ansible-roles/CHANGELOG.md

1598 lignes
61 KiB
Markdown
Brut Lien permanent Vue normale Historique

2018-01-18 18:40:49 +01:00
# Changelog
2023-10-14 07:36:29 +02:00
2018-01-18 18:40:49 +01:00
All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
This project does not follow semantic versioning.
The **major** part of the version is the year
The **minor** part changes is the month
The **patch** part changes is incremented if multiple releases happen the same month
2018-01-18 18:40:49 +01:00
## [Unreleased]
2020-05-13 11:20:45 +02:00
### Added
2024-03-01 09:00:49 +01:00
### Changed
### Fixed
### Removed
### Security
## [24.03] 2024-03-01
### Added
* autosysadmin-agent: upstream release 24.03
2024-03-01 08:32:47 +01:00
* autosysadmin-restart_nrpe: add role
2024-02-21 12:27:18 +01:00
* certbot: Renewal hook for NRPE
2024-02-12 19:07:20 +01:00
* kvm-host: add minifirewall rules if DRBD interface is configured
2024-02-08 09:27:08 +01:00
### Changed
* apt: add ftp.evolix.org as recognized system source
* autosysadmin-agent: logs clearing is done weekly
* autosysadmin-agent: rename /usr/share/scripts/autosysadmin/{auto,restart}
2024-03-01 08:55:07 +01:00
* certbot: use pkey to test the key
* evolinux-base: execute autosysadmin-agent and autosysadmin-restart_nrpe roles
2024-02-16 11:03:22 +01:00
* lxc-php, php: Update sury PGP key
* openvpn: earlier alert for CA expiration
2024-03-01 08:55:07 +01:00
* redis: create sysfs config file if missing
2024-02-08 09:27:08 +01:00
### Removed
* autosysadmin: replaced by autosysadmin-agent
2024-02-08 11:08:28 +01:00
## [24.02.1] 2024-02-08
### Fixed
* fail2ban: fix Ansible syntax
2024-02-08 09:27:08 +01:00
## [24.02] 2024-02-08
### Added
2024-02-08 08:33:49 +01:00
* Support for PHP 8.3 with bookworm LXC containers
* apt: add task file to install ELTS repository (default: False)
2023-12-20 15:28:09 +01:00
* autosysadmin: Add a role to automatically deploy autosysadmin on evolixisation
2024-02-06 08:41:58 +01:00
* check_free_space: added role
2023-12-20 15:28:09 +01:00
* etc-git: add /var/chroot-bind/etc/bind repo
2024-02-06 08:41:58 +01:00
* fail2ban: add script unban_ip
* generateldif: new Services for check_pressure_{cpu,io,mem}
* kvm-host: Automatically add an LVM filter when LVM is present
2023-11-29 09:24:28 +01:00
* lxc-php: Allow one to install php83 on Bookworm container
2023-12-20 15:28:09 +01:00
* minifirewall: Fix nagios check for old versions of minifirewall
2023-12-18 16:36:09 +01:00
* mongodb: add gpg key for 7.0
2023-10-27 15:02:28 +02:00
* nagios-nrpe: add check_sentinel for monitoring Redis Sentinel
2024-02-06 08:41:58 +01:00
* nagios-nrpe: new check_pressure_{cpu,io,mem}
* remount-usr: do not try to remount /usr RW if /usr is not a mounted partition
2024-02-06 08:41:58 +01:00
* vrrpd: configure minifirewall
* vrrpd: test if interface exists before deleting it
* webapps/evoadmin-mail: package installed via public.evolix.org/evolix repo starting with Bookworm
2024-02-06 08:41:58 +01:00
* webapps/nextcloud: Add condition for archive tasks
2023-12-20 15:28:09 +01:00
* webapps/nextcloud: Add condition for config tasks
* webapps/nextcloud: Added var nextcloud_user_uid to enforce uid for nextcloud user
* webapps/nextcloud: Set ownership and permissions of data directory
2023-10-26 16:09:42 +02:00
2023-10-14 07:37:18 +02:00
### Changed
* add-vm.sh: allow VM name max length > 20
* amavis: make ldap_suffix mandatory
* apache : fix goaway pattern for bad bots
* apache : rename MaxRequestsPerChild to MaxConnectionsPerChild (new name)
* apache: use backward compatible Redirect directive
* apt: Disable archive repository for Debian 8
* apt: Use the GPG version of the key for Debian 8-9
* bind: Update role for Buster, Bullseye and Bookworm support
2024-02-07 16:14:29 +01:00
* dovecot: add variables for LDAP
* dovecot: Munin plugin conf path is now `/etc/munin/plugin-conf.d/zzz-dovecot` (instead of `z-evolinux-dovecot`)
2024-01-03 17:46:15 +01:00
* evocheck: upstream release 24.01
* evolinux-base: dump-server-state upstream release 23.11
* evolinux-base: use separate default config file for rsyslog
* kvmstats: use .capacity instead of .physical for disk size
* ldap: make ldap_suffix mandatory
* listupgrade : old-kernel-removal.sh upstream release 24.01
* log2mail: move custom config in separate file
2023-11-30 15:58:31 +01:00
* lxc: init /etc git repository in lxc container
* mysql: disable performance schema for Debian 8
* nagios: add dockerd check in nrpe check template
2023-12-20 15:28:09 +01:00
* nagios: cleaning nrpe check template
* nagios: rename var `nagios_nrpe_process_processes` into `nagios_nrpe_processes` and check systemd-timesyncd instead of ntpd in Debian 12
* nagios: add option --full to check pressure IO and mem to avoid flaps
* proftpd: in SFTP vhost, enable SSH keys login, enable ed25549 host key for Debian >= 11
* redis: manage config template inside a block, to allow custom modifications outside
* spamassassin: Use spamd starting with Bookworm
2024-01-18 10:01:46 +01:00
* squid: config directory seems to have changed from /etc/squid3 to /etc/squid in Debian 8
* unbound: Add config file to allow configuration reload on Debian 11 and lower
* unbound: Add munin configuration & setup plugin
* unbound: Big cleanup
* unbound: Move generated config file to `/etc/unbound/unbound.conf.d/evolinux.conf`
* unbound: Use root hints provided by debian package dns-root-data instead of downloading them
2024-02-08 08:33:49 +01:00
* vrrpd: replace switch script with custom one (fix MAC issue, use `ip(8)`, shell cleanup…)
* vrrpd: variable to force update the switch script (default: false)
* webapps/nextcloud: Add Ceph volume to fstab
* webapps/nextcloud: Set home directory's mode
2023-10-26 16:09:42 +02:00
2023-10-14 07:37:18 +02:00
### Fixed
2023-10-26 16:09:42 +02:00
* Add php-fpm82 to LDAP when relevant
2024-02-08 08:33:49 +01:00
* Check stat.exists before stat.isdir
2023-11-29 09:24:28 +01:00
* apache: fix MaxRequestsPerChild value to be sync with wiki.e.o
2023-12-20 15:28:09 +01:00
* apt: use archive.debian.org with Stretch
* certbot: fix hook for dovecot when more than one certificate is used (eg. different certificates for POP3 and IMAP)
2024-02-06 08:41:58 +01:00
* dovecot: add missing LDAP conf iterate_filter to exclude disabled accounts in users list (caused « User no longer exists » errors in commands listing users like « doveadm user -u '*' » or « doveadm expunge -u "*" mailbox INBOX savedbefore 7d »).
* dovecot: fix missing default mails
2024-01-11 17:46:49 +01:00
* dovecot: fix plugin dovecot1
2023-11-29 09:24:28 +01:00
* evoadmin-web: Fix PHP version for Bookworm
2023-12-20 15:28:09 +01:00
* evolinux-base: fix hardware.yml (wrong repo, missing update cache)
* evolinux-base: start to install linux-image-cloud-amd64 with Buster
2024-01-11 17:46:49 +01:00
* fail2ban: fix template marker
2024-02-06 08:41:58 +01:00
* minifirewall: ports 25, 53, 443, 993, 995 not opened publicly by default anymore, ports 20, 21, 110, 143 not opened semi-publicly by default anymore.
* nagios: fix default file to monitor for check_clamav_db
2024-02-06 08:41:58 +01:00
* nginx: add "when: not ansible_check_mode" in various tasks to prevent fail in check mode
* nginx: fix mistake between "check_mode: no" and "when: not ansible_check_mode" (fail in check mode)
2024-01-11 17:46:49 +01:00
* nginx: fix mistake between "check_mode: no" and "when: not ansible_check_mode" (fail in check mode)
2023-11-29 09:24:28 +01:00
* nginx: keep indentation
2024-01-11 17:46:49 +01:00
* nginx: take care of « already defined » and « not yet defined » server status suffix in check mode
* php: Bullseye/Sury > Honor the php_version asked in the pub.evolix.org repository
2024-01-18 10:01:46 +01:00
* php: drop apt_preferences(5) file for sury
2024-02-06 08:41:58 +01:00
* postfix: remove dependency on evolinux_fqdn var
2023-12-20 15:28:09 +01:00
* proftpd: set missing default listen IP for SFTP
2024-02-06 08:41:58 +01:00
* roundcube: set default SMTP port to 25 instead of 587, which failed because of missing SSL conf (local connexion does not need SSL)
* ssl: no not execute haproxy tasks and reload if haproxy is disabled
2023-12-20 15:28:09 +01:00
* unbound: Add a apt cache validity to enforce an apt update if needed
* webapps/nextcloud: added check that nextcloud uid is over 3000
* webapps/nextcloud: fix Add Ceph volume to fstab : missing UUID= in src
2023-11-29 09:24:28 +01:00
* webapps/nextcloud: fix misplaced gid attribute
* webapps/nextcloud: fix missing gid
* webapps/roundcube & evoadminmail: make roles more idempotent (were failing when played twice)
* amavis: Add variables for generate "ldap_suffix"
* proftpd: fix error when no SSH key is provided
2023-10-26 16:09:42 +02:00
2023-10-14 07:37:18 +02:00
### Removed
* evolinux-base: no need to remove update-evobackup-canary from sbin anymore
* evolinux-base: no need to symlink backup-server-state to dump-server-state anymore
2023-10-14 07:37:18 +02:00
## [23.10] 2023-10-14
### Added
2023-09-20 14:33:45 +02:00
* apt: disable `NonFreeFirmware` warning for VM on Debian 12+
* apt: explicit `signed-by` directives for official sources
* bind: add reload-zone helper
* certbot: deploy-hook for proftpd
* docker-host: added var for user namespace setting
* dovecot: add Munin plugins dovecot1 and dovecot_stats (patched)
2023-09-20 14:33:45 +02:00
* dovecot: fix old_stats plugin for Dovecot 2.3
* evocheck: add support for Debian >= 12 split SSH configuration
* evolinux-base: add split SSH configuration for Debian >= 12
* evolinux-base: configure `.bashrc` for all users
* evolinux-base: New variable `evolinux_system_include_ntpd` to chose wether or not to include `ntpd` role
* evolinux-base: reboot the server if the Cloud kernel has been installed
2023-09-20 14:33:45 +02:00
* evolinux-users: add split SSH configuration for Debian >= 12
* evolinux: install HPE Agentless Management Service (amsd)
* fail2ban: add default variable fail2ban_dbpurgeage_default
2023-09-20 14:33:45 +02:00
* fail2ban: add `fail2ban_sshd_port` variable to configure sshd port
* kvm-host: release 23.10 for migrate-vm.sh
2023-09-20 14:33:45 +02:00
* metricbeat/logstash: fix Ansible syntax
* mysql: new munin graph to follow binlog_days over time
* nagios-nrpe: add a NRPE check-local command with completion.
