Files @ 23a9ea4219dc
Branch filter:

Location: majic-ansible-roles/docs/releasenotes.rst

23a9ea4219dc 14.6 KiB text/prs.fallenstein.rst Show Annotation Show as Raw Download as Raw
branko
MAR-113: Added option for specifying relay port to mail_forwarder:

- Introduced new option "smtp_relay_host_port".
- Updated the test playbook and tests to make sure new functionality works as
expected.
- Update role reference documentation.
- Updated usage instructions.
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
Release notes
=============


1.6.0
-----

GENERAL DESCRIPTION

Breaking changes:

* All roles

  * Previously a number of roles would modify permissions on the ``/srv``
    directory. This has now been fixed in order to prevent weird backup failures
    etc. Manual intervention is necessary on existing servers to fix the issue
    by changing the mode to ``0755`` (this is the usual default upon the OS
    installation).

* ``mail_server`` role

  * Since Postfix will now fall-back to using ``/etc/hosts`` if it cannot
    resovle a domain via DNS, some special care may be needed in case you have
    some unusual entries in ``/etc/hosts``. Normally this should not be an
    issue, though.

* ``backup_client`` role

  * Up to this point, if you had more than one additional encryption key
    specified in configuration, only the first one was taken into account. This
    is a major issue since it would render backups up to this point decryptable
    only with one of the keys. It is highly suggested to perform a full backup
    after upgrading to new version of Majic Ansible Roles via command::

      sudo duply main full

    This will ensure the most recent backup is decryptable with all additional
    keys!

New features/improvements:

* Added new documentation chapter dedicated to development.
* Added ``requirements.txt`` that can be used for installing the required
  packages in virtual environment (useful for development).
* Small fixes (mostly typos and such) throughout the documentation.

* All roles

  * Implemented tests using Molecule. See documentation for instructions on how
    to run tests.
  * Small internal refactorings to make things simpler and easier to maintain.

* ``common`` role

  * Added missing documentation for parameters ``pipreqcheck_uid`` and
    ``pipreqcheck_gid``.

* ``mail_server`` role

  * Updated Postfix configuration to fall-back to using ``/etc/hosts`` if DNS
    lookup fails. This allows for more flexibility when testing and deploying if
    proper DNS is not available.

Bug-fixes:

* All roles

  * Fixed how TLS key and certificate material is deployed in order to avoid
    mangling of tabs.
  * Fixed how file modes are specified in tasks to ensure correct permissions
    are applied.
  * Fixed missing ``become`` keyword in tasks that use ``become_user`` for
    consistent execution.

* ``backup_client`` role

  * Fixed configuration (and documentation) for specifying the backup server
    URI - previous implementation included too many forward slashes which could
    cause failures in case of custom SSH server being used for backup.
  * Fixed configuration of additional encryption keys to include all keys listed
    instead of just the first one.
  * Fixed issue with ``backup_server_port`` parameter being completely ignored
    in the configuration.
  * Fixed issue with missing ``/etc/duply/main/include`` configuration file in
    case no backup patterns are deployed.

* ``backup_server`` role

  * Fixed deployment of backup server SSH keys in order to avoid unusable
    ``ed25519`` keys.

* ``common`` role

  * Fixated version of ``pip`` installed for performing Pyhton requirements
    package upgrade checks.
  * Fixed incorrect documentation for parameter ``additional_groups``.
  * Fixed ownership setting for firewall configuration file.
  * Fixed script used for performing checks on pip requirementes files for
    availalbe package upgrades. False positives due to different sorting will
    not be reported anymore, and the script will actually make sure to check if
    upgrades are available (which was not the case before due ot missing
    paramter to pip-compile).

* ``ldap_server`` role

  * Fixed invalid configuration of LDAP server package via
    ``debconf-set-selections`` (wrong option was used for
    ``shared/organization``).
  * Fixed role documentation example for parameter ``ldap_entries`` (was using
    obsolete syntax of ``ldap_entry`` module).
  * When making changes to the LDAP server configuration, make sure to use Unix
    socket. This way the role does not depend on correct LDAP client
    configuration.

* ``mail_server`` role

  * Fixed Postfix main configuraiton file permissions set-up to be explicit.
  * Fixed issue where Postfix server is not restarted when the truststore (used
    for verifying the LDAP server certificate) is changed.
  * Fixed issue with Postfix configuration where the parameter ``mail_user`` was
    ignored when making deliveries to Dovecot (old implementation used fixed
    value of ``vmail`` instead of parameter).

