Skip to content

Commit 838e756

Browse files
alessfgalessfg
authored
Improve support for listen and ssl directives in stream contexts (#287)
1 parent 730ab15 commit 838e756

File tree

4 files changed

+174
-120
lines changed

4 files changed

+174
-120
lines changed

‎CHANGELOG.md

Lines changed: 105 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -6,27 +6,49 @@ BREAKING CHANGES:
66

77
* The Debian and Ubuntu repositories have slightly changed. You may run into some duplication issues when running the role on a preexisting target that already has had NGINX installed using the role. To fix this, manually remove the old repository source.
88
* If you use `custom_options` you will now need to manually end each directive with a semicolon.
9+
* The listen directive structure in the `stream` template has been updated to the listen directive structure found in the `http` template. You can now specify multiple `listen` directives in the same `server` block as well as include any extra `listen` options you might need.
10+
11+
Old configuration example
12+
```yaml
13+
listen_address: localhost
14+
listen_port: 80
15+
udp_enable: false
16+
```
17+
18+
New configuration example
19+
```yaml
20+
listen:
21+
listen_localhost:
22+
ip: 0.0.0.0 # Wrap in square brackets for IPv6 addresses
23+
port: 80
24+
ssl: false
25+
opts: [] # Listen opts like udp which will be added (ssl is automatically added if you specify 'ssl:').
26+
```
27+
28+
The one major change is that instead of using `udp_enable: true` you will now need to use `opts: [udp]` if you wish to enable `udp`.
929

1030
FEATURES:
1131

12-
* Add support to configure logrotate
13-
* Add support for Ubuntu Focal
14-
* Add support to configure SELinux
15-
* Two new variables have been introduced -- `nginx_install` and `nginx_configure` -- to let you choose whether you want to install NGINX, configure NGINX, or both
32+
* Add support to configure logrotate.
33+
* Add support for Ubuntu Focal.
34+
* Add support to configure SELinux.
35+
* Two new variables have been introduced -- `nginx_install` and `nginx_configure` -- to let you choose whether you want to install NGINX, configure NGINX, or both.
1636

1737
ENHANCEMENTS:
1838

19-
* The role now uses `include_tasks` instead of `import_tasks` when possible to speed up the role's execution time
39+
* Molecule tests using Testinfra have been migrated to use Ansible instead.
40+
* The role now uses `include_tasks` instead of `import_tasks` when possible to speed up the role's execution time.
2041
* Improve configuration templating capabilities:
21-
* Add support for unix upstreams
22-
* Add PID templating option
23-
* Add support for down parameter in upstreams
24-
* Add option for custom error pages
42+
* Add support for unix upstreams.
43+
* Add PID templating option.
44+
* Add support for down parameter in upstreams.
45+
* Add option for custom error pages.
46+
* Add SSL support to `stream` contexts.
2547

2648
BUG FIXES:
2749

28-
* `nginx_debug_output` would sometimes fail if the NGINX had not been automatically started by the system upon installation
29-
* If `http_demo_conf` was undefined the web server template interpolation would fail
50+
* `nginx_debug_output` would sometimes fail if NGINX had not been automatically started by the system upon installation.
51+
* If `http_demo_conf` was undefined the web server template interpolation would fail.
3052

3153
## 0.14.0 (April 22, 2020)
3254

@@ -38,15 +60,15 @@ BREAKING CHANGES:
3860

3961
FEATURES:
4062

41-
* Install/build NGINX from source options now available
42-
* Implement NGINX http sub module templating
43-
* NGINX config is now correctly validated each run
44-
* SSL Private Key data is hidden when running the role with the --diff flag
63+
* Install/build NGINX from source options now available.
64+
* Implement NGINX http sub module templating.
65+
* NGINX config is now correctly validated each run.
66+
* SSL Private Key data is hidden when running the role with the `--diff` flag.
4567

4668
BUG FIXES:
4769

48-
* The role should no longer sporadically cause apt update to fail in amd64 systems when installing NGINX from an official repository
49-
* Modules should now correctly install when using a specific NGINX Plus version
70+
* The role should no longer sporadically cause apt update to fail in amd64 systems when installing NGINX from an official repository.
71+
* Modules should now correctly install when using a specific NGINX Plus version.
5072

