MAR-245: Upgrade to Ansible 11.2.x:

- Update the requirements files.
- Update documentation.
- Update role meta information.
- No obvious breakages at the moment.

MAR-240: Tag dropped packet messages in system log (due to rate-limiting):

- Improves visibility of such messages, making it easier to
distinguish them from other firewall-related messages.
- Update documentation to mention that the messages are logged.

MAR-236: Add auxiliary object class to LDAP directory for optional countryName and friendlyCountryName attributes:

- Makes it easier to specify free-form optional country name in
LDAP-backed address books.
- Object class uses Majic-specific PEN (Private Enterprise Number)
"namespace" - 1.3.6.1.4.1.40926.417.2.1 (40926 is Majic PEN, 417
stands for LDAP, 2 stands for object class, and 1 is incremental
sequence number). The 417 is result of adding together lower-cased
letters LDAP in their decimal value.

MAR-230: Updated documentation, inline comments, and some tests related to TLS configuration:

- Documentation and comments should be a bit more consistent across
the roles now.
- Try to follow same rule for inclusion of singular TLSv1.2 cipher
across the board in affected tests.

MAR-230: Drop support for older TLS versions from the xmpp_server role:

- Update documentation.
- Include TLSv1.3 ciphers in default configuration for documentation
purposes - although ciphers are not configurable.
- Update the tests. Drop the workarounds for enabling the older
versions via OpenSSL policies.

MAR-230: Add support for TLSv1.3 to the mail_server role:

- Tests/support for older versions have already been dropped
previously.
- Document the specifics of TLSv1.3 cipher configuration.
- Update tests. The DH param test is now applicable only for the
mandatory parameter test servers.

MAR-230: Add support for TLSv1.3 to the ldap_server role and drop TLSv1.1 from tests:

- Update the role defaults, make sure to include additional priority
strings for TLSv1.3.
- Document the specifics of TLSv1.3 cipher configuration.
- Update tests.

MAR-230: Add support for TLSv1.3 to the web_server role and drop TLSv1.1 from tests:

- Update the role defaults, make sure to include additional ciphers
for TLSv1.3.
- Document the specifics of TLSv1.3 cipher configuration.
- Update tests, dropping the hack/workaround that allows use of weaker
TLS protocols.

MAR-218: Bump Ansible version to 10.4.x:

- Fix the requirements file not depending on the patch release.
- Bump all metadata to reference the new version.

MAR-218: Document the passlib Python package requirement:

- The library is used for hashing the operating system user passwords
during account creation.

MAR-239: Dropped support for Debian 11 Bullseye from the backup_client role:

- Switch to using Paramiko instead of pexpect backend (therefore
avoiding using the external SSH client binary).

MAR-234: Use the pipreqcheck user when checking the Python version and prompt:

- Using the root account can result in incorrect permissions being set
on the Python cache (__pycache__) directories, which can further
cause permission issues for the pirpeqcheck user itself.
- The prompt also makes more sense to check in context of the virtual
environment user (since that's the one that will normally get used
with the virtual environment itself).

Noticket: Fix version for 8.0.0 release notes:

- The x.y.z was left unchanged by mistake.

MAR-201: Preparing for release 8.0.0:

- Update the release procedure to cater for Sphinx documentation
builder upgrade.

MAR-232: Switch to using IP addreses in firewall rules for mail_forwarder role:

- Perform lookups on managed machine for the passed-in SMTP relay
host, and use those values when populating the firewall rules.

MAR-226: Harmonise the HTTP header override parameter between the PHP and WSGI website roles:

- Use the new naming/syntax introduced in the php_website role since
it implies less dependence on the backend application (more generic
name for it), and is a little bit saner in terms of not having to
provide quotes as part of the value.

MAR-192: Fix missing dnspython library as requiremnts for running the roles:

- Turns out there is still one usage left in the mail_forwarder role.
- It might be a good idea to try to get rid of that single usage to
make the firewall coming up more reliable during boot time.

MAR-192: Get rid of the dnspython requirement, and document netaddr requirement:

- This is the result of previous deprecation of using resolvable names
for setting-up the list of allowed incoming connections when in
maintenance mode.

MAR-192: Drop rsyslog/logrotate configuration for ldap_server role under Debian 12 Bookworm:

- Default installations of Debian 12 Bookworm no longer come with
rsyslog pre-installed (and it is considered to be deprecated as
default system logger under Debian 12 Bookworm).

