Changeset - 7cabc17c71c3
[Not reviewed]
0 30 0
Branko Majic (branko) - 2 months ago 2024-09-03 14:53:33
branko@majic.rs
MAR-218: Quote all octal values in YAML files:

- Fixes linting errors, and ensures there is no ambiguity in case of
YAML specification changes.
30 files changed with 196 insertions and 196 deletions:
0 comments (0 inline, 0 general)
roles/backup/handlers/main.yml
Show inline comments
 
@@ -3,8 +3,8 @@
 
- name: Assemble Duply include patterns
 
  assemble:
 
    dest: "/etc/duply/main/include"
 
    src: "/etc/duply/main/patterns"
 
    owner: root
 
    group: root
 
    mode: 0600
 
    mode: "0600"
 
    backup: true
roles/backup/tasks/main.yml
Show inline comments
 
@@ -3,13 +3,13 @@
 
- name: Configure backup patterns
 
  template:
 
    src: "backup_patterns.j2"
 
    dest: "/etc/duply/main/patterns/{{ backup_patterns_filename }}"
 
    owner: root
 
    group: root
 
    mode: 0600
 
    mode: "0600"
 
  notify:
 
    - Assemble Duply include patterns
 

	
 
- name: Explicitly run all handlers
 
  include_tasks: ../handlers/main.yml
 
  when: "run_handlers | default(False) | bool()"
roles/backup_client/handlers/main.yml
Show inline comments
 
@@ -12,13 +12,13 @@
 
- name: Create keyring directory
 
  file:
 
    path: "/etc/duply/main/gnupg"
 
    state: directory
 
    owner: root
 
    group: root
 
    mode: 0700
 
    mode: "0700"
 

	
 
- name: Import private keys  # noqa no-changed-when
 
  # [no-changed-when] Commands should not change things if nothing needs doing
 
  #   This task is invoked only if user is very specific about requiring to
 
  #   run the handlers manually as a way to bring the system to consistency
 
  #   after interrupted runs.
roles/backup_client/molecule/default/converge.yml
Show inline comments
 
@@ -15,7 +15,7 @@
 
    - name: Deploy pre-backup script
 
      copy:
 
        src: tests/data/10-test-pre-backup.sh
 
        dest: /etc/duply/main/pre.d/10-test-pre-backup.sh
 
        owner: root
 
        group: root
 
        mode: 0700
 
        mode: "0700"
roles/backup_client/molecule/default/prepare.yml
Show inline comments
 
@@ -23,13 +23,13 @@
 
    - name: Deploy SSH server keys
 
      copy:
 
        content: "{{ lookup('file', item.key) + '\n' }}"
 
        dest: "{{ item.value }}"
 
        owner: root
 
        group: root
 
        mode: 0600
 
        mode: "0600"
 
      with_dict:
 
        tests/data/ssh/server_rsa: /etc/ssh/ssh_host_rsa_key
 
        tests/data/ssh/server_ed25519: /etc/ssh/ssh_host_ed25519_key
 
        tests/data/ssh/server_ecdsa: /etc/ssh/ssh_host_ecdsa_key
 
      notify:
 
        - Restart ssh
 
@@ -53,13 +53,13 @@
 
    - name: Deploy custom SSH server configuration that chroots users
 
      copy:
 
        src: "tests/data/backup_server-sshd-chroot_backup_users.conf"
 
        dest: "/etc/ssh/sshd_config.d/chroot_backup_users.conf"
 
        owner: root
 
        group: root
 
        mode: 0600
 
        mode: "0600"
 
      notify:
 
        - Restart ssh
 

	
 
    - name: Set-up backup group that will contain all backup users
 
      group:
 
        name: "backup-users"
 
@@ -93,22 +93,22 @@
 
    - name: Change ownership of home directories for SFTP chroot to work
 
      file:
 
        path: "/home/{{ item.name }}"
 
        state: directory
 
        owner: root
 
        group: root
 
        mode: 0755
 
        mode: "0755"
 
      with_items: "{{ backup_users }}"
 

	
 
    - name: Set-up duplicity backup directories
 
      file:
 
        path: "~{{ item.name }}/duplicity"
 
        state: directory
 
        owner: root
 
        group: backup-users
 
        mode: 0770
 
        mode: "0770"
 
      with_items: "{{ backup_users }}"
 

	
 
  handlers:
 
    - name: Restart ssh
 
      service:
 
        name: ssh
roles/backup_client/tasks/main.yml
Show inline comments
 
@@ -10,13 +10,13 @@
 
- name: Set-up Duply directories
 
  file:
 
    path: "{{ item }}"
 
    state: directory
 
    owner: root
 
    group: root
 
    mode: 0700
 
    mode: "0700"
 
  with_items:
 
    - "/etc/duply"
 
    - "/etc/duply/main"
 
    - "/etc/duply/main/patterns"
 
    - "/etc/duply/main/gnupg"
 
    - "/etc/duply/main/ssh"
 
@@ -26,26 +26,26 @@
 
- name: Deploy GnuPG private keys
 
  copy:
 
    content: "{{ backup_encryption_key }}"
 
    dest: "/etc/duply/main/private_keys.asc"
 
    owner: root
 
    group: root
 
    mode: 0600
 
    mode: "0600"
 
  notify:
 
    - Remove current keyring
 
    - Create keyring directory
 
    - Import private keys
 
    - Import public keys
 

	
 
- name: Deploy GnuPG public keys
 
  copy:
 
    content: "{{ backup_additional_encryption_keys | join('\n') }}"
 
    dest: "/etc/duply/main/public_keys.asc"
 
    owner: root
 
    group: root
 
    mode: 0600
 
    mode: "0600"
 
  notify:
 
    - Remove current keyring
 
    - Create keyring directory
 
    - Import private keys
 
    - Import public keys
 

	
 
@@ -71,54 +71,54 @@
 
- name: Deploy private SSH key for logging-in into backup server
 
  copy:
 
    content: "{{ backup_ssh_key }}"
 
    dest: "/etc/duply/main/ssh/identity"
 
    owner: root
 
    group: root
 
    mode: 0600
 
    mode: "0600"
 
  no_log: true
 

	
 
- name: Deploy custom known_hosts for backup purposes
 
  template:
 
    src: "known_hosts.j2"
 
    dest: "/etc/duply/main/ssh/known_hosts"
 
    owner: root
 
    group: root
 
    mode: 0600
 
    mode: "0600"
 

	
 
- name: Deploy Duply configuration file
 
  template:
 
    src: "duply_main_conf.j2"
 
    dest: "/etc/duply/main/conf"
 
    owner: root
 
    group: root
 
    mode: 0600
 
    mode: "0600"
 

	
 
- name: Deploy base exclude pattern (exclude all by default)
 
  copy:
 
    content: "- **"
 
    dest: "/etc/duply/main/exclude"
 
    owner: root
 
    group: root
 
    mode: 0600
 
    mode: "0600"
 

	
 
- name: Set-up directory for storing pre-backup scripts
 
  file:
 
    path: "/etc/duply/main/pre.d/"
 
    state: directory
 
    owner: root
 
    group: root
 
    mode: 0700
 
    mode: "0700"
 

	
 
- name: Set-up script for running all pre-backup scripts
 
  copy:
 
    src: "duply_pre"
 
    dest: "/etc/duply/main/pre"
 
    owner: root
 
    group: root
 
    mode: 0700
 
    mode: "0700"
 

	
 
- name: Deploy crontab entry for running backups
 
  cron:
 
    name: backup
 
    cron_file: backup
 
    hour: "2"
 
@@ -131,13 +131,13 @@
 
  copy:
 
    content: ""
 
    dest: /etc/duply/main/include
 
    force: false
 
    group: root
 
    owner: root
 
    mode: 0600
 
    mode: "0600"
 

	
 
- name: Explicitly run all handlers
 
  include_tasks: ../handlers/main.yml
 
  when: "run_handlers | default(False) | bool()"
 
  tags:
 
    - handlers
roles/backup_server/tasks/main.yml
Show inline comments
 
@@ -10,13 +10,13 @@
 
- name: Create directory for storing backups
 
  file:
 
    path: "/srv/backups"
 
    state: directory
 
    owner: root
 
    group: root
 
    mode: 0751
 
    mode: "0751"
 

	
 
- name: Create backup client groups
 
  group:
 
    name: "{{ item.server | replace('.', '_') | regex_replace('^', 'bak-') }}"
 
    gid: "{{ item.uid | default(omit) }}"
 
    system: true
 
@@ -37,31 +37,31 @@
 
- name: Create home directories for backup client users
 
  file:
 
    path: "/srv/backups/{{ item.server }}"
 
    state: directory
 
    owner: root
 
    group: "{{ item.server | replace('.', '_') | regex_replace('^', 'bak-') }}"
 
    mode: 0750
 
    mode: "0750"
 
  with_items: "{{ backup_clients }}"
 

	
 
- name: Create duplicity directories for backup client users
 
  file:
 
    path: "/srv/backups/{{ item.server }}/duplicity"
 
    state: directory
 
    owner: "{{ item.server | replace('.', '_') | regex_replace('^', 'bak-') }}"
 
    group: "{{ item.server | replace('.', '_') | regex_replace('^', 'bak-') }}"
 
    mode: 0770
 
    mode: "0770"
 
  with_items: "{{ backup_clients }}"
 

	
 
- name: Create SSH directory for backup client users
 
  file:
 
    path: "/srv/backups/{{ item.server }}/.ssh"
 
    state: directory
 
    owner: root
 
    group: root
 
    mode: 0751
 
    mode: "0751"
 
  with_items: "{{ backup_clients }}"
 

	
 
- name: Populate authorized keys for backup client users
 
  authorized_key:
 
    user: "{{ item.server | replace('.', '_') | regex_replace('^', 'bak-') }}"
 
    key: "{{ item.public_key }}"
 
@@ -72,13 +72,13 @@
 
- name: Set-up authorized_keys file permissions for backup client users
 
  file:
 
    path: "/srv/backups/{{ item.server }}/.ssh/authorized_keys"
 
    state: file
 
    owner: root
 
    group: "{{ item.server | replace('.', '_') | regex_replace('^', 'bak-') }}"
 
    mode: 0640
 
    mode: "0640"
 
  with_items: "{{ backup_clients }}"
 

