Files
@ b3e67fd6c0c1
Branch filter:
Location: majic-ansible-roles/roles/xmpp_server/molecule/default/prepare.yml - annotation
b3e67fd6c0c1
9.3 KiB
text/x-yaml
MAR-187: Reorder the deprecation tasks for xmpp_server role to make the runs reliable:
- Deprecated apt repository really needs to be removed first in case
it has an unresolvable URL (so the backports repository cache update
would trigger correctly).
- Use the file removal for Prosody repository as well to make sure the
file is dropped.
- Deprecated apt repository really needs to be removed first in case
it has an unresolvable URL (so the backports repository cache update
would trigger correctly).
- Use the file removal for Prosody repository as well to make sure the
file is dropped.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 | 701044d4cbba 701044d4cbba 87f4f8572370 87f4f8572370 87f4f8572370 87f4f8572370 87f4f8572370 87f4f8572370 87f4f8572370 87f4f8572370 87f4f8572370 87f4f8572370 87f4f8572370 87f4f8572370 87f4f8572370 87f4f8572370 87f4f8572370 87f4f8572370 87f4f8572370 87f4f8572370 87f4f8572370 87f4f8572370 87f4f8572370 87f4f8572370 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 895e9bd5a83b 895e9bd5a83b 895e9bd5a83b 895e9bd5a83b 895e9bd5a83b 895e9bd5a83b 87f4f8572370 87f4f8572370 87f4f8572370 87f4f8572370 87f4f8572370 87f4f8572370 87f4f8572370 e970d4afbea4 e970d4afbea4 2ada86e90026 e970d4afbea4 e970d4afbea4 e75d5d4fba3b 2ada86e90026 2ada86e90026 e970d4afbea4 701044d4cbba 2ada86e90026 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 2ada86e90026 2ada86e90026 701044d4cbba c92d79571cf9 c92d79571cf9 52c4a4001c46 52c4a4001c46 52c4a4001c46 c92d79571cf9 c92d79571cf9 52c4a4001c46 52c4a4001c46 52c4a4001c46 52c4a4001c46 52c4a4001c46 52c4a4001c46 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 4f29bd1aa05b 4f29bd1aa05b 4f29bd1aa05b 4f29bd1aa05b 895e9bd5a83b 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 449e6423959c 895e9bd5a83b 895e9bd5a83b 341f6d0f5072 341f6d0f5072 341f6d0f5072 341f6d0f5072 341f6d0f5072 341f6d0f5072 341f6d0f5072 341f6d0f5072 341f6d0f5072 341f6d0f5072 341f6d0f5072 341f6d0f5072 895e9bd5a83b 895e9bd5a83b 341f6d0f5072 341f6d0f5072 341f6d0f5072 341f6d0f5072 341f6d0f5072 895e9bd5a83b 895e9bd5a83b 341f6d0f5072 fb34333e4b48 fb34333e4b48 fb34333e4b48 fb34333e4b48 fb34333e4b48 fb34333e4b48 fb34333e4b48 fb34333e4b48 fb34333e4b48 fb34333e4b48 fb34333e4b48 fb34333e4b48 fb34333e4b48 fb34333e4b48 fb34333e4b48 fb34333e4b48 fb34333e4b48 fb34333e4b48 fb34333e4b48 065740010e44 065740010e44 065740010e44 065740010e44 065740010e44 065740010e44 065740010e44 065740010e44 b3e67fd6c0c1 b3e67fd6c0c1 b3e67fd6c0c1 b3e67fd6c0c1 b3e67fd6c0c1 b3e67fd6c0c1 b3e67fd6c0c1 b3e67fd6c0c1 ceb51ff23ae3 2ada86e90026 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 2ada86e90026 701044d4cbba 701044d4cbba 701044d4cbba 87f4f8572370 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 2ada86e90026 701044d4cbba da031f975c67 da031f975c67 da031f975c67 2ada86e90026 da031f975c67 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 895e9bd5a83b 