MAR-234: Use the pipreqcheck user when checking the Python version and prompt:

- Using the root account can result in incorrect permissions being set
on the Python cache (__pycache__) directories, which can further
cause permission issues for the pirpeqcheck user itself.
- The prompt also makes more sense to check in context of the virtual
environment user (since that's the one that will normally get used
with the virtual environment itself).

MAR-234: Use the pipreqcheck user when checking the Python version and prompt:

- Using the root account can result in incorrect permissions being set
on the Python cache (__pycache__) directories, which can further
cause permission issues for the pirpeqcheck user itself.
- The prompt also makes more sense to check in context of the virtual
environment user (since that's the one that will normally get used
with the virtual environment itself).

Noticket: Fix version for 8.0.0 release notes:

- The x.y.z was left unchanged by mistake.

Noticket: Fix version for 8.0.0 release notes:

- The x.y.z was left unchanged by mistake.

MAR-201: Preparing for release 8.0.0:

- Update the release procedure to cater for Sphinx documentation
builder upgrade.

MAR-232: Switch to using IP addreses in firewall rules for mail_forwarder role:

- Perform lookups on managed machine for the passed-in SMTP relay
host, and use those values when populating the firewall rules.

MAR-226: Harmonise the HTTP header override parameter between the PHP and WSGI website roles:

- Use the new naming/syntax introduced in the php_website role since
it implies less dependence on the backend application (more generic
name for it), and is a little bit saner in terms of not having to
provide quotes as part of the value.

MAR-192: Update deployment instructions and configuration for Django Wiki in usage instructions:

- Bring the package and its dependencies to latest possible (LTS)
version.

MAR-192: Fix missing dnspython library as requiremnts for running the roles:

- Turns out there is still one usage left in the mail_forwarder role.
- It might be a good idea to try to get rid of that single usage to
make the firewall coming up more reliable during boot time.

MAR-192: Updated controller and base server installation instructions to use Debian 12 Bookworm:

- Reword some senteces.
- Some reformatting changes.
- Update list of packages getting installed in the Python virtual
environment.

MAR-192: Get rid of the dnspython requirement, and document netaddr requirement:

- This is the result of previous deprecation of using resolvable names
for setting-up the list of allowed incoming connections when in
maintenance mode.

MAR-192: Updated test site instructions/deployment for Debian 12 Bookworm:

- Default to recommending Debian 12 Bookworm.
- Update the demo WSGI application for Python 3 use.

MAR-192: Drop rsyslog/logrotate configuration for ldap_server role under Debian 12 Bookworm:

- Default installations of Debian 12 Bookworm no longer come with
rsyslog pre-installed (and it is considered to be deprecated as
default system logger under Debian 12 Bookworm).

MAR-192: Upgrade documentation build requirements:

- Current requiremetns no longer seem to work with Python 3.9. Time to
bump up the Sphinx version.

MAR-192: Fix incorrect prompt for pipreqcheck virtual environment:

- Ensure that the virtualenv indicator string ends with a
whitespace.
- The virtualenv prompt parameter behaves slightly different between
the versions of Debian 11 Bullseye and Debian 12 Bookworm - the former
being a bit more user-friendly.
- Recreate virtual environment if the prompt does not match-up.

MAR-192: Fix incorrect prompt for wsgi_website virtual environments:

- Ensure that the virtualenv indicator string ends with a whitespace.
- The virtualenv prompt parameter behaves slightly different between
the versions of Debian 11 Bullseye and Debian 12 Bookworm - the
former being a bit more user-friendly.
- Recreate virtual environment if the prompt does not match-up.

MAR-192: Fix/improve backup tests for XMPP server:

- Don't send message to self because go-sendxmpp will retrieve them,
and they won't end-up the offline messages file.
- Generate a random UUID in order to test for the content in the
backed-up files. Makes the test more reliable.

MAR-192: Switch to using go-sendxmpp where possible for testing XMPP server role:

- The sendxmpp in Debian 12 Bookworm is quite broken at this point,
and go-sendxmpp is somewhat close in terms of interface etc.
- Fix a number of tests related to sending messages.

