majic-ansible-roles Changeset

Changeset - 76e05de03837

Parent rev.

Child rev.

[Not reviewed]

0 4 0

Branko Majic (branko) - 10 years ago 2015-09-01 23:10:17
branko@majic.rs

MAR-19: Fixed documentation for optional TLS key/certificate parameters. Simplified php website role, making some parameters optional. Fixed the optional parameters for TLS for web server role.

4 files changed with 22 insertions and 19 deletions:

docs/rolereference.rst

roles/php_website/defaults/main.yml

roles/php_website/tasks/main.yml

roles/web_server/defaults/main.yml

0 comments (0 inline, 0 general)

docs/rolereference.rst

➞

Show inline comments

@@ @@ -483,17 +483,17 @@ Parameters @@
 **ldap_server_log_level** (string, optional, ``256``)
   Log level to use for the server. This should be compatible with OpenLDAP
   configuration option ``olcLogLevel``. See `OpenLDAP Administrator's Guide
   <http://www.openldap.org/doc/admin24/slapdconf2.html#cn=config>` for value
   description and syntax.
 **ldap_server_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/ansible_facts[host]['fqdn']_ldap.pem``)
+**ldap_server_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/{{ ansible_facts[host]['fqdn'] }}_ldap.pem``)
   Path to file on Ansible host that contains the X.509 certificate used for TLS
   for LDAP service. The file will be copied to directory ``/etc/ssl/certs/``.
 **ldap_server_tls_key** (string, optional, ``{{ tls_private_key_dir }}/ansible_facts[host]['fqdn']_ldap.key``)
+**ldap_server_tls_key** (string, optional, ``{{ tls_private_key_dir }}/{{ ansible_facts[host]['fqdn'] }}_ldap.key``)
   Path to file on Ansible host that contains the private key used for TLS for
   LDAP service. The file will be copied to directory ``/etc/ssl/private/``.
 **ldap_server_ssf** (number, optional, ``128``)
   Minimum *Security Strength Factor* to require from all incoming
   connections. This applies for both remote and local connections.
@@ @@ -588,17 +588,17 @@ Parameters @@
 **xmpp_administrators** (list, mandatory)
   List of Prosody users that should be granted administrator privileges over
   Prosody. Each item is a string with value equal to XMPP user ID
   (i.e. ``john.doe@example.com``).
 **xmpp_tls_key** (string, optional, ``{{ tls_private_key_dir }}/ansible_facts[host]['fqdn']_xmpp.key``)
+**xmpp_tls_key** (string, optional, ``{{ tls_private_key_dir }}/{{ ansible_facts[host]['fqdn'] }}_xmpp.key``)
   Path to file on Ansible host that contains the private key used for TLS for
   XMPP service. The file will be copied to directory ``/etc/ssl/private/``.
 **xmpp_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/ansible_facts[host]['fqdn']_xmpp.pem``)
+**xmpp_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/{{ ansible_facts[host]['fqdn'] }}_xmpp.pem``)
   Path to file on Ansible host that contains the X.509 certificate used for TLS
   for SMTP service. The file will be copied to directory ``/etc/ssl/certs/``.
 **xmpp_domains** (list, optional, ``ansible_facts[host]['domain']``)
   List of domains that are served by this Prosody instance. Each item is a
   string specifying a domain.
@@ @@ -738,27 +738,27 @@ Parameters @@
 **mail_user_uid** (integer, optional, ``whatever OS picks``)
   UID of the user that owns all the mail files.
 **mail_user_gid** (integer, optional, ``whatever OS picks``)
   GID of the user that owns all the mail files.
 **imap_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/ansible_facts[host]['fqdn']_imap.pem``)
+**imap_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/{{ ansible_facts[host]['fqdn'] }}_imap.pem``)
   Path to file on Ansible host that contains the X.509 certificate used for TLS
   for IMAP and ManageSieve services. The file will be copied to directory
   ``/etc/ssl/certs/``.
 **imap_tls_key** (string, optional, ``{{ tls_private_key_dir }}/ansible_facts[host]['fqdn']_imap.key``)
+**imap_tls_key** (string, optional, ``{{ tls_private_key_dir }}/{{ ansible_facts[host]['fqdn'] }}_imap.key``)
   Path to file on Ansible host that contains the private key used for TLS for
   IMAP and ManageSieve services. The file will be copied to directory
   ``/etc/ssl/private/``.
 **smtp_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/ansible_facts[host]['fqdn']_smtp.pem``)
+**smtp_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/{{ ansible_facts[host]['fqdn'] }}_smtp.pem``)
   Path to file on Ansible host that contains the X.509 certificate used for TLS
   for SMTP service. The file will be copied to directory ``/etc/ssl/certs/``.
 **smtp_tls_key** (string, optional, ``{{ tls_certificate_dir }}/ansible_facts[host]['fqdn']_smtp.key``)
+**smtp_tls_key** (string, optional, ``{{ tls_certificate_dir }}/{{ ansible_facts[host]['fqdn'] }}_smtp.key``)
   Path to file on Ansible host that contains the private key used for TLS for
   SMTP service. The file will be copied to directory ``/etc/ssl/private/``.
 **imap_folder_separator** (string, optional, ``/``)
   Character used for separating the IMAP folders when clients are requesting
   listing from the server. Usually either slash(``/``) or dot(``.``).
@@ @@ -894,17 +894,17 @@ The role implements the following: @@
