majic-ansible-roles Changelog /docs/rolereference.rst

Changelog - /docs/rolereference.rst @ b757d690af42 - showing 100 out of 297 revisions

branko	b757d690af42	8 years ago	MAR-75: Implemented support for specifying additional environment variables for the wsgi_website role. Environment is set-up for both the systemd service and for application admin user. Updated testsite implementation to use it for sample WSGI website.
branko	3352797ee517	8 years ago	MAR-68: When enforcing TLS in web_server, wsgi_website, or php_website roles, send connecting clients proper HSTS policy via Strict-Transport-Security header.
branko	e15b53d59517	8 years ago	MAR-67: Deploy /etc/profile.d/ configuration file that allows reading user-specific profile config files from ~/.profile.d/ directory. Create home directory for web application users in order to get all the fancy colouring etc. Deploy virtual environment activation script inside of wsgi_website role as profile.d script.
branko	a40cf7a468ea	8 years ago	MAR-66: Create web application users with GECOS field that sets their umask to 0007 (this happens thanks to pam_umask).
branko	a717a6ccd782	8 years ago	MAR-65: Disable Emacs electric-indent-mode by default via common role (if Emacs is installed via common_packages).
branko	152b18777513	8 years ago	MAR-62: Removed TLS hardening from xmpp_server role in order to avoid incompatibilities during s2s communication.
branko	32f61f233098	8 years ago	Noticket: Fixed documentation and examples for CA certificate deployment in common role. Fixed usage instructions, mainly some syntax changes and more explicit listing of parameters and such. Fixed path to truststore file for mail_forwarder role. Fixed testsite configurtion for CA certificates.
branko	3af07319e2f3	8 years ago	MAR-59: Removed ability to specify admin user for php_website and wsgi_website roles. Updated testsite and usage instructions. Updated role reference.
branko	f4e9cd36dad4	8 years ago	MAR-57: Implemented customisation of bash shell prompt as part of the common role.
branko	b2cbf5050e57	8 years ago	MAR-56: Separated backup pattern assembly into a separate role in order to reduce number of tasks that run during each run, and to make the whole thing more consistent/modular. Updated usage and reference documentation.
branko	5a15eda01800	8 years ago	MAR-56: Wait for freshclam to download the initial ClamAV database in mail_server role. Make it possible to specify Gunicorn version in the wsgi_website role (and also install the required futures package now). Clarify the parameter for wsgi_application in wsgi_website role should be relative to code sub-directory. Simplify how roles are specified as deps in order to avoid reruns of shared roles in Ansible 1.9.x (for the non-parametrised/singleton roles, that is). Set correct prompt for virtual environments created in wsgi_website.
branko	1b05bae8e440	8 years ago	MAR-56: Added LDIF templates to docs for relevant roles. Added warning about freshclam/clamav service restart during initial install (need to be restarted). Switched some TLS truststore vars to use concerete values. Introduced option for specifying additional Nginx config options. Added docs for some params. Assmeble Duplicity include pattern when needed. Don't set passwords for existing system users. Fix permissions for database users to be more restrictive. Fixed a couple of default param definitions (mainly tls cert/key stuff). Updated URL for downloading Prosody LDAP plugin. Updated testsite configs.
branko	18cd76ec050d	8 years ago	MAR-51: Replaced referencing of local files for TLS keys and certificates with actual values. Documentation has been updated throughout to reflect this in both role reference and usage instructions.
branko	61e6cfb81789	8 years ago	MAR-51: Fixed documentation for ansible_key parameter in preseed role. Updated ca_certificates parameter in common role to accept key-value pairs of filenames and certificates to put on remote host (so lookups/inventory can be utilised in more flexible manner). Updated backup_client role to fail if it is not possible to extract encryption key IDs from deployed keys. Moved purging of Exim4 configuration files from handlers to tasks (more robust, and still idempotent). All documentation has been updated as well.
branko	a9e97d3e2306	9 years ago	MAR-54: Separated SMTP ports for server-to-server comms and user mail submission, allowing authentication only on port 587 (port 25 purely for server-to-server communication). Hardened TLS configuration on port 587.
branko	6ac610bd3314	9 years ago	MAR-55: Accept incoming connections to port 636 on LDAP server.
branko	1a2f50dfce57	9 years ago	MAR-49: Reworded role reference info about TLS hardening a bit. Implemented TLS hardening for the mail server role (Dovecot only, Postfix would require some additional work for service separation).