	
 
- name: Deny the backup group login via regular SSH
 
  lineinfile:
 
    dest: "/etc/ssh/sshd_config"
 
    state: present
 
@@ -89,53 +89,53 @@
 
- name: Set-up directory for the backup OpenSSH server instance
 
  file:
 
    path: "/etc/ssh-backup/"
 
    state: directory
 
    owner: root
 
    group: root
 
    mode: 0700
 
    mode: "0700"
 

	
 
- name: Deploy configuration file for the backup OpenSSH server instance service
 
  copy:
 
    src: "ssh-backup.default"
 
    dest: "/etc/default/ssh-backup"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  notify:
 
    - Restart backup SSH server
 

	
 
- name: Deploy configuration file for the backup OpenSSH server instance
 
  copy:
 
    src: "backup-sshd_config"
 
    dest: "/etc/ssh-backup/sshd_config"
 
    owner: root
 
    group: root
 
    mode: 0600
 
    mode: "0600"
 
  notify:
 
    - Restart backup SSH server
 

	
 
- name: Deploy the private keys for backup OpenSSH server instance
 
  template:
 
    src: "ssh_host_key.j2"
 
    dest: "/etc/ssh-backup/ssh_host_{{ item.key }}_key"
 
    owner: root
 
    group: root
 
    mode: 0600
 
    mode: "0600"
 
  with_dict: "{{ backup_host_ssh_private_keys }}"
 
  notify:
 
    - Restart backup SSH server
 
  no_log: true
 

	
 
- name: Deploy backup OpenSSH server systemd service file
 
  copy:
 
    src: "ssh-backup.service"
 
    dest: "/etc/systemd/system/ssh-backup.service"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  notify:
 
    - Reload systemd
 
    - Restart backup SSH server
 

	
 
- name: Start and enable OpenSSH backup service
 
  service:
 
@@ -146,13 +146,13 @@
 
- name: Deploy firewall configuration for backup server
 
  template:
 
    src: "ferm_backup.conf.j2"
 
    dest: "/etc/ferm/conf.d/40-backup.conf"
 
    owner: root
 
    group: root
 
    mode: 0640
 
    mode: "0640"
 
  notify:
 
    - Restart ferm
 

	
 
- name: Explicitly run all handlers
 
  include_tasks: ../handlers/main.yml
 
  when: "run_handlers | default(False) | bool()"
roles/bootstrap/tasks/main.yml
Show inline comments
 
@@ -23,13 +23,13 @@
 
    key: "{{ ansible_key }}"
 

	
 
- name: Set-up password-less sudo for the ansible user
 
  copy:
 
    src: "ansible_sudo"
 
    dest: "/etc/sudoers.d/ansible"
 
    mode: 0640
 
    mode: "0640"
 
    owner: root
 
    group: root
 

	
 
- name: Revoke rights for Ansible user to log-in as root to server via ssh
 
  authorized_key:
 
    user: root
roles/common/molecule/default/converge.yml
Show inline comments
 
@@ -14,26 +14,26 @@
 
    - name: Set-up directories for testing pip requirements upgrade checks script
 
      file:
 
        path: "{{ item }}"
 
        state: directory
 
        owner: root
 
        group: pipreqcheck
 
        mode: 0750
 
        mode: "0750"
 
      with_items:
 
        - "/tmp/pip_check_requirements_upgrades"
 
        - "/tmp/pip_check_requirements_upgrades/with_updates"
 
        - "/tmp/pip_check_requirements_upgrades/without_updates"
 

	
 
    - name: Deploy files for testing pip requirements upgrade checks script
 
      copy:
 
        src: "{{ item }}"
 
        dest: "/tmp/{{ item }}"
 
        owner: root
 
        group: pipreqcheck
 
        mode: 0640
 
        directory_mode: 0750
 
        mode: "0640"
 
        directory_mode: "0750"
 
      with_items:
 
        - "pip_check_requirements_upgrades/with_updates/requirements.in"
 
        - "pip_check_requirements_upgrades/with_updates/requirements.txt"
 
        - "pip_check_requirements_upgrades/without_updates/requirements.in"
 
        - "pip_check_requirements_upgrades/without_updates/requirements.txt"
 

	
 
@@ -45,13 +45,13 @@
 
    - name: Deploy firewall configuration file for the web server
 
      copy:
 
        src: ferm_http.conf
 
        dest: /etc/ferm/conf.d/99-http.conf
 
        owner: root
 
        group: root
 
        mode: 0640
 
        mode: "0640"
 
      notify:
 
        - Restart ferm
 

	
 
  handlers:
 

	
 
    - name: Restart ferm
roles/common/molecule/default/prepare.yml
Show inline comments
 
@@ -67,13 +67,13 @@
 
      lineinfile:
 
        path: /etc/hosts
 
        regexp: "^{{ item.key }}"
 
        line: "{{ item.key }} {{ item.value }}"
 
        owner: root
 
        group: root
 
        mode: 0644
 
        mode: "0644"
 
        state: present
 
      with_dict:
 
        192.168.56.21: parameters-mandatory-bookworm
 
        192.168.56.22: parameters-optional-bookworm
 
        fd00::192:168:56:21: parameters-mandatory-bookworm
 
        fd00::192:168:56:22: parameters-optional-bookworm
 
@@ -87,13 +87,13 @@
 
      lineinfile:
 
        path: /etc/hosts
 
        regexp: "^{{ item.key }}"
 
        line: "{{ item.key }} {{ item.value }}"
 
        owner: root
 
        group: root
 
        mode: 0644
 
        mode: "0644"
 
        state: present
 
      with_dict:
 
        192.168.56.3: client1
 
        192.168.56.4: client2
 

	
 
    - name: Load legacy iptables to test their removal
 
@@ -137,29 +137,29 @@
 
    - name: Create deprecated directory for storing requirements files created using Python 3 (pip requirements upgrade checks)
 
      file:
 
        path: "/etc/pip_check_requirements_upgrades-py3"
 
        state: directory
 
        owner: root
 
        group: root
 
        mode: 0750
 
        mode: "0750"
 

	
 
    - name: Create deprecated directory for Python 3 virtual environment (pip requirements upgrade checks)
 
      file:
 
        path: "/var/lib/pipreqcheck/virtualenv-py3/"
 
        state: directory
 
        owner: root
 
        group: root
 
        mode: 0750
 
        mode: "0750"
 

	
 
    - name: Create deprecated cronjob file for Python 3 (pip requirements upgrade checks)
 
      file:
 
        path: "/etc/cron.d/check_pip_requirements-py3"
 
        state: touch
 
        owner: root
 
        group: root
 
        mode: 0644
 
        mode: "0644"
 

	
 
    - name: Install the deprecated/obsolete NTP-related packages
 
      apt:
 
        name:
 
          - ntp
 
          - ntpdate
roles/common/tasks/main.yml
Show inline comments
 
@@ -26,13 +26,13 @@
 
- name: Enable use of proxy for retrieving system packages via apt
 
  template:
 
    src: "apt_proxy.j2"
 
    dest: "/etc/apt/apt.conf.d/00proxy"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  when: apt_proxy is defined
 

	
 
- name: Disable use of proxy for retrieving system packages via apt
 
  file:
 
    path: "/etc/apt/apt.conf.d/00proxy"
 
    state: absent
 
@@ -41,13 +41,13 @@
 
- name: Deploy pam-auth-update configuration file for enabling pam_umask
 
  copy:
 
    src: "pam_umask"
 
    dest: "/usr/share/pam-configs/umask"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  register: pam_umask
 
  notify:
 
    - Update PAM configuration
 

	
 
- name: Update PAM configuration  # noqa no-handler
 
  # [no-handler] Tasks that run when changed should likely be handlers
 
@@ -78,29 +78,29 @@
 
- name: Deploy bash profile configuration for fancier prompts
 
  template:
 
    src: "bash_prompt.sh.j2"
 
    dest: "/etc/profile.d/bash_prompt.sh"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 

	
 
- name: Deploy profile configuration that allows for user-specific profile.d files
 
  copy:
 
    src: "user_profile_d.sh"
 
    dest: "/etc/profile.d/z99-user_profile_d.sh"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 

	
 
- name: Replace default and skeleton bashrc
 
  copy:
 
    src: "{{ item.key }}"
 
    dest: "{{ item.value }}"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  with_dict:
 
    bashrc: "/etc/bash.bashrc"
 
    skel_bashrc: "/etc/skel/.bashrc"
 

	
 
- name: Calculate stock checksum for bashrc root account
 
  stat:
 
@@ -110,13 +110,13 @@
 
- name: Replace stock bashrc for root account with skeleton one
 
  copy:
 
    src: "skel_bashrc"
 
    dest: "/root/.bashrc"
 
    owner: root
 
    group: root
 
    mode: 0640
 
    mode: "0640"
 
  # Checksums: bookworm
 
  when: |
 
    root_bashrc_stat.stat.checksum == "1a422a148ad225aa5ba33f8dafd2b7cfcdbd701f"
 

	
 
- name: Install sudo
 
  apt:
 
@@ -136,13 +136,13 @@
 
- name: Disable electric-indent-mode for Emacs by default for all users
 
  copy:
 
    src: "01disable-electric-indent-mode.el"
 
    dest: "/etc/emacs/site-start.d/01disable-electric-indent-mode.el"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  when: "['emacs24', 'emacs24-nox', 'emacs25', 'emacs25-nox', 'emacs', 'emacs-nox'] | intersect(common_packages) | length > 0"
 

	
 
- name: Set-up operating system groups
 
  group:
 
    name: "{{ item.name }}"
 
    gid: "{{ item.gid | default(omit) }}"
 
@@ -198,13 +198,13 @@
 
- name: Deploy CA certificates
 
  copy:
 
    content: "{{ item.value }}"
 
    dest: "/usr/local/share/ca-certificates/{{ item.key }}.crt"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  with_dict: "{{ ca_certificates }}"
 
  register: deploy_ca_certificates_result
 

	
 
