majic-ansible-roles Files · roles/common/molecule/default/playbook.yml

Files @ 36d96a3fc472

Branch filter:

Location: majic-ansible-roles/roles/common/molecule/default/playbook.yml

36d96a3fc472 2.0 KiB text/x-yaml Show Annotation Show as Raw Download as Raw

branko

MAR-163: Ensure host.run is not suspectible to shell injection:

- Use host.run's built-in capability for handling parameter escaping
and insertion.

---

- hosts: parameters-mandatory,parameters-optional
  become: true
  roles:
    - common

- hosts: parameters-mandatory,parameters-optional
  become: true
  tasks:

    - name: Set-up directories for testing pip requirements upgrade checks script
      file:
        path: "{{ item }}"
        state: directory
        owner: root
        group: pipreqcheck
        mode: 0750
      with_items:
        - "/tmp/pip_check_requirements_upgrades"
        - "/tmp/pip_check_requirements_upgrades/with_updates"
        - "/tmp/pip_check_requirements_upgrades/without_updates"
        - "/tmp/pip_check_requirements_upgrades-py3"
        - "/tmp/pip_check_requirements_upgrades-py3/with_updates"
        - "/tmp/pip_check_requirements_upgrades-py3/without_updates"

    - name: Deploy files for testing pip requirements upgrade checks script
      copy:
        src: "{{ item }}"
        dest: "/tmp/{{ item }}"
        owner: root
        group: pipreqcheck
        mode: 0640
        directory_mode: 0750
      with_items:
        - "pip_check_requirements_upgrades/with_updates/requirements.in"
        - "pip_check_requirements_upgrades/with_updates/requirements.txt"
        - "pip_check_requirements_upgrades/without_updates/requirements.in"
        - "pip_check_requirements_upgrades/without_updates/requirements.txt"
        - "pip_check_requirements_upgrades-py3/with_updates/requirements.in"
        - "pip_check_requirements_upgrades-py3/with_updates/requirements.txt"
        - "pip_check_requirements_upgrades-py3/without_updates/requirements.in"
        - "pip_check_requirements_upgrades-py3/without_updates/requirements.txt"

    - name: Install web server for testing connectivity
      apt:
        name: nginx
        state: present

    - name: Deploy firewall configuration file for the web server
      copy:
        src: ferm_http.conf
        dest: /etc/ferm/conf.d/99-http.conf
        owner: root
        group: root
        mode: 0640
      notify:
        - Restart ferm

  handlers:

    - name: Restart ferm
      service:
        name: ferm
        state: restarted