Release notes

=============

NEXT RELEASE

------------

Upgrade to Ansible 2.9.x, dropping support for Debian 8 Jessie,

upgrade to Python 3.x, dropping support for Python 2.7.

Breaking changes:

* Switched to Ansible 2.9.x, removing support for older versions. All

  documentation has been updated.

* Switched to using Python 3 on both controller and managed server

  side. Python 2.7 can no longer be used for this purpose. Support for

  WSGI applications running on Python 2.7 remains.

* All roles

  * Support for Debian 8 Jessie has been dropped.

  * Common parameters ``tls_private_key_dir`` and

    ``tls_certificate_dir`` are no longer used.

  * TLS private key and certificate parameters are now mandatory.

* ``bootstrap`` role

  * Parameter ``ansible_key`` is now mandatory.

* ``common`` role``

  * Minimum version of ``pip-tools`` in the ``pip_check_requirements``

    and ``pip_check_requirements_py3`` is now 5.3.0. This change was

    required in order to fix the deprecation warnings being sent out

    when the ``pip_check_requirements_upgrades.sh`` script is run.

* ``ldap_server`` role

  * Parameter ``ldap_server_domain`` is now mandatory.

  * Updated default set of TLS ciphers used by server

    (``ldap_tls_ciphers`` parameter). All CBC ciphers have been

    dropped. This could introduce incompatibility with older clients

    trying to connect to the LDAP server.

* ``mail_forwarder`` role

  * Use 2048-bit Diffie-Hellman parameters for relevant TLS

    ciphers. This could introduce incompatibility with older

    clients/servers trying to connect to the SMTP server.

* ``mail_server`` role

  * Use 2048-bit Diffie-Hellman parameters for relevant TLS

    ciphers. This could introduce incompatibility with older

    clients/servers trying to connect to the SMTP/IMAP server.

  * Updated default set of TLS ciphers used by IMAP/SMTP servers

    (``mail_server_tls_ciphers`` parameter). All CBC ciphers have been

    dropped. This could introduce incompatibility with older clients

    trying to connect to the IMAP/SMTP server.

* ``preseed`` role

  * Parameter ``ansible_key`` is now mandatory.

  * Parameter ``preseed_directory`` is now mandatory.

* ``web_server`` role

  * Use 2048-bit Diffie-Hellman parameters for relevant TLS

    ciphers. This could introduce incompatibility with older clients

    trying to connect to the web server.

  * Updated default set of TLS ciphers used by the server

    (``web_server_tls_ciphers`` parameter). All CBC ciphers have been

    dropped. This could introduce incompatibility with older clients

    trying to connect to the server.

* ``wsgi_website`` role

  * Parameters ``gunicorn_version`` and ``futures_version`` have been

    deprecated and removed. Existing roles should be updated to

    utilise the ``wsgi_requirements`` parameter instead.

  * Added parameter ``wsgi_requirements_in`` for listing top-level

    packages for performing pip requirements upgrade checks for

    Gunicorn requirements (listed via existing ``wsgi_requirements``

    parameter).

* ``xmpp_server`` role

  * Parameter ``xmpp_domains`` is now mandatory.

  * Use 2048-bit Diffie-Hellman parameters for relevant TLS

    ciphers. This could introduce incompatibility with older

    clients/servers trying to connect to the XMPP server.

  * TLS hardening is now applied to the *c2s* (client) connections on

    both the standard (``5222``) and legacy (``5223``) ports. Protocol

    version and ciphers are configurable via new

    ``xmpp_server_tls_protocol`` and ``xmpp_server_tls_ciphers``

    parameters with defaults enforcing TLSv1.2+ and PFS (perfect

    forward secrecy) ciphers.

  * Support for older Prosody versions (``0.9.x``) has been

    dropped. Only Prosody ``0.10.x`` is supported at the moment (due

    to missing Lua LDAP bindings in Debian 9 Stretch).

Bug fixes:

* ``common`` role

  * Run apticron at least once during initial installation to avoid

    accidental locking later on during the same playbook run.