- name: Update CA certificate cache  # noqa no-handler
 
  # [no-handler] Tasks that run when changed should likely be handlers
 
  #   CA certificate cache must be updated immediatelly in order for
 
@@ -226,13 +226,13 @@
 
- name: Deploy the patched ferm binary that disables use of legacy iptables
 
  copy:
 
    src: ferm_binary
 
    dest: /usr/sbin/ferm
 
    owner: root
 
    group: root
 
    mode: 0755
 
    mode: "0755"
 
  notify:
 
    - Restart ferm
 

	
 
- name: Install ferm (for firewall management)
 
  apt:
 
    name: ferm
 
@@ -241,31 +241,31 @@
 
- name: Configure ferm init script coniguration file
 
  copy:
 
    src: "ferm_default"
 
    dest: "/etc/default/ferm"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  notify:
 
    - Restart ferm
 

	
 
- name: Create directory for storing ferm configuration files
 
  file:
 
    dest: "/etc/ferm/conf.d/"
 
    state: directory
 
    owner: root
 
    group: root
 
    mode: 0750
 
    mode: "0750"
 

	
 
- name: Deploy main ferm configuration file
 
  copy:
 
    src: "ferm.conf"
 
    dest: "/etc/ferm/ferm.conf"
 
    owner: root
 
    group: root
 
    mode: 0640
 
    mode: "0640"
 
  notify:
 
    - Restart ferm
 

	
 
- name: Verify maintenance_allowed_sources parameter
 
  fail:
 
    msg: "Items in maintenance_allowed_sources must IPv4/IPv6 addresses or subnets: {{ item }}"
 
@@ -275,13 +275,13 @@
 
- name: Deploy ferm base rules
 
  template:
 
    src: "00-base.conf.j2"
 
    dest: "/etc/ferm/conf.d/00-base.conf"
 
    owner: root
 
    group: root
 
    mode: 0640
 
    mode: "0640"
 
  notify:
 
    - Restart ferm
 

	
 
- name: Enable and start ferm
 
  service:
 
    name: ferm
 
@@ -291,13 +291,13 @@
 
- name: Deploy script for flushing legacy iptables rules
 
  copy:
 
    src: "legacy_iptables_rules.sh"
 
    dest: "/usr/local/sbin/drop_legacy_iptables_rules.sh"
 
    owner: root
 
    group: root
 
    mode: 0755
 
    mode: "0755"
 

	
 
- name: Drop legacy iptables rules
 
  command: "/usr/local/sbin/drop_legacy_iptables_rules.sh remove"
 
  register: legacy_iptables_rules
 
  changed_when: "'Removed legacy iptables for families' in legacy_iptables_rules.stdout"
 
  notify:
 
@@ -306,21 +306,21 @@
 
- name: Deploy script for validating server certificates
 
  copy:
 
    src: "check_certificate.sh"
 
    dest: "/usr/local/bin/check_certificate.sh"
 
    owner: root
 
    group: root
 
    mode: 0755
 
    mode: "0755"
 

	
 
- name: Set-up directory for holding configuration for certificate validation script
 
  file:
 
    path: "/etc/check_certificate"
 
    state: "directory"
 
    owner: root
 
    group: root
 
    mode: 0755
 
    mode: "0755"
 

	
 
- name: Deploy crontab entry for checking certificates
 
  cron:
 
    name: "check_certificate"
 
    cron_file: "check_certificate"
 
    hour: "0"
 
@@ -407,13 +407,13 @@
 
- name: Create directory for Python virtual environment used for installing/running pip-tools
 
  file:
 
    path: "{{ item }}"
 
    state: directory
 
    owner: pipreqcheck
 
    group: pipreqcheck
 
    mode: 0750
 
    mode: "0750"
 
  with_items:
 
    - "/var/lib/pipreqcheck"
 
    - "/var/lib/pipreqcheck/virtualenv"
 

	
 
- name: Create Python virtual environment used for installing/running pip-tools
 
  command: "/usr/bin/virtualenv --python '{{ item.python_path }}' --prompt '{{ item.virtualenv_prompt }}' '{{ item.virtualenv_path }}'"
 
@@ -431,44 +431,44 @@
 
- name: Create directory for storing pip requirements files
 
  file:
 
    path: "{{ item }}"
 
    state: "directory"
 
    owner: root
 
    group: pipreqcheck
 
    mode: 0750
 
    mode: "0750"
 
  with_items:
 
    - "/etc/pip_check_requirements_upgrades"
 

	
 
- name: Set-up directory for storing pip requirements file for pip-tools virtual environment itself
 
  file:
 
    path: "{{ item }}"
 
    state: "directory"
 
    owner: root
 
    group: pipreqcheck
 
    mode: 0750
 
    mode: "0750"
 
  with_items:
 
    - "/etc/pip_check_requirements_upgrades/pipreqcheck"
 

	
 
- name: Deploy .in file for pip requirements in pip-tools virtual environment
 
  template:
 
    src: "pipreqcheck_requirements.in.j2"
 
    dest: "{{ item.path }}"
 
    owner: root
 
    group: pipreqcheck
 
    mode: 0640
 
    mode: "0640"
 
  with_items:
 
    - path: "/etc/pip_check_requirements_upgrades/pipreqcheck/requirements.in"
 
      requirements: "{{ pip_check_requirements_in }}"
 

	
 
- name: Deploy requirements file for pipreqcheck virtual environment
 
  template:
 
    src: "pipreqcheck_requirements.txt.j2"
 
    dest: "{{ item.file }}"
 
    owner: root
 
    group: pipreqcheck
 
    mode: 0640
 
    mode: "0640"
 
  with_items:
 
    - file: "/etc/pip_check_requirements_upgrades/pipreqcheck/requirements.txt"
 
      requirements: "{{ pip_check_requirements }}"
 

	
 
- name: Install requirements in the pipreqcheck virtual environment
 
  pip:
 
@@ -492,21 +492,21 @@
 
- name: Deploy script for checking available upgrades
 
  copy:
 
    src: "pip_check_requirements_upgrades.sh"
 
    dest: "/usr/local/bin/pip_check_requirements_upgrades.sh"
 
    owner: root
 
    group: root
 
    mode: 0755
 
    mode: "0755"
 

	
 
- name: Deploy crontab entry for checking pip requirements
 
  copy:
 
    src: "cron_check_pip_requirements"
 
    dest: "/etc/cron.d/check_pip_requirements"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 

	
 
- name: Install NTP packages
 
  apt:
 
    name:
 
      - ntpsec
 
      - ntpsec-ntpdate
 
@@ -525,13 +525,13 @@
 
- name: Deploy NTP configuration
 
  template:
 
    src: "ntp.conf.j2"
 
    dest: "/etc/ntpsec/ntp.conf"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  when: ntp_pools | length > 0
 
  notify:
 
    - Restart NTP server
 

	
 
- name: Explicitly run all handlers
 
  include_tasks: ../handlers/main.yml
roles/database/tasks/backup.yml
Show inline comments
 
@@ -3,18 +3,18 @@
 
- name: Create directory for storing MariaDB database dumps
 
  file:
 
    path: "{{ item }}"
 
    state: directory
 
    owner: root
 
    group: root
 
    mode: 0700
 
    mode: "0700"
 
  with_items:
 
    - "/srv/backup"
 
    - "/srv/backup/mariadb"
 

	
 
- name: Deploy script for creating database backup dumps
 
  template:
 
    src: "dump_db.sh.j2"
 
    dest: "/etc/duply/main/pre.d/dump_{{ db_name }}.sh"
 
    owner: root
 
    group: root
 
    mode: 0700
 
    mode: "0700"
roles/database_server/tasks/main.yml
Show inline comments
 
@@ -17,13 +17,13 @@
 
- name: Set UTF-8 encoding as default for MariaDB
 
  template:
 
    src: "utf8.cnf.j2"
 
    dest: "/etc/mysql/mariadb.conf.d/90-utf8.cnf"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  register: mariadb_utf8_configuration
 

	
 
- name: Restart MariaDB in order to use UTF-8 as default character set  # noqa no-handler
 
  # [no-handler] Tasks that run when changed should likely be handlers
 
  #   UTF-8 configuration must be applied immediatelly in order to ensure that
 
  #   subsequent tasks that create databases will end-up with correct (UTF-8)
roles/ldap_client/tasks/main.yml
Show inline comments
 
@@ -8,21 +8,21 @@
 
- name: Set-up LDAP client configuration directory
 
  file:
 
    path: /etc/ldap/
 
    state: directory
 
    owner: root
 
    group: root
 
    mode: 0755
 
    mode: "0755"
 

	
 
- name: Deploy LDAP client configuration file
 
  template:
 
    src: ldap.conf.j2
 
    dest: /etc/ldap/ldap.conf
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 

	
 
- name: Explicitly run all handlers
 
  include_tasks: ../handlers/main.yml
 
  when: "run_handlers | default(False) | bool()"
 
  tags:
 
    - handlers
roles/ldap_server/molecule/default/prepare.yml
Show inline comments
 
@@ -52,13 +52,13 @@
 
    - name: Deploy CA certificate
 
      copy:
 
        src: tests/data/x509/ca/level1.cert.pem
 
        dest: /etc/ssl/certs/testca.cert.pem
 
        owner: root
 
        group: root
 
        mode: 0644
 
        mode: "0644"
 

	
 
    - name: Remove the ss utility (see https://github.com/philpep/testinfra/pull/320)
 
      file:
 
        path: "/bin/ss"
 
        state: absent
 

	
 
@@ -84,13 +84,13 @@
 
      lineinfile:
 
        path: /etc/hosts
 
        regexp: "^{{ item.key }}"
 
        line: "{{ item.key }} {{ item.value }}"
 
        owner: root
 
        group: root
 
        mode: 0644
 
        mode: "0644"
 
        state: present
 
      with_dict:
 
        192.168.56.21: parameters-mandatory-bookworm
 
        192.168.56.22: parameters-optional-bookworm
 

	
 