2023-09-20 14:33:45 +02:00
* nagios-nrpe: add a proper monitoring plugin for GlusterFS (on servers, not for clients)
* php: add new variable to disable overriding settings of php-fpm default pool (www)
* policy_pam: New role to manage password policy with `pam_pwquality` & `pam_pwhistory`
* userlogrotate: add a `userlogpurge` script disabled by default
* userlogrotate: new version, with separate conf file
2023-09-20 14:33:45 +02:00
* userlogrotate: rotate also php.log
2023-09-26 17:56:33 +02:00
* java: allow version 17
* timesyncd: new role, used instead of ntpd by default starting with Debian 12
2023-04-23 10:48:39 +02:00
### Changed
* all: change syntax "become: [yes,no]" → "become: [true,false]"
2023-09-20 14:33:45 +02:00
* all: change syntax "force: [yes,no]" → "force: [true,false]"
* elasticsearch: improve networking configuration
2023-09-20 14:33:45 +02:00
* evolinux-base: include files under `sshd_config.d`
* evolinux-users: remove Stretch references in tasks that also apply to next Debian versions
* evomaintenance: upstream release 23.10.1
2023-09-20 14:33:45 +02:00
* lxc-php: change LXC container in bookworm for php82
* minifirewall: update nrpe script to check active configuration
2023-09-20 14:33:45 +02:00
* minifirewall: upstream release 23.07
* mysql: improve shell syntax for mysql_skip script
2023-09-20 14:33:45 +02:00
* nagios-nrpe: set default check_load --per-cpu for BSD
* pgbouncer: minor fixes
* postfix (packmail or when postfix_slow_transport_include is True): change `miniprofmal_backoff_time` from 2h to 15m (see HowtoPostfix)
* postfix (packmail) : optimize Amavis integration
2023-09-05 14:37:55 +02:00
* postfix: disable sending mails via IPv6
2023-09-20 14:33:45 +02:00
* postfix: new spam.sh update script that avoids reloading if files did not change.
* postgresql: fix file `postgresql.pref.j2` for exclude package
* postgresql: fix task `update apt cache` for PGDG repo
* redis: standardize plugins path from `/usr/local/share/munin/` to `/usr/local/lib/munin/plugins/`
* varnish: allow the systemd template to be overridden with a template outside of the role
2023-09-26 16:14:54 +02:00
* lxc: purge openssh-server from container on install
2023-04-23 10:48:39 +02:00
### Fixed
2023-09-20 14:33:45 +02:00
* elasticsearch: comment the `Xlog:gc` line instead of changing it completely
* evocheck: fix IS_SSHALLOWUSERS condition
* evolinux-base, evolinux-users: Fix files mode under `/etc/ssh/sshd_config.d`
* evolinux-base: fix file extension
* fail2ban: fix cron `fail2ban_dbpurge` (should be bash instead of sh)
* lxc-php: fix APT keyring path inside containers
2023-09-20 14:33:45 +02:00
* nagios-nrpe: `check_ssl_local` now has an output that nrpe can understand when it isn't OK
* nagios-nrpe: remount `/usr` **after** installing the packages
* nagios-nrpe: sync Redis check from redis roles
* nginx: set default server directive in default vhost
* opendkim: update apt cache before install
2023-09-20 14:33:45 +02:00
* packweb-apache,nagios-nrpe: add missing task and config for PHP 8.2 container
* postfix: add missing `localhost.$mydomain` to `mydestination`
* redis: replace erroneous `ini_file` module for Munin config, fix dedicated Munin config filename (z-XXX).
2023-10-09 17:12:15 +02:00
* evolinux-base: use lineinfile instead of replace under root task
* evolinux-base: Corriger autorisation pour evolinux_user
* docker-host: Retirer directive state en trop
* rbenv: Installer libyaml-dev
2023-04-23 10:48:39 +02:00
### Removed
* dovecot: remove Munin plugin dovecot (not working)
2023-04-23 10:48:39 +02:00
## [23.04] 2023-04-23
### Added
2023-03-30 17:58:30 +02:00
* graylog: new role
* lxc-php: add support for PHP 8.2 container
2023-03-30 17:58:30 +02:00
2023-03-16 14:56:39 +01:00
### Changed
2023-04-23 10:48:39 +02:00
* Use FQCN (Fully Qualified Collection Name)
* apt: with Debian 12, backports are installed but disabled by default
2023-03-22 15:21:58 +01:00
* openvpn: updated the README file
2023-03-30 13:19:13 +02:00
* pgbouncer: add handler to restart the service
2023-03-16 14:56:39 +01:00
### Fixed
* generate-ldif: Support for Debian 12
2023-03-16 22:17:46 +01:00
## [23.03.1] 2023-03-16
### Added
* pgbouncer: new role
### Changed
* apt: deb822 migration python script is looked relative to shell script
* listupgrade: remove old typo version of the cron task
* minifirewall: support protocols in numeric form
2023-03-16 14:56:39 +01:00
## [23.03] 2023-03-16
### Added
2023-03-16 14:06:44 +01:00
* apache: add task to enable mailgraph on default vhost and index.html
* apt: add move-apt-keyrings script/tasks
* apt: add tools to migrate sources to deb822 format
* fail2ban: add "Internal login failure" to Dovecot filter
2023-03-16 14:06:44 +01:00
* lxc: copy `/etc/profile.d/evolinux.sh` from host into container
* nagios-nrpe: add tasks/files for a wrapper
* nagios-nrpe: Print pool config path in check_phpfpm_multi output
* php: add `php_version` variable when sury is activated for each Debian version
* php: add a way to choose which version to install using sury repository
2023-03-16 14:06:44 +01:00
* postfix: Add task to enable mailgraph on packmail
2023-03-09 14:37:42 +01:00
* postgresql: configure max_connections
2023-03-16 14:06:44 +01:00
* userlogrotate: create dedicated role, separated from packweb-apache
* varnish: add `varnish_update_config` variable to disable configuration update
2022-12-30 10:46:24 +01:00
2022-12-14 11:37:38 +01:00
### Changed
2022-12-28 09:02:17 +01:00
* Use systemd module instead of command
2023-03-16 14:06:44 +01:00
* Removed all `warn: False` args in command, shell and other modules as it's been deprecated and will give a hard fail in ansible-core 2.14.0.
* apt: Use pub.evolix.org instead of pub.evolix.net
* bind: refactor role
2023-03-16 14:06:44 +01:00
* elasticsearch: Disable garabge collector logging (JDK >= 9)
2023-02-21 15:09:05 +01:00
* evolinux-users: Update sudoers template to remove commands allowed without password
2023-03-16 14:31:34 +01:00
* listupgrade: upstream release 23.03.3
2023-03-16 14:37:51 +01:00
* kvmstats: use virsh domstats | awk to get guests informations
2023-03-16 14:06:44 +01:00
* nagios-nrpe : Rewrite `check_vrrpd` for a better check (check `rp_filter`, `vrrpd` and `uvrrpd` compatible, use arguments, …)
* openvpn: Change `check_openvpn` destination file to comply with recent EvoBSD change
2023-02-21 15:09:05 +01:00
* postfix: come back to default value of `notify_classes` for pack mails.
2023-03-16 14:06:44 +01:00
* userlogrotate: set rotate date format in right order (YYYY-MM-DD)!
2023-02-21 15:09:05 +01:00
* webapps/nextcloud : Change default data directory to be outside web root
* webapps/nextcloud : Small enhancement on the vhost template to lock out data dir
* yarn: update apt key
2022-12-14 11:37:38 +01:00
### Fixed
2022-12-28 09:03:37 +01:00
* Proper jinja spacing
2023-03-16 14:06:44 +01:00
* clamav: set `MaxConnectionQueueLength` to its default value (200), custom (15) was way too small and caused recurring failures in Postfix.
* docker-host: fix type in `daemon.json` and remove host configuration that is already in the systemd service by default
* evolinux-base: ensure dbus is started and enabled (not by default in the case of an offline netinst)
* haproxy: fix missing admin ACL in stats module access permissions
* openvpn: fix the client cipher configuration to match the server cipher configuration
2023-03-16 14:06:44 +01:00
* php: fix error introduced in #33503e4538 (`False` evaluated as a String instead of Boolean)
* php: install using Sury repositories on Bullseye
* postfix (packmail only): disable `concurrency_failed_cohort_limit` for destination smtp-amavis to prevent the suspension of this destination when Amavis fails to answer. Indeed, we configure the suspension delay quite long in `minimal_backoff_time` (2h) and `maximal_backoff_time` (6h) to reduce the risk of ban from external SMTPs.
2023-03-16 14:06:44 +01:00
* postfix: avoid Amavis transport to be considered dead when restarted.
