diff --git a/apache/defaults/main.yml b/apache/defaults/main.yml index 901f3c20..ffc74b4e 100644 --- a/apache/defaults/main.yml +++ b/apache/defaults/main.yml @@ -12,6 +12,7 @@ apache_evolinux_default_ssl_cert: /etc/ssl/certs/ssl-cert-snakeoil.pem apache_evolinux_default_ssl_key: /etc/ssl/private/ssl-cert-snakeoil.key apache_serverstatus_suffix: "" +apache_serverstatus_suffix_file: "/etc/evolinux/apache_serverstatus_suffix" apache_log2mail_include: True apache_munin_include: True diff --git a/apache/tasks/auth.yml b/apache/tasks/auth.yml index dff100ce..03598682 100644 --- a/apache/tasks/auth.yml +++ b/apache/tasks/auth.yml @@ -9,7 +9,7 @@ mode: "0640" force: no tags: - - apache + - apache - name: add IP addresses to private IP whitelist lineinfile: @@ -19,7 +19,7 @@ with_items: "{{ apache_ipaddr_whitelist_present }}" notify: reload apache tags: - - apache + - apache - name: remove IP addresses from private IP whitelist lineinfile: @@ -29,7 +29,7 @@ with_items: "{{ apache_ipaddr_whitelist_absent }}" notify: reload apache tags: - - apache + - apache - name: include private IP whitelist for server-status lineinfile: @@ -38,7 +38,7 @@ insertafter: 'SetHandler server-status' state: present tags: - - apache + - apache - name: Copy private_htpasswd copy: @@ -50,7 +50,7 @@ force: no notify: reload apache tags: - - apache + - apache - name: add user:pwd to private htpasswd lineinfile: @@ -60,7 +60,7 @@ with_items: "{{ apache_private_htpasswd_present }}" notify: reload apache tags: - - apache + - apache - name: remove user:pwd from private htpasswd lineinfile: @@ -70,4 +70,4 @@ with_items: "{{ apache_private_htpasswd_absent }}" notify: reload apache tags: - - apache + - apache diff --git a/apache/tasks/log2mail.yml b/apache/tasks/log2mail.yml index 894ff039..3b0650b7 100644 --- a/apache/tasks/log2mail.yml +++ b/apache/tasks/log2mail.yml @@ -4,6 +4,8 @@ apt: name: log2mail state: present + tags: + - apache - name: Add log2mail config for Apache segfaults template: @@ -13,3 +15,5 @@ group: adm mode: "0644" force: no + tags: + - apache diff --git a/apache/tasks/main.yml b/apache/tasks/main.yml index 3820fad2..3175108f 100644 --- a/apache/tasks/main.yml +++ b/apache/tasks/main.yml @@ -5,14 +5,14 @@ name: '{{ item }}' state: present with_items: - - apache2 - - libapache2-mpm-itk - - libapache2-mod-evasive - - apachetop - - libwww-perl + - apache2 + - libapache2-mpm-itk + - libapache2-mod-evasive + - apachetop + - libwww-perl tags: - - apache - - packages + - apache + - packages when: ansible_distribution_major_version | version_compare('9', '>=') - name: packages are installed (jessie) @@ -20,13 +20,13 @@ name: '{{ item }}' state: present with_items: - - apache2-mpm-itk - - libapache2-mod-evasive - - apachetop - - libwww-perl + - apache2-mpm-itk + - libapache2-mod-evasive + - apachetop + - libwww-perl tags: - - apache - - packages + - apache + - packages when: ansible_distribution_release == "jessie" - name: basic modules are enabled @@ -34,17 +34,21 @@ name: '{{ item }}' state: present with_items: - - rewrite - - expires - - headers - - cgi - - ssl - - include - - negotiation - - alias + - rewrite + - expires + - headers + - cgi + - ssl + - include + - negotiation + - alias notify: reload apache tags: - - apache + - apache + +- include: server_status.yml + tags: + - apache - name: Copy Apache defaults config file copy: @@ -75,19 +79,23 @@ dest: /etc/apache2/mods-enabled/status.conf state: absent notify: reload apache + tags: + - apache - name: Ensure Apache config files are enabled command: "a2enconf {{ item }}" register: command_result changed_when: "'Enabling' in command_result.stderr" with_items: - - z-evolinux-defaults.conf - - zzz-evolinux-custom.conf + - z-evolinux-defaults.conf + - zzz-evolinux-custom.conf notify: reload apache tags: - - apache + - apache - include: auth.yml + tags: + - apache - name: default vhost is installed