majic-ansible-roles Changeset

Changeset - 01e9035dac41

Parent rev.

Child rev.

[Not reviewed]

0 9 0

Branko Majic (branko) - 9 months ago 2023-08-10 00:30:49
branko@majic.rs

MAR-181: Drop support for Debian 9 Stretch from mail_server role:

- Switch to using IPs from VirtualBox default allowed host-only
network subnets.
- Use Debian Buster for helper machines.
- Drop Stretch-specific code and tests.

9 files changed with 16 insertions and 172 deletions:

docs/rolereference.rst

roles/mail_server/meta/main.yml

roles/mail_server/molecule/default/group_vars/parameters-optional.yml

roles/mail_server/molecule/default/host_vars/ldap-server.yml

roles/mail_server/molecule/default/molecule.yml

roles/mail_server/molecule/default/prepare.yml

roles/mail_server/molecule/default/tests/test_default.py

roles/mail_server/molecule/default/tests/test_optional.py

roles/mail_server/templates/99-local.conf.j2

0 comments (0 inline, 0 general)

docs/rolereference.rst

➞

Show inline comments

@@ @@ -1243,7 +1243,6 @@ Distribution compatibility @@
 Role is compatible with the following distributions:
 - Debian 9 (Stretch)
 - Debian 10 (Buster)

roles/mail_server/meta/main.yml

➞

Show inline comments

@@ @@ -16,5 +16,4 @@ galaxy_info: @@
   platforms:
     - name: Debian
       versions:
         - 9
         - 10

roles/mail_server/molecule/default/group_vars/parameters-optional.yml

➞

Show inline comments

@@ @@ -33,14 +33,13 @@ mail_message_size_limit: 20480001 @@
 # Variables dependant on distribution release.
 release_based_smtp_allow_relay_from:
   stretch: "10.31.127.22"
   buster: "10.31.127.20"
   buster: "192.168.56.20"
 # common
 ca_certificates:
   testca: "{{ lookup('file', 'tests/data/x509/ca/level1.cert.pem') }}"
-# backup_client (backup username should end in -s64 for Stretch).
+# backup_client (backup username should end in -b64 for Buster).
 enable_backup: true
 backup_client_username: "bak-parameters-optional-{{ ansible_distribution_release[0] }}64"
 backup_encryption_key: "{{ lookup('file', 'tests/data/gnupg/parameters-optional.asc') }}"

roles/mail_server/molecule/default/host_vars/ldap-server.yml

➞

Show inline comments

@@ @@ -43,10 +43,6 @@ backup_host_ssh_private_keys: @@
   ecdsa: "{{ lookup('file', 'tests/data/ssh/server_ecdsa') }}"
 backup_clients:
   - server: parameters-optional-s64
     ip: 10.31.127.33
     public_key: "{{ lookup('file', 'tests/data/ssh/parameters-optional.pub') }}"
   - server: parameters-optional-b64
-    ip: 10.31.127.31
+    ip: 192.168.56.31
     public_key: "{{ lookup('file', 'tests/data/ssh/parameters-optional.pub') }}"