* ``wsgi_website`` role

  * Deploy the requirement files used for upgrade checks to correct

    location when using Python 3. Previously the files would get

    deployed to directory dedicated to Python 2 version, which means

    the checks would be performed using Python 2 instead of Python 3.

New features/improvements:

* Tests have been updated to work with latest Molecule/Testinfra as

  part of the Ansible upgrade process.

* X.509 artefacts used during testing are now generated on the fly

  using `Gimmecert <https://gimmecert.readthedocs.io/>`_.

* ``mail_forwader`` role

  * The role now supports specifying the maximum mail message size

    limit for the SMTP server to accept via

    ``mail_message_size_limit`` role parameter.

* ``mail_server`` role

  * The role now supports specifying the maximum mail message size

    limit for the SMTP server to accept via

    ``mail_message_size_limit`` role parameter.

Deprecations:

* ``backup_server`` and ``backup_client`` role

  * Officially dropped support for DSA keys (this was mainly remnant

    from Debian 8 Jessie support, on Debian 9 Stretch and upwards the

    DSA keys were not supported at all).

4.0.0

-----

A couple of smaller bug-fixes, and introduction of (minor) breaking

change related to handling of pip requirements upgrade checks in the

``common`` role (see below).

Breaking changes:

* ``common`` role:

  * Added separate parameter (``pip_check_requirements_py3``) for

    specifying dedicated Python 3 virtual environment package

    requirements used for package upgrade checks on (other

    user-provided) Python 3 virtual environments. If the existing

    ``pip_check_requirements`` parameter has been overridden, the new

    parameter will most likely need to be overridden in your site

    configuration as well. Take note that the new requirements will

    differ between Debian Jessie and Debian Stretch due to differnece

    in Python 3 minor version releases.

Bug fixes:

* ``backup_client`` role

  * Avoid errors related to lack of ``tty`` when invoking the GnuPG

    utility by using the ``--no-tty`` option.

* ``common`` role

  * Fixed problem with pip requirements upgrades checks outputting

    package list to stderr, causing the cron job to report outdated

    packages to administrator even though nothing is outdated (cron

    job treats anything output to stderr as worthy of notification).

3.1.0

-----

Minor improvements and fixes.

Breaking changes:

* ``common`` role:

   * Default values for the ``pip_check_requirements`` have changed to

     include ``pip`` and ``setuptools`` (and a couple more). It might

     be necessary to update any customised values of this parameter to

     match the default set of packages.

Bug fixes:

* ``common`` role

  * Use Python 3 in Python virtual environment used for checking if

    upgrades are available for Python requirements files. Fixes

    possibly incorrect package resolution due to wrong version of

    Python (for packages that have different dependencies based on

    Python version).

New features/improvements:

* ``common`` role

  * Changed how the packages are installed in Python virtual

    environments used for performing pip requirements upgrade checks,

    making the process more reliable. The packages in those dedicated

    environments are now fully pinned, including system packages such

    as ``setuptools`` and ``pip`` itself.

  * Changed the pip requirements checks to now take into account

    unsafe packages as well (such as ``setuptools`` and ``pip``) if

    listed.

3.0.0

-----

Upgrade to Ansible 2.7.x and full support for Debian 9 (Stretch).

Breaking changes:

* Switched to Ansible 2.7.x, removing support for older versions. All

  documentation has been updated.

* All roles

  * In order to avoid collision with reserved name, the variable for

    running the handlers explicitly has been changed from ``handlers``

    to ``run_handlers``. E.g. to run all handlers a command similar to

    ``ansible-playbook -t handlers -e run_handlers=true

    playbooks/site.yml`` should be used.

* ``ldap_server`` role

  * Custom LDAP module ``m_ldap_entry`` has been removed. Role uses

    the official ``ldap_entry`` and ``ldap_attr`` modules.

  * The ``ldap_entries`` parameter now supports only the states

    supported by ``ldap_entry`` module (e.g. ``append`` is not

    supported any longer - since it came with custom LDAP module).

* ``xmpp_server`` role

  * Installs Prosody nightly builds (default version 0.10) instead of

    latest stable. Change made to improve reproducability, and to

    avoid future breakages after new major/minor releases of

    Prosody. Prosody package name can be specified through the

    ``xmpp_prosody_package`` variable.

