/defaults/main/template.yml new file mode 100644 index 0000000..1c0afd7 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/defaults/main/template.yml @@ -0,0 +1,369 @@ +--- +# Enable creating dynamic templated NGINX HTML demo websites. +nginx_html_demo_template_enable: false +nginx_html_demo_template: + default: + template_file: www/index.html.j2 + html_file_name: index.html + html_file_location: /usr/share/nginx/html + web_server_name: Default + +# Enable creating dynamic templated NGINX configuration files. +# Defaults are the values found in a fresh NGINX installation. +nginx_main_template_enable: false +nginx_main_template: + template_file: nginx.conf.j2 + conf_file_name: nginx.conf + conf_file_location: /etc/nginx/ + user: nginx + worker_processes: auto + # worker_rlimit_nofile: 1024 + error_log: + location: /var/log/nginx/error.log + level: warn + worker_connections: 1024 + http_enable: true + http_settings: + access_log_format: + - name: main + format: |- + '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"' + access_log_location: + - name: main + location: /var/log/nginx/access.log + tcp_nopush: true + tcp_nodelay: true + keepalive_timeout: 65 + cache: false + rate_limit: false + keyval: false + # server_tokens: "off" + http_global_autoindex: false + sub_filter: + # sub_filters: [] + last_modified: "off" + once: "on" + types: "text/html" + # http_custom_options: [] + stream_enable: false + # stream_custom_options: [] + # auth_request_http: /auth + # auth_request_set_http: + # name: $auth_user + # value: $upstream_http_x_user + +# Enable creating dynamic templated NGINX HTTP configuration files. +# Defaults will not produce a valid configuration. Instead they are meant to showcase +# the options available for templating. Each key represents a new configuration file. +nginx_http_template_enable: false +nginx_http_template: + default: + template_file: http/default.conf.j2 + conf_file_name: default.conf + conf_file_location: /etc/nginx/conf.d/ + servers: + server1: + listen: + listen_localhost: + ip: localhost # Wrap in square brackets for IPv6 addresses + port: 8081 + ssl: true + opts: [] # Listen opts like http2 which will be added (ssl is automatically added if you specify 'ssl:'). + server_name: localhost + include_files: [] + error_page: /usr/share/nginx/html + access_log: + - name: main + location: /var/log/nginx/access.log + error_log: + location: /var/log/nginx/error.log + level: warn + root: /usr/share/nginx/html + # https_redirect: $host + autoindex: false + auth_basic: null + auth_basic_user_file: null + try_files: $uri $uri/index.html $uri.html =404 + # auth_request: /auth + # auth_request_set: + # name: $auth_user + # value: $upstream_http_x_user + client_max_body_size: 1m + proxy_hide_headers: [] # A list of headers which shouldn't be passed to the application + add_headers: + strict_transport_security: + name: Strict-Transport-Security + value: max-age=15768000; includeSubDomains + always: true + # header_name: + # name: Header-X + # value: Value-X + # always: false + ssl: + cert: /etc/ssl/certs/default.crt + key: /etc/ssl/private/default.key + dhparam: /etc/ssl/private/dh_param.pem + protocols: TLSv1 TLSv1.1 TLSv1.2 + ciphers: HIGH:!aNULL:!MD5 + prefer_server_ciphers: true + session_cache: none + session_timeout: 5m + disable_session_tickets: false + trusted_cert: /etc/ssl/certs/root_CA_cert_plus_intermediates.crt + stapling: true + stapling_verify: true + sub_filter: + # sub_filters: [] + last_modified: "off" + once: "on" + types: "text/html" + # custom_options: [] + web_server: + locations: + default: + location: / + include_files: [] + proxy_hide_headers: [] # A list of headers which shouldn't be passed to the application + add_headers: + strict_transport_security: + name: Strict-Transport-Security + value: max-age=15768000; includeSubDomains + always: true + # header_name: + # name: Header-X + # value: Value-X + # always: false + html_file_location: /usr/share/nginx/html + html_file_name: index.html + autoindex: false + auth_basic: null + auth_basic_user_file: null + try_files: $uri $uri/index.html $uri.html =404 + # auth_request: /auth + # auth_request_set: + # name: $auth_user + # value: $upstream_http_x_user + client_max_body_size: 1m + # returns: + # return302: + # code: 302 + # url: https://sso.somehost.local/?url=https://$http_host$request_uri + sub_filter: + # sub_filters: [] + last_modified: "off" + once: "on" + types: "text/html" + # custom_options: [] + http_demo_conf: false + reverse_proxy: + locations: + backend: + location: / + include_files: [] + proxy_hide_headers: [] # A list of headers which shouldn't be passed to the application + add_headers: + strict_transport_security: + name: Strict-Transport-Security + value: max-age=15768000; includeSubDomains + always: true + # header_name: + # name: Header-X + # value: Value-X + # always: false + proxy_connect_timeout: null + proxy_pass: http://backend + # rewrites: + # - /foo(.*) /$1 break + # proxy_pass_request_body: off + # allows: + # - 192.168.1.0/24 + # denies: + # - all + proxy_set_header: + header_host: + name: Host + value: $host + header_x_real_ip: + name: X-Real-IP + value: $remote_addr + header_x_forwarded_for: + name: X-Forwarded-For + value: $proxy_add_x_forwarded_for + header_x_forwarded_proto: + name: X-Forwarded-Proto + value: $scheme + # header_upgrade: + # name: Upgrade + # value: $http_upgrade + # header_connection: + # name: Connection + # value: "Upgrade" + # header_random: + # name: RandomName + # value: RandomValue + # internal: false + # proxy_store: off + # proxy_store_acccess: user:rw + proxy_read_timeout: null + proxy_send_timeout: null + proxy_ssl: + cert: /etc/ssl/certs/proxy_default.crt + key: /etc/ssl/private/proxy_default.key + trusted_cert: /etc/ssl/certs/proxy_ca.crt + protocols: TLSv1 TLSv1.1 TLSv1.2 + ciphers: HIGH:!aNULL:!MD5 + verify: false + verify_depth: 1 + session_reuse: true + proxy_cache: backend_proxy_cache + proxy_cache_valid: + - code: 200 + time: 10m + - code: 301 + time: 1m + proxy_temp_path: + path: /var/cache/nginx/proxy/backend/temp + proxy_cache_lock: false + proxy_cache_min_uses: 3 + proxy_cache_revalidate: false + proxy_cache_use_stale: + - http_403 + - http_404 + proxy_ignore_headers: + - Vary + - Cache-Control + proxy_cookie_path: + path: /web/ + replacement: / + proxy_buffering: false + proxy_http_version: 1.0 + websocket: false + auth_basic: null + auth_basic_user_file: null + try_files: $uri $uri/index.html $uri.html =404 + # auth_request: /auth + # auth_request_set: + # name: $auth_user + # value: $upstream_http_x_user + # returns: + # return302: + # code: 302 + # url: https://sso.somehost.local/?url=https://$http_host$request_uri + sub_filter: + # sub_filters: [] + last_modified: "off" + once: "on" + types: "text/html" + # custom_options: [] + health_check_plus: false + returns: + return301: + location: / + code: 301 + value: http://$host$request_uri + proxy_cache: + proxy_cache_path: + - path: /var/cache/nginx/proxy/backend + keys_zone: + name: backend_proxy_cache + size: 10m + levels: "1:2" + max_size: 10g + inactive: 60m + use_temp_path: true + proxy_temp_path: + path: /var/cache/nginx/proxy/temp + proxy_cache_valid: + - code: 200 + time: 10m + - code: 301 + time: 1m + proxy_cache_lock: true + proxy_cache_min_uses: 5 + proxy_cache_revalidate: true + proxy_cache_use_stale: + - error + - timeout + proxy_ignore_headers: + - Expires + upstreams: + upstream1: + name: backend + lb_method: least_conn + zone_name: backend_mem_zone + zone_size: 64k + sticky_cookie: false + servers: + server1: + address: localhost + port: 8081 + weight: 1 + health_check: max_fails=1 fail_timeout=10s + # custom_options: [] + # custom_options: [] + +# Enable NGINX status data. +# Will enable 'stub_status' in NGINX Open Source and 'status' in NGINX Plus. +# Note - 'status' has been deprecated since NGINX Plus R13. +# Default is false. +nginx_status_enable: false +nginx_status_location: /etc/nginx/conf.d/stub_status.conf +nginx_status_port: 80 + +# Enable NGINX Plus REST API, write access to the REST API, and NGINX Plus dashboard. +# Requires NGINX Plus. +# Default is false. +nginx_rest_api_enable: false +nginx_rest_api_template_file: http/api.conf.j2 +nginx_rest_api_file_location: /etc/nginx/conf.d/api.conf +nginx_rest_api_port: 80 +nginx_rest_api_write: false +nginx_rest_api_dashboard: false + +# Enable creating dynamic templated NGINX stream configuration files. +# Defaults will not produce a valid configuration. Instead they are meant to showcase +# the options available for templating. Each key represents a new configuration file. +nginx_stream_template_enable: false +nginx_stream_template: + default: + template_file: stream/default.conf.j2 + conf_file_name: default.conf + conf_file_location: /etc/nginx/conf.d/stream/ + network_streams: + default: + listen_address: localhost + listen_port: 80 + udp_enable: false + include_files: [] + proxy_pass: backend + proxy_timeout: 3s + proxy_connect_timeout: 1s + proxy_protocol: false + proxy_ssl: + cert: /etc/ssl/certs/proxy_default.crt + key: /etc/ssl/private/proxy_default.key + trusted_cert: /etc/ssl/certs/proxy_ca.crt + protocols: TLSv1 TLSv1.1 TLSv1.2 + ciphers: HIGH:!aNULL:!MD5 + verify: false + verify_depth: 1 + session_reuse: true + health_check_plus: false + # custom_options: [] + upstreams: + upstream1: + name: backend + lb_method: least_conn + zone_name: backend + zone_size: 64k + sticky_cookie: false + servers: + server1: + address: localhost + port: 8080 + weight: 1 + health_check: max_fails=1 fail_timeout=10s + # custom_options: [] + # custom_options: [] diff --git a/ansible/roles/nginxinc.nginx/defaults/main/unit.yml b/ansible/roles/nginxinc.nginx/defaults/main/unit.yml new file mode 100644 index 0000000..e2bce7b --- /dev/null +++ b/ansible/roles/nginxinc.nginx/defaults/main/unit.yml @@ -0,0 +1,6 @@ +--- +# Install NGINX Unit and NGINX Unit modules. +# Use a list of supported NGINX Unit modules. +# Default is false. +nginx_unit_enable: false +nginx_unit_modules: null diff --git a/ansible/roles/nginxinc.nginx/defaults/main/upload.yml b/ansible/roles/nginxinc.nginx/defaults/main/upload.yml new file mode 100644 index 0000000..d6aca77 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/defaults/main/upload.yml @@ -0,0 +1,26 @@ +--- +# Enable uploading NGINX configuration files to your system. +# Default for uploading files is false. +# Default location of files is the files folder within the NGINX Ansible role. +# Upload the main NGINX configuration file. +nginx_main_upload_enable: false +nginx_main_upload_src: conf/nginx.conf +nginx_main_upload_dest: /etc/nginx/ +# Upload HTTP NGINX configuration files. +nginx_http_upload_enable: false +nginx_http_upload_src: conf/http/*.conf +nginx_http_upload_dest: /etc/nginx/conf.d/ +# Upload Stream NGINX configuration files. +nginx_stream_upload_enable: false +nginx_stream_upload_src: conf/stream/*.conf +nginx_stream_upload_dest: /etc/nginx/conf.d/ +# Upload HTML files. +nginx_html_upload_enable: false +nginx_html_upload_src: www/* +nginx_html_upload_dest: /usr/share/nginx/html +# Upload SSL certificates and keys. +nginx_ssl_upload_enable: false +nginx_ssl_crt_upload_src: ssl/*.crt +nginx_ssl_crt_upload_dest: /etc/ssl/certs/ +nginx_ssl_key_upload_src: ssl/*.key +nginx_ssl_key_upload_dest: /etc/ssl/private/ diff --git a/ansible/roles/nginxinc.nginx/files/conf/http/.gitkeep b/ansible/roles/nginxinc.nginx/files/conf/http/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/ansible/roles/nginxinc.nginx/files/conf/stream/.gitkeep b/ansible/roles/nginxinc.nginx/files/conf/stream/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/ansible/roles/nginxinc.nginx/files/license/.gitkeep b/ansible/roles/nginxinc.nginx/files/license/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/ansible/roles/nginxinc.nginx/files/services/nginx.conf.upstart b/ansible/roles/nginxinc.nginx/files/services/nginx.conf.upstart new file mode 100644 index 0000000..da562ab --- /dev/null +++ b/ansible/roles/nginxinc.nginx/files/services/nginx.conf.upstart @@ -0,0 +1,16 @@ +description "nginx - small, powerful, scalable web/proxy server" + +start on filesystem and static-network-up +stop on runlevel [016] + +expect fork +respawn + +pre-start script + [ -x /usr/sbin/nginx ] || { stop; exit 0; } + /usr/sbin/nginx -q -t -g 'daemon on; master_process on;' || { stop; exit 0; } +end script + +exec /usr/sbin/nginx -g 'daemon on; master_process on;' + +pre-stop exec /usr/sbin/nginx -s quit \ No newline at end of file diff --git a/ansible/roles/nginxinc.nginx/files/services/nginx.openrc b/ansible/roles/nginxinc.nginx/files/services/nginx.openrc new file mode 100644 index 0000000..d8a1231 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/files/services/nginx.openrc @@ -0,0 +1,70 @@ +#!