subspace 2.5.2 → 2.5.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5ec1fed10091007f72b23e57d0493ff65646a9bc4cf530de36adbb9fdeb8e00f
-  data.tar.gz: fcaaff33ec9cb84b996258e74d3fc525f6fd727d0ef24b27e5bc71883fe4f95b
+  metadata.gz: 24d9413d60da10fc4e89a7a07acdee04a663d0ce45a1bf3c666d27b0b4b867ba
+  data.tar.gz: 5c6acea9ad2dd19abd20355764a3e6b5febc9281875ce0e4c5026cb86de5f3bf
 SHA512:
-  metadata.gz: 6429f545796109a5974e7183b8de7f992caf9d47742d08e2a9676053e6b5d634ee38b0f833cdc1e875fe03a64801841eec94517bccbe3d39adb5e7340d683fc2
-  data.tar.gz: 4afb2d4d2a0f772ec67bd923da0469c57ff65c51d65e656d7db89ef90c546cd6371c04593869ca36558c546e36e5e45788be550d2c601c17f38daa7e9c69dae9
+  metadata.gz: 57e1b9ea34bb641ac71f2f38297b7f1b80c2a97b7aa7c734d44826f5d252b4ead6e9cf0aa74359dd728802527848f36953c871ac37e05ebac770e506f5db8cc7
+  data.tar.gz: f7632eb404a54a3f034ee5dab75854d3109f97d34e9850f1886097bfe70c1e5e3d0621ef1d15cf25e8052fb0d8fe7f24317f5bedd947070039bed17094c11f3e

data/CHANGELOG.md

@@ -2,7 +2,7 @@
 
 This is a [changelog](https://keepachangelog.com/en/0.3.0/).
 
-This project attempts to follow [semantic versioning](https://semver.org/)
+This project attempts to follow [semantic versioning](https://semver.org/).
 
 ## Known Bugs
 
@@ -10,6 +10,23 @@ This project attempts to follow [semantic versioning](https://semver.org/)
   * Not working on OSX - macs don't read from /etc/profile.d/
   * Stops showing color if you `sudo su`
 
+## Unreleased
+
+## 2.5.6
+  * Fix sending security stats
+  * Make sure apt package acl is installed in common role so ansible can become a non-privileged user
+
+## 2.5.5
+  * Remove duplicate nginx role from playbook templates
+  * Don't send stats if there have been no upgrades
+
+## 2.5.4
+  * certbox => certbot
+
+## 2.5.3
+  * Add a friendly error message if ansible is not installed
+  * Add new role to support New Relic One's infrastructure agent
+
 ## 2.5.2
   * Always specify the letsencrypt cert_name so they are consistent
 

data/README.md

@@ -282,6 +282,21 @@ Installs logrotate and lets you configure logs for automatic rotation.  Example
 
 ## newrelic
 
+## newrelic-infra
+This role will install the next-gen "Newrelic One" infrastructure agent which can perform a few different functions for newrelic.  The previous "newrelic" role is deprecated. 
+
+Variables: 
+    # Required, the newrelic license key you get after signing up. 
+    newrelic_license: "longhashthingyougetfromnewrelichere" 
+    # Optional - send logs to newrelic one's log aggregator.
+    newrelic_logs:
+      - name: rails-production
+        path: /u/apps/blah/shared/log/production.log
+      - name: nginx-error
+        path: /var/log/nginx/error.log
+
+
+
 ## nginx-rails
 
 Configures nginx to look at localhost:9292 for the socket/backend connection.  If you need to do fancy stuff you should simply override this role
@@ -413,8 +428,8 @@ After checking out the repo, run `bin/setup` to install dependencies. Then, run
 To install this gem onto your local machine, run `bundle exec rake install`. To release a new version:
 
   1. update the version number in `version.rb`
-  2. update the version number in motds
-  3. run `bundle exec rake release`
+  2. `gem build subspace.gemspec`
+  3. `gem push subspace-x.y.z.gem`
 
