MAR-232: Switch to using IP addreses in firewall rules for mail_forwarder role:

- Perform lookups on managed machine for the passed-in SMTP relay
host, and use those values when populating the firewall rules.

MAR-226: Harmonise the HTTP header override parameter between the PHP and WSGI website roles:

- Use the new naming/syntax introduced in the php_website role since
it implies less dependence on the backend application (more generic
name for it), and is a little bit saner in terms of not having to
provide quotes as part of the value.

MAR-192: Drop rsyslog/logrotate configuration for ldap_server role under Debian 12 Bookworm:

- Default installations of Debian 12 Bookworm no longer come with
rsyslog pre-installed (and it is considered to be deprecated as
default system logger under Debian 12 Bookworm).

MAR-192: Added support for Debian 12 Bookworm to xmpp_server role:

- Some of the tests are still failing, namely the ones centered around
the sendxmpp tool (which seems completely broken at this point in
Debian 12 Bookworm)

MAR-192: Added support for Debian 12 Bookworm to mail_server role:

- Allow use of older versions of TLS on Bookworm for testing of
related optional parameters.
- Install the IMAP CLI testing tool under its own virtual environment
in order to avoid warnings and errors when trying to install it
globally under Debian 12 Bookworm.
- Update the lists of expected TLS protocols and ciphers.

MAR-192: Added support for Debian 12 Bookworm to wsgi_website role:

- Update list of Python packages that are installed for running the
tests.
- Paramterise Python version testing (depends on distribution
release). Use similar construct like for the php_website role.

MAR-192: Added support for Debian 12 Bookworm to web_server role:

- Some tweaks had to be done to test the TLS, but it would be useful
to revisit the TLS configuration in general in the future, and to
modernise it for TLSv1.2 and TLSv1.3, especially once the supports
for Debian 11 Bullseye is dropped.

MAR-192: Added support for Debian 12 Bookworm to database_server role:

- Newer versions of MariaDB are planning on making the utf8 become a
default alias for utf8mb4. Stick to utf8mb3 currently for
compatibility purposes.

MAR-192: Added support for Debian 12 Bookworm to backup_server role:

- Use test parametrisation instead of looping over a list when testing
correct key usage.
- Replace deprecated key algorithm (in Debian 12 Bookworm) for test
purposes (it just needs to be one of the RSA variants).

MAR-192: Added support for Debian 12 Bookworm to common role:

- Use slightly more memory for Debian 12 Bookworm VMs, they have a
tendency to OOM otherwise (march of progress).
- Update regex for matching the DIR_MODE confiuration in Debian 12.
- Remove NTP pacakges if ntp_pools parameter was not set.

MAR-192: Switch to using NTP pools instead of servers:

- This is the recommended configuration by NTPsec, and also default on
Debian. Previuosly suggested values for servers have been pool
addresses in any case.

MAR-192: Added support for Debian 12 Bookworm to backup_client role:

- Drop the orphan config file for backup server helper.

MAR-195: Reject mails with non-matching sender for logged-in users:

- Prevents logged-in user from setting "MAIL FROM" with e-mail address
that does not match either his own account or one of the aliases
that the user receives mails from.
- Reworked the submission port configuration to restrict only based on
sender-related restrictions, merging some of the newer changs from
the workaround.org instructions.

MAR-196: Simplify allowed TLS protocol configuration for mail_server role:

- Accept minimum version allowed instead of arbitrary list.
- Fixes deprecation warnings in Dovecot logs (ssl_protocols ->
ssl_min_protocol transition).

MAR-194: Use IP addresses instead names for maintenance allowed connections:

- Less ambigious. Solves problems around names being resolvable to
different IPs depending on what DNS server is used.
- Parameter renamed to better represent what is specified.
- Updated requirements to allow execution of ipv4/ipv6 filters.
- Pin the rich requirement to a lower version for compatibility
reasons.
- Implement tests for IPv6 connectivity tests.
- Improve rendering of base rules (indentation).

MAR-197: Implement environment indicator for the web_server role:

- Now the environment indicator will also cover the default landing
page for the web server.
- Tweaked the landing page to look a bit better in terms of
margins (particularly important for the environment indicator).

