Merge branch 'unstable' into stable

README.md

@@ -1,10 +1,61 @@
 # Ansible-roles
 
-A repository for Ansible roles used by Evolix.
+A repository for Ansible roles used by Evolix on Debian GNU/Linux 9 (stretch) servers.
+Few roles are also be compatible with Debian GNU/Linux 8 (jessie) servers.
 
 It contains only roles, everything else is available at
 https://forge.evolix.org/projects/ansible-public
 
+## Branches
+
 The **stable** branch contains roles that we consider ready for production.
 
 The **unstable** branch contains not sufficiently tested roles (or evolutions on existing roles) that we don't consider ready for production yet.
+
+Many feature branches may exist in the repository. They represent "work in progress". They may be used, for testing purposes.
+
+## Install and usage
+
+First, check-out the repository :
+
+```
+$ cd ~/GIT/
+$ git clone https://forge.evolix.org/projects/ansible-roles
+```
+
+Then, add its path to your ansible load path :
+
+```
+$ vim ~/.ansible.cfg
+[defaults]
+roles_path = $HOME/GIT/ansible-roles
+```
+
+Then, include roles in your playbooks :
+
+```
+- hosts: all
+  gather_facts: yes
+  become: yes
+  roles:
+    - etc-git
+    - evolinux-base
+```
+
+## Contributing
+
+Contributions are welcome, especially bug fixes and "ansible good practices". They will be merged in if they are consistent with our conventions and use cases. They might be rejected if they introduce complexity, cover features we don't need or don't fit "style".
+
+Before starting anything of importance, we suggest contacting us to discuss what you'd like to add or change.
+
+Our conventions are available in the "ansible-public":https://forge.evolix.org/projects/ansible-public repository, in the CONVENTIONS.md file.
+
+## Workflow
+
+The ideal and most typical workflow is to create a branch, based on the "unstable" branch. The branch should have a descriptive name (a ticket/issue number is great). The branch can be treated as a pull-request or merge-request. It should be propery tested and reviewed before merging into "unstable".
+
+Changes that don't introduce significant changes — or that must go faster that the typical workflow — can be commited directly into "unstable".
+
+Hotfixes, can be prepared on a new branch, based on "stable" or "unstable" (to be decided by the author). When ready, it can be merged back to "stable" for immediate deployment and to "unstable" for proper backporting.
+
+Other workflow are not forbidden, but should be discussed in advance.

admin-users/meta/main.yml

@@ -12,6 +12,7 @@ galaxy_info:
   - name: Debian
     versions:
     - jessie
+    - stretch
 
 dependencies: []
   # List your role dependencies here, one per line.

admin-users/tasks/main.yml

@@ -1,5 +1,11 @@
 ---
 
+- fail:
+    msg: only compatible with Debian >= 8
+  when:
+  - ansible_distribution == "Debian"
+  - ansible_distribution_major_version | version_compare('8', '<')
+
 - debug:
     msg: "Warning: empty 'admin_users' variable, tasks will be skipped!"
   when: admin_users == {}

admin-users/tasks/sudo.yml

@@ -1,26 +1,48 @@
 ---
 
-- name: Verify Evolinux sudoers file presence
+- name: "Verify Evolinux sudoers file presence (jessie)"
   template:
-    src: sudoers_{{ ansible_distribution_release }}.j2
+    src: sudoers_jessie.j2
     dest: /etc/sudoers.d/evolinux
     force: no
     validate: '/usr/sbin/visudo -cf %s'
   register: copy_sudoers_evolinux
+  when: ansible_distribution_release == "jessie"
 
-- name: Verify Evolinux sudoers file permissions
+- name: "Verify Evolinux sudoers file presence (Debian 9 or later)"
+  template:
+    src: sudoers_stretch.j2
+    dest: /etc/sudoers.d/evolinux
+    force: no
+    validate: '/usr/sbin/visudo -cf %s'
+  register: copy_sudoers_evolinux
+  when: ansible_distribution_major_version | version_compare('9', '>=')
+
+- name: "Verify Evolinux sudoers file permissions"
   file:
     path: /etc/sudoers.d/evolinux
     mode: "0440"
     state: file
 
