evolix
/
ansible-roles
18
2
Fork 2
Code Issues 61 Pull Requests 18 Releases 32 Wiki Activity

Release 22.01 #142

Merged
jlecour merged 189 commits from unstable into stable 2022-01-25 18:30:09 +01:00
Conversation 0 Commits 189 Files Changed 201 +5250 -871
jlecour commented 2022-01-25 18:28:51 +01:00
Owner
Copy Link

Added

  • Support for Debian 11 « Bullseye » (with possible remaining blind spots)
  • apache: new variable for MPM mode (+ updated default config accordingly)
  • apache: prevent accessing Git or "env" related files
  • certbot: add script for manual deploy hooks execution
  • docker-host: install additional dependencies
  • dovecot: switch to TLS 1.2+ and external DH params
  • etc-git: centralize cron jobs in dedicated crontab
  • etc-git: manage commits with an optimized shell script instead of many slow Ansible tasks
  • evolinux-base: add script backup-server-state
  • evolinux-base: configure top and htop to display the swap column
  • evolinux-base: install molly-guard by default
  • generate-ldif: detect RAID controller
  • generate-ldif: detect mdadm
  • listupgrade: crontab is configurable
  • logstash: logging to syslog is configurable (default: True)
  • mongodb: create munin plugins directory if missing
  • munin: systemd override to unprotect home directory
  • mysql: add evomariabackup 21.11
  • mysql: improve Bullseye compatibility
  • mysql: script "mysql_connections" to display a compact list of connections
  • mysql: script "mysql-queries-killer.sh" to kill MySQL queries
  • nagios-nrpe + evolinux-users: new check for ipmi
  • nagios-nrpe + evolinux-users: new check for RAID (soft + hard)
  • nagios-nrpe + evolinux-users: new checks for bkctld
  • nagios-nrpe: new check influxdb
  • openvpn: new role (beta)
  • redis: instance service for Debian 11
  • squid: add *.o.lencr.org to default whitelist

Changed

  • Change version pattern
  • Install python 2 or 3 libraries according to running python version
  • Remove embedded GPG keys only if legacy keyring is present
  • apt: remove workaround for Evolix public repositories with Debian 11
  • apt: upgrade packages after all the configuration is done
  • apt: use the new security repository for Bullseye
  • certbot: silence letsencrypt deprecation warnings
  • elasticsearch: elastic_stack_version = 7.x
  • evoacme: exclude renewal-hooks directory from cron
  • evoadmin-web: simpler PHP packages lists
  • evocheck: upstream release 21.10.4
  • evolinux-base: alert5 comes after the network
  • evolinux-base: force Debian version to buster for Evolix repository (temporary)
  • evolinux-base: install freeipmi by default on dedicated hw
  • evolinux-base: logs are rotated with dateext by default
  • evolinux-base: split dpkg logrotate configuration
  • evolinux-users + nagios-nrpe: Add support for php-fpm80 in lxc
  • evomaintenance: extract a config.yml tasks file
  • evomaintenance: upstream release 22.01
  • filebeat/metricbeat: elastic_stack_version = 7.x
  • kibana: elastic_stack_version = 7.x
  • listupgrade: old-kernel-removal version 21.10
  • listupgrade: upstream release 21.06.3
  • logstash: elastic_stack_version = 7.x
  • mongodb: Allow to specify a mongodb version for buster & bullseye
  • mongodb: Deny the install on Debian 11 « Bullseye » when the version is unsupported
  • mongodb: Support version 5.0 (for buster)
  • mysql: use python3 and mariadb-client-10.5 with Debian 11 and later
  • nodejs: default to version 16 LTS
  • php: enforce Debian version with assert instead of fail
  • squid: improve default whitelist (more specific patterns)
  • squid: must be started in foreground mode for systemd
  • squid: remove obsolete variable on Squid 4

Fixed

  • evolinux-base: fix alert5.service dependency syntax
  • certbot: sync_remote excludes itself
  • lxc-php: fix config for opensmtpd on bullseye containers
  • mysql : Create a default ~root/.my.cnf for compatibility reasons
  • nginx : fix variable name and debug to actually use nginx-light
  • packweb-apache : Support php 8.0
  • nagios-nrpe: Fix check_nfsserver for buster and bullseye

