MAR-164: Harden the c2s TLS configuration for the XMPP server role:

- Updated the xmpp_server role.
- Added (optional) xmpp_server_tls_protocol and
xmpp_server_tls_ciphers parameters for specifying the desired
TLS protocol version and ciphers for the c2s connections.
- Updated XMPP server configuration to introduce separate TLS
configuration for the s2s and c2s (legacy included) connections.
- Drop support for Prosody 0.9 since it is not possible to have
separate TLS configuration for c2s and s2s connections.
- Updated role reference documentation.

MAR-158: Update default TLS ciphers configuration in the mail_server role:

- Updated the default value for parameter mail_server_tls_ciphers.
- Updated tests, making them explicitly test for enabled and disabled
ciphers.
- Refactored tests for TLS to use nmap ssl-enum-ciphers script for
listing available TLS versions and ciphers.
- Install nmap as part of preparation step.
- Updated role reference documentation.

MAR-158: Refactor ldap_server TLS-related tests to use nmap:

- Updated requirements to include defusedxml for safe parsing of XML
reports from nmap.
- Install nmap as part of preparation step.
- Refactored tests for TLS to use nmap ssl-enum-ciphers script for
listing available TLS versions and ciphers.

MAR-158: Update default TLS ciphers configuration in the ldap_server role:

- Updated the default value for parameter ldap_tls_ciphers.
- Updated tests, making them explicitly test for enabled and disabled
ciphers
- Updated role reference documentation.

MAR-158: Extended TLS cipher tests for web_server role for optional parameters:

- Extend the existing tests to cover both enabled and disabled
ciphers.
- Deduplicate list of all available ciphers for both testing of
mandatory and optional parameters.

MAR-158: Update default TLS cipher configuration in the web_server role:

- Updated the default value for parameter web_server_tls_ciphers.
- Updated tests, making them explicitly test for enabled and disabled
ciphers.
- Updated role reference documentation.

MAR-158: Deduplicate tests in web server role:

- Deduplicate test for certificate validity check configuration
deployment.
- Deduplicate test for checking if TLS is enabled or not.

MAR-158: Split-up the TLS tests for web_server role:

- Better separation for testing individual properties of TLS
configuration (whether it's enabled, what protocols are enabled, and
finally enabled ciphers).

MAR-150: Use fixtures for X.509 artefacts in the xmpp_server role:

- Removed the statically generated artefacts.
- Generate X.509 artefacts for tests using Gimmecert.
- Updated paths to point to generated artefacts.
- Introduced cleanup playbook for removing generated artefacts.

MAR-150: Use fixtures for X.509 artefacts in the wsgi_website role:

- Removed the statically generated artefacts.
- Generate X.509 artefacts for tests using Gimmecert.
- Updated paths to point to generated artefacts.
- Introduced cleanup playbook for removing generated artefacts.

MAR-150: Use fixtures for X.509 artefacts in the web_server role:

- Removed the statically generated artefacts.
- Generate X.509 artefacts for tests using Gimmecert.
- Updated paths to point to generated artefacts.
- Introduced cleanup playbook for removing generated artefacts.

MAR-150: Use fixtures for X.509 artefacts in the php_website role:

- Removed the statically generated artefacts.
- Generate X.509 artefacts for tests using Gimmecert.
- Updated paths to point to generated artefacts.
- Introduced cleanup playbook for removing generated artefacts.

MAR-150: Use fixtures for X.509 artefacts in the mail_server role:

- Removed the statically generated artefacts.
- Generate X.509 artefacts for tests using Gimmecert.
- Updated paths to point to generated artefacts.
- Introduced cleanup playbook for removing generated artefacts.
- Increase allocated RAM for the mail server to avoid OOM and
swapping.

MAR-150: Use fixtures for X.509 artefacts in the mail_forwarder role:

- Removed the statically generated artefacts.
- Generate X.509 artefacts for tests using Gimmecert.
- Updated paths to point to generated artefacts.
- Introduced cleanup playbook for removing generated artefacts.

MAR-150: Use fixtures for X.509 artefacts in the ldap_server role:

- Removed the statically generated artefacts.
- Generate X.509 artefacts for tests using Gimmecert.
- Updated paths to point to generated artefacts.
- Introduced cleanup playbook for removing generated artefacts.

MAR-150: Refactor the common role tests fixture handling:

- Use the cleanup playbook for removing the X.509 generated
keys/certificates.
- Drop the fixture.yml playbook, and include it inside of prepare
playbook (reduce unnecessary nesting).

MAR-150: Refactor the test for deployed CA certificates in common role:

- Use parametrisation to reduce code duplication.

MAR-150: Use Gimmecert for X.509 test fixtures in the common role:

- Drop the statically-generated X.509 certificates used for testing.
- Introduce fixture playbook in preparation phase that sets-up the
necessary certificates.
- Update the tests to use the fixture.
- Dynamically calculate the OpenSSL hash for CA certificate instead of
having the hard-coded value.
- Add the fixture artefacts to .gitignore files.

MAR-162: Updated usage instructions:

- Create directory for storing TLS artefacts during base set-up of
control machine.
- Use full paths to TLS artefacts for parameters.
- Fix the name of TLS parameters for the XMPP server role.

