subspace 3.0.21 → 3.0.23

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: df4ca7c7afe682b2ea4aa12fd7ce11ea9fd7d87a380cd9b7adc9b4b3aa554228
-  data.tar.gz: 5f14219cb20dcfdb6adf6dde79b49dbdd33f1db12223dee02c8ddc76e5f72138
+  metadata.gz: 0b795ab120c9cd6ef51a2a7307a259bf93ce7e61043e8acd5e4b0c2315bd8add
+  data.tar.gz: b6721a78778b6b5005a4e36db7bfde02387a10656ffe990f41e9d1baddbbd72e
 SHA512:
-  metadata.gz: 6cccd145a57a66a18dc2224496e250b022801d1f57643bbddd14bc4e7a844d684d9656d919c19fd339455ac209e1ef204702e0ea68a179faf6990181514479d0
-  data.tar.gz: b0eeed81c79e8637f78db6be40f32e8d6fff8ad552bf44e1305dad4fe57d0ede687bf3aa32de842ebaaee5cd4bbf1f38330a6ef74224b7412fa7f9e1ff02eb3d
+  metadata.gz: f87b11db0b941afa71af37de75cbdc4db31ffa444c1562d734595e828779e6048825f2b9a0861feb96eef897625d6adadd2f3c7aa49fcf3fa13a9788427c77d1
+  data.tar.gz: 7df00e223764df49ed05a4a17d420e9c23df51384eff3d61bf5b76d44d80570db1384bb57d43d6503dcb7f7c606bbda81ffb91f9992aeb4051853759095ee774

data/CHANGELOG.md

@@ -12,6 +12,12 @@ This project attempts to follow [semantic versioning](https://semver.org/).
 
 ## Unreleased
 
+## 3.0.23
+  * Add cache_valid_time to apt update_cache calls across roles to avoid redundant apt updates during provision
+
+## 3.0.22
+  * Switch nginx from ppa:ondrej/nginx to official nginx.org repository.
+
 ## 3.0.21
   * Add gem-patch-report role. Sends stats for each vulnerable gem fixed since the start of the month.
 

data/ansible/roles/common/tasks/main.yml

@@ -62,8 +62,48 @@
     tags:
       - maintenance
 
+  - name: Remove ppa:ondrej/nginx apt repository
+    apt_repository:
+      repo: ppa:ondrej/nginx
+      state: absent
+    become: true
+
+  - name: Install nginx repo prerequisites
+    apt:
+      pkg:
+        - curl
+        - gnupg2
+        - ca-certificates
+        - lsb-release
+        - ubuntu-keyring
+      state: present
+    become: true
+
+  - name: Import official nginx signing key
+    shell: curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor > /usr/share/keyrings/nginx-archive-keyring.gpg
+    args:
+      creates: /usr/share/keyrings/nginx-archive-keyring.gpg
+    become: true
+
+  - name: Add official nginx.org stable apt repository
+    apt_repository:
+      repo: "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://nginx.org/packages/ubuntu {{ ansible_distribution_release }} nginx"
+      filename: nginx
+      state: present
+    become: true
+
+  - name: Pin nginx.org packages over distribution packages
+    copy:
+      content: |
+        Package: *
+        Pin: origin nginx.org
+        Pin: release o=nginx
+        Pin-Priority: 900
+      dest: /etc/apt/preferences.d/99nginx
+    become: true
+
   - name: apt-get update
-    apt: update_cache=yes cache_valid_time=86400
+    apt: update_cache=yes cache_valid_time=3600
     become: true
     tags:
       - upgrade
@@ -83,10 +123,7 @@
       name: systemd
       state: latest
       update_cache: yes
-
-  - name: Add ppa:ondrej/nginx apt repository for TLS 1.3
-    apt_repository:
-      repo: ppa:ondrej/nginx
+      cache_valid_time: 3600
 
   - name: /usr/lib/update-notifier/apt-check --human-readable
     command: /usr/lib/update-notifier/apt-check --human-readable

data/ansible/roles/nginx/tasks/main.yml

@@ -1,17 +1,65 @@
-- name: Install nginx
-  apt: pkg=nginx state=latest
+- name: Remove ondrej nginx packages before switching to official repo
+  apt:
+    pkg:
+      - nginx
+      - nginx-common
+      - nginx-core
+      - nginx-full
+    state: absent
+    purge: no
   become: true
 
