majic-ansible-roles Changeset

Changeset - 76e05de03837

Parent rev.

Child rev.

[Not reviewed]

0 4 0

Branko Majic (branko) - 9 years ago 2015-09-01 23:10:17
branko@majic.rs

MAR-19: Fixed documentation for optional TLS key/certificate parameters. Simplified php website role, making some parameters optional. Fixed the optional parameters for TLS for web server role.

4 files changed with 22 insertions and 19 deletions:

docs/rolereference.rst

roles/php_website/defaults/main.yml

roles/php_website/tasks/main.yml

roles/web_server/defaults/main.yml

0 comments (0 inline, 0 general)

docs/rolereference.rst

➞

Show inline comments

@@ @@ -486,11 +486,11 @@ Parameters @@
   <http://www.openldap.org/doc/admin24/slapdconf2.html#cn=config>` for value
   description and syntax.
 **ldap_server_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/ansible_facts[host]['fqdn']_ldap.pem``)
+**ldap_server_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/{{ ansible_facts[host]['fqdn'] }}_ldap.pem``)
   Path to file on Ansible host that contains the X.509 certificate used for TLS
   for LDAP service. The file will be copied to directory ``/etc/ssl/certs/``.
 **ldap_server_tls_key** (string, optional, ``{{ tls_private_key_dir }}/ansible_facts[host]['fqdn']_ldap.key``)
+**ldap_server_tls_key** (string, optional, ``{{ tls_private_key_dir }}/{{ ansible_facts[host]['fqdn'] }}_ldap.key``)
   Path to file on Ansible host that contains the private key used for TLS for
   LDAP service. The file will be copied to directory ``/etc/ssl/private/``.
@@ @@ -591,11 +591,11 @@ Parameters @@
   Prosody. Each item is a string with value equal to XMPP user ID
   (i.e. ``john.doe@example.com``).
 **xmpp_tls_key** (string, optional, ``{{ tls_private_key_dir }}/ansible_facts[host]['fqdn']_xmpp.key``)
+**xmpp_tls_key** (string, optional, ``{{ tls_private_key_dir }}/{{ ansible_facts[host]['fqdn'] }}_xmpp.key``)
   Path to file on Ansible host that contains the private key used for TLS for
   XMPP service. The file will be copied to directory ``/etc/ssl/private/``.
 **xmpp_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/ansible_facts[host]['fqdn']_xmpp.pem``)
+**xmpp_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/{{ ansible_facts[host]['fqdn'] }}_xmpp.pem``)
   Path to file on Ansible host that contains the X.509 certificate used for TLS
   for SMTP service. The file will be copied to directory ``/etc/ssl/certs/``.
@@ @@ -741,21 +741,21 @@ Parameters @@
 **mail_user_gid** (integer, optional, ``whatever OS picks``)
   GID of the user that owns all the mail files.
 **imap_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/ansible_facts[host]['fqdn']_imap.pem``)
+**imap_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/{{ ansible_facts[host]['fqdn'] }}_imap.pem``)
   Path to file on Ansible host that contains the X.509 certificate used for TLS
   for IMAP and ManageSieve services. The file will be copied to directory
   ``/etc/ssl/certs/``.
 **imap_tls_key** (string, optional, ``{{ tls_private_key_dir }}/ansible_facts[host]['fqdn']_imap.key``)
+**imap_tls_key** (string, optional, ``{{ tls_private_key_dir }}/{{ ansible_facts[host]['fqdn'] }}_imap.key``)
   Path to file on Ansible host that contains the private key used for TLS for
   IMAP and ManageSieve services. The file will be copied to directory
   ``/etc/ssl/private/``.
 **smtp_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/ansible_facts[host]['fqdn']_smtp.pem``)
+**smtp_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/{{ ansible_facts[host]['fqdn'] }}_smtp.pem``)
   Path to file on Ansible host that contains the X.509 certificate used for TLS
   for SMTP service. The file will be copied to directory ``/etc/ssl/certs/``.
 **smtp_tls_key** (string, optional, ``{{ tls_certificate_dir }}/ansible_facts[host]['fqdn']_smtp.key``)
+**smtp_tls_key** (string, optional, ``{{ tls_certificate_dir }}/{{ ansible_facts[host]['fqdn'] }}_smtp.key``)
   Path to file on Ansible host that contains the private key used for TLS for
   SMTP service. The file will be copied to directory ``/etc/ssl/private/``.
@@ @@ -897,11 +897,11 @@ The role implements the following: @@
 Parameters
 ~~~~~~~~~~
-**https_tls_key** (string, optional, ``{{ tls_private_key_dir }}/ansible_facts[host]['fqdn']_web.key``)
+**https_tls_key** (string, optional, ``{{ tls_private_key_dir }}/{{ ansible_facts[host]['fqdn'] }}_https.key``)
   Path to file on Ansible host that contains the private key used for TLS for
   HTTPS service. The file will be copied to directory ``/etc/ssl/private/``.
-**https_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/ansible_facts[host]['fqdn']_web.pem``)
+**https_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/{{ ansible_facts[host]['fqdn'] }}_https.pem``)
   Path to file on Ansible host that contains the X.509 certificate used for TLS
   for HTTPS service. The file will be copied to directory ``/etc/ssl/certs/``.
 Parameters
 ~~~~~~~~~~
-**admin** (string, mandatory)
+**admin** (string, optional, ``web-{{ fqdn | replace('.', '_') }}``)
   Name of the operating system user in charge of maintaining the website. This
-  user is capable of making modifications to website configuration anda data
+  user is capable of making modifications to website configuration and data
   stored within the website directory.
 **deny_files_regex** (list, optional)
@@ @@ -1000,11 +1000,11 @@ Parameters @@
   succession, until the first match, or until it runs out of matches, when a
   client requests an URI pointing to directory. Default is ``index.php``.
-**https_tls_certificate** (string, mandatory)
+**https_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/{{ fqdn }}_https.pem``)
   Path to file on Ansible host that contains the X.509 certificate used for TLS
   for HTTPS service. The file will be copied to directory ``/etc/ssl/certs/``.
-**https_tls_key** (string, mandatory)
+**https_tls_key** (string, optional, ``{{ tls_private_key_dir }}/{{ fqdn }}_https.key``)
   Path to file on Ansible host that contains the private key used for TLS for
   HTTPS service. The file will be copied to directory ``/etc/ssl/private/``.
@@ @@ -1029,7 +1029,7 @@ Parameters @@
   A list of additional packages to install for this particular PHP
   appliction. This is usually going to be different PHP extensions.
-**uid** (integer, mandatory)
+**uid** (integer, optional, ``whatever OS picks``)
   UID/GID (they are set-up to be the same) of the dedicated website
   user/group.