 This will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
 

data/ansible/roles/common/tasks/main.yml

@@ -125,6 +125,12 @@
       - maintenance
       - upgrade
 
+  - name: Install acl so ansible can become a non-privileged user
+    apt:
+      pkg: acl
+      state: present
+    become: true
+
   - name: Get os_upgrades stats
     shell:
       cmd: |
@@ -153,7 +159,7 @@
           key: os_upgrades
           value: "{{stats_os_upgrades.stdout}}"
           hostname: "{{hostname}}"
-    when: send_stats == true and stats_url is defined and stats_api_key is defined
+    when: (send_stats == true) and (stats_url is defined) and (stats_api_key is defined) and (stats_os_upgrades.stdout | length > 0)
     tags:
       - maintenance
       - stats
@@ -197,9 +203,8 @@
   - name: Get os_security_upgrades stats
     shell:
       cmd: |
-        sed -n "/$(date '+%Y-%m')/,+2p" updates.log | # Groups of lines from the current month
+        grep -A 1 $(date +%Y-%m) updates.log | # Groups of lines from the current month
         grep 'security' | # Only lines matching 'security'
-        grep -P -o '(^\d+)' | #Extract the numbers at the beginning of the lines
         awk '{s+=$1} END {print s}' # Sum all the lines
     args:
       chdir: /opt/subspace
@@ -222,7 +227,7 @@
           key: os_security_upgrades
           value: "{{stats_os_security_upgrades.stdout}}"
           hostname: "{{hostname}}"
-    when: send_stats == true and stats_url is defined and stats_api_key is defined
+    when: (send_stats == true) and (stats_url is defined) and (stats_api_key is defined) and (stats_os_security_upgrades.stdout | length > 0)
     tags:
       - maintenance
       - stats

data/ansible/roles/letsencrypt/tasks/main.yml

@@ -10,7 +10,7 @@
     become: true
     ignore_errors: true
     apt:
-      pkg: certbox
+      pkg: certbot
       state: present
 
   - name: "Detect if certbot was installed via APT"
@@ -52,13 +52,13 @@
     command: "{{certbot_bin}} certonly --email {{letsencrypt_email}} --domains {{item.domains | join(',')}} --cert-name {{item.cert_name}} --standalone --agree-tos --expand --non-interactive"
 
   - name: Update nginx default options
-    when: nginx_installed is defined
+    when: "'nginx' in role_names"
     get_url:
       url: https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf
       dest: /etc/letsencrypt/options-ssl-nginx.conf
 
   - name: Update apache default options
-    when: apache_installed is defined
+    when: "'apache' in role_names"
     get_url:
       url: https://raw.githubusercontent.com/certbot/certbot/master/certbot-apache/certbot_apache/options-ssl-apache.conf
       dest: /etc/letsencrypt/options-ssl-apache.conf
@@ -76,7 +76,7 @@
 
   - name: Setup cron job to auto renew
     become: true
-    when: apache_installed is defined
+    when: "'apache' in role_names"
     cron:
       name: Auto-renew SSL
       job: "{{certbot_bin}} renew --no-self-upgrade --apache >> /var/log/cron.log 2>&1"
@@ -86,10 +86,10 @@
 
   - name: Setup cron job to auto renew
     become: true
-    when: nginx_installed is defined
+    when: "'nginx' in role_names"
     cron:
       name: Auto-renew SSL
       job: "{{certbot_bin}} renew --no-self-upgrade --nginx >> /var/log/cron.log 2>&1"
       hour: "0"
       minute: "33"
-      state: present
+      state: present

data/ansible/roles/letsencrypt/tasks/modern.yml

@@ -11,3 +11,22 @@
     set_fact:
       certbot_bin: "certbot"
 
+  - name: "Check for certbot-auto"
+    stat:
+      path: /opt/certbot/certbot-auto
+    register: certbot_auto_exists
+
+  - name: "Remove certbot-auto"
+    file:
+      path: /opt/certbot/certbot-auto
+      state: absent
+    when: certbot_auto_exists.stat.exists
+
+  - name: "Remove certbot-auto cron task"
+    cron:
+      name: Auto-renew SSL
+      job: "{{certbot_bin}} renew --no-self-upgrade --nginx >> /var/log/cron.log 2>&1"
+      hour: "0"
+      minute: "33"
+      state: absent
+    when: certbot_auto_exists.stat.exists

data/ansible/roles/newrelic-infra/defaults/main.yml

@@ -0,0 +1,2 @@
+newrelic_license: ""
+newrelic_logs: []