- name: Prepare, test fixtures
 
@@ -102,13 +102,13 @@
 
      lineinfile:
 
        path: /etc/hosts
 
        regexp: "^{{ item.key }}"
 
        line: "{{ item.key }} {{ item.value }}"
 
        owner: root
 
        group: root
 
        mode: 0644
 
        mode: "0644"
 
        state: present
 
      with_dict:
 
        127.0.2.1: parameters-optional
 

	
 
- name: Prepare, test fixtures
 
  hosts: parameters-mandatory
 
@@ -119,13 +119,13 @@
 
      lineinfile:
 
        path: /etc/hosts
 
        regexp: "^{{ item.key }}"
 
        line: "{{ item.key }} {{ item.value }}"
 
        owner: root
 
        group: root
 
        mode: 0644
 
        mode: "0644"
 
        state: present
 
      with_dict:
 
        127.0.2.1: parameters-mandatory
 

	
 
- name: Prepare, helpers
 
  hosts: backup-server
roles/ldap_server/tasks/backup.yml
Show inline comments
 
@@ -3,17 +3,17 @@
 
- name: Create directory for storing LDAP database dumps
 
  file:
 
    path: "{{ item }}"
 
    state: directory
 
    owner: root
 
    group: root
 
    mode: 0700
 
    mode: "0700"
 
  with_items:
 
    - "/srv/backup"
 

	
 
- name: Deploy script for creating LDAP database backup dumps
 
  copy:
 
    src: "ldapdump.sh"
 
    dest: "/etc/duply/main/pre.d/ldapdump.sh"
 
    owner: root
 
    group: root
 
    mode: 0700
 
    mode: "0700"
roles/ldap_server/tasks/main.yml
Show inline comments
 
@@ -79,45 +79,45 @@
 
# against under Debian) picking a matching DH parameter from RFC-7919
 
# (https://www.ietf.org/rfc/rfc7919.txt).
 
- name: Generate the LDAP server Diffie-Hellman parameter
 
  openssl_dhparam:
 
    owner: root
 
    group: openldap
 
    mode: 0640
 
    mode: "0640"
 
    path: "/etc/ssl/private/{{ ansible_fqdn }}_ldap.dh.pem"
 
    size: 2048
 
  notify:
 
    - Restart slapd
 

	
 
- name: Deploy LDAP TLS private key
 
  template:
 
    src: "ldap_tls_key.j2"
 
    dest: "/etc/ssl/private/{{ ansible_fqdn }}_ldap.key"
 
    mode: 0640
 
    mode: "0640"
 
    owner: root
 
    group: openldap
 
  notify:
 
    - Restart slapd
 

	
 
- name: Deploy LDAP TLS certificate
 
  template:
 
    src: "ldap_tls_cert.j2"
 
    dest: "/etc/ssl/certs/{{ ansible_fqdn }}_ldap.pem"
 
    mode: 0644
 
    mode: "0644"
 
    owner: root
 
    group: root
 
  notify:
 
    - Restart slapd
 

	
 
- name: Deploy configuration file for checking certificate validity via cron
 
  copy:
 
    content: "/etc/ssl/certs/{{ ansible_fqdn }}_ldap.pem"
 
    dest: "/etc/check_certificate/{{ ansible_fqdn }}_ldap.conf"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 

	
 
# We need to have this hack around TLS configuration because OpenLDAP
 
# expects both private key and certificate to be set at the same
 
# time.
 
#
 
# OpenLDAP server behaviour is a bit weird around this thing, so here
 
@@ -289,26 +289,26 @@
 
- name: Deploy firewall configuration for LDAP
 
  copy:
 
    src: "ferm_ldap.conf"
 
    dest: "/etc/ferm/conf.d/10-ldap.conf"
 
    owner: root
 
    group: root
 
    mode: 0640
 
    mode: "0640"
 
  notify:
 
    - Restart ferm
 

	
 
# @TODO: This whole thing could be dropped if newer version of Ansible
 
#        was in use (where community collection has the ldap_search
 
#        module.
 
- name: Deploy temporary file with LDAP admin password
 
  template:
 
    src: "ldap_admin_password.j2"
 
    dest: "/root/.ldap_admin_password"
 
    owner: root
 
    group: root
 
    mode: 0400
 
    mode: "0400"
 
  changed_when: false
 

	
 
- name: Test if LDAP admin password needs to be changed
 
  command: "ldapwhoami -H ldapi:/// -D 'cn=admin,{{ ldap_server_int_basedn }}' -x -y /root/.ldap_admin_password"
 
  register: ldap_admin_password_check
 
  changed_when: ldap_admin_password_check.rc != 0
roles/mail_forwarder/molecule/default/prepare.yml
Show inline comments
 
@@ -51,13 +51,13 @@
 
      lineinfile:
 
        path: /etc/hosts
 
        regexp: "^{{ item.key }}"
 
        line: "{{ item.key }} {{ item.value }}"
 
        owner: root
 
        group: root
 
        mode: 0644
 
        mode: "0644"
 
        state: present
 
      with_dict:
 
        192.168.56.11: "mail-server domain1"
 
        192.168.56.12: "client1"
 
        192.168.56.21: "parameters-mandatory-bookworm"
 
        192.168.56.22: "parameters-optional-bookworm"
 
@@ -86,13 +86,13 @@
 
    - name: Deploy CA certificate
 
      copy:
 
        src: tests/data/x509/ca/level1.cert.pem
 
        dest: /usr/local/share/ca-certificates/testca.crt
 
        owner: root
 
        group: root
 
        mode: 0644
 
        mode: "0644"
 
      notify:
 
        - Update CA certificate cache
 

	
 
  handlers:
 

	
 
    - name: Update CA certificate cache  # noqa no-changed-when
 
@@ -108,23 +108,23 @@
 
    - name: Deploy CA certificate
 
      copy:
 
        src: tests/data/x509/ca/level1.cert.pem
 
        dest: /usr/local/share/ca-certificates/testca.crt
 
        owner: root
 
        group: root
 
        mode: 0644
 
        mode: "0644"
 
      notify:
 
        - Update CA certificate cache
 

	
 
    - name: Deploy SMTP private key and certificate
 
      copy:
 
        src: "tests/data/x509/server/{{ item }}"
 
        dest: "/etc/ssl/{{ item }}"
 
        owner: root
 
        group: root
 
        mode: 0600
 
        mode: "0600"
 
      with_items:
 
        - mail-server_smtp.cert.pem
 
        - mail-server_smtp.key.pem
 

	
 
    - name: Install Postfix
 
      apt:
 
@@ -140,13 +140,13 @@
 
    - name: Deploy Postfix configuration
 
      copy:
 
        src: tests/data/main.cf
 
        dest: /etc/postfix/main.cf
 
        owner: root
 
        group: root
 
        mode: 0644
 
        mode: "0644"
 
      notify:
 
        - Restart Postfix
 

	
 
    - name: Install tool for testing TCP connectivity
 
      apt:
 
        name: hping3
roles/mail_forwarder/tasks/main.yml
Show inline comments
 
@@ -19,41 +19,41 @@
 
- name: Deploy the SMTP relay TLS truststore
 
  copy:
 
    content: "{{ smtp_relay_truststore }}"
 
    dest: "/etc/ssl/certs/smtp_relay_truststore.pem"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 

	
 
- name: Generate the SMTP server Diffie-Hellman parameter
 
  openssl_dhparam:
 
    owner: root
 
    group: root
 
    mode: 0640
 
    mode: "0640"
 
    path: "/etc/ssl/private/{{ ansible_fqdn }}_smtp.dh.pem"
 
    size: 2048
 
  notify:
 
    - Restart Postfix
 

	
 
- name: Configure visible mail name of the system
 
  copy:
 
    content: "{{ inventory_hostname }}"
 
    dest: "/etc/mailname"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  notify:
 
    - Restart Postfix
 

	
 
- name: Deploy Postfix main configuration
 
  template:
 
    src: "main.cf.j2"
 
    dest: "/etc/postfix/main.cf"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  notify:
 
    - Restart Postfix
 

	
 
- name: Set-up local mail aliases
 
  lineinfile:
 
    dest: "/etc/aliases"
 
@@ -105,13 +105,13 @@
 
- name: Deploy firewall configuration for mail forwader
 
  template:
 
    src: "ferm_mail.conf.j2"
 
    dest: "/etc/ferm/conf.d/20-mail.conf"
 
    owner: root
 
    group: root
 
    mode: 0640
 
    mode: "0640"
 
  notify:
 
    - Restart ferm
 

	
 
- name: Install SWAKS
 
  apt:
 
    name: swaks
roles/mail_server/molecule/default/prepare.yml
Show inline comments
 
@@ -80,13 +80,13 @@
 
    - name: Set-up directory for ClamAV database sync tool virtual environment
 
      file:
 
        path: /var/lib/cvdupdate
 
        state: directory
 
        owner: vagrant
 
        group: vagrant
 
        mode: 0755
 
        mode: "0755"
 

	
 
    - name: Create virtual environment for running ClamAV database sync tool
 
      become: true
 
      become_user: vagrant
 
      command:
 
        cmd: "/usr/bin/virtualenv --python /usr/bin/python3 --prompt '(cvdupdate) ' /var/lib/cvdupdate"
 
@@ -95,33 +95,33 @@
 
    - name: Deploy pip requirements file for running the ClamAV database sync tool
 
      copy:
 
        src: cvdupdate-requirements.txt
 
        dest: /var/lib/cvdupdate/requirements.txt
 
        owner: vagrant
 
        group: vagrant
 
        mode: 0644
 
        mode: "0644"
 

	
 
    - name: Install requirements in the pipreqcheck virtual environment
 
      become: true
 
      become_user: vagrant
 
      pip:
 
        requirements: /var/lib/cvdupdate/requirements.txt
 
        virtualenv: /var/lib/cvdupdate
 

	
 
    - name: Allow traversal of Vagrant directory by the http server user
 
      file:
 
        path: /vagrant/
 
        mode: 0711
 
        mode: "0711"
 

	
 
    - name: Create directory for storing ClamAV database files
 
      file:
 
        path: /vagrant/clamav-database
 
        state: directory
 
        owner: vagrant
 
        group: vagrant
 
        mode: 0755
 
        mode: "0755"
 