* postfix: remove unused `aliases_scope=sub` from virtual_aliases.cf (it generated warnings)
* userlogrotate: fix bug introduced in commit 2e54944a246 (rotated files were not zipped)
* userlogrotate: skip zipping if .gz log already exists (prevents interactive question)
2022-12-14 11:37:38 +01:00
### Removed
* evolinux-base: subversion is not installed anymore
2022-12-14 11:37:38 +01:00
## [22.12] 2022-12-14
### Added
* all: add signed-by option for additional APT sources
2022-11-06 15:20:31 +01:00
* all: preliminary work to support Debian 12
2022-12-14 11:37:38 +01:00
* all: use proper keyrings directory for APT version
* evolinux-base: replace regular kernel by cloud kernel on virtual servers
2022-12-14 11:37:38 +01:00
* lxc-php: set php-fpm umask to `007`
* nagios-nrpe: `check_ceph_*`
* nagios-nrpe: `check_haproxy_stats` supports DRAIN status
* packweb-apache: enable `log_forensic` module
2022-12-07 15:46:40 +01:00
* rabbitmq: add link in default page
2022-12-14 11:37:38 +01:00
* varnish: create special tmp directory for syntax validation
* postfix: add localhost.$mydomain to mydestination
2022-10-26 15:25:22 +02:00
2022-09-19 17:06:25 +02:00
### Changed
* certbot: auto-detect HAPEE version in renewal hook
* evocheck: install script according to Debian version
2022-12-14 11:37:38 +01:00
* evolinux-base: `utils.yml` can be excluded
* evolinux-todo: execute tasks only for Debian distribution (because this task is a dependency for others roles used on different distributions)
2022-12-14 11:37:38 +01:00
* evolinux-user: add sudoers privilege for check `php_fpm81`
* evomaintenance: allow missing API endpoint if APi is disabled
* java: use default JRE package when version is not specified
2022-12-14 11:37:38 +01:00
* keepalived: change exit code (_warning_ if running but not on expected state ; _critical_ if not running)
* listupgrade: better detection for PostgreSQL
* listupgrade: sort/uniq of packages/services lists in email template
* lxc-solr: detect the real partition options
* lxc-solr: download URL according to Solr Version
* lxc-solr: set homedir and port at install
* minifirewall: whitelist deb.freexian.com
2022-12-14 11:37:38 +01:00
* openvpn: shellpki upstream release 22.12.2
* openvpn: specifies that the mail for expirations is for OpenVPN
* packweb-apache: manual dependencies resolution
* redis: some values should be quoted
* redis: variable to disable transparent hugepage (default: do nothing)
2022-12-14 11:37:38 +01:00
* squid: whitelist `deb.freexian.com`
* varnish: better package facts usage with check mode and tags
* varnish: systemd override depends on Varnish version instead of Debian version
2022-09-19 17:06:25 +02:00
### Fixed
2022-12-14 11:37:38 +01:00
* evolinux-user: Fix sudoers privilege for check `php_fpm80`
* nagios-nrpe: Fix check opendkim for recent change in listening port
2022-12-13 19:37:54 +01:00
* openvpn: Fix mode of shellpki script
2022-12-14 11:37:38 +01:00
* proftpd: Fix format of public key files controlled by Ansible
* proftpd: Fix mode of public key directory and files (they have to be accessible by `proftpd:nobody`)
* varnish: fix missing state, that blocked the task
2022-09-19 17:06:25 +02:00
### Removed
* openvpn: Deleted the task fixing the CRL rights since it has been fixed in upstream
2022-09-19 17:06:25 +02:00
## [22.09] 2022-09-19
### Added
* evolinux_users: create only users who have a certain value for the `create` key (default: `always`).
* php: install php-xml with recent PHP versions
2022-08-24 17:58:44 +02:00
* vrrp: add an `ip.yml` task file to help create VRRP addresses
2022-08-26 16:34:19 +02:00
* webapps/nextcloud: Add compatibility with apache2, and apache2 mod_php.
* memcached: NRPE check for multi-instance setup
* munin: Add ipmi_ plugins on dedicated hardware
* proftpd: Add options to override configs (and add a warning if file was overriden)
2022-09-13 16:29:59 +02:00
* proftpd: Allow user auth with ssh keys
2022-07-06 18:02:42 +02:00
### Changed
2022-09-14 10:55:00 +02:00
* evocheck: upstream release 22.09
* evolinux-base: update-evobackup-canary upstream release 22.06
* generate-ldif: Support any MariaDB version
* minifirewall: use handlers to restart minifirewall
* openvpn: automate the initialization of the CA and the creation of the server certificate ; use openssl_dhparam module instead of a command
2023-10-14 07:36:29 +02:00
* generate-ldif: support any version of MariaDB (instead of only 10.0, 10.1 and 10.3)
* openvpn: Run OpenVPN with the \_openvpn user and group instead of nobody which is originally for NFS
2022-09-14 12:21:13 +02:00
* nagios-nrpe: Upgrade check_mongo
2022-07-28 14:18:12 +02:00
2022-07-06 18:02:42 +02:00
### Fixed
* fail2ban: fix dovecot-evolix regex syntax
2022-08-10 10:26:37 +02:00
* haproxy: make it so that munin doesn't break if there is a non default `haproxy_stats_path`
* mysql: Add missing Munin conf for Debian 11
* redis: config directory must be owned by the user that runs the service (to be able to write tmp config files in it)
* varnish: make `-j <jail_config>` the first argument on jessie/stretch as it has to be the first argument there.
* webapps/nextcloud: Add missing dependencies for imagick
2022-08-10 10:26:37 +02:00
2022-07-06 18:02:42 +02:00
### Removed
* evocheck: remove failure if deprecated variable is used
* webapps/nextcloud: Drop support for Nginx
2022-07-28 13:49:57 +02:00
## [22.07.1] 2022-07-28
### Changed
* evocheck: upstream release 22.07
* evomaintenance: upstream release 22.07
* mongodb: replace version_compare() with version()
* nagios-nrpe: check_disk1 returns only alerts
* nagios-nrpe: use regexp to exclude paths/devices in check_disk1
2022-07-08 11:28:29 +02:00
## [22.07] 2022-07-08
### Added
* fail2ban: Ensure apply dbpurgeage from stretch and buster
2022-07-06 18:02:42 +02:00
## [22.07] 2022-07-06
### Added
* evolinux-base: session timeout is configurable (default: 36000 seconds = 10 hours)
* haproxy: add haproxy_allow_ip_nonlocal_bind to set sysctl value (optional)
2022-07-05 10:18:49 +02:00
* kvm-host: fix depreciation of "drbd-overview" by "drbdadm status" in add-vm.sh
2022-07-06 14:26:13 +02:00
* openvpn: configure logrotate
2022-06-10 11:11:44 +02:00
### Changed
* openvpn: minimal rights on /etc/shellpki/ and crl.pem
2022-06-10 11:11:44 +02:00
### Fixed
* evolinux-base: Update PermitRootLogin task to work on Debian 11
* evolinux-user: Update PermitRootLogin task to work on Debian 11
* minifirewall: docker mode is configurable
2022-06-17 11:00:51 +02:00
## [22.06.3] 2022-06-17
### Changed
* evolinux-base: blacklist and do not install megaclisas-status package on incompatible servers
2022-06-10 11:11:44 +02:00
## [22.06.2] 2022-06-10
### Added
* postgresql: add variable to configure binding addresses (default: 127.0.0.1)
2022-06-03 09:27:01 +02:00
### Changed
2022-06-09 07:41:49 +02:00
* evocheck: upstream release 22.06.2
* fail2ban: Give the possibility to override jail.local (with fail2ban_override_jaillocal)
* fail2ban: If jail.local was overriden, add a warning
* fail2ban: Allow to tune some jail settings (maxretry, bantime, findtime) with ansible
* fail2ban: Allow to tune the default action with ansible
* fail2ban: Change default action to ban only (instead of ban + mail with whois report)
* fail2ban: Configure recidive jail (off by default) + extend dbpurgeage
* redis: binding is possible on multiple interfaces (breaking change)
2022-06-03 09:27:01 +02:00
### Fixed
2022-06-08 15:38:21 +02:00
* Enforce String notation for mode
* postgresql: fix nested loop for Munin plugins
* postgresql: Fix task order when using pgdg repo
* postgresql: Install the right pg version
2022-06-08 15:38:21 +02:00
2022-06-06 15:07:10 +02:00
## [22.06.1] 2022-06-06
### Changed
* evocheck: upstream release 22.06.1
* minifirewall: upstream release 22.06
* mysql: evomariabackup release 22.06.1
* mysql: reorganize evomariabackup to use mtree instead of our own dir-check
2022-06-03 09:27:01 +02:00
## [22.06] 2022-06-03
### Added
2022-06-01 17:23:56 +02:00
* certbot: add hapee (HAProxy Enterprise Edition) deploy hook
* evolinux-base: add dir-check script
* evolinux-base: add update-evobackup-canary script
* mysql: add post-backup-hook to evomariabackup
* mysql: use dir-check inside evomariabackup
2022-05-12 15:49:18 +02:00
### Changed
* docker: Allow "live-restore" to be toggled with docker_conf_live_restore
2022-06-03 09:15:04 +02:00
* evocheck: upstream release 22.06
2022-06-13 17:35:31 +02:00
* evolinux-base: Replacement of variable `evolinux_packages_hardware` by `ansible_virtualization_role == "host"` automatize host type detection and avoids installing smartd & other on VM.
2022-06-03 10:19:35 +02:00
* minifirewall: tail template follows symlinks
2022-06-03 09:26:07 +02:00
* mysql: add "set crypt_use_gpgme=no" Mutt option, for mysqltuner
2022-12-14 11:47:53 +01:00
### Fixed
2022-06-13 17:35:31 +02:00
* Role `postfix`: Add missing `localhost.localdomain localhost` to `mydestination` variable which caused undelivered of some local mails.