branko	5d6cebe35306	9 years ago	MAR-49: Implemented TLS hardening for XMPP server role.
branko	3907a5157ef8	9 years ago	MAR-49: Implemented TLS hardening for the LDAP server role.
branko	9767536963e6	9 years ago	MAR-49: Implemented TLS hardening for web server role.
branko	dfb91e411e40	9 years ago	MAR-46: Intorduced additional options to web server, PHP website, and WSGI website roles for controling if HTTPS access is enforced (HTTP redirected to HTTPS) or not. Defaults to enforcing HTTPS now. Updated docs for the new parameters.
branko	680d322cf8cc	9 years ago	MAR-47: Added role dependency description to the role reference documentation. Added database_server role as dependency for the database role.
branko	f1da206cd88e	9 years ago	MAR-52: Renamed the web server parameters for TLS. Updated the docs for the role reference to make it clearer what the key/cert is used for.
branko	7742feee3781	9 years ago	MAR-44: Updated the name of backup_client parameter to be more clear (backup_patterns_name to backup_patterns_filename). Removed unused handler from backup clients role.
branko	de825c5e17de	9 years ago	MAR-44: Redisgned how backup client handles backup pattern deployment. Introduce a list parameter for this purpose to the role. Updated docs.
branko	79aa82273952	9 years ago	MAR-44: Document pre-backup scripts for backup_client role. Use static prefix for the backup pattern file for databases.
branko	c6f217756635	9 years ago	MAR-44: Redesigned handling of private keys by the backup_client role. Keys are now provided directly, not as key identifiers to be looked-up in the backup keyring.
branko	d61d01c00362	9 years ago	MAR-44: Redesigned usage of GnuPG keys used by the backup_client role. Now one must provide encryption key, signing key (both have to be private, and will be transfered to host), and can optionally provide additional public keys to use for encryption. Updated example.
branko	5e15f8ca16fc	9 years ago	MAR-44: Moved away from crontab for database backups to pre-backup commands for better reliability. Fixed command for collecting the encryption keys.
branko	0f817823bed7	9 years ago	MAR-44: Implemented backup support for the common role. Includes back-up of logs and (regular) home directories.
branko	b668f8894d52	9 years ago	MAR-44: Implemented backup support for the database role.
branko	f05039c7d383	9 years ago	MAR-44: Implemented backup support for the mail server role.
branko	dbc3381e1ff3	9 years ago	MAR-44: Implemented backup support for the XMPP server role. Updated test site to include XMPP server as one of the backup clients.
branko	881a85f08e22	9 years ago	MAR-44: Added another global parameter for controlling deployment of backup configs for roles. Implemented backup support for the LDAP server role. Updated testsite configuration, moving the backup configuration to be global.
branko	3686169e9565	9 years ago	MAR-44: Set-up crontab to run backups at 02:00 every day in backup client role. Updated role reference documentation for backup client role. Updated test site set-up instructions. Updated testsite configuration for backup client/server to use domain parameters. Enabled backup client role for the web server.
branko	c4113608aa36	9 years ago	MAR-44: Added role reference documentation for the backup_client role. Added role reference examples for the backup_server role.
branko	500658358454	9 years ago	MAR-44: Added backup server implementation. Updated testsite to include deployment of dedicated backup server. Documented the backup server implementation (except for usage instructions).
branko	f661345e5b93	9 years ago	MAR-18: Added small section on where to go next at the bottom of usage instructions.
branko	41d138d49d52	9 years ago	MAR-41: Small documentation fixes for default values for the PHP and WSGI website roles.
branko	011f651f90ce	9 years ago	MAR-40: Updated the XMPP role to be more in the line of other roles (like mail server) by having more implicit settings/expected LDAP directory structure.Removed a number of options that are now hard-coded. Updated testsite appropriately to accomodate for this change.
branko	b9ad784771b4	9 years ago	MAR-39: Updated description for the LDAP server role.
branko	d077bd1afabb	9 years ago	MAR-38: Added deploment of LDAP misc schema to LDAP server role. Updated the test site to accomodate this change (removing the LDAP entries that took care of it manually before).
branko	4313878669b1	9 years ago	MAR-37: Fixed documentation for the mail server LDAP base DN parameter, and renamed the parameter to make a bit more sense (to reduce confusion).