data/ansible/roles/newrelic-infra/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+  - name: Restart newrelic-infra
+    service:
+      name: newrelic-infra
+      state: restarted

data/ansible/roles/newrelic-infra/tasks/main.yml

@@ -0,0 +1,33 @@
+---
+  - name: Add New Relic apt key
+    apt_key:
+      url: https://download.newrelic.com/infrastructure_agent/gpg/newrelic-infra.gpg 
+      state: present
+    become: true
+
+  - name: create license key
+    copy: 
+      dest: "/etc/newrelic-infra.yml"
+      content: |
+        license_key: {{newrelic_license}}
+
+  - name: Add New Relic apt repo
+    apt_repository:
+      repo: deb [arch=amd64] https://download.newrelic.com/infrastructure_agent/linux/apt focal main
+      state: present
+    become: true
+
+  - name: Install New Relic server agent
+    apt:
+      pkg: newrelic-infra
+      state: present
+      update_cache: true
+    become: true
+
+  - name: Configure application log forwarding if enabled
+    when: "{{ newrelic_logs|length }}"
+    become: true
+    template: 
+      dest: "/etc/newrelic-infra/logging.d/subspace.yml"
+      src: logs.yml.j2
+    notify: Restart newrelic-infra

data/ansible/roles/newrelic-infra/templates/logs.yml.j2

@@ -0,0 +1,5 @@
+logs:
+{% for log in newrelic_logs %}
+  - name: {{log.name}}
+    file: {{log.path}}
+{% endfor %}

data/ansible/roles/newrelic/tasks/main.yml

@@ -1,4 +1,8 @@
 ---
+  - name: "Deprecation notice"
+    ansible.builtin.debug:
+      msg: The 'newrelic' role in subspace is deprecated. Please migration to Newrelic One and the 'newrelic-infra' role
+
   - name: Add New Relic apt repo
     apt_repository:
       repo: deb http://apt.newrelic.com/debian/ newrelic non-free

data/lib/subspace/cli.rb

@@ -24,6 +24,11 @@ class Subspace::Cli
     program :version, Subspace::VERSION
     program :description, 'Ansible-backed server provisioning tool for rails'
 
+    unless system("which ansible > /dev/null")
+      puts "*** Subspace depends on ansible being on your PATH. Please install it: https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html"
+      exit 1
+    end
+
     command :init do |c|
       c.syntax = 'subspace init [vars]'
       c.summary = 'Run without options to initialize subspace.'

data/lib/subspace/version.rb

@@ -1,3 +1,3 @@
 module Subspace
-  VERSION = "2.5.2"
+  VERSION = "2.5.6"
 end

data/template/provision/playbook.yml.erb

@@ -12,9 +12,8 @@
       - ruby-common
       - rails
       - puma
-      - nginx
       - letsencrypt
-      - nginx # This is included twice intentionally. I think there is a bug that is fixed by running it both before and after the letsencrypt role.
+      - nginx
       - postgresql
       - monit
       - logrotate

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: subspace
 version: !ruby/object:Gem::Version
-  version: 2.5.2
+  version: 2.5.6
 platform: ruby
 authors:
 - Brian Samson
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2021-02-02 00:00:00.000000000 Z
+date: 2021-07-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -173,6 +173,10 @@ files:
 - ansible/roles/mysql/templates/mysql_database.yml
 - ansible/roles/mysql2_gem/meta/main.yml
 - ansible/roles/mysql2_gem/tasks/main.yml
+- ansible/roles/newrelic-infra/defaults/main.yml
+- ansible/roles/newrelic-infra/handlers/main.yml
+- ansible/roles/newrelic-infra/tasks/main.yml
+- ansible/roles/newrelic-infra/templates/logs.yml.j2
 - ansible/roles/newrelic/handlers/main.yml
 - ansible/roles/newrelic/tasks/main.yml
 - ansible/roles/nginx-maintenance/tasks/main.yml
@@ -291,7 +295,7 @@ licenses:
 - MIT
 metadata:
   allowed_push_host: https://rubygems.org
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -306,8 +310,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.8
-signing_key: 
+rubygems_version: 3.0.3
+signing_key:
 specification_version: 4
 summary: Ansible-based server provisioning for rails projects
 test_files: []