-- name: "Add user in sudoers file for '{{ user.name }}'"
+- name: "Add user in sudoers file for '{{ user.name }}' (jessie)"
   replace:
     dest: /etc/sudoers.d/evolinux
     regexp: '^(User_Alias\s+ADMINS\s+=((?!{{ user.name }}).)*)$'
     replace: '\1,{{ user.name }}'
     validate: '/usr/sbin/visudo -cf %s'
   when:
-  - ansible_distribution == "Debian"
-  - ansible_distribution_major_version | version_compare('9', '<')
+  - ansible_distribution_release == "jessie"
   - not copy_sudoers_evolinux.changed
+
+- name: "Create evolinux-sudo group (Debian 9 or later)"
+  group:
+    name: evolinux-sudo
+    system: yes
+  when: ansible_distribution_major_version | version_compare('9', '>=')
+
+- name: "Add user to evolinux-sudo group (Debian 9 or later)"
+  user:
+    name: '{{ user.name }}'
+    groups: 'evolinux-sudo'
+    append: yes
+  when: ansible_distribution_major_version | version_compare('9', '>=')

admin-users/tasks/user.yml

@@ -1,5 +1,12 @@
 ---
 
+- name: "Test if '{{ user.name }}' exists"
+  command: 'getent passwd {{ user.name }}'
+  register: loginisbusy
+  failed_when: False
+  changed_when: False
+  check_mode: no
+
 - name: "Test if uid exists for '{{ user.name }}'"
   command: 'getent passwd {{ user.uid }}'
   register: uidisbusy
@@ -16,7 +23,7 @@
    shell: /bin/bash
    password: '{{ user.password_hash }}'
    update_password: on_create
-  when: uidisbusy.rc != 0
+  when: loginisbusy.rc != 0 and uidisbusy.rc != 0
 
 - name: "Add Unix account with random uid for '{{ user.name }}'"
   user:
@@ -26,18 +33,19 @@
    shell: /bin/bash
    password: '{{ user.password_hash }}'
    update_password: on_create
-  when: uidisbusy.rc == 0
+  when: loginisbusy.rc != 0 and uidisbusy.rc == 0
 
-- name: "Create {{ admin_users_group }}"
+- name: "Create {{ admin_users_group }} group (Debian 9 or later)"
   group:
     name: "{{ admin_users_group }}"
+  when: ansible_distribution_major_version | version_compare('9', '>=')
 
-- name: "Add user to sudo group (Stretch)"
+- name: "Add user to {{ admin_users_group }} group (Debian 9 or later)"
   user:
     name: '{{ user.name }}'
-    groups: 'sudo,{{ admin_users_group }}'
+    groups: '{{ admin_users_group }}'
     append: yes
-  when: ansible_distribution_release == "stretch"
+  when: ansible_distribution_major_version | version_compare('9', '>=')
 
 - name: "Fix perms on homedirectory for '{{ user.name }}'"
   file:

admin-users/templates/sudoers_stretch.j2

@@ -5,4 +5,5 @@ Cmnd_Alias      MAINT = /usr/share/scripts/evomaintenance.sh, /usr/share/scripts
 nagios          ALL = NOPASSWD: /usr/lib/nagios/plugins/check_procs
 nagios          ALL = (clamav) NOPASSWD: /usr/bin/clamscan /tmp/safe.txt
 
-%sudo           ALL = NOPASSWD: MAINT
+%evolinux-sudo  ALL=(ALL:ALL) ALL
+%evolinux-sudo  ALL = NOPASSWD: MAINT

apache/defaults/main.yml

@@ -13,5 +13,8 @@ apache_phpmyadmin_set: False
 apache_phpmyadmin_suffix: ""
 apache_serverstatus_suffix: ""
 
+apache_log2mail_include: True
+apache_munin_include: True
+
 general_alert_email: "root@localhost"
 log2mail_alert_email: Null

apache/handlers/main.yml

@@ -8,3 +8,8 @@
   service:
     name: apache2
     state: reloaded
+
+- name: reload munin-node
+  service:
+    name: munin-node
+    state: reloaded

apache/tasks/auth.yml

@@ -1,9 +1,9 @@
 ---
 
-- name: Init private_ipaddr_whitelist.conf file
+- name: Init ipaddr_whitelist.conf file
   copy:
     src: private_ipaddr_whitelist.conf
-    dest: /etc/apache2/private_ipaddr_whitelist.conf
+    dest: /etc/apache2/ipaddr_whitelist.conf
     owner: root
     group: root
     mode: "0640"
@@ -13,7 +13,7 @@
 
 - name: add IP addresses to private IP whitelist
   lineinfile:
-    dest: /etc/apache2/private_ipaddr_whitelist.conf
+    dest: /etc/apache2/ipaddr_whitelist.conf
     line: "Require ip {{ item }}"
     state: present
   with_items: "{{ apache_private_ipaddr_whitelist_present }}"
@@ -23,7 +23,7 @@
 