	
 
    - name: Configure default location for storing ClamAV database files  # noqa no-changed-when
 
      # [no-changed-when] Commands should not change things if nothing needs doing
 
      #   Does not matter in test prepare step.
 
      become: true
 
      become_user: vagrant
 
@@ -141,35 +141,35 @@
 
        recurse: true
 

	
 
    - name: Deploy nginx TLS private key
 
      copy:
 
        dest: "/etc/ssl/private/nginx_https.key"
 
        content: "{{ clamav_database_http_server_tls_key }}"
 
        mode: 0640
 
        mode: "0640"
 
        owner: root
 
        group: root
 
      notify:
 
        - Restart nginx
 

	
 
    - name: Deploy nginx TLS certificate
 
      copy:
 
        dest: "/etc/ssl/certs/nginx_https.pem"
 
        content: "{{ clamav_database_http_server_tls_certificate }}"
 
        mode: 0644
 
        mode: "0644"
 
        owner: root
 
        group: root
 
      notify:
 
        - Restart nginx
 

	
 
    - name: Deploy nginx configuration for serving the ClamAV database files
 
      copy:
 
        src: clamav-database-nginx.conf
 
        dest: /etc/nginx/sites-available/default
 
        owner: root
 
        group: root
 
        mode: 0644
 
        mode: "0644"
 
      notify:
 
        - Restart nginx
 

	
 
  handlers:
 

	
 
    - name: Restart nginx
 
@@ -194,23 +194,23 @@
 

	
 
          [system_default_sect]
 
          MinProtocol = TLSv1.1
 
          CipherString = DEFAULT@SECLEVEL=0
 
        owner: root
 
        group: root
 
        mode: 0644
 
        mode: "0644"
 
        state: present
 

	
 
    - name: Set-up the hosts file
 
      lineinfile:
 
        path: /etc/hosts
 
        regexp: "^{{ item.key }}"
 
        line: "{{ item.key }} {{ item.value }}"
 
        owner: root
 
        group: root
 
        mode: 0644
 
        mode: "0644"
 
        state: present
 
      with_dict:
 
        # Force mail servers to use local ClamAV database mirror.
 
        192.168.56.11: "db.local.clamav.net database.clamav.net"
 
        192.168.56.12: "ldap-server backup-server"
 
        192.168.56.21: "client1 smtp-server-requiring-tls"
 
@@ -282,26 +282,26 @@
 
    - name: Deploy IMAP CLI configuration
 
      copy:
 
        src: "tests/data/{{ item }}"
 
        dest: "/home/vagrant/{{ item }}"
 
        owner: vagrant
 
        group: vagrant
 
        mode: 0600
 
        mode: "0600"
 
      with_items:
 
        - imapcli-parameters-mandatory-john_doe.conf
 
        - imapcli-parameters-mandatory-jane_doe.conf
 
        - imapcli-parameters-optional-john_doe.conf
 
        - imapcli-parameters-optional-jane_doe.conf
 

	
 
    - name: Deploy CA certificate
 
      copy:
 
        src: tests/data/x509/ca/level1.cert.pem
 
        dest: /usr/local/share/ca-certificates/testca.crt
 
        owner: root
 
        group: root
 
        mode: 0644
 
        mode: "0644"
 
      notify:
 
        - Update CA certificate cache
 

	
 
    - name: Install and configure Postfix for testing mail sending from managed servers
 
      block:
 

	
 
@@ -319,13 +319,13 @@
 
        - name: Configure Postfix
 
          template:
 
            src: "helper_smtp_main.cf.j2"
 
            dest: "/etc/postfix/main.cf"
 
            owner: root
 
            group: root
 
            mode: 0644
 
            mode: "0644"
 
          notify:
 
            - Restart Postfix
 

	
 
        - name: Enable Postfix service
 
          service:
 
            name: postfix
roles/mail_server/tasks/main.yml
Show inline comments
 
@@ -40,75 +40,75 @@
 
    groups: ssl-cert
 

	
 
- name: Deploy SMTP TLS private key
 
  copy:
 
    dest: "/etc/ssl/private/{{ ansible_fqdn }}_smtp.key"
 
    content: "{{ smtp_tls_key }}"
 
    mode: 0640
 
    mode: "0640"
 
    owner: root
 
    group: root
 
  notify:
 
    - Restart Postfix
 

	
 
- name: Deploy SMTP TLS certificate
 
  copy:
 
    dest: "/etc/ssl/certs/{{ ansible_fqdn }}_smtp.pem"
 
    content: "{{ smtp_tls_certificate }}"
 
    mode: 0644
 
    mode: "0644"
 
    owner: root
 
    group: root
 
  notify:
 
    - Restart Postfix
 

	
 
- name: Generate the SMTP server Diffie-Hellman parameter
 
  openssl_dhparam:
 
    owner: root
 
    group: root
 
    mode: 0640
 
    mode: "0640"
 
    path: "/etc/ssl/private/{{ ansible_fqdn }}_smtp.dh.pem"
 
    size: 2048
 
  notify:
 
    - Restart Postfix
 

	
 
- name: Deploy IMAP TLS private key
 
  copy:
 
    dest: "/etc/ssl/private/{{ ansible_fqdn }}_imap.key"
 
    content: "{{ imap_tls_key }}"
 
    mode: 0640
 
    mode: "0640"
 
    owner: root
 
    group: root
 
  notify:
 
    - Restart Dovecot
 

	
 
- name: Deploy IMAP TLS certificate
 
  copy:
 
    dest: "/etc/ssl/certs/{{ ansible_fqdn }}_imap.pem"
 
    content: "{{ imap_tls_certificate }}"
 
    mode: 0644
 
    mode: "0644"
 
    owner: root
 
    group: root
 
  notify:
 
    - Restart Dovecot
 

	
 
- name: Generate the IMAP server Diffie-Hellman parameter
 
  openssl_dhparam:
 
    owner: root
 
    group: root
 
    mode: 0640
 
    mode: "0640"
 
    path: "/etc/ssl/private/{{ ansible_fqdn }}_imap.dh.pem"
 
    size: 2048
 
  notify:
 
    - Restart Dovecot
 

	
 
- name: Deploy configuration files for checking certificate validity via cron
 
  copy:
 
    content: "/etc/ssl/certs/{{ ansible_fqdn }}_{{ item }}.pem"
 
    dest: "/etc/check_certificate/{{ ansible_fqdn }}_{{ item }}.conf"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  with_items:
 
    - smtp
 
    - imap
 

	
 
- name: Install SWAKS
 
  apt:
 
@@ -121,22 +121,22 @@
 
    state: present
 

	
 
- name: Configure ClamAV Milter
 
  copy:
 
    dest: "/etc/clamav/clamav-milter.conf"
 
    src: "clamav-milter.conf"
 
    mode: 0644
 
    mode: "0644"
 
    owner: root
 
    group: root
 
  notify:
 
    - Restart ClamAV Milter
 

	
 
- name: Set-up privileges for directories within Postfix chroot
 
  file:
 
    dest: "{{ item }}"
 
    mode: 0755
 
    mode: "0755"
 
    state: directory
 
    owner: root
 
    group: root
 
  with_items:
 
    - /var/spool/postfix/var
 
    - /var/spool/postfix/var/run
 
@@ -144,51 +144,51 @@
 
- name: Set-up privileges for directories within Postfix chroot
 
  file:
 
    dest: "{{ item }}"
 
    state: directory
 
    owner: clamav
 
    group: clamav
 
    mode: 0755
 
    mode: "0755"
 
  with_items:
 
    - /var/spool/postfix/var/run/clamav
 

	
 
- name: Deploy the LDAP TLS truststore in default location
 
  copy:
 
    content: "{{ mail_ldap_tls_truststore }}"
 
    dest: "/etc/ssl/certs/mail_ldap_tls_truststore.pem"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 

	
 
- name: Deploy the LDAP TLS truststore in Postfix chroot
 
  copy:
 
    content: "{{ mail_ldap_tls_truststore }}"
 
    dest: "/var/spool/postfix/etc/ssl/certs/mail_ldap_tls_truststore.pem"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  notify:
 
    - Restart Postfix
 

	
 
- name: Configure visible mail name of the system
 
  copy:
 
    content: "{{ inventory_hostname }}"
 
    dest: "/etc/mailname"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  notify:
 
    - Restart Postfix
 

	
 
- name: Deploy Postfix configurations files for LDAP look-ups
 
  template:
 
    src: "{{ item }}.cf.j2"
 
    dest: "/etc/postfix/{{ item }}.cf"
 
    owner: root
 
    group: postfix
 
    mode: 0640
 
    mode: "0640"
 
  with_items:
 
    - ldap-virtual-alias-maps
 
    - ldap-virtual-mailbox-domains
 
    - ldap-virtual-mailbox-maps
 
  notify:
 
    - Restart Postfix
 
@@ -196,13 +196,13 @@
 
- name: Deploy Postfix main configuration
 
  template:
 
    src: "main.cf.j2"
 
    dest: "/etc/postfix/main.cf"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  notify:
 
    - Restart Postfix
 

	
 
- name: Set-up local mail aliases
 
  lineinfile:
 
    dest: "/etc/aliases"
 
@@ -238,33 +238,33 @@
 
- name: Deploy Dovecot configuration file with overrides
 
  template:
 
    src: "99-local.conf.j2"
 
    dest: "/etc/dovecot/conf.d/99-local.conf"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  notify:
 
    - Restart Dovecot
 

	
 
- name: Deploy Dovecot configuration file for LDAP look-ups
 
  template:
 
    src: "dovecot-ldap.conf.ext.j2"
 
    dest: "/etc/dovecot/dovecot-ldap.conf.ext"
 
    owner: root
 
    group: root
 
    mode: 0600
 
    mode: "0600"
 
  notify:
 
    - Restart Dovecot
 

	
 
- name: Deploy Postifx master process configuration
 
  template:
 
    src: "master.cf.j2"
 
    dest: "/etc/postfix/master.cf"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  notify:
 
    - Restart Postfix
 

	
 