Removed

  • evocheck: package install is not supported anymore
  • logstash: no more dependency on Java
  • php: remove php-gettext for 7.4
### Added * Support for Debian 11 « Bullseye » (with possible remaining blind spots) * apache: new variable for MPM mode (+ updated default config accordingly) * apache: prevent accessing Git or "env" related files * certbot: add script for manual deploy hooks execution * docker-host: install additional dependencies * dovecot: switch to TLS 1.2+ and external DH params * etc-git: centralize cron jobs in dedicated crontab * etc-git: manage commits with an optimized shell script instead of many slow Ansible tasks * evolinux-base: add script backup-server-state * evolinux-base: configure top and htop to display the swap column * evolinux-base: install molly-guard by default * generate-ldif: detect RAID controller * generate-ldif: detect mdadm * listupgrade: crontab is configurable * logstash: logging to syslog is configurable (default: True) * mongodb: create munin plugins directory if missing * munin: systemd override to unprotect home directory * mysql: add evomariabackup 21.11 * mysql: improve Bullseye compatibility * mysql: script "mysql_connections" to display a compact list of connections * mysql: script "mysql-queries-killer.sh" to kill MySQL queries * nagios-nrpe + evolinux-users: new check for ipmi * nagios-nrpe + evolinux-users: new check for RAID (soft + hard) * nagios-nrpe + evolinux-users: new checks for bkctld * nagios-nrpe: new check influxdb * openvpn: new role (beta) * redis: instance service for Debian 11 * squid: add *.o.lencr.org to default whitelist ### Changed * Change version pattern * Install python 2 or 3 libraries according to running python version * Remove embedded GPG keys only if legacy keyring is present * apt: remove workaround for Evolix public repositories with Debian 11 * apt: upgrade packages after all the configuration is done * apt: use the new security repository for Bullseye * certbot: silence letsencrypt deprecation warnings * elasticsearch: elastic_stack_version = 7.x * evoacme: exclude renewal-hooks directory from cron * evoadmin-web: simpler PHP packages lists * evocheck: upstream release 21.10.4 * evolinux-base: alert5 comes after the network * evolinux-base: force Debian version to buster for Evolix repository (temporary) * evolinux-base: install freeipmi by default on dedicated hw * evolinux-base: logs are rotated with dateext by default * evolinux-base: split dpkg logrotate configuration * evolinux-users + nagios-nrpe: Add support for php-fpm80 in lxc * evomaintenance: extract a config.yml tasks file * evomaintenance: upstream release 22.01 * filebeat/metricbeat: elastic_stack_version = 7.x * kibana: elastic_stack_version = 7.x * listupgrade: old-kernel-removal version 21.10 * listupgrade: upstream release 21.06.3 * logstash: elastic_stack_version = 7.x * mongodb: Allow to specify a mongodb version for buster & bullseye * mongodb: Deny the install on Debian 11 « Bullseye » when the version is unsupported * mongodb: Support version 5.0 (for buster) * mysql: use python3 and mariadb-client-10.5 with Debian 11 and later * nodejs: default to version 16 LTS * php: enforce Debian version with assert instead of fail * squid: improve default whitelist (more specific patterns) * squid: must be started in foreground mode for systemd * squid: remove obsolete variable on Squid 4 ### Fixed * evolinux-base: fix alert5.service dependency syntax * certbot: sync_remote excludes itself * lxc-php: fix config for opensmtpd on bullseye containers * mysql : Create a default ~root/.my.cnf for compatibility reasons * nginx : fix variable name and debug to actually use nginx-light * packweb-apache : Support php 8.0 * nagios-nrpe: Fix check_nfsserver for buster and bullseye ### Removed * evocheck: package install is not supported anymore * logstash: no more dependency on Java * php: remove php-gettext for 7.4
jlecour added 189 commits 2022-01-25 18:28:53 +01:00