MAR-198: Implement removal of expired backups via backup_client role:

- In addition to expired backup removals, ensure that the backup
does not proceed if previous execution step has failed. This means
that pre-scripts now have to run without errors for the main backup
to kick-in.
- Could not use full _and_ chaining of duply. For example, if we have
A_and_B_and_C (where A/B/C are duply backup commands), if A
fails, B will be skipped, but C will still run because B has ran
without_errors.

MAR-154: Update documentation and test site for Python 2.7 support removal:

- Drop most of the references to Python 2.
- Switch anything that has been previously using Python 2.7 to Python
3.

MAR-154: Drop suppor for Python 2.7 from the wsgi_website role:

- Mostly a matter of dropping the Python version parameter, and
updating some package versioning to account for Python 3 only.

MAR-154: Drop support for Python 2.7 from the common role:

- This primarily concerns removal of pip requirements upgrade checks
for Python 2.7.
- The old Python 3-specific paths are getting deprecated, and the
Python 2 paths will be used instead.
- Set permissions on pipreqcheck directory explicitly (because of
deprecation testing).

MAR-191: Drop support for Debian 11 Buster from the wsgi_website role:

- Get rid of the workaround that used to cause issues in some of the
previous versions of Debian while at it. This should no longer pose
an issue.

MAR-191: Drop support for Debian 10 Buster from the php_website role:

- Move some of the distribution release-specific information used in
tests into a fixture of its own. Make the code a bit cleaner/more
consistent.

MAR-191: Drop support for Debian 10 Buster from the common role:

- Fix incorrect comment on the pkg-resources/pkg_resources package as
well - this one is not distro-dependent.

MAR-191: Drop Debian 10 Buster support for the backup_client role:

- Internal parameter for Python's pexpect package is no longer
required - newer versions of Debian have fully switche to using the
Python 3 version of it for duplicity.
- Fix prepare playbook task to iterate over list of backup users
instead of hard-coding the values.
- Drop the directory set-up task that seems to serve no purpose (some
leftover from previous refactoring most likely.
- Update supported version information in docs and metadata.

MAR-189: Added support for Debian 11 Bullseye to backup_server role:

- Drop the architecture version from the test machine names.

MAR-184: Update package versions for pip upgrade checks virtual environments:

- Should provide better test coverage compared to previously since
newer versions of pip-tools have slightly different ways of resolving
packages, as well as output formats.

MAR-182: Added ability to specify input requirements for running pip package upgrade checks against helper virtual environments:

- These environments are used for running the package upgrade checks
themselves.

MAR-181: Drop support for Debian 9 Stretch from php_website role:

- Keep the mail alias step - it is still relevant for Debian Buster.

MAR-181: Drop support for Debian 9 Stretch from web_server role:

- Switch to using IPs from VirtualBox default allowed host-only
network subnets.
- Drop Stretch-specific code and tests.

MAR-181: Drop support for Debian 9 Stretch from mail_server role:

- Switch to using IPs from VirtualBox default allowed host-only
network subnets.
- Use Debian Buster for helper machines.
- Drop Stretch-specific code and tests.

MAR-181: Drop support Debian 9 Stretch from mail_forwarder role:

- Switch to using IPs from VirtualBox default allowed host-only
network subnets.
- Use Debian Buster for helper machines.

MAR-181: Drop support for Debian 9 Stretch from ldap_server role:

- Switch to using IPs from VirtualBox default allowed host-only
network subnets.
- Drop the workaround for unsupported TLS ciphers on Debian Stretch.

MAR-181: Drop support for Debian 9 Stretch from database role:

- Bump VM memory to 512MB (otherwise MariaDB fails to start up).

MAR-165: Deploy Diffie-Helman parameters for LDAP server in the ldap_server role:

- Not relevant for Debian Strech because of a bug in the OpenLDAP
version it ships with.
- This should allow use of DHE ciphers with LDAP server.
- Generated DH parameters only help pick one of the parameters from
RFC-7919 (based on the size of generated ones).
- Make the cipher test lists distro-specific due to differences
between supported algorithms in respective GnuTLS versions.

MAR-151: Minor fix for wsgi_website role reference documentation:

- List paths for both Python 2 and Python 3 pip requirements upgrade
check directories.

MAR-151: Added support for Debian 10 Buster to xmpp_server role:

- Updated role reference documentaiton.
- Updated role meta information.
- Updated tests.
- Enable lower-level TLS protocols (1.0/1.1) in global OpenSSL
configuration file on Buster in order to be able to test the
xmpp_server_tls_protocol parameter (otherwise Prosody completely
refuses to use them even if listed in its configuration).
- Move stretch-specific tests into its own file (for backported
lua-ldap library), and run them on Debian 9 Stretch machines only.