- name: Enable and start ClamAV database update service (freshclam)
 
  service:
 
    name: clamav-freshclam
 
@@ -317,13 +317,13 @@
 
- name: Deploy firewall configuration for mail server
 
  copy:
 
    src: "ferm_mail.conf"
 
    dest: "/etc/ferm/conf.d/20-mail.conf"
 
    owner: root
 
    group: root
 
    mode: 0640
 
    mode: "0640"
 
  notify:
 
    - Restart ferm
 

	
 
- name: Explicitly run all handlers
 
  include_tasks: ../handlers/main.yml
 
  when: "run_handlers | default(False) | bool()"
roles/php_website/molecule/default/converge.yml
Show inline comments
 
@@ -59,41 +59,41 @@
 
    - name: Set-up directory where PHP files are hosted at
 
      file:
 
        path: /var/www/parameters-mandatory/htdocs
 
        state: directory
 
        owner: admin-parameters-mandatory
 
        group: web-parameters-mandatory
 
        mode: 0750
 
        mode: "0750"
 

	
 
    - name: Deploy a couple of PHP pages for testing purposes
 
      copy:
 
        src: "tests/data/php/mandatory/{{ item }}"
 
        dest: "/var/www/parameters-mandatory/htdocs/{{ item }}"
 
        owner: admin-parameters-mandatory
 
        group: web-parameters-mandatory
 
        mode: 0640
 
        mode: "0640"
 
      with_items:
 
        - index.php
 
        - index.php3
 

	
 
    # parameters-optional application
 
    - name: Set-up directory where PHP files are hosted at
 
      file:
 
        path: /var/www/parameters-optional.local/htdocs
 
        state: directory
 
        owner: admin-parameters-optional_local
 
        group: web-parameters-optional_local
 
        mode: 0750
 
        mode: "0750"
 

	
 
    - name: Deploy a couple of PHP pages for testing purposes
 
      copy:
 
        src: "tests/data/php/optional/{{ item }}"
 
        dest: "/var/www/parameters-optional.local/htdocs/{{ item }}"
 
        owner: admin-parameters-optional_local
 
        group: web-parameters-optional_local
 
        mode: 0640
 
        mode: "0640"
 
      with_items:
 
        - myindex.php
 
        - myindex.myphp
 
        - path.myphp
 
        - secretfile.txt
 
        - info.myphp
roles/php_website/tasks/main.yml
Show inline comments
 
@@ -19,13 +19,13 @@
 
- name: Set-up directory for storing user profile configuration files
 
  file:
 
    path: "{{ home }}/.profile.d"
 
    state: directory
 
    owner: "{{ admin }}"
 
    group: "{{ user }}"
 
    mode: 0750
 
    mode: "0750"
 

	
 
- name: Create PHP website user
 
  user:
 
    name: "{{ user }}"
 
    uid: "{{ uid | default(omit) }}"
 
    group: "{{ user }}"
 
@@ -52,13 +52,13 @@
 
- name: Set-up forwarding for mails delivered to local application user/admin
 
  template:
 
    src: "forward.j2"
 
    dest: "{{ home }}/.forward"
 
    owner: root
 
    group: "{{ user }}"
 
    mode: 0640
 
    mode: "0640"
 

	
 
- name: Install extra packages for website
 
  apt:
 
    name: "{{ packages }}"
 
    state: present
 

	
 
@@ -66,51 +66,51 @@
 
  template:
 
    src: "fpm_site.conf.j2"
 
    dest: "{{ php_fpm_pool_directory }}/{{ fqdn }}.conf"
 
    validate: "{{ php_fpm_binary }} -t -y %s"
 
    owner: root
 
    group: root
 
    mode: 0640
 
    mode: "0640"
 
  notify:
 
    - Restart PHP-FPM
 

	
 
- name: Deploy nginx TLS private key for website
 
  copy:
 
    dest: "/etc/ssl/private/{{ fqdn }}_https.key"
 
    content: "{{ https_tls_key }}"
 
    owner: root
 
    group: root
 
    mode: 0640
 
    mode: "0640"
 
  notify:
 
    - Restart nginx
 

	
 
- name: Deploy nginx TLS certificate for website
 
  copy:
 
    dest: "/etc/ssl/certs/{{ fqdn }}_https.pem"
 
    content: "{{ https_tls_certificate }}"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  notify:
 
    - Restart nginx
 

	
 
- name: Deploy configuration file for checking certificate validity via cron
 
  copy:
 
    content: "/etc/ssl/certs/{{ fqdn }}_https.pem"
 
    dest: "/etc/check_certificate/{{ fqdn }}_https.conf"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 

	
 
- name: Deploy nginx configuration file for website
 
  template:
 
    src: "nginx_site.j2"
 
    dest: "/etc/nginx/sites-available/{{ fqdn }}"
 
    owner: root
 
    group: root
 
    mode: 0640
 
    mode: "0640"
 
    validate: "/usr/local/bin/nginx_verify_site.sh -n '{{ fqdn }}' %s"
 
  notify:
 
    - Restart nginx
 

	
 
- name: Enable website
 
  file:
roles/preseed/tasks/main.yml
Show inline comments
 
---
 

	
 
- name: Create directory for storing preseed configurations
 
  file:
 
    path: "{{ preseed_directory }}"
 
    mode: 0750
 
    mode: "0750"
 
    state: directory
 

	
 
- name: Create preseed configuration file
 
  template:
 
    src: "preseed.cfg.j2"
 
    dest: "{{ preseed_directory }}/{{ item }}.cfg"
 
    mode: 0640
 
    mode: "0640"
 
  when: item != "localhost"
 
  with_items: "{{ groups['all'] }}"
 

	
 
- name: Explicitly run all handlers
 
  include_tasks: ../handlers/main.yml
 
  when: "run_handlers | default(False) | bool()"
roles/web_server/molecule/default/prepare.yml
Show inline comments
 
@@ -73,13 +73,13 @@
 

	
 
          [system_default_sect]
 
          MinProtocol = TLSv1.1
 
          CipherString = DEFAULT@SECLEVEL=0
 
        owner: root
 
        group: root
 
        mode: 0644
 
        mode: "0644"
 
        state: present
 

	
 
- name: Prepare, test fixtures
 
  hosts: all
 
  become: true
 
  tasks:
 
@@ -88,13 +88,13 @@
 
      lineinfile:
 
        path: /etc/hosts
 
        regexp: "^{{ item.key }}"
 
        line: "{{ item.key }} {{ item.value }}"
 
        owner: root
 
        group: root
 
        mode: 0644
 
        mode: "0644"
 
        state: present
 
      with_dict:
 
        192.168.56.11: "client"
 
        192.168.56.21: "parameters-mandatory-bookworm"
 
        192.168.56.22: "parameters-optional-bookworm"
 

	
 
@@ -121,13 +121,13 @@
 
    - name: Deploy CA certificate
 
      copy:
 
        src: tests/data/x509/ca/level1.cert.pem
 
        dest: /usr/local/share/ca-certificates/testca.crt
 
        owner: root
 
        group: root
 
        mode: 0644
 
        mode: "0644"
 
      notify:
 
        - Update CA certificate cache
 

	
 
  handlers:
 

	
 
    - name: Update CA certificate cache  # noqa no-changed-when
roles/web_server/tasks/main.yml
Show inline comments
 
@@ -14,45 +14,45 @@
 
    - Restart nginx
 

	
 
- name: Deploy nginx TLS private key
 
  copy:
 
    dest: "/etc/ssl/private/{{ ansible_fqdn }}_https.key"
 
    content: "{{ default_https_tls_key }}"
 
    mode: 0640
 
    mode: "0640"
 
    owner: root
 
    group: root
 
  notify:
 
    - Restart nginx
 

	
 
- name: Deploy nginx TLS certificate
 
  copy:
 
    dest: "/etc/ssl/certs/{{ ansible_fqdn }}_https.pem"
 
    content: "{{ default_https_tls_certificate }}"
 
    mode: 0644
 
    mode: "0644"
 
    owner: root
 
    group: root
 
  notify:
 
    - Restart nginx
 

	
 
- name: Generate the HTTPS server Diffie-Hellman parameter
 
  openssl_dhparam:
 
    owner: root
 
    group: root
 
    mode: 0640
 
    mode: "0640"
 
    path: "/etc/ssl/private/{{ ansible_fqdn }}_https.dh.pem"
 
    size: 2048
 
  notify:
 
    - Restart nginx
 

	
 
- name: Deploy configuration file for checking certificate validity via cron
 
  copy:
 
    content: "/etc/ssl/certs/{{ ansible_fqdn }}_https.pem"
 
    dest: "/etc/check_certificate/{{ ansible_fqdn }}_https.conf"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 

	
 
- name: Remove TLS protocol configuration from the main configuration file
 
  lineinfile:
 
    dest: "/etc/nginx/nginx.conf"
 
    backrefs: true
 
    regexp: "^\\s*ssl_protocols"
 
@@ -63,31 +63,31 @@
 
- name: Harden TLS by allowing only TLSv1.2 and PFS ciphers
 
  template:
 
    dest: "/etc/nginx/conf.d/tls.conf"
 
    src: "tls.conf.j2"
 
    owner: "root"
 
    group: "root"
 
    mode: 0644
 
    mode: "0644"
 
  notify:
 
    - Restart nginx
 

	
 
- name: Deploy script for verification of nginx vhost configurations
 
  copy:
 
    src: "nginx_verify_site.sh"
 
    dest: "/usr/local/bin/nginx_verify_site.sh"
 
    owner: root
 
    group: root
 
    mode: 0755
 
    mode: "0755"
 

	
 
- name: Deploy default vhost configuration
 
  template:
 
    src: "nginx-default.j2"
 
    dest: "/etc/nginx/sites-available/default"
 
    owner: root
 
    group: root
 
    mode: 0640
 
    mode: "0640"
 
    validate: "/usr/local/bin/nginx_verify_site.sh -n default %s"
 
  notify:
 
    - Restart nginx
 

	
 
- name: Enable default website
 
  file:
 
@@ -100,13 +100,13 @@
 
- name: Deploy firewall configuration for web server
 
  copy:
 
    src: "ferm_http.conf"
 
    dest: "/etc/ferm/conf.d/30-web.conf"
 
    owner: root
 
    group: root
 
    mode: 0640
 
    mode: "0640"
 
  notify:
 
