radityo
/
ansible-nginx
mirror of https://github.com/HanXHX/ansible-nginx.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Fix deprecations on Ansible 2.7 

- with_ -> loop
- fix filters as test
- test version_compare -> version
- set min_version to 2.5
pull/35/head
Emilien Mantel 2019-01-22 22:08:14 +01:00
parent d168219c29
commit 682339d818
17 changed files with 63 additions and 77 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
.travis.yml
View File

@ -1,17 +1,4 @@
env:
- PLATFORM='docker-debian-jessie' ANSIBLE_VERSION='ansible>=2.2,<2.3'
- PLATFORM='docker-debian-jessie-backports' ANSIBLE_VERSION='ansible>=2.2,<2.3'
- PLATFORM='docker-debian-jessie-dotdeb' ANSIBLE_VERSION='ansible>=2.2,<2.3'
- PLATFORM='docker-debian-jessie' ANSIBLE_VERSION='ansible>=2.3,<2.4'
- PLATFORM='docker-debian-jessie-backports' ANSIBLE_VERSION='ansible>=2.3,<2.4'
- PLATFORM='docker-debian-jessie-dotdeb' ANSIBLE_VERSION='ansible>=2.3,<2.4'
- PLATFORM='docker-debian-stretch' ANSIBLE_VERSION='ansible>=2.3,<2.4'
- PLATFORM='docker-debian-stretch-sury' ANSIBLE_VERSION='ansible>=2.3,<2.4'
- PLATFORM='docker-debian-jessie' ANSIBLE_VERSION='ansible>=2.4,<2.5'
- PLATFORM='docker-debian-jessie-backports' ANSIBLE_VERSION='ansible>=2.4,<2.5'
- PLATFORM='docker-debian-jessie-dotdeb' ANSIBLE_VERSION='ansible>=2.4,<2.5'
- PLATFORM='docker-debian-stretch' ANSIBLE_VERSION='ansible>=2.4,<2.5'
- PLATFORM='docker-debian-stretch-sury' ANSIBLE_VERSION='ansible>=2.4,<2.5'
- PLATFORM='docker-debian-jessie' ANSIBLE_VERSION='ansible>=2.5,<2.6'
- PLATFORM='docker-debian-jessie-backports' ANSIBLE_VERSION='ansible>=2.5,<2.6'
- PLATFORM='docker-debian-jessie-dotdeb' ANSIBLE_VERSION='ansible>=2.5,<2.6'

2
README.md
View File

@ -30,7 +30,7 @@ Supported OS:
Requirements
------------
None. If you set true to `nginx_backports`, you must install backports repository before lauching this role.
Ansible 2.5+. If you set true to `nginx_backports`, you must install backports repository before lauching this role.
Role Variables
--------------

5
meta/main.yml
View File

@ -1,14 +1,15 @@
---
galaxy_info:
author: Emilien Mantel
description: Nginx for Debian
description: Nginx for Debian / FreeBSD
company:
license: GPLv2
min_ansible_version: 2.2
min_ansible_version: 2.5
platforms:
- name: Debian
versions:
- jessie
- stretch
- name: FreeBSD
versions:
- 11.0

7
tasks/config.yml
View File

@ -24,13 +24,14 @@
regexp: '{{ item.0.regexp }}'
line: '{{ item.0.line }}'
dest: '{{ item.1 }}'
with_nested:
-
loop: "{{ list_one | product(list_two) | list }}"
vars:
list_one:
- regexp: '^fastcgi_param SCRIPT_FILENAME'
line: 'fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;'
- regexp: '^fastcgi_param DOCUMENT_ROOT'
line: 'fastcgi_param DOCUMENT_ROOT $realpath_root;'
-
list_two:
- '{{ nginx_etc_dir }}/fastcgi.conf'
when: nginx_fastcgi_fix_realpath

13
tasks/install_Debian.yml
View File

@ -1,13 +1,5 @@
---
- name: FAIL | Check possible issues
fail:
msg: "This ansible version ({{ ansible_version.full}}) is not compatible with your needs (Debian Stretch + htpasswd). Please see https://github.com/HanXHX/ansible-nginx/issues/28"
when:
ansible_distribution_major_version | version_compare('9', 'ge') and
ansible_version.full | version_compare('2.3.2', 'lt') and
nginx_htpasswd | length > 0
- name: APT | Update cache
apt:
update_cache: yes
@ -29,11 +21,10 @@
- name: APT | Install nginx modules
apt:
pkg: "{{ item }}"
pkg: "{{ nginx_module_packages }}"
state: present
with_items: "{{ nginx_module_packages }}"
when:
ansible_distribution_major_version | version_compare('9', 'ge') or
ansible_distribution_major_version is version('9', 'ge') or
nginx_backports
- name: APT | Install python-passlib

