subspace 2.4.0 → 2.5.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f235d8197ea5831cdf3006f8f180ae826f524665a5965965b6292b6403adc206
-  data.tar.gz: 8c6d3e7a879a8fda045b8c30a94c0631fa73a21d8f3509b771a755dd947dd13a
+  metadata.gz: 5ec1fed10091007f72b23e57d0493ff65646a9bc4cf530de36adbb9fdeb8e00f
+  data.tar.gz: fcaaff33ec9cb84b996258e74d3fc525f6fd727d0ef24b27e5bc71883fe4f95b
 SHA512:
-  metadata.gz: 2de55ab4d546444eeaf8d98cdc6d42b8edb589c3ef500f56b7797f2cbff81d5feeceeb069b573d72d049f18048f6a72e3085226731810b0d8fd6de266d8981ce
-  data.tar.gz: 1d58d3a3df528cb398ae1c4feafd085cecad96ca56063bddd117002b43cbf485f32fe8bf8fb879bb68918095cbea00aa228717782bb6bdedc92badba094e21f4
+  metadata.gz: 6429f545796109a5974e7183b8de7f992caf9d47742d08e2a9676053e6b5d634ee38b0f833cdc1e875fe03a64801841eec94517bccbe3d39adb5e7340d683fc2
+  data.tar.gz: 4afb2d4d2a0f772ec67bd923da0469c57ff65c51d65e656d7db89ef90c546cd6371c04593869ca36558c546e36e5e45788be550d2c601c17f38daa7e9c69dae9

data/CHANGELOG.md

@@ -10,6 +10,32 @@ This project attempts to follow [semantic versioning](https://semver.org/)
   * Not working on OSX - macs don't read from /etc/profile.d/
   * Stops showing color if you `sudo su`
 
+## 2.5.2
+  * Always specify the letsencrypt cert_name so they are consistent
+
+## 2.5.1
+  * Fix os upgrades stat collection for ubuntu 20
+
+## 2.5
+  * Get actual os version number along with kernal name
+  * Update MOTD version automatically!
+  * Get and upload unattended security updates
+
+## 2.4.2
+  * Update deprecated syntax for ansible
+  * Fix postgresql-client for python 3
+
+## 2.4.1
+  * Allow extra nginx options via extra_nginx_config eg:
+    ```
+    extra_nginx_config: |
+      proxy_http_version 1.1;
+      chunked_transfer_encoding off;
+      proxy_buffering off;
+      proxy_cache off;
+    ```
+  * Add keepalive_timeout for nginx
+
 ## 2.4
   Lots of modifications for ubuntu 20.04, which has python3 as a default
 

data/README.md

@@ -291,6 +291,10 @@ Configures nginx to look at localhost:9292 for the socket/backend connection.  I
 defaults are here, we'll probably add more:
 
     client_max_body_size: 4G
+    ssl_force_redirect: true
+    default_server: true
+    keepalive_timeout: 10
+    extra_nginx_config: ""
 
 Optional variables:
 
@@ -300,6 +304,12 @@ Optional variables:
     nginx_proxy_read_timeout: Set [proxy_read_timeout](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_read_timeout). This is in seconds. You probably only want to change this if using rack-timeout (although I may be wrong). If using rack-timeout, it should be slightly higher than the rack-timeout timeout. I'm doing 5 seconds higher, but that was arbitrarily chosen.
 
     ssl_force_redirect: redirect all HTTP traffic to HTTPS on the same host.  Defaults to true and only applies if ssl_enabled is also true.
+    extra_nginx_config: anything else you want to configure in the main nginx config block, formatted like:
+    extra_nginx_config: |
+      proxy_http_version 1.1;
+      chunked_transfer_encoding off;
+      proxy_buffering off;
+      proxy_cache off;
 
 ## nodejs
 
@@ -348,8 +358,6 @@ Installs redis on the server.
     # Change to * if you want tthis available everywhere.
     redis_bind: 127.0.0.1
 
-
-
 ## ruby-common
 
 Installs ruby on the machine.  YOu can set a version by picking off the download url and sha hash from ruby-lang.org

data/ansible/roles/common/tasks/main.yml

@@ -72,10 +72,6 @@
     tags:
       - maintenance
 
-  - name: Add ppa:ondrej/nginx apt repository for TLS 1.3
-    apt_repository:
-      repo: ppa:ondrej/nginx
-
   - name: apt-get update
     apt: update_cache=yes cache_valid_time=86400
     become: true
@@ -83,6 +79,10 @@
       - upgrade
       - maintenance
 