 - name: remove IP addresses from private IP whitelist
   lineinfile:
-    dest: /etc/apache2/private_ipaddr_whitelist.conf
+    dest: /etc/apache2/ipaddr_whitelist.conf
     line: "Require ip {{ item }}"
     state: absent
   with_items: "{{ apache_private_ipaddr_whitelist_absent }}"
@@ -34,7 +34,7 @@
 - name: include private IP whitelist for server-status
   lineinfile:
     dest: /etc/apache2/mods-available/status.conf
-    line: "        include /etc/apache2/private_ipaddr_whitelist.conf"
+    line: "        include /etc/apache2/ipaddr_whitelist.conf"
     insertafter: 'SetHandler server-status'
     state: present
   tags:

apache/tasks/log2mail.yml

@@ -0,0 +1,15 @@
+---
+
+- name: log2mail is installed
+  apt:
+    name: log2mail
+    state: present
+
+- name: Add log2mail config for Apache segfaults
+  template:
+    src: log2mail-apache.j2
+    dest: "/etc/log2mail/config/apache"
+    owner: log2mail
+    group: adm
+    mode: "0644"
+    force: no

apache/tasks/main.yml

@@ -1,6 +1,6 @@
 ---
 
-- name: packages are installed (stretch)
+- name: packages are installed (Debian 9 or later)
   apt:
     name: '{{ item }}'
     state: present
@@ -13,7 +13,7 @@
   tags:
   - apache
   - packages
-  when: ansible_distribution_release == "stretch"
+  when: ansible_distribution_major_version | version_compare('9', '>=')
 
 - name: packages are installed (jessie)
   apt:
@@ -139,19 +139,6 @@
 - include: phpmyadmin.yml
   when: apache_phpmyadmin_set and _default_index.stat.exists
 
-- name: Check if log2mail is installed
-  apt:
-    name: log2mail
-    state: present
-
-- name: Add log2mail config for Apache segfaults
-  template:
-    src: log2mail-apache.j2
-    dest: "/etc/log2mail/config/apache"
-    owner: root
-    group: root
-    mode: "0644"
-    force: no
 
 # - block:
 #   - name: generate random string for serverstatus suffix
@@ -169,3 +156,9 @@
 #     dest: /var/www/index.html
 #     regexp: '__SERVERSTATUS_SUFFIX__'
 #     replace: "{{ apache_serverstatus_suffix }}"
+
+- include: log2mail.yml
+  when: apache_log2mail_include
+
+- include: munin.yml
+  when: apache_munin_include

apache/tasks/munin.yml

@@ -0,0 +1,23 @@
+---
+
+- name: munin-node and core plugins are installed
+  apt:
+    name: "{{ item }}"
+    state: installed
+  with_items:
+    - munin-node
+    - munin-plugins-core
+
+- name: enable munin plugins
+  file:
+    src: "/usr/share/munin/plugins/{{ item }}"
+    dest: "/etc/munin/plugins/{{ item }}"
+    state: link
+  with_items:
+  - apache_accesses
+  - apache_processes
+  - apache_volume
+  notify: reload munin-node
+  tags:
+  - apache
+  - munin

apache/templates/evolinux-default.conf.j2

@@ -5,24 +5,24 @@
     DocumentRoot /var/www/
 
     <Directory />
-        Include /etc/apache2/private_ipaddr_whitelist.conf
+        Include /etc/apache2/ipaddr_whitelist.conf
     </Directory>
     <Directory /var/www/>
         Options -Indexes
         Require all denied
-        Include /etc/apache2/private_ipaddr_whitelist.conf
+        Include /etc/apache2/ipaddr_whitelist.conf
     </Directory>
 
     # Munin. We need to set Directory directive as Alias take precedence.
     Alias /munin /var/cache/munin/www
     <Directory /var/cache/munin/>
         Require all denied
-        Include /etc/apache2/private_ipaddr_whitelist.conf
+        Include /etc/apache2/ipaddr_whitelist.conf
     </Directory>
     <Directory /usr/lib/munin/cgi/>
         Options -Indexes
         Require all denied
-        Include /etc/apache2/private_ipaddr_whitelist.conf
+        Include /etc/apache2/ipaddr_whitelist.conf
     </Directory>
 
     # For CGI Scripts. We need to set Directory directive as ScriptAlias take precedence.
@@ -30,7 +30,7 @@
     <Directory /usr/lib/cgi-bin>
         Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
         Require all denied
-        Include /etc/apache2/private_ipaddr_whitelist.conf
+        Include /etc/apache2/ipaddr_whitelist.conf
     </Directory>
 
     CustomLog /var/log/apache2/access.log vhost_combined
@@ -53,7 +53,7 @@
     <IfModule mod_status.c>
         <Location /server-status>
             SetHandler server-status
-            include /etc/apache2/private_ipaddr_whitelist.conf
+            include /etc/apache2/ipaddr_whitelist.conf
             Require local
         </Location>
     </IfModule>
@@ -68,12 +68,12 @@
         DocumentRoot /var/www/
 
         <Directory />
-            Include /etc/apache2/private_ipaddr_whitelist.conf
+            Include /etc/apache2/ipaddr_whitelist.conf
         </Directory>
         <Directory /var/www/>
             Options -Indexes
             Require all denied
-            Include /etc/apache2/private_ipaddr_whitelist.conf
+            Include /etc/apache2/ipaddr_whitelist.conf
         </Directory>
 