2022-05-12 15:49:18 +02:00
## [22.05.1] 2022-05-12
### Added
2023-11-21 11:35:42 +01:00
* docker: Introduce new default settings + allow to change the docker data directory
* docker: Introduce new variables to tweak daemon settings
2022-05-10 16:58:32 +02:00
### Changed
2023-11-21 11:35:42 +01:00
* evocheck: Upstream release 22.05
2022-05-12 15:47:37 +02:00
2022-05-10 16:58:32 +02:00
### Removed
2023-11-21 11:35:42 +01:00
* docker: Removed Debian Jessie support
2022-05-10 17:39:45 +02:00
2022-05-10 16:58:32 +02:00
## [22.05] 2022-05-10
### Added
* etc-git: use "ansible-commit" to efficiently commit all available repositories (including /etc inside LXC) from Ansible
* minifirewall: compatibility with "legacy" version of minifirewall
2022-05-10 16:58:32 +02:00
* minifirewall: configure proxy/backup/sysctl values
* munin: Add possibility to install local plugins, and install dhcp_pool plugin
2022-03-31 15:59:38 +02:00
* nagios-nrpe: Add a check dhcp_pool
* redis: Activate overcommit sysctl
* redis: Add log2mail user to redis group
2022-03-02 09:42:12 +01:00
### Changed
2022-05-10 16:58:32 +02:00
* dump-server-state: upstream release 22.04.3
2022-04-25 10:33:33 +02:00
* evocheck: upstream release 22.04.1
* evolinux-base: Add non-free repos & install non-free firmware on dedicated hardware
2022-03-28 13:28:48 +02:00
* evolinux-base: rename backup-server-state to dump-server-state
* generate-ldif: Add services check for bkctld
2022-03-28 13:28:48 +02:00
* minifirewall: restore "force-restart" and fix "restart-if-needed"
* minifirewall: tail template follows symlinks
2022-05-10 15:55:08 +02:00
* minifirewall: upstream release 22.05
2023-10-14 07:36:29 +02:00
* opendkim : add generate opendkim-genkey in sha256 and key 4096
2022-05-10 16:58:32 +02:00
* openvpn: use a local copy of files instead of cloning an external git repository
* openvpn: use a subnet topology instead of the net30 default topology
2022-04-08 11:57:33 +02:00
* tomcat: Tomcat 9 by default with Debian 11
* vrrpd: Store sysctl values in specific file
2022-03-02 09:42:12 +01:00
### Fixed
* etc-git : Remount /usr in rw for git gc in in /usr/share/scripts/
* etc-git: Make evocommit fully compatible with OpenBSD
2022-05-10 16:58:32 +02:00
* generate-ldif: Correct generated entries for php-fpm in containers
* keepalived: repair broken role
* minifirewall: fix `failed_when` condition on restart
2022-05-10 16:58:32 +02:00
* postfix: Do not send mails through milters a second time after amavis (in packmail)
* redis: Remount /usr with RW before adding nagios plugin
2022-03-02 09:42:12 +01:00
## [22.03] 2022-03-02
### Added
* apt: apt_hold_packages: broadcast message with wall, if present
* evolinux-base: option to bypass raid-related tasks
* Explicit permissions for systemd overrides
* generate-ldif: Add support for php-fpm in containers
2022-02-03 14:16:09 +01:00
* kvm-host: add missing default value
* lxc-php: preliminary support for PHP 8.1 container
* openvpn: now check that openvpn has been restarted since last certificates renewal
* redis: always install check_redis_instances
* redis: check_redis_instances tolerates absence of instances
### Changed
* elasticsearch: Use `/etc/elasticsearch/jvm.options.d/evolinux` instead of default `/etc/elasticsearch/jvm.options`
* evolinux-users: check permissions for /etc/sudoers.d
* evolinux-users: optimize sudo configuration
2022-02-17 16:25:20 +01:00
* lxc: Fail if /var is nosuid
* openvpn: make it compatible with OpenBSD and add some improvements
2022-01-31 11:57:21 +01:00
## [22.01.3] 2022-01-31
### Changed
2022-01-28 16:27:20 +01:00
* rbenv: install Ruby 3.1.0 by default
2022-01-28 16:27:39 +01:00
* evolinux-base: backup-server-state: add "force" mode
### Fixed
2022-01-28 16:27:39 +01:00
* evolinux-base: backup-server-state: fix systemctl invocation
* varnish: update munin plugin to work with recent varnish versions
2022-01-27 14:12:40 +01:00
## [22.01.2] 2022-01-27
2022-01-27 14:04:41 +01:00
### Changed
* evolinux-base: many improvements for backup-server-state script
* remount-usr: use findmnt to find if usr is a readonly partition
2022-01-25 14:53:19 +01:00
## [22.01] 2022-01-25
### Added
2021-09-30 10:45:07 +02:00
* Support for Debian 11 « Bullseye » (with possible remaining blind spots)
2022-01-25 14:53:19 +01:00
* apache: new variable for MPM mode (+ updated default config accordingly)
* apache: prevent accessing Git or "env" related files
* certbot: add script for manual deploy hooks execution
* docker-host: install additional dependencies
2022-01-25 14:53:19 +01:00
* dovecot: switch to TLS 1.2+ and external DH params
* etc-git: centralize cron jobs in dedicated crontab
2022-01-25 14:53:19 +01:00
* etc-git: manage commits with an optimized shell script instead of many slow Ansible tasks
* evolinux-base: add script backup-server-state
* evolinux-base: configure top and htop to display the swap column
* evolinux-base: install molly-guard by default
2022-01-25 14:53:19 +01:00
* generate-ldif: detect RAID controller
2021-09-16 17:26:58 +02:00
* generate-ldif: detect mdadm
2021-07-02 14:01:46 +02:00
* listupgrade: crontab is configurable
* logstash: logging to syslog is configurable (default: True)
* mongodb: create munin plugins directory if missing
2022-01-25 14:53:19 +01:00
* munin: systemd override to unprotect home directory
* mysql: add evomariabackup 21.11
2021-09-30 10:13:11 +02:00
* mysql: improve Bullseye compatibility
* mysql: script "mysql_connections" to display a compact list of connections
* mysql: script "mysql-queries-killer.sh" to kill MySQL queries
2022-01-25 14:53:19 +01:00
* nagios-nrpe + evolinux-users: new check for ipmi
* nagios-nrpe + evolinux-users: new check for RAID (soft + hard)
* nagios-nrpe + evolinux-users: new checks for bkctld
2022-01-25 14:53:19 +01:00
* nagios-nrpe: new check influxdb
* openvpn: new role (beta)
2021-05-01 22:25:38 +02:00
* redis: instance service for Debian 11
* squid: add *.o.lencr.org to default whitelist
2021-06-28 15:31:55 +02:00
### Changed
* Change version pattern
* Install python 2 or 3 libraries according to running python version
* Remove embedded GPG keys only if legacy keyring is present
* apt: remove workaround for Evolix public repositories with Debian 11
* apt: upgrade packages after all the configuration is done
* apt: use the new security repository for Bullseye
* certbot: silence letsencrypt deprecation warnings
2022-01-25 14:53:19 +01:00
* elasticsearch: elastic_stack_version = 7.x
* evoacme: exclude renewal-hooks directory from cron
* evoadmin-web: simpler PHP packages lists
2022-01-25 14:53:19 +01:00
* evocheck: upstream release 21.10.4
* evolinux-base: alert5 comes after the network
* evolinux-base: force Debian version to buster for Evolix repository (temporary)
* evolinux-base: install freeipmi by default on dedicated hw
* evolinux-base: logs are rotated with dateext by default
2022-01-25 14:53:19 +01:00
* evolinux-base: split dpkg logrotate configuration
* evolinux-users + nagios-nrpe: Add support for php-fpm80 in lxc
* evomaintenance: extract a config.yml tasks file
* evomaintenance: upstream release 22.01
* filebeat/metricbeat: elastic_stack_version = 7.x
* kibana: elastic_stack_version = 7.x
* listupgrade: old-kernel-removal version 21.10
2021-07-02 13:59:42 +02:00
* listupgrade: upstream release 21.06.3
2021-09-21 14:39:51 +02:00
* logstash: elastic_stack_version = 7.x
2022-01-25 14:53:19 +01:00
* mongodb: Allow to specify a mongodb version for buster & bullseye
* mongodb: Deny the install on Debian 11 « Bullseye » when the version is unsupported
* mongodb: Support version 5.0 (for buster)
* mysql: use python3 and mariadb-client-10.5 with Debian 11 and later
* nodejs: default to version 16 LTS
* php: enforce Debian version with assert instead of fail
2021-07-03 08:52:50 +02:00
* squid: improve default whitelist (more specific patterns)
* squid: must be started in foreground mode for systemd
* squid: remove obsolete variable on Squid 4
2021-06-28 15:31:55 +02:00
### Fixed
2022-01-25 14:53:19 +01:00
* evolinux-base: fix alert5.service dependency syntax
2021-06-30 07:39:57 +02:00
* certbot: sync_remote excludes itself
2022-01-25 14:53:19 +01:00
* lxc-php: fix config for opensmtpd on bullseye containers
* mysql : Create a default ~root/.my.cnf for compatibility reasons
* nginx : fix variable name and debug to actually use nginx-light
* packweb-apache : Support php 8.0
* nagios-nrpe: Fix check_nfsserver for buster and bullseye
2021-06-30 07:39:57 +02:00
2021-06-28 15:31:55 +02:00
### Removed
2022-01-25 14:53:19 +01:00
* evocheck: package install is not supported anymore
2021-09-21 14:41:48 +02:00
* logstash: no more dependency on Java
2022-01-25 14:53:19 +01:00
* php: remove php-gettext for 7.4
2021-05-01 22:14:33 +02:00
2021-06-28 15:31:55 +02:00
## [10.6.0] 2021-06-28
### Added
* Add Elastic GPG key to kibana, filebeat, logstash, metricbeat roles
* apache: new variable for mpm mode (+ updated default config accordingly)
* evolinux-base: add default motd template
2021-04-28 15:53:36 +02:00
* kvm-host: add migrate-vm script
* mysql: variable to disable myadd script overwrite (default: True)
* nodejs: update apt cache before installing the package
* squid: add Yarn apt repository in default whitelist
2021-04-01 15:38:10 +02:00
### Changed
* Update Galaxy metadata (company, platforms and galaxy_tags)
* Use 'loop' syntax instead of 'with_first_found/with_items/with_dict/with_nested/with_list'
2021-05-09 23:21:21 +02:00
* Use Ansible syntax used in Ansible 2.8+
* apt: store keys in /etc/apt/trusted.gpg.d in ascii format
* certbot: sync_remote.sh is configurable
2021-05-01 16:51:20 +02:00
* evolinux-base: copy GPG key instead of using apt-key
2021-06-17 10:57:07 +02:00
* evomaintenance: upstream release 0.6.4
* kvm-host: replace the "kvm-tools" package with scripts deployed by Ansible
2021-06-20 12:06:49 +02:00
* listupgrade: upstream release 21.06.2
2021-06-08 11:19:26 +02:00
* nodejs: change GPG key name
* ntpd: Add leapfile configuration setting to ntpd on debian 10+
* packweb-apache: install phpMyAdmin from buster-backports
* spamassassin: change dependency on evomaintenance
* squid: remove obsolete variable on Squid 4
2021-04-01 15:38:10 +02:00
### Fixed
* add default (useless) value for file lookup (first_found)
* fix pipefail option for shell invocations
* elasticsearch: inline YAML formatting of seed_hosts and initial_master_nodes
2021-05-19 17:02:10 +02:00
* evolinux-base: fix motd lookup path
* ldap: fix edge cases where passwords were not set/get properly
* listupgrade: fix wget error + shellcheck cleanup
2021-04-01 15:38:10 +02:00
### Removed
* elasticsearch: recent versiond don't depend on external JRE
2021-04-13 15:56:09 +02:00
## [10.5.1] 2021-04-13
### Added
* haproxy: dedicated internal address/binding (without SSL)
### Changed
* etc-git: commit in /usr/share/scripts when there's an active repository
2021-04-01 15:38:10 +02:00
## [10.5.0] 2021-04-01
### Added
* apache: new variables for logrotate + server-status
* filebeat: package can be upgraded to latest (default: False)
* haproxy: possible admin access with login/pass
2021-06-28 15:31:55 +02:00
* lxc-php: Add PHP 7.4 support
* metricbeat: package can be upgraded to latest (default: False)
* metricbeat: new variables to configure SSL mode
* nagios-nrpe: new script check_phpfpm_multi
* nginx: add access to server status on default VHost
* postfix: add smtpd_relay_restrictions in configuration
2020-12-24 14:00:37 +01:00
### Changed
* apache: rotate logs daily instead of weekly
* apache: deny requests to ^/evolinux_fpm_status-.*
* certbot: use a fixed 1.9.0 version of the certbot-auto script (renamed "letsencrypt-auto")
2021-04-01 15:38:10 +02:00
* certbot: use the legacy script on Debian 8 and 9
* elasticsearch: log rotation is more readable/maintainable
2021-01-07 19:16:06 +01:00
* evoacme: upstream release 21.01
* evolinux-users: Add sudo rights for nagios for multi-php lxc
* listupgrade: update script from upstream
* minifirewall: change some defaults
* nagios-nrpe: update check_phpfpm_status.pl & install perl dependencies
2021-02-18 16:42:54 +01:00
* redis: use /run instead or /var/run
* redis: escape password in Munin configuration
2020-12-24 14:00:37 +01:00
### Fixed
* bind9: added log files to apparmor definition so bind can run
2021-03-23 16:29:03 +01:00
* filebeat: fix Ansible syntax error
* nagios-nrpe: libfcgi-client-perl is not available before Debian 10
* redis: socket/pid directories have the correct permissions
2020-12-24 14:00:37 +01:00
### Removed
2021-04-01 15:38:10 +02:00
* nginx: no more "minimal" mode, but the package remains customizable.