MAR-162: Make the smtp_relay_truststore parameter mandatory in mail_forwarder role:

- Dropped the defaults from mail_forwarder role.
- Updated group variables in role tests.
- Updated role reference documentation.
- Updated usage instructions to include the mandatory parameter.
- Deduplicated tests for the TLS files.

MAR-162: Make the xmpp_tls_certificate and xmpp_tls_key parameters mandatory in xmpp_server role:

- Dropped the defaults from wsgi_server role.
- Updated group variables in role tests.
- Changed the key/certificate file extensions to be more descriptive.
- Updated role reference documentation.
- Updated usage instructions to include the mandatory parameters.
- Deduplicated tests for the TLS files.

MAR-162: Make the https_tls_certificate and https_tls_key parameters mandatory in wsgi_website role:

- Dropped the defaults from wsgi_server role.
- Updated group variables in role tests.
- Changed the key/certificate file extensions to be more descriptive.
- Updated role reference documentation.
- Updated usage instructions to include the mandatory parameters.

MAR-162: Make the https_tls_certificate and https_tls_key parameters mandatory in php_website role:

- Dropped the defaults from php_server role.
- Updated group variables in role tests.
- Changed the key/certificate file extensions to be more descriptive.
- Updated role reference documentation.
- Updated usage instructions to include the mandatory parameters.

MAR-162: Make the default_https_tls_certificate and default_https_tls_key parameters mandatory:

- Dropped the defaults from web_server role.
- Updated group variables in role tests.
- Changed the key/certificate file extensions to be more descriptive.
- Updated role reference documentation.
- Updated usage instructions to include the mandatory parameters.

MAR-162: Make the mail_ldap_tls_truststore, imap_tls_key, imap_tls_certificate, smtp_tls_key, and smtp_tls_certificate parameters mandatory:

- Dropped the defaults from mail_server role.
- Updated group variables in role tests.
- Changed the key/certificate file extensions to be more descriptive.
- Updated role reference documentation.
- Updated usage instructions to include the mandatory parameters.

MAR-162: Deduplicate TLS private key/certificate tests for LDAP server role:

- Rename the key/certificate files to match the Ansible inventory
name.
- Move the tests into test_default.py.
- Change the key/certificate extensions to be more descriptie.

MAR-162: Make the ldap_server_tls_certificate ldap_server_tls_key parameters mandatory:

- Updated release notes.
- Updated role reference documentation.
- Updated usage instructions to cover set-up of CA hierarchy earlier on
in the process.

MAR-153: Updated role reference documentation and release notes:

- Marks the change as breaking because it could mean older
client/servers cannot interoperate with the Majic Ansible Roles TLS
services any longer.

MAR-149: Update requirements to Molecule 2.22:

- Updated requirements to use Molecule 2.22.
- Updated requirements to include pip and setuptools (to avoid
breakages related to use of pip-tools).

MAR-149: Updated usage documentation:

- Add warning that Majic Ansible Roles support only Python 3.
- Updated the Django Wiki deployment to use Python 3.
- Upgraded the Django Wiki deployment for use with Python 3.
- Removed one stale warning regarding compat links for MariDB devel
files (leftover from Jessie).

MAR-149: Improved documentation for the test site (more details):

- Cover server names.
- Cover additional names that should be resolvable towards the web
server (for reaching sample web applications)
- Include links for testing the sample web applications.

MAR-149: Minor syntax fixes for Python 3 in tests for common role:

- Do not use the unicode function (this still might break, need to
test it).
- Fix syntax used for catching exceptions within variables.
- Fix one small linting error related to row length.

MAR-149: Switch to using File.content_string instead of File.content in tests for all roles:

- The .content variant returns contents as bytes, while the
content_string returns a string (which is what is wanted in
practically all cases).

MAR-152: Revert path change for LDAP server unix socket test:

By default OpenLDAP server opens unix socket to listen on at
/var/run/slapd/ldapi, and this is what netstat will list as a
path (with e.g. netstat -xl).

Testinfra in turn relies on netstat output, and therefore a canonical
path has to be used. This might change in next release (Buster),
though - since Debian is trying to transition all applications to use
/run instead of /var/run.

MAR-152: Fix idempotence issues with web_server role:

- Reload configuration of PHP-FPM to ensure changes are picked-up.
- Install base packages for PHP applications prior to creating the
directory containing unix socket files (so the package installation
would not change them back).

MAR-152: Update documentation regarding removal of support for Debian 8 Jessie:

- Updated introductory information about the project.
- Removed references to Debian 8 Jessie from documentation.
- Updated release notes.

MAR-152: Drop a couple of references to Debian 8 Jessie from multiple roles:

- Mark workaround as TODO entry (so maybe it can get fixed at some
point.
- Drop SSH known hosts entries in tests for backup_server role.
- Fix some erroneous comments in tests for mail_server
role (references to Debian 8 Jessie).
- Drop reference to Debian 8 Jessie from the preseed file template.

MAR-152: Drop support for Debian 8 Jessie from the backup_client role:

- Simplify the invocation of GnuPG commands (since we don't have to
massage output formats depending on distribution version anymore).

MAR-152: Refactor tests for mail_forwader relay testing:

- Mark the helper machines in the Ansible inventory.
- Parametrise the tests to make adding future servers easier (e.g. do
not use specific hostnames in tests).
- Break-up relay test to be more specific (also to be able to
parametrise properly).