Prevent crash on Docker+Buster

- fix acme.sh home directory
- Clean crash when acme.sh fails (EXPERIMENTAL)

.travis.yml

@@ -1,8 +1,10 @@
 env:
   - PLATFORM='docker-debian-stretch'          ANSIBLE_VERSION='ansible>=2.6,<2.7'
   - PLATFORM='docker-debian-stretch-sury'     ANSIBLE_VERSION='ansible>=2.6,<2.7'
+  - PLATFORM='docker-debian-buster'           ANSIBLE_VERSION='ansible>=2.6,<2.7'
   - PLATFORM='docker-debian-stretch'          ANSIBLE_VERSION='ansible>=2.7,<2.8'
   - PLATFORM='docker-debian-stretch-sury'     ANSIBLE_VERSION='ansible>=2.7,<2.8'
+  - PLATFORM='docker-debian-buster'           ANSIBLE_VERSION='ansible>=2.7,<2.8'
 
 
 matrix:
@@ -13,6 +15,7 @@ sudo: required
 dist: trusty
 
 language: python
+python: 2.7
 
 services:
   - docker

README.md

@@ -24,6 +24,7 @@ Supported OS:
 | ------------------ | ------- | ----------------------- |
 | Debian Jessie (8)  | Yes     | Check latest supported version ([1.5.0](https://github.com/HanXHX/ansible-nginx/releases/tag/1.5.0)) |
 | Debian Stretch (9) | Yes     | Yes                     |
+| Debian Buster (10) | Yes     | No                      |
 | FreeBSD 11         | Yes     | No                      |
 | FreeBSD 12         | Yes     | No                      |
 

Vagrantfile

@@ -7,7 +7,8 @@ Vagrant.configure("2") do |config|
 
   vms_debian = [
     { :name => "debian-stretch", :box => "debian/stretch64", :vars => { "nginx_php": [{"version": "7.0"}] }},
-    { :name => "debian-stretch-sury", :box => "debian/stretch64", :vars => { "nginx_php": [{"version": "7.1"}], "sury": true }}
+    { :name => "debian-stretch-sury", :box => "debian/stretch64", :vars => { "nginx_php": [{"version": "7.1"}], "sury": true }},
+    { :name => "debian-buster", :box => "debian/buster64", :vars => { "nginx_php": [{"version": "7.3"}] }}
   ]
 
   vms_freebsd = [
@@ -17,7 +18,8 @@ Vagrant.configure("2") do |config|
 
   conts = [
     { :name => "docker-debian-stretch", :docker => "hanxhx/vagrant-ansible:debian9", :vars => { "nginx_php": [{"version": "7.0"}] }},
-    { :name => "docker-debian-stretch-sury", :docker => "hanxhx/vagrant-ansible:debian9", :vars => { "nginx_php": [{"version": "7.1"}], "sury": true }}
+    { :name => "docker-debian-stretch-sury", :docker => "hanxhx/vagrant-ansible:debian9", :vars => { "nginx_php": [{"version": "7.1"}], "sury": true }},
+    { :name => "docker-debian-buster", :docker => "hanxhx/vagrant-ansible:debian10", :vars => { "nginx_php": [{"version": "7.3"}] }},
   ]
 
   config.vm.network "private_network", type: "dhcp"
@@ -34,7 +36,7 @@ Vagrant.configure("2") do |config|
         ansible.playbook = "tests/test.yml"
         ansible.verbose = 'vv'
         ansible.become = true
-        ansible.extra_vars = opts[:vars].merge({ "nginx_debug_role": true })
+        ansible.extra_vars = opts[:vars].merge({ "nginx_debug_role": true, is_docker: true })
       end
     end
   end

doc/auth.md

@@ -1,11 +1,6 @@
 Auth Basic management
 =====================
 
-IMPORTANT
----------
-
-If you use this feature with Debian Stretch, you *MUST* use ansible >= 2.3.2! See: [https://github.com/HanXHX/ansible-nginx/issues/28](#28).
-
 Description
 -----------
 

