Release 24.02 #174

Closed

jlecour wants to merge 0 commits from unstable into stable

pull from: unstable

merge into: evolix:stable

evolix:stable

evolix:patroni

evolix:etcd

evolix:jitsimeet

evolix:monitoringctl

evolix:bind

evolix:peertube

evolix:wip_10691

evolix:multi-php-v2

evolix:etherpad

evolix:gitea

evolix:add-drbd-firewall-rule

evolix:backports_preferences

evolix:migrate-vm-error-handling

evolix:evofs

evolix:goto-postfix-role

evolix:lxc-php82

evolix:timesyncd

evolix:noopensshinlxc

evolix:ssh-split

evolix:rsyslog-remote

evolix:emorino/patroni-etcd

evolix:jitsimeet_docker

evolix:hedgedoc

evolix:privatebin

evolix:mattermost

evolix:p10166-mastodon

evolix:replace_include

evolix:when-not-check

evolix:fix_lxc_php56_debian10

evolix:debian12

evolix:boost-proxy

evolix:debian12-keyring

evolix:evodomains

evolix:vrrp-addresses

evolix:lxc_etc-git

evolix:lxc_etc-commit

evolix:evoacme-v2

evolix:sshd_modular_config

evolix:exclusion_images_evobackup

evolix:rotate_elasticsearch_logs

evolix:evobackup_tags_redux

evolix:log2mail-beats

evolix:T47076

evolix:kvm-guest

evolix:lpoujol/fpm-php

evolix:lxc-php-buster

evolix:simplify-evolinux-users

evolix:openvpn

evolix:newkernel

evolix:etc-git-status-script

evolix:ubuntu

evolix:nagios-sudoers

evolix:configurable-swapiness

evolix:alert5-minifirewall-restart

evolix:fail2ban_ips_tag

evolix:audit-ftpadmin

evolix:projet6062

evolix:whitelisting-changes

evolix:uvrrpd

evolix:packweb-apache-lxc

evolix:backup/jlecour/ssh-groups

evolix:nextcloud

evolix:backup/jlecour/nextcloud

evolix:evoadmin-mail

evolix:haproxy_munin

evolix:evolinux-users

evolix:ansible-log

evolix:ansible-managed

evolix:apache-fix-default-vhost

evolix:ipsec

evolix:courier

evolix:spamassassin

evolix:samba

evolix:munin-openbsd

Conversation 0 Commits - Files changed -

jlecour commented 2024-02-05 19:08:02 +01:00

Owner

Copy link

No description provided.

jlecour added 130 commits 2024-02-05 19:08:05 +01:00

679e170dce evolinux-base: use separate default config file for rsyslog

ab30ea4cde

nginx: keep indentation

03c09dc092 evoadmin-web: Fix PHP version for Bookworm

b05fa5a779 Add php-fpm82 to LDAP when relevant

1259b88588 php83: preliminary work

45436d77b1 evocheck: upstream release 23.10

953ca015c5 Changelog entries for latest changes

331f4e8875 Revert "php83: preliminary work" ...

This reverts commit 1259b88588.

74a6b2ead1 nagios-nrpe: add check_sentinel

bc284f8248 add-vm.sh: allow VM name max length > 20

c9c8ade55d nagios: fix default file to monitor for check_clamav_db

41ec5b737b nagios: rename var into and check systemd-timesyncd instead of ntpd in Debian 12

009de62e28 webapps/nextcloud Added var nextcloud_user_uid to enforce uid for nextcloud user

aab3381887 webapps/nextcloud: fix missing gid

6ae9e04f27 webapps/nextcloud: fix misplaced gid attr and added check for nexctcloud uid

c97e94bfe7

use ternary syntax for readability (subjective)

b77845cc8c php: Bullseye/Sury > Honor the php_version asked in the pub.evolix.org repository

4a6e6e6ba2 ProFTPd: in SFTP vhost, enable SSH keys login, enable ed25549 host key

1394052fd6 ProFTPd: set missing default listen IP for SFTP, enable ed25525549 key only for Debian >= 11

b1a67d1a5c apache : fix goaway pattern for bad bots

ac72c7ac31 apache: fix MaxRequestsPerChild value to be sync with wiki.e.o

0578d5a3ec apache : rename MaxRequestsPerChild to MaxConnectionsPerChild (new name)

a5e4359d0e #73871 ssl: no not execute haproxy tasks and reload if haproxy is disabled

