majic-ansible-roles Changeset

Changeset - ddcc0a5f7312

Parent rev.

Child rev.

[Not reviewed]

4 7 4

Branko Majic (branko) - 4 years ago 2020-07-26 22:35:29
branko@majic.rs

MAR-162: Make the default_https_tls_certificate and default_https_tls_key parameters mandatory:

- Dropped the defaults from web_server role.
- Updated group variables in role tests.
- Changed the key/certificate file extensions to be more descriptive.
- Updated role reference documentation.
- Updated usage instructions to include the mandatory parameters.

11 files changed with 19 insertions and 18 deletions:

docs/rolereference.rst

docs/usage.rst

roles/web_server/defaults/main.yml

roles/web_server/molecule/default/group_vars/parameters-mandatory.yml

roles/web_server/molecule/default/group_vars/parameters-optional.yml

roles/web_server/molecule/default/tests/data/x509/parameters-mandatory-stretch64_https.cert.pem

rename

roles/web_server/molecule/default/tests/data/x509/parameters-mandatory-stretch64_https.key.pem

rename

roles/web_server/molecule/default/tests/data/x509/parameters-optional-stretch64_https.cert.pem

rename

roles/web_server/molecule/default/tests/data/x509/parameters-optional-stretch64_https.key.pem

rename

roles/web_server/molecule/default/tests/test_mandatory.py

roles/web_server/molecule/default/tests/test_optional.py

0 comments (0 inline, 0 general)

docs/rolereference.rst

➞

Show inline comments

@@ @@ -1386,11 +1386,11 @@ Parameters @@
   clients will be served with ``Strict-Transport-Security`` header with value of
   ``max-age=31536000; includeSubDomains``.
-**default_https_tls_certificate** (string, optional, ``{{ lookup('file', tls_certificate_dir + '/' + ansible_fqdn + '_https.pem') }}``)
+**default_https_tls_certificate** (string, mandatory)
   X.509 certificate used for TLS for HTTPS service. The file will be stored in
   directory ``/etc/ssl/certs/`` under name ``{{ ansible_fqdn }}_https.pem``.
-**default_https_tls_key** (string, optional, ``{{ lookup('file', tls_private_key_dir + '/' + ansible_fqdn + '_https.key') }}``)
+**default_https_tls_key** (string, mandatory)
   Private key used for TLS for HTTPS service. The file will be stored in
   directory ``/etc/ssl/private/`` under name ``{{ ansible_fqdn }}_https.key``.

docs/usage.rst

➞

Show inline comments

@@ @@ -1221,16 +1221,20 @@ Nginx. @@
           - mail_forwarder
           - web_server
 . You know the drill, role configuration comes up next. Actually... The web
    server role parameters are all optional, and they default to some ok-ish
    values. But let us spicen up things a bit nevertheless. No configuration has
    been deployed before for the web server, so we will be creating a new file.
 . You know the drill, role configuration comes up next. No
    configuration has been deployed before for the web server, so we
    will be creating a new file. Only the TLS parameters are really
    necessary, but we'll spice things up a bit by setting custom title
    and message for default virtual host.
    :file:`~/mysite/group_vars/web.yml`
    ::
       ---
       default_https_tls_certificate: "{{ lookup('file', 'tls/www.example.com_https.pem') }}"
       default_https_tls_key: "{{ lookup('file', 'tls/www.example.com_https.key') }}"
       web_default_title: "Welcome to default page!"
       web_default_message: "Nothing to see here, move along..."

roles/web_server/defaults/main.yml

➞

Show inline comments

 ---
 default_enforce_https: true
 default_https_tls_certificate: "{{ lookup('file', tls_certificate_dir + '/' + ansible_fqdn + '_https.pem') }}"
 default_https_tls_key: "{{ lookup('file', tls_private_key_dir + '/' + ansible_fqdn + '_https.key') }}"
 web_default_title: "Welcome"
 web_default_message: "You are attempting to access the web server using a wrong name or an IP address. Please check your URL."
 web_server_tls_protocols:

roles/web_server/molecule/default/group_vars/parameters-mandatory.yml

➞

Show inline comments

 ---
 default_https_tls_certificate: "{{ lookup('file', 'tests/data/x509/{{ inventory_hostname }}_https.cert.pem') }}"
 default_https_tls_key: "{{ lookup('file', 'tests/data/x509/{{ inventory_hostname }}_https.key.pem') }}"
 # common
 ca_certificates:
   testca: "{{ lookup('file', 'tests/data/x509/ca.cert.pem') }}"
 # Common parameters (general, not role).
 tls_certificate_dir: tests/data/x509/
 tls_private_key_dir: tests/data/x509/

