Changelog - showing 100 out of 268 revisions
revisions
Branch filter:
branko 9b97210fd352
9 years ago
MAR-93: Preparing for release 1.4.0.
1.4.0
branko 8548876c068b
9 years ago
MAR-90: Updated testsite to include the two new configuration options (to make sure they are applied correctly).
branko 0426b42179d3
9 years ago
MAR-90: Fixed syntax for specifying TLS protocol in Nginx configuration file.
branko f79cc0281c7c
9 years ago
MAR-90: Fixed syntax for specifying TLS protocol in Dovecot configuration file.
branko 6bc64e4e9c35
9 years ago
MAR-90: Added configuration options for the web_server role for specyfing TLS versions and ciphers to support on the server.
branko f344ed6181a9
9 years ago
MAR-90: Fixed small typo in documentation for ldap_server role. Added configuration parameters for the mail_server role for specifying TLS protocols and ciphers.
branko 430eb250e244
9 years ago
MAR-90: Added option to ldap_server role for specifying TLS version/ciphers. Updated role reference documentation. Update usage instructions to mention the TLS ciphers/versions are configurable.
branko 111e954e826d
9 years ago
MAR-89: Implemented mail_server role parameter for specifying maximum number of IMAP connections a single user can have from single IP address.
branko ced76d02b757
9 years ago
Noticket: Bumping version to 1.3-dev (switching back to development).
branko c96db74be6f8
9 years ago
MAR-87: Preparing for release 1.3.0.
1.3.0
branko f454072704fa
9 years ago
MAR-88: Include /etc/shadow, /var/mail, and /var/spool/cron/ in back-ups of common role.
branko 2284f8fa383a
9 years ago
MAR-86: Once explicitly configured static locations have been exhausted, direct any further requests to WSGI application. I.e. do not serve files from document root unless explicitly configured.
branko 7977a2033d9a
9 years ago
Noticket: Fixed ldap_permissions module - if no olcAccess rules are defined, assume empty list (otherwise we get key lookup exception).
branko 3a9692d96170
9 years ago
Noticket: Fixed myhostname setting in Postfix configuration for mail_server and mail_forwarder roles.
branko 7df70ebc439c
9 years ago
MAR-85: Updated all role firewall deployment rules to cover IPv6 in addition to IPv4. Update instructions to make it clear that an additional Python package is required.
branko b9979765e3a6
9 years ago
Noticket: Bumping version to 1.2-dev (switching back to development).
branko 02686b6dcfc0
9 years ago
MAR-84: Preparing for release 1.2.0. Updated years in copyright notices.
1.2.0
branko 4f7054d023b6
9 years ago
MAR-82: Make sure environment indicator is always on top of other elements by having ridiculously high z-index value.
branko 67dd87d59abb
9 years ago
MAR-83: Added support to wsgi_website role for specifying headers that should be passed on to Gunicorn by Nginx. Updated hello.wsgi app to demonstrate the feature.
branko ed4b840fdf74
9 years ago
Noticket: Bumping version to 1.1-dev (switching back to development).
branko dadb5ff14c84
9 years ago
MAR-81: Preparing for release 1.1.0.
1.1.0
branko 4f66faab0b48
9 years ago
MAR-72: Update usage instructions, user does not need to create symbolic link by hand anymore.
branko c120dfad296f
9 years ago
MAR-78: Fixed default values for local_mail_aliases in mail_server and mail_forwareder roles (should've been empty dict, not empty list).
branko 0ec59430e00c
9 years ago
MAR-70: Updated testsite to include environment indicator. Updated the sample WSGI app role to output minimalistic HTML page (instead of text as it used to do until now).
branko 4ca98a158269
9 years ago
MAR-70: Implemented support for having environment indicator on all HTML pages in wsgi_website and php_website roles.
branko 4a3c8915f967
9 years ago
MAR-80: Added support to wsgi_website and php_website roles to specify list of e-mails or accounts that should receive mails delivered to role's administrator/application users. Updated application users in both roles to use same home directory as the admin. Added .keep file for docs/_static in order to avoid warnings when building documentation.
branko 3bd270c9e860
9 years ago
MAR-78: Implement ability to specify local mail aliases in the mail_server role.
branko 13fd27e4004c
9 years ago
MAR-79: Update mail_forwarder role to allow incoming connections to SMTP port from SMTP relay (if configured). Don't verify SMTP TLS server certificate if delivering mails directly.
branko 7c58a0eb0e5a
9 years ago
MAR-77: Updated mail_server role to deliver undeliverable bounces to postmaster.
