majic-ansible-roles Changelog /docs/rolereference.rst

Changelog - /docs/rolereference.rst @ 6b87dd13b24c - showing 100 out of 311 revisions

branko	6b87dd13b24c	9 years ago	MAR-96: Synchronised introduction in index.rst and about.rst. Added information about distribution compatibility, along with mention in introductory text.Switched to classic theme for documentation to get rid of documentation build warnings. Updated backup_client role so it can work with both Debian 8 and Debian 9. Changes between distro versions include: calling correct GnuPG binary, using correct GnuPG key ID format, installation additional dependencies, using correct Duply settings. Fixed _major_ bug related to additional backup keys (essentially, this never worked correctly due to wrong registered value being used when populating the Duply keyring).
branko	4b964a31bd96	9 years ago	MAR-95: Separated configuration for backing-up the /root and /home directories in the common role. This should allow user to have better fine-grained control over what gets backed-up in the home directory. Updated role reference documentation. Updated the testsite variable configuration so the new setting can be tested.
branko	6bc64e4e9c35	9 years ago	MAR-90: Added configuration options for the web_server role for specyfing TLS versions and ciphers to support on the server.
branko	f344ed6181a9	9 years ago	MAR-90: Fixed small typo in documentation for ldap_server role. Added configuration parameters for the mail_server role for specifying TLS protocols and ciphers.
branko	430eb250e244	9 years ago	MAR-90: Added option to ldap_server role for specifying TLS version/ciphers. Updated role reference documentation. Update usage instructions to mention the TLS ciphers/versions are configurable.
branko	111e954e826d	9 years ago	MAR-89: Implemented mail_server role parameter for specifying maximum number of IMAP connections a single user can have from single IP address.
branko	f454072704fa	9 years ago	MAR-88: Include /etc/shadow, /var/mail, and /var/spool/cron/ in back-ups of common role.
branko	67dd87d59abb	9 years ago	MAR-83: Added support to wsgi_website role for specifying headers that should be passed on to Gunicorn by Nginx. Updated hello.wsgi app to demonstrate the feature.
branko	4ca98a158269	9 years ago	MAR-70: Implemented support for having environment indicator on all HTML pages in wsgi_website and php_website roles.
branko	4a3c8915f967	9 years ago	MAR-80: Added support to wsgi_website and php_website roles to specify list of e-mails or accounts that should receive mails delivered to role's administrator/application users. Updated application users in both roles to use same home directory as the admin. Added .keep file for docs/_static in order to avoid warnings when building documentation.
branko	3bd270c9e860	9 years ago	MAR-78: Implement ability to specify local mail aliases in the mail_server role.
branko	13fd27e4004c	9 years ago	MAR-79: Update mail_forwarder role to allow incoming connections to SMTP port from SMTP relay (if configured). Don't verify SMTP TLS server certificate if delivering mails directly.
branko	7c58a0eb0e5a	9 years ago	MAR-77: Updated mail_server role to deliver undeliverable bounces to postmaster.
branko	4dc3b09894e9	9 years ago	MAR-69: Introduced configuration option to php_website for providing additional PHP FPM settings. Updated testsite phpinfo role to use it. Updated usage and role reference documentation.
branko	b757d690af42	9 years ago	MAR-75: Implemented support for specifying additional environment variables for the wsgi_website role. Environment is set-up for both the systemd service and for application admin user. Updated testsite implementation to use it for sample WSGI website.
branko	3352797ee517	9 years ago	MAR-68: When enforcing TLS in web_server, wsgi_website, or php_website roles, send connecting clients proper HSTS policy via Strict-Transport-Security header.
branko	e15b53d59517	9 years ago	MAR-67: Deploy /etc/profile.d/ configuration file that allows reading user-specific profile config files from ~/.profile.d/ directory. Create home directory for web application users in order to get all the fancy colouring etc. Deploy virtual environment activation script inside of wsgi_website role as profile.d script.
branko	a40cf7a468ea	9 years ago	MAR-66: Create web application users with GECOS field that sets their umask to 0007 (this happens thanks to pam_umask).
branko	a717a6ccd782	9 years ago	MAR-65: Disable Emacs electric-indent-mode by default via common role (if Emacs is installed via common_packages).
branko	152b18777513	9 years ago	MAR-62: Removed TLS hardening from xmpp_server role in order to avoid incompatibilities during s2s communication.
branko	32f61f233098	9 years ago	Noticket: Fixed documentation and examples for CA certificate deployment in common role. Fixed usage instructions, mainly some syntax changes and more explicit listing of parameters and such. Fixed path to truststore file for mail_forwarder role. Fixed testsite configurtion for CA certificates.
branko	3af07319e2f3	9 years ago	MAR-59: Removed ability to specify admin user for php_website and wsgi_website roles. Updated testsite and usage instructions. Updated role reference.