2020-12-24 14:00:37 +01:00
## [10.4.0] 2020-12-24
### Added
2020-12-24 13:56:11 +01:00
* certbot: detect domains if missing
* certbot: new "sync_remote.sh" hook to sync certificates and execute hooks on remote servers
* varnish: variable for jail configuration
2020-12-21 16:03:49 +01:00
### Changed
* certbot: disable auth for Let's Encrypt challenge
* nginx: change from "nginx_status-XXX" to "server-status-XXX"
2020-12-21 16:03:49 +01:00
## [10.3.0] 2020-12-21
### Added
* bookworm-detect: transitional role to help dealing with unreleased bookworm version
* dovecot: Update munin plugin & configure it
* dovecot: vmail uid/gid are configurable
* evoacme: variable to disable Debian version check (default: False)
* kvm-host: Add drbd role dependency (toggleable with kvm_install_drbd)
2020-12-01 22:57:13 +01:00
* minifirewall: upstream release 20.12
* minifirewall: add variables to force upgrade the script and the config (default: False)
* mysql: install save_mysql_processlist script
2020-10-02 16:51:05 +02:00
* nextcloud: New role to setup a nextcloud instance
* redis: variable to force use of port 6379 in instances mode
* redis: check maxmemory in NRPE check
2020-10-20 17:27:34 +02:00
* lxc-php: Allow php containers to contact local MySQL with localhost
* varnish: config file name is configurable
2020-10-02 16:51:05 +02:00
2020-09-17 14:06:46 +02:00
### Changed
* Create system users for vmail (dovecot) and evoadmin
* apt: disable APT Periodic
2020-12-01 22:27:05 +01:00
* evoacme: upstream release 20.12
2020-12-08 11:07:42 +01:00
* evocheck: upstream release 20.12
* evolinux-users: improve uid/login checks
* tomcat-instance: fail if uid already exists
* varnish: change template name for better readability
* varnish: no threadpool delay by default
2021-06-28 15:31:55 +02:00
* varnish: no custom reload script for Debian 10 and later
2020-09-17 14:06:46 +02:00
### Fixed
* cerbot: parse HAProxy config file only if HAProxy is found
2020-09-17 14:06:46 +02:00
## [10.2.0] 2020-09-17
### Added
2020-09-14 11:31:47 +02:00
* evoacme: remount /usr if necessary
* evolinux-base: swappiness is customizable
2020-09-10 14:59:19 +02:00
* evolinux-base: install wget
* tomcat: root directory owner/group are configurable
2020-08-21 14:50:17 +02:00
### Changed
* Change default public SSH/SFTP port from 2222 to 22222
2020-08-21 14:50:17 +02:00
### Fixed
* certbot: an empty change shouldn't raise an exception
2020-09-08 10:02:15 +02:00
* certbot: fix "no-self-upgrade" option
2020-08-21 14:50:17 +02:00
### Removed
2020-09-11 11:08:42 +02:00
* evoacme: remove Debian 9 support
2020-08-21 14:50:17 +02:00
## [10.1.0] 2020-08-21
### Added
2020-06-14 12:30:34 +02:00
* certbot: detect HAProxy cert directory
2020-08-18 14:00:46 +02:00
* filebeat: allow using a template
2020-08-21 14:03:41 +02:00
* generate-ldif: add NVMe disk support
* haproxy: add deny_ips file to reject connections
* haproxy: add some comments to default config
* haproxy: enable stats frontend with access lists
* haproxy: preconfigure SSL with defaults
* lxc-php: Don't disable putenv() by default in PHP settings
2020-08-21 14:03:41 +02:00
* lxc-php: Install php-sqlite by default
2020-08-18 14:01:09 +02:00
* metricbeat: allow using a template
* mysql: activate binary logs by specifying log_bin path
* mysql: option to define as read only
2020-08-21 14:03:41 +02:00
* mysql: specify a custom server_id
* nagios-nrpe/evolinux-base: brand new check for hardware raid on HP servers gen 10
2020-06-14 12:32:14 +02:00
* nginx: make default vhost configurable
* packweb-apache: Install zip & unzip by default
* php: Don't disable putenv() by default in PHP settings
2020-08-21 14:03:41 +02:00
* php: Install php-sqlite by default
2020-05-13 11:20:45 +02:00
### Changed
* certbot: fix haproxy hook (ssl cert directory detection)
2020-07-17 13:48:18 +02:00
* certbot: install certbot dependencies non-interactively for jessie
* elasticsearch: configure cluster with seed hosts and initial masters
2020-08-21 14:03:41 +02:00
* elasticsearch: set tmpdir before datadir
2020-07-17 13:48:18 +02:00
* evoacme: read values from environment before defaults file
* evoacme: update for new certbot role
2020-08-21 14:03:41 +02:00
* evoacme: upstream release 20.08
* haproxy: adapt backports installed package list to distibution
2020-08-21 14:03:41 +02:00
* haproxy: chroot and socket path are configurable
* haproxy: deport SSL tuning to Mozilla SSL generator
* haproxy: rotate logs with date extension and immediate compression
2020-08-21 14:03:41 +02:00
* haproxy: split stats variables
2020-07-17 13:48:18 +02:00
* lxc-php: Do --no-install-recommends for ssmtp/opensmtpd
* mongodb: install custom munin plugins
* nginx: read server-status values before changing the config
2020-07-17 13:48:18 +02:00
* packweb-apache: Don't turn on mod-evasive emails by default
2020-06-02 10:54:48 +02:00
* redis: create sudoers file if missing
2020-06-02 10:55:35 +02:00
* redis: new syntax for match filter
* redis: raise an error is port 6379 is used in "instance" mode
2020-05-13 11:20:45 +02:00
### Fixed
2020-08-21 14:03:41 +02:00
* certbot: restore compatibility with old Nginx
* evobackup-client: fixed the ssh connection test
* generate-ldif: better detection of computerOS field
* generate-ldif: skip some odd ethernet devices
2020-06-05 10:57:49 +02:00
* lxc-php: Install opensmtpd as intended
* mongodb: fix logrotate patterm on Debian buster
2020-08-21 14:03:41 +02:00
* nagios-nrpe: check_amavis: updated regex
* squid: better regex to match sa-update domains
* varnish: fix start command when multiple addresses are present
2020-05-13 11:20:45 +02:00
## [10.0.0] - 2020-05-13
2019-06-21 10:46:08 +02:00
### Added
2023-10-14 07:36:29 +02:00
* apache: the default VHost doesn't redirect to https for ".well-known" paths
* apt: added buster backports prerferences
* apt: check if cron is installed before adding a cron job
* apt: remove jessie/buster sources from Gandi servers
* apt: verify that /etc/evolinux is present
2019-09-27 00:13:30 +02:00
* certbot : new role to install and configure certbot
* etc-git: add versioning for /usr/share/scripts on Debian 10+
2019-11-05 14:08:02 +01:00
* evoacme: upstream version 19.11
* evolinux-base: default value for "evolinux_ssh_group"
2019-10-30 13:53:47 +01:00
* evolinux-base: install /sbin/deny
* evolinux-base: install Evocheck (default: `True`)
2019-10-30 13:53:47 +01:00
* evolinux-base: on debian 10 and later, add noexec on /dev/shm
* evolinux-base: on debian 10 and later, add /usr/share/scripts in root's PATH
* evolinux-base: remove the chrony package
* evomaintenance: don't configure firewall for database if not necessary
2019-09-02 10:39:25 +02:00
* generate-ldif: support MariaDB 10.3
* haproxy: add a variable to keep the existing configuration
* java: add Java 11 as possible version to install
* listupgrade: install old-kernel-autoremoval script
* minifirewall: add a variable to force the check scripts update
* mongodb: mongodb: compatibility with Debian 10
2019-10-24 15:37:50 +02:00
* mysql-oracle: backport tasks from mysql role
* networkd-to-ifconfig: add variables for configuration by variables
2019-09-23 13:47:19 +02:00
* packweb-apache: Deploy opcache.php to give some insights on PHP's opcache status
* php: variable to install the mysqlnd module instead of the default mysql module
2020-03-02 20:53:54 +01:00
* postgresql : variable to install PostGIS (default: `False`)
2019-09-06 16:04:47 +02:00
* redis: rewrite of the role (separate instances, better systemd units…)
2019-09-23 13:47:19 +02:00
* webapps/evoadmin-web Add an htpasswd to evoadmin if you cant use an apache IP whitelist
2019-10-24 15:37:50 +02:00
* webapps/evoadmin-web Overload templates if needed
* evolinux-base: install ssacli for HP Smart Array
2019-08-30 20:43:52 +02:00
* evobackup-client role to configure a machine for backups with bkctld(8)
* bind: enable query logging for recursive resolvers
* bind: enable logrotate for recursive resolvers
* bind: enable bind9 munin plugin for recursive resolvers
2019-06-21 10:46:08 +02:00
### Changed
2023-10-14 07:36:29 +02:00
* replace version_compare() with version()s
2020-01-03 16:40:53 +01:00
* removed some deprecations for Ansible 2.7
* apache: improve permissions in save_apache_status script
* apt: hold packages only if package is installed
* bind: the munin task was present, but not included
* bind: change name of logrotate file to bind9
* certbot: commit hook must be executed at the end
* elasticsearch: listen on local interface only by default
2020-04-28 16:00:45 +02:00
* evocheck: upstream version 20.04.4
2019-09-23 09:22:40 +02:00
* evocheck: cron jobs execute in verbose
* evolinux-base: use "evolinux_internal_group" for SSH authentication
* evolinux-base: Don't customize the logcheck recipient by default.