895e9bd5a83b 895e9bd5a83b 895e9bd5a83b 895e9bd5a83b 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 701044d4cbba 2ada86e90026 701044d4cbba 2ada86e90026 2ada86e90026 701044d4cbba c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 895e9bd5a83b 895e9bd5a83b 895e9bd5a83b 895e9bd5a83b 895e9bd5a83b 895e9bd5a83b 895e9bd5a83b 895e9bd5a83b 895e9bd5a83b 895e9bd5a83b 895e9bd5a83b c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 c64473fcd1a8 895e9bd5a83b c64473fcd1a8 895e9bd5a83b 2ada86e90026 da031f975c67 da031f975c67 da031f975c67 da031f975c67 da031f975c67 2ada86e90026 24033bb8b1a5 24033bb8b1a5 24033bb8b1a5 24033bb8b1a5 24033bb8b1a5 24033bb8b1a5 24033bb8b1a5 24033bb8b1a5 | ---
- name: Set-up fixtures
hosts: localhost
connection: local
gather_facts: false
tasks:
- name: Initialise CA hierarchy
command: "gimmecert init"
args:
creates: ".gimmecert/ca/level1.cert.pem"
chdir: "tests/data/"
- name: Generate server private keys and certificates
command:
args:
chdir: "tests/data/"
creates: ".gimmecert/server/{{ item.name }}.cert.pem"
argv: "{{ ['gimmecert', 'server', item.name] + item.fqdn }}"
with_items:
- name: ldap-server_ldap
fqdn:
- ldap-server
- name: parameters-mandatory-buster64_xmpp
fqdn:
- parameters-mandatory
- domain1
- proxy.domain1
- conference.domain1
- name: parameters-optional-buster64_xmpp
fqdn:
- parameters-optional
- domain2
- proxy.domain2
- conference.domain2
- domain3
- proxy.domain3
- conference.domain3
- name: deprecated-buster64_xmpp
fqdn:
- deprecated
- domain4
- proxy.domain4
- conference.domain4
- name: Set-up link to generated X.509 material
file:
src: ".gimmecert"
dest: "tests/data/x509"
state: link
- name: Prepare
hosts: all
gather_facts: false
tasks:
- name: Install python for Ansible
raw: test -e /usr/bin/python3 || (apt -y update && apt install -y python3-minimal)
become: true
changed_when: false
- hosts: all
become: true
tasks:
- name: Update all caches to avoid errors due to missing remote archives
apt:
update_cache: true
changed_when: false
- name: Install tools for testing
apt:
name:
- gnutls-bin
- nmap
state: present
- name: Use name provided via CLI when running STARTTLS handshake for XMPP via nmap
replace:
path: "/usr/share/nmap/nselib/sslcert.lua"
regexp: "host\\.name\\)"
replace: "host.targetname)"
- hosts: buster
become: true
tasks:
- name: Set-up the hosts file
lineinfile:
path: /etc/hosts
regexp: "^{{ item.key }}"
line: "{{ item.key }} {{ item.value }}"
owner: root
group: root
mode: 0644
state: present
with_dict:
192.168.56.10: "ldap-server backup-server"
192.168.56.20: "client-buster"
192.168.56.30: "parameters-mandatory domain1 proxy.domain1 conference.domain1"
192.168.56.31: "parameters-optional domain2 proxy.domain2 conference.domain2 domain3 proxy.domain3 conference.domain3"
192.168.56.32: "deprecated domain4 proxy.domain4 conference.domain4"
- name: Enable TLSv1.0+ in global OpenSSL configuration file in order to be able to test the xmpp_server_tls_protocol parameter
lineinfile:
path: "/etc/ssl/openssl.cnf"
regexp: "^MinProtocol ="
line: "MinProtocol = TLSv1.0"