/sbin/openrc-run + +description="Nginx http and reverse proxy server" +extra_commands="checkconfig" +extra_started_commands="reload reopen upgrade" + +cfgfile=${cfgfile:-/etc/nginx/nginx.conf} +pidfile=/var/run/nginx.pid +command=/usr/sbin/nginx +command_args="-c $cfgfile" +required_files="$cfgfile" + +depend() { + need net + use dns logger netmount +} + +start_pre() { + $command $command_args -t -q +} + +checkconfig() { + ebegin "Checking $RC_SVCNAME configuration" + start_pre + eend $? +} + +reload() { + ebegin "Reloading $RC_SVCNAME configuration" + start_pre && start-stop-daemon --signal HUP --pidfile $pidfile + eend $? +} + +reopen() { + ebegin "Reopening $RC_SVCNAME log files" + start-stop-daemon --signal USR1 --pidfile $pidfile + eend $? +} + +upgrade() { + start_pre || return 1 + + ebegin "Upgrading $RC_SVCNAME binary" + + einfo "Sending USR2 to old binary" + start-stop-daemon --signal USR2 --pidfile $pidfile + + einfo "Sleeping 3 seconds before pid-files checking" + sleep 3 + + if [ ! -f $pidfile.oldbin ]; then + eerror "File with old pid ($pidfile.oldbin) not found" + return 1 + fi + + if [ ! -f $pidfile ]; then + eerror "New binary failed to start" + return 1 + fi + + einfo "Sleeping 3 seconds before WINCH" + sleep 3 ; start-stop-daemon --signal 28 --pidfile $pidfile.oldbin + + einfo "Sending QUIT to old binary" + start-stop-daemon --signal QUIT --pidfile $pidfile.oldbin + + einfo "Upgrade completed" + + eend $? "Upgrade failed" +} \ No newline at end of file diff --git a/ansible/roles/nginxinc.nginx/files/services/nginx.systemd b/ansible/roles/nginxinc.nginx/files/services/nginx.systemd new file mode 100644 index 0000000..23eb0ed --- /dev/null +++ b/ansible/roles/nginxinc.nginx/files/services/nginx.systemd @@ -0,0 +1,15 @@ +[Unit] +Description=nginx - high performance web server +Documentation=http://nginx.org/en/docs/ +After=network-online.target remote-fs.target nss-lookup.target +Wants=network-online.target + +[Service] +Type=forking +PIDFile=/var/run/nginx.pid +ExecStart=/usr/sbin/nginx -c /etc/nginx/nginx.conf +ExecReload=/bin/kill -s HUP $MAINPID +ExecStop=/bin/kill -s TERM $MAINPID + +[Install] +WantedBy=multi-user.target diff --git a/ansible/roles/nginxinc.nginx/files/services/nginx.sysvinit b/ansible/roles/nginxinc.nginx/files/services/nginx.sysvinit new file mode 100644 index 0000000..9d0b09c --- /dev/null +++ b/ansible/roles/nginxinc.nginx/files/services/nginx.sysvinit @@ -0,0 +1,196 @@ +#!/bin/sh + +### BEGIN INIT INFO +# Provides: nginx +# Required-Start: $local_fs $remote_fs $network $syslog $named +# Required-Stop: $local_fs $remote_fs $network $syslog $named +# Default-Start: 2 3 4 5 +# Default-Stop: 0 1 6 +# Short-Description: starts the nginx web server +# Description: starts nginx using start-stop-daemon +### END INIT INFO + +PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin +DAEMON=/usr/sbin/nginx +NAME=nginx +DESC=nginx + +# Include nginx defaults if available +if [ -r /etc/default/nginx ]; then + . /etc/default/nginx +fi + +STOP_SCHEDULE="${STOP_SCHEDULE:-QUIT/5/TERM/5/KILL/5}" + +test -x $DAEMON || exit 0 + +. /lib/init/vars.sh +. /lib/lsb/init-functions + +# Try to extract nginx pidfile +PID=$(cat /etc/nginx/nginx.conf | grep -Ev '^\s*#' | awk 'BEGIN { RS="[;{}]" } { if ($1 == "pid") print $2 }' | head -n1) +if [ -z "$PID" ]; then + PID=/run/nginx.pid +fi + +if [ -n "$ULIMIT" ]; then + # Set ulimit if it is set in /etc/default/nginx + ulimit $ULIMIT +fi + +start_nginx() { + # Start the daemon/service + # + # Returns: + # 0 if daemon has been started + # 1 if daemon was already running + # 2 if daemon could not be started + start-stop-daemon --start --quiet --pidfile $PID --exec $DAEMON --test > /dev/null \ + || return 1 + start-stop-daemon --start --quiet --pidfile $PID --exec $DAEMON -- \ + $DAEMON_OPTS 2>/dev/null \ + || return 2 +} + +test_config() { + # Test the nginx configuration + $DAEMON -t $DAEMON_OPTS >/dev/null 2>&1 +} + +stop_nginx() { + # Stops the daemon/service + # + # Return + # 0 if daemon has been stopped + # 1 if daemon was already stopped + # 2 if daemon could not be stopped + # other if a failure occurred + start-stop-daemon --stop --quiet --retry=$STOP_SCHEDULE --pidfile $PID --name $NAME + RETVAL="$?" + sleep 1 + return "$RETVAL" +} + +reload_nginx() { + # Function that sends a SIGHUP to the daemon/service + start-stop-daemon --stop --signal HUP --quiet --pidfile $PID --name $NAME + return 0 +} + +rotate_logs() { + # Rotate log files + start-stop-daemon --stop --signal USR1 --quiet --pidfile $PID --name $NAME + return 0 +} + +upgrade_nginx() { + # Online upgrade nginx executable + # http://nginx.org/en/docs/control.html + # + # Return + # 0 if nginx has been successfully upgraded + # 1 if nginx is not running + # 2 if the pid files were not created on time + # 3 if the old master could not be killed + if start-stop-daemon --stop --signal USR2 --quiet --pidfile $PID --name $NAME; then + # Wait for both old and new master to write their pid file + while [ ! -s "${PID}.oldbin" ] || [ ! -s "${PID}" ]; do + cnt=`expr $cnt + 1` + if [ $cnt -gt 10 ]; then + return 2 + fi + sleep 1 + done + # Everything is ready, gracefully stop the old master + if start-stop-daemon --stop --signal QUIT --quiet --pidfile "${PID}.oldbin" --name $NAME; then + return 0 + else + return 3 + fi + else + return 1 + fi +} + +case "$1" in + start) + log_daemon_msg "Starting $DESC" "$NAME" + start_nginx + case "$?" in + 0|1) log_end_msg 0 ;; + 2) log_end_msg 1 ;; + esac + ;; + stop) + log_daemon_msg "Stopping $DESC" "$NAME" + stop_nginx + case "$?" in + 0|1) log_end_msg 0 ;; + 2) log_end_msg 1 ;; + esac + ;; + restart) + log_daemon_msg "Restarting $DESC" "$NAME" + + # Check configuration before stopping nginx + if ! test_config; then + log_end_msg 1 # Configuration error + exit $? + fi + + stop_nginx + case "$?" in + 0|1) + start_nginx + case "$?" in + 0) log_end_msg 0 ;; + 1) log_end_msg 1 ;; # Old process is still running + *) log_end_msg 1 ;; # Failed to start + esac + ;; + *) + # Failed to stop + log_end_msg 1 + ;; + esac + ;; + reload|force-reload) + log_daemon_msg "Reloading $DESC configuration" "$NAME" + + # Check configuration before stopping nginx + # + # This is not entirely correct since the on-disk nginx binary + # may differ from the in-memory one, but that's not common. + # We prefer to check the configuration and return an error + # to the administrator. + if ! test_config; then + log_end_msg 1 # Configuration error + exit $? + fi + + reload_nginx + log_end_msg $? + ;; + configtest|testconfig) + log_daemon_msg "Testing $DESC configuration" + test_config + log_end_msg $? + ;; + status) + status_of_proc -p $PID "$DAEMON" "$NAME" && exit 0 || exit $? + ;; + upgrade) + log_daemon_msg "Upgrading binary" "$NAME" + upgrade_nginx + log_end_msg $? + ;; + rotate) + log_daemon_msg "Re-opening $DESC log files" "$NAME" + rotate_logs + log_end_msg $? + ;; + *) + echo "Usage: $NAME {start|stop|restart|reload|force-reload|status|configtest|rotate|upgrade}" >&2 + exit 3 + ;; +esac \ No newline at end of file diff --git a/ansible/roles/nginxinc.nginx/files/services/nginx.upstart b/ansible/roles/nginxinc.nginx/files/services/nginx.upstart new file mode 100644 index 0000000..9d0b09c --- /dev/null +++ b/ansible/roles/nginxinc.nginx/files/services/nginx.upstart @@ -0,0 +1,196 @@ +#!/bin/sh + +### BEGIN INIT INFO +# Provides: nginx +# Required-Start: $local_fs $remote_fs $network $syslog $named +# Required-Stop: $local_fs $remote_fs $network $syslog $named +# Default-Start: 2 3 4 5 +# Default-Stop: 0 1 6 +# Short-Description: starts the nginx web server +# Description: starts nginx using start-stop-daemon +### END INIT INFO + +PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin +DAEMON=/usr/sbin/nginx +NAME=nginx +DESC=nginx + +# Include nginx defaults if available +if [ -r /etc/default/nginx ]; then + . /etc/default/nginx +fi + +STOP_SCHEDULE="${STOP_SCHEDULE:-QUIT/5/TERM/5/KILL/5}" + +test -x $DAEMON || exit 0 + +. /lib/init/vars.sh +. /lib/lsb/init-functions + +# Try to extract nginx pidfile +PID=$(cat /etc/nginx/nginx.conf | grep -Ev '^\s*#' | awk 'BEGIN { RS="[;{}]" } { if ($1 == "pid") print $2 }' | head -n1) +if [ -z "$PID" ]; then + PID=/run/nginx.pid +fi + +if [ -n "$ULIMIT" ]; then + # Set ulimit if it is set in /etc/default/nginx + ulimit $ULIMIT +fi + +start_nginx() { + # Start the daemon/service + # + # Returns: + # 0 if daemon has been started + # 1 if daemon was already running + # 2 if daemon could not be started + start-stop-daemon --start --quiet --pidfile $PID --exec $DAEMON --test > /dev/null \ + || return 1 + start-stop-daemon --start --quiet --pidfile $PID --exec $DAEMON -- \ + $DAEMON_OPTS 2>/dev/null \ + || return 2 +} + +test_config() { + # Test the nginx configuration + $DAEMON -t $DAEMON_OPTS >/dev/null 2>&1 +} + +stop_nginx() { + # Stops the daemon/service + # + # Return + # 0 if daemon has been stopped + # 1 if daemon was already stopped + # 2 if daemon could not be stopped + # other if a failure occurred + start-stop-daemon --stop --quiet --retry=$STOP_SCHEDULE --pidfile $PID --name $NAME + RETVAL="$?" + sleep 1 + return "$RETVAL" +} + +reload_nginx() { + # Function that sends a SIGHUP to the daemon/service + start-stop-daemon --stop --signal HUP --quiet --pidfile $PID --name $NAME + return 0 +} + +rotate_logs() { + # Rotate log files + start-stop-daemon --stop --signal USR1 --quiet --pidfile $PID --name $NAME + return 0 +} + +upgrade_nginx() { + # Online upgrade nginx executable + # http://nginx.org/en/docs/control.html + # + # Return + # 0 if nginx has been successfully upgraded + # 1 if nginx is not running + # 2 if the pid files were not created on time + # 3 if the old master could not be killed + if start-stop-daemon --stop --signal USR2 --quiet --pidfile $PID --name $NAME; then + # Wait for both old and new master to write their pid file + while [ ! -s "${PID}.oldbin" ] || [ ! -s "${PID}" ]; do + cnt=`expr $cnt + 1` + if [ $cnt -gt 10 ]; then + return 2 + fi + sleep 1 + done + # Everything is ready, gracefully stop the old master + if start-stop-daemon --stop --signal QUIT --quiet --pidfile "${PID}.oldbin" --name $NAME; then + return 0 + else + return 3 + fi + else + return 1 + fi +} + +case "$1" in + start) + log_daemon_msg "Starting $DESC" "$NAME" + start_nginx + case "$?" in + 0|1) log_end_msg 0 ;; + 2) log_end_msg 1 ;; + esac + ;; + stop) + log_daemon_msg "Stopping $DESC" "$NAME" + stop_nginx + case "$?" in + 0|1) log_end_msg 0 ;; + 2) log_end_msg 1 ;; + esac + ;; + restart) + log_daemon_msg "Restarting $DESC" "$NAME" + + # Check configuration before stopping nginx + if ! test_config; then + log_end_msg 1 # Configuration error + exit $? + fi + + stop_nginx + case "$?" in + 0|1) + start_nginx + case "$?" in + 0) log_end_msg 0 ;; + 1) log_end_msg 1 ;; # Old process is still running + *) log_end_msg 1 ;; # Failed to start + esac + ;; + *) + # Failed to stop + log_end_msg 1 + ;; + esac + ;; + reload|force-reload) + log_daemon_msg "Reloading $DESC configuration" "$NAME" + + # Check configuration before stopping nginx + # + # This is not entirely correct since the on-disk nginx binary + # may differ from the in-memory one, but that's not common. + # We prefer to check the configuration and return an error + # to the administrator. + if ! test_config; then + log_end_msg 1 # Configuration error + exit $? + fi + + reload_nginx + log_end_msg $? + ;; + configtest|testconfig) + log_daemon_msg "Testing $DESC configuration" + test_config + log_end_msg $? + ;; + status) + status_of_proc -p $PID "$DAEMON" "$NAME" && exit 0 || exit $? + ;; + upgrade) + log_daemon_msg "Upgrading binary" "$NAME" + upgrade_nginx + log_end_msg $? + ;; + rotate) + log_daemon_msg "Re-opening $DESC log files" "$NAME" + rotate_logs + log_end_msg $? + ;; + *) + echo "Usage: $NAME {start|stop|restart|reload|force-reload|status|configtest|rotate|upgrade}" >&2 + exit 3 + ;; +esac \ No newline at end of file diff --git a/ansible/roles/nginxinc.nginx/files/ssl/.gitkeep b/ansible/roles/nginxinc.nginx/files/ssl/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/ansible/roles/nginxinc.nginx/files/www/index.html b/ansible/roles/nginxinc.nginx/files/www/index.html new file mode 100644 index 0000000..77dc0b6 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/files/www/index.html @@ -0,0 +1,25 @@ + + + +Welcome to nginx! + + + +

Welcome to nginx!