* evolinux-base: configure cciss-vol-statusd in the proper file
2020-03-02 22:12:58 +01:00
* evomaintenance: upstream release 0.6.3
2019-09-23 13:47:19 +02:00
* evomaintenance: Turn on API by default (instead of DB)
* evomaintenance: install PG dependencies only when needed
2020-02-27 13:41:04 +01:00
* listupgrade: update from upstream
2019-10-24 15:37:50 +02:00
* lxc: rely on lxc_container module instead of command module
* lxc: remove useless loop in apt execution
* lxc: update our default template to be compatible with Debian 10
2020-03-02 20:53:54 +01:00
* lxc-php: refactor tasks for better maintainability
* lxc-php: Use OpenSMTPD for Stretch/Buster containers, and ssmtp for Jessie containers
2020-03-02 20:53:54 +01:00
* lxc-solr: changed default Solr version to 8.4.1
2020-02-10 10:36:00 +01:00
* minifirewall: better alert5 activation
* minifirewall: no http filtering by default
* minifirewall: /bin/true command doesn't report "changed" anymore
* nagios-nrpe: update check_redis_instances (same as redis role)
* nagios-nrpe: change default haproxy socket path
* nagios-nrpe: check_mode per cpu dynamically
* nodejs: change default version to 12 (new LTS)
* packweb-apache: Do the install & conffigure phpContainer script (instead of evoadmin-web role)
* php: By default, allow 128M for OpCache (instead of 64M)
* php: Don't set a chroot for the default fpm pool
* php: Make sure the default pool we define can be fully functionnal witout debian's default pool file
* php: Change the default pool names to something more explicit (and same for the variables names)
* php: Add a task to remove Debian's default FPM pool file (off by default)
* php: Cleanup CLI Settings. Also, allow url fopen and don't disable functions (in CLI only)
2020-03-02 20:53:54 +01:00
* postgresql : changed logrotate config to 10 days (and fixed permissions)
* rbenv: changed default Ruby version to 2.7.0
* squid: Remove wait time when we turn off squid
2019-10-24 16:23:48 +02:00
* squid: compatibility wit Debian 10
* tomcat: package version derived from Debian version if missing
* varnish: remove custom ExecReload= script for Debian 10+
2019-06-21 10:46:08 +02:00
### Fixed
2023-10-14 07:36:29 +02:00
2020-01-08 17:19:36 +01:00
* etc-git: fix warnings ansible-lint
2019-10-24 15:37:50 +02:00
* evoadmin-web: Put the php config at the right place for Buster
* lxc: Don't stop the container if it already exists
* lxc: Fix container existance check to be able to run in check_mode
* lxc-php: Don't remove the default pool
* minifirewall: fix warnings ansible-lint
2019-09-23 13:47:19 +02:00
* nginx: fix munin fcgi not working (missing chmod 660 on logs)
2019-10-24 15:37:50 +02:00
* php: add missing handler for php7.3-fpm
* roundcube: fix typo for roundcube vhost
* tomcat: fix typo for default tomcat_version
* evolinux-base: Fix our zsyslog rotate config that doesn't work on Debian 10
* certbot: Properly evaluate when apache is installed
* evolinux-base: Don't make alert5.service executable as systemd will complain
* webapps/evoadmin-web: Set default evoadmin_mail_tpl_force to True to fix a regression where the mail template would not get updated because the file is created before the role is first run.
* minifirewall: Backport changes from minifirewall (properly open outgoing smtp(s))
* minifirewall: Properly detect alert5.sh to turn on firewall at boot
* packweb-apache: Add missing dependency to evoacme role
* php: Chose the debian version repo archive for packages.sury.org
* php: update surry_post.yml to match current latest PHP release
* packweb-apache: Don't try to install PHPMyAdmin on Buster as it's not available
2019-06-21 10:46:08 +02:00
2020-03-02 20:53:54 +01:00
### Removed
2023-10-14 07:36:29 +02:00
2020-03-02 20:53:54 +01:00
* clamav : do not install the zoo package anymore
2019-06-21 14:36:20 +02:00
## [9.10.1] - 2019-06-21
### Changed
2023-10-14 07:36:29 +02:00
2019-06-21 14:36:20 +02:00
* evocheck : update (version 19.06) from upstream
2019-06-21 10:46:08 +02:00
## [9.10.0] - 2019-06-21
2019-04-16 16:41:28 +02:00
### Added
2023-10-14 07:36:29 +02:00
* apache: add server status suffix in VHost (and default site) if missing
* apache: add a variable to customize the server-status host
* apt: add a script to manage packages with "hold" mark
* etc-git: gitignore /etc/letsencrypt/.certbot.lock
2019-06-21 09:42:02 +02:00
* evolinux-base: install "spectre-meltdown-checker" (Debian 10 and later)
* evomaintenance: make hooks configurable
* nginx: add server status suffix in VHost (and default site) if missing
* redmine: enable gzip compression in nginx vhost
2019-04-16 16:41:28 +02:00
### Changed
2023-10-14 07:36:29 +02:00
2019-06-21 09:42:02 +02:00
* evocheck : update (unreleased) from upstream
2019-04-26 11:09:36 +02:00
* evomaintenance : use the web API instead of PG Insert
2019-06-21 10:29:18 +02:00
* fluentd: store gpg key locally
2019-06-21 10:43:20 +02:00
* rbenv: update defaults rbenv version to 1.1.2 and ruby version to 2.6.3
* redmine: update default version to 4.0.3
* nagios-nrpe: change required status code for http and https check
* redmine: use custom errors-pages in Nginx vhost
* nagios-nrpe: check_load is now based on ansible_processor_vcpus
* php: Stop enforcing /var/www/html as chroot while we use /var/www
2019-06-17 14:24:09 +02:00
* apt: Add Debian Buster repositories
2019-04-16 16:41:28 +02:00
### Fixed
2023-10-14 07:36:29 +02:00
* rbenv: add check_mode for check rbenv and ruby versions
* nagios-nrpe: fix redis_instances check when Redis port equal 0
2019-05-29 11:49:10 +02:00
* redmine: fix 500 error on logging
* evolinux-base: Validate sshd config with "-t" instead of "-T"
* evolinux-base: Ensure rename is present
* evolinux-users: Validate sshd config with "-t" instead of "-T"
2023-10-14 07:36:29 +02:00
* nagios-nrpe: Replace the dummy packages nagios-plugins-*with monitoring-plugins-*
2019-04-16 16:41:28 +02:00
## [9.9.0] - 2019-04-16
2019-01-31 10:22:50 +01:00
### Added
2023-10-14 07:36:29 +02:00
* etc-git: ignore evobackup/.keep-* files
2019-04-16 16:36:27 +02:00
* lxc: /home is mounted in the container by default
2019-04-25 13:34:28 +02:00
* nginx : add "x-frame-options: sameorigin" for Munin
2019-01-31 10:22:50 +01:00
### Changed
2023-10-14 07:36:29 +02:00
* changed remote repository to <https://gitea.evolix.org/evolix/ansible-roles>
2019-04-16 16:27:10 +02:00
* apt: Ensure jessie-backport from archives.debian.org is accepted
* apt: Remove jessie-update suite as it's no longer exists
* apt: Replace mirror.evolix.org by archives.debian.org for jessie-backport
2019-04-16 10:46:44 +02:00
* evocheck : update script from upstream
* evolinux-base: remove apt-listchanges on Stretch and later
2019-04-16 16:27:10 +02:00
* evomaintenance: embed version 0.5.0
* opendkim: aligning roles with our conventions, major changes in opendkim-add.sh
2019-03-08 13:43:59 +01:00
* redis: higher limit of open files
2019-04-16 16:27:10 +02:00
* redis: set variables on inclusion, not with set_facts
* tomcat: better tomcat version management
* webapps/evoadmin-web: add dbadmin.sh to sudoers file
2019-01-31 10:22:50 +01:00
### Fixed
2023-10-14 07:36:29 +02:00
* spamassasin: fix sa-update.sh and ensure service is started and enabled
* tomcat-instance: deploy correct version of config files
2019-04-16 16:27:10 +02:00
* tomcat-instance: deploy correct version of server.xml
2019-01-31 10:22:50 +01:00
## [9.8.0] - 2019-01-31
2019-01-17 18:11:46 +01:00
### Added
2023-10-14 07:36:29 +02:00
* filebeat: disable cloud_metadata processor by default
* metricbeat: disable cloud_metadata processor by default
* percona : new role to install Percona repositories and tools
* redis: add variable for configure unixsocketperm
2019-01-17 18:11:46 +01:00
### Changed
2023-10-14 07:36:29 +02:00
* redmine: refactoring of redmine role with use of rbenv
2019-01-17 18:11:46 +01:00
### Fixed
2023-10-14 07:36:29 +02:00
* ntpd: Update the restrictions to follow wiki.evolix.org/HowtoNTP client config
2019-01-17 18:11:46 +01:00
## [9.7.0] - 2019-01-17
2018-12-04 14:51:17 +01:00
### Added
2023-10-14 07:36:29 +02:00
* apache: add Munin configuration for Apache server-status URL
* evomaintenance: database variables must be set or the task fails
2019-01-17 17:42:18 +01:00
* fail2ban: add "ips" tag added to fail2ban/tasks/ip_whitelist.yml
* metricbeat: add a variable for the protocol to use with Elasticsearch
* rbenv: add pkg-config to the list of packages to install
* redis: Configure munin when working in instance mode
* redis: add a variable for renamed/disabled commands
* redis: add a variable to disable the restart handler
* redis: add a variable to force a restart (even with no change)
2019-01-24 11:47:03 +01:00