owner: root
group: root
mode: 0644
state: present
# @WORKAROUND: Prosody repository override
#
# Prosody project has killed off Debian Buster repositories. Trick
# the system to install packages from custom repository location
# instead.
- name: Override server IP for Prosody repository via hosts file
lineinfile:
path: /etc/hosts
regexp:
line: "{{ lookup('dig', 'prosody.repo.majic.rs') }} packages.prosody.im"
owner: root
group: root
mode: 0644
state: present
tags:
- workaround:prosody_repository_override
- name: Add workaround Prosody repository signing key
apt_key:
data: "{{ lookup('file', 'workaround_prosody_repository_signing_key.asc') }}"
state: present
tags:
- workaround:prosody_repository_override
- hosts: deprecated
become: true
tasks:
- name: Add Prosody repository signing key
apt_key:
data: "{{ lookup('file', 'prosody-debian-gpg-key.asc') }}"
state: present
- name: Add Prosody repository
apt_repository:
repo: "deb http://packages.prosody.im/debian {{ ansible_distribution_release }} main"
state: present
- name: Install Prosody (from Prosody repository)
apt:
name: prosody-0.11
state: present
- name: Set-up directory for storing additional Prosody modules
file:
path: "/usr/local/lib/prosody/modules/"
state: directory
owner: root
group: root
mode: 0755
- name: Invalidate the Prosody repository URL for testing if the file gets dropped at correct time during initial converge
copy:
content: "deb http://invalidname/debian buster main"
dest: "/etc/apt/sources.list.d/packages_prosody_im_debian.list"
owner: root
group: root
mode: 0644
- hosts: clients
become: true
tasks:
- name: Install tool for testing TCP connectivity
apt:
name: hping3
state: present
- name: Deploy CA certificate
copy:
src: tests/data/x509/ca/level1.cert.pem
dest: /usr/local/share/ca-certificates/testca.crt
owner: root
group: root
mode: 0644
notify:
- Update CA certificate cache
- name: Install console-based XMPP client (for interactive testing)
apt:
name: mcabber
state: present
- name: Install console-based XMPP tool (for non-interactive testing)
apt:
name: sendxmpp
state: present
- name: Create dedicated group for testing
group:
name: user
state: present
- name: Create dedicated user for testing
user:
name: user
group: user
shell: /bin/bash
- name: Deploy mcabber configuration files
template:
src: tests/data/mcabber.cfg.j2
dest: "~user/{{ item.jid }}.cfg"
owner: user
group: user
mode: 0600
with_items:
- jid: john.doe@domain1
password: johnpassword
server: domain1
security: tls
nickname: john.doe
- jid: jane.doe@domain2
password: janepassword
server: domain2
security: ssl
nickname: jane.doe
- jid: mick.doe@domain3
password: mickpassword
server: domain3
security: tls
nickname: mick.doe
- jid: noxmpp@domain1
password: noxmpppassword
server: domain1
security: tls
nickname: noxmpp
- jid: eve.doe@domain4
password: evepassword
server: domain4
security: tls
nickname: eve.doe
handlers:
- name: Update CA certificate cache
command: /usr/sbin/update-ca-certificates --fresh
- hosts: ldap-server
become: true
roles:
- ldap_server
- backup_server
- hosts: ldap-server
become: true
tasks:
- name: Create LDAP accounts for testing
ldap_entry:
dn: "{{ item.dn }}"
objectClass: "{{ item.objectClass }}"
attributes: "{{ item.attributes }}"
with_items:
- dn: uid=john,ou=people,dc=local
objectClass:
- inetOrgPerson
- simpleSecurityObject
attributes:
userPassword: johnpassword
uid: john
cn: John Doe
sn: Doe
mail: john.doe@domain1
- dn: uid=jane,ou=people,dc=local
objectClass:
- inetOrgPerson
- simpleSecurityObject
attributes:
userPassword: janepassword
uid: jane
cn: Jane Doe
sn: Doe
mail: jane.doe@domain2
- dn: uid=mick,ou=people,dc=local
objectClass:
- inetOrgPerson
- simpleSecurityObject
attributes:
userPassword: mickpassword
uid: mick
cn: Mick Doe
sn: Doe
mail: mick.doe@domain3
- dn: uid=noxmpp,ou=people,dc=local
objectClass:
- inetOrgPerson
- simpleSecurityObject
attributes:
userPassword: noxmpppassword
uid: noxmpp
cn: No XMPP
sn: XMPP
mail: noxmpp@domain1
- dn: uid=eve,ou=people,dc=local
objectClass:
- inetOrgPerson
- simpleSecurityObject
attributes:
userPassword: evepassword
uid: eve
cn: Eve Doe
sn: Doe
mail: eve.doe@domain4
- name: Add test accounts to correct group
ldap_attr:
dn: "cn=xmpp,ou=groups,dc=local"
name: uniqueMember
state: exact
values:
- uid=john,ou=people,dc=local
- uid=jane,ou=people,dc=local
- uid=mick,ou=people,dc=local
- uid=eve,ou=people,dc=local
- hosts: parameters-mandatory,parameters-optional,deprecated
become: true
tasks:
- name: Install console-based XMPP tool (for non-interactive testing)
apt:
name: sendxmpp
state: present
- name: Deploy small Lua script for listing the enabled modules in Prosody
copy:
src: list_prosody_modules.lua
dest: "/usr/local/bin/list_prosody_modules.lua"
owner: root
group: root
mode: 0755
|