branko	f4e9cd36dad4	9 years ago	MAR-57: Implemented customisation of bash shell prompt as part of the common role.
branko	b2cbf5050e57	9 years ago	MAR-56: Separated backup pattern assembly into a separate role in order to reduce number of tasks that run during each run, and to make the whole thing more consistent/modular. Updated usage and reference documentation.
branko	5a15eda01800	9 years ago	MAR-56: Wait for freshclam to download the initial ClamAV database in mail_server role. Make it possible to specify Gunicorn version in the wsgi_website role (and also install the required futures package now). Clarify the parameter for wsgi_application in wsgi_website role should be relative to code sub-directory. Simplify how roles are specified as deps in order to avoid reruns of shared roles in Ansible 1.9.x (for the non-parametrised/singleton roles, that is). Set correct prompt for virtual environments created in wsgi_website.
branko	1b05bae8e440	9 years ago	MAR-56: Added LDIF templates to docs for relevant roles. Added warning about freshclam/clamav service restart during initial install (need to be restarted). Switched some TLS truststore vars to use concerete values. Introduced option for specifying additional Nginx config options. Added docs for some params. Assmeble Duplicity include pattern when needed. Don't set passwords for existing system users. Fix permissions for database users to be more restrictive. Fixed a couple of default param definitions (mainly tls cert/key stuff). Updated URL for downloading Prosody LDAP plugin. Updated testsite configs.
branko	18cd76ec050d	10 years ago	MAR-51: Replaced referencing of local files for TLS keys and certificates with actual values. Documentation has been updated throughout to reflect this in both role reference and usage instructions.
branko	61e6cfb81789	10 years ago	MAR-51: Fixed documentation for ansible_key parameter in preseed role. Updated ca_certificates parameter in common role to accept key-value pairs of filenames and certificates to put on remote host (so lookups/inventory can be utilised in more flexible manner). Updated backup_client role to fail if it is not possible to extract encryption key IDs from deployed keys. Moved purging of Exim4 configuration files from handlers to tasks (more robust, and still idempotent). All documentation has been updated as well.
branko	a9e97d3e2306	10 years ago	MAR-54: Separated SMTP ports for server-to-server comms and user mail submission, allowing authentication only on port 587 (port 25 purely for server-to-server communication). Hardened TLS configuration on port 587.
branko	6ac610bd3314	10 years ago	MAR-55: Accept incoming connections to port 636 on LDAP server.
branko	1a2f50dfce57	10 years ago	MAR-49: Reworded role reference info about TLS hardening a bit. Implemented TLS hardening for the mail server role (Dovecot only, Postfix would require some additional work for service separation).
branko	5d6cebe35306	10 years ago	MAR-49: Implemented TLS hardening for XMPP server role.
branko	3907a5157ef8	10 years ago	MAR-49: Implemented TLS hardening for the LDAP server role.
branko	9767536963e6	10 years ago	MAR-49: Implemented TLS hardening for web server role.
branko	dfb91e411e40	10 years ago	MAR-46: Intorduced additional options to web server, PHP website, and WSGI website roles for controling if HTTPS access is enforced (HTTP redirected to HTTPS) or not. Defaults to enforcing HTTPS now. Updated docs for the new parameters.
branko	680d322cf8cc	10 years ago	MAR-47: Added role dependency description to the role reference documentation. Added database_server role as dependency for the database role.
branko	f1da206cd88e	10 years ago	MAR-52: Renamed the web server parameters for TLS. Updated the docs for the role reference to make it clearer what the key/cert is used for.
branko	7742feee3781	10 years ago	MAR-44: Updated the name of backup_client parameter to be more clear (backup_patterns_name to backup_patterns_filename). Removed unused handler from backup clients role.
branko	de825c5e17de	10 years ago	MAR-44: Redisgned how backup client handles backup pattern deployment. Introduce a list parameter for this purpose to the role. Updated docs.
branko	79aa82273952	10 years ago	MAR-44: Document pre-backup scripts for backup_client role. Use static prefix for the backup pattern file for databases.
branko	c6f217756635	10 years ago	MAR-44: Redesigned handling of private keys by the backup_client role. Keys are now provided directly, not as key identifiers to be looked-up in the backup keyring.
branko	d61d01c00362	10 years ago	MAR-44: Redesigned usage of GnuPG keys used by the backup_client role. Now one must provide encryption key, signing key (both have to be private, and will be transfered to host), and can optionally provide additional public keys to use for encryption. Updated example.
branko	5e15f8ca16fc	10 years ago	MAR-44: Moved away from crontab for database backups to pre-backup commands for better reliability. Fixed command for collecting the encryption keys.
branko	0f817823bed7	10 years ago	MAR-44: Implemented backup support for the common role. Includes back-up of logs and (regular) home directories.