+

If you see this page, the nginx web server is successfully installed and +working. Further configuration is required.

+ +

For online documentation and support please refer to +nginx.org.
+Commercial support is available at +nginx.com.

+ +

Thank you for using nginx.

+ + \ No newline at end of file diff --git a/ansible/roles/nginxinc.nginx/handlers/main.yml b/ansible/roles/nginxinc.nginx/handlers/main.yml new file mode 100644 index 0000000..5d58b86 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/handlers/main.yml @@ -0,0 +1,39 @@ +--- +- name: "(Handler: All OSs) Run NGINX" + block: + + - name: "(Handler: All OSs) Start NGINX" + service: + name: nginx + state: started + enabled: yes + notify: "(Handler: All OSs) Check NGINX" + + - name: "(Handler: All OSs) Reload NGINX" + command: "nginx -s reload" + changed_when: false + + when: + - nginx_start | bool + - not ansible_check_mode + +- name: "(Handler: All OSs) Start NGINX Amplify Agent" + service: + name: amplify-agent + state: started + +- name: "(Handler: Debian/Ubuntu/CentOS/RedHat) Start NGINX Unit" + service: + name: unit + state: started + enabled: yes + +- name: "(Handler: FreeBSD) Start NGINX Unit" + service: + name: unitd + state: started + enabled: yes + +- name: "(Handler: All OSs) Check NGINX" + command: "nginx -t" + changed_when: false diff --git a/ansible/roles/nginxinc.nginx/meta/.galaxy_install_info b/ansible/roles/nginxinc.nginx/meta/.galaxy_install_info new file mode 100644 index 0000000..24f861e --- /dev/null +++ b/ansible/roles/nginxinc.nginx/meta/.galaxy_install_info @@ -0,0 +1,2 @@ +install_date: Fri May 15 21:51:16 2020 +version: 0.14.0 diff --git a/ansible/roles/nginxinc.nginx/meta/main.yml b/ansible/roles/nginxinc.nginx/meta/main.yml new file mode 100644 index 0000000..0a3f86e --- /dev/null +++ b/ansible/roles/nginxinc.nginx/meta/main.yml @@ -0,0 +1,50 @@ +--- +galaxy_info: + author: Alessandro Fael Garcia + description: Official Ansible role for NGINX + company: NGINX, Inc. + + license: Apache License, Version 2.0 + + min_ansible_version: 2.9 + + platforms: + - name: Alpine + versions: + - all + - name: Amazon + versions: + - Candidate + - name: Debian + versions: + - jessie + - stretch + - buster + - name: EL + versions: + - 6 + - 7 + - name: FreeBSD + versions: + - 11.2 + - 12.0 + - name: Ubuntu + versions: + - xenial + - bionic + - name: SLES + versions: + - 12 + - 15 + + galaxy_tags: + - nginx + - oss + - plus + - amplify + - unit + - web + - server + - development + +dependencies: [] diff --git a/ansible/roles/nginxinc.nginx/molecule/common/Dockerfile.j2 b/ansible/roles/nginxinc.nginx/molecule/common/Dockerfile.j2 new file mode 100644 index 0000000..c268a5b --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/common/Dockerfile.j2 @@ -0,0 +1,43 @@ +# Molecule managed + +{% if item.registry is defined %} +FROM {{ item.registry.url }}/{{ item.image }} +{% else %} +FROM {{ item.image }} +{% endif %} + +{% if item.env is defined %} +{% for var, value in item.env.items() %} +{% if value %} +ENV {{ var }} {{ value }} +{% endif %} +{% endfor %} +{% endif %} + +RUN \ + if [ $(command -v apt-get) ]; then \ + apt-get update \ + && apt-get install -y python3 sudo bash ca-certificates iproute2 python3-apt aptitude systemd systemd-sysv procps curl \ + && apt-get clean; \ + elif [ $(command -v dnf) ]; then \ + dnf makecache \ + && dnf --assumeyes install /usr/bin/python3 /usr/bin/python3-config /usr/bin/dnf-3 bash iproute \ + && dnf clean all; \ + elif [ $(command -v yum) ]; then \ + yum makecache fast \ + && yum install -y /usr/bin/python /usr/bin/python2-config sudo yum-plugin-ovl bash iproute \ + && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf \ + && yum clean all; \ + elif [ $(command -v zypper) ]; then \ + zypper refresh \ + && zypper install -y python3 sudo bash iproute2 \ + && zypper clean -a; \ + elif [ $(command -v apk) ]; then \ + apk update \ + && apk add --no-cache python3 sudo bash ca-certificates curl openrc; \ + echo 'rc_provide="loopback net"' >> /etc/rc.conf; \ + elif [ $(command -v xbps-install) ]; then \ + xbps-install -Syu \ + && xbps-install -y python3 sudo bash ca-certificates iproute2 \ + && xbps-remove -O; \ + fi diff --git a/ansible/roles/nginxinc.nginx/molecule/common/files/http/default.conf b/ansible/roles/nginxinc.nginx/molecule/common/files/http/default.conf new file mode 100755 index 0000000..4559b82 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/common/files/http/default.conf @@ -0,0 +1,44 @@ +server { + listen 80; + server_name localhost; + + #charset koi8-r; + #access_log /var/log/nginx/host.access.log main; + + location / { + root /usr/share/nginx/html; + index index.html index.htm; + } + + #error_page 404 /404.html; + + # redirect server error pages to the static page /50x.html + # + error_page 500 502 503 504 /50x.html; + location = /50x.html { + root /usr/share/nginx/html; + } + + # proxy the PHP scripts to Apache listening on 127.0.0.1:80 + # + #location ~ \.php$ { + # proxy_pass http://127.0.0.1; + #} + + # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000 + # + #location ~ \.php$ { + # root html; + # fastcgi_pass 127.0.0.1:9000; + # fastcgi_index index.php; + # fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name; + # include fastcgi_params; + #} + + # deny access to .htaccess files, if Apache's document root + # concurs with nginx's one + # + #location ~ /\.ht { + # deny all; + #} +} diff --git a/ansible/roles/nginxinc.nginx/molecule/common/files/nginx.conf b/ansible/roles/nginxinc.nginx/molecule/common/files/nginx.conf new file mode 100755 index 0000000..ba09f41 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/common/files/nginx.conf @@ -0,0 +1,31 @@ +user nginx; +worker_processes 4; + +error_log /var/log/nginx/error.log warn; +pid /var/run/nginx.pid; + + +events { + worker_connections 1024; +} + + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + access_log /var/log/nginx/access.log main; + + sendfile on; + #tcp_nopush on; + + keepalive_timeout 65; + + #gzip on; + + include /etc/nginx/conf.d/*.conf; +} diff --git a/ansible/roles/nginxinc.nginx/molecule/common/files/www/.gitkeep b/ansible/roles/nginxinc.nginx/molecule/common/files/www/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/ansible/roles/nginxinc.nginx/molecule/common/playbook_default.yml b/ansible/roles/nginxinc.nginx/molecule/common/playbook_default.yml new file mode 100644 index 0000000..aa04765 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/common/playbook_default.yml @@ -0,0 +1,20 @@ +--- +- name: Converge + hosts: all + pre_tasks: + - name: "Set repo if Alpine" + set_fact: + version: "=1.17.8-r1" + when: ansible_os_family == "Alpine" + - name: "Set repo if Debian" + set_fact: + version: "=1.17.8-1~{{ ansible_distribution_release }}" + when: ansible_os_family == "Debian" + - name: "Set repo if RedHat" + set_fact: + version: "-1.17.8-1.el{{ ansible_distribution_major_version }}.ngx" + when: ansible_os_family == "RedHat" + roles: + - role: ansible-role-nginx + vars: + nginx_version: "{{ version }}" diff --git a/ansible/roles/nginxinc.nginx/molecule/common/playbook_module.yml b/ansible/roles/nginxinc.nginx/molecule/common/playbook_module.yml new file mode 100644 index 0000000..3f42b42 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/common/playbook_module.yml @@ -0,0 +1,16 @@ +--- +- name: Converge + hosts: all + roles: + - role: ansible-role-nginx + vars: + nginx_debug_output: true + + nginx_modules: + njs: true + perl: true + waf: false + geoip: true + image_filter: true + rtmp: true + xslt: true diff --git a/ansible/roles/nginxinc.nginx/molecule/common/playbook_source.yml b/ansible/roles/nginxinc.nginx/molecule/common/playbook_source.yml new file mode 100644 index 0000000..808fd2f --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/common/playbook_source.yml @@ -0,0 +1,19 @@ +--- +- name: Converge + hosts: all + roles: + - role: ansible-role-nginx + vars: + nginx_debug_output: true + + nginx_install_from: source + nginx_branch: mainline + nginx_install_source_build_tools: true + nginx_install_source_pcre: false + nginx_install_source_openssl: true + nginx_install_source_zlib: false + + nginx_main_upload_enable: true + nginx_main_upload_src: files/nginx.conf + nginx_http_upload_enable: true + nginx_http_upload_src: files/http/*.conf diff --git a/ansible/roles/nginxinc.nginx/molecule/common/playbook_stable_push.yml b/ansible/roles/nginxinc.nginx/molecule/common/playbook_stable_push.yml new file mode 100644 index 0000000..c4841ae --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/common/playbook_stable_push.yml @@ -0,0 +1,13 @@ +--- +- name: Converge + hosts: all + roles: + - role: ansible-role-nginx + vars: + nginx_debug_output: true + + nginx_branch: stable + nginx_main_upload_enable: true + nginx_main_upload_src: files/nginx.conf + nginx_http_upload_enable: true + nginx_http_upload_src: files/http/*.conf diff --git a/ansible/roles/nginxinc.nginx/molecule/common/playbook_template.yml b/ansible/roles/nginxinc.nginx/molecule/common/playbook_template.yml new file mode 100644 index 0000000..3ff9e57 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/common/playbook_template.yml @@ -0,0 +1,353 @@ +--- +- name: Converge + hosts: all + roles: + - role: ansible-role-nginx + vars: + nginx_debug_output: true + + nginx_main_template_enable: true + nginx_main_template: + template_file: nginx.conf.j2 + conf_file_name: nginx.conf + conf_file_location: /etc/nginx/ + user: nginx + worker_processes: auto + error_log: + location: /var/log/nginx/error.log + level: warn + worker_connections: 1024 + http_enable: true + http_settings: + access_log_format: + - name: main + format: | + '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"' + access_log_location: + - name: main + location: /var/log/nginx/access.log + keepalive_timeout: 65 + cache: false + rate_limit: false + keyval: false + server_tokens: "off" + sub_filter: + # sub_filters: [] + last_modified: "off" + once: "on" + types: "text/html" + stream_enable: true + http_global_autoindex: false + + nginx_http_template_enable: true + nginx_http_template: + app: + template_file: http/default.conf.j2 + conf_file_name: default.conf + conf_file_location: /etc/nginx/conf.d/ + servers: + server1: + listen: + listen_localhost: + ip: 0.0.0.0 + port: 80 + opts: + - default_server + server_name: localhost + error_page: /usr/share/nginx/html + client_max_body_size: 512k + proxy_hide_headers: + - X-Powered-By + add_headers: + strict_transport_security: + name: Strict-Transport-Security + value: max-age=15768000; includeSubDomains + always: true + sub_filter: + # sub_filters: [] + last_modified: "off" + once: "on" + types: "text/html" + # custom_options: [] + reverse_proxy: + locations: + frontend: + location: / + proxy_hide_headers: + - X-Powered-By + add_headers: + strict_transport_security: + name: Strict-Transport-Security + value: max-age=15768000; includeSubDomains + always: true + another_header: + name: Fancy-New-Header-To-Test + value: testing=true + always: false + proxy_pass: http://frontend_servers/ + proxy_cache: frontend_proxy_cache + proxy_cache_valid: + - code: 200 + time: 10m + - code: 301 + time: 1m + proxy_temp_path: + path: /var/cache/nginx/proxy/frontend/temp + proxy_cache_lock: false + proxy_cache_min_uses: 3 + proxy_cache_revalidate: false + proxy_cache_use_stale: + - http_403 + - http_404 + proxy_ignore_headers: + - Vary + - Cache-Control + proxy_redirect: false + proxy_set_header: + header_host: + name: Host + value: $host + header_x_real_ip: + name: X-Real-IP + value: $remote_addr + header_x_forwarded_for: + name: X-Forwarded-For + value: $proxy_add_x_forwarded_for + header_x_forwarded_proto: + name: X-Forwarded-Proto + value: $scheme + proxy_buffering: false + client_max_body_size: 5m + sub_filter: + # sub_filters: [] + last_modified: "off" + once: "on" + types: "text/html" + backend: + location: /backend + proxy_pass: http://backend_servers/ + proxy_cache: backend_proxy_cache + proxy_cache_valid: + - time: 10m + proxy_temp_path: + path: /var/cache/nginx/proxy/backend/temp + proxy_cache_lock: true + proxy_cache_min_uses: 2 + proxy_cache_revalidate: true + proxy_cache_use_stale: + - http_500 + - http_502 + - http_503 + proxy_redirect: default + proxy_set_header: + header_host: + name: Host + value: $host + header_x_real_ip: + name: X-Real-IP + value: $remote_addr + header_x_forwarded_for: + name: X-Forwarded-For + value: $proxy_add_x_forwarded_for + header_x_forwarded_proto: + name: X-Forwarded-Proto + value: $scheme + proxy_cookie_path: + path: /web/ + replacement: / + returns: + return301: + location: ^~ /old-path + code: 301 + value: http://$host/new-path + proxy_cache: + proxy_cache_path: + - path: /var/cache/nginx/proxy/frontend + keys_zone: + name: frontend_proxy_cache + size: 5m + levels: "1:2" + max_size: 5g + inactive: 30m + use_temp_path: true + - path: /var/cache/nginx/proxy/backend + keys_zone: + name: backend_proxy_cache + size: 10m + levels: "1:2" + max_size: 10g + inactive: 60m + use_temp_path: true + proxy_temp_path: + path: /var/cache/nginx/proxy/temp + proxy_cache_lock: true + proxy_cache_min_uses: 