branko 4dc3b09894e9
9 years ago
MAR-69: Introduced configuration option to php_website for providing additional PHP FPM settings. Updated testsite phpinfo role to use it. Updated usage and role reference documentation.
branko b757d690af42
9 years ago
MAR-75: Implemented support for specifying additional environment variables for the wsgi_website role. Environment is set-up for both the systemd service and for application admin user. Updated testsite implementation to use it for sample WSGI website.
branko db91799cc8fa
9 years ago
MAR-72: Set-up symbolic link for mysql_config pointing to mariadb_config when installing the libmariadb-client-lgpl-dev-compat package via common, php_website, or wsgi_website roles. Mainly useful when installin MySQL-python in wsgi_website role, but added in all three places for completeness.
branko 3352797ee517
9 years ago
MAR-68: When enforcing TLS in web_server, wsgi_website, or php_website roles, send connecting clients proper HSTS policy via Strict-Transport-Security header.
branko 483065c6c24f
9 years ago
MAR-67: Replace the stock root's .bashrc with skeleton one. Don't touch the file if it does not match default file shipped with distro.
branko e15b53d59517
9 years ago
MAR-67: Deploy /etc/profile.d/ configuration file that allows reading user-specific profile config files from ~/.profile.d/ directory. Create home directory for web application users in order to get all the fancy colouring etc. Deploy virtual environment activation script inside of wsgi_website role as profile.d script.
branko a40cf7a468ea
9 years ago
MAR-66: Create web application users with GECOS field that sets their umask to 0007 (this happens thanks to pam_umask).
branko 9f9dbcb79909
9 years ago
MAR-74: Restart the WSGI applications when related packages are getting updated (in order to run against latest version of a package).
branko 6d38fef46832
9 years ago
MAR-71: Add back the handler for updating CA certificate cache. It is still useful thing to run as a handler (when using -t handlers -e handlers=yes).
branko 19b15357124a
9 years ago
MAR-76: Restart MariaDB immediatelly after defaulting to using UTF-8 character encoding in order to avoid issues with databases and tables being create with wrong encoding. Handler would not help since it runs at the end of current play.
branko 6c256b0514cf
9 years ago
MAR-71: Update the CA certificate cache in the common role immediatelly instead as a handler. Solves issues where certificate validation is performed during the inital run of different roles (handler would run at the end of playbook). Removed unused handler for updating the CA certificate cache.
branko 91f1fe045f28
9 years ago
MAR-73: Fixed the virtualenv wrapper script in wsgi_website role to properly escape arguments.
branko a717a6ccd782
9 years ago
MAR-65: Disable Emacs electric-indent-mode by default via common role (if Emacs is installed via common_packages).
branko 152b18777513
9 years ago
MAR-62: Removed TLS hardening from xmpp_server role in order to avoid incompatibilities during s2s communication.
branko c75a8ee52cb8
9 years ago
MAR-61: Bumping version to 1.0-dev (switching back to development).
branko 71a306678e09
9 years ago
MAR-61: Preparing for release 1.0.0.
1.0.0
branko afc2e98bcd39
9 years ago
MAR-60: Removed an outdated warning from usage instructions. Use real command for running handlers in the usage instructions (one that would work with usage site).
branko 987fea84e131
9 years ago
MAR-60: Revert to using Ansible 1.9.x due to bugs present in Ansible 2.0.x and 2.1.x. Only documentation needed changes, the implementation is otherwise backwards-compatible with 1.9.x.
branko e0c1f4e07f07
9 years ago
Noticket: Fix ownership for some files deployed by the phpinfo and wsgihello roles.
branko 96b84032cb00
9 years ago
Noticket: No need to add the website admin to user group, this is the admin's main group anyway. Do not define admin variable for testsite wsgihello role."
branko 32f61f233098
9 years ago
Noticket: Fixed documentation and examples for CA certificate deployment in common role. Fixed usage instructions, mainly some syntax changes and more explicit listing of parameters and such. Fixed path to truststore file for mail_forwarder role. Fixed testsite configurtion for CA certificates.
branko 3af07319e2f3
9 years ago
MAR-59: Removed ability to specify admin user for php_website and wsgi_website roles. Updated testsite and usage instructions. Updated role reference.
branko 05bbc00281d8
9 years ago
MAR-58: Fixed another spot where old version of Ansible was mentioned in docs.
branko f9416ce2b72f
9 years ago
MAR-58: Updated Ansible versioning information in documentation. Updated deprecated syntax in usage instructions.