branko	b668f8894d52	10 years ago	MAR-44: Implemented backup support for the database role.
branko	f05039c7d383	10 years ago	MAR-44: Implemented backup support for the mail server role.
branko	dbc3381e1ff3	10 years ago	MAR-44: Implemented backup support for the XMPP server role. Updated test site to include XMPP server as one of the backup clients.
branko	881a85f08e22	10 years ago	MAR-44: Added another global parameter for controlling deployment of backup configs for roles. Implemented backup support for the LDAP server role. Updated testsite configuration, moving the backup configuration to be global.
branko	3686169e9565	10 years ago	MAR-44: Set-up crontab to run backups at 02:00 every day in backup client role. Updated role reference documentation for backup client role. Updated test site set-up instructions. Updated testsite configuration for backup client/server to use domain parameters. Enabled backup client role for the web server.
branko	c4113608aa36	10 years ago	MAR-44: Added role reference documentation for the backup_client role. Added role reference examples for the backup_server role.
branko	500658358454	10 years ago	MAR-44: Added backup server implementation. Updated testsite to include deployment of dedicated backup server. Documented the backup server implementation (except for usage instructions).
branko	f661345e5b93	10 years ago	MAR-18: Added small section on where to go next at the bottom of usage instructions.
branko	41d138d49d52	10 years ago	MAR-41: Small documentation fixes for default values for the PHP and WSGI website roles.
branko	011f651f90ce	10 years ago	MAR-40: Updated the XMPP role to be more in the line of other roles (like mail server) by having more implicit settings/expected LDAP directory structure.Removed a number of options that are now hard-coded. Updated testsite appropriately to accomodate for this change.
branko	b9ad784771b4	10 years ago	MAR-39: Updated description for the LDAP server role.
branko	d077bd1afabb	10 years ago	MAR-38: Added deploment of LDAP misc schema to LDAP server role. Updated the test site to accomodate this change (removing the LDAP entries that took care of it manually before).
branko	4313878669b1	10 years ago	MAR-37: Fixed documentation for the mail server LDAP base DN parameter, and renamed the parameter to make a bit more sense (to reduce confusion).
branko	e29b656fbf7a	10 years ago	MAR-36: Added new option to ldap_server role for defining the LDAP administrator's password.
branko	ddfeb485fb84	10 years ago	MAR-35: Fixed handling of Ansible-provided facts, making it _much_ simpler along the way as well.
branko	b7a248e3c287	10 years ago	MAR-35: Fixed documentation for tls_private_key_dir and tls_certificate_dir options. Fixed default definition for common packages that should be deployed on servers.
branko	121c6165add4	10 years ago	MAR-35: Fixed the user of Ansible facts (fixed wrong variable name).
branko	955d4a31a0b0	10 years ago	MAR-19: Make the ansible_key var for bootstrap role optional.
branko	ed37f9854bfb	10 years ago	MAR-19: Simplified the WSGI website role by making a number of parameters optional.
branko	76e05de03837	10 years ago	MAR-19: Fixed documentation for optional TLS key/certificate parameters. Simplified php website role, making some parameters optional. Fixed the optional parameters for TLS for web server role.
branko	5b175621f79a	10 years ago	MAR-19: Fixed some docs. Made a bunch of parameters optional for web server role.
branko	226b5faf3e5a	10 years ago	MAR-19: Simplified the mail forwarder role by making some of the parameters optional.
branko	e838bcb94a9e	10 years ago	MAR-19: Simplified the mail server parameters by making a bunch of them optional.
branko	fb163acf23e7	10 years ago	MAR-19: Fixed handling off TLS private keys and certificates. Added some common parameters for defining where the TLS private keys and certificates reside.
branko	e61d502b9d00	10 years ago	MAR-19: Simplified a couple of parameters in the xmpp_server role.
branko	63d26c0b3d86	10 years ago	MAR-19: Simplified LDAP permissions specification for the LDAP server. Auto-calculate on which db the permissions need to be changed (instead of having user provide it). Also switched to a single tree where it can be configured. Updated the example in role reference.
branko	99edcba90842	10 years ago	MAR-19: Simplified the parameters for LDAP server role. Most of the parameters have become optional, with some smart defaults.
branko	b325005c1a8f	10 years ago	MAR-19: Flattened the ldap server configurtion parameter provisioning (i.e. no more placeholder dictionary, instead use distinct variable names for each option).
branko	4c5f1593c786	10 years ago	MAR-19: Make the ldap client configuration optional.
branko	fe6cdb2443c7	10 years ago	MAR-19: Simplified the parameters for common role, making a lot of them optional with some sane defaults. Switched to using an actual list for additional groups.