5 + proxy_cache_revalidate: true + proxy_cache_use_stale: + - error + - timeout + proxy_ignore_headers: + - Expires + upstreams: + frontend_upstream: + name: frontend_servers + lb_method: least_conn + zone_name: frontend_mem_zone + zone_size: 64k + sticky_cookie: false + servers: + frontend_server_1: + address: 0.0.0.0 + port: 8081 + weight: 1 + health_check: max_fails=3 fail_timeout=5s + backend_upstream: + name: backend_servers + lb_method: least_conn + zone_name: backend_mem_zone + zone_size: 64k + sticky_cookie: false + servers: + backend_server_1: + address: 0.0.0.0 + port: 8082 + weight: 1 + health_check: max_fails=3 fail_timeout=5s + frontend: + template_file: http/default.conf.j2 + conf_file_name: frontend_default.conf + conf_file_location: /etc/nginx/conf.d/ + servers: + server1: + listen: + listen_localhost: + port: 8081 + opts: [] + server_name: localhost + error_page: /usr/share/nginx/html + autoindex: false + sub_filter: + sub_filters: + - "'server_hostname' '$hostname'" + - "'server_address' '$server_addr:$server_port'" + - "'server_url' '$request_uri'" + - "'remote_addr' '$remote_addr:$remote_port'" + - "'server_date' '$time_local'" + - "'client_browser' '$http_user_agent'" + - "'request_id' '$request_id'" + - "'nginx_version' '$nginx_version'" + - "'document_root' '$document_root'" + - "'proxied_for_ip' '$http_x_forwarded_for'" + last_modified: "off" + once: "off" + types: "text/html" + web_server: + locations: + frontend_site: + location: / + proxy_hide_headers: + - X-Powered-By + html_file_location: /usr/share/nginx/html + html_file_name: frontend_index.html + autoindex: false + sub_filter: + # sub_filters: [] + last_modified: "off" + once: "off" + types: "text/html" + http_demo_conf: false + backend: + template_file: http/default.conf.j2 + conf_file_name: backend_default.conf + conf_file_location: /etc/nginx/conf.d/ + servers: + server1: + listen: + listen_localhost: + port: 8082 + opts: [] + server_name: localhost + error_page: /usr/share/nginx/html + autoindex: false + sub_filter: + sub_filters: + - "'server_hostname' '$hostname'" + - "'server_address' '$server_addr:$server_port'" + - "'server_url' '$request_uri'" + - "'remote_addr' '$remote_addr:$remote_port'" + - "'server_date' '$time_local'" + - "'client_browser' '$http_user_agent'" + - "'request_id' '$request_id'" + - "'nginx_version' '$nginx_version'" + - "'document_root' '$document_root'" + - "'proxied_for_ip' '$http_x_forwarded_for'" + last_modified: "off" + once: "off" + types: "text/html" + web_server: + locations: + backend_site: + location: / + html_file_location: /usr/share/nginx/html + html_file_name: backend_index.html + autoindex: false + php: + location: ~ \.php$ + html_file_location: /usr/share/nginx/html + autoindex: false + custom_options: + - fastcgi_split_path_info ^(.+\.php)(/.+)$ + - fastcgi_pass unix:/run/php/php7.2-fpm.sock + - fastcgi_index index.php + - include fastcgi_params + - fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name + sub_filter: + # sub_filters: [] + last_modified: "off" + once: "off" + types: "text/html" + http_demo_conf: false + nginx_html_demo_template_enable: true + nginx_html_demo_template: + frontend: + template_file: www/index.html.j2 + html_file_name: frontend_index.html + html_file_location: /usr/share/nginx/html + web_server_name: Frontend + backend: + template_file: www/index.html.j2 + html_file_name: backend_index.html + html_file_location: /usr/share/nginx/html + web_server_name: Backend + + nginx_stream_template_enable: true + nginx_stream_template: + default: + template_file: stream/default.conf.j2 + conf_file_name: default.conf + conf_file_location: /etc/nginx/conf.d/stream + network_streams: + app: + listen_address: 0.0.0.0 + listen_port: 8090 + udp_enable: false + proxy_pass: backend + proxy_timeout: 3s + proxy_connect_timeout: 1s + proxy_protocol: false + health_check_plus: false + upstreams: + backend_upstream: + name: backend + lb_method: least_conn + zone_name: backend + zone_size: 64k + sticky_cookie: false + servers: + backend_server_1: + address: 0.0.0.0 + port: 8091 + weight: 1 + health_check: max_fails=1 fail_timeout=10s diff --git a/ansible/roles/nginxinc.nginx/molecule/common/playbook_unit.yml b/ansible/roles/nginxinc.nginx/molecule/common/playbook_unit.yml new file mode 100644 index 0000000..ee1dcc1 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/common/playbook_unit.yml @@ -0,0 +1,30 @@ +--- +- name: Converge + hosts: all + pre_tasks: + - name: "Set module if Alpine" + set_fact: + module: + - "unit-perl" + - "unit-php7" + - "unit-python3" + when: ansible_os_family == "Alpine" + - name: "Set module if Debian/RedHat" + set_fact: + module: + - "unit-perl" + - "unit-php" + - "unit-ruby" + when: ansible_os_family == "Debian" + - name: "Set module if RedHat" + set_fact: + module: + - "unit-php" + - "unit-go" + when: ansible_os_family == "RedHat" + roles: + - role: ansible-role-nginx + vars: + nginx_enable: false + nginx_unit_enable: true + nginx_unit_modules: "{{ module }}" diff --git a/ansible/roles/nginxinc.nginx/molecule/common/test_default/test_default.py b/ansible/roles/nginxinc.nginx/molecule/common/test_default/test_default.py new file mode 100644 index 0000000..8d12025 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/common/test_default/test_default.py @@ -0,0 +1,30 @@ +import os + +import testinfra.utils.ansible_runner + +testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner( + os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all') + + +def test_nginx_is_installed(host): + ngx = host.package("nginx") + assert ngx.is_installed + + +def test_nginx_running_and_enabled(host): + ngx = host.service("nginx") + assert ngx.is_running + assert ngx.is_enabled + + +def test_hosts_file(host): + ngx = host.file('/etc/hosts') + assert ngx.exists + assert ngx.user == 'root' + assert ngx.group == 'root' + + +def test_endpoint(host): + command = """curl -I http://localhost/""" + cmd = host.run(command) + assert '200 OK' in cmd.stdout diff --git a/ansible/roles/nginxinc.nginx/molecule/common/test_module/test_default.py b/ansible/roles/nginxinc.nginx/molecule/common/test_module/test_default.py new file mode 100644 index 0000000..8d12025 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/common/test_module/test_default.py @@ -0,0 +1,30 @@ +import os + +import testinfra.utils.ansible_runner + +testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner( + os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all') + + +def test_nginx_is_installed(host): + ngx = host.package("nginx") + assert ngx.is_installed + + +def test_nginx_running_and_enabled(host): + ngx = host.service("nginx") + assert ngx.is_running + assert ngx.is_enabled + + +def test_hosts_file(host): + ngx = host.file('/etc/hosts') + assert ngx.exists + assert ngx.user == 'root' + assert ngx.group == 'root' + + +def test_endpoint(host): + command = """curl -I http://localhost/""" + cmd = host.run(command) + assert '200 OK' in cmd.stdout diff --git a/ansible/roles/nginxinc.nginx/molecule/common/test_source/test_default.py b/ansible/roles/nginxinc.nginx/molecule/common/test_source/test_default.py new file mode 100644 index 0000000..24fcbab --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/common/test_source/test_default.py @@ -0,0 +1,25 @@ +import os + +import testinfra.utils.ansible_runner + +testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner( + os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all') + + +def test_nginx_running_and_enabled(host): + ngx = host.service("nginx") + assert ngx.is_running + assert ngx.is_enabled + + +def test_hosts_file(host): + ngx = host.file('/etc/hosts') + assert ngx.exists + assert ngx.user == 'root' + assert ngx.group == 'root' + + +def test_endpoint(host): + command = """curl -I http://localhost/""" + cmd = host.run(command) + assert '200 OK' in cmd.stdout diff --git a/ansible/roles/nginxinc.nginx/molecule/common/test_stable_push/test_default.py b/ansible/roles/nginxinc.nginx/molecule/common/test_stable_push/test_default.py new file mode 100644 index 0000000..c695962 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/common/test_stable_push/test_default.py @@ -0,0 +1,42 @@ +import nginx +import os + +import testinfra.utils.ansible_runner + +testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner( + os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all') + + +def test_nginx_is_installed(host): + ngx = host.package("nginx") + assert ngx.is_installed + + +def test_nginx_running_and_enabled(host): + ngx = host.service("nginx") + assert ngx.is_running + assert ngx.is_enabled + + +def test_hosts_file(host): + ngx = host.file('/etc/hosts') + assert ngx.exists + assert ngx.user == 'root' + assert ngx.group == 'root' + + +def test_endpoint(host): + command = """curl -I http://localhost/""" + cmd = host.run(command) + assert '200 OK' in cmd.stdout + + +def test_generated_files(host): + assert host.file('/etc/nginx/conf.d/default.conf').exists + + +def test_default_server(host): + f = host.file('/etc/nginx/conf.d/default.conf') + c = nginx.loads(f.content_string) + lf = c.server.filter('Location', '/') + assert len(lf) == 1 diff --git a/ansible/roles/nginxinc.nginx/molecule/common/test_template/test_default.py b/ansible/roles/nginxinc.nginx/molecule/common/test_template/test_default.py new file mode 100644 index 0000000..0b79c97 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/common/test_template/test_default.py @@ -0,0 +1,58 @@ +import nginx +import os + +import testinfra.utils.ansible_runner + +testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner( + os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all') + + +def test_nginx_is_installed(host): + ngx = host.package("nginx") + assert ngx.is_installed + + +def test_nginx_running_and_enabled(host): + ngx = host.service("nginx") + assert ngx.is_running + assert ngx.is_enabled + + +def test_hosts_file(host): + ngx = host.file('/etc/hosts') + assert ngx.exists + assert ngx.user == 'root' + assert ngx.group == 'root' + + +def test_endpoint(host): + command = """curl -I http://localhost/""" + cmd = host.run(command) + assert '200 OK' in cmd.stdout + + +def test_generated_files(host): + assert host.file('/etc/nginx/conf.d/default.conf').exists + assert host.file('/etc/nginx/conf.d/frontend_default.conf').exists + assert host.file('/etc/nginx/conf.d/backend_default.conf').exists + + +def test_default_server(host): + f = host.file('/etc/nginx/conf.d/default.conf') + c = nginx.loads(f.content_string) + lf = c.server.filter('Location', '/') + assert len(lf) == 1 + lb = c.server.filter('Location', '/backend') + assert len(lb) == 1 + + +def test_client_max_body_size(host): + f = host.file('/etc/nginx/conf.d/default.conf') + c = nginx.loads(f.content_string) + vs = c.server.filter('Key', 'client_max_body_size') + assert len(vs) == 1 + assert vs[0].value == '512k' + lc = c.server.filter('Location', '/') + vl = lc[0].filter('Key', 'client_max_body_size') + assert len(vl) == 1 + assert vl[0].value == '5m' diff --git a/ansible/roles/nginxinc.nginx/molecule/default/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/default/molecule.yml new file mode 100644 index 0000000..9a5c3a6 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/default/molecule.yml @@ -0,0 +1,44 @@ +--- +driver: + name: docker +lint: | + set -e + yamllint . + ansible-lint + flake8 +platforms: + - name: debian-stretch + image: debian:stretch-slim + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: debian-buster + image: debian:buster-slim + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: ubuntu-xenial + image: ubuntu:xenial + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: ubuntu-bionic + image: ubuntu:bionic + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" +provisioner: + name: ansible + playbooks: + converge: ../common/playbook_default.yml +verifier: + name: testinfra + directory: ../common/test_default diff --git a/ansible/roles/nginxinc.nginx/molecule/default_alpine/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/default_alpine/molecule.yml new file mode 100644 index 0000000..8fea6a0 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/default_alpine/molecule.yml @@ -0,0 +1,44 @@ +--- +driver: + name: docker +lint: | + set -e + yamllint . + ansible-lint + flake8 +platforms: + - name: alpine-3.8 + image: alpine:3.8 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: alpine-3.9 + image: alpine:3.9 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: alpine-3.10 + image: alpine:3.10 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: alpine-3.11 + image: alpine:3.11 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" +provisioner: + name: ansible + playbooks: + converge: ../common/playbook_default.yml +verifier: + name: testinfra + directory: ../common/test_default diff --git a/ansible/roles/nginxinc.nginx/molecule/default_centos/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/default_centos/molecule.yml new file mode 100644 index 0000000..11b030f --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/default_centos/molecule.yml @@ -0,0 +1,33 @@ +--- +driver: + name: docker +lint: | + set -e + yamllint . + ansible-lint + flake8 +platforms: + - name: centos-6 + image: centos:6 + dockerfile: ../common/Dockerfile.j2 + - name: centos-7 + image: centos:7 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/usr/sbin/init" + - name: centos-8 + image: centos:8 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/usr/sbin/init" +provisioner: + name: ansible + playbooks: + converge: ../common/playbook_default.yml +verifier: + name: testinfra + directory: ../common/test_default diff --git a/ansible/roles/nginxinc.nginx/molecule/module/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/module/molecule.yml new file mode 100644 index 0000000..2e12f7e --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/module/molecule.yml @@ -0,0 +1,44 @@ +--- +driver: + name: docker +lint: | + set -e + yamllint . + ansible-lint + flake8 +platforms: + - name: debian-stretch + image: debian:stretch-slim + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: debian-buster + image: debian:buster-slim + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: ubuntu-xenial + image: ubuntu:xenial + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: ubuntu-bionic + image: ubuntu:bionic + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" +provisioner: + name: ansible + playbooks: + converge: ../common/playbook_module.yml +verifier: + name: testinfra + directory: ../common/test_module diff --git a/ansible/roles/nginxinc.nginx/molecule/module_alpine/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/module_alpine/molecule.yml new file mode 100644 index 0000000..8de545e --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/module_alpine/molecule.yml @@ -0,0 +1,44 @@ +--- +driver: + name: docker +lint: | + set -e + yamllint . + ansible-lint + flake8 +platforms: + - name: alpine-3.8 + image: alpine:3.8 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: alpine-3.9 + image: alpine:3.9 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: alpine-3.10 + image: alpine:3.10 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: alpine-3.11 + image: alpine:3.11 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" +provisioner: + name: ansible + playbooks: + converge: ../common/playbook_module.yml +verifier: + name: testinfra + directory: ../common/test_module diff --git a/ansible/roles/nginxinc.nginx/molecule/module_centos/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/module_centos/molecule.yml new file mode 100644 index 0000000..0b09e78 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/module_centos/molecule.yml @@ -0,0 +1,33 @@ +--- +driver: + name: docker +lint: | + set -e + yamllint . + ansible-lint + flake8 +platforms: + - name: centos-6 + image: centos:6 + dockerfile: ../common/Dockerfile.j2 + - name: centos-7 + image: centos:7 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/usr/sbin/init" + - name: centos-8 + image: centos:8 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/usr/sbin/init" +provisioner: + name: ansible + playbooks: + converge: ../common/playbook_module.yml +verifier: + name: testinfra + directory: ../common/test_module diff --git a/ansible/roles/nginxinc.nginx/molecule/source/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/source/molecule.yml new file mode 100644 index 0000000..a2028ed --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/source/molecule.yml @@ -0,0 +1,44 @@ +--- +driver: + name: docker +lint: | + set -e + yamllint . + ansible-lint + flake8 +platforms: + - name: debian-stretch + image: debian:stretch-slim + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: debian-buster + image: debian:buster-slim + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: ubuntu-xenial + image: ubuntu:xenial + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: ubuntu-bionic + image: ubuntu:bionic + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" +provisioner: + name: ansible + playbooks: + converge: ../common/playbook_source.yml +verifier: + name: testinfra + directory: ../common/test_source diff --git a/ansible/roles/nginxinc.nginx/molecule/source_alpine/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/source_alpine/molecule.yml new file mode 100644 index 0000000..a5b2919 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/source_alpine/molecule.yml @@ -0,0 +1,44 @@ +--- +driver: + name: docker +lint: | + set -e + yamllint . + ansible-lint + flake8 +platforms: + - name: alpine-3.8 + image: alpine:3.8 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: alpine-3.9 + image: alpine:3.9 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: alpine-3.10 + image: python:alpine3.10 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: alpine-3.11 + image: python:alpine3.11 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" +provisioner: + name: ansible + playbooks: + converge: ../common/playbook_source.yml +verifier: + name: testinfra + directory: ../common/test_source diff --git a/ansible/roles/nginxinc.nginx/molecule/source_centos/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/source_centos/molecule.yml new file mode 100644 index 0000000..1fff5be --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/source_centos/molecule.yml @@ -0,0 +1,30 @@ +--- +driver: + name: docker +lint: | + set -e + yamllint . + ansible-lint + flake8 +platforms: + - name: centos-7 + image: centos:7 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/usr/sbin/init" + - name: centos-8 + image: centos:8 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/usr/sbin/init" +provisioner: + name: ansible + playbooks: + converge: ../common/playbook_source.yml +verifier: + name: testinfra + directory: ../common/test_source diff --git a/ansible/roles/nginxinc.nginx/molecule/stable_push/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/stable_push/molecule.yml new file mode 100644 index 0000000..40c6990 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/stable_push/molecule.yml @@ -0,0 +1,47 @@ +--- +dependency: + name: shell + command: pip install python-nginx +driver: + name: docker +lint: | + set -e + yamllint . + ansible-lint + flake8 +platforms: + - name: debian-stretch + image: debian:stretch-slim + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: debian-buster + image: debian:buster-slim + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: ubuntu-xenial + image: ubuntu:xenial + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: ubuntu-bionic + image: ubuntu:bionic + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" +provisioner: + name: ansible + playbooks: + converge: ../common/playbook_stable_push.yml +verifier: + name: testinfra + directory: ../common/test_stable_push diff --git a/ansible/roles/nginxinc.nginx/molecule/stable_push_alpine/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/stable_push_alpine/molecule.yml new file mode 100644 index 0000000..c2753f3 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/stable_push_alpine/molecule.yml @@ -0,0 +1,47 @@ +--- +dependency: + name: shell + command: pip install python-nginx +driver: + name: docker +lint: | + set -e + yamllint . + ansible-lint + flake8 +platforms: + - name: alpine-3.8 + image: alpine:3.8 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: alpine-3.9 + image: alpine:3.9 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: alpine-3.10 + image: alpine:3.10 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: alpine-3.11 + image: alpine:3.11 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" +provisioner: + name: ansible + playbooks: + converge: ../common/playbook_stable_push.yml +verifier: + name: testinfra + directory: ../common/test_stable_push diff --git a/ansible/roles/nginxinc.nginx/molecule/stable_push_centos/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/stable_push_centos/molecule.yml new file mode 100644 index 0000000..c5f1884 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/stable_push_centos/molecule.yml @@ -0,0 +1,36 @@ +--- +dependency: + name: shell + command: pip install python-nginx +driver: + name: docker +lint: | + set -e + yamllint . + ansible-lint + flake8 +platforms: + - name: centos-6 + image: centos:6 + dockerfile: ../common/Dockerfile.j2 + - name: centos-7 + image: centos:7 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/usr/sbin/init" + - name: centos-8 + image: centos:8 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/usr/sbin/init" +provisioner: + name: ansible + playbooks: + converge: ../common/playbook_stable_push.yml +verifier: + name: testinfra + directory: ../common/test_stable_push diff --git a/ansible/roles/nginxinc.nginx/molecule/template/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/template/molecule.yml new file mode 100644 index 0000000..541fee0 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/template/molecule.yml @@ -0,0 +1,47 @@ +--- +dependency: + name: shell + command: pip install python-nginx +driver: + name: docker +lint: | + set -e + yamllint . + ansible-lint + flake8 +platforms: + - name: debian-stretch + image: debian:stretch-slim + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: debian-buster + image: debian:buster-slim + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: ubuntu-xenial + image: ubuntu:xenial + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: ubuntu-bionic + image: ubuntu:bionic + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" +provisioner: + name: ansible + playbooks: + converge: ../common/playbook_template.yml +verifier: + name: testinfra + directory: ../common/test_template diff --git a/ansible/roles/nginxinc.nginx/molecule/template_alpine/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/template_alpine/molecule.yml new file mode 100644 index 0000000..a646a5b --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/template_alpine/molecule.yml @@ -0,0 +1,47 @@ +--- +dependency: + name: shell + command: pip install python-nginx +driver: + name: docker +lint: | + set -e + yamllint . + ansible-lint + flake8 +platforms: + - name: alpine-3.8 + image: alpine:3.8 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: alpine-3.9 + image: alpine:3.9 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: alpine-3.10 + image: alpine:3.10 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: alpine-3.11 + image: alpine:3.11 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" +provisioner: + name: ansible + playbooks: + converge: ../common/playbook_template.yml +verifier: + name: testinfra + directory: ../common/test_template diff --git a/ansible/roles/nginxinc.nginx/molecule/template_centos/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/template_centos/molecule.yml new file mode 100644 index 0000000..3b0f745 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/template_centos/molecule.yml @@ -0,0 +1,36 @@ +--- +dependency: + name: shell + command: pip install python-nginx +driver: + name: docker +lint: | + set -e + yamllint . + ansible-lint + flake8 +platforms: + - name: centos-6 + image: centos:6 + dockerfile: ../common/Dockerfile.j2 + - name: centos-7 + image: centos:7 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/usr/sbin/init" + - name: centos-8 + image: centos:8 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/usr/sbin/init" +provisioner: + name: ansible + playbooks: + converge: ../common/playbook_template.yml +verifier: + name: testinfra + directory: ../common/test_template diff --git a/ansible/roles/nginxinc.nginx/molecule/unit/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/unit/molecule.yml new file mode 100644 index 0000000..71585a8 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/unit/molecule.yml @@ -0,0 +1,41 @@ +--- +driver: + name: docker +lint: | + set -e + yamllint . + ansible-lint + flake8 +platforms: + - name: debian-stretch + image: debian:stretch-slim + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: debian-buster + image: debian:buster-slim + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: ubuntu-xenial + image: ubuntu:xenial + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: ubuntu-bionic + image: ubuntu:bionic + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" +provisioner: + name: ansible + playbooks: + converge: ../common/playbook_unit.yml diff --git a/ansible/roles/nginxinc.nginx/molecule/unit_alpine/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/unit_alpine/molecule.yml new file mode 100644 index 0000000..cd02977 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/unit_alpine/molecule.yml @@ -0,0 +1,41 @@ +--- +driver: + name: docker +lint: | + set -e + yamllint . + ansible-lint + flake8 +platforms: + - name: alpine-3.8 + image: alpine:3.8 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: alpine-3.9 + image: alpine:3.9 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: alpine-3.10 + image: alpine:3.10 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" + - name: alpine-3.11 + image: alpine:3.11 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/sbin/init" +provisioner: + name: ansible + playbooks: + converge: ../common/playbook_unit.yml diff --git a/ansible/roles/nginxinc.nginx/molecule/unit_centos/molecule.yml b/ansible/roles/nginxinc.nginx/molecule/unit_centos/molecule.yml new file mode 100644 index 0000000..bd73ca0 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/molecule/unit_centos/molecule.yml @@ -0,0 +1,30 @@ +--- +driver: + name: docker +lint: | + set -e + yamllint . + ansible-lint + flake8 +platforms: + - name: centos-6 + image: centos:6 + dockerfile: ../common/Dockerfile.j2 + - name: centos-7 + image: centos:7 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/usr/sbin/init" + - name: centos-8 + image: centos:8 + dockerfile: ../common/Dockerfile.j2 + privileged: true + volumes: + - "/sys/fs/cgroup:/sys/fs/cgroup:rw" + command: "/usr/sbin/init" +provisioner: + name: ansible + playbooks: + converge: ../common/playbook_unit.yml diff --git a/ansible/roles/nginxinc.nginx/tasks/amplify/install-amplify.yml b/ansible/roles/nginxinc.nginx/tasks/amplify/install-amplify.yml new file mode 100644 index 0000000..9204abf --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/amplify/install-amplify.yml @@ -0,0 +1,24 @@ +--- +- import_tasks: setup-debian.yml + when: ansible_os_family == "Debian" + +- import_tasks: setup-redhat.yml + when: ansible_os_family == "RedHat" + +- name: "(Install: All OSs) Install NGINX Amplify Agent" + package: + name: nginx-amplify-agent + state: present + +- name: "(Setup: All OSs) Copy NGINX Configurator Agent Configuration Template" + copy: + remote_src: yes + src: /etc/amplify-agent/agent.conf.default + dest: /etc/amplify-agent/agent.conf + +- name: "(Setup: All OSs) Configure NGINX Amplify Agent API Key" + lineinfile: + dest: /etc/amplify-agent/agent.conf + regexp: api_key =.