         SSLEngine on
@@ -83,19 +83,19 @@
         # We override these 2 Directory directives setted in apache2.conf.
         # We want no access except from allowed IP address.
         <Directory />
-            Include /etc/apache2/private_ipaddr_whitelist.conf
+            Include /etc/apache2/ipaddr_whitelist.conf
         </Directory>
 
         # Munin. We need to set Directory directive as Alias take precedence.
         Alias /munin /var/cache/munin/www
         <Directory /var/cache/munin/>
             Require all denied
-            Include /etc/apache2/private_ipaddr_whitelist.conf
+            Include /etc/apache2/ipaddr_whitelist.conf
         </Directory>
         <Directory /usr/lib/munin/cgi/>
             Options -Indexes
             Require all denied
-            Include /etc/apache2/private_ipaddr_whitelist.conf
+            Include /etc/apache2/ipaddr_whitelist.conf
         </Directory>
 
         # For CGI Scripts. We need to set Directory directive as ScriptAlias take precedence.
@@ -103,7 +103,7 @@
         <Directory /usr/lib/cgi-bin>
             Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
             Require all denied
-            Include /etc/apache2/private_ipaddr_whitelist.conf
+            Include /etc/apache2/ipaddr_whitelist.conf
         </Directory>
 
         CustomLog /var/log/apache2/access.log vhost_combined
@@ -113,7 +113,7 @@
         <IfModule mod_status.c>
             <Location /server-status>
                 SetHandler server-status
-                include /etc/apache2/private_ipaddr_whitelist.conf
+                include /etc/apache2/ipaddr_whitelist.conf
                 Require local
             </Location>
         </IfModule>

apt/defaults/main.yml

@@ -1,3 +1,4 @@
+---
 apt_install_basics: True
 apt_basics_components: "main"
 

etc-git/tasks/commit.yml

@@ -22,10 +22,11 @@
     repo: /etc
     scope: local
   register: git_config_user_email
+  ignore_errors: yes
 
 - name: set commit author
   set_fact:
-    etc_git_commit_options: "{% if ansible_env.SUDO_USER %} --author \"{{ ansible_env.SUDO_USER }} <{{ git_config_user_email.config_value }}>\"{% endif %}"
+    etc_git_commit_options: "{% if ansible_env.SUDO_USER %} --author \"{{ ansible_env.SUDO_USER }} <{{ git_config_user_email.config_value |default()}}>\"{% endif %}"
 
 - name: /etc modifications are committed
   shell: "git add -A . && git commit -m \"{{ commit_message | mandatory }}\"{{ etc_git_commit_options }}"

evoacme/tasks/certbot.yml

@@ -65,7 +65,7 @@
     squid_service_name: squid3
   when:
   - ansible_distribution == "Debian"
-  - ansible_distribution_major_version | version_compare('9', '<')
+  - ansible_distribution_release == "jessie"
 
 - name: Let's Encrypt OCSP server is authorized by squid
   lineinfile:

evoadmin/defaults/main.yml

@@ -12,3 +12,13 @@ evoadmin_username: evoadmin
 evoadmin_ssl_subject: "/CN={{ evoadmin_host }}"
 
 evoadmin_enable_vhost: True
+
+evoadmin_tpl_servername: "{{ ansible_fqdn }}"
+evoadmin_tpl_address:  "{{ ansible_default_ipv4.address }}"
+evoadmin_tpl_phpmyadmin_url: Null
+evoadmin_tpl_cgi_suffix: Null
+evoadmin_tpl_signature: evoadmin
+evoadmin_tpl_mail_from: root@localhost
+evoadmin_tpl_mail_bcc: Null
+evoadmin_tpl_mail_standard: "{{ general_alert_email }}"
+evoadmin_tpl_mail_urgent: "{{ general_alert_email }}"

evoadmin/tasks/web.yml

@@ -16,7 +16,7 @@
     option: "disable_functions"
     value: "shell-exec,system,passthru,putenv,popen"
   notify: reload apache
-  when: ansible_distribution_release == "stretch"
+  when: ansible_distribution_major_version | version_compare('9', '>=')
 
 - name: Install evoadmin VHost
   template:

evoadmin/templates/web-mail.tpl.j2

@@ -1,6 +1,6 @@
-From: %MAIL_FROM%
+From: {{ evoadmin_tpl_mail_from }}
 To: RCPTTO
-Bcc: %MAIL_BCC%
+Bcc: {{ evoadmin_tpl_mail_bcc }}
 Subject: Parametres hebergement web : LOGIN
 
 Bonjour,
@@ -11,7 +11,7 @@ Votre compte d'hebergement web a ete cree.
 * CONNEXION SFTP/SSH
 **********************************
 
-NOM DU SERVEUR : %SERVER_NAME%
+NOM DU SERVEUR : {{ evoadmin_tpl_servername }}
 USER : LOGIN
 PASSWORD : PASSE1
 
@@ -20,10 +20,10 @@ PASSWORD : PASSE1
 *****************************************
 
 URL du site :
-http://SERVERNAME
+http://{{ evoadmin_tpl_servername }}
 
 URL des stats :
-http://SERVERNAME/cgi-RANDOM/awstats.pl
+http://{{ evoadmin_tpl_servername }}/cgi-RANDOM/awstats.pl
 (acces par IP ou login a demander !)
 
