Skip to content

Commit bbf0bce

Browse files
aknot242aknot242
authored
Merge branch 'master' into selinux
2 parents 29920d1 + 318dfc2 commit bbf0bce

14 files changed

+209
-69
lines changed

‎.yamllint

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
# Based on ansible-lint config
3+
extends: default
4+
5+
rules:
6+
braces:
7+
max-spaces-inside: 1
8+
level: error
9+
brackets:
10+
max-spaces-inside: 1
11+
level: error
12+
colons:
13+
max-spaces-after: -1
14+
level: error
15+
commas:
16+
max-spaces-after: -1
17+
level: error
18+
comments: disable
19+
comments-indentation: disable
20+
document-start: disable
21+
empty-lines:
22+
max: 3
23+
level: error
24+
hyphens:
25+
level: error
26+
indentation: disable
27+
key-duplicates: enable
28+
line-length: disable
29+
new-line-at-end-of-file: disable
30+
new-lines:
31+
type: unix
32+
trailing-spaces: disable
33+
truthy: disable

‎README.md

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -91,8 +91,6 @@ This is a sample playbook file for using the role to install NGINX App Protect o
9191
- hosts: wafs
9292
become: true
9393
vars:
94-
# Installs NGINX App Protect and all dependencies to the target host
95-
app_protect_enable: true
9694
9795
# Specify whether you want to maintain your version of NGINX App Protect, upgrade to the latest version, or remove NGINX App Protect.
9896
# Can be used with `app_protect_version` to achieve fine grained control on which version of NGINX App Protect is installed/used on each playbook execution.

‎defaults/main.yml

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,6 @@
11
---
22
# defaults file for ansible-role-nginx-app-protect
33

4-
# Installs NGINX App Protect and all dependencies to the target host
5-
app_protect_enable: true
6-
74
# Specify whether you want to maintain your version of NGINX App Protect, upgrade to the latest version, or remove NGINX App Protect.
85
# Can be used with `app_protect_version` to achieve fine grained control on which version of NGINX App Protect is installed/used on each playbook execution.
96
# Using 'present' will install the latest version (or 'app_protect_version') of NGINX App Protect on a fresh install.

‎meta/main.yml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@ galaxy_info:
1616
- name: Debian
1717
versions:
1818
- stretch
19-
- buster
2019

2120
galaxy_tags:
2221
- waf

‎molecule/default/INSTALL.rst

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
*******
2+
Docker driver installation guide
3+
*******
4+
5+
Requirements
6+
============
7+
8+
* Docker Engine
9+
10+
Install
11+
=======
12+
13+
Please refer to the `Virtual environment`_ documentation for installation best
14+
practices. If not using a virtual environment, please consider passing the
15+
widely recommended `'--user' flag`_ when invoking ``pip``.
16+
17+
.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
18+
.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
19+
20+
.. code-block:: bash
21+
22+
$ python3 -m pip install 'molecule[docker]'

‎molecule/default/converge.yml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
- name: Converge
3+
hosts: all
4+
vars:
5+
app_protect_enable: true
6+
app_protect_install_signatures: true
7+
app_protect_configure: true
8+
app_protect_security_policy_template_enable: true
9+
security_policy_enforcement_mode: blocking
10+
app_protect_log_policy_template_enable: true
11+
log_policy_filter_request_type: all
12+
nginx_conf_template_enable: true
13+
log_policy_syslog_target: 10.1.10.105:5144
14+
nginx_demo_workload_protocol: http://
15+
nginx_demo_workload_host: 10.1.10.105:8080
16+
nginx_license:
17+
certificate: "./license/nginx-repo.crt"
18+
key: "./license/nginx-repo.key"
19+
20+
tasks:
21+
- name: "Include ansible-role-nginx-app-protect"
22+
include_role:
23+
name: "ansible-role-nginx-app-protect"

‎molecule/default/molecule.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
dependency:
3+
name: galaxy
4+
driver:
5+
name: docker
6+
platforms:
7+
- name: centos-7
8+
image: docker.io/pycontribs/centos:7
9+
pre_build_image: true
10+
provisioner:
11+
name: ansible
12+
log: true
13+
verifier:
14+
name: ansible
15+
lint: |
16+
yamllint .
17+
ansible-lint
18+
flake8

‎molecule/default/verify.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
# This is an example playbook to execute Ansible tests.
3+
4+
- name: Verify
5+
hosts: all
6+
tasks:
7+
- name: Example assertion
8+
assert:
9+
that: true

‎tasks/configure-app-protect.yml

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
- name: "Ensure NGINX Main Directory Exists"
33
file:
4-
path: "{{ nginx_conf_template.out_file_location}}"
4+
path: "{{ nginx_conf_template.out_file_location }}"
55
state: directory
66
when: app_protect_security_policy_template_enable or app_protect_log_policy_template_enable or nginx_conf_template_enable
77

@@ -31,7 +31,26 @@
3131
src: "{{ nginx_conf_template.template_file }}"
3232
dest: "{{ nginx_conf_template.out_file_location }}{{ nginx_conf_template.out_file_name }}"
3333
backup: true
34-
when: nginx_conf_template_enable
34+
when:
35+
- nginx_conf_template_enable
36+
- app_protect_state != "absent"
37+
38+
- name: "Remove NGINX App Protect"
39+
block:
40+
41+
- name: Comment out NGINX App Protect module reference in nginx.conf
42+
replace:
43+
path: /etc/nginx/nginx.conf
44+
regexp: '^([ \t]*load_module.*ngx_http_app_protect_module.so;)'
45+
replace: '# \1'
46+
47+
- name: Comment out NGINX App Protect directives in nginx.conf
48+
replace:
49+
path: /etc/nginx/nginx.conf
50+
regexp: '^([ \t]*app_protect_)'
51+
replace: '# \1'
52+
53+
when: app_protect_state == "absent"
3554

3655
- name: "Reload NGINX"
3756
debug:

‎tasks/install-app-protect-linux.yml

Lines changed: 10 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,17 @@
11
---
2-
- import_tasks: setup-debian.yml
3-
when: ansible_os_family == "Debian"
2+
- name: "Remove NGINX App Protect"
3+
block:
44

5-
- import_tasks: setup-redhat.yml
6-
when: ansible_os_family == "RedHat"
5+
- import_tasks: setup-debian.yml
6+
when: ansible_os_family == "Debian"
7+
8+
- import_tasks: setup-redhat.yml
9+
when: ansible_os_family == "RedHat"
10+
11+
when: app_protect_state != "absent"
712

813
- name: "(Install: Linux) Install NGINX App Protect"
914
package:
10-
name: "app-protect{{ nginx_version | default('') }}"
15+
name: "app-protect{{ app_protect_version | default('') }}"
1116
state: "{{ app_protect_state }}"
1217
notify: "(Handler: All OSs) Restart NGINX"
13-
14-
# - name: "Start NGINX App Protect"
15-
# service:
16-
# name: nginx-app-protect
17-
# state: started
18-
# enabled: true
19-
# when:
20-
# - not ansible_check_mode
21-
22-
# - name: "Start NGINX"
23-
# service:
24-
# name: nginx
25-
# state: reloaded
26-
# when:
27-
# - not ansible_check_mode

0 commit comments

Comments
 (0)