MAR-192: Added support for Debian 12 Bookworm to xmpp_server role:

- Some of the tests are still failing, namely the ones centered around
the sendxmpp tool (which seems completely broken at this point in
Debian 12 Bookworm)

MAR-192: Align IP ranges used for testing VMs in the xmpp_sever role:

- Use two consecutive ranges for Debian 11 Bullseye like in
mail_server.

MAR-192: Allocate a bit more memory to LDAP server helper for mail_server tests:

- Debian 12 Bookworm is a bit more memory-hungry.

MAR-192: Added support for Debian 12 Bookworm to mail_server role:

- Allow use of older versions of TLS on Bookworm for testing of
related optional parameters.
- Install the IMAP CLI testing tool under its own virtual environment
in order to avoid warnings and errors when trying to install it
globally under Debian 12 Bookworm.
- Update the lists of expected TLS protocols and ciphers.

MAR-192: Update compatibility-related entries for Postfix main configuration file:

- Default value for append_dot_mydomain has been "no" for a while now,
no need to set it explicitly.
- Prefer the whitelist/blacklist instead of allowlist/denylist
keywords in logs.

MAR-192: Reformatted mail_forwader Postfix configuration file:

- Improve commenting, and align it with the mail_server role
configuration file in terms of layout.
- Set the compatibility level.

MAR-192: Reformat the Postfix main configuration file for mail_server:

- Improve the comments and split up the config with section titles.
- Drop the deprecated/unnecessary option smtpd_use_tls (already
covered with smtpd_tls_security_level).

MAR-192: Added support for Debian 12 Bookworm to wsgi_website role:

- Update list of Python packages that are installed for running the
tests.
- Paramterise Python version testing (depends on distribution
release). Use similar construct like for the php_website role.

MAR-192: Added support for Debian 12 Bookworm to web_server role:

- Some tweaks had to be done to test the TLS, but it would be useful
to revisit the TLS configuration in general in the future, and to
modernise it for TLSv1.2 and TLSv1.3, especially once the supports
for Debian 11 Bullseye is dropped.

MAR-192: Fix environment indicator test:

- Expected content in the test was incorrect (probably old value from
messing around with improving the environment indicator).

MAR-192: Added support for Debian 12 Bookworm to database_server role:

- Newer versions of MariaDB are planning on making the utf8 become a
default alias for utf8mb4. Stick to utf8mb3 currently for
compatibility purposes.

MAR-192: Added support for Debian 12 Bookworm to backup_server role:

- Use test parametrisation instead of looping over a list when testing
correct key usage.
- Replace deprecated key algorithm (in Debian 12 Bookworm) for test
purposes (it just needs to be one of the RSA variants).

MAR-192: Added support for Debian 12 Bookworm to common role:

- Use slightly more memory for Debian 12 Bookworm VMs, they have a
tendency to OOM otherwise (march of progress).
- Update regex for matching the DIR_MODE confiuration in Debian 12.
- Remove NTP pacakges if ntp_pools parameter was not set.

MAR-192: Switch to using NTP pools instead of servers:

- This is the recommended configuration by NTPsec, and also default on
Debian. Previuosly suggested values for servers have been pool
addresses in any case.

MAR-192: Switch to using NTPsec NTP server for increased security:

- This has for some time been a way better option, and it should also
provide for compatibility with Debian 12 Bookworm.

MAR-192: Drop the Python 2.7-specific packages from installation:

- These are leftovers from previous work for dropping the Python 2.7
support.

MAR-192: Added support for Debian 12 Bookworm to backup_client role:

- Drop the orphan config file for backup server helper.

MAR-195: Reject mails with non-matching sender for logged-in users:

- Prevents logged-in user from setting "MAIL FROM" with e-mail address
that does not match either his own account or one of the aliases
that the user receives mails from.
- Reworked the submission port configuration to restrict only based on
sender-related restrictions, merging some of the newer changs from
the workaround.org instructions.

MAR-196: Simplify allowed TLS protocol configuration for mail_server role:

- Accept minimum version allowed instead of arbitrary list.
- Fixes deprecation warnings in Dovecot logs (ssl_protocols ->
ssl_min_protocol transition).