 Repertoire de connexion : HOME_DIR/LOGIN/
@@ -47,20 +47,20 @@ USER : LOGIN
 PASSWORD : PASSE2
 NOM BASE : DBNAME
 URL interface d'admin :
-%PMA_URL%
+{{ evoadmin_tpl_phpmyadmin_url }}
 
 ***********************************
 * Rappels divers
 ***********************************
 
 Votre nom de domaine doit etre configure pour pointer
-sur l'adresse IP %SERVER_ADDR% (enregistrement DNS A)
-ou etre un alias de %SERVER_NAME% (enregistrement DNS CNAME).
+sur l'adresse IP {{ evoadmin_tpl_address }} (enregistrement DNS A)
+ou etre un alias de {{ evoadmin_tpl_servername }} (enregistrement DNS CNAME).
 
 Si vous avez besoin de faire des tests, vous devez
 ajouter la ligne suivante au fichier "/etc/hosts" sous Linux/Unix
 ou au fichier "system32\drivers\etc\hosts" sous Windows NT/XP :
-%SERVER_ADDR% SERVERNAME
+{{ evoadmin_tpl_address }} {{ evoadmin_tpl_servername }}
 
 Attention, par defaut, toutes les connexions vers l'exterieur
 sont bloquees. Si vous avez besoin de recuperer des donnees
@@ -71,16 +71,16 @@ Afin de securiser au maximum le serveur, certaines URL
 particulieres sont non autorisees pour eviter diverses
 attaques (XSS, robots, trojans, injections, etc.).
 Exemple d'URL refusee :
-http://SERVERNAME/cmd32.exe
+http://{{ evoadmin_tpl_servername }}/cmd32.exe
 En cas de soucis avec votre application, prevenez-nous.
 
 Si vous desirez mettre en place des parametres particuliers
-pour votre site (PHP, etc.) ou pour tout autre demande (scripts en crontab, 
+pour votre site (PHP, etc.) ou pour tout autre demande (scripts en crontab,
 etc.), n'hesitez pas a nous contacter a l'adresse
-%MAIL_STANDARD% (ou %MAIL_URGENT% si votre demande est
+{{ evoadmin_tpl_mail_standard }} (ou {{ evoadmin_tpl_mail_urgent }} si votre demande est
 urgente).
 
 
 Cordialement,
--- 
-%FOOTER%
+--
+{{ evoadmin_tpl_signature }}

evocheck/files/evocheck.sh

@@ -204,7 +204,7 @@ if [ -e /etc/debian_version ]; then
     fi
 
     if [ "$IS_LISTCHANGESCONF" = 1 ]; then
-        egrep "(which=both|confirm=1)" /etc/apt/listchanges.conf | wc -l | grep -q ^2$ || echo 'IS_LISTCHANGESCONF FAILED!'
+        is_debianversion stretch || ( test -e /etc/apt/listchanges.conf && egrep "(which=both|confirm=1)" /etc/apt/listchanges.conf | wc -l | grep -q ^2$ || echo 'IS_LISTCHANGESCONF FAILED!' )
     fi
 
     if [ "$IS_CUSTOMCRONTAB" = 1 ]; then
@@ -220,7 +220,7 @@ if [ -e /etc/debian_version ]; then
     fi
 
     if [ "$IS_TMOUTPROFILE" = 1 ]; then
-        grep -q TMOUT= /etc/profile || echo 'IS_TMOUTPROFILE FAILED!'
+        grep -q TMOUT= /etc/profile /etc/profile.d/evolinux.sh || echo 'IS_TMOUTPROFILE FAILED!'
     fi
 
     if [ "$IS_ALERT5BOOT" = 1 ]; then

evolinux-base/tasks/main.yml

@@ -1,4 +1,11 @@
 ---
+
+- fail:
+    msg: only compatible with Debian >= 8
+  when:
+  - ansible_distribution == "Debian"
+  - ansible_distribution_major_version | version_compare('8', '<')
+
 - name: Hostname
   include: hostname.yml
   when: evolinux_hostname_include

evolinux-base/tasks/packages.yml

@@ -79,7 +79,6 @@
   - net-tools
   when:
   - evolinux_packages_stretch
-  - ansible_distribution == "Debian"
   - ansible_distribution_major_version | version_compare('9', '>=')
 