* proftpd: add FTPS and SFTP support
2018-12-04 14:51:17 +01:00
### Changed
2023-10-14 07:36:29 +02:00
* redis: distinction between main and master password
* evocheck: update evocheck.sh for source install
* php: added php-zip in the installed package list for debian 9 (and later)
* squid: added packagist.org in the whitelist
* java: update Oracle java package to 8u192
2018-12-04 14:51:17 +01:00
### Fixed
2023-10-14 07:36:29 +02:00
2019-01-09 16:44:16 +01:00
* fail2ban: fix "ignoreip" update
* metricbeat: fix username/password replacement
* nagios-nrpe: check_process now return the error code (making the check more usefull than /bin/true)
* nginx: Munin url config is now a template to insert the server-status prefix
* nodejs: Update yarn repo GPG key (current key expired)
* redis: In instance mode, ensure to replace the nrpe check_redis with the instance check script
* redis: Don't set the owner of /var/{lib,log}/redis to a redis instance account
2018-12-04 14:51:17 +01:00
## [9.6.0] - 2018-12-04
2018-11-14 17:15:25 +01:00
### Added
2023-10-14 07:36:29 +02:00
* evolinux-base: deploy custom motd if template are present
* minifirewall: all variables are configurable (untouched by default)
2018-12-04 14:25:39 +01:00
* minifirewall: main file is configurable
* squid: minifirewall main file is configurable
2018-11-14 17:15:25 +01:00
### Changed
2023-10-14 07:36:29 +02:00
* minifirewall: compare config before/after (for restart condition)
* squid: better replacement in minifirewall config
* evoadmin-mail: complete refactoring, use Debian Package
2018-11-14 17:15:25 +01:00
## [9.5.0] - 2018-11-14
2018-10-12 10:16:40 +02:00
### Added
2023-10-14 07:36:29 +02:00
2018-11-14 16:11:42 +01:00
* apache: separate task to update IP whitelist
* evolinux-base: install man package
2018-11-14 17:04:51 +01:00
* evolinux-users: add newaliases handler
2018-11-14 16:11:42 +01:00
* evomaintenance: FROM domain is configurable
* fail2ban: separate task to update IP whitelist
* nginx: add tag for ips management
* nginx: separate task to update IP whitelist
* postfix: enable SSL/TLS client
* ssl: add an SSL role for certificates deployment
* haproxy: add vars for tls configuration
2018-11-14 16:13:02 +01:00
* mysql: logdir can be customized
2018-10-12 10:16:40 +02:00
### Changed
2023-10-14 07:36:29 +02:00
2018-11-14 16:11:42 +01:00
* evocheck: update script from upstream
* evomaintenance: update script from upstream
* mysql: restart service if systemd unit has been patched
2018-10-12 10:16:40 +02:00
### Fixed
2023-10-14 07:36:29 +02:00
* packweb-apache: mod-security config is already included elsewhere
2018-11-14 15:35:11 +01:00
* redis: for permissions on log and lib directories
* redis: fix shell for instance users
* evoacme: fix error handling in sed_cert_path_for_(apache|nginx)
2018-10-12 10:16:40 +02:00
## [9.4.2] - 2018-10-12
2018-09-20 12:30:52 +02:00
### Added
2023-10-14 07:36:29 +02:00
2018-10-08 09:43:09 +02:00
* evomaintenance: install dependencies manually when installing vendored version
* nagios-nrpe: add an option to ignore servers in NOLB status
2018-09-20 12:30:52 +02:00
### Changed
2023-10-14 07:36:29 +02:00
2018-10-08 09:43:09 +02:00
* haproxy: move check_haproxy_stats to nagios-nrpe role
2018-09-20 12:30:52 +02:00
### Fixed
2023-10-14 07:36:29 +02:00
2018-10-08 09:43:09 +02:00
* evoacme: better error when apache2ctl fails
* evomaintenance: fix role compatibility with OpenBSD
* spamassassin: add missing right for amavis
2018-10-11 17:17:50 +02:00
* amavis: fix output result checking
2018-09-20 12:30:52 +02:00
2018-09-28 10:42:25 +02:00
## [9.4.1] - 2018-09-28
### Added
2023-10-14 07:36:29 +02:00
2018-09-28 10:42:25 +02:00
* redis: set masterauth when redis_password is defined
* evomaintenance: variable to install a vendored version
* evomaintenance: tasks/variables to handle minifirewall restarts
### Changed
2023-10-14 07:36:29 +02:00
2018-09-28 10:42:25 +02:00
* mysql-oracle: better handle packages and users
2018-09-20 12:30:52 +02:00
## [9.4.0] - 2018-09-20
2018-09-06 15:14:34 +02:00
### Added
2023-10-14 07:36:29 +02:00
2018-09-08 00:27:03 +02:00
* etc-git: manage a cron job to monitor uncommited changes in /etc/.git (default: `True`)
2018-09-11 14:20:13 +02:00
* evolinux-base: better shell history
* evolinux-users: add user to /etc/aliases
* generate-ldif: add a section for postgresql
* logstash: tmp directory can be customized
* logstash: max memory is set to 512M by default
* logstash: version 6.x is installed by default
* mysql: add a variable to prevent mysql from restarting
* networkd-to-ifconfig: add a role to switch from networkd to ifconfig
* webapps/evoadmin-web: add users to /etc/aliases
2018-09-19 17:24:26 +02:00
* redis: add support for multi instances
2018-09-20 10:21:49 +02:00
* nagios-nrpe: add check_redis_instances
2018-09-06 15:14:34 +02:00
### Changed
2023-10-14 07:36:29 +02:00
2018-09-11 11:13:02 +02:00
* dovecot: stronger TLS configuration
2018-09-06 15:14:34 +02:00
### Fixed
2023-10-14 07:36:29 +02:00
* apache: cleaner way to overwrite the server status suffix
* packweb-apache: don't regenerate phpMyAdmin suffix each time
* nginx: cleaner way to overwrite the server status suffix
2018-09-19 16:25:47 +02:00
* redis: add missing tags
2018-09-06 15:14:34 +02:00
## [9.3.2] - 2018-09-06
2018-08-24 18:24:14 +02:00
### Added
2023-10-14 07:36:29 +02:00
* minifirewall: add a variable to disable the restart handler
* minifirewall: add a variable to force a restart of the firewall (even with no change)
2018-08-31 19:28:06 +02:00
* minifirewall: improve variables values and documentation
2018-08-24 18:24:14 +02:00
### Changed
2023-10-14 07:36:29 +02:00
* dovecot: enable SSL/TLS by default with snakeoil certificate
2018-08-24 18:24:14 +02:00
### Fixed
### Security
2018-08-30 14:06:06 +02:00
## [9.3.1] - 2018-08-30
### Added
2023-10-14 07:36:29 +02:00
2018-08-30 14:06:06 +02:00
* metricbeat: new variables to configure elasticsearch hosts and auth
2018-08-24 18:24:14 +02:00
## [9.3.0] - 2018-08-24
2018-04-06 10:49:23 +02:00
### Added
2023-10-14 07:36:29 +02:00
* elasticsearch: tmpdir configuration compatible with 5.x also
* elasticsearch: add http.publish_host variable
* evoacme: disable old certbot cron also in cron.daily
* evocheck: detect installed packages even if "held" by APT (manual fix)
* evocheck: the crontab is updated by the role (default: `True`)
2018-07-10 16:27:04 +02:00
* evolinux-base: add mail related aliases
2018-08-24 14:29:30 +02:00
* evolinux-todo: new role, to help maintain a file of todo tasks
* fail2ban: add a variable to disable the ssh filter (default: `False`)
* etc-git: install a script to optimize the repository each month
* fail2ban: add a variable to update the list of ignored IP addresses/blocs (default: `False`)
* generate-ldif: detect installed packages even if "held" by APT
2018-07-10 16:27:04 +02:00
* java: support for Oracle JRE
* kibana: log messages go to /var/log/kibana/kibana.log
2018-07-10 16:27:04 +02:00
* metricbeat: add a role (copied from filebeat)
* munin: properly rename Munin cache directory
* mysql: add an option to install the client development libraries (default: `False`)
* mysql: add a few variables to customize the configuration
2018-06-14 13:49:35 +02:00
* nagios-nrpe: add check_postgrey
2018-04-06 10:49:23 +02:00
2018-05-16 11:10:31 +02:00
### Changed
2023-10-14 07:36:29 +02:00
* etc-git: some entries of .gitignore are mandatory
2018-08-17 10:04:07 +02:00
* evocheck: update upstream script
* evolinux-base: improve hostname configuration (real vs. internal)
2018-08-24 14:29:30 +02:00
* evolinux-base: use the "evolinux-todo" role
2018-06-07 10:39:29 +02:00
* evolinux-users: add sudo permission for bkctld check
2018-07-10 16:27:04 +02:00
* java8: renamed to java (java8 symlinked to java for backward compatibility)
* minifirewall: the tail file can be overwritten, or not (default: `True`)
2018-06-07 10:39:29 +02:00
* nagios-nrpe: use bkctld internal check instead of nrpe plugin
* php: reorganization of the role for Sury overrides and more clear configuration
2018-07-10 16:27:04 +02:00
* redmine: use .my.cnf for mysql password
2018-06-07 10:39:29 +02:00
* rbenv: change default Ruby version (2.5.1)
* rbenv: switch from copy to lineinfile for default gems
* remount-usr: mount doesn't report a change
2018-06-07 10:39:29 +02:00
* squid: add a few news sites to the whitelist
2018-07-03 12:24:11 +02:00
* tomcat: better nrpe check output
* kvm-host: install kvm-tools package instead of copying add-vm.sh
2018-05-16 11:10:31 +02:00
### Fixed
2023-10-14 07:36:29 +02:00
* apache: logrotate replacement is more subtle/precise. It replaces only the proper directive and not every occurence of the word.