    This should most likely not break anything, but is included as

    possibly breaking change nevertheless since it is a big change in

    how Prosody is installed.

    This change had to be done because LDAP integration broke with

    Prosody 0.11 due to missing LDAP bindings for Lua 5.2. See

    `MAR-137: XMPP server LDAP integration not working for Prosody

    0.11.x

    <https://projects.majic.rs/majic-ansible-roles/issues/MAR-137>`_

    for more details.

  string resembling the RBL domain.

**mail_postmaster** (string, optional, ``postmaster@{{ ansible_domain}}``)

  Mail address to use for the postmaster account in Dovecot.

**smtp_allow_relay_from** (list, optional, [])

  List of networks from which mail relaying is allowed even without

  authentication. Each item in the list is a string defining a network. The

  format must be compatible with Postfix ``mynetworks`` setting (for example:

  ``192.168.1.0/24``, ``myhost.example.com`` etc).

Distribution compatibility

~~~~~~~~~~~~~~~~~~~~~~~~~~

Role is compatible with the following distributions:

- Debian 9 (Stretch)

Examples

~~~~~~~~

Here is an example configuration for setting-up XMPP server using Prosody:

.. code-block:: yaml

  ---

  mail_ldap_url: ldap://ldap.example.com/

  mail_ldap_tls_truststore: /etc/ssl/certs/truststore.pem

  mail_ldap_base_dn: dc=example,dc=com

  mail_ldap_postfix_password: postfix

  mail_ldap_dovecot_password: dovecot

  mail_user: vmail

  mail_user_uid: 5000

  mail_user_gid: 5000

  # All mails sent to local user root will be forwarded to external account as

  # well.

  local_mail_aliases:

    root: "root john.doe@example.com"

  imap_tls_certificate: "{{ lookup('file', '~/tls/mail.example.com_imap.pem') }}"

  imap_tls_key: "{{ lookup('file', '~/tls/mail.example.com_imap.key') }}"

  smtp_tls_certificate: "{{ lookup('file', '~/tls/mail.example.com_smtp.pem') }}"

  smtp_tls_key: "{{ lookup('file', '~/tls/mail.example.com_smtp.key') }}"

  imap_folder_separator: /

  smtp_rbl:

    - bl.spamcop.net

    - zen.spamhaus.org

  mail_postmaster: postmaster@example.com

  smtp_allow_relay_from:

    - ldap.example.com

    - xmpp.example.com

  imap_max_user_connections_per_ip: 50

Mail Forwarder

--------------

The ``mail_forwarder`` role can be used for setting-up a local SMTP server for

sending out mails and receiving mails for local users. The SMTP server is

provided by Postfix.

SMTP service on server set-up this way is not meant to be exposed to the

Internet directly, and should receive delivery failures from the relay server

instead.

The role implements the following:

* Installs and configures Postfix.

* Purges Exim4 configuration (just in case).

* Sets-up aliases for the local recipients.

* Installs SWAKS (utility for testing SMTP servers).

* Configures firewall to accept SMTP connections from SMTP relay (if one has

  been configured). This allows for delivery of bounced e-mails.

Postfix is configured as follows:

* Local destinations are set-up.

* A relay host is set.

* TLS is enforced for relaying mails, with configurable truststore for server

  certificate verification if SMTP relay is used. If SMTP relay is not used

  (configured), no certificate verification is done.

* Uses 2048-bit Diffie-Hellman parameters for relevant TLS ciphers for

  incoming connections.

Role dependencies

~~~~~~~~~~~~~~~~~

Depends on the following roles:

* **common**

Parameters

~~~~~~~~~~

**local_mail_aliases** (dictionary, optional, ``[]``)

  Dictionary defining the local aliases. Aliases defined this way will either be

  appended to default aliases on the server, or replace the existing entries (if

  the alias/recipient is already present). Keys in the dictionary are the local

  recipients/aliases, while the value provided should be a space-separated list

  of mail addresses (or local users) where the mails should be forwarded.