4
tasks/site.yml
View File

@ -30,7 +30,7 @@
owner: "{{ item.owner | default(nginx_user) }}"
group: "{{ item.group | default(nginx_user) }}"
mode: "{{ item.mode | default('0755') }}"
with_items: "{{ nginx_sites }}"
loop: "{{ nginx_sites }}"
when: >
item.root is not defined and
(item.template is defined and item.template not in nginx_templates_no_dir) and
@ -43,9 +43,9 @@
template:
src: "etc/nginx/sites-available/{{ item.template if item.redirect_to is not defined else '_redirect' }}.j2"
dest: "{{ nginx_etc_dir }}/sites-available/{{ item | nginx_site_filename }}"
with_items: "{{ nginx_sites }}"
notify: ['reload nginx', 'restart nginx freebsd']
when: item.state is not defined or item.state != 'absent'
loop: "{{ nginx_sites }}"
loop_control:
label: "{{ item | nginx_site_name }}"

2
tasks/upstream.yml
View File

@ -17,7 +17,7 @@
template:
src: "etc/nginx/conf.d/_upstream.conf.j2"
dest: "{{ nginx_etc_dir }}/conf.d/upstream-{{ item.name }}.conf"
with_items: "{{ nginx_upstreams }}"
loop: "{{ nginx_upstreams }}"
when: item.state is not defined or item.state == 'present'
notify: reload nginx

2
templates/etc/nginx/conf.d/_upstream.conf.j2
View File

@ -1,5 +1,5 @@
{%- macro s(key, value, is_bool, min_version) %}
{% if nginx_version.stdout | version_compare(min_version, 'ge') %}
{% if nginx_version.stdout is version(min_version, 'ge') %}
{% if is_bool and value %} {{ key }}{% elif not is_bool %} {{ key }}={{ value }}{% endif %}
{% endif %}
{%- endmacro -%}

4
templates/etc/nginx/helper/ssl-legacy.j2
View File

@ -3,10 +3,10 @@
#
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:ECDHE-RSA-AES128-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA128:DHE-RSA-AES128-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA128:ECDHE-RSA-AES128-SHA384:ECDHE-RSA-AES128-SHA128:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA128:DHE-RSA-AES128-SHA128:DHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA384:AES128-GCM-SHA128:AES128-SHA128:AES128-SHA128:AES128-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
ssl_protocols TLSv1 TLSv1.1 TLSv1.2{% if nginx_version.stdout | version_compare('1.13.0', 'ge') %} TLSv1.3{% endif %};
ssl_protocols TLSv1 TLSv1.1 TLSv1.2{% if nginx_version.stdout is version('1.13.0', 'ge') %} TLSv1.3{% endif %};
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains"{% if nginx_version.stdout | version_compare('1.7.5', 'ge') %} always{% endif %};
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains"{% if nginx_version.stdout is version('1.7.5', 'ge') %} always{% endif %};
ssl_stapling on;
ssl_stapling_verify on;
resolver {{ nginx_resolver_hosts | join(' ') }} valid={{ nginx_resolver_valid }};

4
templates/etc/nginx/helper/ssl-strong.j2
View File

@ -3,10 +3,10 @@
#
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
ssl_protocols TLSv1 TLSv1.1 TLSv1.2{% if nginx_version.stdout | version_compare('1.13.0', 'ge') %} TLSv1.3{% endif %};
ssl_protocols TLSv1 TLSv1.1 TLSv1.2{% if nginx_version.stdout is version('1.13.0', 'ge') %} TLSv1.3{% endif %};
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains"{% if nginx_version.stdout | version_compare('1.7.5', 'ge') %} always{% endif %};
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains"{% if nginx_version.stdout is version('1.7.5', 'ge') %} always{% endif %};
ssl_stapling on;
ssl_stapling_verify on;
resolver {{ nginx_resolver_hosts | join(' ') }} valid={{ nginx_resolver_valid }};

2
templates/etc/nginx/nginx.conf.j2
View File

@ -5,7 +5,7 @@
user {{ nginx_user }};
worker_processes {{ nginx_worker_processes }};
pid {{ nginx_pid }};
{% if nginx_version.stdout | version_compare('1.9.11', 'ge') %}
{% if nginx_version.stdout is version('1.9.11', 'ge') %}
include {{ nginx_etc_dir }}/modules-enabled/*.conf;
{% endif %}

2
templates/etc/nginx/sites-available/_base.j2
View File

@ -83,7 +83,7 @@ server {
{% block template_headers %}
# --> Custom headers
{% for key, value in __headers.iteritems() %}
add_header {{ key }} "{{ value | replace(' always', '') }}"{% if nginx_version.stdout | version_compare('1.7.5', 'ge') and ' always' in value %} always{% endif %};
add_header {{ key }} "{{ value | replace(' always', '') }}"{% if nginx_version.stdout is version('1.7.5', 'ge') and ' always' in value %} always{% endif %};
{% endfor %}
# <-- Custom headers
{% endblock %}

7
tests/includes/post_Debian.yml
View File

@ -2,11 +2,12 @@
- name: APT | Install webapps
apt:
pkg: "{{ item }}"
pkg: "{{ packages }}"
state: present
install_recommends: no
with_items:
- backuppc
vars:
packages:
- backuppc
- name: SERVICE | Ensure backuppc is started
service:

30
tests/includes/pre_Debian.yml
View File

@ -45,19 +45,20 @@
- name: APT | Install needed packages
apt:
pkg: "{{ item }}"
pkg: "{{ packages }}"
update_cache: yes
cache_valid_time: 3600
state: present
with_items:
- cron
- curl
- fcgiwrap
- jq
- nghttp2
- strace
- vim
- unzip
vars:
packages:
- cron
- curl
- fcgiwrap
- jq
- nghttp2
- strace
- vim
- unzip
- name: APT | Install daemonize from Stretch
apt:
@ -69,7 +70,7 @@
update_cache: yes
cache_valid_time: 3600
state: present
with_items: "{{ nginx_php }}"
loop: "{{ nginx_php }}"
register: apt_php
- name: SERVICE | Force start fcgiwrap
@ -77,10 +78,11 @@
name: "fcgiwrap"
state: started
# Bypasses Ansible 2.4 issue (cannot use service module)... With service module... php is not really started!
- name: COMMAND | Force start PHP
command: "service {{ item.version | php_fpm_service }} start"
with_items: "{{ nginx_php }}"
service:
name: "{{ item.version | php_fpm_service }}"
state: started
loop: "{{ nginx_php }}"
when: apt_php.changed
- name: GET_URL | Download ngrok

23
tests/includes/pre_FreeBSD.yml
View File

@ -15,17 +15,18 @@
- name: PKGNG | Install needed packages
pkgng:
pkg: "{{ item }}"
pkg: "{{ packages }}"
state: present
with_items:
- curl
- daemonize
- fcgiwrap
- GeoIP
- jq
- nghttp2
- php72
- vim
vars:
packages:
- curl
- daemonize
- fcgiwrap
- GeoIP
- jq
- nghttp2
- php72
- vim
- name: COMMAND | Get geoip database
command: geoipupdate.sh
@ -38,7 +39,7 @@
state: started
enabled: yes
register: sf
with_items:
loop:
- php-fpm
- fcgiwrap

4
tests/includes/pre_common.yml
View File

@ -14,6 +14,8 @@
- name: SHELL | Get ngrok public address
shell: curl 'http://127.0.0.1:4040/api/tunnels/command_line' | jq '.public_url' | grep -oE '[[:alnum:]]+\.ngrok\.io'
args:
warn: false
register: ngrok
changed_when: false
@ -22,6 +24,6 @@
line: "set mouse="
dest: "{{ item }}/.vimrc"
create: yes
with_items:
loop:
- /root
- /home/vagrant

16
tests/test.yml
View File

@ -276,7 +276,7 @@
copy:
dest: "{{ nginx_root }}/{{ item }}/public/index.php"
content: "<?php phpinfo();"
with_items:
loop:
- 'test-php.local'
- 'test-php-index.local'
- 'test-php-index2.local'
@ -285,7 +285,7 @@
copy:
dest: "{{ item }}/index.html"
content: "Index HTML test OK\n"
with_items:
loop:
- '{{ nginx_root }}/first-test/public'
- '/var/tmp'
- '{{ nginx_root }}/test-htpasswd-all.local/public'
@ -319,7 +319,7 @@
url: "http://{{ item | nginx_site_name }}{% if item.listen is defined %}:{{ item.listen[0] }}{% endif %}/"
status_code: '200,301,302,401,403'
follow_redirects: none
with_items: "{{ nginx_sites }}"
loop: "{{ nginx_sites }}"
when: item.state is undefined or item.state != "absent"
changed_when: false
@ -333,7 +333,7 @@
url: "http://{{ item.redirect_from[0] }}/"
status_code: 301
follow_redirects: none
with_items: "{{ nginx_sites }}"
loop: "{{ nginx_sites }}"
when: item.redirect_from is defined and (item.state is undefined or item.state != "absent") and (item.proto is not defined or 'https' not in item.proto)
changed_when: false
@ -343,7 +343,7 @@
status_code: 301
follow_redirects: none
validate_certs: no
with_items: "{{ nginx_sites }}"
loop: "{{ nginx_sites }}"
when: item.redirect_from is defined and (item.state is undefined or item.state != "absent") and item.proto is defined and 'https' in item.proto
changed_when: false
@ -355,7 +355,7 @@
url: "http://{{ item.name}}/"
return_content: yes
register: p
with_items: "{{ nginx_sites }}"
loop: "{{ nginx_sites }}"
when: >
item.template is defined and
(item.template == '_php' or item.template == '_php_index' or item.template == '_php_index2')
@ -430,7 +430,7 @@
validate_certs: no
register: sslok
failed_when: sslok.content.find('Index HTML test OK') == -1
with_items:
loop:
- 'test-ssl-predeployed.local'
- 'test-ssl-selfsigned.local'
- 'test-ssl.local'
@ -445,7 +445,7 @@
follow_redirects: none
register: sslredirok
failed_when: '"https://%s%s" % (item.name, ":" + item.port if item.port is defined else "") not in sslredirok.location'
with_items:
loop:
- name: 'test-ssl-redirect.local'
- name: 'test-ssl-redirect-many.local'
port: '8443'