 - name: Customize logcheck recipient
@@ -109,6 +108,8 @@
   with_items:
   - { option: "confirm", value: "1" }
   - { option: "which",   value: "both" }
-  when: evolinux_packages_listchanges and ansible_distribution == "Debian" and ansible_distribution_major_version | version_compare('9', '<')
+  when:
+  - evolinux_packages_listchanges
+  - ansible_distribution_release == "jessie"
 
 - meta: flush_handlers

evolinux-base/tasks/ssh.yml

@@ -1,5 +1,9 @@
 ---
 
+- fail:
+    msg: You must provide at least 1 ssh trusted IP
+  when: evolinux_ssh_password_auth_addresses == []
+
 - name: Security directives for Evolinux
   blockinfile:
     dest: /etc/ssh/sshd_config
@@ -55,6 +59,8 @@
   notify: reload sshd
   when: evolinux_ssh_disable_root
 
+# We disable AcceptEnv because it can be a security issue, but also because we
+# do not want clients to push their environment variables like LANG.
 - name: disable AcceptEnv in ssh config
   replace:
     dest: /etc/ssh/sshd_config
@@ -69,8 +75,6 @@
     regexp: '^#?LogLevel [A-Z]+'
     replace: "LogLevel VERBOSE"
   notify: reload sshd
-  when:
-  - ansible_distribution == "Debian"
-  - ansible_distribution_major_version | version_compare('9', '>=')
+  when: ansible_distribution_major_version | version_compare('9', '>=')
 
 - meta: flush_handlers

jenkins/tasks/main.yml

@@ -11,12 +11,12 @@
   check_mode: no
   register: squid_whitelist_files
 
-- name: set squid_service_name=squid3 for Debian < 9
+- name: set squid_service_name=squid3 for Debian 8
   set_fact:
     squid_service_name: squid3
   when:
   - ansible_distribution == "Debian"
-  - ansible_distribution_major_version | version_compare('9', '<')
+  - ansible_distribution_release == "jessie"
 
 - name: Append packages.dotdeb.org to Squid whitelist
   lineinfile:

mongodb/tasks/main.yml

@@ -7,12 +7,12 @@
   check_mode: no
   register: squid_whitelist_files
 
-- name: set squid_service_name=squid3 for Debian < 9
+- name: set squid_service_name=squid3 for Debian 8
   set_fact:
     squid_service_name: squid3
   when:
   - ansible_distribution == "Debian"
-  - ansible_distribution_major_version | version_compare('9', '<')
+  - ansible_distribution_release == "jessie"
 
 - name: Append packages.dotdeb.org to Squid whitelist
   lineinfile:

munin/defaults/main.yml

@@ -1,2 +1 @@
 ---
-munin_dir: /home/www/munin

munin/templates/munin.conf.j2

@@ -6,7 +6,7 @@
 # defaulted to the values you see here.
 #
 #dbdir  /var/db/munin
-htmldir {{ munin_dir }}
+#htmldir /var/cache/munin/www
 #logdir /var/log/munin
 #rundir  /var/run/munin
 

mysql/defaults/main.yml

@@ -2,7 +2,7 @@
 general_alert_email: "root@localhost"
 log2mail_alert_email: Null
 
-general_scripts_dir: "/usr/local/bin"
+general_scripts_dir: "/usr/share/scripts"
 mysql_scripts_dir: Null
 
 mysql_variant: oracle
@@ -18,4 +18,7 @@ mysql_innodb_buffer_pool_size: '{{ (ansible_memtotal_mb * 0.3) | int }}M'
 mysql_cron_optimize: True
 mysql_cron_optimize_frequency: weekly
 
+mysql_cron_mysqltuner: True
+mysql_cron_mysqltuner_frequency: monthly
+
 mysql_force_new_nrpe_password: False