-- name: Disable Server tokens
-  lineinfile:
-    path: /etc/nginx/nginx.conf
-    regexp: '# server_tokens off'
-    line: "\tserver_tokens off;"
+- name: Install nginx from official repo
+  apt:
+    pkg: nginx
+    state: latest
+    update_cache: yes
+    cache_valid_time: 3600
+  become: true
 
-- name: Remove the default app
+- name: Remove default nginx config files
   file:
-    path: /etc/nginx/sites-enabled/default
+    path: "{{ item }}"
     state: absent
+  loop:
+    - /etc/nginx/sites-enabled/default
+    - /etc/nginx/conf.d/default.conf
+  become: true
+
+- name: Ensure sites-available directory exists
+  file:
+    path: /etc/nginx/sites-available
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+  become: true
+
+- name: Ensure sites-enabled directory exists
+  file:
+    path: /etc/nginx/sites-enabled
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+  become: true
+
+- name: Ensure modules-enabled directory exists
+  file:
+    path: /etc/nginx/modules-enabled
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+  become: true
+
+- name: Deploy nginx.conf
+  template:
+    src: nginx.conf
+    dest: /etc/nginx/nginx.conf
+    owner: root
+    group: root
+    mode: '0644'
   become: true
 
 - name: "Configure rails projects"

data/ansible/roles/nginx/templates/nginx.conf

@@ -0,0 +1,29 @@
+user www-data;
+worker_processes auto;
+pid /run/nginx.pid;
+error_log /var/log/nginx/error.log;
+include /etc/nginx/modules-enabled/*.conf;
+
+events {
+	worker_connections 768;
+}
+
+http {
+	sendfile on;
+	tcp_nopush on;
+	types_hash_max_size 2048;
+	server_tokens off;
+
+	include /etc/nginx/mime.types;
+	default_type application/octet-stream;
+
+	ssl_protocols TLSv1.2 TLSv1.3;
+	ssl_prefer_server_ciphers on;
+
+	access_log /var/log/nginx/access.log;
+
+	gzip on;
+
+	include /etc/nginx/conf.d/*.conf;
+	include /etc/nginx/sites-enabled/*;
+}

data/ansible/roles/nodejs/tasks/main.yml

@@ -18,7 +18,7 @@
   register: node_repo
 
 - name: Update apt cache if repo was added.
-  apt: update_cache=yes
+  apt: update_cache=yes cache_valid_time=3600
   when: node_repo.changed
 
 - name: Ensure Node.js and npm are installed.

data/ansible/roles/postgresql/tasks/main.yml

@@ -46,6 +46,7 @@
       name: python3-pip
       state: present
       update_cache: yes
+      cache_valid_time: 3600
 
   - name: Install psycopg2 (python3)
     when: is_python3 is succeeded

data/ansible/roles/postgresql-client/tasks/main.yml

@@ -58,6 +58,7 @@
     name: python3-pip
     state: present
     update_cache: yes
+    cache_valid_time: 3600
   tags:
     - postgresql
     - db

data/ansible/roles/ruby-common/tasks/main.yml

@@ -1,6 +1,6 @@
 ---
 - name: Update APT cache
-  apt: update_cache=yes
+  apt: update_cache=yes cache_valid_time=3600
   become: true
   when: ansible_facts["distribution"] == 'Debian' or ansible_facts["distribution"] == 'Ubuntu'
 

data/ansible/roles/tailscale/tasks/main.yml

@@ -32,6 +32,7 @@
       state: latest
       allow_downgrade: true
       update_cache: yes
+      cache_valid_time: 3600
     tags:
       - maintenance
       - tailscale_reauth

data/ansible/roles/yarn/tasks/main.yml

@@ -30,6 +30,7 @@
   become_user: root
   apt:
     update_cache: yes
+    cache_valid_time: 3600
 
 - name: "Yarn | Install"
   become: yes

data/lib/subspace/version.rb

@@ -1,3 +1,3 @@
 module Subspace
-  VERSION = "3.0.21"
+  VERSION = "3.0.23"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: subspace
 version: !ruby/object:Gem::Version
-  version: 3.0.21
+  version: 3.0.23
 platform: ruby
 authors:
 - Brian Samson
@@ -192,6 +192,7 @@ files:
 - ansible/roles/nginx/defaults/main.yml
 - ansible/roles/nginx/handlers/main.yml
 - ansible/roles/nginx/tasks/main.yml
+- ansible/roles/nginx/templates/nginx.conf
 - ansible/roles/nginx/templates/status
 - ansible/roles/nodejs/tasks/main.yml
 - ansible/roles/papertrail/tasks/main.yml
@@ -330,7 +331,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.8
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Ansible-based server provisioning for rails projects
 test_files: []