**mail_message_size_limit** (integer, optional, ``10240000``)

  Maximum size of message in bytes that the SMTP server should accept

  for incoming mails. If the mail message size exceeds the listed

  value, it will be rejected by the server. The size is also

  advertised as part of SMTP server capabilities (in response to the

  ``ehlo`` SMTP command). Changing the value is primarily useful when

  SMTP from relay is allowed (via the ``smtp_from_relay_allowed``

  parameter), since incoming SMTP communication is otherwise not

  allowed at all.

**smtp_from_relay_allowed** (boolean, optional, ``True``)

  Specify if SMTP traffic from SMTP relay should be allowed or not (for bounced

  messages, for example). This parameter should be set to ``False`` on systems

  behind NAT or on systems that may not have constant network connectivity (such

  as laptops) to avoid firewall failures since SMTP relay name needs to be

  resolvable.

**smtp_relay_host** (string, optional, ``None``)

  SMTP server via which the mails are sent out for non-local recipients.

**smtp_relay_host_port** (integer, optional, ``None``)

  Port to use when connecting to the SMTP relay host.

**smtp_relay_truststore** (string, mandatory)

  X.509 certificate chain used for issuing certificate for the SMTP relay

  service. The file will be stored in location

  ``/etc/ssl/certs/smtp_relay_truststore.pem``

Distribution compatibility

~~~~~~~~~~~~~~~~~~~~~~~~~~

Role is compatible with the following distributions:

- Debian 9 (Stretch)

Examples

~~~~~~~~

Here is an example configuration for setting-up the mail forwarder:

.. code-block:: yaml

  ---

  # All mails sent to local user root will be forwarded to external account as

  # well.

  local_mail_aliases:

    root: "root john.doe@example.com"

  smtp_relay_host: mail.example.com

  smtp_relay_host_port: 27

  smtp_from_relay_allowed: False

  smtp_relay_truststore: /etc/ssl/certs/example_ca_chain.pem

Web Server

----------

The ``web_server`` role can be used for setting-up a web server on destination

machine.

The role is supposed to be very lightweight, providing a basis for deployment of

web applications.

The role implements the following:

* Installs and configures nginx with a single, default vhost with a small static

  index page.

* Deploys the HTTPS TLS private key and certificate (for default vhost).

* Configures TLS versions and ciphers supported by Nginx.

* Uses 2048-bit Diffie-Hellman parameters for relevant TLS ciphers for

  incoming connections.

* Configures firewall to allow incoming connections to the web server.

* Installs and configures virtualenv and virtualenvwrapper as a common base for

  Python apps.

* Installs and configures PHP FPM as a common base for PHP apps.

Role dependencies

~~~~~~~~~~~~~~~~~

Depends on the following roles:

* **common**

Parameters

~~~~~~~~~~

**default_https_tls_certificate** (string, mandatory)

  X.509 certificate used for TLS for HTTPS service. The file will be stored in

  directory ``/etc/ssl/certs/`` under name ``{{ ansible_fqdn }}_https.pem``.

**default_https_tls_key** (string, mandatory)

  Private key used for TLS for HTTPS service. The file will be stored in

  directory ``/etc/ssl/private/`` under name ``{{ ansible_fqdn }}_https.key``.

**web_default_title** (string, optional, ``Welcome``)

  Title for the default web page shown to users (if no other vhosts were matched).

**web_default_message** (string, optional, ``You are attempting to access the web server using a wrong name or an IP address. Please check your URL.``)

  Message for the default web page shown to users (if no other vhosts were

  matched).

**web_server_tls_protocols** (list, optional, ``[ "TLSv1.2" ]``)

  List of TLS protocols the web server should support. Each value specified

  should be compatible with Nginx configuration option ``ssl_protocols``.

**web_server_tls_ciphers** (string, optional, ``DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:!aNULL:!MD5:!EXPORT``)

  TLS ciphers to enable on the web server. This should be an OpenSSL-compatible

  cipher specification. Value should be compatible with Nginx configuration

  option ``ssl_ciphers``. Default value allows only TLSv1.2 and strong PFS

  ciphers with RSA private keys.