meta/main.yml

@@ -9,6 +9,7 @@ galaxy_info:
   - name: Debian
     versions:
     - stretch
+    - buster
   - name: FreeBSD
     versions:
     - 11.0

tasks/install_Debian.yml

@@ -1,5 +1,10 @@
 ---
 
+- name: SET_FACT | Bypass https://github.com/ansible/ansible/issues/19874
+  set_fact:
+    ansible_distribution_release: 'buster'
+  when: ansible_facts.distribution_major_version == "buster/sid"
+
 - name: APT | Update cache
   apt:
     update_cache: yes
@@ -47,7 +52,7 @@
       update: no
 
   - name: SHELL | Install acme.sh
-    shell: ./acme.sh --install --home {{ nginx_acmesh_dir }} --cert-home {{ nginx_acmesh_dir }}
+    shell: ./acme.sh --install --home "{{ nginx_acmesh_dir }}"
     args:
       chdir: "{{ nginx_acmesh_git_dir }}"
       creates: "{{ nginx_acmesh_dir }}"

tasks/ssl/acme.yml

@@ -17,6 +17,9 @@
   loop: "{{ acme_installed_certs.results }}"
   when: item.skipped is not defined and not item.stat.exists
 
+- name: BLOCK | Start acme
+  block:
+
   - name: TEMPLATE | Create fake site
     template:
       src: "etc/nginx/conf.d/FAKESITE.conf.j2"
@@ -44,9 +47,9 @@
     when: fake_site.changed and ansible_virtualization_type == 'docker'
 
   - name: SHELL | Get certificates
-  shell: '{{ nginx_acmesh_bin }} --issue{% if item.name is string %} -d {{ item.name }}{% else %}{% for name in item.name %} -d {{ name }}{% endfor %}{% endif %} --nginx {% if nginx_acmesh_test %}--test{% endif %}'
+    shell: '{{ nginx_acmesh_bin }} --home {{ nginx_acmesh_dir }} --issue{% if item.name is string %} -d {{ item.name }}{% else %}{% for name in item.name %} -d {{ name }}{% endfor %}{% endif %} --nginx {% if nginx_acmesh_test %}--test{% endif %}'
     args:
-    creates: "/root/.acme.sh/{{ item | nginx_site_name }}/{{ item | nginx_site_name }}.key"
+      creates: "{{ nginx_acmesh_dir }}/{{ item | nginx_site_name }}/{{ item | nginx_site_name }}.key"
     loop: "{{ acme_create }}"
     register: acme_get
     failed_when: acme_get.rc != 0 and acme_get.rc != 2
@@ -58,15 +61,33 @@
     loop: "{{ acme_create }}"
 
   - name: SHELL | Install certificates
-  shell: '{{ nginx_acmesh_bin }} --install-cert -d {{ item | nginx_site_name }} --fullchain-file {{ nginx_ssl_dir }}/{{ item | nginx_site_name }}/{{ item | nginx_site_name }}.crt --key-file {{ nginx_ssl_dir }}/{{ item | nginx_site_name }}/{{ item | nginx_site_name }}.key --reloadcmd "service nginx restart"'
+    shell: '{{ nginx_acmesh_bin }} --home {{ nginx_acmesh_dir }} --install-cert -d {{ item | nginx_site_name }} --fullchain-file {{ nginx_ssl_dir }}/{{ item | nginx_site_name }}/{{ item | nginx_site_name }}.crt --key-file {{ nginx_ssl_dir }}/{{ item | nginx_site_name }}/{{ item | nginx_site_name }}.key --reloadcmd "service nginx restart"'
     args:
       creates: "{{ nginx_ssl_dir }}/{{ item | nginx_site_name }}/{{ item | nginx_site_name }}.key"
     loop: "{{ nginx_ssl_pairs }}"
     when: item.acme is defined and item.acme
     notify: restart nginx
 