5173
## 0.13.0 (December 13, 2019)
5274

@@ -58,163 +80,163 @@ BREAKING CHANGES:
5880
FEATURES:
5981

6082
* Improve NGINX http templating:
61-
* Multiple server support in HTTP contexts
62-
* Header support
63-
* OCSP stapling
64-
* Improved proxy settings
65-
* Logging settings
66-
* Improved SSL settings
67-
* Improved authentication settings
68-
* Max body size support
69-
* Improved listen templating
70-
* Switch to Molecule for testing
71-
* Add support for Debian Buster
72-
* Support for specifying which version of NGINX to install
73-
* Split default variables into multiple functional files
74-
* Improve support for Alpine distributions
75-
* Support for updating or removing NGINX from your system
76-
* Implemented tags to support running specific tasks instead of the whole role
83+
* Multiple server support in HTTP contexts.
84+
* Header support.
85+
* OCSP stapling.
86+
* Improved proxy settings.
87+
* Logging settings.
88+
* Improved SSL settings.
89+
* Improved authentication settings.
90+
* Max body size support.
91+
* Improved listen templating.
92+
* Switch to Molecule for testing.
93+
* Add support for Debian Buster.
94+
* Support for specifying which version of NGINX to install.
95+
* Split default variables into multiple functional files.
96+
* Improve support for Alpine distributions.
97+
* Support for updating or removing NGINX from your system.
98+
* Implemented tags to support running specific tasks instead of the whole role.
7799

78100
BUG FIXES:
79101

80-
* Module installation when using NGINX Plus has been fixed
81-
* Websockets templating has been reenabled after being accidentally deleted
102+
* Module installation when using NGINX Plus has been fixed.
103+
* Websockets templating has been reenabled after being accidentally deleted.
82104
* When deleting your NGINX Plus license from the system, the NGINX Plus repository will also be deleted to prevent issues further down the line if you run a repository update since there will not be a license anymore to authenticate into the NGINX Plus repository.
83105

84106
## 0.12.0 (May 22, 2019)
85107

86108
FEATURES:
87109

88110
* Improve NGINX http templating - following parameters are now supported:
89-
* Websockets
90-
* Basic authentication
91-
* Proxy cache
92-
* Proxy redirect
93-
* Proxy timeouts
94-
* SSL
95-
* Root (in server context)
96-
* Add basic NGINX stream templating
97-
* Add support for RHEL 8 and Alpine Linux
111+
* Websockets.
112+
* Basic authentication.
113+
* Proxy cache.
114+
* Proxy redirect.
115+
* Proxy timeouts.
116+
* SSL.
117+
* Root (in server context).
118+
* Add basic NGINX stream templating.
119+
* Add support for RHEL 8 and Alpine Linux.
98120

99121
BUG FIXES:
100122

101-
* Fix module installation tasks
123+
* Fix module installation tasks.
102124

103125
## 0.11.0 (Januray 14, 2019)
104126

105127
FEATURES:
106128

107-
* Allow setting a custom apt and rpm signing key host
108-
* Add support for enabling an http to https redirects
109-
* Add ansible_managed to templates
110-
* Rename html_app_name to web_server_name
111-
* Rename load_balancer block to reverse_proxy
112-
* Allow setting the listen port when using SSL
113-
* Improve SSL defaults
114-
* Allow setting http or https server locations in proxy_pass
129+
* Allow setting a custom apt and rpm signing key host.
130+
* Add support for enabling an http to https redirects.
131+
* Add ansible_managed to templates.
132+
* Rename html_app_name to web_server_name.
133+
* Rename load_balancer block to reverse_proxy.
134+
* Allow setting the listen port when using SSL.
135+
* Improve SSL defaults.
136+
* Allow setting http or https server locations in proxy_pass.
115137