branko	a25135cc9e78	10 years ago	MAR-19: Updated documentation for the preseed role to match parameter redesign. Removed some testing file that was added to playbooks by mistake earlier.
branko	1b76d272e529	10 years ago	MAR-34: Renamed the role prosody to xmpp_server. Updated all parameters for the role to be prefixed with xmpp_ instead of prosody_. Updated documentation.
branko	babda105c9cf	10 years ago	MAR-16: Added option to common role for setting-up caching proxy for apt.
branko	40689344a8f3	10 years ago	MAR-15: Implemented role for deploying a MariaDB database.
branko	09625826d96f	10 years ago	MAR-15: Added implementation for the database server role. Performs very simpled deployment and set-up of MariaDB database server.
branko	d26fe0368a4b	10 years ago	MAR-5: Updated php and wsgi website roles to include set-up website-specific TLS configuration for Nginx (including separate TLS key/certificate if necessary).
branko	9fa438ee34c0	10 years ago	MAR-5: Added another example to role reference for running PHP websites. Allow duplicates of roles php_website and wsgi_website. Use parameter in handler for restarting WSGI website (to have them website-specific). Updated test site to force handler execution in order to avoid being in undefined state.
branko	40473a82c752	11 years ago	MAR-5: Updated the PHP website role to be a bit more flexible when configuring the nginx.
branko	981584549895	11 years ago	MAR-5: Adding the initial implementation of the WSGI website role.
branko	467a66f3ec65	11 years ago	MAR-5: Added handler for reloading systemd configuration to common role. Dropped installation of supervisor as part of web server role. Updted web server role to create directory for storing WSGI application sockets. Updated web server role to use correct directory for storing PHP website sockets.
branko	7727c37bce67	11 years ago	MAR-5: Fixed some typos in role reference for web server. Added initial implementation of a role for deploying PHP websites (some common functionality).
branko	0079746d9a8b	11 years ago	MAR-5: Updated the web server role to include deployment of some base packages for PHP and Python web apps.
branko	373cdfe71c66	11 years ago	MAR-5: Implemented the initial web server role that deploys a basic Nginx to the server. Updated test site to include the new role (for server web.example.com).
branko	61ddc6eab566	11 years ago	MAR-13: Updated documentation for the preseed role (added missin parameter description for ansible_key). Remove the ansible key from list of authorised keys for root user at end of bootstrap process. Updated testsite documentation to be more explicit for bootstrap process.
branko	b453b7fcb189	11 years ago	MAR-13: Don't use Wheezy backports repository for deploying mail server. Updated package name for Emacs.
branko	eb9a1b525c77	11 years ago	MAR-12: Added documentation related to firewall for the common role. Added deployment of firewall rules for roles mail_server, prosody, and ldap_server.
branko	941f4f372672	11 years ago	MAR-12: Updated the common role to deploy ferm, and set-up a basic firewall for allowing incoming SSH and ICMP echo requsts (ping).
branko	2285dcdda345	11 years ago	MAR-11: Force use of TLS when forwarding mails to mail relay, including proper server certificate verification. Updated testsite and docs as well.
branko	0ad9410c243a	11 years ago	MAR-10: Deploy CA certificates to /etc/ssl/certs/ only, otherwise some weird issues can happen in case update-ca-certificates does not run. Plus is it more straightforward. Deploy TLS private key/cert a bit later for all roles in order to have the necessary groups available. Fixed a wrong notify.
branko	96e9f230a669	11 years ago	MAR-10: Updated server roles to deploy private key and certificate. Updated documentation and test site configuration as well.
branko	76ed37089b33	11 years ago	MAR-10: Added support for deploying CA certificates to role 'common'. Make sure symlink truststore is deployed as file in Postfix chroot (for role mail_server). Small fix in handlers for role common (ls command is not necessary). Updated testsite configuration and documentation to refer to correct CA certificate file (for trust chain).
branko	c9b8c60fbd5e	11 years ago	MAR-4: Deploy the SWAKS utility on servers that forward their mails via relay. Useful for testing.
branko	9a5d1122146f	11 years ago	MAR-4: Added documentation for the mail forwarder role. Removed allowed networks for the mail forwarder role (the server is not supposed to relay mail).
branko	298c0dbe1698	11 years ago	MAR-4: Updated documentation for the mail server role, adding information about rsync installation, set-up of chroot for Postfix, and the smtp_allow_relay_from option. Updated mail_server role implementation, fixing rsync command for deploying the truststore to preserve truststore permissions and adding support for specifying networks from which unauthenticated relaying should be allowed.
branko	81d6b5ac9240	11 years ago	MAR-4: Added example configuration for the mail server role. Updated name for the TLS key files. Added steps that need to be done after mail server has been set-up (for TLS keys mainly).
branko	52f75c39ab69	11 years ago	MAR-4: Added documentation for the mail server role.