+  rescue:
+
+  - name: FILE | Delete acme.sh files
+    file:
+      path: "{{ nginx_acmesh_dir }}/{{ item | nginx_site_name }}/"
+      state: absent
+    loop: "{{ nginx_ssl_pairs }}"
+
+  - name: FAIL | Explicit
+    fail:
+      msg: "Something is bad... Auto crash!"
+
+  always:
+
   - name: FILE | Delete fake sites
     file:
       path: "{{ nginx_etc_dir }}/conf.d/FAKESITE_{{ item | nginx_site_name }}.conf"
       state: absent
     loop: "{{ acme_create }}"
+    notify: restart nginx
+
+  - name: META | Flush handlers
+    meta: flush_handlers

templates/etc/nginx/sites-available/_base.j2

@@ -10,6 +10,9 @@
 {% set __ssl_name = item.ssl_name | default(item.name if item.name is string else item.name[0]) %}
 {% set __location_order = item.location_order | default(__location.keys()) %}
 {% set __location_order_before = item.location_order_before | default(__location_before.keys()) %}
+{% macro server_name(name) %}
+{% if name is string %}{{ name }}{% else %}{{ name | join(" ") }}{% endif %}
+{% endmacro %}
 {% macro locations(list, order) %}
 {% if order | length > 0 %}
 	# --> Custom locations
@@ -47,7 +50,7 @@ server {
 {% for port in __listen %}
 	listen {{ port }}{% if port | int in __http_proxy_protocol_port %} proxy_protocol{% endif %};
 {% endfor %}
-	server_name {{ name }};
+	server_name {{ server_name(name) }};
 	location / {
 		return 301 https://{{ name }}{% if '443' not in __listen_ssl and 443 not in __listen_ssl %}:{{ __listen_ssl[0] }}{% endif %}$request_uri;
 	}
@@ -76,7 +79,7 @@ server {
 	include {{ nginx_helper_dir + '/ssl-' + item.ssl_template | default('strong') }};
 {% endif %}
 {% endif %}
-	server_name {% if item.name is string %}{{ item.name }}{% else %}{{ "\n\t\t"  }}{{ item.name | join("\n\t\t") }}{% endif %};
+	server_name {{ server_name(item.name) }};
 {% block root %}
 {% if item.root is defined %}
 	root {{ item.root }};
@@ -181,7 +184,7 @@ server {
 {% for port in __listen %}
 	listen {{ port }}{% if port | int in __http_proxy_protocol_port %} proxy_protocol{% endif %};
 {% endfor %}
-	server_name {% if item.redirect_from is string %}{{ item.redirect_from }}{% else %}{{ "\n\t\t" }}{{ item.redirect_from | join("\n\t\t") }}{% endif %};
+	server_name {{ server_name(item.redirect_from) }};
 	location / {
 		return 301 $scheme://{{ item.name if item.name is string else item.name[0] }}$request_uri;
 	}
@@ -196,7 +199,7 @@ server {
 {% if item.ssl_template is not defined or item.ssl_template != false %}
 	include {{ nginx_helper_dir + '/ssl-' + item.ssl_template | default('strong') }};
 {% endif %}
-	server_name {% if item.redirect_from is string %}{{ item.redirect_from }}{% else %}{{ "\n\t\t" }}{{ item.redirect_from | join("\n\t\t") }}{% endif %};
+	server_name {{ server_name(item.redirect_from) }};
 	location / {
 		return 301 https://{{ item.name if item.name is string else item.name[0] }}{% if '443' not in __listen_ssl and 443 not in __listen_ssl %}:{{ __listen_ssl[0] }}{% endif %}$request_uri;
 	}

tests/includes/post_Debian.yml

@@ -1,6 +1,6 @@
 ---
 
-- name: APT | Install webapps
+- name: APT | Install webapps and related tools
   apt:
     pkg: "{{ packages }}"
     state: present
@@ -8,8 +8,12 @@
   vars:
     packages:
       - backuppc
+      - samba-common-bin
+      - smbclient
 
 - name: SERVICE | Ensure backuppc is started
   service:
     name: backuppc
     state: started
+  register: b
+  failed_when: b.failed and 'Another BackupPC is running' not in b.msg