MAR-192: Switch to using NTP pools instead of servers:

- This is the recommended configuration by NTPsec, and also default on
Debian. Previuosly suggested values for servers have been pool
addresses in any case.

MAR-195: Reject mails with non-matching sender for logged-in users:

- Prevents logged-in user from setting "MAIL FROM" with e-mail address
that does not match either his own account or one of the aliases
that the user receives mails from.
- Reworked the submission port configuration to restrict only based on
sender-related restrictions, merging some of the newer changs from
the workaround.org instructions.

MAR-196: Simplify allowed TLS protocol configuration for mail_server role:

- Accept minimum version allowed instead of arbitrary list.
- Fixes deprecation warnings in Dovecot logs (ssl_protocols ->
ssl_min_protocol transition).

MAR-194: Use IP addresses instead names for maintenance allowed connections:

- Less ambigious. Solves problems around names being resolvable to
different IPs depending on what DNS server is used.
- Parameter renamed to better represent what is specified.
- Updated requirements to allow execution of ipv4/ipv6 filters.
- Pin the rich requirement to a lower version for compatibility
reasons.
- Implement tests for IPv6 connectivity tests.
- Improve rendering of base rules (indentation).

MAR-197: Implement environment indicator for the web_server role:

- Now the environment indicator will also cover the default landing
page for the web server.
- Tweaked the landing page to look a bit better in terms of
margins (particularly important for the environment indicator).

MAR-198: Implement removal of expired backups via backup_client role:

- In addition to expired backup removals, ensure that the backup
does not proceed if previous execution step has failed. This means
that pre-scripts now have to run without errors for the main backup
to kick-in.
- Could not use full _and_ chaining of duply. For example, if we have
A_and_B_and_C (where A/B/C are duply backup commands), if A
fails, B will be skipped, but C will still run because B has ran
without_errors.

MAR-154: Drop suppor for Python 2.7 from the wsgi_website role:

- Mostly a matter of dropping the Python version parameter, and
updating some package versioning to account for Python 3 only.

MAR-154: Drop support for Python 2.7 from the common role:

- This primarily concerns removal of pip requirements upgrade checks
for Python 2.7.
- The old Python 3-specific paths are getting deprecated, and the
Python 2 paths will be used instead.
- Set permissions on pipreqcheck directory explicitly (because of
deprecation testing).

MAR-193: Fix deprecation warnings coming from newer versions of pip-tools:

- In more recent versions of pip-tools, a new option has been
added (--strip-extras) that will become a new default in next major
release. Not using this option causes some warnings on Debian 11
Bullseye when pip-tools is brought up to date.
- Refactor the invocation of pip-compile to make it more modular.
- No test expansion for this since it would make it a bit harder to
target both Debian 10 Buster and Debian 11 Bullseye.

MAR-186: Reorder the deprecation tasks for xmpp_server role to make the runs reliable:

- Deprecated apt repository really needs to be removed first in case
it has an unresolvable URL (so the backports repository cache update
would trigger correctly).
- Use the file removal for Prosody repository as well to make sure the
file is dropped.

MAR-184: Update package versions for pip upgrade checks virtual environments:

- Should provide better test coverage compared to previously since
newer versions of pip-tools have slightly different ways of resolving
packages, as well as output formats.

MAR-182: Added ability to specify input requirements for running pip package upgrade checks against helper virtual environments:

- These environments are used for running the package upgrade checks
themselves.

MAR-181: Deploy Prosody modules (in order to use the LDAP authentcation):

- Replaces the rolled-out-by-hand authentication module, making it
less dependent on upstream repository.

MAR-181: Install Prosody from Debian backports repository:

- This way we should be able to get way more features available, and
reduce chances of breaking upgrades from upstream project towards
Debian-provided packages due to eventual bigger differences between
the nightly builds and official releases.

MAR-165: Deploy Diffie-Helman parameters for LDAP server in the ldap_server role:

- Not relevant for Debian Strech because of a bug in the OpenLDAP
version it ships with.
- This should allow use of DHE ciphers with LDAP server.
- Generated DH parameters only help pick one of the parameters from
RFC-7919 (based on the size of generated ones).
- Make the cipher test lists distro-specific due to differences
between supported algorithms in respective GnuTLS versions.

MAR-160: Update release notes, usage instructions, and role reference documentation:

- Describe the maintenance and maintenance_allowed_hosts parameters
for the common role.