* + line: "api_key = {{ nginx_amplify_api_key }}" + notify: "(Handler: All OSs) Start NGINX Amplify Agent" diff --git a/ansible/roles/nginxinc.nginx/tasks/amplify/setup-debian.yml b/ansible/roles/nginxinc.nginx/tasks/amplify/setup-debian.yml new file mode 100644 index 0000000..224a076 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/amplify/setup-debian.yml @@ -0,0 +1,5 @@ +--- +- name: "(Install: Debian/Ubuntu) Add NGINX Amplify Agent Repository" + apt_repository: + filename: nginx-amplify + repo: deb [arch=amd64] http://packages.amplify.nginx.com/{{ ansible_distribution|lower }}/ {{ ansible_distribution_release|lower }} amplify-agent diff --git a/ansible/roles/nginxinc.nginx/tasks/amplify/setup-redhat.yml b/ansible/roles/nginxinc.nginx/tasks/amplify/setup-redhat.yml new file mode 100644 index 0000000..154da5e --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/amplify/setup-redhat.yml @@ -0,0 +1,8 @@ +--- +- name: "(Install: CentOS/RedHat/Amazon Linux) Add NGINX Amplify Agent Repository" + yum_repository: + name: nginx-amplify + baseurl: http://packages.amplify.nginx.com/{{ (ansible_distribution == "Amazon") | ternary('amzn/', 'centos/') }}/$releasever/$basearch/ + description: NGINX Amplify Agent + enabled: yes + gpgcheck: yes diff --git a/ansible/roles/nginxinc.nginx/tasks/conf/cleanup-config.yml b/ansible/roles/nginxinc.nginx/tasks/conf/cleanup-config.yml new file mode 100644 index 0000000..9eb405c --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/conf/cleanup-config.yml @@ -0,0 +1,8 @@ +--- +- name: "(Setup: All OSs) Remove NGINX configuration files" + file: + path: "{{ item }}" + state: absent + with_items: + - "{{ nginx_cleanup_config_path }}" + notify: "(Handler: All OSs) Reload NGINX" diff --git a/ansible/roles/nginxinc.nginx/tasks/conf/debug-output.yml b/ansible/roles/nginxinc.nginx/tasks/conf/debug-output.yml new file mode 100644 index 0000000..6ad7ba1 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/conf/debug-output.yml @@ -0,0 +1,9 @@ +--- +- name: "(Setup: All OSs) Register NGINX configuration" + command: nginx -T + changed_when: false + register: nginx_configuration + +- name: "(Setup: All OSs) Print NGINX configuration" + debug: + var: nginx_configuration.stdout_lines diff --git a/ansible/roles/nginxinc.nginx/tasks/conf/setup-status.yml b/ansible/roles/nginxinc.nginx/tasks/conf/setup-status.yml new file mode 100644 index 0000000..a69c43e --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/conf/setup-status.yml @@ -0,0 +1,32 @@ +--- +- name: "(Setup: NGINX Open Source) Enable NGINX Open Source Status" + blockinfile: + path: "{{ nginx_status_location }}" + create: yes + block: | + server { + listen 127.0.0.1:{{ nginx_status_port | default('80') }}; + location /nginx_status { + stub_status on; + allow 127.0.0.1; + deny all; + } + } + when: nginx_type == "opensource" + notify: "(Handler: All OSs) Reload NGINX" + +- name: "(Setup: NGINX Plus) Enable NGINX Plus Status" + blockinfile: + path: "{{ nginx_status_location }}" + create: yes + block: | + server { + listen 127.0.0.1:{{ nginx_status_port | default('80') }}; + location /status { + status; + allow 127.0.0.1; + deny all; + } + } + when: nginx_type == "plus" + notify: "(Handler: All OSs) Reload NGINX" diff --git a/ansible/roles/nginxinc.nginx/tasks/conf/template-config.yml b/ansible/roles/nginxinc.nginx/tasks/conf/template-config.yml new file mode 100644 index 0000000..21205f0 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/conf/template-config.yml @@ -0,0 +1,81 @@ +--- +- name: "(Setup: All NGINX) Ensure HTML Directory Exists" + file: + path: "{{ item.value.html_file_location | default('/usr/share/nginx/html') }}" + state: directory + with_dict: "{{ nginx_html_demo_template }}" + when: nginx_html_demo_template_enable | bool + +- name: "(Setup: All NGINX) Dynamically Generate HTML Files" + template: + src: "{{ item.value.template_file | default('www/index.html.j2') }}" + dest: "{{ item.value.html_file_location | default('/usr/share/nginx/html') }}/{{ item.value.html_file_name | default('index.html') }}" + backup: yes + with_dict: "{{ nginx_html_demo_template }}" + when: nginx_html_demo_template_enable | bool + +- name: "(Setup: All NGINX) Ensure NGINX Main Directory Exists" + file: + path: "{{ nginx_main_template.conf_file_location | default('/etc/nginx') }}" + state: directory + when: nginx_main_template_enable | bool + +- name: "(Setup: All NGINX) Dynamically Generate NGINX Main Configuration File" + template: + src: "{{ nginx_main_template.template_file | default('nginx.conf.j2') }}" + dest: "{{ nginx_main_template.conf_file_location | default('/etc/nginx') }}/{{ nginx_main_template.conf_file_name | default('nginx.conf') }}" + backup: yes + when: nginx_main_template_enable | bool + notify: "(Handler: All OSs) Reload NGINX" + +- name: "(Setup: All NGINX) Ensure NGINX HTTP Directory Exists" + file: + path: "{{ item.value.conf_file_location | default('/etc/nginx/conf.d/') }}" + state: directory + with_dict: "{{ nginx_http_template }}" + when: nginx_http_template_enable | bool + +- name: "(Setup: All NGINX) Ensure NGINX Proxy Cache Directories Exist" + file: + path: "{{ item.1.path }}" + state: directory + owner: "{{ nginx_main_template.user | default('nginx') }}" + with_subelements: + - "{{ nginx_http_template }}" + - proxy_cache.proxy_cache_path + - skip_missing: true + when: nginx_http_template_enable | bool + +- name: "(Setup: All NGINX) Dynamically Generate NGINX HTTP Configuration Files" + template: + src: "{{ item.value.template_file | default('http/default.conf.j2') }}" + dest: "{{ item.value.conf_file_location | default('/etc/nginx/conf.d/') }}/{{ item.value.conf_file_name | default('default.conf') }}" + backup: yes + with_dict: "{{ nginx_http_template }}" + when: nginx_http_template_enable | bool + notify: "(Handler: All OSs) Reload NGINX" + + +- name: "(Setup: All NGINX) Dynamically Generate NGINX API Configuration File" + template: + src: "{{ nginx_rest_api_template_file | default('http/api.conf.j2') }}" + dest: "{{ nginx_rest_api_file_location | default('/etc/nginx/conf.d/api.conf') }}" + backup: yes + notify: "(Handler: All OSs) Reload NGINX" + when: nginx_rest_api_enable | bool + +- name: "(Setup: All NGINX) Ensure NGINX Stream Directory Exists" + file: + path: "{{ item.value.conf_file_location | default('/etc/nginx/conf.d/stream/') }}" + state: directory + with_dict: "{{ nginx_stream_template }}" + when: nginx_stream_template_enable | bool + +- name: "(Setup: All NGINX) Dynamically Generate NGINX Stream Configuration Files" + template: + src: "{{ item.value.template_file | default('stream/default.conf.j2') }}" + dest: "{{ item.value.conf_file_location | default('/etc/nginx/conf.d/stream/') }}/{{ item.value.conf_file_name | default('default.conf') }}" + backup: yes + with_dict: "{{ nginx_stream_template }}" + notify: "(Handler: All OSs) Reload NGINX" + when: nginx_stream_template_enable | bool diff --git a/ansible/roles/nginxinc.nginx/tasks/conf/upload-config.yml b/ansible/roles/nginxinc.nginx/tasks/conf/upload-config.yml new file mode 100644 index 0000000..66c68dd --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/conf/upload-config.yml @@ -0,0 +1,92 @@ +--- +- name: "(Setup: All NGINX) Ensure NGINX Main Directory Exists" + file: + path: "{{ nginx_main_upload_dest | default('/etc/nginx/') }}" + state: directory + when: nginx_main_upload_enable | bool + +- name: "(Setup: All NGINX) Upload NGINX Main Configuration File" + copy: + src: "{{ nginx_main_upload_src | default('conf/nginx.conf') }}" + dest: "{{ nginx_main_upload_dest | default('/etc/nginx/') }}" + backup: yes + when: nginx_main_upload_enable | bool + notify: "(Handler: All OSs) Reload NGINX" + +- name: "(Setup: All NGINX) Ensure NGINX HTTP Directory Exists" + file: + path: "{{ nginx_http_upload_dest | default('/etc/nginx/conf.d/') }}" + state: directory + when: nginx_http_upload_enable | bool + +- name: "(Setup: All NGINX) Upload NGINX HTTP Configuration Files" + copy: + src: "{{ item }}" + dest: "{{ nginx_http_upload_dest | default('/etc/nginx/conf.d/') }}" + backup: yes + with_fileglob: "{{ nginx_http_upload_src }}" + when: nginx_http_upload_enable | bool + notify: "(Handler: All OSs) Reload NGINX" + +- name: "(Setup: All NGINX) Ensure NGINX Stream Directory Exists" + file: + path: "{{ nginx_stream_upload_dest | default('/etc/nginx/conf.d/') }}" + state: directory + when: nginx_stream_upload_enable | bool + +- name: "(Setup: All NGINX) Upload NGINX Stream Configuration Files" + copy: + src: "{{ item }}" + dest: "{{ nginx_stream_upload_dest | default('/etc/nginx/conf.d/') }}" + backup: yes + with_fileglob: "{{ nginx_stream_upload_src }}" + when: nginx_stream_upload_enable | bool + notify: "(Handler: All OSs) Reload NGINX" + +- name: "(Setup: All NGINX) Ensure NGINX HTML Directory Exists" + file: + path: "{{ nginx_html_upload_dest | default('/usr/share/nginx/html') }}" + state: directory + when: nginx_html_upload_enable | bool + +- name: "(Setup: All NGINX) Upload NGINX HTML Files" + copy: + src: "{{ item }}" + dest: "{{ nginx_html_upload_dest | default('/usr/share/nginx/html') }}" + backup: yes + with_fileglob: "{{ nginx_html_upload_src }}" + when: nginx_html_upload_enable | bool + notify: "(Handler: All OSs) Reload NGINX" + +- name: "(Setup: All NGINX) Ensure SSL Certificate Directory Exists" + file: + path: "{{ nginx_ssl_crt_upload_dest | default('/etc/ssl/certs/') }}" + state: directory + when: nginx_ssl_upload_enable | bool + +- name: "(Setup: All NGINX) Ensure SSL Key Directory Exists" + file: + path: "{{ nginx_ssl_key_upload_dest | default('/etc/ssl/private/') }}" + state: directory + when: nginx_ssl_upload_enable | bool + +- name: "(Setup: All NGINX) Upload NGINX SSL Certificates" + copy: + src: "{{ item }}" + dest: "{{ nginx_ssl_crt_upload_dest | default('/etc/ssl/certs/') }}" + mode: 0640 + decrypt: yes + backup: yes + with_fileglob: "{{ nginx_ssl_crt_upload_src }}" + when: nginx_ssl_upload_enable | bool + +- name: "(Setup: All NGINX) Upload NGINX SSL Keys" + copy: + src: "{{ item }}" + dest: "{{ nginx_ssl_key_upload_dest | default('/etc/ssl/private/') }}" + mode: 0640 + decrypt: yes + backup: yes + with_fileglob: "{{ nginx_ssl_key_upload_src }}" + no_log: yes + when: nginx_ssl_upload_enable | bool diff --git a/ansible/roles/nginxinc.nginx/tasks/keys/apk-key.yml b/ansible/roles/nginxinc.nginx/tasks/keys/apk-key.yml new file mode 100644 index 0000000..131634d --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/keys/apk-key.yml @@ -0,0 +1,13 @@ +--- +- name: "(Install: APK OSs) Set Default APK NGINX Signing Key URL" + set_fact: + default_keysite: https://nginx.org/keys/nginx_signing.rsa.pub + +- name: "(Install: APK OSs) Set APK NGINX Signing Key URL" + set_fact: + keysite: "{{ nginx_signing_key | default(default_keysite) }}" + +- name: "(Install: APK OSs) Download NGINX Signing Key" + get_url: + url: "{{ keysite }}" + dest: /etc/apk/keys/nginx_signing.rsa.pub diff --git a/ansible/roles/nginxinc.nginx/tasks/keys/apt-key.yml b/ansible/roles/nginxinc.nginx/tasks/keys/apt-key.yml new file mode 100644 index 0000000..ef7f140 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/keys/apt-key.yml @@ -0,0 +1,12 @@ +--- +- name: "(Install: APT OSs) Set Default APT NGINX Signing Key URL" + set_fact: + default_keysite: https://nginx.org/keys/nginx_signing.key + +- name: "(Install: APT OSs) Set APT NGINX Signing Key URL" + set_fact: + keysite: "{{ nginx_signing_key | default(default_keysite) }}" + +- name: "(Install: APT OSs) Add APT NGINX Signing Key" + apt_key: + url: "{{ keysite }}" diff --git a/ansible/roles/nginxinc.nginx/tasks/keys/rpm-key.yml b/ansible/roles/nginxinc.nginx/tasks/keys/rpm-key.yml new file mode 100644 index 0000000..0323d56 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/keys/rpm-key.yml @@ -0,0 +1,14 @@ +--- +- name: "(Install: RPM OSs) Set Default RPM NGINX Signing Key" + set_fact: + default_keysite: >- + {{ (ansible_distribution_major_version|int == 6) + | ternary('http://nginx.org/keys/nginx_signing.key', 'https://nginx.org/keys/nginx_signing.key') }} + +- name: "(Install: RPM OSs) Set RPM NGINX Signing Key URL" + set_fact: + keysite: "{{ nginx_signing_key | default(default_keysite) }}" + +- name: "(Install: RPM OSs) Add RPM NGINX Signing Key" + rpm_key: + key: "{{ keysite }}" diff --git a/ansible/roles/nginxinc.nginx/tasks/main.yml b/ansible/roles/nginxinc.nginx/tasks/main.yml new file mode 100644 index 0000000..ead4e9b --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/main.yml @@ -0,0 +1,85 @@ +--- +- import_tasks: prerequisites/install-prerequisites.yml + tags: nginx_prerequisites + +- import_tasks: keys/apt-key.yml + when: + - ansible_os_family == "Debian" + - nginx_install_from == "nginx_repository" + or nginx_amplify_enable + or nginx_unit_enable + tags: nginx_aptkey + +- import_tasks: keys/rpm-key.yml + when: + - ansible_os_family == "RedHat" + or ansible_os_family == "Suse" + - nginx_install_from == "nginx_repository" + or nginx_amplify_enable + or nginx_unit_enable + tags: nginx_rpmkey + +- import_tasks: keys/apk-key.yml + when: ansible_os_family == "Alpine" + tags: nginx_apkkey + +- name: "(Install: Debian/Ubuntu/CentOS/RedHat/FreeBSD) Install NGINX" + block: + + - import_tasks: opensource/install-oss.yml + when: nginx_type == "opensource" + tags: nginx_install_oss + + - import_tasks: plus/install-plus.yml + when: nginx_type == "plus" + tags: nginx_install_plus + + - import_tasks: conf/cleanup-config.yml + when: nginx_cleanup_config | bool + tags: nginx_cleanup_config + + - import_tasks: conf/upload-config.yml + when: nginx_main_upload_enable + or nginx_http_upload_enable + or nginx_stream_upload_enable + or nginx_html_upload_enable + or nginx_ssl_upload_enable + tags: nginx_upload_config + + - import_tasks: conf/template-config.yml + when: nginx_main_template_enable + or nginx_http_template_enable + or nginx_stream_template_enable + or nginx_rest_api_enable + tags: nginx_template_config + + - import_tasks: conf/setup-status.yml + when: nginx_status_enable | bool + tags: nginx_setup_status + + - import_tasks: modules/install-modules.yml + when: true in nginx_modules.values() + tags: nginx_install_modules + + - import_tasks: conf/debug-output.yml + when: nginx_debug_output | bool + tags: nginx_debug_output + + - import_tasks: plus/delete-license.yml + when: + - nginx_type == "plus" + - nginx_delete_license + tags: nginx_delete_license + + when: nginx_enable | bool + +- import_tasks: amplify/install-amplify.yml + when: + - nginx_amplify_enable | bool + - nginx_amplify_api_key is defined + - nginx_amplify_api_key | length > 0 + tags: nginx_install_amplify + +- import_tasks: unit/install-unit.yml + when: nginx_unit_enable | bool + tags: nginx_install_unit diff --git a/ansible/roles/nginxinc.nginx/tasks/modules/install-geoip.yml b/ansible/roles/nginxinc.nginx/tasks/modules/install-geoip.yml new file mode 100644 index 0000000..124d0f0 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/modules/install-geoip.yml @@ -0,0 +1,29 @@ +--- +- name: "(Install: CentOS) Install GeoIP Required CentOS Dependencies" + yum: + name: + - epel-release + when: ansible_distribution == "CentOS" + +- name: "(Install: All OSs) Install NGINX Open Source GeoIP Module" + package: + name: "nginx-module-geoip{{ nginx_version | default('') }}" + state: present + when: nginx_type == "opensource" + +- name: "(Install: All OSs) Install NGINX Plus GeoIP Module" + package: + name: "nginx-plus-module-geoip{{ nginx_version | default('') }}" + state: present + when: nginx_type == "plus" + +- name: "(Setup: All NGINX) Load NGINX GeoIP Module" + lineinfile: + path: /etc/nginx/nginx.conf + insertbefore: BOF + line: "{{ item }}" + with_items: + - load_module modules/ngx_http_geoip_module.so; + - load_module modules/ngx_stream_geoip_module.so; + when: not nginx_main_template_enable + notify: "(Handler: All OSs) Reload NGINX" diff --git a/ansible/roles/nginxinc.nginx/tasks/modules/install-image-filter.yml b/ansible/roles/nginxinc.nginx/tasks/modules/install-image-filter.yml new file mode 100644 index 0000000..bbce180 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/modules/install-image-filter.yml @@ -0,0 +1,20 @@ +--- +- name: "(Install: All OSs) Install NGINX Open Source Image Filter Module" + package: + name: "nginx-module-image-filter{{ nginx_version | default('') }}" + state: present + when: nginx_type == "opensource" + +- name: "(Install: All OSs) Install NGINX Plus Image Filter Module" + package: + name: "nginx-plus-module-image-filter{{ nginx_version | default('') }}" + state: present + when: nginx_type == "plus" + +- name: "(Setup: All NGINX) Load NGINX Image Filter Module" + lineinfile: + path: /etc/nginx/nginx.conf + insertbefore: BOF + line: load_module modules/ngx_http_image_filter_module.so; + when: not nginx_main_template_enable + notify: "(Handler: All OSs) Reload NGINX" diff --git a/ansible/roles/nginxinc.nginx/tasks/modules/install-modules.yml b/ansible/roles/nginxinc.nginx/tasks/modules/install-modules.yml new file mode 100644 index 0000000..d055fe4 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/modules/install-modules.yml @@ -0,0 +1,28 @@ +--- +- import_tasks: install-njs.yml + when: nginx_modules.njs | default(false) + +- import_tasks: install-perl.yml + when: nginx_modules.perl | default(false) + +- import_tasks: install-geoip.yml + when: + - nginx_modules.geoip | default(false) + - ansible_os_family != "RedHat" + - ansible_distribution_major_version != "8" + +- import_tasks: install-image-filter.yml + when: nginx_modules.image_filter | default(false) + +- import_tasks: install-rtmp.yml + when: + - nginx_modules.rtmp | default(false) + - nginx_type == "plus" + +- import_tasks: install-xslt.yml + when: nginx_modules.xslt | default(false) + +- import_tasks: install-waf.yml + when: + - nginx_modules.waf | default(false) + - nginx_type == "plus" diff --git a/ansible/roles/nginxinc.nginx/tasks/modules/install-njs.yml b/ansible/roles/nginxinc.nginx/tasks/modules/install-njs.yml new file mode 100644 index 0000000..f0a2a8a --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/modules/install-njs.yml @@ -0,0 +1,23 @@ +--- +- name: "(Install: All OSs) Install NGINX Open Source JavaScript Module" + package: + name: "nginx-module-njs{{ nginx_version | default('') }}" + state: present + when: nginx_type == "opensource" + +- name: "(Install: All OSs) Install NGINX Plus JavaScript Module" + package: + name: "nginx-plus-module-njs{{ nginx_version | default('') }}" + state: present + when: nginx_type == "plus" + +- name: "(Setup: All NGINX) Load NGINX JavaScript Module" + lineinfile: + path: /etc/nginx/nginx.conf + insertbefore: BOF + line: "{{ item }}" + with_items: + - load_module modules/ngx_http_js_module.so; + - load_module modules/ngx_stream_js_module.so; + when: not nginx_main_template_enable + notify: "(Handler: All OSs) Reload NGINX" diff --git a/ansible/roles/nginxinc.nginx/tasks/modules/install-perl.yml b/ansible/roles/nginxinc.nginx/tasks/modules/install-perl.yml new file mode 100644 index 0000000..eb8fac3 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/modules/install-perl.yml @@ -0,0 +1,25 @@ +--- +- name: "(Install: All OSs) Install Perl Dependency" + package: + name: perl + state: present + +- name: "(Install: All OSs) Install NGINX Open Source Perl Module" + package: + name: "nginx-module-perl{{ nginx_version | default('') }}" + state: present + when: nginx_type == "opensource" + +- name: "(Install: All OSs) Install NGINX Plus Perl Module" + package: + name: "nginx-plus-module-perl{{ nginx_version | default('') }}" + state: present + when: nginx_type == "plus" + +- name: "(Setup: All NGINX) Load NGINX Perl Module" + lineinfile: + path: /etc/nginx/nginx.conf + insertbefore: BOF + line: load_module modules/ngx_http_perl_module.so; + when: not nginx_main_template_enable + notify: "(Handler: All OSs) Reload NGINX" diff --git a/ansible/roles/nginxinc.nginx/tasks/modules/install-rtmp.yml b/ansible/roles/nginxinc.nginx/tasks/modules/install-rtmp.yml new file mode 100644 index 0000000..77b1dfd --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/modules/install-rtmp.yml @@ -0,0 +1,13 @@ +--- +- name: "(Install: All OSs) Install NGINX Plus RTMP Module" + package: + name: "nginx-plus-module-rtmp{{ nginx_version | default('') }}" + state: present + +- name: "(Setup: All NGINX) Load NGINX RTMP Module" + lineinfile: + path: /etc/nginx/nginx.conf + insertbefore: BOF + line: load_module modules/ngx_rtmp_module.so; + when: not nginx_main_template_enable + notify: "(Handler: All OSs) Reload NGINX" diff --git a/ansible/roles/nginxinc.nginx/tasks/modules/install-waf.yml b/ansible/roles/nginxinc.nginx/tasks/modules/install-waf.yml new file mode 100644 index 0000000..806cfd3 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/modules/install-waf.yml @@ -0,0 +1,13 @@ +--- +- name: "(Install: All OSs) Install NGINX Plus WAF Module" + package: + name: "nginx-plus-module-modsecurity{{ nginx_version | default('') }}" + state: present + +- name: "(Setup: NGINX Plus) Load NGINX Plus WAF Module" + lineinfile: + path: /etc/nginx/nginx.conf + insertbefore: BOF + line: load_module modules/ngx_http_modsecurity_module.so; + when: not nginx_main_template_enable + notify: "(Handler: All OSs) Reload NGINX" diff --git a/ansible/roles/nginxinc.nginx/tasks/modules/install-xslt.yml b/ansible/roles/nginxinc.nginx/tasks/modules/install-xslt.yml new file mode 100644 index 0000000..d73f552 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/modules/install-xslt.yml @@ -0,0 +1,20 @@ +--- +- name: "(Install: All OSs) Install NGINX Open Source XSLT Module" + package: + name: "nginx-module-xslt{{ nginx_version | default('') }}" + state: present + when: nginx_type == "opensource" + +- name: "(Install: All OSs) Install NGINX Plus XSLT Module" + package: + name: "nginx-plus-module-xslt{{ nginx_version | default('') }}" + state: present + when: nginx_type == "plus" + +- name: "(Setup: All NGINX) Load NGINX XSLT Module" + lineinfile: + path: /etc/nginx/nginx.conf + insertbefore: BOF + line: load_module modules/ngx_http_xslt_filter_module.so; + when: not nginx_main_template_enable + notify: "(Handler: All OSs) Reload NGINX" diff --git a/ansible/roles/nginxinc.nginx/tasks/opensource/install-oss-bsd.yml b/ansible/roles/nginxinc.nginx/tasks/opensource/install-oss-bsd.yml new file mode 100644 index 0000000..b8b5997 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/opensource/install-oss-bsd.yml @@ -0,0 +1,103 @@ +--- +- name: "(Install: FreeBSD) Update ports" + block: + + - name: "(Install: FreeBSD) Fetch Ports" + command: portsnap fetch --interactive + args: + creates: /var/db/portsnap/INDEX + + - name: "(Install: FreeBSD) Extract Ports" + command: portsnap extract + args: + creates: /usr/ports + + when: + - ansible_system == 'FreeBSD' + - nginx_bsd_update_ports + +- name: "(Install: FreeBSD)" + block: + + - name: "(Install: FreeBSD) Install NGINX package" + pkgng: + name: "www/nginx{{ nginx_version | default('') }}" + state: "{{ nginx_state }}" + when: nginx_bsd_install_packages + notify: "(Handler: All OSs) Start NGINX" + + - name: "(Install: FreeBSD) Install NGINX port" + portinstall: + name: "www/nginx{{ nginx_version | default('') }}" + use_packages: "{{ nginx_bsd_portinstall_use_packages | default(omit) }}" + state: "{{ nginx_state }}" + when: not nginx_bsd_install_packages + notify: "(Handler: All OSs) Start NGINX" + + when: ansible_system == 'FreeBSD' + +- name: "(Install: OpenBSD)" + block: + + - name: "(Install: OpenBSD) Install NGINX package" + openbsd_pkg: + name: "nginx{{ nginx_version | default('') }}" + build: false + state: "{{ nginx_state }}" + when: nginx_bsd_install_packages + notify: "(Handler: All OSs) Start NGINX" + + - name: "(Install: OpenBSD) Install NGINX port" + openbsd_pkg: + name: "nginx{{ nginx_version | default('') }}" + build: true + state: "{{ nginx_state }}" + when: not nginx_bsd_install_packages + notify: "(Handler: All OSs) Start NGINX" + + when: ansible_system == 'OpenBSD' + +- name: "(Install: NetBSD)" + block: + + - name: "(Install: NetBSD) Install NGINX package" + command: "pkg_add www/nginx{{ nginx_version | default('') }}" + when: nginx_bsd_install_packages + notify: "(Handler: All OSs) Start NGINX" + + - name: "(Install: NetBSD) Install NGINX port" + fail: + msg: "{{ ansible_system }} Install NGINX port not implemented." + when: not nginx_bsd_install_packages + + when: ansible_system == 'NetBSD' + +- name: "(Install: DragonFlyBSD)" + block: + + - name: "(Install: DragonFlyBSD) Install NGINX package" + command: "pkg install www/nginx{{ nginx_version | default('') }}" + when: nginx_bsd_install_packages + notify: "(Handler: All OSs) Start NGINX" + + - name: "(Install: DragonFlyBSD) Install NGINX port" + fail: + msg: "{{ ansible_system }} Install NGINX port not implemented." + when: not nginx_bsd_install_packages + + when: ansible_system == 'DragonFlyBSD' + +- name: "(Install: HardenedBSD)" + block: + + - name: "(Install: HardenedBSD) Install NGINX package" + command: "pkg install www/nginx{{ nginx_version | default('') }}" + when: nginx_bsd_install_packages + notify: "(Handler: All OSs) Start NGINX" + + - name: "(Install: HardenedBSD) Install NGINX port" + fail: + msg: "{{ ansible_system }} Install NGINX port not implemented." + when: not nginx_bsd_install_packages + + when: ansible_system == 'HardenedBSD' diff --git a/ansible/roles/nginxinc.nginx/tasks/opensource/install-oss-linux.yml b/ansible/roles/nginxinc.nginx/tasks/opensource/install-oss-linux.yml new file mode 100644 index 0000000..3525e63 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/opensource/install-oss-linux.yml @@ -0,0 +1,28 @@ +--- +- name: "(Install: Linux) Configure NGINX repo" + block: + + - import_tasks: setup-alpine.yml + when: ansible_os_family == "Alpine" + + - import_tasks: setup-debian.yml + when: ansible_os_family == "Debian" + + - import_tasks: setup-redhat.yml + when: ansible_os_family == "RedHat" + + - import_tasks: setup-suse.yml + when: ansible_os_family == "Suse" + + when: nginx_install_from == "nginx_repository" + +- name: "(Install: Linux) Install NGINX from source" + import_tasks: setup-source.yml + when: nginx_install_from == "source" + +- name: "(Install: Linux) Install NGINX package" + package: + name: "nginx{{ nginx_version | default('') }}" + state: "{{ nginx_state }}" + when: nginx_install_from == "os_repository" + notify: "(Handler: All OSs) Start NGINX" diff --git a/ansible/roles/nginxinc.nginx/tasks/opensource/install-oss.yml b/ansible/roles/nginxinc.nginx/tasks/opensource/install-oss.yml new file mode 100644 index 0000000..a2b8584 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/opensource/install-oss.yml @@ -0,0 +1,8 @@ +--- +- name: "(Install: OSS Linux)" + import_tasks: install-oss-linux.yml + when: ansible_os_family in nginx_linux_families + +- name: "(Install: OSS BSD)" + import_tasks: install-oss-bsd.yml + when: ansible_system in nginx_bsd_systems diff --git a/ansible/roles/nginxinc.nginx/tasks/opensource/setup-alpine.yml b/ansible/roles/nginxinc.nginx/tasks/opensource/setup-alpine.yml new file mode 100644 index 0000000..f5aa5b9 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/opensource/setup-alpine.yml @@ -0,0 +1,29 @@ +--- +- name: "(Install: Alpine) Set Default APK NGINX Repository" + set_fact: + default_repository: >- + https://nginx.org/packages/{{ (nginx_branch == 'mainline') + | ternary('mainline/', '') }}alpine/v{{ ansible_distribution_version.split('.')[0] }}.{{ ansible_distribution_version.split('.')[1] }}/main + +- name: "(Install: Alpine) Set APK NGINX Repository" + set_fact: + repository: "{{ nginx_repository | default(default_repository) }}" + +- name: "(Install: Alpine) Add NGINX Repository" + lineinfile: + path: /etc/apk/repositories + insertafter: EOF + line: "{{ repository }}" + +- name: "(Install: Alpine) Install Required Alpine Dependencies" + apk: + name: + - openssl + - pcre + +- name: "(Install: Alpine) Install NGINX" + apk: + name: "nginx{{ nginx_version | default('') }}" + repository: "{{ repository }}" + state: "{{ nginx_state }}" + notify: "(Handler: All OSs) Start NGINX" diff --git a/ansible/roles/nginxinc.nginx/tasks/opensource/setup-debian.yml b/ansible/roles/nginxinc.nginx/tasks/opensource/setup-debian.yml new file mode 100644 index 0000000..a289956 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/opensource/setup-debian.yml @@ -0,0 +1,26 @@ +--- +- name: "(Install: Debian/Ubuntu) Set Default APT NGINX Repository" + set_fact: + default_repository: + - >- + deb [arch=amd64] https://nginx.org/packages/{{ (nginx_branch == 'mainline') + | ternary('mainline/', '') }}{{ ansible_distribution | lower }}/ {{ ansible_distribution_release }} nginx + - >- + deb-src [arch=amd64] https://nginx.org/packages/{{ (nginx_branch == 'mainline') + | ternary('mainline/', '') }}{{ ansible_distribution | lower }}/ {{ ansible_distribution_release }} nginx + +- name: "(Install: Debian/Ubuntu) Set APT NGINX Repository" + set_fact: + repository: "{{ nginx_repository | default(default_repository) }}" + +- name: "(Install: Debian/Ubuntu) Add NGINX Repository" + apt_repository: + repo: "{{ item }}" + with_items: + - "{{ repository }}" + +- name: "(Install: Debian/Ubuntu) Install NGINX" + apt: + name: "nginx{{ nginx_version | default('') }}" + state: "{{ nginx_state }}" + notify: "(Handler: All OSs) Start NGINX" diff --git a/ansible/roles/nginxinc.nginx/tasks/opensource/setup-redhat.yml b/ansible/roles/nginxinc.nginx/tasks/opensource/setup-redhat.yml new file mode 100644 index 0000000..45b19b4 --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/opensource/setup-redhat.yml @@ -0,0 +1,31 @@ +--- +- name: "(Install: CentOS/RedHat) Set Default YUM NGINX Repository" + set_fact: + default_repository: >- + https://nginx.org/packages/{{ (nginx_branch == 'mainline') + | ternary('mainline/', '') }}{{ (ansible_distribution == "RedHat") + | ternary('rhel', 'centos') }}/{{ ansible_distribution_major_version }}/$basearch/ + +- name: "(Install: CentOS/RedHat) Set YUM NGINX Repository" + set_fact: + repository: "{{ nginx_repository | default(default_repository) }}" + +- name: "(Install: CentOS/RedHat) Add NGINX Repository" + yum_repository: + name: nginx + baseurl: "{{ repository }}" + description: NGINX Repository + enabled: yes + gpgcheck: yes + +- name: "(Install: CentOS/RedHat) Install Required CentOS/RedHat Dependencies" + yum: + name: openssl + +- name: "(Install: CentOS/RedHat) Install NGINX" + yum: + name: "nginx{{ nginx_version | default('') }}" + state: "{{ nginx_state }}" + disablerepo: "*" + enablerepo: "nginx" + notify: "(Handler: All OSs) Start NGINX" diff --git a/ansible/roles/nginxinc.nginx/tasks/opensource/setup-source.yml b/ansible/roles/nginxinc.nginx/tasks/opensource/setup-source.yml new file mode 100644 index 0000000..f194daf --- /dev/null +++ b/ansible/roles/nginxinc.nginx/tasks/opensource/setup-source.yml @@ -0,0 +1,437 @@ +--- +- name: "(Install: Linux) Check for build tools" + when: nginx_install_source_build_tools + block: + + - name: "(Install: Linux) Install Python - Centos/RHEL" + package: + name: + - python3 + - python3-pip + - python3-devel + state: present + when: ansible_os_family == "RedHat" + + - name: "(Install: Linux) Set Python3 default - Centos/RHEL" + alternatives: + name: python + path: /usr/bin/python3 + link: /usr/bin/python + when: ansible_os_family == "RedHat" and ansible_distribution_major_version == "8" + + - name: "(Install: Linux) Install Build Tools - Centos/RHEL" + package: + name: + - "@Development tools" + - gcc + - glibc + - glibc-common + - gd + - gd-devel + - perl-core + - wget + - ca-certificates + - zlib-devel + state: present + when: ansible_os_family == "RedHat" + + - name: "(Install: Linux) Install backports repo for Buster" + apt_repository: + repo: deb http://ftp.us.debian.org/debian buster-backports main + when: ansible_distribution_release == "buster" + + - name: "(Install: Linux) Install Build Tools - Debian/Ubuntu" + package: + name: + - python-minimal + - build-essential + - perl + - tar + - checkinstall + - zlib1g-dev + - libtemplate-perl + state: present + when: ansible_os_family == "Debian" + + - name: "(Install: Linux) Install Build Tools - Alpine" + package: + name: + - python + - alpine-sdk + - build-base + - git + - wget + - perl + - linux-headers + - tar + - openrc + state: present + when: ansible_os_family == "Alpine" + + - name: "(Install: Linux) Enable openrc - Alpine" + copy: + content: "" + dest: /run/openrc/softlevel + force: no + owner: root + mode: 0644 + when: ansible_os_family == "Alpine" + +- name: "(Install: Linux) Check for Source Installs" + block: + + - name: "(Install: Linux) Check for PCRE Install" + stat: + path: /tmp/{{ pcre_version }} + register: pcre_result + + - name: "(Install: Linux) Check for zlib Install" + stat: + path: /tmp/{{ zlib_version }} + register: zlib_result + + - name: "(Install: Linux) Check for openssl Install" + stat: + path: /tmp/{{ openssl_version }} + register: openssl_result + +- name: "(Install: Linux) Install PCRE Dependency: Package: Centos/RHEL" + when: nginx_install_source_pcre and ansible_os_family == "RedHat" + package: + name: pcre-devel + state: present + +- name: "(Install: Linux) Install PCRE Dependency: Package: Debian/Ubuntu" + when: nginx_install_source_pcre and ansible_os_family == "Debian" + package: + name: libpcre3–dev + state: present + +- name: "(Install: Linux) Install PCRE Dependency: Package: Alpine" + when: nginx_install_source_pcre and ansible_os_family == "Alpine" + package: + name: pcre-dev + state: present + +- name: "(Install: Linux) Install PCRE Dependency: Source" + when: not pcre_result.stat.exists and not nginx_install_source_pcre + block: + + - name: "(Install: Linux) Install PCRE Dependency: Download" + get_url: + url: "http://ftp.pcre.org/pub/pcre/{{ pcre_version }}.tar.gz" + dest: "/tmp/{{ pcre_version }}.tar.gz" + register: pcre_source + + - name: "(Install: Linux) Install PCRE Dependency: Unpack" + unarchive: + copy: no + dest: /tmp/ + src: "{{ pcre_source.dest }}" + register: pcre_source_unpack + + - name: "(Install: Linux) Install PCRE Dependency: Configure" + command: "./configure" + args: + chdir: "/tmp/{{ pcre_version }}" + register: pcre_configure + + - name: "(Install: Linux) Install PCRE Dependency: Install" + make: + chdir: "/tmp/{{ pcre_version }}" + + - name: "(Install: Linux) Install PCRE Dependency: Install" + make: + chdir: "/tmp/{{ pcre_version }}" + target: install + +- name: "(Install: Linux) Install zlib Dependency: Package: Centos/RHEL" + when: nginx_install_source_zlib and ansible_os_family == "RedHat" + package: + name: zlib-devel + state: present + +- name: "(Install: Linux) Install zlib Dependency: Package: Debian/Ubuntu" + when: nginx_install_source_zlib and ansible_os_family == "Debian" + package: + name: zlib1g-dev + state: present + +- name: "(Install: Linux) Install zlib Dependency: Package: Alpine" + when: nginx_install_source_zlib and ansible_os_family == "Alpine" + package: + name: zlib-dev + state: present + +- name: "(Install: Linux) Install zlib Dependency: Source" + when: not zlib_result.stat.exists and not nginx_install_source_zlib + block: + + - name: "(Install: Linux) Install zlib Dependency: Download" + get_url: + url: "http://zlib.net/{{ zlib_version }}.tar.gz" + dest: "/tmp/{{ zlib_version }}.tar.gz" + register: zlib_source + + - name: "(Install: Linux) Install zlib Dependency: Unpack" + unarchive: + copy: no + dest: /tmp/ + src: "{{ zlib_source.dest }}" + register: zlib_source_unpack + + - name: "(Install: Linux) Install zlib Dependency: Configure" + command: "./configure" + args: + chdir: "/tmp/{{ zlib_version }}" + register: zlib_configure + + - name: "(Install: Linux) Install zlib Dependency: Install" + make: + chdir: "/tmp/{{ zlib_version }}" + + - name: "(Install: Linux) Install zlib Dependency: Install" + make: + chdir: "/tmp/{{ zlib_version }}" + target: install + +- name: "(Install: Linux) Install OpenSSL Dependency: Package: Centos/RHEL" + when: nginx_install_source_openssl and ansible_os_family == "RedHat" + package: + name: openssl-devel + state: present + +- name: "(Install: Linux) Install OpenSSL Dependency: Package: Debian/Ubuntu" + when: nginx_install_source_openssl and ansible_os_family == "Debian" + package: + name: libssl-dev + state: present + +- name: "(Install: Linux) Install OpenSSL Dependency: Package: Alpine" + when: nginx_install_source_openssl and ansible_os_family == "Alpine" + package: + name: openssl-dev + state: present + +- name: "(Install: Linux) Install OpenSSL Dependency: Source" + when: not openssl_result.stat.exists and not nginx_install_source_openssl + block: + + - name: "(Install: Linux) Install OpenSSL Dependency: Download" + get_url: + url: "http://www.openssl.org/source/{{ openssl_version }}.tar.gz" + dest: "/tmp/{{ openssl_version }}.tar.gz" + register: openssl_source + + - name: "(Install: Linux) Install OpenSSL Dependency: Unpack" + unarchive: + copy: no + dest: /tmp/ + src: "{{ openssl_source.dest }}" + register: openssl_source_unpack + + - name: "(Install: Linux) Install OpenSSL Dependency: Configure" + command: "./config --prefix=/usr" + args: + chdir: "/tmp/{{ openssl_version }}" + register: openssl_configure + + - name: "(Install: Linux) Install OpenSSL Dependency: Make" + make: + chdir: "/tmp/{{ openssl_version }}" + + - name: "(Install: Linux) Install OpenSSL Dependency: Install" + make: + chdir: "/tmp/{{ openssl_version }}" + target: install + +- name: "(Install: Linux) Install NGINX: Get NGINX version" + block: + + - name: "(Install: Linux) Install NGINX: Get NGINX mainline version" + shell: + args: + cmd: curl --stderr - https://trac.nginx.org/nginx/browser | grep release | head -1 | sed -e 's:.*