continuous-integration/drone/push Build is passing Details
11813c31a4 certbot: add script for manual deploy hooks execution
continuous-integration/drone/push Build is passing Details
27a09ce682 listupgrade: update old-kernel-removal.sh from upstream
continuous-integration/drone/push Build is passing Details
83e8a3d75a listupgrade: add repository URL
52d06a3987 temporary bulseye-detect role 
Overrides some facts to add compatibility with unreleased Debian version
5c1ae6ed0c spamassassin: change dependency on evomaintenance 
Fail with an error if evomaintenance config is missing
instead of trying to install a package that doesn't exist anymore.
continuous-integration/drone/push Build is passing Details
04e41b5dc9 squid: improve default whitelist
continuous-integration/drone/push Build is passing Details
continuous-integration/drone/pr Build is failing Details
d1829e7000 metricbeat: fix indentation
continuous-integration/drone/push Build is passing Details
ba3ed5e903 Merge branch 'bullseye' into unstable
continuous-integration/drone/push Build is passing Details
continuous-integration/drone/pr Build is failing Details
6f66ab8e93 Merge branch 'unstable' into bullseye
continuous-integration/drone/push Build is passing Details
continuous-integration/drone/pr Build is failing Details
29ec7bdcf2 Remove embedded GPG keys only if legacy keyring is present
continuous-integration/drone/push Build is passing Details
c77e0d73f8 Merge branch 'bullseye' into unstable
49cb5adf92 evolinux-base: Fix hw card detect 
Run the shell command as bash instead of sh; otherwise it will fail because of the set -o pipefail
7a089f88af Correct typo in var name 
trusted_gpg_keyring.stat.present instead of _trusted_gpg_keyring.stat.present
continuous-integration/drone/push Build is passing Details
8e6c08b81b evolinux-base: Change the pattern of MegaRAID detect 
Seems the card names may somethings between 'MegaRAID' and 'SAS'
I'll take the short and easy path as I think MegaRAID is enough in most cases
continuous-integration/drone/push Build is failing Details
73352f55d7 evolinux-base: add tags to hardawre tasks
continuous-integration/drone/push Build is passing Details
32b5efa30e evocheck: upstream release 21.07
continuous-integration/drone/push Build is passing Details
491407953c We want LDAP listen on ldapi:/// by default
continuous-integration/drone/push Build is passing Details
ad457dd7ba apt: use the new security repository for Bullseye
continuous-integration/drone/push Build is passing Details
066baf3538 Revert "bullseye-detect: this role is obsolete, Debian 11 has been fully released" 
This reverts commit c9f25f4638.
continuous-integration/drone/push Build is passing Details
42189ba613 Configure php7.4 for evoadmin-web on bullseye
continuous-integration/drone/push Build is passing Details
continuous-integration/drone/pr Build is failing Details
2448168008 evolinux-base: Add swap column to htop and top
continuous-integration/drone/push Build is passing Details
bd92ff95c8 use absolute path in evacme cron
7b14296503 etc-git: optimize maintenance tasks 
* manage commits with an optimized shell script instead of many slow Ansible tasks
* centralize cron jobs in dedicated crontab
a6fe0397a6 etc-git: back to 2 tasks for each commit 
"test X && git commit" generates a failure and a lot of noise.
73d6979e72 Various changes on mongodb (support 5.0) + fixes & compatibility 
* mongodb: Deny the install on Debian 11 « Bullseye » when the version is unsupported
* mongodb: Support version 5.0 (for buster)
* mongodb: Allow to specify a mongodb version for buster & bullseye
* mongodb: Add missing remount-usr for munin plugins
d38119eb0f nginx : fix variable name and debug 
nginx_minimal defined the nginx_package_name_default variable which was not
used instead of the nginx_default_package_name variable