MAR-177: Do not pin pip/setuptools to specific versions when setting up Python virtual environment:

- Provided more details for the pkg-resources workaround.
- Skip installing latest version of pip - it will get installed
automatically via the virtualenv command already.
- Do not pin the setuptools package when installing.
- Updated release notes.

MAR-168: Drop the Debian system maintenance user if present:

- Drop the user itself from the MySQL database.
- Update the Debian system maintenance configuration file if root is
not specified as the user within.
- Updated tests.
- Updated release notes.
- Updated role reference documentation.

MAR-168: Drop the user of passwords for the root MySQL account:

- Rely on unix_socket authentication plugin instead.
- Updated role reference documentation.
- Updated tests.

MAR-174: Enable Message Carbons (XEP-0280) and Message Archive Management (XEP-0313) via xmpp_server role:

- Updated release notes.
- Updated role reference documentation.
- Enable the two modules via Prosody configuration file, and set the
archive expiration configuration option for Prosody.
- Updated tests.

MAR-164: Fix Prosody TLS configuration in xmpp_server role:

- Added warning to role reference documentation about what DNS names
need to be included in the subject alternative name of issued
certificate used for Prosody.
- Added crontab with script that validates the certificate on daily
basis.
- Updated tests to include the proxy.DOMAIN and conference.DOMAIN DNS
names in subject alternative name for generated test certificates.
- Added and updated tests that cover new functionality.
- Fixed the Prosody TLS configuration to have common parameters
specified in general section, and any kind of overrides (mainly the
ciphers) in more specific sections.
- Updated release notes.

MAR-170: Always enforce use of HTTPS in the php_server role:

- Dropped the enforce_https parameter.
- Updated tests.
- Updated release notes.
- Update role reference documentation.
- Update usage instructions.

MAR-170: Always enforce use of HTTPS in the wsgi_server role:

- Dropped the enforce_https parameter.
- Updated tests.
- Updated release notes.

MAR-170: Always enforce use of HTTPS in the web_server role:

- Dropped the default_enforce_https parameter.
- Updated tests.
- Updated release notes.

MAR-171: Make the xmpp_domains parameter mandatory:

- Updated release notes.
- Updated role reference documentation.
- Dropped the default value for parameter from the xmpp_server role.
- Updated tests.

MAR-159: Added wsgi_requirements_in parameter to wsgi_website role:

- Added the parameter as optional.
- Updated role reference documentation.
- Updated release notes.
- Updated tests.

MAR-161: Make the ldap_server_domain parameter in the ldap_server role mandatory:

- Updated the ldap_server role.
- Removed default value for the parameter.
- Updated tests.
- Updated role reference documentation.
- Updated release notes.
- Dropped the .local from the Molecule instance names.

MAR-155: Make the ansible_key parameter in the bootstrap role mandatory:

- Updated the preseed role.
- Removed default value for the parameter.
- Updated tests.
- Updated role reference documentation.
- Updated release notes.

MAR-155: Make the ansible_key parameter in the preseed role mandatory:

- Updated the preseed role.
- Removed default value for the parameter.
- Updated tests.
- Updated role reference documentation.
- Updated release notes.

MAR-155: Make the preseed_directory parameter in the preseed role mandatory:

- Updated the preseed role.
- Removed default value for the parameter.
- Updated tests.
- Updated role reference documentation.
- Updated release notes.

MAR-162: Make the ldap_server_tls_certificate ldap_server_tls_key parameters mandatory:

- Updated release notes.
- Updated role reference documentation.
- Updated usage instructions to cover set-up of CA hierarchy earlier on
in the process.

MAR-153: Updated role reference documentation and release notes:

- Marks the change as breaking because it could mean older
client/servers cannot interoperate with the Majic Ansible Roles TLS
services any longer.

MAR-152: Update documentation regarding removal of support for Debian 8 Jessie:

- Updated introductory information about the project.
- Removed references to Debian 8 Jessie from documentation.
- Updated release notes.

MAR-146: Added separate parameter for Pyhton 3 virtual environment used for upgrade checks:

- Release notes updated to mention the breaking change.
- Updated role reference documentation to cover the new parameter.
- Updated default values for the dedicated Python virtual
environments.
- Update role common to deploy separate requirements for the two
environments.
- Include wheel package in the requirements.

Noticket: Fix the invocation of GnuPG to use the --no-tty option:

- At least in some cases GnuPG would otherwise fail to run.