MAR-151: Added support for Debian 10 Buster to wsgi_website role:

- Updated role reference documentaiton.
- Updated role meta information.
- Updated tests.
- Replace the installation of libmariadbclient-dev-compat library with
atftp - the actual package is differently named under Debian Stretch
and Debian Buster (which would complicate the test without any
benefits).
- Drop the fix for root mail alias in Vagrant image - seems it's no
longer a problem.
- Split-up the test for web application user since it's not possible
to keep it all under one parametrised test due to differences in
assigned system UID numbers for Debian Stretch and Debian Buster.
- Make the test for web application user less dependant on what the
actual UID number is in case of default value. By default user
should be created as system user, which means its UID number should
be less than 1000.

MAR-151: Added support for Debian 10 Buster to php_website role:

- Updated role reference documentaiton.
- Updated role meta information.
- Updated tests.
- Refactor the code to take into account differences in PHP-related
paths between Debian Stretch and Debian Buster.
- Make the test for web application user less dependant on what the
actual UID number is in case of default value. By default user
should be created as system user, which means its UID number should
be less than 1000.
- Drop the installation of libmariadbclient-dev-compat library - the
test is good enough without it, and the actual package is
differently named under Debian Stretch and Debian Buster (which
would complicate the test without any benefits).

MAR-151: Added support for Debian 10 Buster to web_server role:

- Updated role reference documentaiton.
- Updated role meta information.
- Updated tests.
- Refactor the code around handling of different directories and files
for PHP 7.0 (Debian Stretch) and PHP 7.3 (Debian Buster).
- Separate socket directory tests for WSGI and PHP applications (due
to differences in paths for PHP in Debian Stretch and Debian
Buster).

MAR-151: Added support for Debian 10 Buster to preseed role:

- Updated role reference documentaiton.
- Updated role meta information.
- Updated tests.
- Parametrise distribution release in one of the tests to cover both
servers with custom overrides being tested.

MAR-151: Added support for Debian 10 Buster to mail_server role:

- Updated role reference documentaiton.
- Updated role meta information.
- Updated tests.
- Improve handling of configured IP in tests to avoid hard-coding the
value in the relevant test for Postfix configuration file content.

MAR-151: Added support for Debian 10 Buster to mail_forwarder role:

- Updated role reference documentaiton.
- Updated role meta information.
- Updated tests.
- Set the smtpd_relay_restrictions configuration option for Postfix
SMTP server in mail_forwarder role (required for version found in
Debian 10 Buster).

MAR-151: Added support for Debian 10 Buster to ldap_server role:

- Updated role reference documentaiton.
- Updated role meta information.
- Updated tests.

MAR-151: Added support for Debian 10 Buster to ldap_client role:

- Updated role reference documentaiton.
- Updated role meta information.
- Updated tests.

MAR-151: Added support for Debian 10 Buster to database role:

- Updated role reference documentaiton.
- Updated role meta information.
- Updated tests.
- Fix test that produces different outputs during invocation on
Stretch/Buster.

MAR-151: Added support for Debian 10 Buster to database_server role:

- Updated role reference documentaiton.
- Updated role meta information.
- Updated tests.
- Deploy MariaDB client login configuration prior to setting-up
users/passwords for deprecated feature testing to avoid errors when
password gets changed in the middle of a task loop.

MAR-151: Added support for Debian 10 Buster to bootstrap role:

- Updated role reference documentaiton.
- Updated role meta information.
- Updated tests.

MAR-151: Added support for Debian 10 Buster to backup_server role:

- Updated role reference documentation.
- Updated role meta information.
- Updated tests.
- Do not use distribution version-specific SSH configuration file for
backup server SSH daemon.

MAR-151: Added support for Debian 10 Buster to common role:

- Updated tests.
- Updated role reference documentation.
- Updated role metadata information.
- Refactored IP plan for the test machines for better separation
between different types of machines and versions.
- Parametrised tests for limited connectivity using the maintenance
mode.
- Don't use MariaDB compat package in tests - name differs between
Debian 9 and Debian 10, and relevant parameter is already getting
tested properly using the remaining packages.

MAR-151: Added support for Debian 10 Buster to backup role:

- Updated tests.
- Updated role reference documentation.