roles/php_website/defaults/main.yml

➞

Show inline comments

@@ @@ -6,3 +6,6 @@ packages: [] @@
 php_file_regex: \.php$
 php_rewrite_urls: []
 rewrites: []
 admin: "web-{{ fqdn | replace('.', '_') }}"
 https_tls_certificate: "{{ tls_certificate_dir }}/{{ fqdn }}_https.pem"
 https_tls_key: "{{ tls_private_key_dir }}/{{ fqdn }}_https.key"

roles/php_website/tasks/main.yml

➞

Show inline comments

@@ @@ -5,14 +5,14 @@ @@
     home: "/var/www/{{ fqdn }}"
 - name: Create PHP website group
   group: name="{{ user }}" gid="{{ uid }}" state=present
+  group: name="{{ user }}" gid="{{ uid | default(omit) }}" state=present
 - name: Create home directory for the user (avoid populating with skeleton)
   file: path="{{ home }}" state=directory
         owner="{{ admin }}" group="{{ user }}" mode=2750
 - name: Create PHP website user
   user: name="{{ user }}" uid="{{ uid }}" group="{{ user }}"
+  user: name="{{ user }}" uid="{{ uid | default(omit) }}" group="{{ user }}"
         system=yes createhome=no state=present
 - name: Add nginx user to website group

roles/web_server/defaults/main.yml

➞

Show inline comments

 ---
 https_tls_key: "{{ tls_private_key_dir }}/ansible_facts[host]['fqdn']_web.key"
 https_tls_certificate: "{{ tls_certificate_dir }}/ansible_facts[host]['fqdn']_web.pem }}"
 https_tls_key: "{{ tls_private_key_dir }}/ansible_facts[host]['fqdn']_https.key"
 https_tls_certificate: "{{ tls_certificate_dir }}/ansible_facts[host]['fqdn']_https.pem }}"
 web_default_title: "Welcome"
 web_default_message: "You are attempting to access the web server using a wrong name or an IP address. Please check your URL."

0 comments (0 inline, 0 general)