    - Restart ferm
 

	
 
- name: Remove the default Debian html files
 
  file:
 
    path: "{{ item }}"
 
@@ -118,21 +118,21 @@
 
- name: Create directory for storing the default website page
 
  file:
 
    path: "/var/www/default/"
 
    state: directory
 
    owner: root
 
    group: www-data
 
    mode: 0750
 
    mode: "0750"
 

	
 
- name: Deploy the default index.html
 
  template:
 
    src: "index.html.j2"
 
    dest: /var/www/default/index.html
 
    owner: root
 
    group: www-data
 
    mode: 0640
 
    mode: "0640"
 

	
 
- name: Enable nginx service
 
  service:
 
    name: nginx
 
    enabled: true
 
    state: started
 
@@ -153,45 +153,45 @@
 
- name: Create directories for storing per-site socket files
 
  file:
 
    path: "/run/{{ item }}"
 
    state: directory
 
    owner: root
 
    group: www-data
 
    mode: 0750
 
    mode: "0750"
 
  with_items:
 
    - wsgi
 
    - php
 

	
 
- name: Create directories for storing per-site socket files on boot
 
  copy:
 
    content: "d /run/{{ item.socket_dir }}/ 0750 root www-data - -"
 
    dest: "/etc/tmpfiles.d/{{ item.tmpfiles_d }}"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  with_items:
 
    - socket_dir: wsgi
 
      tmpfiles_d: "wsgi.conf"
 
    - socket_dir: php
 
      tmpfiles_d: "{{ php_fpm_service_name }}.conf"
 

	
 
- name: Create directory for storing PHP-FPM service configuration overrides
 
  file:
 
    path: "/etc/systemd/system/{{ php_fpm_service_name }}.service.d/"
 
    state: directory
 
    owner: root
 
    group: root
 
    mode: 0755
 
    mode: "0755"
 

	
 
- name: Configure PHP-FPM service to run with umask 0007
 
  copy:
 
    src: "php_fpm_umask.conf"
 
    dest: "/etc/systemd/system/{{ php_fpm_service_name }}.service.d/umask.conf"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  notify:
 
    - Reload systemd
 
    - Restart PHP-FPM
 

	
 
- name: Enable service used for running PHP web applications
 
  service:
 
@@ -207,13 +207,13 @@
 
- name: Configure timezone for PHP
 
  template:
 
    src: "php_timezone.ini.j2"
 
    dest: "{{ item }}/30-timezone.ini"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  with_items:
 
    - "{{ php_base_config_dir }}/cli/conf.d/"
 
    - "{{ php_base_config_dir }}/fpm/conf.d/"
 
  notify:
 
    - Restart PHP-FPM
 

	
roles/wsgi_website/molecule/default/converge.yml
Show inline comments
 
@@ -99,116 +99,116 @@
 
    - name: Set-up directories where application files are hosted at
 
      file:
 
        path: "/var/www/parameters-mandatory/{{ item }}"
 
        state: directory
 
        owner: admin-parameters-mandatory
 
        group: web-parameters-mandatory
 
        mode: 02750
 
        mode: "02750"
 
      with_items:
 
        - htdocs/static
 
        - htdocs/media
 
        - code
 
    - name: Deploy WSGI application
 
      copy:
 
        src: "tests/data/python/wsgi/testapp.py"
 
        dest: "/var/www/parameters-mandatory/code/testapp.py"
 
        owner: admin-parameters-mandatory
 
        group: web-parameters-mandatory
 
        mode: 0640
 
        mode: "0640"
 
      notify:
 
        - Restart parameters-mandatory
 
    - name: Deploy a static file
 
      copy:
 
        src: "tests/data/static_file.txt"
 
        dest: "/var/www/parameters-mandatory/htdocs/static/static_file.txt"
 
        owner: admin-parameters-mandatory
 
        group: web-parameters-mandatory
 
        mode: 0640
 
        mode: "0640"
 
    - name: Deploy a media file
 
      copy:
 
        src: "tests/data/media_file.txt"
 
        dest: "/var/www/parameters-mandatory/htdocs/media/media_file.txt"
 
        owner: admin-parameters-mandatory
 
        group: web-parameters-mandatory
 
        mode: 0640
 
        mode: "0640"
 

	
 
    # parameters-optional application
 
    - name: Set-up directories where application files are hosted at
 
      file:
 
        path: "/var/www/parameters-optional.local/{{ item }}"
 
        state: directory
 
        owner: admin-parameters-optional_local
 
        group: web-parameters-optional_local
 
        mode: 02750
 
        mode: "02750"
 
      with_items:
 
        - htdocs/static
 
        - htdocs/media
 
        - code
 
    - name: Deploy WSGI application
 
      copy:
 
        src: "tests/data/python/wsgi/testapp.py"
 
        dest: "/var/www/parameters-optional.local/code/testapp.py"
 
        owner: admin-parameters-optional_local
 
        group: web-parameters-optional_local
 
        mode: 0640
 
        mode: "0640"
 
      notify:
 
        - Restart parameters-optional.local
 
    - name: Deploy a static file
 
      copy:
 
        src: "tests/data/static_file.txt"
 
        dest: "/var/www/parameters-optional.local/htdocs/static/static_file.txt"
 
        owner: admin-parameters-optional_local
 
        group: web-parameters-optional_local
 
        mode: 0640
 
        mode: "0640"
 
    - name: Deploy a media file
 
      copy:
 
        src: "tests/data/media_file.txt"
 
        dest: "/var/www/parameters-optional.local/htdocs/media/media_file.txt"
 
        owner: admin-parameters-optional_local
 
        group: web-parameters-optional_local
 
        mode: 0640
 
        mode: "0640"
 

	
 
    # parameters-paste-req application
 
    - name: Set-up directories where application files are hosted at
 
      file:
 
        path: "/var/www/parameters-paste-req/{{ item }}"
 
        state: directory
 
        owner: admin-parameters-paste-req
 
        group: web-parameters-paste-req
 
        mode: 02750
 
        mode: "02750"
 
      with_items:
 
        - htdocs/static
 
        - htdocs/media
 
        - code
 
    - name: Deploy WSGI application
 
      copy:
 
        src: "tests/data/python/paste/{{ item }}"
 
        dest: "/var/www/parameters-paste-req/code/{{ item }}"
 
        owner: admin-parameters-paste-req
 
        group: web-parameters-paste-req
 
        mode: 0640
 
        mode: "0640"
 
      with_items:
 
        - config.ini
 
        - testapp.py
 
        - wsgi.py
 
      notify:
 
        - Restart parameters-paste-req
 
    - name: Deploy a static file
 
      copy:
 
        src: "tests/data/static_file.txt"
 
        dest: "/var/www/parameters-paste-req/htdocs/static/static_file.txt"
 
        owner: admin-parameters-paste-req
 
        group: web-parameters-paste-req
 
        mode: 0640
 
        mode: "0640"
 
    - name: Deploy a media file
 
      copy:
 
        src: "tests/data/media_file.txt"
 
        dest: "/var/www/parameters-paste-req/htdocs/media/media_file.txt"
 
        owner: admin-parameters-paste-req
 
        group: web-parameters-paste-req
 
        mode: 0640
 
        mode: "0640"
 

	
 
  handlers:
 
    - name: Restart parameters-mandatory
 
      service:
 
        name: parameters-mandatory
 
        state: restarted
roles/wsgi_website/tasks/main.yml
Show inline comments
 
@@ -19,29 +19,29 @@
 
- name: Set-up directory for storing user profile configuration files
 
  file:
 
    path: "{{ home }}/.profile.d"
 
    state: directory
 
    owner: "{{ admin }}"
 
    group: "{{ user }}"
 
    mode: 0750
 
    mode: "0750"
 

	
 
- name: Deploy profile configuration file for auto-activating the virtual environment
 
  copy:
 
    src: "profile_virtualenv.sh"
 
    dest: "{{ home }}/.profile.d/virtualenv.sh"
 
    owner: root
 
    group: "{{ user }}"
 
    mode: 0640
 
    mode: "0640"
 

	
 
- name: Deploy profile configuration file for setting environment variables
 
  template:
 
    src: "environment.sh.j2"
 
    dest: "{{ home }}/.profile.d/environment.sh"
 
    owner: root
 
    group: "{{ user }}"
 
    mode: 0640
 
    mode: "0640"
 

	
 
- name: Create WSGI website user
 
  user:
 
    name: "{{ user }}"
 
    uid: "{{ uid | default(omit) }}"
 
    group: "{{ user }}"
 
@@ -68,13 +68,13 @@
 
- name: Set-up forwarding for mails delivered to local application user/admin
 
  template:
 
    src: "forward.j2"
 
    dest: "{{ home }}/.forward"
 
    owner: root
 
    group: "{{ user }}"
 
    mode: 0640
 
    mode: "0640"
 

	
 
- name: Install extra packages for website
 
  apt:
 
    name: "{{ packages }}"
 
    state: present
 
  register: install_extra_packages
 
@@ -125,13 +125,13 @@
 
- name: Create directory for storing the Python virtual environment
 
  file:
 
    path: "{{ home }}/virtualenv"
 
    state: directory
 
    owner: "{{ admin }}"
 
    group: "{{ user }}"
 
    mode: 02750
 
    mode: "02750"
 

	
 
- name: Create Python virtual environment
 
  command: '/usr/bin/virtualenv --python "{{ python_interpreter }}" --prompt "{{ virtualenv_prompt }}" "{{ home }}/virtualenv"'
 
  args:
 
    creates: "{{ home }}/virtualenv/bin/{{ python_interpreter | basename }}"
 
  become: true
 
@@ -140,48 +140,48 @@
 
- name: Configure project directory for the Python virtual environment
 
  template:
 
    src: "venv_project.j2"
 
    dest: "{{ home }}/virtualenv/.project"
 
    owner: "{{ admin }}"
 
    group: "{{ user }}"
 
    mode: 0640
 
    mode: "0640"
 

	
 
