* All roles

  * Support for Debian 8 Jessie has been dropped.

  * Common parameters ``tls_private_key_dir`` and

    ``tls_certificate_dir`` are no longer used.

  * TLS private key and certificate parameters are now mandatory.

* ``bootstrap`` role

  * Parameter ``ansible_key`` is now mandatory.

* ``common`` role``

  * Minimum version of ``pip-tools`` in the ``pip_check_requirements``

    and ``pip_check_requirements_py3`` is now 5.3.0. This change was

    required in order to fix the deprecation warnings being sent out

    when the ``pip_check_requirements_upgrades.sh`` script is run.

* ``database_server`` role

  * Parameter ``db_root_password`` has been deprecated. The root user

    can now login into the database (as the root database user) via

    unix socket authentication.

* ``ldap_server`` role

  * Parameter ``ldap_server_domain`` is now mandatory.

  * Updated default set of TLS ciphers used by server

    (``ldap_tls_ciphers`` parameter). All CBC ciphers have been

    dropped. This could introduce incompatibility with older clients

    trying to connect to the LDAP server.

* ``mail_forwarder`` role

  * Use 2048-bit Diffie-Hellman parameters for relevant TLS

    ciphers. This could introduce incompatibility with older

    clients/servers trying to connect to the SMTP server.

* ``mail_server`` role

  * Use 2048-bit Diffie-Hellman parameters for relevant TLS

    ciphers. This could introduce incompatibility with older

    clients/servers trying to connect to the SMTP/IMAP server.

  * Updated default set of TLS ciphers used by IMAP/SMTP servers

    (``mail_server_tls_ciphers`` parameter). All CBC ciphers have been

    dropped. This could introduce incompatibility with older clients

      proxy_headers:

        Accept-Encoding: '""'

    # Use wsgi_requirements to deploy Gunicorn.

    - role: wsgi_website

      fqdn: wsgi.example.com

      wsgi_application: wsgi:main

      wsgi_requirements:

        - gunicorn==19.7.1

	- futures==3.1.1

Database Server

---------------

The ``database_server`` role can be used for setting-up a MariaDB database

server on destination machine.

The role implements the following:

* Installs MariaDB server and client.

* Configures MariaDB server and client to use *UTF-8* encoding by default.

* Sets-up the database root user for passwordless login via UNIX

  socket authentication.

Role dependencies

~~~~~~~~~~~~~~~~~

Depends on the following roles:

* **common**

Parameters

~~~~~~~~~~

This role has no parameters.

Distribution compatibility

~~~~~~~~~~~~~~~~~~~~~~~~~~

Role is compatible with the following distributions:

- Debian 9 (Stretch)

        assert check_database.rc == 0

        assert check_database.stdout == "utf8\nutf8_general_ci\n"

        check_database = host.run("mysql -uroot -BNe 'select @@character_set_connection; select @@collation_connection'")

        assert check_database.rc == 0

        assert check_database.stdout == "utf8\nutf8_general_ci\n"

def test_root_can_login_via_unix_socket_only(host):

    """

    Tests if the root login is possible only via unix socket.

    """

    with host.sudo():

        root_logins_without_unix_socket_count = host.run("mysql -BNe %s", "select count(*) from mysql.user where user = 'root' and plugin != 'unix_socket'")

        root_logins_with_unix_socket = host.run("mysql -BNe %s", "select User, Host, Password from mysql.user where user = 'root' and plugin = 'unix_socket'")

        assert root_logins_without_unix_socket_count.rc == 0

        assert root_logins_without_unix_socket_count.stdout.strip() == "0"

        assert root_logins_with_unix_socket.rc == 0

        assert root_logins_with_unix_socket.stdout.strip() == "root	localhost"

- name: Set-up unix socket authentication for the root user

  command: mysql --skip-column-names -B -e "grant all privileges on *.* to root@localhost identified via unix_socket;"

  when: "not root_using_unix_socket_authentication.stdout"

- name: Check if there are any root-like database accounts available where host is not localhost

  command: mysql --skip-column-names -B -e "select 1 from mysql.user where user='root' and host!='localhost';"

  register: "additional_root_users"

  changed_when: false

- name: Drop all excess root user logins

  command:

    argv:

      - "mysql"

      - "-N"

      - "-B"

      - "-e"

      - "delete from mysql.user where User='root' and Host != 'localhost'; flush privileges;"

  when: "additional_root_users.stdout"

- name: Remove (now deprecated) my.cnf configuration file for the root database user

  file:

    path: "/root/.my.cnf"

    state: absent

- name: Set UTF-8 encoding as default for MariaDB

  copy:

    src: "utf8.cnf"

    dest: "/etc/mysql/mariadb.conf.d/90-utf8.cnf"

    owner: root

    group: root

    mode: 0644

  register: mariadb_utf8_configuration

- name: Restart MariaDB in order to use UTF-8 as default character set

  service:

    name: mysql

    state: restarted

  when: mariadb_utf8_configuration.changed

  tags:

    # [ANSIBLE0016] Tasks that run when changed should likely be handlers

    #   UTF-8 configuration must be applied immediatelly in order to ensure that

    #   subsequent tasks that create databases will end-up with correct (UTF-8)

    #   encoding. Otherwise they will be created using default latin1.

    - skip_ansible_lint

- name: Explicitly run all handlers

  include: ../handlers/main.yml

  when: "run_handlers | default(False) | bool()"