Add manual trigger for Molecule test workflow (#97)

Author: aknot242

.github/workflows/molecule.yml

@@ -11,6 +11,7 @@ on:
       - "*"
   schedule:
     - cron: "0 0 1 * *"
+  workflow_dispatch:
 jobs:
   molecule:
     name: Molecule

CHANGELOG.md

@@ -14,21 +14,22 @@ DEPRECATION WARNINGS:
 
 FEATURES:
 
-Implement Release Drafter.
+*   Implement Release Drafter.
+*   Add warning re having to install NGINX Plus beforehand on Alpine distros if NGINX Plus releases a security patch.
 
 ENHANCEMENTS:
 
 *   Changing the default policy directory from `/etc/nginx` to `/etc/app_protect/conf` to align with this change introduced in App Protect 3.2.
 *   Update Ansible base to `2.10.8`, Ansible Lint to `5.0.7`, yamllint to `1.26.1` and Docker Python SDK to `5.0.0`.
 *   Update the Ansible `community.general` collection to `3.0.2` and `community.docker` collection to `1.6.0`.
+*   Update GitHub actions to add a workflow dispatch option.
 
 ## 0.4.3 (April 6, 2020)
 
 BREAKING CHANGES:
 
 The `nginx_app_protect_version` variable has been removed, as it cannot be implemented fully on all platforms.
 
-
 FEATURES:
 
 *   Add support for Dependabot.

README.md

@@ -70,6 +70,8 @@ Ubuntu:
   - 20.04
 ```
 
+**Note:** Due to a packaging limitation in NGINX App Protect on Alpine, it may be required to explicitly install NGINX Plus on the instance **before** using the NGINX App Protect role if a hotfix version of NGINX Plus has been published. It is recommended to use the [NGINX Core](https://galaxy.ansible.com/nginxinc/nginx_core) Ansible role for this purpose.
+
 ## Role Variables
 
 This role has multiple variables. The descriptions and defaults for all these variables can be found in the **[`defaults/`](https://github.com/nginxinc/ansible-role-nginx-app-protect/blob/main/defaults/)** folder in the following files:

molecule/advanced/prepare.yml

@@ -17,6 +17,22 @@
         force: false
         mode: 0444
 
+- name: Install NGINX Plus on Alpine
+  hosts: nap
+  tasks:
+    - name: Set up NGINX Plus on Alpine for NAP 3.2 issue workaround (remove in versions > 3.2)
+      include_role:
+        name: nginxinc.nginx
+      vars:
+        nginx_enable: true
+        nginx_start: true
+        nginx_type: plus
+        nginx_remove_license: false
+        nginx_license:
+          certificate: ../../files/license/nginx-repo.crt
+          key: ../../files/license/nginx-repo.key
+      when: ansible_os_family == "Alpine"
+
 - name: Set up rsyslog server for verifying NAP syslog events
   hosts: nap
   tasks:

molecule/advanced/requirements.yml

@@ -2,3 +2,5 @@
 roles:
   - name: robertdebock.rsyslog
     version: 3.2.0
+  - name: nginxinc.nginx
+    version: 0.19.2

molecule/default/molecule.yml

@@ -1,4 +1,8 @@
 ---
+dependency:
+  name: galaxy
+  options:
+    role-file: molecule/default/requirements.yml
 driver:
   name: docker
 lint: |

molecule/default/prepare.yml

@@ -16,3 +16,19 @@
         dest: ../../files/license/nginx-repo.key
         force: false
         mode: 0444
+
+- name: Install NGINX Plus on Alpine
+  hosts: all
+  tasks:
+    - name: Set up NGINX Plus on Alpine for NAP 3.2 issue workaround (remove in versions > 3.2)
+      include_role:
+        name: nginxinc.nginx
+      vars:
+        nginx_enable: true
+        nginx_start: true
+        nginx_type: plus
+        nginx_remove_license: false
+        nginx_license:
+          certificate: ../../files/license/nginx-repo.crt
+          key: ../../files/license/nginx-repo.key
+      when: ansible_os_family == "Alpine"

molecule/default/requirements.yml

@@ -0,0 +1,4 @@
+---
+roles:
+  - name: nginxinc.nginx
+    version: 0.19.2

molecule/specific-version/molecule.yml

@@ -1,4 +1,8 @@
 ---
+dependency:
+  name: galaxy
+  options:
+    role-file: molecule/default/requirements.yml
 driver:
   name: docker
 lint: |

molecule/specific-version/prepare.yml

@@ -16,3 +16,19 @@
         dest: ../../files/license/nginx-repo.key
         force: false
         mode: 0444
+
+- name: Install NGINX Plus on Alpine
+  hosts: all
+  tasks:
+    - name: Set up NGINX Plus on Alpine for NAP 3.2 issue workaround (remove in versions > 3.2)
+      include_role:
+        name: nginxinc.nginx
+      vars:
+        nginx_enable: true
+        nginx_start: true
+        nginx_type: plus
+        nginx_remove_license: false
+        nginx_license:
+          certificate: ../../files/license/nginx-repo.crt
+          key: ../../files/license/nginx-repo.key
+      when: ansible_os_family == "Alpine"