Distribution compatibility

~~~~~~~~~~~~~~~~~~~~~~~~~~

Role is compatible with the following distributions:

- Debian 9 (Stretch)

Examples

~~~~~~~~

Here is an example configuration for setting-up web server:

.. code-block:: yaml

  ---

  default_https_tls_key: "{{ lookup('file', inventory_dir + '/tls/web.example.com_https.key') }}"

  default_https_tls_certificate: "{{ lookup('file', inventory_dir + '/tls/web.example.com_https.pem') }}"

  web_default_title: "Welcome to Example Inc."

  web_default_message: "You are attempting to access the web server using a wrong name or an IP address. Please check your URL."

PHP Website

-----------

The ``php_website`` role can be used for setting-up a website powered by PHP on

destination machine.

This role is normally not supposed to be used directly, but should instead serve

as the basis for writing website-specific roles. Therefore the role is written

in quite generic way, allowing the integrator to write his/her own logic for

deploying the necessary PHP applications, while still reusing a common base and

reducing the workload.

The role implements the following:

* Creates a dedicated user/group for running the PHP scripts.

* Creates a dedicated administrator user for maintaining the website.

* Creates a base directory where the website-specific code and data should be

  stored at.

* Adds nginx to website's group, so nginx could read the necessary files.

* Adds website administrator to website's group, so administrator could manage

  the code and data.

* Installs additional packages required for running the role (as configured).

* Deploys the HTTPS TLS private key and certificate (for website vhost).

* Configures PHP FPM and nginx to serve the website.

The role is implemented with the following layout/logic in mind:

* Website users are named after the ``FQDN`` (fully qualified domain name) of

  website, in format of ``web-ESCAPEDFQDN``, where ``ESCAPEDFQDN`` is equal to

  ``FQDN`` where dots have been replaced by underscores (for example,

  ``web-cloud_example_com``).

* Website users are set-up via GECOS field to have their umask set to ``0007``

  (in combination with ``pam_umask``).

* Administrator users are named after the ``FQDN`` (fully qualified domain name)

  of website, in format of ``admin-ESCAPEDFQDN``, where ``ESCAPEDFQDN`` is equal

  to ``FQDN`` where dots have been replaced by underscores (for example,

  ``admin-cloud_example_com``).

* All websites reside within a dedicated sub-directory in ``/var/www``. The

  sub-directory name is equal to the ``FQDN`` used for accessing the

  website. Owner of the directory is set to be the application administrator,

  while group is set to be the website group. Additionally, ``SGID`` bit is set

  on the directory. This allows admin, with correct umask, to create necessary

  files and directories that should be readable (and eventually writeable) by

  the website user (running the PHP scripts) without having to become root.

* All files placed in the website directory should be either created there

  directly, or copied to the directory in order to make sure the ``SGID`` gets

  honored. **Do not move the files, the permissions will not be set correctly.**

* Within the website directory, nginx/php5-fpm will expect to find the relevant

  files within the htdocs sub-directory (this can be symlink too).

* nginx communicates with PHP FPM over a dedicated Unix socket for each website.

Role dependencies

~~~~~~~~~~~~~~~~~

Depends on the following roles:

* **common**

* **web_server**

Parameters

~~~~~~~~~~

**additional_fpm_config** (dict, optional, ``{}``)

  Additional PHP FPM configuration options that should be included for PHP

  website's pool. Keys are parameter names, values are associated values. Don't

  forget to include quotes in the value itself if expected value type is string.

**additional_nginx_config** (list, optional, ``[]``)

  List providing additional Nginx configuration options to include. This can be

  useful for specifying things like error pages. Options are applied inside of a

  **server** context of Nginx configuration file.

  Each item is a dictionary with the following options describing the extra

  configuration option:

  **comment** (string, mandatory)

    Comment describing the configuration option.

  **value** (string, mandatory)

    Configuration option.

**admin_uid** (integer, optional, ``whatever OS picks``)

  UID of the dedicated website administrator user. The user will be member of

  website group.

**deny_files_regex** (list, optional, ``[]``)

  List of regular expressions for matching files/locations to which the web

  server should deny access. This is useful to block access to any sensitive

  files that should not be served directly by the web server. The format must be

  compatible with regular expressions used by ``nginx`` for ``location ~``

  syntax.