* ``php_website`` role

  * Fixed Nginx configuration file to use correct parameter (``enforce_https``
    instead of ``default_enforce_https``) when configuring HSTS. Previously it
    was possible to set the parameter to ``no``, and still end-up with HSTS
    headers being set-up.

* ``wsgi_website`` role

  * Fixed Nginx configuration file to use correct parameter (``enforce_https``
    instead of ``default_enforce_https``) when configuring HSTS. Previously it
    was possible to set the parameter to ``no``, and still end-up with HSTS
    headers being set-up.

* ``xmpp_server`` role

  * Fixed invalid default value for paramerer ``xmpp_domains`` - it should be a
    list and not a simple string. Previously this would result in invalid domain
    set-up in Prosody configuration file.
  * Fixed issue with permissions not being set on Prosody configuration file,
    making it world-readable (the configuration file contains passwords).


1.5.1
-----

Small bug-fix release for misbehaving package upgrade checks.

Bug-fixes:

* ``common`` role

  * Fixed script used for performing checks on pip requirementes files for
    availalbe package upgrades. False positives due to different sorting will
    not be reported anymore, and the script will actually make sure to check if
    upgrades are available (which was not the case before due ot missing
    paramter to pip-compile).


1.5.0
-----

Minor bug-fixes, package upgrade checks, and better support for next Debian
stable release (Stretch).

New features/improvements:

* ``backup_client`` role

  * Implemented support for next Debian stable release (*Debian Stretch*). This
    was needed due to changes in duplicity parameters and their syntax.

* ``common`` role

  * Added parameter for configuring common backup patterns. Allows for better
    control over ``/root`` and ``/home`` directories. Backup of remaining
    directories is still hard-coded.
  * Added support for checking if package upgrades are available. Covers system
    packages out-of-the-box, and provides ability to perform checks on pip
    requirements files.
  * Added generic support for checking certificate expiration dates. Relevant
    roles need to deploy special configuration files to trigger the checks.

* ``ldap_server`` role

  * Updated role to perform certificate expiration date check on LDAP server
    certificate.

* ``mail_server`` role

  * Updated role to perform certificate expiration date check on all mail server
    certificates.

* ``php_website`` role

  * Updated role to perform certificate expiration date check on website server
    certificate.

* ``xmpp_server`` role

  * Updated role to perform certificate expiration date check on XMPP server
    certificate.

* ``web_server`` role

  * Updated role to perform certificate expiration date check on default web
    server certificate.

* ``wsgi_website`` role

  * Added alternative way to specify Gunicorn version to install in virtual
    environment (via separate parameter). If this parameter is in use, package
    upgrade checks will be done as well (against auto-assembled pip requirements
    file). See role reference documentation for details.
  * Updated role to perform certificate expiration date check on website server
    certificate.

Bug-fixes:

* ``mail_server`` role

  * Fixed incorrect mail name (FQDN) used for mails originating from the server.

* ``web_server`` role

  * Fixed configuration of available TLS versions on the Nginx web server.

Documentation:

* Added release procedures and related information.
* Added information about Debian release compatibility to role reference.


1.4.0
-----

Minor fixes and features allowing for more fine-tuning of installations.

New features/improvements:

* ``ldap_server`` role

  * TLS versions and ciphers supported by server are now configurable.

* ``mail_server`` role

  * TLS versions and ciphers supported by SMTP and IMAP server are now
    configurable.
  * Number of allowed concurent IMAP connections for a single user from a single
    IP address is now configurable.

* ``web_server`` role

  * TLS versions and ciphers supported by server are now configurable.


1.3.0
-----

IPv6 support in firewall rules, small bug fixes and improvements.

New features/improvements:

* All roles that deploy firewall rules

  * Set-up IPv6 firewall rules in addition to IPv4.

* ``common`` role

  * Crontabs, operating system user passwords (``/etc/shadow``), and local user
    mails are now included in the backup.

Bug-fixes:

* ``wsgi_website`` role

  * Do not traverse static locations that have not been explicitly
    configured. Fixes issue where static location ends-up being served by Nginx
    instea of WSGI application.


1.2.0
-----

Minor fixes and features.

New features:

* ``wsgi_website`` role

  * Added support for providing custom proxy headers to pass on to Gunicorn
    server.

Bug-fixes:

* ``php_website`` role

  * Make sure the environment indicator is always shown on top by increasing its
    ``z-index`` value.

* ``wsgi_website`` role

  * Make sure the environment indicator is always shown on top by increasing its
    ``z-index`` value.


1.1.0
-----

Minor bug fixes, enchancements, and features.

