Remove Debian Stretch from supported platforms and temporarily install NGINX Plus R24 in Molecule tests (#130)

Author: alessfg

CHANGELOG.md

@@ -2,9 +2,14 @@
 
 ## 0.6.1 (Unreleased)
 
+KNOWN ISSUES:
+
+As of the latest NGINX Plus release, R25, NGINX App Protect will no longer install or work. The only workaround at this time is to install NGINX Plus R24 before attempting to install NGINX App Protect WAF/DoS. A fix is planned in NGINX App Protect 3.6, planned for release mid-October.
+
 ENHANCEMENTS:
 
-Update the Ansible `community.general` collection to `3.7.0`, `ansible.posix` collection to `1.3.0` and `community.docker` collection to `1.9.1`.
+* Remove Debian Stretch from the list of supported platforms for NAP (and from Molecule).
+* Update the Ansible `community.general` collection to `3.7.0`, `ansible.posix` collection to `1.3.0` and `community.docker` collection to `1.9.1`.
 
 BUG FIXES:
 

README.md

@@ -8,6 +8,8 @@
 
 This role installs and configures NGINX App Protect WAF or DoS for NGINX Plus on your target host.
 
+**Warning:** As of the latest NGINX Plus release, R25, NGINX App Protect will no longer install or work. The only workaround at this time is to install NGINX Plus R24 before attempting to install NGINX App Protect WAF/DoS. A fix is planned in NGINX App Protect 3.6, planned for release mid-October.
+
 **Note:** By default, this role will install NGINX App Protect WAF. To install NGINX App Protect DoS, you need to set the `nginx_app_protect_dos_enable` variable to `true`.
 
 **Note:** This role is still in active development. There may be unidentified issues and the role variables may change as development continues.

meta/main.yml

@@ -22,7 +22,6 @@ galaxy_info:
         - 7
     - name: Debian
       versions:
-        - stretch
         - buster
     - name: Ubuntu
       versions:

molecule/advanced/prepare.yml

@@ -36,18 +36,27 @@
       raw: nohup nginx </dev/null >/dev/null 2>&1 & sleep 1
       changed_when: false
 
-- name: Install NGINX Plus on Alpine
+- name: Install NGINX Plus R24 to avoid dependency issues
   hosts: nap
   tasks:
-    - name: Set up NGINX Plus on Alpine for NAP 3.2/3.3 issue workaround (remove in versions > 3.3)
+    - name: Set repo if Alpine
+      set_fact:
+        version: "=24-r2"
+      when: ansible_facts['os_family'] == "Alpine"
+    - name: Set repo if Debian
+      set_fact:
+        version: "=24-2~{{ ansible_facts['distribution_release'] }}"
+      when: ansible_facts['os_family'] == "Debian"
+    - name: Set repo if Red Hat
+      set_fact:
+        version: "-24-2.{{ (ansible_facts['distribution']=='Amazon') | ternary('amzn2', ('el' + ansible_facts['distribution_major_version'] | string)) }}.ngx"
+      when: ansible_facts['os_family'] == "RedHat"
+    - name: Install NGINX Plus R24 to avoid dependency issues
       include_role:
         name: nginxinc.nginx
       vars:
-        nginx_enable: true
-        nginx_start: true
         nginx_type: plus
-        nginx_remove_license: false
+        nginx_version: "{{ version }}"
         nginx_license:
           certificate: ../../files/license/nginx-repo.crt
           key: ../../files/license/nginx-repo.key
-      when: ansible_os_family == "Alpine"

molecule/advanced/requirements.yml

@@ -1,6 +1,6 @@
 ---
 roles:
   - name: nginxinc.nginx
-    version: 0.20.0
+    version: 0.21.1
   - name: robertdebock.rsyslog
     version: 3.2.0

molecule/default/molecule.yml

@@ -31,13 +31,6 @@ platforms:
     volumes:
       - "/sys/fs/cgroup:/sys/fs/cgroup:rw"
     command: "/usr/sbin/init"
-  - name: debian-stretch
-    image: debian:stretch-slim
-    dockerfile: ../Dockerfile.j2
-    privileged: true
-    volumes:
-      - "/sys/fs/cgroup:/sys/fs/cgroup:rw"
-    command: "/sbin/init"
   - name: debian-buster
     image: debian:buster-slim
     dockerfile: ../Dockerfile.j2

molecule/default/prepare.yml

@@ -17,17 +17,27 @@
         force: false
         mode: 0444
 
-- name: Install NGINX Plus on Alpine
+- name: Install NGINX Plus R24 to avoid dependency issues
   hosts: all
   tasks:
-    - name: Set up NGINX Plus on Alpine for NAP 3.2/3.3 issue workaround (remove in versions > 3.3)
+    - name: Set repo if Alpine
+      set_fact:
+        version: "=24-r2"
+      when: ansible_facts['os_family'] == "Alpine"
+    - name: Set repo if Debian
+      set_fact:
+        version: "=24-2~{{ ansible_facts['distribution_release'] }}"
+      when: ansible_facts['os_family'] == "Debian"
+    - name: Set repo if Red Hat
+      set_fact:
+        version: "-24-2.{{ (ansible_facts['distribution']=='Amazon') | ternary('amzn2', ('el' + ansible_facts['distribution_major_version'] | string)) }}.ngx"
+      when: ansible_facts['os_family'] == "RedHat"
+    - name: Install NGINX Plus R24 to avoid dependency issues
       include_role:
         name: nginxinc.nginx
       vars:
-        nginx_enable: true
-        nginx_start: true
         nginx_type: plus
+        nginx_version: "{{ version }}"
         nginx_license:
           certificate: ../../files/license/nginx-repo.crt
           key: ../../files/license/nginx-repo.key
-      when: ansible_os_family == "Alpine"

molecule/default/requirements.yml

@@ -1,4 +1,4 @@
 ---
 roles:
   - name: nginxinc.nginx
-    version: 0.20.0
+    version: 0.21.1

molecule/dos/prepare.yml

@@ -16,3 +16,27 @@
         dest: ../../files/license/nginx-repo.key
         force: false
         mode: 0444
+- name: Install NGINX Plus R24 to avoid dependency issues
+  hosts: all
+  tasks:
+    - name: Set repo if Alpine
+      set_fact:
+        version: "=24-r2"
+      when: ansible_facts['os_family'] == "Alpine"
+    - name: Set repo if Debian
+      set_fact:
+        version: "=24-2~{{ ansible_facts['distribution_release'] }}"
+      when: ansible_facts['os_family'] == "Debian"
+    - name: Set repo if Red Hat
+      set_fact:
+        version: "-24-2.{{ (ansible_facts['distribution']=='Amazon') | ternary('amzn2', ('el' + ansible_facts['distribution_major_version'] | string)) }}.ngx"
+      when: ansible_facts['os_family'] == "RedHat"
+    - name: Install NGINX Plus R24 to avoid dependency issues
+      include_role:
+        name: nginxinc.nginx
+      vars:
+        nginx_type: plus
+        nginx_version: "{{ version }}"
+        nginx_license:
+          certificate: ../../files/license/nginx-repo.crt
+          key: ../../files/license/nginx-repo.key

molecule/dos/requirements.yml

@@ -1,4 +1,4 @@
 ---
 roles:
   - name: nginxinc.nginx
-    version: 0.20.0
+    version: 0.21.1