mysql/files/mysqltuner.cron.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+set -e
+export TERM=screen
+
+mem=$(free -m | grep Mem: | tr -s ' ' | cut -d ' ' -f2)
+swap=$(free -m | grep Swap: | tr -s ' ' | cut -d ' ' -f2)
+template=$(mktemp --tmpdir=/tmp evomysqltuner.XXX)
+body=$(mktemp --tmpdir=/tmp evomysqltuner.XXX)
+clientmail=$(grep EVOMAINTMAIL /etc/evomaintenance.cf | cut -d'=' -f2)
+hostname=$(grep HOSTNAME /etc/evomaintenance.cf | cut -d'=' -f2)
+hostname=${hostname%%.evolix.net}
+# If hostname is composed with -, remove the first part.
+if [[ $hostname =~ "-" ]]; then
+    hostname=$(echo $hostname | cut -d'-' -f2-)
+fi
+
+# Remove temporary files on exit.
+trap "rm $template $body" EXIT
+
+# Add port here if you have more than one instance!
+instances="3306"
+for instance in $instances; do
+    mysqltuner --port $instance --host 127.0.0.1 --forcemem $mem --forceswap $swap \
+      | aha > /var/www/mysqlreport_${instance}.html
+    cat << EOT > $template
+Content-Type: text/plain; charset="utf-8"
+Reply-To: Équipe Evolix <equipe@evolix.fr>
+From: Équipe Evolix <equipe@evolix.net>
+To: $clientmail
+Subject: Rapport MySQL instance $instance pour votre serveur $hostname
+EOT
+    cat << EOT > $body
+Bonjour,
+
+Veuillez trouver ci-joint un rapport MySQL.
+Celui-ci permet d'identifier aisément si des optimisations MySQL sont possibles.
+
+N'hésitez pas à nous indiquer par mail ou ticket quelles variables vous souhaiter
+optimiser.
+
+Veuillez noter qu'il faudra redémarrer MySQL pour appliquer de nouveaux paramètres.
+
+Bien à vous,
+--
+Rapport automatique Evolix
+EOT
+    mutt -x -e 'set send_charset="utf-8"' -H $template \
+      -a /var/www/mysqlreport_${instance}.html < $body
+done
+chmod 644 /var/www/mysqlreport*html

mysql/tasks/log2mail.yml

@@ -13,6 +13,8 @@
   template:
     src: log2mail.j2
     dest: /etc/log2mail/config/mysql.conf
+    owner: log2mail
+    group: adm
     mode: "0640"
   when: log2mail_config_dir.stat.exists
   tags:

mysql/tasks/main.yml

@@ -1,9 +1,13 @@
 ---
 
-- include: packages.yml
+- include: packages_stretch.yml
+  when: ansible_distribution_major_version | version_compare('9', '>=')
+
+- include: packages_jessie.yml
+  when: ansible_distribution_release == "jessie"
 
 - include: users_stretch.yml
-  when: ansible_distribution_release == "stretch"
+  when: ansible_distribution_major_version | version_compare('9', '>=')
 
 - include: users_jessie.yml
   when: ansible_distribution_release == "jessie"

mysql/tasks/nrpe.yml

@@ -20,7 +20,7 @@
 
 - block:
   - name: Create a password for NRPE
-    shell: perl -e 'print map{("a".."z","A".."Z",0..9)[int(rand(62))]}(1..16)'
+    command: "apg -n 1 -m 16 -M lcN"
     register: mysql_nrpe_password
     changed_when: False
 

mysql/tasks/packages_stretch.yml

@@ -0,0 +1,29 @@
+---
+
+- name: Install MySQL packages
+  apt:
+    name: '{{ item }}'
+    update_cache: yes
+    state: present
+  with_items:
+  - mariadb-server
+  - mariadb-client
+  tags:
+  - mysql
+  - packages
+
+- name: MySQL is started
+  service:
+    name: mysql
+    state: started
+  tags:
+  - mysql
+  - services
+
+- name: apg package is installed
+  apt:
+    name: apg
+    state: present
+  tags:
+  - mysql
+  - packages

mysql/tasks/users_jessie.yml

@@ -10,7 +10,7 @@
   - mysql
 
 - name: create a password for mysqladmin
-  shell: perl -e 'print map{("a".."z","A".."Z",0..9)[int(rand(62))]}(1..16)'
+  command: "apg -n 1 -m 16 -M lcN"
   register: mysql_admin_password
   changed_when: False
   tags:

mysql/tasks/users_stretch.yml

@@ -10,7 +10,7 @@
   - mysql
 
 - name: create a password for mysqladmin
-  shell: perl -e 'print map{("a".."z","A".."Z",0..9)[int(rand(62))]}(1..16)'
+  command: "apg -n 1 -m 16 -M lcN"
   register: mysql_admin_password
   changed_when: False
   tags:
@@ -45,7 +45,7 @@
 
 
 - name: create a password for debian-sys-maint
-  shell: perl -e 'print map{("a".."z","A".."Z",0..9)[int(rand(62))]}(1..16)'
+  command: "apg -n 1 -m 16 -M lcN"
   register: mysql_debian_password
   changed_when: False
   tags:

mysql/tasks/utils.yml

@@ -1,8 +1,8 @@
 ---
 
-- name: Ensure /usr/share/scripts exists
+- name: Ensure scripts directory exists
   file:
-    dest: /usr/share/scripts
+    dest: "{{ mysql_scripts_dir or general_scripts_dir | mandatory }}"
     mode: "0700"
     state: directory
   tags:
@@ -52,13 +52,17 @@
   when: (mysql_scripts_dir or general_scripts_dir) | search ("/usr")
 