branko 922cda0a1834
9 years ago
MAR-58: Updated roles, LDAP modules, and test site to be compatible with Ansible 2.0.x and 2.1.x. Switched from using sudo/sudo_user to become/become_user. Fixed referencing of variables within roles, mainly for with_items/with_dicts calls. Improved handling of options in ldap_entry module to avoid deprecation of passing dict-like arguments to ldap_entry module. Minor fix to ldap_permissions module.
branko f4e9cd36dad4
9 years ago
MAR-57: Implemented customisation of bash shell prompt as part of the common role.
branko cd445c47c4bf
9 years ago
MAR-56: Fixing an issue with invalid option for ClamAV Milter (seems like it got removed in the Debian package for some reason).
branko b2cbf5050e57
9 years ago
MAR-56: Separated backup pattern assembly into a separate role in order to reduce number of tasks that run during each run, and to make the whole thing more consistent/modular. Updated usage and reference documentation.
branko 97be416e882e
9 years ago
MAR-56: Set-up slapd to listen on legacy TLS port. Fixed ClamAV tasks used for waiting for ClamAV database to be donwloaded. Fixed some handling of rewrite rules for the PHP websites.
branko 5a15eda01800
9 years ago
MAR-56: Wait for freshclam to download the initial ClamAV database in mail_server role. Make it possible to specify Gunicorn version in the wsgi_website role (and also install the required futures package now). Clarify the parameter for wsgi_application in wsgi_website role should be relative to code sub-directory. Simplify how roles are specified as deps in order to avoid reruns of shared roles in Ansible 1.9.x (for the non-parametrised/singleton roles, that is). Set correct prompt for virtual environments created in wsgi_website.
branko 1b05bae8e440
9 years ago
MAR-56: Added LDIF templates to docs for relevant roles. Added warning about freshclam/clamav service restart during initial install (need to be restarted). Switched some TLS truststore vars to use concerete values. Introduced option for specifying additional Nginx config options. Added docs for some params. Assmeble Duplicity include pattern when needed. Don't set passwords for existing system users. Fix permissions for database users to be more restrictive. Fixed a couple of default param definitions (mainly tls cert/key stuff). Updated URL for downloading Prosody LDAP plugin. Updated testsite configs.
branko 7387caca37f3
10 years ago
MAR-51: Introduced ability to only run the handlers for each role. May help with inconsitencies due to failed runs.
branko 18cd76ec050d
10 years ago
MAR-51: Replaced referencing of local files for TLS keys and certificates with actual values. Documentation has been updated throughout to reflect this in both role reference and usage instructions.
branko 61e6cfb81789
10 years ago
MAR-51: Fixed documentation for ansible_key parameter in preseed role. Updated ca_certificates parameter in common role to accept key-value pairs of filenames and certificates to put on remote host (so lookups/inventory can be utilised in more flexible manner). Updated backup_client role to fail if it is not possible to extract encryption key IDs from deployed keys. Moved purging of Exim4 configuration files from handlers to tasks (more robust, and still idempotent). All documentation has been updated as well.
branko a9e97d3e2306
10 years ago
MAR-54: Separated SMTP ports for server-to-server comms and user mail submission, allowing authentication only on port 587 (port 25 purely for server-to-server communication). Hardened TLS configuration on port 587.
branko 6ac610bd3314
10 years ago
MAR-55: Accept incoming connections to port 636 on LDAP server.
branko 1a2f50dfce57
10 years ago
MAR-49: Reworded role reference info about TLS hardening a bit. Implemented TLS hardening for the mail server role (Dovecot only, Postfix would require some additional work for service separation).
branko 5d6cebe35306
10 years ago
MAR-49: Implemented TLS hardening for XMPP server role.
branko 3907a5157ef8
10 years ago
MAR-49: Implemented TLS hardening for the LDAP server role.
branko 9767536963e6
10 years ago
MAR-49: Implemented TLS hardening for web server role.
branko dfb91e411e40
10 years ago
MAR-46: Intorduced additional options to web server, PHP website, and WSGI website roles for controling if HTTPS access is enforced (HTTP redirected to HTTPS) or not. Defaults to enforcing HTTPS now. Updated docs for the new parameters.
branko 680d322cf8cc
10 years ago
MAR-47: Added role dependency description to the role reference documentation. Added database_server role as dependency for the database role.
branko 14bb6b065c0c
10 years ago
MAR-47: Updated role dependencies.
branko e25e0902d95c
10 years ago
MAR-48: Fixed creation of directories (forgot to use the item variable).
branko f1da206cd88e
10 years ago
MAR-52: Renamed the web server parameters for TLS. Updated the docs for the role reference to make it clearer what the key/cert is used for.