branko	e29b656fbf7a	9 years ago	MAR-36: Added new option to ldap_server role for defining the LDAP administrator's password.
branko	ddfeb485fb84	9 years ago	MAR-35: Fixed handling of Ansible-provided facts, making it _much_ simpler along the way as well.
branko	b7a248e3c287	9 years ago	MAR-35: Fixed documentation for tls_private_key_dir and tls_certificate_dir options. Fixed default definition for common packages that should be deployed on servers.
branko	121c6165add4	9 years ago	MAR-35: Fixed the user of Ansible facts (fixed wrong variable name).
branko	955d4a31a0b0	9 years ago	MAR-19: Make the ansible_key var for bootstrap role optional.
branko	ed37f9854bfb	9 years ago	MAR-19: Simplified the WSGI website role by making a number of parameters optional.
branko	76e05de03837	9 years ago	MAR-19: Fixed documentation for optional TLS key/certificate parameters. Simplified php website role, making some parameters optional. Fixed the optional parameters for TLS for web server role.
branko	5b175621f79a	9 years ago	MAR-19: Fixed some docs. Made a bunch of parameters optional for web server role.
branko	226b5faf3e5a	9 years ago	MAR-19: Simplified the mail forwarder role by making some of the parameters optional.
branko	e838bcb94a9e	9 years ago	MAR-19: Simplified the mail server parameters by making a bunch of them optional.
branko	fb163acf23e7	9 years ago	MAR-19: Fixed handling off TLS private keys and certificates. Added some common parameters for defining where the TLS private keys and certificates reside.
branko	e61d502b9d00	9 years ago	MAR-19: Simplified a couple of parameters in the xmpp_server role.
branko	63d26c0b3d86	9 years ago	MAR-19: Simplified LDAP permissions specification for the LDAP server. Auto-calculate on which db the permissions need to be changed (instead of having user provide it). Also switched to a single tree where it can be configured. Updated the example in role reference.
branko	99edcba90842	9 years ago	MAR-19: Simplified the parameters for LDAP server role. Most of the parameters have become optional, with some smart defaults.
branko	b325005c1a8f	9 years ago	MAR-19: Flattened the ldap server configurtion parameter provisioning (i.e. no more placeholder dictionary, instead use distinct variable names for each option).
branko	4c5f1593c786	9 years ago	MAR-19: Make the ldap client configuration optional.
branko	fe6cdb2443c7	9 years ago	MAR-19: Simplified the parameters for common role, making a lot of them optional with some sane defaults. Switched to using an actual list for additional groups.
branko	a25135cc9e78	9 years ago	MAR-19: Updated documentation for the preseed role to match parameter redesign. Removed some testing file that was added to playbooks by mistake earlier.
branko	1b76d272e529	9 years ago	MAR-34: Renamed the role prosody to xmpp_server. Updated all parameters for the role to be prefixed with xmpp_ instead of prosody_. Updated documentation.
branko	babda105c9cf	9 years ago	MAR-16: Added option to common role for setting-up caching proxy for apt.
branko	40689344a8f3	9 years ago	MAR-15: Implemented role for deploying a MariaDB database.
branko	09625826d96f	9 years ago	MAR-15: Added implementation for the database server role. Performs very simpled deployment and set-up of MariaDB database server.
branko	d26fe0368a4b	9 years ago	MAR-5: Updated php and wsgi website roles to include set-up website-specific TLS configuration for Nginx (including separate TLS key/certificate if necessary).
branko	9fa438ee34c0	9 years ago	MAR-5: Added another example to role reference for running PHP websites. Allow duplicates of roles php_website and wsgi_website. Use parameter in handler for restarting WSGI website (to have them website-specific). Updated test site to force handler execution in order to avoid being in undefined state.
branko	40473a82c752	9 years ago	MAR-5: Updated the PHP website role to be a bit more flexible when configuring the nginx.
branko	981584549895	9 years ago	MAR-5: Adding the initial implementation of the WSGI website role.
branko	467a66f3ec65	9 years ago	MAR-5: Added handler for reloading systemd configuration to common role. Dropped installation of supervisor as part of web server role. Updted web server role to create directory for storing WSGI application sockets. Updated web server role to use correct directory for storing PHP website sockets.
