Release notes

=============

x.y.z

-----

Dropped support for Debian 10 (Stretch), alongside changes required to

run applications using Debian-only repositories.

**Breaking changes:**

* All roles

  * Dropped support for Debian 10 (Stretch).

* ``xmpp_server`` role

  * Parameter ``xmpp_prosody_package`` has been dropped.

**New features/improvements**

* ``xmpp_server`` role

  * Drop dependency on the external (Prosody) package

    repository. Install everything using official Debian

    repositories. This should help avoid future issues with Prosody

    project removing older versions of packages or dropping entire

    repository archives for older Debian releases.

  * Prosody package and some of its dependencies are installed from

    Debian backports to get more featureful release installed.

6.0.0

-----

Added support for Debian 10 (Buster), alongside a couple of minor

changes and features/improvements.

**Breaking changes:**

* ``ldap_server`` role

  * Use 2048-bit Diffie-Hellman parameters for relevant TLS

    ciphers. This could introduce incompatibility with older

    clients/servers trying to connect to the LDAP server. This change

    is applicable only under Debian Buster.

**New features/improvements:**

* All roles

  * Added support for Debian 10 (Buster).

* ``common`` role

  * Added parameters ``maintenance`` and ``maintenance_allowed_hosts``

    for enabling maintenance mode. In maintenance mode only the listed

    hosts are allowed to connect to the server.

**Bug fixes:**

* ``ldap_server`` role

  * Allow use of DHE TLS ciphers by generating the necessary

    Diffie-Hellman parameters. This bug fix is applicable only under

    Debian Buster.

* ``wsgi_website_`` role

  * When the virtual environment is created, the ``setuptools`` and

    ``pip`` packages will not get pinned to any specific version,

    allowing roles that are based on ``wsgi_website`` to easily

    install preferred versions, and avoid idempotence problems in the

    process.

5.0.0

-----

import os

import testinfra.utils.ansible_runner

testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(

    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('parameters-*')

testinfra_hosts += testinfra.utils.ansible_runner.AnsibleRunner(

    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('deprecated')

def test_supporting_packages_installed(host):

    """

    Tests if all the necessary supporting packages have been

    installed.

    """

    assert host.package('python-apt').is_installed

    assert host.package('lua-ldap').is_installed

def test_prosody_user(host):

    """

    Tests if Prosody user has been set-up correctly to access TLS material.

    """

    assert 'ssl-cert' in host.user('prosody').groups

def test_prosody_modules_directory(host):

    """

    Tests if directory for storing additional Prosody modules is set-up

    correctly.

    """

    directory = host.file('/usr/local/lib/prosody/modules')

    assert directory.is_directory

    assert directory.user == 'root'

    assert directory.group == 'root'

    assert directory.mode == 0o755

def test_prosody_mod_auth_ldap(host):

    """

    Tests if Prosody module mod_auth_ldap has been deployed correctly.

    """

    module = host.file('/usr/local/lib/prosody/modules/mod_auth_ldap.lua')

    assert module.is_file

    assert module.user == 'root'

    assert module.group == 'root'

    assert module.mode == 0o644

    assert 'module:provides("auth", provider);' in module.content_string

    assert 'mod_auth_ldap' in module.content_string

def test_prosody_configuration_file(host):

    """

    Tests if Prosody configuration file has correct permissions.

    """

    with host.sudo():

        config = host.file('/etc/prosody/prosody.cfg.lua')

def test_prosody_certificate_checker_crontab(host):

    """

    Tests if crontab entry has been deployed for running the Prosody

    certificate checker script.

    """

    crontab = host.file('/etc/cron.d/check_prosody_certificate')

    assert crontab.is_file

    assert crontab.user == 'root'

    assert crontab.group == 'root'

    assert crontab.mode == 0o644

    assert "MAILTO=root" in crontab.content_string

    assert "/usr/local/bin/check_prosody_certificate.sh" in crontab.content_string

def test_backports_repository(host):

    """

    Tests if the backports repository has been configured.