also fixed debug which was reversed, and add another one to be sure which mode
is used
72e8200d5b kvm-host: reorganize code for kvmstats 
* add -V|--version flag
* add -h|--help flag
* normalize options parsing
continuous-integration/drone/push Build is failing Details
e4bb0c6f55 filebeat/metricbeat: version 7.x y default
continuous-integration/drone/push Build is failing Details
4fb885a33b Fix right for redis log dir and log file
continuous-integration/drone/push Build is failing Details
21bd4021d3 add virsh list --all on kvm host and this neighbor
continuous-integration/drone/push Build is failing Details
8dca949564 Add *xml to crontab for sync libvirt xml file
continuous-integration/drone/push Build is failing Details
a35139fcee Add missing sudoers line (for old debian 9)
continuous-integration/drone/push Build is failing Details
82694ef5e9 generate-ldif: Don't miss detect deb11 as VM
continuous-integration/drone/pr Build is failing Details
d3eef71127
nagios-nrpe: Fix check_nfsserver for buster and bullseye 
From buster onward the nfs server doesn't run NFSv4 over UDP (it is out
of spec, see RFC 7530). As such the check broke as it attempt to check
the availability of NFSv4 over UDP.

Right now the check doesn't check for NFSv2 over UDP as it would need to
check if it exist first, as on bullseye it isn't supported by default
anymore.
continuous-integration/drone/push Build is failing Details
cd7c488713 Add rule .well-know to allow letsencrypt challenge
continuous-integration/drone/push Build encountered an error Details
d27d6b69cd evolinux-base: Add missing dependency dmidecode
continuous-integration/drone/push Build encountered an error Details
64b632c000 evolinux-base: Donner le choix (ou non) de virer apt-listchanges
continuous-integration/drone/push Build encountered an error Details
7c7ccf07eb generate-ldif: fix typo in var name (cap)
continuous-integration/drone/push Build encountered an error Details
7bb7b22d1f Add redirectMath 404 on http request /.git by default
continuous-integration/drone/push Build encountered an error Details
1c754f7eb0 Fix Filebeat role for --check mode.
continuous-integration/drone/push Build was killed Details
ec346a42a5 munin: systemd override to unprotect home directory
continuous-integration/drone/push Build was killed Details
1893b6dea5 don't enable alert5 service in check mode
continuous-integration/drone/push Build was killed Details
4c6d30a52c apache: block access to .git* and .env* files
continuous-integration/drone/push Build was killed Details
bd39adaf68 Fail if /var has nodev or noexec option enabled.
continuous-integration/drone/push Build was killed Details
ea382a1686 varnish: add additional options
continuous-integration/drone/push Build was killed Details
c8a862c5e7 nagios-nrpe: Amélioration du check phpfpm_status et phpfpm_multi 
Pour phpfpm_status > Ajout de la possibilité d'avoir un seuil de max procs actifs
Pour phpfpm_multi > Utilisation des seuils max (calculé sur le pm.max_children) + timeout
continuous-integration/drone/push Build was killed Details
c4fab71d7a evolinux-base: add new states to backup-server-states
continuous-integration/drone/push Build was killed Details
168b0fa9b7 nginx: Add snippet for custom server block config.
continuous-integration/drone/push Build was killed Details
4effe91b9f Write an openvpn role
continuous-integration/drone/push Build was killed Details
3822696db6 Update CHANGELOG for new openvpn role
continuous-integration/drone/push Build was killed Details
fec9e49c18
Repair munin role
continuous-integration/drone/pr Build was killed Details
1902c40c3c
lxc-php: Fix config for opensmtpd on bullseye
continuous-integration/drone/push Build was killed Details
1f4ee2de79 Prepare CHANGELOG for 22.01 release
continuous-integration/drone/push Build was killed Details
continuous-integration/drone/pr Build was killed Details
8f8c024163 Merge branch 'unstable' into bullseye-swap-top
continuous-integration/drone/push Build was killed Details
93929864be lxc-php: use bullseye-php80 for php80 container
continuous-integration/drone/push Build was killed Details
continuous-integration/drone/pr Build was killed Details
bff8fcfebb apt: upgrade packages after all the configuration is done
jlecour merged commit 2c6a3601de into stable 2022-01-25 18:30:09 +01:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug

Something is not working

  
duplicate

This issue or pull request already exists

  
enhancement

New feature

  
help wanted

Need some help

  
invalid

Something is wrong

  
question

More information is needed

  
security

Concern a security issue

  
wontfix

This won't be fixed

No Label
bug
duplicate
enhancement
help wanted
invalid
question
security
wontfix
Milestone
Clear milestone
No items
No Milestone
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: evolix/ansible-roles#142
No description provided.
Delete Branch "unstable"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?