branko	7727c37bce67	9 years ago	MAR-5: Fixed some typos in role reference for web server. Added initial implementation of a role for deploying PHP websites (some common functionality).
branko	0079746d9a8b	9 years ago	MAR-5: Updated the web server role to include deployment of some base packages for PHP and Python web apps.
branko	373cdfe71c66	9 years ago	MAR-5: Implemented the initial web server role that deploys a basic Nginx to the server. Updated test site to include the new role (for server web.example.com).
branko	61ddc6eab566	9 years ago	MAR-13: Updated documentation for the preseed role (added missin parameter description for ansible_key). Remove the ansible key from list of authorised keys for root user at end of bootstrap process. Updated testsite documentation to be more explicit for bootstrap process.
branko	b453b7fcb189	9 years ago	MAR-13: Don't use Wheezy backports repository for deploying mail server. Updated package name for Emacs.
branko	eb9a1b525c77	9 years ago	MAR-12: Added documentation related to firewall for the common role. Added deployment of firewall rules for roles mail_server, prosody, and ldap_server.
branko	941f4f372672	9 years ago	MAR-12: Updated the common role to deploy ferm, and set-up a basic firewall for allowing incoming SSH and ICMP echo requsts (ping).
branko	2285dcdda345	9 years ago	MAR-11: Force use of TLS when forwarding mails to mail relay, including proper server certificate verification. Updated testsite and docs as well.
branko	0ad9410c243a	9 years ago	MAR-10: Deploy CA certificates to /etc/ssl/certs/ only, otherwise some weird issues can happen in case update-ca-certificates does not run. Plus is it more straightforward. Deploy TLS private key/cert a bit later for all roles in order to have the necessary groups available. Fixed a wrong notify.
branko	96e9f230a669	9 years ago	MAR-10: Updated server roles to deploy private key and certificate. Updated documentation and test site configuration as well.
branko	76ed37089b33	9 years ago	MAR-10: Added support for deploying CA certificates to role 'common'. Make sure symlink truststore is deployed as file in Postfix chroot (for role mail_server). Small fix in handlers for role common (ls command is not necessary). Updated testsite configuration and documentation to refer to correct CA certificate file (for trust chain).
branko	c9b8c60fbd5e	9 years ago	MAR-4: Deploy the SWAKS utility on servers that forward their mails via relay. Useful for testing.
branko	9a5d1122146f	9 years ago	MAR-4: Added documentation for the mail forwarder role. Removed allowed networks for the mail forwarder role (the server is not supposed to relay mail).
branko	298c0dbe1698	9 years ago	MAR-4: Updated documentation for the mail server role, adding information about rsync installation, set-up of chroot for Postfix, and the smtp_allow_relay_from option. Updated mail_server role implementation, fixing rsync command for deploying the truststore to preserve truststore permissions and adding support for specifying networks from which unauthenticated relaying should be allowed.
branko	81d6b5ac9240	9 years ago	MAR-4: Added example configuration for the mail server role. Updated name for the TLS key files. Added steps that need to be done after mail server has been set-up (for TLS keys mainly).
branko	52f75c39ab69	9 years ago	MAR-4: Added documentation for the mail server role.
branko	8b0cbc64f6e9	10 years ago	MAR-3: Added legacyauth module, including support for deprecated TLS/SSL on port 5223.
branko	713f25145801	10 years ago	MAR-3: Added example for Prosody role.
branko	8001cba3f698	10 years ago	MAR-3: Added role documentation.
branko	f7fe8adec8d3	10 years ago	MAR-1: Updated documentation about memberof overlay. Updated configuration of the memberof overlay.
branko	4782a39c90dd	10 years ago	MAR-1: Adding initial documentation for the LDAP server role.
branko	9eca957bb9db	10 years ago	MAR-1: Configure private key directory permissions.
branko	3816b71c274c	10 years ago	MAR-1: Added reference documentation for LDAP client role.
branko	0aff90546ac4	10 years ago	MAR-2: Updated docs formatting a bit. Added documentation for the bootstrap role. Updated bootstrap role a bit to have better authorized key referencing.
branko	626eadba53b7	10 years ago	MAR-2: Added the 'common' role for some basic server set-up.
branko	cc12c282bb3d	10 years ago	MAR-2: Added a role for generating the preseed files.
branko	c377c1d24d7c	10 years ago	MAR-6: Added initial documentation with some basic description of the project, links, and structure.