642fbb1ea4

evolinux-base: dump-server-state upstream release 23.11

83c178f244

log2mail: move custom config in separate file

00fad357b5

use ternary condition (more readable)

71ed4c4c8c

shell syntax

f01e7453fb

no need to symlink backup-server-state to dump-server-state anymore

4cba25d8fc

evolinux-base: no need to remove update-evobackup-canary from sbin anymore

8993242b2c bind: /etc/default/bind9 has been renamed as /etc/default/named ...

Since Bullseye (Debian 11)

c71521acc3 bind: Adapt chroot-bind for Buster

7ad55027da bind: Adapt apparmor rules as in https://wiki.debian.org/Bind9

9cedf84dae bind: Group accessibility for /var/chroot-bind

3bd87906ce bind: Adapt chroot-bind for Bookworm

33d22b2614 bind: Bind mount for Bookworm

96d15eb5aa Changelog entry for bind changes

736ed26036 lxc-php: Add variable 'lxc_php_container_name'

239065bf36 kvm-host: Fix regression on old Debian

95aeb9a68e Fix bind changelog entry

2c86660e52 evocheck: upstream release 23.11

c93748487b evocheck: upstream release 23.11.1

892067cf2b kvmstats: use .capacity instead of .physical for disk size

cb03831ae8 lxc-php: Fix lxc_php_container_name

8f1fa57c37 evocheck: report “IS_ETCGIT_LXC, IS_GITPERMS_LXC: fix path”

69bc93ff6e lxc: Init /etc git repository in lxc container ...

Note: ugly loop, but “it works”…

e5f5425f6d lxc-php: Allow one to install php83 on Bookworm container

f9125b8f3f

whitespace

9e3e20e3a8

evolinux-base: move htop/top config to different task file

81d97bb3fb

vrrpd: variable to force update the switch script (default: false)

06c47493e9

sort changelog

83e61b25a5 etc-git: add /var/chroot-bind/etc/bind repo

1a74bef0bc check stat.exists before stat.isdir

fba894cad9 etc-git: create /var/chroot-bind/etc/bind GIT repo also in jessie

0ca31b91fe

fix(certbot): Fix hook for dovecot (too strict) ...

When we use a separate certificate for POP3 and IMAP there might be
blank characters (almost certainly spaces but might as well be more lax)
before `ssl_cert` which resulted in these lines not being detected and
the hook not being played, forcing manual intervention.

This commit fixes that problem by accepting blank characters before
ssl_certs. (`\b` might be even better...)

59afbb2e9a apt: Stretch has been archived

4d9e1af40f evolinux-base: Don’t try to install unavailable linux-image-cloud-amd64 before Buster

b8732dffaf Changelog for previous changes

066a66eb4b [minor] drop extra line

9867dcb319 Retrait debug

c861fe1974 etc-git: add /var/chroot-bind/etc/bind to Git safe directories to avoid owner check by Git (bind owns the repo, not root)

ae79f33e3a

fix: search/replace error

57ce920d7f scripts munin pour les stats sur les pools

de949fd348 Fix timesyncd template

43aff50891 webapps/nextcloud: Ajouter volume dans fstab

31826b9ee5 webapps/nextcloud: Set owner and mode once mounted

c9e8b6c4e1 dovecot: Munin plugin conf path is now /etc/munin/plugin-conf.d/zzz-dovecot (instead of z-evolinux-dovecot)

4d7de89ad4 webapps/nextcloud: Add condition for config tasks ...

And update CHANGELOG

cbc51c462a fix Add Ceph volume to fstab : missing UUID= in src

e32e1c5496 Unbound: Big update & enhancements ...

