majic-ansible-roles Changeset

Changeset - 2e340af74a96

Parent rev.

Child rev.

[Not reviewed]

0 2 0

Branko Majic (branko) - 5 years ago 2020-05-19 19:58:36
branko@majic.rs

MAR-153: Updated role reference documentation and release notes:

- Marks the change as breaking because it could mean older
client/servers cannot interoperate with the Majic Ansible Roles TLS
services any longer.

2 files changed with 32 insertions and 0 deletions:

docs/releasenotes.rst

docs/rolereference.rst

0 comments (0 inline, 0 general)

docs/releasenotes.rst

➞

Show inline comments

@@ @@ -11,24 +11,48 @@ upgrade to Python 3.x, dropping support for Python 2.7. @@
 Breaking changes:
 * Switched to Ansible 2.9.x, removing support for older versions. All
   documentation has been updated.
 * Switched to using Python 3 on both controller and managed server
   side. Python 2.7 can no longer be used for this purpose. Support for
   WSGI applications running on Python 2.7 remains.
 * All roles
   * Support for Debian 8 Jessie has been dropped.
 * ``mail_forwarder`` role
   * Use 2048-bit Diffie-Hellman parameters for relevant TLS
     ciphers. This could introduce incompatibility with older
     clients/servers trying to connect to the SMTP server.
 * ``mail_server`` role
   * Use 2048-bit Diffie-Hellman parameters for relevant TLS
     ciphers. This could introduce incompatibility with older
     clients/servers trying to connect to the SMTP/IMAP server.
 * ``web_server`` role
   * Use 2048-bit Diffie-Hellman parameters for relevant TLS
     ciphers. This could introduce incompatibility with older clients
     trying to connect to the web server.
 * ``xmpp_server`` role
   * Use 2048-bit Diffie-Hellman parameters for relevant TLS
     ciphers. This could introduce incompatibility with older
     clients/servers trying to connect to the XMPP server.
 Bug fixes:
 * ``common`` role
   * Run apticron at least once during initial installation to avoid
     accidental locking later on during the same playbook run.
 New features/improvements:
 * Tests have been updated to work with latest Molecule/Testinfra as
   part of the Ansible upgrade process.

docs/rolereference.rst

➞

Show inline comments

@@ @@ -842,24 +842,26 @@ The role implements the following: @@
 * Deploys XMPP TLS private key and certificate.
 * Installs Prosody.
 * Configures Prosody.
 * Configures firewall to allow incoming connections to the XMPP server.
 Prosody is configured as follows:
 * Modules enabled: roster, saslauth, tls, dialback, posix, private, vcard,
   version, uptime, time, ping, pep, register, admin_adhoc, announce, legacyauth.
 * Self-registration is not allowed.
 * TLS is configured. Legacy TLS is available on port 5223.
 * Client-to-server communication requires encryption (TLS).
 * Uses 2048-bit Diffie-Hellman parameters for relevant TLS ciphers for
   incoming connections.
 * Authentication is done via LDAP. For setting the LDAP TLS truststore, see
   :ref:`LDAP Client <ldap_client>`.
 * Internal storage is used.
 * For each domain specified, a dedicated conference/multi-user chat (MUC)
   service is set-up, with FQDN set to ``conference.DOMAIN``.
 * For each domain specified, a dedicated file proxy service will be set-up, with
   FQDN set to ``proxy.DOMAIN``.
 .. warning::
    Since it is not possible to set-up separate TLS configuration for *c2s* and
    *s2s* connections in Prosody 0.9.x, no hardening of TLS is performed in order
    to improve interoperability. This will be changed in Prosody 0.10.x, at which
@@ @@ -1005,24 +1007,26 @@ The role implements the following: @@
   submission port), as well as redirection from TCP port 27 to TCP port 25
   (alternate SMTP port), useful as workaround for ISP/hotel blocks.
 Deployed services are configured as follows:
 * Both Postfix and Dovecot look-up available domains, users, and aliases in
   LDAP.
 * Incoming and outgoing mail is scanned with ClamAV (via ClamAV
   Milter). Infected mails are rejected.
 * Mail is stored in directory ``/var/MAIL_USER/DOMAIN/USER``, using ``Maildir``
   format.
 * TLS is required for user log-ins for both SMTP and IMAP.
 * Uses 2048-bit Diffie-Hellman parameters for relevant TLS ciphers for
   incoming connections.
 * For user submission (SMTP), users must connect and authenticate over TCP
   port 587.
 * Configures TLS versions and ciphers supported by Dovecot.
 * Configures TLS versions and ciphers supported by Postfix on submission port
   (587). TLS configuration on port 25 is kept intact in order to maintain maximum
   interoperability with other servers.
 * RBL's are used for combating spam (if any is specified in configuration, see
   below).
 * Postfix is configured to deliver undeliverable bounces to postmaster. This
   helps with detecting misconfigured applications and servers.
 Both Postfix and Dovecot expect a specific directory structure in LDAP when
@@ @@ -1244,24 +1248,26 @@ The role implements the following: @@
 * Sets-up aliases for the local recipients.
 * Installs SWAKS (utility for testing SMTP servers).
 * Configures firewall to accept SMTP connections from SMTP relay (if one has
   been configured). This allows for delivery of bounced e-mails.
 Postfix is configured as follows:
 * Local destinations are set-up.
 * A relay host is set.
 * TLS is enforced for relaying mails, with configurable truststore for server
   certificate verification if SMTP relay is used. If SMTP relay is not used
   (configured), no certificate verification is done.
 * Uses 2048-bit Diffie-Hellman parameters for relevant TLS ciphers for
   incoming connections.
 Role dependencies
 ~~~~~~~~~~~~~~~~~
 Depends on the following roles:
 * **common**
 Parameters
 ~~~~~~~~~~
@@ @@ -1329,24 +1335,26 @@ Web Server @@
 The ``web_server`` role can be used for setting-up a web server on destination
 machine.
 The role is supposed to be very lightweight, providing a basis for deployment of
 web applications.
 The role implements the following:
 * Installs and configures nginx with a single, default vhost with a small static
   index page.
 * Deploys the HTTPS TLS private key and certificate (for default vhost).
 * Configures TLS versions and ciphers supported by Nginx.
 * Uses 2048-bit Diffie-Hellman parameters for relevant TLS ciphers for
   incoming connections.
 * Configures firewall to allow incoming connections to the web server.
 * Installs and configures virtualenv and virtualenvwrapper as a common base for
   Python apps.
 * Installs and configures PHP FPM as a common base for PHP apps.
 Role dependencies
 ~~~~~~~~~~~~~~~~~
 Depends on the following roles:
 * **common**

0 comments (0 inline, 0 general)