branko 0bab7aaa84d6
10 years ago
MAR-48: Fixed creation and handling of web server directories where unix sockets are created for PHP5 FPM and WSGI apps. Improved some permissions while at it.
branko a561d73e3242
10 years ago
MAR-45: Introduced workaround for broken handling of SysV init scripts by systemctl is-enabled command.
branko e6d00cec4195
10 years ago
MAR-44: Allow duplicates for the backup client role.
branko 7742feee3781
10 years ago
MAR-44: Updated the name of backup_client parameter to be more clear (backup_patterns_name to backup_patterns_filename). Removed unused handler from backup clients role.
branko d5252677bcb0
10 years ago
MAR-44: Updated roles depending on backup_client role to use the new design (where only backup patterns are provided to the dependant backup_client role).
branko de825c5e17de
10 years ago
MAR-44: Redisgned how backup client handles backup pattern deployment. Introduce a list parameter for this purpose to the role. Updated docs.
branko aa76fae1cf25
10 years ago
MAR-44: Added usage instructions for the backup roles. Also fixed a couple of errors in existing usage instructions, and included some changes related to addition of a backup server.
branko 79aa82273952
10 years ago
MAR-44: Document pre-backup scripts for backup_client role. Use static prefix for the backup pattern file for databases.
branko 0d7fd6fb319b
10 years ago
MAR-44: Expanding usage to include set-up of backup server. Currently no special role set-up, just the preparation of server.
branko c161524058d5
10 years ago
MAR-44: Updated testsite documentation, mostly small tweaks. Include backup server itself as backup client (backing-up logs and the like).
branko c6f217756635
10 years ago
MAR-44: Redesigned handling of private keys by the backup_client role. Keys are now provided directly, not as key identifiers to be looked-up in the backup keyring.
branko d61d01c00362
10 years ago
MAR-44: Redesigned usage of GnuPG keys used by the backup_client role. Now one must provide encryption key, signing key (both have to be private, and will be transfered to host), and can optionally provide additional public keys to use for encryption. Updated example.
branko 5e15f8ca16fc
10 years ago
MAR-44: Moved away from crontab for database backups to pre-backup commands for better reliability. Fixed command for collecting the encryption keys.
branko 0f817823bed7
10 years ago
MAR-44: Implemented backup support for the common role. Includes back-up of logs and (regular) home directories.
branko b668f8894d52
10 years ago
MAR-44: Implemented backup support for the database role.
branko f05039c7d383
10 years ago
MAR-44: Implemented backup support for the mail server role.
branko dbc3381e1ff3
10 years ago
MAR-44: Implemented backup support for the XMPP server role. Updated test site to include XMPP server as one of the backup clients.
branko 881a85f08e22
10 years ago
MAR-44: Added another global parameter for controlling deployment of backup configs for roles. Implemented backup support for the LDAP server role. Updated testsite configuration, moving the backup configuration to be global.
branko 3686169e9565
10 years ago
MAR-44: Set-up crontab to run backups at 02:00 every day in backup client role. Updated role reference documentation for backup client role. Updated test site set-up instructions. Updated testsite configuration for backup client/server to use domain parameters. Enabled backup client role for the web server.
branko c4113608aa36
10 years ago
MAR-44: Added role reference documentation for the backup_client role. Added role reference examples for the backup_server role.
branko 3498d77cad32
10 years ago
MAR-44: Use a number of convenient default values for certain parameters for backup_client role. Make sure signing key is not configured/deployed if not defined. Make the target for backup storage a bit more flexible/configurable. Extract the 8-character hex key ID for configuing the duplicity signing key in backup client role. Updated handling of key deployment/import to make it a bit more robust.
branko a45dcc06530a
10 years ago
MAR-44: Updated gitignore to exclude the backup GnuPG keyring from the testsite. Added initial backup client implementation. Updated the testsite configuration for backup server to use realistic IP addresses for clients.
branko 500658358454
10 years ago
MAR-44: Added backup server implementation. Updated testsite to include deployment of dedicated backup server. Documented the backup server implementation (except for usage instructions).
branko a77fff9fcd91
10 years ago
MAR-43: Deploy information about project home directory in the Python virtual environment. This makes things more convenient when using virtualenv wrapper.
branko 819d02d81946
10 years ago
MAR-42: make sure the protocol used (http/https) is passed-on to the WSGI application. This is important in order to generate proper redirects and URLs from within the WSGI application.
branko d73446661f9c
10 years ago
MAR-18: Minor corrections to usage instructions, rephrasing, and small enhancements.
This site is powered by Kallithea 0.7.0, which is © 2010–2025 by various authors & licensed under GPLv3.