roles/mail_server/molecule/default/molecule.yml

➞

Show inline comments

@@ @@ -15,68 +15,12 @@ lint: @@
 platforms:
   - name: ldap-server
     box: debian/contrib-stretch64
     memory: 256
     cpus: 1
     interfaces:
       - auto_config: true
         ip: 10.31.127.10
         network_name: private_network
         type: static
   - name: client1-stretch
     groups:
       - client
       - client-relay-allowed
       - stretch
       - smtp-server-requiring-tls
     box: debian/contrib-stretch64
     memory: 256
     cpus: 1
     interfaces:
       - auto_config: true
         ip: 10.31.127.22
         network_name: private_network
         type: static
   - name: client2-stretch
     groups:
       - client
       - client-relay-forbidden
       - stretch
       - smtp-server-refusing-tls
     box: debian/contrib-stretch64
     box: debian/contrib-buster64
     memory: 256
     cpus: 1
     interfaces:
       - auto_config: true
         ip: 10.31.127.23
         network_name: private_network
         type: static
   - name: parameters-mandatory-stretch64
     groups:
       - parameters-mandatory
       - stretch
     box: debian/contrib-stretch64
     memory: 1536
     cpus: 1
     interfaces:
       - auto_config: true
         ip: 10.31.127.32
         network_name: private_network
         type: static
   - name: parameters-optional-stretch64
     groups:
       - parameters-optional
       - stretch
     box: debian/contrib-stretch64
     memory: 1536
     cpus: 1
     interfaces:
       - auto_config: true
         ip: 10.31.127.33
         ip: 192.168.56.10
         network_name: private_network
         type: static
@@ @@ -91,7 +35,7 @@ platforms: @@
     cpus: 1
     interfaces:
       - auto_config: true
-        ip: 10.31.127.20
+        ip: 192.168.56.20
         network_name: private_network
         type: static
@@ @@ -106,7 +50,7 @@ platforms: @@
     cpus: 1
     interfaces:
       - auto_config: true
-        ip: 10.31.127.21
+        ip: 192.168.56.21
         network_name: private_network
         type: static
@@ @@ -119,7 +63,7 @@ platforms: @@
     cpus: 1
     interfaces:
       - auto_config: true
-        ip: 10.31.127.30
+        ip: 192.168.56.30
         network_name: private_network
         type: static
@@ @@ -132,7 +76,7 @@ platforms: @@
     cpus: 1
     interfaces:
       - auto_config: true
-        ip: 10.31.127.31
+        ip: 192.168.56.31
         network_name: private_network
         type: static

roles/mail_server/molecule/default/prepare.yml

➞

Show inline comments

@@ @@ -26,14 +26,6 @@ @@
       with_items:
         - name: ldap-server_ldap
           fqdn: ldap-server
         - name: parameters-mandatory-stretch64_imap
           fqdn: parameters-mandatory-stretch64
         - name: parameters-mandatory-stretch64_smtp
           fqdn: parameters-mandatory-stretch64
         - name: parameters-optional-stretch64_imap
           fqdn: parameters-optional-stretch64
         - name: parameters-optional-stretch64_smtp
           fqdn: parameters-optional-stretch64
         - name: parameters-mandatory-buster64_imap
           fqdn: parameters-mandatory-buster64
         - name: parameters-mandatory-buster64_smtp
@@ @@ -74,26 +66,6 @@ @@
           - nmap
         state: present
 - hosts: stretch
   become: true
   tasks:
     - name: Set-up the hosts file
       lineinfile:
         path: /etc/hosts
         regexp: "^{{ item.key }}"
         line: "{{ item.key }} {{ item.value }}"
         owner: root
         group: root
         mode: 0644
         state: present
       with_dict:
 .31.127.10: "ldap-server backup-server"
 .31.127.22: "client1 smtp-server-requiring-tls"
 .31.127.23: "client2 smtp-server-refusing-tls"
 .31.127.32: "parameters-mandatory parameters-mandatory-stretch64"
 .31.127.33: "parameters-optional parameters-optional-stretch64"
 - hosts: buster
   become: true
   tasks:
@@ @@ -108,11 +80,11 @@ @@
         mode: 0644
         state: present
       with_dict:
 .31.127.10: "ldap-server backup-server"
 .31.127.20: "client1 smtp-server-requiring-tls"
 .31.127.21: "client2 smtp-server-refusing-tls"
 .31.127.30: "parameters-mandatory parameters-mandatory-buster64"
 .31.127.31: "parameters-optional parameters-optional-buster64"
 .168.56.10: "ldap-server backup-server"
 .168.56.20: "client1 smtp-server-requiring-tls"
 .168.56.21: "client2 smtp-server-refusing-tls"
 .168.56.30: "parameters-mandatory parameters-mandatory-buster64"
 .168.56.31: "parameters-optional parameters-optional-buster64"
 - hosts: client
   become: true