template: @@ -97,7 +105,7 @@ force: no notify: reload apache tags: - - apache + - apache - name: default vhost is enabled file: @@ -108,7 +116,7 @@ notify: reload apache when: apache_evolinux_default_enabled tags: - - apache + - apache - name: is umask already present? command: "grep -E '^umask ' /etc/apache2/envvars" @@ -117,7 +125,7 @@ register: envvar_grep_umask check_mode: no tags: - - apache + - apache - name: Add a mark in envvars for umask blockinfile: @@ -129,12 +137,12 @@ umask 007 when: envvar_grep_umask.rc != 0 tags: - - apache + - apache - include_role: name: remount-usr tags: - - apache + - apache - name: "Install save_apache_status.sh" copy: @@ -142,9 +150,15 @@ dest: /usr/share/scripts/save_apache_status.sh mode: "0755" force: no + tags: + - apache - include: log2mail.yml when: apache_log2mail_include + tags: + - apache - include: munin.yml when: apache_munin_include + tags: + - apache diff --git a/apache/tasks/server_status.yml b/apache/tasks/server_status.yml new file mode 100644 index 00000000..c6070c2b --- /dev/null +++ b/apache/tasks/server_status.yml @@ -0,0 +1,29 @@ +--- + +- name: set apache serverstatus suffix if provided + shell: "echo {{ apache_serverstatus_suffix }} > {{ apache_serverstatus_suffix_file }}" + when: apache_serverstatus_suffix != "" + +- name: generate random string for server-status suffix + shell: "apg -a 1 -M N -n 1 > {{ apache_serverstatus_suffix_file }}" + args: + creates: "{{ apache_serverstatus_suffix_file }}" + +- name: read apache server status suffix + command: "tail -n 1 {{ apache_serverstatus_suffix_file }}" + changed_when: False + check_mode: no + register: new_apache_serverstatus_suffix + +- name: overwrite apache_serverstatus_suffix + set_fact: + apache_serverstatus_suffix: "{{ new_apache_serverstatus_suffix.stdout }}" + +- debug: + var: apache_serverstatus_suffix + +- name: replace server-status suffix in default site index + replace: + dest: /var/www/index.html + regexp: '__SERVERSTATUS_SUFFIX__' + replace: "{{ apache_serverstatus_suffix }}" diff --git a/apache/templates/evolinux-default.conf.j2 b/apache/templates/evolinux-default.conf.j2 index 238665b2..e1c97911 100644 --- a/apache/templates/evolinux-default.conf.j2 +++ b/apache/templates/evolinux-default.conf.j2 @@ -53,7 +53,7 @@ - + SetHandler server-status include /etc/apache2/ipaddr_whitelist.conf Require local @@ -112,7 +112,7 @@ LogLevel warn - + SetHandler server-status include /etc/apache2/ipaddr_whitelist.conf Require local diff --git a/evolinux-base/defaults/main.yml b/evolinux-base/defaults/main.yml index f9a0a5de..6f462f15 100644 --- a/evolinux-base/defaults/main.yml +++ b/evolinux-base/defaults/main.yml @@ -21,6 +21,10 @@ evolinux_apt_public_sources: True evolinux_apt_upgrade: True evolinux_apt_remove_aptitude: True +# etc-evolinux + +evolinux_etcevolinux_include: True + # etc-git evolinux_etcgit_include: True diff --git a/evolinux-base/tasks/etc-evolinux.yml b/evolinux-base/tasks/etc-evolinux.yml new file mode 100644 index 00000000..2aee963f --- /dev/null +++ b/evolinux-base/tasks/etc-evolinux.yml @@ -0,0 +1,9 @@ +--- + +- name: /etc/evolinux exists + file: + dest: /etc/evolinux + owner: root + group: root + mode: "0700" + state: directory diff --git a/evolinux-base/tasks/main.yml b/evolinux-base/tasks/main.yml index e30a7fcf..f775fe13 100644 --- a/evolinux-base/tasks/main.yml +++ b/evolinux-base/tasks/main.yml @@ -19,6 +19,10 @@ name: etc-git when: evolinux_etcgit_include +- name: /etc/evolinux base + include: etc-evolinux.yml + when: evolinux_etcevolinux_include + - name: Hostname include: hostname.yml when: evolinux_hostname_include diff --git a/evolinux-base/templates/default_www/index.html.j2 b/evolinux-base/templates/default_www/index.html.j2 index f7d5c428..4ede9d36 100644 --- a/evolinux-base/templates/default_www/index.html.j2 +++ b/evolinux-base/templates/default_www/index.html.j2 @@ -58,7 +58,7 @@