116138
BUG FIXES:
117139

118-
* Ignore undefined values for autoindex and health check
119-
* Clarify that the redirect variable refers to a http to https redirect
140+
* Ignore undefined values for autoindex and health check.
141+
* Clarify that the redirect variable refers to a http to https redirect.
120142

121143
## 0.10.1 (November 26, 2018)
122144

123145
BUG FIXES:
124146

125-
* Fix HTML template to use correct variable name
147+
* Fix HTML template to use correct variable name.
126148

127149
## 0.10.0 (November 26, 2018)
128150

129151
FEATURES:
130152

131-
* Improve templating support for health checks, multiple location blocks, and auto indexing
153+
* Improve templating support for health checks, multiple location blocks, and auto indexing.
132154

133155
BUG FIXES:
134156

135-
* Fetching the NGINX signing key is now more reliable
136-
* Fixed HTML templating
157+
* Fetching the NGINX signing key is now more reliable.
158+
* Fixed HTML templating.
137159

138160
## 0.9.0 (October 18, 2018)
139161

140162
FEATURES:
141163

142-
* Refactor NGINX templating and file uploading
143-
* Add ability to upload and template HTML files
144-
* Add ability to upload SSL keys and certificates
164+
* Refactor NGINX templating and file uploading.
165+
* Add ability to upload and template HTML files.
166+
* Add ability to upload SSL keys and certificates.
145167

146168
## 0.8.0 (September 17, 2018)
147169

148170
FEATURES:
149171

150-
* Add ability to install NGINX Plus Controller agent
151-
* Refactor installation of NGINX Amplify agent
152-
* Rename variables to be prefixed with `nginx_`
172+
* Add ability to install NGINX Plus Controller agent.
173+
* Refactor installation of NGINX Amplify agent.
174+
* Rename variables to be prefixed with `nginx_`.
153175

154176
BUG FIXES:
155177

156-
* Correct spelling of name in `tasks/prerequisites/setup-debian.yml`
178+
* Correct spelling of name in `tasks/prerequisites/setup-debian.yml`.
157179

158180
## 0.7.1 (August 21, 2018)
159181

160182
FEATURES:
161183

162-
* Add enabled parameter to NGINX and NGINX Unit handlers
184+
* Add enabled parameter to NGINX and NGINX Unit handlers.
163185

164186
## 0.7.0 (August 4, 2018)
165187

166188
FEATURES:
167189

168-
* Add Amazon Linux 2 support for NGINX Plus
169-
* Add ability to delete NGINX Plus license after installation
190+
* Add Amazon Linux 2 support for NGINX Plus.
191+
* Add ability to delete NGINX Plus license after installation.
170192

171193
BUG FIXES:
172194

173-
* GeoIP module can now be properly installed
174-
* Module installation will no longer fail if only one module is specified
195+
* GeoIP module can now be properly installed.
196+
* Module installation will no longer fail if only one module is specified.
175197

176198
## 0.6.0 (July 19, 2018)
177199

178200
FEATURES:
179201

180-
* Improve NGINX Unit related documentation
181-
* Add FreeBSD and Amazon Linux 2 support for NGINX Unit
182-
* Allow users to install NGINX Unit without having to also install NGINX
202+
* Improve NGINX Unit related documentation.
203+
* Add FreeBSD and Amazon Linux 2 support for NGINX Unit.
204+
* Allow users to install NGINX Unit without having to also install NGINX.
183205

184206
## 0.5.0 (June 28, 2018)
185207

186208
FEATURES:
187209

188-
* Add support for NGINX Unit
210+
* Add support for NGINX Unit.
189211

190212
## 0.4.0 (May 25, 2018)
191213

192214
FEATURES:
193215

194-
* Implement support for FreeBSD
195-
* Allow users to select the default NGINX repository
216+
* Implement support for FreeBSD.
217+
* Allow users to select the default NGINX repository.
196218

197219
## 0.3.0 (April 19, 2018)
198220

199221
FEATURES:
200222

201-
* Improve Travis CI testing strategy
223+
* Improve Travis CI testing strategy.
202224

203225
BUG FIXES:
204226

205-
* Fix templating and push tasks
227+
* Fix templating and push tasks.
206228