    """

    repository = host.file("/etc/apt/sources.list.d/backports.list")

    distribution_release = host.ansible("setup")["ansible_facts"]["ansible_distribution_release"]

    expected_content = "deb http://deb.debian.org/debian %s-backports main" % distribution_release

    assert repository.is_file

    assert repository.user == "root"

    assert repository.group == "root"

    assert repository.mode == 0o644

    assert repository.content_string.rstrip() == expected_content

def test_backports_prosody_pinning(host):

    """

    Tests if the backports pin for Prosody has been deployed correctly.

    """

    pin = host.file("/etc/apt/preferences.d/prosody")

    assert pin.is_file

    assert pin.user == "root"

    assert pin.group == "root"

    assert pin.mode == 0o644

    prosody_package = host.package("prosody")

    lua_ldap_package = host.package("lua-sec")

    assert "bpo" in prosody_package.version

    assert "bpo" in lua_ldap_package.version

# @TODO: Tests which were not implemented due to lack of out-of-box tools:

#

# - Proxy capability.

# - MUC.

# - Server administration through XMPP.

  when: backports_repository_configuration.changed

- name: Configure package pins to backports for Prosody

  template:

    src: prosody_backports_pin.j2

    dest: /etc/apt/preferences.d/prosody

    owner: root

    group: root

    mode: 0644

- name: Collect information about installed packages

  package_facts:

- name: Uninstall Prosody from project-provided repository

  apt:

    name: prosody

    state: absent

  when:

    - "ansible_facts.packages['prosody'] is defined"

    - "'nightly' in ansible_facts.packages['prosody'][0].version"

- name: Uninstall Prosody dependencies from project-provided repository

  apt:

    name:

      - lua-expat

      - lua-filesystem

      - lua-sec

      - lua-socket

    state: absent

  when: >-

    (ansible_facts.packages['lua-expat'] is defined and 'prosody' in ansible_facts.packages['lua-expat'][0].version)

    or (ansible_facts.packages['lua-filesystem'] is defined and 'prosody' in ansible_facts.packages['lua-filesystem'][0].version)

    or (ansible_facts.packages['lua-sec'] is defined and 'prosody' in ansible_facts.packages['lua-sec'][0].version)

    or (ansible_facts.packages['lua-socket'] is defined and 'prosody' in ansible_facts.packages['lua-socket'][0].version)

- name: Remove Prosody project-provided apt key

  apt_key:

    id: "{{ item }}"

    state: absent

  with_items:

    - "107D65A0A148C237FDF00AB47393D7E674D9DBB5"

    - "44AB6DD06DA46979CFAF997F9B1B82786C8F28BA"

- name: Remove Prosody project-provided repository

  apt_repository:

    repo: "deb http://packages.prosody.im/debian {{ ansible_distribution_release }} main"

    state: absent

  apt:

    state: present

  notify:

    - Restart Prosody

- name: Install Prosody

  apt:

    name: prosody

    state: present

  notify:

    - Restart Prosody

- name: Allow Prosody user to traverse the directory with TLS private keys

  user:

    name: prosody

    append: true

    groups: ssl-cert

- name: Deploy XMPP TLS private key

  copy:

    dest: "/etc/ssl/private/{{ ansible_fqdn }}_xmpp.key"

    content: "{{ xmpp_tls_key }}"

    owner: root

    group: prosody

    mode: 0640

  notify:

    - Restart Prosody

- name: Deploy XMPP TLS certificate

  copy:

    dest: "/etc/ssl/certs/{{ ansible_fqdn }}_xmpp.pem"

    content: "{{ xmpp_tls_certificate }}"

    owner: root

    group: root

    mode: 0644

  notify:

    - Restart Prosody

- name: Generate the XMPP server Diffie-Hellman parameter

  openssl_dhparam:

    owner: root

    group: prosody

    mode: 0640

    path: "/etc/ssl/private/{{ ansible_fqdn }}_xmpp.dh.pem"

    size: 2048

  notify:

    - Restart Prosody

- name: Deploy configuration file for checking certificate validity via cron

#

# Pins Prosody and some related packages to Debian backports in order

# to get more up-to-date features and bug/security updates.

#

Pin: release a={{ ansible_distribution_release }}-backports

Pin-Priority: 600