roles/mail_server/molecule/default/tests/test_default.py

➞

Show inline comments

@@ @@ -244,9 +244,7 @@ def test_postfix_delivery_to_dovecot(host): @@
     with host.sudo():
         mail_log = host.file('/var/log/mail.log')
         # The (<\d+><.+?>)? pattern is for difference between Debian
         # Stretch and Debian Buster log format.
         pattern = r"dovecot: lda\(john.doe@domain1\)(<\d+><.+?>)?: msgid=<%s>: saved mail to INBOX" % message_id
         pattern = r"dovecot: lda\(john.doe@domain1\)<\d+><.+?>: msgid=<%s>: saved mail to INBOX" % message_id
         assert re.search(pattern, mail_log.content_string) is not None
@@ @@ -621,61 +619,6 @@ def test_smtp_default_port_tls_version_and_ciphers(host): @@
     expected_tls_versions = ["TLSv1.0", "TLSv1.1", "TLSv1.2"]
     expected_tls_ciphers = {
         "stretch": [
             "TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
             "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
             "TLS_DHE_RSA_WITH_AES_128_CCM",
             "TLS_DHE_RSA_WITH_AES_128_CCM_8",
             "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
             "TLS_DHE_RSA_WITH_AES_256_CBC_SHA",
             "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
             "TLS_DHE_RSA_WITH_AES_256_CCM",
             "TLS_DHE_RSA_WITH_AES_256_CCM_8",
             "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
             "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA",
             "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256",
             "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA",
             "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256",
             "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
             "TLS_DHE_RSA_WITH_SEED_CBC_SHA",
             "TLS_DH_anon_WITH_AES_128_CBC_SHA",
             "TLS_DH_anon_WITH_AES_128_CBC_SHA256",
             "TLS_DH_anon_WITH_AES_128_GCM_SHA256",
             "TLS_DH_anon_WITH_AES_256_CBC_SHA",
             "TLS_DH_anon_WITH_AES_256_CBC_SHA256",
             "TLS_DH_anon_WITH_AES_256_GCM_SHA384",
             "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA",
             "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256",
             "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA",
             "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256",
             "TLS_DH_anon_WITH_SEED_CBC_SHA",
             "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
             "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
             "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
             "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
             "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
             "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
             "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256",
             "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384",
             "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
             "TLS_ECDH_anon_WITH_AES_128_CBC_SHA",
             "TLS_ECDH_anon_WITH_AES_256_CBC_SHA",
             "TLS_RSA_WITH_AES_128_CBC_SHA",
             "TLS_RSA_WITH_AES_128_CBC_SHA256",
             "TLS_RSA_WITH_AES_128_CCM",
             "TLS_RSA_WITH_AES_128_CCM_8",
             "TLS_RSA_WITH_AES_128_GCM_SHA256",
             "TLS_RSA_WITH_AES_256_CBC_SHA",
             "TLS_RSA_WITH_AES_256_CBC_SHA256",
             "TLS_RSA_WITH_AES_256_CCM",
             "TLS_RSA_WITH_AES_256_CCM_8",
             "TLS_RSA_WITH_AES_256_GCM_SHA384",
             "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA",
             "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256",
             "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA",
             "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256",
             "TLS_RSA_WITH_SEED_CBC_SHA",
         ],
         "buster": [
             'TLS_DHE_RSA_WITH_AES_128_CBC_SHA',
             'TLS_DHE_RSA_WITH_AES_128_CBC_SHA256',

roles/mail_server/molecule/default/tests/test_optional.py

➞

Show inline comments

@@ @@ -62,9 +62,7 @@ def test_local_aliases(host): @@
     with host.sudo():
         mail_log = host.file('/var/log/mail.log')
         # The (<\d+><.+?>)? pattern is for difference between Debian
         # Stretch and Debian Buster log format.
         pattern = r"dovecot: lda\(john.doe@domain1\)(<\d+><.+?>)?: msgid=<%s>: saved mail to INBOX" % message_id
         pattern = r"dovecot: lda\(john.doe@domain1\)<\d+><.+?>: msgid=<%s>: saved mail to INBOX" % message_id
         assert re.search(pattern, mail_log.content_string) is not None

roles/mail_server/templates/99-local.conf.j2

➞

Show inline comments

@@ @@ -31,13 +31,7 @@ service auth { @@
 # TLS configuration.
 ssl_cert = </etc/ssl/certs/{{ ansible_fqdn }}_imap.pem
 ssl_key = </etc/ssl/private/{{ ansible_fqdn }}_imap.key
 {% if ansible_distribution_release == "stretch" %}
 ssl_dh_parameters_length = 2048
 {% elif ansible_distribution_release == "buster" %}
 ssl_dh=</etc/ssl/private/{{ inventory_hostname }}_imap.dh.pem
 {% else %}
 {{ unsupported_distribution_release }}
 {% endif %}
 ssl_protocols = {{ mail_server_tls_protocols | join(' ') }}
 ssl_cipher_list = {{ mail_server_tls_ciphers }}
 ssl = required

0 comments (0 inline, 0 general)