* Move configuration generated to /etc/unbound/unbound.conf.d/evolinux.conf so we don't override default config file
* Make use of root hints provided by dns-root-data instead of downloading them
* Add configuration to ensure that configuration reload work out of the box on Debian11 and old
* Add required configuration in Unbound and munin to allow tge plugin to work
* Make ansible-lint a bit more happy

c90afcb4f4

apt: fix Jessie repository

66b69f1502 remount-usr: do not try to remount /usr RW if /usr is not a mounted partition

fb7218972f

squid: config directory seems to have changed from /etc/squid3 to /etc/squid in Debian 8

ca5d9d5202

mysql: use a boolean for read-only

db63902206

apt: use the GPG version of the key for Debian 8-9

6c0ca02391

apt: add task file to install ELTS repository (default: False)

a920d2d402

apt: Disable archive repository for Debian 8

26e3dc1be6

apache: use backward compatible Redirect directive

b0992bcaf9

mysql: disable performance schema for Debian 8

5f158e031b spamassin: Use spamd starting with Bookworm

95610e16be bind: allow bullseye and bookworm

0c09763e87

fix(minifirewall): Properly detect old minifirewall versions

9e67db57e5 evolinux-base: fix hardware.yml (wrong repo, missing update cache)

b4c9fcf6f7

mongodb: add gpg key for 7.0

62c596046d

Add role for automatically deploying autosysadmin

c0f27426bc

Merge branch 'unstable' of gitea.evolix.org:evolix/ansible-roles into unstable

70c2d25837 evolinux-base: Check for syntax error in cron.log

d4ac4ef7a1 nagios: cleaning nrpe check template

1eb5a47c71 nagios: add dockerd check in nrpe check template

4a1b94f55d unbound: Add a apt cache validity to enforce an apt update if needed

046f1411b3

vrrpd: test if interface exists before deleting it

d93eb2495b

sort CHANGELOG

c2de4b4cd1

kvm-host: Add LVM filter when needed

9fb635b45f webapps/evoadmin-mail: package installed via public.evolix.org/evolix repo starting with Bookworm ...

(H)acked-By: David Prévot <dprevot+git@evolix.fr>

1ac497282c evoadmin-mail: use fixed version for Ansible

41897f4c62 bind: improve reload script

0a590b6679 nginx: fix multiple fails in check mode

e089796c4c evocheck: upstream release 24.01

f5d5e84caf dovecot: fix plugin dovecot1

bf07ef74c3

nginx: take care of « already defined » and « not yet defined » server status suffix in check mode

c9df19e146

warning comment

bca5b9f28c

fail2ban: fix template marker

f3eb7a4981

listupgrade : old-kernel-removal.sh upstream release 24.01

72727a8332 nagios-nrpe: check_phpfpm_multi expand globing of args

422f007e9d php: drop apt_preferences(5) file for sury ...

It doesn’t work as expected, and all covered cases should already be
available from http://pub.evolix.org/evolix/dists/ (if
$release_name-phpXY is not available, $release should probably be fixed
or the correct suite added to the repository).

bceb3f5c27 php: drop apt_preferences(5) file for sury (changelog)

531b633d99 listupgrade: try and get rid of duplicate entries

f994e19946

vrrpd: fix typo in switch script

51280c586a

redis: manage config template inside a block ...

This allows to have a coherent block managed by Ansible and extra lines that won't be overwritten.
Eg. : automatically added lines for replication, sentinel groups…

0c17e4d8fc

sort CHANGELOG

bc19912b71 Revert "listupgrade: try and get rid of duplicate entries" ...

This reverts commit 531b633d99.

aa2593f34c Revert "listupgrade: No removal (especially of the just installed cron_file) needed" ...

This reverts commit 09f951de18.

30bd72614d listupgrade: Fix removal order

9b67202acc webapps/nextcloud: Add condition for archive tasks

251416f3e8 webapps/nextcloud: Set home directory's mode

68d9d3c47c minifirewall: do not open publicly ports except 22222

cce7280cd0 fail2ban: add script unban_ip

dae2a25f78 check_free_space: add role; evolinux-base: install check_free_space by default

b31aa53c81 apt: Improve check mode

d55b2b14bb evolinux-base: tfix

1924324c07 apt: No preferences needed for backports

e14408cb05 apt: follow up from previous commit

393c1f4ff1 add missing LDAP conf iterate_filter to exclude disabled accounts in users list

d67e2b122f nagios-nrpe, generateldif: new check_pressure_{cpu,io,mem}

4c9e4a30cc userlogrotate: Ensure we use a valid group name ...

Use user's primary group when user's name is not an existing group.

