subspace 3.0.21 → 3.0.22

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: df4ca7c7afe682b2ea4aa12fd7ce11ea9fd7d87a380cd9b7adc9b4b3aa554228
-  data.tar.gz: 5f14219cb20dcfdb6adf6dde79b49dbdd33f1db12223dee02c8ddc76e5f72138
+  metadata.gz: e12ca8ad07d7bc9ef0a4eed0d52be0f1ffa6cac408cd0acb52da0cfb994ea9f1
+  data.tar.gz: '082166c447bb6dcb58a71599167ed69d23ed3cd9dd13ccb1bd34a9eb1039d7c8'
 SHA512:
-  metadata.gz: 6cccd145a57a66a18dc2224496e250b022801d1f57643bbddd14bc4e7a844d684d9656d919c19fd339455ac209e1ef204702e0ea68a179faf6990181514479d0
-  data.tar.gz: b0eeed81c79e8637f78db6be40f32e8d6fff8ad552bf44e1305dad4fe57d0ede687bf3aa32de842ebaaee5cd4bbf1f38330a6ef74224b7412fa7f9e1ff02eb3d
+  metadata.gz: 323f2f1acd128d1f4f7c5080bea4263580f77d837a24aa2359d3c4d865c10533978214ea444c365dadb9f8800feb7fa8175f597b0679978bbb33f35994ba1138
+  data.tar.gz: 1eb77a6dcfc4df830e6d5e223cc2d3f48ac48444955bc3a56916997b17b412e2920af98624ed3b119d5f583c819a504bc74aa40b822f3135af51b67c14030026

data/CHANGELOG.md

@@ -12,6 +12,9 @@ This project attempts to follow [semantic versioning](https://semver.org/).
 
 ## Unreleased
 
+## 3.0.22
+  * Switch nginx from ppa:ondrej/nginx to official nginx.org repository.
+
 ## 3.0.21
   * Add gem-patch-report role. Sends stats for each vulnerable gem fixed since the start of the month.
 

data/ansible/roles/common/tasks/main.yml

@@ -62,6 +62,46 @@
     tags:
       - maintenance
 
+  - name: Remove ppa:ondrej/nginx apt repository
+    apt_repository:
+      repo: ppa:ondrej/nginx
+      state: absent
+    become: true
+
+  - name: Install nginx repo prerequisites
+    apt:
+      pkg:
+        - curl
+        - gnupg2
+        - ca-certificates
+        - lsb-release
+        - ubuntu-keyring
+      state: present
+    become: true
+
+  - name: Import official nginx signing key
+    shell: curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor > /usr/share/keyrings/nginx-archive-keyring.gpg
+    args:
+      creates: /usr/share/keyrings/nginx-archive-keyring.gpg
+    become: true
+
+  - name: Add official nginx.org stable apt repository
+    apt_repository:
+      repo: "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://nginx.org/packages/ubuntu {{ ansible_distribution_release }} nginx"
+      filename: nginx
+      state: present
+    become: true
+
+  - name: Pin nginx.org packages over distribution packages
+    copy:
+      content: |
+        Package: *
+        Pin: origin nginx.org
+        Pin: release o=nginx
+        Pin-Priority: 900
+      dest: /etc/apt/preferences.d/99nginx
+    become: true
+
   - name: apt-get update
     apt: update_cache=yes cache_valid_time=86400
     become: true
@@ -84,10 +124,6 @@
       state: latest
       update_cache: yes
 
-  - name: Add ppa:ondrej/nginx apt repository for TLS 1.3
-    apt_repository:
-      repo: ppa:ondrej/nginx
-
   - name: /usr/lib/update-notifier/apt-check --human-readable
     command: /usr/lib/update-notifier/apt-check --human-readable
     tags:

data/ansible/roles/nginx/tasks/main.yml

@@ -1,17 +1,64 @@
-- name: Install nginx
-  apt: pkg=nginx state=latest
+- name: Remove ondrej nginx packages before switching to official repo
+  apt:
+    pkg:
+      - nginx
+      - nginx-common
+      - nginx-core
+      - nginx-full
+    state: absent
+    purge: no
   become: true
 
-- name: Disable Server tokens
-  lineinfile:
-    path: /etc/nginx/nginx.conf
-    regexp: '# server_tokens off'
-    line: "\tserver_tokens off;"
+- name: Install nginx from official repo
+  apt:
+    pkg: nginx
+    state: latest
+    update_cache: yes
+  become: true
 
-- name: Remove the default app
+- name: Remove default nginx config files
   file:
-    path: /etc/nginx/sites-enabled/default
+    path: "{{ item }}"
     state: absent
+  loop:
+    - /etc/nginx/sites-enabled/default
+    - /etc/nginx/conf.d/default.conf
+  become: true
+
+- name: Ensure sites-available directory exists
+  file:
+    path: /etc/nginx/sites-available
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+  become: true
+
+- name: Ensure sites-enabled directory exists
+  file:
+    path: /etc/nginx/sites-enabled
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+  become: true
+
+- name: Ensure modules-enabled directory exists
+  file:
+    path: /etc/nginx/modules-enabled
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+  become: true
+
+- name: Deploy nginx.conf
+  template:
+    src: nginx.conf
+    dest: /etc/nginx/nginx.conf
+    owner: root
+    group: root
+    mode: '0644'
   become: true
 
 - name: "Configure rails projects"

data/ansible/roles/nginx/templates/nginx.conf

@@ -0,0 +1,29 @@
+user www-data;
+worker_processes auto;
+pid /run/nginx.pid;
+error_log /var/log/nginx/error.log;
+include /etc/nginx/modules-enabled/*.conf;
+
+events {
+	worker_connections 768;
+}
+
+http {
+	sendfile on;
+	tcp_nopush on;
+	types_hash_max_size 2048;
+	server_tokens off;
+
+	include /etc/nginx/mime.types;
+	default_type application/octet-stream;
+
+	ssl_protocols TLSv1.2 TLSv1.3;
+	ssl_prefer_server_ciphers on;
+
+	access_log /var/log/nginx/access.log;
+
+	gzip on;
+
+	include /etc/nginx/conf.d/*.conf;
+	include /etc/nginx/sites-enabled/*;
+}

data/lib/subspace/version.rb

@@ -1,3 +1,3 @@
 module Subspace
-  VERSION = "3.0.21"
+  VERSION = "3.0.22"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: subspace
 version: !ruby/object:Gem::Version
-  version: 3.0.21
+  version: 3.0.22
 platform: ruby
 authors:
 - Brian Samson
@@ -192,6 +192,7 @@ files:
 - ansible/roles/nginx/defaults/main.yml
 - ansible/roles/nginx/handlers/main.yml
 - ansible/roles/nginx/tasks/main.yml
+- ansible/roles/nginx/templates/nginx.conf
 - ansible/roles/nginx/templates/status
 - ansible/roles/nodejs/tasks/main.yml
 - ansible/roles/papertrail/tasks/main.yml
@@ -330,7 +331,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.8
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Ansible-based server provisioning for rails projects
 test_files: []