- name: Deploy virtualenv wrapper
 
  template:
 
    src: "venv_exec.j2"
 
    dest: "{{ home }}/virtualenv/bin/exec"
 
    owner: "{{ admin }}"
 
    group: "{{ user }}"
 
    mode: 0750
 
    mode: "0750"
 

	
 
- name: Set-up directory for storing requirements file for upgrade checks
 
  file:
 
    path: "{{ pip_check_requirements_upgrades_directory }}/{{ fqdn }}"
 
    state: directory
 
    owner: root
 
    group: pipreqcheck
 
    mode: 0750
 
    mode: "0750"
 

	
 
- name: Deploy WSGI requirements files for upgrade checks
 
  template:
 
    src: "{{ item }}.j2"
 
    dest: "{{ pip_check_requirements_upgrades_directory }}/{{ fqdn }}/{{ item }}"
 
    owner: root
 
    group: pipreqcheck
 
    mode: 0640
 
    mode: "0640"
 
  with_items:
 
    - wsgi_requirements.in
 
    - wsgi_requirements.txt
 

	
 
- name: Deploy Gunicorn requirements file for installation purposes
 
  template:
 
    src: "wsgi_requirements.txt.j2"
 
    dest: "{{ home }}/.wsgi_requirements.txt"
 
    owner: "{{ admin }}"
 
    group: "{{ user }}"
 
    mode: 0640
 
    mode: "0640"
 

	
 
- name: Install Gunicorn via requirements file
 
  become: true
 
  become_user: "{{ admin }}"
 
  pip:
 
    requirements: "{{ home }}/.wsgi_requirements.txt"
 
@@ -206,25 +206,25 @@
 
- name: Deploy systemd socket configuration for website
 
  template:
 
    src: "systemd_wsgi_website.socket.j2"
 
    dest: "/etc/systemd/system/{{ fqdn }}.socket"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  register: deploy_systemd_socket_configuration
 
  notify:
 
    - Reload systemd
 
    - Restart WSGI services
 

	
 
- name: Deploy systemd service configuration for website
 
  template:
 
    src: "systemd_wsgi_website.service.j2"
 
    dest: "/etc/systemd/system/{{ fqdn }}.service"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  register: deploy_systemd_service_configuration
 
  notify:
 
    - Reload systemd
 
    - Restart WSGI services
 

	
 
- name: Enable the website service
 
@@ -236,49 +236,49 @@
 
- name: Create directory where static files can be served from
 
  file:
 
    path: "{{ home }}/htdocs/"
 
    state: directory
 
    owner: "{{ admin }}"
 
    group: "{{ user }}"
 
    mode: 02750
 
    mode: "02750"
 

	
 
- name: Deploy nginx TLS private key for website
 
  copy:
 
    dest: "/etc/ssl/private/{{ fqdn }}_https.key"
 
    content: "{{ https_tls_key }}"
 
    owner: root
 
    group: root
 
    mode: 0640
 
    mode: "0640"
 
  notify:
 
    - Restart nginx
 

	
 
- name: Deploy nginx TLS certificate for website
 
  copy:
 
    dest: "/etc/ssl/certs/{{ fqdn }}_https.pem"
 
    content: "{{ https_tls_certificate }}"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  notify:
 
    - Restart nginx
 

	
 
- name: Deploy configuration file for checking certificate validity via cron
 
  copy:
 
    content: "/etc/ssl/certs/{{ fqdn }}_https.pem"
 
    dest: "/etc/check_certificate/{{ fqdn }}_https.conf"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 

	
 
- name: Deploy nginx configuration file for website
 
  template:
 
    src: "nginx_site.j2"
 
    dest: "/etc/nginx/sites-available/{{ fqdn }}"
 
    owner: root
 
    group: root
 
    mode: 0640
 
    mode: "0640"
 
    validate: "/usr/local/bin/nginx_verify_site.sh -n '{{ fqdn }}' %s"
 
  notify:
 
    - Restart nginx
 

	
 
- name: Enable nginx website
 
  file:
roles/xmpp_server/molecule/default/prepare.yml
Show inline comments
 
@@ -91,23 +91,23 @@
 

	
 
          [system_default_sect]
 
          MinProtocol = TLSv1.1
 
          CipherString = DEFAULT@SECLEVEL=0
 
        owner: root
 
        group: root
 
        mode: 0644
 
        mode: "0644"
 
        state: present
 

	
 
    - name: Set-up the hosts file
 
      lineinfile:
 
        path: /etc/hosts
 
        regexp: "^{{ item.key }}"
 
        line: "{{ item.key }} {{ item.value }}"
 
        owner: root
 
        group: root
 
        mode: 0644
 
        mode: "0644"
 
        state: present
 
      with_dict:
 
        192.168.56.11: "ldap-server backup-server"
 
        192.168.56.21: "client-bookworm"
 
        192.168.56.31: "parameters-mandatory domain1 proxy.domain1 conference.domain1"
 
        192.168.56.32: "parameters-optional domain2 proxy.domain2 conference.domain2 domain3 proxy.domain3 conference.domain3"
 
@@ -125,13 +125,13 @@
 
    - name: Deploy CA certificate
 
      copy:
 
        src: tests/data/x509/ca/level1.cert.pem
 
        dest: /usr/local/share/ca-certificates/testca.crt
 
        owner: root
 
        group: root
 
        mode: 0644
 
        mode: "0644"
 
      notify:
 
        - Update CA certificate cache
 

	
 
    - name: Install console-based XMPP client (for interactive testing)
 
      apt:
 
        name: mcabber
 
@@ -156,13 +156,13 @@
 
    - name: Deploy mcabber configuration files
 
      template:
 
        src: tests/data/mcabber.cfg.j2
 
        dest: "~user/{{ item.jid }}.cfg"
 
        owner: user
 
        group: user
 
        mode: 0600
 
        mode: "0600"
 
      with_items:
 
        - jid: john.doe@domain1
 
          password: johnpassword
 
          server: domain1
 
          security: tls
 
          nickname: john.doe
 
@@ -277,7 +277,7 @@
 
    - name: Deploy small Lua script for listing the enabled modules in Prosody
 
      copy:
 
        src: list_prosody_modules.lua
 
        dest: "/usr/local/bin/list_prosody_modules.lua"
 
        owner: root
 
        group: root
 
        mode: 0755
 
        mode: "0755"
roles/xmpp_server/tasks/main.yml
Show inline comments
 
@@ -6,13 +6,13 @@
 
- name: Set-up the Debian backports repository
 
  template:
 
    src: backports.list.j2
 
    dest: /etc/apt/sources.list.d/backports.list
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  register: backports_repository_configuration
 

	
 
- name: Update apt cache if backports repository configuration changed (for immediate use)  # noqa no-handler
 
  # [no-handler] Tasks that run when changed should likely be handlers
 
  #   Since apt_repository module is not reliable (does not deploy
 
  #   change when changing distro version etc), we have to use
 
@@ -47,77 +47,77 @@
 
- name: Deploy XMPP TLS private key
 
  copy:
 
    dest: "/etc/ssl/private/{{ ansible_fqdn }}_xmpp.key"
 
    content: "{{ xmpp_tls_key }}"
 
    owner: root
 
    group: prosody
 
    mode: 0640
 
    mode: "0640"
 
  notify:
 
    - Restart Prosody
 

	
 
- name: Deploy XMPP TLS certificate
 
  copy:
 
    dest: "/etc/ssl/certs/{{ ansible_fqdn }}_xmpp.pem"
 
    content: "{{ xmpp_tls_certificate }}"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 
  notify:
 
    - Restart Prosody
 

	
 
- name: Generate the XMPP server Diffie-Hellman parameter
 
  openssl_dhparam:
 
    owner: root
 
    group: prosody
 
    mode: 0640
 
    mode: "0640"
 
    path: "/etc/ssl/private/{{ ansible_fqdn }}_xmpp.dh.pem"
 
    size: 2048
 
  notify:
 
    - Restart Prosody
 

	
 
- name: Deploy configuration file for checking certificate validity via cron
 
  copy:
 
    content: "/etc/ssl/certs/{{ ansible_fqdn }}_xmpp.pem"
 
    dest: "/etc/check_certificate/{{ ansible_fqdn }}_xmpp.conf"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 

	
 
- name: Deploy script for validating Prosody certificate
 
  copy:
 
    src: "check_prosody_certificate.sh"
 
    dest: "/usr/local/bin/check_prosody_certificate.sh"
 
    owner: root
 
    group: root
 
    mode: 0755
 
    mode: "0755"
 

	
 
- name: Set-up crontab task that runs the Prosody certificate checker script once a day
 
  copy:
 
    src: "cron_check_prosody_certificate"
 
    dest: "/etc/cron.d/check_prosody_certificate"
 
    owner: root
 
    group: root
 
    mode: 0644
 
    mode: "0644"
 

	
 
- name: Deploy LDAP client configuration (for validating LDAP server certificate)
 
  copy:
 
    src: prosody_ldaprc
 
    dest: "/var/lib/prosody/.ldaprc"
 
    owner: root
 
    group: prosody
 
    mode: 0640
 
    mode: "0640"
 
  notify:
 
    - Restart Prosody
 

	
 
- name: Deploy Prosody configuration file
 
  template:
 
    src: "prosody.cfg.lua.j2"
 
    dest: "/etc/prosody/prosody.cfg.lua"
 
    owner: root
 
    group: prosody
 
    mode: 0640
 
    mode: "0640"
 
  notify:
 
    - Restart Prosody
 

	
 
- name: Enable and start Prosody service
 
  service:
 
    name: prosody
 
@@ -127,13 +127,13 @@
 
- name: Deploy firewall configuration for XMPP server
 
  copy:
 
    src: "ferm_xmpp.conf"
 
    dest: "/etc/ferm/conf.d/30-xmpp.conf"
 
    owner: root
 
    group: root
 
    mode: 0640
 
    mode: "0640"
 
  notify:
 
    - Restart ferm
 

	
 
- name: Explicitly run all handlers
 
  include_tasks: ../handlers/main.yml
 
  when: "run_handlers | default(False) | bool()"
0 comments (0 inline, 0 general)