New features/improvements:

* ``common`` role

  * Added support for having user-defined ``/etc/profile.d`` style scripts (in
    ``~/.profile.d/``.
  * Disables Emacs ``electric-indent-mode`` globally if Emacs is installed.
  * Deploys symbolic link for ``mysql_config`` if package
    ``libmariadb-client-lgpl-dev-compat`` is installed (workaround for
    `Debian Bug 766996
    <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=766996>`_)
  * Updates CA cache immediatelly so that roles depending on cache being
    up-to-date do not throw validation errors.

* ``mail_server`` role

  * Added support for specifying local aliases.
  * Undeliverable bounces are now delivered to postmaster.

* ``php_website`` role

  * Added support for specifying custom ``php-fpm`` pool configuration options.
  * Added support for having ribon/strip at bottom to identify website
    environment. Useful for testing/staging environments.
  * Deploys symbolic link for ``mysql_config`` if package
    ``libmariadb-client-lgpl-dev-compat`` is installed (workaround for
    `Debian Bug 766996
    <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=766996>`_)
  * Forwards mails delivered to application or application administrator users
    to local ``root`` account (can be configured to deliver mails elsewhere).
  * Sets ``HSTS`` policy if TLS is enforced.
  * *Umask* for the operating system which runs the website is set to ``0007``.
  * When administrator user is created for the first time, its home directory is
    populated from ``/etc/skel``. This makes prompts etc look more uniform
    across the system.

* ``wsgi_website`` role

  * Added support for having ribon/strip at bottom to identify website
    environment. Useful for testing/staging environments.
  * Added support for specifying environment variables that should be set when
    running the service, or when administering the installation (using
    application administrator operating system user).
  * Deploys symbolic link for ``mysql_config`` if package
    ``libmariadb-client-lgpl-dev-compat`` is installed (workaround for
    `Debian Bug 766996
    <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=766996>`_)
  * Forwards mails delivered to application or application administrator users
    to local ``root`` account (can be configured to deliver mails elsewhere).
  * Sets ``HSTS`` policy if TLS is enforced.
  * *Umask* for the operating system which runs the website is set to ``0007``.
  * When administrator user is created for the first time, its home directory is
    populated from ``/etc/skel``. This makes prompts etc look more uniform
    across the system.

Bug-fixes:

* ``database_server`` role

  * Applies UTF-8 configuration immediatelly. This should fix issues during
    inital server set-up for roles that need to create database using UTF-8
    character set.

* ``wsgi_website`` role

  * Fixed virtualenv wrapper shell script to use proper escaping around
    arguments.
  * Website service is now restarted in case of package changes (system or
    virtual environment).

* ``mail_forwarder`` role

  * Allows incoming SMTP connections from the SMTP relay server (if
    configured). This way the SMTP relay can deliver bounces.


1.0.1
-----

Minimal bugfix update to improve interoperability.

Changes:

* ``xmpp_server`` role no longer restricts TLS to version 1.2 and ciphers to PFS
  ciphers. Should solve ``s2s`` communication issues with old XMPP servers.


1.0.0
-----

Initial release of Majic Ansible Roles.

New roles:

* ``backup``, reusable role for specifying files to back-up.
* ``backup_client``, base role for setting-up backup client on a server
  (Duplicity).
* ``backup_server``, sets-up a backup server.
* ``bootstrap``, sets-up server for Ansible management (bootstrapping it for
  subsequent Ansible runs).
* ``common``, basic set-up of server, some hardening, creation of admin accounts
  etc.
* ``database``, reusable role for creating MariaDB database and user for
  accessing the database.
* ``database_server``, sets-up database server (MariaDB).
* ``ldap_client``, sets-up LDAP client tools and configuration (OpenLDAP).
* ``ldap_server``, sets-up and manages basic entries in an LDAP server
  (OpenLDAP).
* ``mail_forwarder``, sets-up local SMTP server that forwards mail to the main
  mail server (Postfix).
* ``mail_server``, sets-up a mail server with SMTP and IMAP services (Postfix,
  Dovecot).
* ``php_website``, reusable role for creating PHP-based websites. Provides basic
  building block for PHP applications (Nginx).
* ``preseed``, small role for generating Debian preseed files for automated OS
  installation.
* ``web_server``, sets-up web server with basic welcome page (Nginx).
* ``wsgi_website``, reusable role for creating WSGI-based websites. Provides
  basic building block for WSGI applications (Nginx).
* ``xmpp_server``, sets-up an XMPP server for instant messaging services
  (Prosody).

New features:

* Usage (tutorial-like) instructions.
* Test site, serving as an example and used for basic regression testing.
* Role reference documentation.