+  - name: Add ppa:ondrej/nginx apt repository for TLS 1.3
+    apt_repository:
+      repo: ppa:ondrej/nginx
+
   - name: /usr/lib/update-notifier/apt-check --human-readable
     command: /usr/lib/update-notifier/apt-check --human-readable
     tags:
@@ -129,7 +129,7 @@
     shell:
       cmd: |
         sed -n "/$(date '+%Y-%m')/,+2p" updates.log | # Groups of lines from the current month
-        grep 'packages' | # Only lines matching 'packages'
+        grep 'packages\|immediately' | # Only lines matching 'packages' or 'immediately'
         grep -P -o '(^\d+)' | #Extract the numbers at the beginning of the lines
         awk '{s+=$1} END {print s}' # Sum all the lines
     args:
@@ -158,6 +158,42 @@
       - maintenance
       - stats
 
+  - name: Get unattended security updates
+    shell:
+      cmd: cat /var/log/unattended-upgrades/unattended-upgrades.log | grep "Packages that will be upgraded:" | grep $(date '+%Y-%m') | cut -d " " -f 9- | wc -w
+    register: out
+    tags:
+      - maintenance
+      - stats
+
+  - name: get current date as month
+    shell:
+      cmd: date '+%Y-%m'
+    register: current_month
+    tags:
+      - maintenance
+      - stats
+
+  - name: Save unattended updates to /opt/subspace/updates.log
+    lineinfile:
+      path: /opt/subspace/updates.log
+      line: "[{{current_month.stdout}}]\n{{ out.stdout }} unattended security updates"
+      insertafter: EOF
+      create: yes
+    become: true
+    tags:
+      - maintenance
+      - stats
+    when: out.stdout != "0"
+
+  - name: Update unattended-upgrades.log
+    shell:
+      cmd: perl -i -pe 's/Packages that will be upgraded:/Packages already upgraded and logged in Subspace:/smg' /var/log/unattended-upgrades/unattended-upgrades.log
+    become: true
+    tags:
+      - maintenance
+      - stats
+
   - name: Get os_security_upgrades stats
     shell:
       cmd: |
@@ -253,7 +289,7 @@
       - maintenance
 
   - name: Grab OS version
-    shell: uname --kernel-release
+    shell: uname -rv
     register: stats_os_version
     when: send_stats == true and stats_url is defined and stats_api_key is defined
     tags:

data/ansible/roles/common/templates/motd

@@ -4,7 +4,7 @@ This server brought to you by:
 \___ \| | | | '_ \___ \| '_ \ / _` |/ __/ _ \
  ___) | |_| | |_) |__) | |_) | (_| | (_|  __/
 |____/ \__,_|_.__/____/| .__/ \__,_|\___\___|
-                       |_|             v2.4.0
+                       |_|             v{{lookup('env', 'SUBSPACE_VERSION')}}
 ~~~ https://github.com/tenforwardconsulting/subspace ~~~
 
 If you need to make configuration changes to the server, please modify the

data/ansible/roles/letsencrypt/tasks/main.yml

@@ -44,7 +44,7 @@
   - name: Run default
     when: le_ssl_certs is not defined
     become: true
-    command: "{{certbot_bin}} certonly --email {{letsencrypt_email}} --domains {{([server_name] + server_aliases) | join(',')}} --standalone --agree-tos --expand --non-interactive"
+    command: "{{certbot_bin}} certonly --email {{letsencrypt_email}} --domains {{([server_name] + server_aliases) | join(',')}} --cert-name {{server_name}} --standalone --agree-tos --expand --non-interactive"
 
   - name: Generate SSL Certificates
     become: true

data/ansible/roles/nginx-rails/defaults/main.yml

@@ -2,3 +2,5 @@
   client_max_body_size: 4G
   ssl_force_redirect: true
   default_server: true
+  keepalive_timeout: 10
+  extra_nginx_config: ""

data/ansible/roles/nginx-rails/tasks/main.yml

@@ -5,11 +5,19 @@
     dest: /etc/nginx/sites-available/{{project_name}}
   become: true
 
-- name: Enable the app
+- name: Enable the non-ssl app
   file:
     src: /etc/nginx/sites-available/{{project_name}}
     dest: /etc/nginx/sites-enabled/{{project_name}}
-    state: "{{ (ssl_enabled and nginx_ssl_config is defined) | ternary('absent', 'link') }}"
+    state: link
+  when: ssl_enabled != true or nginx_ssl_config is not defined
+  become: true
+
+- name: Disable the non-ssl app
+  file:
+    dest: /etc/nginx/sites-enabled/{{project_name}}
+    state: absent
+  when: (ssl_enabled and nginx_ssl_config is defined)
   become: true
 
 - name: create ssl nginx config for rails app
@@ -23,7 +31,15 @@
   file:
     src: /etc/nginx/sites-available/{{project_name}}-ssl
     dest: /etc/nginx/sites-enabled/{{project_name}}-ssl
-    state: "{{ (ssl_enabled and nginx_ssl_config is defined) | ternary('link', 'absent') }}"
+    state: link
+  when: (ssl_enabled and nginx_ssl_config is defined)
+  become: true
+
+- name: Disable SSL configured app
+  file:
+    dest: /etc/nginx/sites-enabled/{{project_name}}-ssl
+    state: absent
+  when: ssl_enabled != true or nginx_ssl_config is not defined
   become: true
 
 - name: Enable a default server if one is not defined in the app

data/ansible/roles/nginx-rails/templates/_rails.conf

@@ -15,6 +15,7 @@
     {% if nginx_proxy_read_timeout is defined %}
     proxy_read_timeout {{nginx_proxy_read_timeout}};
     {% endif %}
+    {{ extra_nginx_config | indent( width=4 ) }}
   }
 
   {% if asset_cors_allow_origin is defined %}
@@ -29,5 +30,5 @@
     root /opt/subspace;
   }
   client_max_body_size {{client_max_body_size}};
-  keepalive_timeout 10;
+  keepalive_timeout {{keepalive_timeout}};
 

data/ansible/roles/postgresql-client/tasks/main.yml

@@ -35,14 +35,49 @@
     - db
     - deps
 
-- name: Install dependencies for the Ansible module
+- name: Install libpq-dev
   when: ansible_os_family == 'Debian'
   become: yes
   apt:
-    name: "{{item}}"
+    name: "libpq-dev"
+    state: present
+    update_cache: yes
+    cache_valid_time: 3600
+  tags:
+    - postgresql
+    - db
+    - deps
+
+- name: "Detect python3"
+  shell: "which python3"
+  register: is_python3
+
+- name: Ensure pip is installed (python3)
+  when: is_python3 is succeeded
+  apt:
+    name: python3-pip
+    state: present
+    update_cache: yes
+  tags:
+    - postgresql
+    - db
+    - deps
+
+- name: Install psycopg2 (python3)
+  when: is_python3 is succeeded
+  become: yes
+  command: "pip3 install psycopg2"
+  tags:
+    - postgresql
+    - db
+    - deps
+
+- name: Install psycopg2 (python2)
+  when: is_python3 is failed
+  become: yes
+  apt:
+    name: python-psycopg2
     state: latest
-  with_items:
-    - python-psycopg2
   tags:
     - postgresql
     - db

data/ansible/roles/ruby-common/tasks/main.yml

@@ -87,12 +87,7 @@
   ignore_errors: yes
 
 - name: Install Bundler
-  gem:
-    name: bundler
-    version: "{{ bundler_version }}"
-    state: present
-    user_install: no
-    executable: "{{ ruby_location }}/bin/gem"
+  shell: "{{ ruby_location }}/bin/gem install bundler -v {{ bundler_version }}"
   become: true
 
 - name: Make Ruby symlinks

data/lib/subspace/commands/base.rb

@@ -70,6 +70,10 @@ module Subspace
 
         ansible_options
       end
+
+      def set_subspace_version
+        ENV['SUBSPACE_VERSION'] = Subspace::VERSION
+      end
     end
   end
 end

data/lib/subspace/commands/maintain.rb

@@ -4,6 +4,7 @@ class Subspace::Commands::Maintain < Subspace::Commands::Base
   def initialize(args, options)
     @environment = args.first
     @options = options
+    set_subspace_version
     run
   end
 

data/lib/subspace/commands/provision.rb

@@ -4,6 +4,7 @@ class Subspace::Commands::Provision < Subspace::Commands::Base
   def initialize(args, options)
     @environment = args.first
     @options = options
+    set_subspace_version
     run
   end
 

data/lib/subspace/version.rb

@@ -1,3 +1,3 @@
 module Subspace
-  VERSION = "2.4.0"
+  VERSION = "2.5.2"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: subspace
 version: !ruby/object:Gem::Version
-  version: 2.4.0
+  version: 2.5.2
 platform: ruby
 authors:
 - Brian Samson
-autorequire:
+autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-11-03 00:00:00.000000000 Z
+date: 2021-02-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -291,7 +291,7 @@ licenses:
 - MIT
 metadata:
   allowed_push_host: https://rubygems.org
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -306,8 +306,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.4
-signing_key:
+rubygems_version: 3.0.8
+signing_key: 
 specification_version: 4
 summary: Ansible-based server provisioning for rails projects
 test_files: []