207229
## 0.2.0 (April 12, 2018)
208230

209231
FEATURES:
210232

211-
* Add support for all first party NGINX modules
233+
* Add support for all first party NGINX modules.
212234

213235
BUG FIXES:
214236

215-
* Role should now work correctly in distros with old versions of Python
216-
* Rest API configuration will now only be created when rest_api_enable is set to true (an empty file would be created in previous versions if rest_api_enable was set to false)
217-
* Uploading/dynamically generating files should now result in the files being uploaded/created to/in the correct directory
237+
* Role should now work correctly in distros with old versions of Python.
238+
* Rest API configuration will now only be created when rest_api_enable is set to true (an empty file would be created in previous versions if rest_api_enable was set to false).
239+
* Uploading/dynamically generating files should now result in the files being uploaded/created to/in the correct directory.
218240

219241
## 0.1.0 - Initial release (Januray 26, 2018)
220242

‎defaults/main/template.yml

Lines changed: 34 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,21 @@ nginx_http_template:
7575
port: 8081
7676
ssl: true
7777
opts: [] # Listen opts like http2 which will be added (ssl is automatically added if you specify 'ssl:').
78+
ssl:
79+
cert: /etc/ssl/certs/default.crt
80+
key: /etc/ssl/private/default.key
81+
dhparam: /etc/ssl/private/dh_param.pem
82+
protocols: TLSv1 TLSv1.1 TLSv1.2
83+
ciphers: HIGH:!aNULL:!MD5
84+
prefer_server_ciphers: true
85+
session_cache: none
86+
session_timeout: 5m
87+
disable_session_tickets: false
88+
trusted_cert: /etc/ssl/certs/root_CA_cert_plus_intermediates.crt
89+
stapling: true
90+
stapling_verify: true
91+
buffer_size: 16k
92+
ecdh_curve: auto
7893
server_name: localhost
7994
include_files: []
8095
http_error_pages: {}
@@ -106,21 +121,7 @@ nginx_http_template:
106121
# name: Header-X
107122
# value: Value-X
108123
# always: false
109-
ssl:
110-
cert: /etc/ssl/certs/default.crt
111-
key: /etc/ssl/private/default.key
112-
dhparam: /etc/ssl/private/dh_param.pem
113-
protocols: TLSv1 TLSv1.1 TLSv1.2
114-
ciphers: HIGH:!aNULL:!MD5
115-
prefer_server_ciphers: true
116-
session_cache: none
117-
session_timeout: 5m
118-
disable_session_tickets: false
119-
trusted_cert: /etc/ssl/certs/root_CA_cert_plus_intermediates.crt
120-
stapling: true
121-
stapling_verify: true
122-
buffer_size: 16k
123-
ecdh_curve: auto
124+
124125
sub_filter:
125126
# sub_filters: []
126127
last_modified: "off"
@@ -342,9 +343,24 @@ nginx_stream_template:
342343
conf_file_location: /etc/nginx/conf.d/stream/
343344
network_streams:
344345
default:
345-
listen_address: localhost
346-
listen_port: 80
347-
udp_enable: false
346+
listen:
347+
listen_localhost:
348+
ip: 0.0.0.0 # Wrap in square brackets for IPv6 addresses
349+
port: 80
350+
ssl: false
351+
opts: [] # Listen opts like udp which will be added (ssl is automatically added if you specify 'ssl:').
352+
ssl:
353+
cert: /etc/ssl/certs/default.crt
354+
key: /etc/ssl/private/default.key
355+
dhparam: /etc/ssl/private/dh_param.pem
356+
protocols: TLSv1 TLSv1.1 TLSv1.2
357+
ciphers: HIGH:!aNULL:!MD5
358+
prefer_server_ciphers: true
359+
session_cache: none
360+
session_timeout: 5m
361+
disable_session_tickets: false
362+
trusted_cert: /etc/ssl/certs/root_CA_cert_plus_intermediates.crt
363+
ecdh_curve: auto
348364
include_files: []
349365
proxy_pass: backend
350366
proxy_timeout: 3s

0 commit comments

Comments
 (0)