Fix lints warnings (#40)

* Add new filter plugins related to SSL
* Ignore lint on few tasks
py3
Emilien M 2019-04-26 13:29:06 +02:00 committed by GitHub
parent 247f849b86
commit 39d3f5f06a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
9 changed files with 79 additions and 31 deletions

View File

@ -10,11 +10,29 @@ def nginx_site_name(site):
else: else:
return site['name'] return site['name']
def nginx_ssl_dir(pair, ssl_dir):
return ssl_dir + '/' + nginx_site_filename(pair)
def nginx_key_path(pair, ssl_dir):
if pair.has_key('dest_key'):
return pair['dest_key']
else:
return nginx_ssl_dir(pair, ssl_dir) + '/' + nginx_site_filename(pair) + '.key'
def nginx_cert_path(pair, ssl_dir):
if pair.has_key('dest_cert'):
return pair['dest_cert']
else:
return nginx_ssl_dir(pair, ssl_dir) + '/' + nginx_site_filename(pair) + '.crt'
class FilterModule(object): class FilterModule(object):
''' Nginx module ''' ''' Nginx module '''
def filters(self): def filters(self):
return { return {
'nginx_site_filename': nginx_site_filename, 'nginx_site_filename': nginx_site_filename,
'nginx_site_name': nginx_site_name 'nginx_site_name': nginx_site_name,
'nginx_ssl_dir': nginx_ssl_dir,
'nginx_key_path': nginx_key_path,
'nginx_cert_path': nginx_cert_path
} }

View File

@ -26,4 +26,3 @@ galaxy_info:
- nginx - nginx
- cdn - cdn
dependencies: [] dependencies: []

View File

@ -11,17 +11,9 @@
cache_valid_time: 3600 cache_valid_time: 3600
changed_when: false changed_when: false
- name: APT | Force OpenSSL from backports (fix dependency break)
apt:
pkg: openssl
state: latest
default_release: "{{ ansible_distribution_release + '-backports' }}"
when: nginx_backports
- name: APT | Install nginx and dependencies - name: APT | Install nginx and dependencies
apt: apt:
pkg: "{{ nginx_apt_package }}" pkg: "{{ nginx_apt_package }}"
state: present
default_release: "{{ ansible_distribution_release + '-backports' if nginx_backports else ansible_distribution_release }}" default_release: "{{ ansible_distribution_release + '-backports' if nginx_backports else ansible_distribution_release }}"
- name: APT | Install nginx modules - name: APT | Install nginx modules
@ -50,9 +42,10 @@
repo: 'https://github.com/Neilpang/acme.sh.git' repo: 'https://github.com/Neilpang/acme.sh.git'
dest: '{{ nginx_acmesh_git_dir }}' dest: '{{ nginx_acmesh_git_dir }}'
update: no update: no
version: master
- name: SHELL | Install acme.sh - name: COMMAND | Install acme.sh
shell: ./acme.sh --install --home "{{ nginx_acmesh_dir }}" command: ./acme.sh --install --home "{{ nginx_acmesh_dir }}"
args: args:
chdir: "{{ nginx_acmesh_git_dir }}" chdir: "{{ nginx_acmesh_git_dir }}"
creates: "{{ nginx_acmesh_dir }}" creates: "{{ nginx_acmesh_dir }}"

View File

@ -7,14 +7,24 @@
register: nginx_version register: nginx_version
changed_when: false changed_when: false
check_mode: no check_mode: no
tags:
- skip_ansible_lint
- name: SHELL | Get module list - name: SHELL | Get module list
shell: nginx -V 2>&1 | tr -- - '\n' | grep -A 1 with | grep _module | sed -r 's/_module//g; s/\s+//g' | sort shell: |
nginx -V 2>&1 |
tr -- - '\n' |
grep -A 1 with |
grep _module |
sed -r 's/_module//g; s/\s+//g' |
sort
args: args:
executable: /bin/sh executable: /bin/sh
register: shell_modules register: shell_modules
changed_when: false changed_when: false
check_mode: no check_mode: no
tags:
- skip_ansible_lint
- name: SET_FACT | Save modules - name: SET_FACT | Save modules
set_fact: set_fact:

View File

@ -75,7 +75,7 @@
- name: FILE | Disable sites - name: FILE | Disable sites
file: file:
path: "{{ nginx_etc_dir}}/sites-enabled/{{ item | nginx_site_filename }}" path: "{{ nginx_etc_dir }}/sites-enabled/{{ item | nginx_site_filename }}"
state: absent state: absent
loop: "{{ nginx_sites }}" loop: "{{ nginx_sites }}"
notify: ['reload nginx', 'restart nginx freebsd'] notify: ['reload nginx', 'restart nginx freebsd']