roles/web_server/molecule/default/group_vars/parameters-optional.yml

➞

Show inline comments

 ---
 default_enforce_https: false
 default_https_tls_certificate: "{{ lookup('file', 'tests/data/x509/parameters-optional_https.cert.pem') }}"
 default_https_tls_key: "{{ lookup('file', 'tests/data/x509/parameters-optional_https.key.pem') }}"
 default_https_tls_certificate: "{{ lookup('file', 'tests/data/x509/{{ inventory_hostname }}_https.cert.pem') }}"
 default_https_tls_key: "{{ lookup('file', 'tests/data/x509/{{ inventory_hostname }}_https.key.pem') }}"
 web_default_title: "Optional Welcome"
 web_default_message: "Welcome to parameters-optional, default virtual host."
 web_server_tls_protocols:

roles/web_server/molecule/default/tests/data/x509/parameters-mandatory-stretch64_https.cert.pem

➞

Show inline comments

file renamed from roles/web_server/molecule/default/tests/data/x509/parameters-mandatory-stretch64_https.pem to roles/web_server/molecule/default/tests/data/x509/parameters-mandatory-stretch64_https.cert.pem

roles/web_server/molecule/default/tests/data/x509/parameters-mandatory-stretch64_https.key.pem

➞

Show inline comments

file renamed from roles/web_server/molecule/default/tests/data/x509/parameters-mandatory-stretch64_https.key to roles/web_server/molecule/default/tests/data/x509/parameters-mandatory-stretch64_https.key.pem

roles/web_server/molecule/default/tests/data/x509/parameters-optional-stretch64_https.cert.pem

➞

Show inline comments

file renamed from roles/web_server/molecule/default/tests/data/x509/parameters-optional_https.cert.pem to roles/web_server/molecule/default/tests/data/x509/parameters-optional-stretch64_https.cert.pem

roles/web_server/molecule/default/tests/data/x509/parameters-optional-stretch64_https.key.pem

➞

Show inline comments

file renamed from roles/web_server/molecule/default/tests/data/x509/parameters-optional_https.key.pem to roles/web_server/molecule/default/tests/data/x509/parameters-optional-stretch64_https.key.pem

roles/web_server/molecule/default/tests/test_mandatory.py

➞

Show inline comments

@@ @@ -21,14 +21,14 @@ def test_nginx_tls_files(host): @@
         assert tls_file.user == 'root'
         assert tls_file.group == 'root'
         assert tls_file.mode == 0o640
         assert tls_file.content_string == open("tests/data/x509/%s_https.key" % hostname, "r").read().rstrip()
+        assert tls_file.content_string == open("tests/data/x509/%s_https.key.pem" % hostname, "r").read().rstrip()
         tls_file = host.file('/etc/ssl/certs/%s_https.pem' % hostname)
         assert tls_file.is_file
         assert tls_file.user == 'root'
         assert tls_file.group == 'root'
         assert tls_file.mode == 0o644
         assert tls_file.content_string == open("tests/data/x509/%s_https.pem" % hostname, "r").read().rstrip()
+        assert tls_file.content_string == open("tests/data/x509/%s_https.cert.pem" % hostname, "r").read().rstrip()
 def test_certificate_validity_check_configuration(host):

roles/web_server/molecule/default/tests/test_optional.py

➞

Show inline comments

@@ @@ -21,14 +21,14 @@ def test_nginx_tls_files(host): @@
         assert tls_file.user == 'root'
         assert tls_file.group == 'root'
         assert tls_file.mode == 0o640
-        assert tls_file.content_string == open("tests/data/x509/parameters-optional_https.key.pem", "r").read().rstrip()
+        assert tls_file.content_string == open("tests/data/x509/%s_https.key.pem" % hostname, "r").read().rstrip()
         tls_file = host.file('/etc/ssl/certs/%s_https.pem' % hostname)
         assert tls_file.is_file
         assert tls_file.user == 'root'
         assert tls_file.group == 'root'
         assert tls_file.mode == 0o644
-        assert tls_file.content_string == open("tests/data/x509/parameters-optional_https.cert.pem", "r").read().rstrip()
+        assert tls_file.content_string == open("tests/data/x509/%s_https.cert.pem" % hostname, "r").read().rstrip()
 def test_certificate_validity_check_configuration(host):

0 comments (0 inline, 0 general)