 * Installs and configures PHP FPM as a common base for PHP apps.
 Parameters
 ~~~~~~~~~~
-**https_tls_key** (string, optional, ``{{ tls_private_key_dir }}/ansible_facts[host]['fqdn']_web.key``)
+**https_tls_key** (string, optional, ``{{ tls_private_key_dir }}/{{ ansible_facts[host]['fqdn'] }}_https.key``)
   Path to file on Ansible host that contains the private key used for TLS for
   HTTPS service. The file will be copied to directory ``/etc/ssl/private/``.
-**https_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/ansible_facts[host]['fqdn']_web.pem``)
+**https_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/{{ ansible_facts[host]['fqdn'] }}_https.pem``)
   Path to file on Ansible host that contains the X.509 certificate used for TLS
   for HTTPS service. The file will be copied to directory ``/etc/ssl/certs/``.
 **web_default_title** (string, optional, ``Welcome``)
   Title for the default web page shown to users (if no other vhosts were matched).
 * nginx communicates with PHP FPM over a dedicated Unix socket for each website.
 Parameters
 ~~~~~~~~~~
-**admin** (string, mandatory)
+**admin** (string, optional, ``web-{{ fqdn | replace('.', '_') }}``)
   Name of the operating system user in charge of maintaining the website. This
-  user is capable of making modifications to website configuration anda data
+  user is capable of making modifications to website configuration and data
   stored within the website directory.
 **deny_files_regex** (list, optional)
   List of regular expressions for matching files/locations to which the web
   server should deny access. This is useful to block access to any sensitive
   files that should not be served directly by the web server. The format must be
@@ @@ -997,17 +997,17 @@ Parameters @@
 **index** (string, optional)
   Space-separated list of files which should be treated as index files by the
   web server. The web server will attempt opening these index files, in
   succession, until the first match, or until it runs out of matches, when a
   client requests an URI pointing to directory. Default is ``index.php``.
-**https_tls_certificate** (string, mandatory)
+**https_tls_certificate** (string, optional, ``{{ tls_certificate_dir }}/{{ fqdn }}_https.pem``)
   Path to file on Ansible host that contains the X.509 certificate used for TLS
   for HTTPS service. The file will be copied to directory ``/etc/ssl/certs/``.
-**https_tls_key** (string, mandatory)
+**https_tls_key** (string, optional, ``{{ tls_private_key_dir }}/{{ fqdn }}_https.key``)
   Path to file on Ansible host that contains the private key used for TLS for
   HTTPS service. The file will be copied to directory ``/etc/ssl/private/``.
 **php_file_regex** (string, optional)
   Regular expression used for determining which file should be interepted via
   PHP. Default is ``\.php$``.
@@ @@ -1026,13 +1026,13 @@ Parameters @@
   as trailing semi-colon (``;``).
 **packages** (list, optional)
   A list of additional packages to install for this particular PHP
   appliction. This is usually going to be different PHP extensions.
-**uid** (integer, mandatory)
+**uid** (integer, optional, ``whatever OS picks``)
   UID/GID (they are set-up to be the same) of the dedicated website
   user/group.
 Examples
 ~~~~~~~~

roles/php_website/defaults/main.yml

➞

Show inline comments

@@ @@ -3,6 +3,9 @@ @@
 deny_files_regex: []
 index: index.php
 packages: []
 php_file_regex: \.php$
 php_rewrite_urls: []
 rewrites: []
 admin: "web-{{ fqdn | replace('.', '_') }}"
 https_tls_certificate: "{{ tls_certificate_dir }}/{{ fqdn }}_https.pem"
 https_tls_key: "{{ tls_private_key_dir }}/{{ fqdn }}_https.key"

roles/php_website/tasks/main.yml

➞

Show inline comments

@@ @@ -2,20 +2,20 @@ @@
 - set_fact:
     user: "web-{{ fqdn | replace('.', '_') }}"
     home: "/var/www/{{ fqdn }}"
 - name: Create PHP website group
   group: name="{{ user }}" gid="{{ uid }}" state=present
+  group: name="{{ user }}" gid="{{ uid | default(omit) }}" state=present
 - name: Create home directory for the user (avoid populating with skeleton)
   file: path="{{ home }}" state=directory
         owner="{{ admin }}" group="{{ user }}" mode=2750
 - name: Create PHP website user
   user: name="{{ user }}" uid="{{ uid }}" group="{{ user }}"
+  user: name="{{ user }}" uid="{{ uid | default(omit) }}" group="{{ user }}"
         system=yes createhome=no state=present
 - name: Add nginx user to website group
   user: name="www-data" groups="{{ user }}" append="yes"
   notify:
     - Restart nginx

roles/web_server/defaults/main.yml

➞

Show inline comments

 ---
 https_tls_key: "{{ tls_private_key_dir }}/ansible_facts[host]['fqdn']_web.key"
 https_tls_certificate: "{{ tls_certificate_dir }}/ansible_facts[host]['fqdn']_web.pem }}"
 https_tls_key: "{{ tls_private_key_dir }}/ansible_facts[host]['fqdn']_https.key"
 https_tls_certificate: "{{ tls_certificate_dir }}/ansible_facts[host]['fqdn']_https.pem }}"
 web_default_title: "Welcome"
 web_default_message: "You are attempting to access the web server using a wrong name or an IP address. Please check your URL."

0 comments (0 inline, 0 general)