View File

@ -46,8 +46,13 @@
warn: false warn: false
when: fake_site.changed and ansible_virtualization_type == 'docker' when: fake_site.changed and ansible_virtualization_type == 'docker'
- name: SHELL | Get certificates - name: COMMAND | Get certificates
shell: '{{ nginx_acmesh_bin }} --home {{ nginx_acmesh_dir }} --issue{% if item.name is string %} -d {{ item.name }}{% else %}{% for name in item.name %} -d {{ name }}{% endfor %}{% endif %} --nginx {% if nginx_acmesh_test %}--test{% endif %}' command: |
{{ nginx_acmesh_bin }}
--home {{ nginx_acmesh_dir }}
--issue{% if item.name is string %} -d {{ item.name }}{% else %}{% for name in item.name %} -d {{ name }}{% endfor %}{% endif %}
--nginx
{% if nginx_acmesh_test %}--test{% endif %}
args: args:
creates: "{{ nginx_acmesh_dir }}/{{ item | nginx_site_name }}/{{ item | nginx_site_name }}.key" creates: "{{ nginx_acmesh_dir }}/{{ item | nginx_site_name }}/{{ item | nginx_site_name }}.key"
loop: "{{ acme_create }}" loop: "{{ acme_create }}"
@ -60,8 +65,14 @@
path: "{{ nginx_ssl_dir }}/{{ item | nginx_site_name }}" path: "{{ nginx_ssl_dir }}/{{ item | nginx_site_name }}"
loop: "{{ acme_create }}" loop: "{{ acme_create }}"
- name: SHELL | Install certificates - name: COMMAND | Install certificates
shell: '{{ nginx_acmesh_bin }} --home {{ nginx_acmesh_dir }} --install-cert -d {{ item | nginx_site_name }} --fullchain-file {{ nginx_ssl_dir }}/{{ item | nginx_site_name }}/{{ item | nginx_site_name }}.crt --key-file {{ nginx_ssl_dir }}/{{ item | nginx_site_name }}/{{ item | nginx_site_name }}.key --reloadcmd "service nginx restart"' command: |
{{ nginx_acmesh_bin }}
--home {{ nginx_acmesh_dir }}
--install-cert -d {{ item | nginx_site_name }}
--fullchain-file {{ nginx_ssl_dir }}/{{ item | nginx_site_name }}/{{ item | nginx_site_name }}.crt
--key-file {{ nginx_ssl_dir }}/{{ item | nginx_site_name }}/{{ item | nginx_site_name }}.key
--reloadcmd "service nginx restart"
args: args:
creates: "{{ nginx_ssl_dir }}/{{ item | nginx_site_name }}/{{ item | nginx_site_name }}.key" creates: "{{ nginx_ssl_dir }}/{{ item | nginx_site_name }}/{{ item | nginx_site_name }}.key"
loop: "{{ nginx_ssl_pairs }}" loop: "{{ nginx_ssl_pairs }}"

View File

@ -30,7 +30,7 @@
- name: FILE | Create SSL directories - name: FILE | Create SSL directories
file: file:
path: "{{ nginx_ssl_dir + '/' + item | nginx_site_name }}" path: "{{ item | nginx_ssl_dir(nginx_ssl_dir) }}"
state: directory state: directory
loop: "{{ nginx_ssl_pairs }}" loop: "{{ nginx_ssl_pairs }}"
when: item.dest_key is not defined or item.dest_cert is not defined when: item.dest_key is not defined or item.dest_cert is not defined
@ -39,7 +39,7 @@
- name: COPY | Deploy SSL keys - name: COPY | Deploy SSL keys
copy: copy:
content: "{{ item.key }}" content: "{{ item.key }}"
dest: "{{ nginx_ssl_dir + '/' + item | nginx_site_name + '/' + item | nginx_site_name + '.key' if item.dest_key is not defined else item.dest_key }}" dest: "{{ item | nginx_key_path(nginx_ssl_dir) }}"
mode: 0640 mode: 0640
loop: "{{ nginx_ssl_pairs }}" loop: "{{ nginx_ssl_pairs }}"
when: item.key is defined when: item.key is defined
@ -49,7 +49,7 @@
- name: COPY | Deploy SSL certs - name: COPY | Deploy SSL certs
copy: copy:
content: "{{ item.cert }}" content: "{{ item.cert }}"
dest: "{{ nginx_ssl_dir + '/' + item | nginx_site_name + '/' + item | nginx_site_name + '.crt' if item.dest_cert is not defined else item.dest_cert }}" dest: "{{ item | nginx_cert_path(nginx_ssl_dir) }}"
mode: 0644 mode: 0644
loop: "{{ nginx_ssl_pairs }}" loop: "{{ nginx_ssl_pairs }}"
when: item.cert is defined when: item.cert is defined
@ -57,10 +57,15 @@
no_log: not nginx_debug_role no_log: not nginx_debug_role
- name: COMMAND | Create self-signed certificates - name: COMMAND | Create self-signed certificates
command: "openssl req -new -newkey rsa:2048 -sha256 -days 3650 -nodes -x509 -subj '/CN={{ item | nginx_site_name }}' -keyout {{ item | nginx_site_name + '.key' }} -out {{ item | nginx_site_name + '.crt' }}" command: |
openssl req
-new -newkey rsa:2048 -sha256 -days 3650 -nodes -x509
-subj '/CN={{ item | nginx_site_name }}'
-keyout {{ item | nginx_key_path(nginx_ssl_dir) }}
-out {{ item | nginx_cert_path(nginx_ssl_dir) }}
args: args:
chdir: "{{ nginx_ssl_dir + '/' + item | nginx_site_name }}" chdir: "{{ item | nginx_ssl_dir(nginx_ssl_dir) }}"
creates: "{% if item.force is defined and item.force %}/tmp/dummy{% else %}{{ nginx_ssl_dir + '/' + item | nginx_site_name + '/' + item | nginx_site_name + '.crt' }}{% endif %}" creates: "{{ '/tmp/dummy' if item.force is defined and item.force else item | nginx_cert_path(nginx_ssl_dir) }}"
loop: "{{ nginx_ssl_pairs }}" loop: "{{ nginx_ssl_pairs }}"
when: item.self_signed is defined when: item.self_signed is defined
notify: restart nginx notify: restart nginx