* bind: chroot-bind.sh must not be executed in check mode
2018-07-10 16:27:04 +02:00
* evoacme: fix module detection in apache config
* fail2ban: fix fail2ban_ignore_ips definition
* mysql-oracle: fix configuration directory variable
2018-06-19 16:51:27 +02:00
* php: fpm slowlog needs an absolute path
* roundcube: add missing slash to https redirection
2018-05-16 11:10:31 +02:00
## [9.2.0] - 2018-05-16
2018-04-24 16:45:05 +02:00
### Changed
2023-10-14 07:36:29 +02:00
* filebeat: install version 6.x by default
2018-05-09 20:57:32 +02:00
* filebeat: cleanup unused code
* squid: add some domaine and fix broken restrictions
2018-05-16 11:08:18 +02:00
* elasticsearch: defaults to version 6.x
2018-04-24 16:45:05 +02:00
### Fixed
2023-10-14 07:36:29 +02:00
* evolinux-users: secondary groups are comma-separated
2018-05-16 11:06:06 +02:00
* ntpd: fix configuration (server and ACL)
2018-05-16 11:07:12 +02:00
* varnish: don't fork the process on startup with systemd
2018-04-24 16:45:05 +02:00
## [9.1.9] - 2018-04-24
### Added
2018-04-16 00:00:13 +02:00
### Changed
2023-10-14 07:36:29 +02:00
2018-04-22 17:44:37 +02:00
* apache: customize logrotate (52 weeks)
* evolinux: groups for SSH configuration are used with Debian 10 and later
* evolinux-base: fail2ban is not enabled by default
2018-04-18 12:01:03 +02:00
* evolinux-users: refactoring of the SSH configuration
* mysql-oracle: copy evolinux config files in mysql.cond.d
* mysql/mysql-oracle: mysqltuner cron scripts is 0755
* generate-ldif: add a minifirewall service when /etc/default/minifirewall exists
2018-04-16 00:00:13 +02:00
## [9.1.8] - 2018-04-16
2018-04-06 10:49:23 +02:00
### Changed
2023-10-14 07:36:29 +02:00
2018-04-13 12:05:48 +02:00
* packweb-apache: use dependencies instead of include_role for apache and php roles
2018-04-06 10:49:23 +02:00
### Fixed
2023-10-14 07:36:29 +02:00
* mysql: use check_mode for apg command (Fix --check)
2018-04-15 23:58:31 +02:00
* mysql/mysql-oracle: properly reload systemd
* packweb-apache: use check_mode for apg command (Fix --check)
2018-04-06 10:49:23 +02:00
## [9.1.7] - 2018-04-06
2018-02-04 11:49:14 +01:00
### Added
2023-10-14 07:36:29 +02:00
2018-04-06 09:26:51 +02:00
* added a few become attributes where missing
* etc-git: add tags for Ansible
* evolinux-base: install ncurses-term package
* haproxy: install Munin plugins
2018-04-06 10:42:32 +02:00
* listupgrade: add service restart notification for Squid and libstdc++6
2018-04-06 09:45:10 +02:00
* minifirewall: add "check_minifirewall" Nagios plugin (and `minifirewall_status` script)
* mysql-oracle: new role to install MySQL 5.7 with Oracle packages
* mysql: remount /usr before creating scripts directory
2018-04-06 09:26:51 +02:00
* nagios-nrpe: add "check_open_files" plugin
* nagios-nrpe: mark plugins as executable
* nodejs: Yarn package manager can be installed (default: `false`)
* packweb-apache: choose mysql variant (default: `debian`)
2018-04-06 09:26:51 +02:00
* postfix: add lines in /etc/.gitignore
* proftpd: use "proftpd_accounts" list to manage ftp accounts
2018-04-04 23:46:50 +02:00
* redmine: added missing tags
2018-02-04 11:49:14 +01:00
### Changed
2023-10-14 07:36:29 +02:00
* elasticsearch: RESTART_ON_UPGRADE is configurable (default: `true`)
2018-04-06 09:26:51 +02:00
* elasticsearch: use ES_TMPDIR variable for custom tmpdir, (from `/etc/default/elasticsearch` instead of changing `/etc/elesticsearch/jvm.options`).
* evolinux-base: Exec the firewall tasks sooner (to avoid dependency issues)
* evolinux-users: split AllowGroups/AllowUsers modes for SSH directives
* mongodb: allow unauthenticated packages for Jessie
2018-04-06 09:26:51 +02:00
* mongodb: configuration is forced by default but it's configurable (default: `false`)
2018-04-05 18:43:29 +02:00
* mongodb: rename logrotate script
2018-04-06 09:26:51 +02:00
* nagios-nrpe: mark plugins as executable
* nginx: don't debug variables in verbosity 0
* nginx: package name can be specified (default: `nginx-full`)
2018-03-26 21:53:32 +02:00
* php: fix FPM custom file permissions
* php: more tasks notify FPM handler to restart if needed
2018-04-06 09:26:51 +02:00
* webapps/evoadmin-web: Fail if variable evoadmin_contact_email isn't defined
### Fixed
2023-10-14 07:36:29 +02:00
2018-03-13 10:25:45 +01:00
* dovecot: fix support of plus sign
* mysql/mysql-oracle: mysqltuner cron task is executable
2018-04-06 09:26:51 +02:00
* nginx: fix basic auth for default vhost
* rbenv: fix become user issue with copy tasks
2018-02-02 20:10:20 +01:00
## [9.1.6] - 2018-02-02
2018-01-20 19:57:58 +01:00
### Added
2023-10-14 07:36:29 +02:00
2018-01-20 19:57:58 +01:00
* mongodb: install python-pymongo for monitoring
* nagios-nrpe: allowed_hosts can be updated
2018-01-20 19:57:58 +01:00
### Changed
2023-10-14 07:36:29 +02:00
* Changelog: explain the versioning scheme
* Changelog: add a release date for 9.1.5
* evoacme: exclude typical certbot directories
### Fixed
2023-10-14 07:36:29 +02:00
* fail2ban: fix horrible typo, Python is not Ruby
2018-02-01 12:27:18 +01:00
* nginx: fix servers status dirname
## [9.1.5] - 2018-01-18
2018-01-18 18:40:49 +01:00
### Added
2023-10-14 07:36:29 +02:00
2018-02-28 17:41:54 +01:00
* There is a changelog!
* redis: configuration variable for protected mode (v3.2+)
2018-01-18 18:40:49 +01:00
* evolinux-users: users are in "adm" group for Debian 9 or later
* evolinx-base: purge locate/mlocate packages
* evolinx-base: create /etc/evolinux if missing
* many Ansible tags for easier fine grained execution of playbooks
* apache/nginx: server status suffix management
* unbound: retrieve list of root DNS servers
* redmine: ability to install themes and plugins
2018-01-18 18:40:49 +01:00
### Changed
2023-10-14 07:36:29 +02:00
* rbenv: Ruby 2.5 becomes the default version
2018-01-18 18:40:49 +01:00
* evocheck: update upstream version embedded in role (c993244)
* bind: keep 52 weeks of logs
### Fixed
2023-10-14 07:36:29 +02:00
2018-01-18 18:40:49 +01:00
* squid: different logrotate file for Jessie or Stretch+
* evoacme: don't invoke evoacme if no vhost is found
* evomaintenance: explicit quotes in config file
* redmine: force xpath gem < 3.0.0
### Security
2023-10-14 07:36:29 +02:00
2018-01-18 18:40:49 +01:00
* evomaintenance: fix permissions for config file
## [9.1.4] - 2017-12-20
### Added
2023-10-14 07:36:29 +02:00
* php: install php5-intl (for Jessie) and php-intl (for Debian 9 or later)
* mysql: add a check_mysql_slave in nrpe configuration
* ldap: slapd tcp port is configurable
* elasticsearch: broader patterns for log rotation
### Changed
2023-10-14 07:36:29 +02:00
* split IP lists in 2 – default and additional – for easier customization.
### Fixed
2023-10-14 07:36:29 +02:00
2018-01-20 19:54:41 +01:00
* minifirewall: allow outgoing SSH connections over IPv6
* nodejs: rename source.list file
### Security
2023-10-14 07:36:29 +02:00
* evoadmin-web: change config.local.php file permissions
* evolinux-base: change default_www file permissions
## [9.1.3] 2017-12-08
### Added
2023-10-14 07:36:29 +02:00
* evolinux-base: install traceroute package
* evolinux-base/ntpd: purge openntpd
* tomcat: add Tomcat 8 cmpatibility
2018-01-20 19:54:41 +01:00
* log2mail: add "The total blob data length" pattern for MySQL
* nagios-nrpe: add bkctld check in evolix.cfg
* varnish: reload or restart if needed
* rabbitmq: add a munin plugin and an NRPE check
* minifirewall: add debug for variables
* elastic: option for stack main version
### Changed
2023-10-14 07:36:29 +02:00
* nginx: rename Let's Encrypt snippet
2018-01-20 19:54:41 +01:00
* nginx: simpler apt preferences for backports
* generate-ldif: add clamd service instead of clamav_db
* mysql: parameterize evolinux config files
* rbenv: use Rbenv 1.1.1 and Ruby 2.4.2 by default
* elasticsearch: update curator debian repository
* evoacme: crontab management
* evoacme: better documentation
* mongodb: comatible with Stretch
### Removed
2023-10-14 07:36:29 +02:00
* mongodb: logfile/pidfile are not configurable on Jessie
2018-01-20 19:54:41 +01:00
* minifirewall: remove zidane.evolix.net from HTTPSITES
### Fixed
2023-10-14 07:36:29 +02:00
* nginx: fix munin CGI graphs
* ntpd: fix default configuration (localhost only)
2018-01-20 19:54:41 +01:00
* logstash: fix permissions on pipeline configuration
* postfix/spamassassin: add user in cron job
* php: php.ini custom file are now readable
* hostname customization needs the dbus package
## [9.1.2] 2017-12-05
### Fixed
2023-10-14 07:36:29 +02:00
2018-01-20 19:54:41 +01:00
* listupgrade: remount /usr as rw
## [9.1.1] 2017-11-21
### Added
2023-10-14 07:36:29 +02:00
2018-01-20 19:54:41 +01:00
* amazon-ec2: add egress rules
### Fixed
2023-10-14 07:36:29 +02:00
2018-01-20 19:54:41 +01:00
* evoacme: fix multiple bugs
## [9.1.0] 2017-11-19
_Warning: huge release, many entries are missing below._
### Added
2023-10-14 07:36:29 +02:00
2018-01-20 19:54:41 +01:00
* amazon-ec2: new role, for EC2 instances creation
* Move /usr rw remount into remount-usr role
* kibana: host and basepath configuration
* kibana: move optimize and data to /var
* logstash: daily job for log rotation
* elasticsearch: daily job for log rotation
* roundcube: add link in default site index
* nagios-nrpe: add opendkim check
### Changed
2023-10-14 07:36:29 +02:00
2018-01-20 19:54:41 +01:00
* Combine evolix and additional trusted IP addresses
* amazon-ec2: split tasks
* apt: don't upgrade by default
* postfix: extract main.cf md5sum into variables
* evolinux-base: cache hwraid pgp key locally
* evoacme: improve cron task
* elasticsearch: use elastic.list APT source list for curator
* ldap: better variables
### Fixed
2023-10-14 07:36:29 +02:00
2018-01-20 19:54:41 +01:00
* fail2ban: create config hierarchy beforehand
* elasticsearch: fix datadir/tmpdir conditions
* elastic: remove double ".list" suffix
* nagios-nrpe: fix check_free_mem for OpenBSD 6.2
* nagios-nrpe: fix check_amavis
### Removed
### Security
## [9.0.1] 2017-10-02
### Added
2023-10-14 07:36:29 +02:00
2018-01-20 19:54:41 +01:00
* haproxy: add a Nagios check
* php: add "sury" mode for PHP 7.1 on Stretch
* minifirewall: explicit dependency on iptables
* apt: remove Gandi source files
* docker-host: new variable for docker home
### Changed
2023-10-14 07:36:29 +02:00
2018-01-20 19:54:41 +01:00
* php: install php5/php package after fpm/libapache2-mod-php
### Fixed
2023-10-14 07:36:29 +02:00
2018-01-20 19:54:41 +01:00
* mysql: add "REPLICATION CLIENT" privilege for nrpe
* evoadmin-web: revert from variables to keywords in the templates
* evoacme: many fixes
* etc-git: detect user if root (without su or sudo)
* docker-host: clean override of docker systemd unit
* varnish: fix systemd unit override
## [9.0.0] 2017-09-19
First official release