8741167a80 Revert last commit

de0a98d693 dovecot: fix missing default mails

9f530d78db evolinux-base: addd cert.sh, a small readonly openssl wrapper (testing, not deployed yet)

bc07010aa6 webapps/roundcube & evoadminmail: make roles more idempotent (were failing when played twice)

554bbaa36f roundcube: set default SMTP port to 25 instead of 587, which failed because of missing SSL conf (local connexion does not need SSL)

1f8738fbda postfix: move postfix installation from evolinux-base to postfix role, plus some refactoring ...

postfix:
* Move common packages installation in common.yml
* Replace ansible_fqdn by evolinux_fqdn, set postfix_slow_transport_include to false by default (only for packmails and packwebs)
* Remove dependency on evolinux_fqdn var
* Do not overwrite main.cf if it has been modified (except if postfix_force_main_cf)

evolinux-base:
* Move exim4 purge from evolinux-base to postfix role
* Call postfix role call after nagios role (dependency)

jlecour reviewed 2024-02-05 19:46:47 +01:00

jlecour left a comment

Author

Owner

Copy link

@whirigoyen For check_free_space and the cron configuration, we should use the appropriate Ansible module

@whirigoyen For check_free_space and the cron configuration, we should use the appropriate Ansible module

jlecour added 2 commits 2024-02-06 08:23:54 +01:00

63745c2697

apt: remove duplicate extension

112bc2133a

dovecot: combine similar tasks

jlecour added 1 commit 2024-02-06 08:34:43 +01:00

8dd9c64cbc

nagios-nrpe: multi-line list

jlecour added 1 commit 2024-02-06 08:40:17 +01:00

ff233b65a6

remove check-mode protection for handlers ...

handlers are not supposed to be executed in check-mode since no change should happen in check-mode.
If there is a corner case we should deal with it at the source, not at the handler level.

jlecour added 1 commit 2024-02-06 08:41:40 +01:00

12993a8d7c

vrrpd: configure minifirewall

jlecour added 1 commit 2024-02-06 08:42:37 +01:00

ba827b79d9

sort CHANGELOG

jlecour added 1 commit 2024-02-06 08:45:26 +01:00

8f86584605

nginx: different way of dealing with check-mode

jlecour added 1 commit 2024-02-06 08:46:59 +01:00

2768b3146f

nginx: simpler regex for settings

emorino added 1 commit 2024-02-06 10:30:14 +01:00

5df27a4bc5 Add variables for generate "ldap_suffix" in amavis role.

jlecour added 1 commit 2024-02-06 13:33:27 +01:00

75650032d4

postfix: default to evolinux_fqdn

jlecour added 1 commit 2024-02-06 13:59:43 +01:00

47d7141a66

evoadmin-mail: apt modules already knows how to download packages

whirigoyen added 1 commit 2024-02-07 11:32:49 +01:00

3bb29aa6ba proftpd: fix error when no SSH key is provided

jlecour added 2 commits 2024-02-07 15:38:41 +01:00

8af6cdc4d6

apache: create ip_whitelist file if missing

ef2e65287e

YAML header

jlecour added 2 commits 2024-02-07 15:43:45 +01:00

4fb49dd6c9

nginx: clarify intent regarding check mode

d401778024

remount-usr: back to a simpler implementation

jlecour added 1 commit 2024-02-07 16:01:52 +01:00

ae665ea178

spamassassin: optimize tasks

jlecour added 3 commits 2024-02-07 16:15:48 +01:00

fe5a61289b

whitespaces

0b859fd1a4

dovecot: add variables for LDAP

2e9b6c0680

amavis/ldap: make ldap_suffix mandatory

jlecour added 1 commit 2024-02-08 08:41:52 +01:00

eb3aac9d3e

update CHANGELOG

jlecour added 1 commit 2024-02-08 09:27:47 +01:00

d4fcc6f8f4

Release 24.02

jlecour closed this pull request 2024-02-08 09:50:07 +01:00

Pull request closed

Please reopen this pull request to perform a merge.

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

bug

Something is not working

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

help wanted

Need some help

  

invalid

Something is wrong

  

question

More information is needed

  

security

Concern a security issue

  

wontfix

This won't be fixed

No labels

bug

duplicate

enhancement

help wanted

invalid

question

security

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

3 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: evolix/ansible-roles#174

No description provided.