View File

@ -41,8 +41,8 @@
{%- endmacro %} {%- endmacro %}
{% macro ssl(ssl_name) %} {% macro ssl(ssl_name) %}
{% for sn in nginx_ssl_pairs if ((sn.name is string and sn.name == ssl_name) or (sn.name.0 == ssl_name)) %} {% for sn in nginx_ssl_pairs if ((sn.name is string and sn.name == ssl_name) or (sn.name.0 == ssl_name)) %}
ssl_certificate {{ nginx_ssl_dir + '/' + ssl_name + '/' + ssl_name + '.crt' if sn.dest_cert is not defined else sn.dest_cert }}; ssl_certificate {{ sn | nginx_cert_path(nginx_ssl_dir) }};
ssl_certificate_key {{ nginx_ssl_dir + '/' + ssl_name + '/' + ssl_name + '.key' if sn.dest_key is not defined else sn.dest_key }}; ssl_certificate_key {{ sn | nginx_key_path(nginx_ssl_dir) }};
{% endfor %} {% endfor %}
{%- endmacro %} {%- endmacro %}
{% macro httpsredirect(name) %} {% macro httpsredirect(name) %}

View File

@ -23,10 +23,20 @@
src: "file/test.key" src: "file/test.key"
dest: "{{ int_ansible_ssl_dir }}/test.key" dest: "{{ int_ansible_ssl_dir }}/test.key"
- name: LINEINFILE | Add all hosts in /etc/hosts - name: COPY | Add all hosts in /etc/hosts
lineinfile: copy:
line: "127.0.0.1\tlocalhost {% for s in nginx_sites %}{% if s.name is string %}{{ s.name }}{% else %}{% for n in s.name %}{{ n }} {% endfor %}{% endif %} {% if s.redirect_from is defined %}{% for rf in s.redirect_from %}{{ rf }} {% endfor %}{% endif %}{% endfor %}" content: |
regexp: '^127\.0\.0\.1' 127.0.0.1 localhost
{% for s in nginx_sites %}
{% if s.name is string %}
127.0.0.1 {{ s.name }}
{% else %}
127.0.0.1 {% for n in s.name %}{{ n }} {% endfor %}
{% endif %}
{% if s.redirect_from is defined %}
127.0.0.1 {% for rf in s.redirect_from %}{{ rf }} {% endfor %}
{% endif %}
{% endfor %}
dest: "/etc/hosts" dest: "/etc/hosts"
unsafe_writes: yes unsafe_writes: yes
@ -355,7 +365,7 @@
# -------------------------------- # --------------------------------
- name: -- VERIFY PHP SITES -- - name: -- VERIFY PHP SITES --
uri: uri:
url: "http://{{ item.name}}/" url: "http://{{ item.name }}/"
return_content: yes return_content: yes
register: p register: p
loop: "{{ nginx_sites }}" loop: "{{ nginx_sites }}"
@ -510,3 +520,5 @@
executable: /bin/sh executable: /bin/sh
changed_when: false changed_when: false
when: nginx_auto_config_httpv2 and 'http_v2' in nginx_modules when: nginx_auto_config_httpv2 and 'http_v2' in nginx_modules
tags:
- skip_ansible_lint