**enforce_https** (boolean, optional, ``True``)

  Specify if HTTPS should be enforced for the website or not. If enforced,

  clients connecting via plaintext will be redirected to HTTPS, and clients will

  be served with ``Strict-Transport-Security`` header with value of

  ``max-age=31536000; includeSubDomains``.

**environment_indicator** (dictionary, optional, ``null``)

  Specify configuration for including environment indicator on all HTML

  pages. Indicator is a simple strip at bottom of a page with custom background

  colour, text colour, and text.

  Specifying environment indicator is useful for avoiding mistakes when testing

  by having better visibility what environment you are in

  (production/staging/test).

  The following keys need to be specified:

  **background_colour** (string, mandatory)

    Background colour to use for the strip at bottom. This should be value

    compatible with CSS ``background-color`` attribute.

  **text_colour** (string, mandatory

    Text colour to use for the strip at bottom. This should be value compatible

    with CSS ``color`` attribute.

  **text** (string, mandatory)

    Text to show in show in the strip at bottom.

**fqdn** (string, mandatory)

  Fully-qualified domain name where the website is reachable. This value is used

  for calculating the user/group name for dedicated website user, as well as

  home directory of the website user (where data/code should be stored at).

**index** (string, optional, ``index.php``)

  Space-separated list of files which should be treated as index files by the

  web server. The web server will attempt opening these index files, in

  succession, until the first match, or until it runs out of matches, when a

  client requests an URI pointing to directory.

**https_tls_certificate** (string, mandatory)

  X.509 certificate used for TLS for HTTPS service. The file will be stored in

  directory ``/etc/ssl/certs/`` under name ``{{ fqdn }}_https.pem``.

**https_tls_key** (string, optional, mandatory)

  Private key used for TLS for HTTPS service. The file will be stored in

  directory ``/etc/ssl/private/`` under name ``{{ fqdn }}_https.key``.

**php_file_regex** (string, optional, ``\.php$``)

---

web_default_title: "Welcome"

web_default_message: "You are attempting to access the web server using a wrong name or an IP address. Please check your URL."

web_server_tls_protocols:

  - "TLSv1.2"

web_server_tls_ciphers: "\

DHE-RSA-AES128-GCM-SHA256:\

DHE-RSA-AES256-GCM-SHA384:\

DHE-RSA-CHACHA20-POLY1305:\

ECDHE-RSA-AES128-GCM-SHA256:\

ECDHE-RSA-AES256-GCM-SHA384:\

ECDHE-RSA-CHACHA20-POLY1305:\

!aNULL:!MD5:!EXPORT"

# Internal parameters

php_fpm_package_name: "php-fpm"

php_fpm_service_name: "php7.0-fpm"

php_base_config_dir: "/etc/php/7.0"

---

default_https_tls_certificate: "{{ lookup('file', 'tests/data/x509/server/{{ inventory_hostname }}_https.cert.pem') }}"

default_https_tls_key: "{{ lookup('file', 'tests/data/x509/server/{{ inventory_hostname }}_https.key.pem') }}"

web_default_title: "Optional Welcome"

web_default_message: "Welcome to parameters-optional, default virtual host."

web_server_tls_protocols:

  - TLSv1.1

  - TLSv1.2

web_server_tls_ciphers: "DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-GCM-SHA384:\

DHE-RSA-AES256-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-GCM-SHA384:\

ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:!aNULL:!MD5:!EXPORT"

# common

ca_certificates:

  testca: "{{ lookup('file', 'tests/data/x509/ca/level1.cert.pem') }}"

        assert page.user == 'root'

        assert page.group == 'www-data'

        assert page.mode == 0o640

def test_services(host, php_info):

    """

    Tests if services are enabled at boot and running.

    """

    service = host.service('nginx')

    assert service.is_enabled

    assert service.is_running

    service = host.service(php_info.fpm_service)

    assert service.is_enabled

    assert service.is_running

def test_sockets(host):

    """

    Tests if web server is listening on correct ports.