MAR-194: Use IP addresses instead names for maintenance allowed connections:

- Less ambigious. Solves problems around names being resolvable to
different IPs depending on what DNS server is used.
- Parameter renamed to better represent what is specified.
- Updated requirements to allow execution of ipv4/ipv6 filters.
- Pin the rich requirement to a lower version for compatibility
reasons.
- Implement tests for IPv6 connectivity tests.
- Improve rendering of base rules (indentation).

MAR-194: Configure static IPv6 addresses for testing of common role:

- Requires some additional steps to be done when preparing the
development machine, since VirtualBox prohibits use of network
subnets that are not explicitly configured for use with private
networks.

MAR-194: Switch to using nmap for testing connectivity in common role:

- Unfortunately, hping3 does not support IPv6.

MAR-197: Implement environment indicator for the web_server role:

- Now the environment indicator will also cover the default landing
page for the web server.
- Tweaked the landing page to look a bit better in terms of
margins (particularly important for the environment indicator).

MAR-198: Implement removal of expired backups via backup_client role:

- In addition to expired backup removals, ensure that the backup
does not proceed if previous execution step has failed. This means
that pre-scripts now have to run without errors for the main backup
to kick-in.
- Could not use full _and_ chaining of duply. For example, if we have
A_and_B_and_C (where A/B/C are duply backup commands), if A
fails, B will be skipped, but C will still run because B has ran
without_errors.

MAR-154: Update documentation and test site for Python 2.7 support removal:

- Drop most of the references to Python 2.
- Switch anything that has been previously using Python 2.7 to Python
3.

MAR-154: Improve incorrect Python version handling in virtual environments:

- This should be helpful when performing distribution upgrades as
well (since it should be able to automatically detect a mismatch
now).

MAR-154: Drop suppor for Python 2.7 from the wsgi_website role:

- Mostly a matter of dropping the Python version parameter, and
updating some package versioning to account for Python 3 only.

MAR-154: Drop support for Python 2.7 from the common role:

- This primarily concerns removal of pip requirements upgrade checks
for Python 2.7.
- The old Python 3-specific paths are getting deprecated, and the
Python 2 paths will be used instead.
- Set permissions on pipreqcheck directory explicitly (because of
deprecation testing).

MAR-191: Using pexpect+sftp still required for Duplicity backup:

- From what I can tell even Debian 11 Bullseye duplicyt has similar
limitation like the Buster version.

MAR-191: Drop support for Debian 11 Buster from the wsgi_website role:

- Get rid of the workaround that used to cause issues in some of the
previous versions of Debian while at it. This should no longer pose
an issue.

MAR-191: Drop support for Debian 10 Buster from the php_website role:

- Move some of the distribution release-specific information used in
tests into a fixture of its own. Make the code a bit cleaner/more
consistent.

MAR-191: Drop support for Debian 10 Buster from the common role:

- Fix incorrect comment on the pkg-resources/pkg_resources package as
well - this one is not distro-dependent.

MAR-191: Make tests for allowed/disallowed connections more generic:

- Use dynamic inventory to retrive the list of hosts instead of
hard-coding release names in the tests.

MAR-191: Drop Debian 10 Buster support for the backup_client role:

- Internal parameter for Python's pexpect package is no longer
required - newer versions of Debian have fully switche to using the
Python 3 version of it for duplicity.
- Fix prepare playbook task to iterate over list of backup users
instead of hard-coding the values.
- Drop the directory set-up task that seems to serve no purpose (some
leftover from previous refactoring most likely.
- Update supported version information in docs and metadata.

MAR-193: Fix deprecation warnings coming from newer versions of pip-tools:

- In more recent versions of pip-tools, a new option has been
added (--strip-extras) that will become a new default in next major
release. Not using this option causes some warnings on Debian 11
Bullseye when pip-tools is brought up to date.
- Refactor the invocation of pip-compile to make it more modular.
- No test expansion for this since it would make it a bit harder to
target both Debian 10 Buster and Debian 11 Bullseye.

MAR-193: Updated requirements file for up-to-date version of Python:

- Primarily required in order to run Gimmecert in tests.