 - name: Install mysqltuner
-  copy:
-    src: mysqltuner.pl
-    dest: "{{ mysql_scripts_dir or general_scripts_dir | mandatory }}/mysqltuner.pl"
-    mode: "0700"
+  # copy:
+  #   src: mysqltuner.pl
+  #   dest: "{{ mysql_scripts_dir or general_scripts_dir | mandatory }}/mysqltuner.pl"
+  #   mode: "0700"
+  apt:
+    name: mysqltuner
+    state: present
   tags:
     - mysql
     - mysqltuner
+    - mysqltuner
 
 - name: Install aha
   apt:
@@ -79,7 +83,7 @@
   tags:
     - mysql
 
-- name: "Cron dir is present"
+- name: "Cron dir for optimize is present"
   file:
     path: "/etc/cron.{{ mysql_cron_optimize_frequency | mandatory }}"
     state: directory
@@ -98,12 +102,36 @@
 
 - name: "Disable cron to optimize MySQL"
   file:
-    dest: /etc/cron.weekly/mysql-optimize.sh
+    dest: /etc/cron.{{ mysql_cron_optimize_frequency | mandatory }}/mysql-optimize.sh
     state: absent
   when: not mysql_cron_optimize
   tags:
     - mysql
 
+- name: "Cron dir for mysqltuner is present"
+  file:
+    path: "/etc/cron.{{ mysql_cron_mysqltuner_frequency | mandatory }}"
+    state: directory
+    mode: "0755"
+    owner: root
+    group: root
+
+- name: "Enable mysqltuner in cron"
+  copy:
+    src: mysqltuner.cron.sh
+    dest: /etc/cron.{{ mysql_cron_mysqltuner_frequency | mandatory }}/mysqltuner.sh
+  when: mysql_cron_mysqltuner
+  tags:
+    - mysql
+
+- name: "Disable mysqltuner in cron"
+  file:
+    dest: /etc/cron.{{ mysql_cron_mysqltuner_frequency | mandatory }}/mysqltuner.sh
+    state: absent
+  when: not mysql_cron_mysqltuner
+  tags:
+    - mysql
+
 # my-add.sh
 
 - include: remount_usr_rw.yml

nagios-nrpe/defaults/main.yml

@@ -5,6 +5,6 @@ nagios_nrpe_ldap_passwd: LDAP_PASSWD
 nagios_nrpe_pgsql_passwd: PGSQL_PASSWD
 nagios_nrpe_amavis_from: "foobar@{{ ansible_domain }}"
 
-nagios_nrpe_check_proxy_host: "www.debian.org"
+nagios_nrpe_check_proxy_host: "www.example.com"
 
 nagios_plugins_directory: "/usr/local/lib/nagios/plugins"

newrelic/tasks/sources.yml

@@ -5,12 +5,12 @@
     # url: https://download.newrelic.com/548C16BF.gpg
     data: "{{ lookup('file', '548C16BF.gpg') }}"
 
-- name: set squid_service_name=squid3 for Debian < 9
+- name: set squid_service_name=squid3 for Debian 8
   set_fact:
     squid_service_name: squid3
   when:
   - ansible_distribution == "Debian"
-  - ansible_distribution_major_version | version_compare('9', '<')
+  - ansible_distribution_release == "jessie"
 
 - name: Find squid config whitelist
   shell: find /etc/{{ squid_service_name | default('squid') }}/whitelist-custom.conf /etc/{{ squid_service_name | default('squid') }}/whitelist.conf 2> /dev/null

nginx/tasks/main_regular.yml

@@ -4,7 +4,7 @@
   when: ansible_distribution_release == "jessie"
 
 - include: packages_stretch.yml
-  when: ansible_distribution_release == "stretch"
+  when: ansible_distribution_major_version | version_compare('9', '>=')
 
 # TODO: find a way to override the main configuration
 # without touching the main file

packweb-apache/tasks/main.yml

@@ -42,7 +42,7 @@
   when: ansible_distribution_release == "jessie"
 
 - include: php.yml
-  when: ansible_distribution_release == "stretch"
+  when: ansible_distribution_major_version | version_compare('9', '>=')
 
 - include: phpmyadmin.yml
 

php-fpm/tasks/main.yml

@@ -2,7 +2,9 @@
   apt:
     name: php5-fpm
     state: present
-  when: ansible_distribution_major_version | version_compare('8', '<=')
+  when:
+  - ansible_distribution == "Debian"
+  - ansible_distribution_release == "jessie"
   tags:
   - php-fpm
 
@@ -10,6 +12,8 @@
   apt:
     name: php-fpm
     state: present
-  when: ansible_distribution_major_version | version_compare('9', '>=')
+  when:
+  - ansible_distribution == "Debian"
+  - ansible_distribution_major_version | version_compare('9', '>=')
   tags:
   - php-fpm

proftpd/templates/evolinux.conf.j2

@@ -14,6 +14,7 @@ MaxClientsPerHost 20
 PassivePorts  60000 61000
 UseReverseDNS off
 IdentLookups  off
+TimesGMT      off
 
 # Local permissions
 DefaultRoot       ~