    """

    assert host.socket("tcp://80").is_listening

    assert host.socket("tcp://443").is_listening

@pytest.mark.parametrize("application_type, tmpfiles_d_path",

                         [("wsgi", "/etc/tmpfiles.d/wsgi.conf"),

                          ("php", "/etc/tmpfiles.d/php7.0-fpm.conf")])

def test_socket_directories(host, application_type, tmpfiles_d_path):

    """

    Tests if directories containing sockets for WSGI and PHP apps are created

    correctly.

    """

    socket_directory = "/run/%s" % application_type

    tmpfiles_d_content = "d /run/%s/ 0750 root www-data - -" % application_type

    directory = host.file(socket_directory)

    assert directory.is_directory

    assert directory.user == 'root'

    assert directory.group == 'www-data'

    assert directory.mode == 0o750

    config = host.file(tmpfiles_d_path)

    assert config.is_file

    assert config.user == 'root'

    assert config.group == 'root'

    assert config.mode == 0o644

    assert config.content_string == tmpfiles_d_content

def test_php_fpm_service_overrides(host, php_info):

    """

    Tests if overrides for PHP-FPM service are deployed correctly.

    """

    directory = host.file('/etc/systemd/system/%s.service.d' % php_info.fpm_service)

    assert directory.is_directory

    assert directory.user == 'root'

    assert directory.group == 'root'

    assert directory.mode == 0o755

    config = host.file('/etc/systemd/system/%s.service.d/umask.conf' % php_info.fpm_service)

    assert config.is_file

    assert config.user == 'root'

    assert config.group == 'root'

    assert config.mode == 0o644

def test_php_timezone_configuration(host, php_info):

    """

    Tests if PHP timezone configuration has been set correctly.

    """

    server_timezone = host.file("/etc/timezone").content_string.strip()

    config = host.file('%s/cli/conf.d/30-timezone.ini' % php_info.base_config_dir)

    assert config.is_file

    assert config.user == 'root'

    assert config.group == 'root'

    assert config.mode == 0o644

    config = host.file('%s/fpm/conf.d/30-timezone.ini' % php_info.base_config_dir)

    assert config.is_file

    assert config.user == 'root'

    assert config.group == 'root'

    assert config.mode == 0o644

    timezone = host.run("php --php-ini %s -r %s", "%s/cli/php.ini" % php_info.base_config_dir, "echo ini_get('date.timezone');")

    assert timezone.rc == 0

    assert timezone.stdout == server_timezone

    timezone = host.run("php --php-ini %s -r %s", "%s/fpm/php.ini" % php_info.base_config_dir, "echo ini_get('date.timezone');")

    assert timezone.rc == 0

    assert timezone.stdout == server_timezone

def test_https_server_dh_parameters_file(host):

    """

    Tests if the Diffie-Hellman parameter file has been generated

    correctly.

    """

    hostname = host.run('hostname').stdout.strip()

    dhparam_file_path = '/etc/ssl/private/%s_https.dh.pem' % hostname

    with host.sudo():

        dhparam_file = host.file(dhparam_file_path)

        assert dhparam_file.is_file

        assert dhparam_file.user == 'root'

        assert dhparam_file.group == 'root'

        assert dhparam_file.mode == 0o640

        dhparam_info = host.run("openssl dhparam -noout -text -in %s", dhparam_file_path)

        assert "DH Parameters: (2048 bit)" in dhparam_info.stdout

def test_https_server_uses_correct_dh_parameters(host):

    """

    Tests if the HTTP server uses the generated Diffie-Hellman parameter.

    """

    hostname = host.run('hostname').stdout.strip()

    with host.sudo():

        expected_dhparam = host.file('/etc/ssl/private/%s_https.dh.pem' % hostname).content_string.rstrip()

    connection = host.run("gnutls-cli --no-ca-verification --starttls-proto=https --port 443 "

                          "--priority 'NONE:+VERS-TLS1.2:+CTYPE-X509:+COMP-NULL:+SIGN-RSA-SHA384:+DHE-RSA:+SHA384:+AEAD:+AES-256-GCM' --verbose localhost")