Skip to content

Commit 1ba553b

Browse files
alessfgalessfg
authored
Check distribution and validate role variables (#583)
1 parent 7853fc6 commit 1ba553b

File tree

4 files changed

+146
-54
lines changed

4 files changed

+146
-54
lines changed

‎CHANGELOG.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,12 +20,14 @@ BREAKING CHANGES:
2020

2121
FEATURES:
2222

23+
* Validate that various role variables have been set to one of the allowed values.
2324
* Add support for the newer `ndk` and `set-misc` NGINX Plus dynamic modules and remove old code checks for distributions that are no longer supported.
2425
* Add AlmaLinux, Oracle Linux and Rocky Linux to the list of NGINX OSS and NGINX Plus tested and supported distributions.
2526
* Add Alpine Linux 3.17 to the NGINX list of tested and supported platforms (and remove Alpine Linux 3.13 from the list of NGINX OSS supported distributions).
2627

2728
ENHANCEMENTS:
2829

30+
* Improve validation of supported distributions when installing NGINX from the official repository.
2931
* Bump the Ansible `community.general` collection to `6.2.0`, `community.crypto` collection to `2.10.0` and `community.docker` collection to `3.4.0`.
3032
* Use the official GitHub repositories as the source for the various packages required to compile NGINX OSS from source.
3133

‎tasks/main.yml

Lines changed: 4 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,7 @@
11
---
2-
- name: Check whether you are using a supported NGINX distribution
3-
ansible.builtin.assert:
4-
that: (nginx_type == "opensource" and ansible_facts['distribution'] in nginx_distributions)
5-
or (nginx_type == "plus" and ansible_facts['distribution'] in nginx_plus_distributions)
6-
success_msg: Your OS, {{ ansible_facts['distribution'] }} is supported by NGINX {{ (nginx_type == 'plus') | ternary('Plus', 'Open Source') }}
7-
fail_msg: Your OS, {{ ansible_facts['distribution'] }} is not supported by NGINX {{ (nginx_type == 'plus') | ternary('Plus', 'Open Source') }}
8-
when:
9-
- nginx_enable | bool
10-
- (nginx_install_from == "nginx_repository" or nginx_type == "plus")
11-
ignore_errors: true # noqa ignore-errors
12-
tags: nginx_check_support
13-
14-
- name: Check that NGINX setup is an allowed value
15-
ansible.builtin.assert:
16-
that: nginx_setup in nginx_setup_vars
17-
fail_msg: The value {{ nginx_setup }} you used for `nginx_setup` is not allowed. Try one of {{ nginx_setup_vars | join(', ') }}.
18-
when: nginx_enable | bool
19-
ignore_errors: true # noqa ignore-errors
20-
tags: nginx_check_support
2+
- name: Validate distribution and role variables
3+
ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate/validate.yml"
4+
tags: nginx_validate
215

226
- name: Set up prerequisites
237
ansible.builtin.include_tasks: "{{ role_path }}/tasks/prerequisites/prerequisites.yml"
@@ -78,6 +62,7 @@
7862
- name: Debug NGINX output
7963
ansible.builtin.include_tasks: "{{ role_path }}/tasks/config/debug-output.yml"
8064
when:
65+
- nginx_enable | bool
8166
- nginx_debug_output | bool
8267
- nginx_state != "absent"
8368
tags: nginx_debug_output

‎tasks/validate/validate.yml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
- name: Check whether you are using a supported NGINX distribution
3+
ansible.builtin.assert:
4+
that:
5+
- "{{ ansible_facts['distribution'] | lower in nginx_distributions.keys() | list }}"
6+
- "{{ (ansible_facts['distribution_version'] | regex_search('\\d+\\.?\\d*') in nginx_distributions[ansible_facts['distribution'] | lower]['versions'] | string)
7+
if ansible_facts['distribution'] | lower in ['alpine', 'ubuntu'] else ansible_facts['distribution_major_version'] in nginx_distributions[ansible_facts['distribution'] | lower]['versions'] | string }}"
8+
- "{{ ansible_facts['architecture'] in nginx_distributions[ansible_facts['distribution'] | lower]['architectures'] }}"
9+
success_msg: Your distribution, {{ nginx_distributions[ansible_facts['distribution'] | lower]['name'] }} {{ ansible_facts['distribution_version'] }} ({{ ansible_facts['architecture'] }}), is supported by NGINX {{ (nginx_type == 'opensource') | ternary('Open Source', 'Plus') }}.
10+
fail_msg: Your distribution, {{ nginx_distributions[ansible_facts['distribution'] | lower]['name'] }} {{ ansible_facts['distribution_version'] }} ({{ ansible_facts['architecture'] }}), is not supported by NGINX {{ (nginx_type == 'opensource') | ternary('Open Source', 'Plus') }}.
11+
when:
12+
- nginx_enable | bool
13+
- (nginx_install_from == "nginx_repository" or nginx_type == "plus")
14+
ignore_errors: true # noqa ignore-errors
15+
16+
- name: Check that 'nginx_setup' is an allowed value
17+
ansible.builtin.assert:
18+
that: nginx_setup in nginx_setup_vars
19+
fail_msg: The value you used for 'nginx_setup', {{ nginx_setup }}, is not allowed. The allowed values are [{{ nginx_setup_vars | join(', ') }}].
20+
when: nginx_enable | bool
21+
ignore_errors: true # noqa ignore-errors
22+
23+
- name: Check that 'nginx_branch' is an allowed value
24+
ansible.builtin.assert:
25+
that: nginx_branch in nginx_branch_vars
26+
fail_msg: The value you used for 'nginx_branch', {{ nginx_branch }}, is not allowed. The allowed values are [{{ nginx_branch_vars | join(', ') }}].
27+
when: nginx_enable | bool
28+
ignore_errors: true # noqa ignore-errors
29+
30+
- name: Check that 'nginx_install_from' is an allowed value
31+
ansible.builtin.assert:
32+
that: nginx_install_from in nginx_install_from_vars
33+
fail_msg: The value you used for 'nginx_install_from', {{ nginx_install_from }}, is not allowed. The allowed values are [{{ nginx_install_from_vars | join(', ') }}].
34+
when: nginx_enable | bool
35+
ignore_errors: true # noqa ignore-errors

‎vars/main.yml

Lines changed: 105 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,114 @@
11
---
2-
nginx_setup_vars: [
3-
install, uninstall, upgrade,
4-
]
2+
# Set the values allowed for various variables
3+
nginx_setup_vars: [install, uninstall, upgrade]
54

6-
nginx_default_setup: install
5+
nginx_install_from_vars: [nginx_repository, source, os_repository]
6+
7+
nginx_branch_vars: [mainline, stable]
78

9+
# Determine the current value of 'nginx_state'
810
nginx_state_vals:
911
install: present
1012
uninstall: absent
1113
upgrade: latest
1214

15+
nginx_default_setup: install
1316
nginx_state: "{{ nginx_state_vals[nginx_setup] | default(nginx_state_vals[nginx_default_setup]) }}"
1417

18+
# Set the nginx_platforms check to opensource or plus
19+
nginx_distributions: "{{ (nginx_type == 'opensource') | ternary(nginx_supported_distributions, nginx_plus_supported_distributions) }}"
20+
1521
# Supported NGINX Open Source distributions
1622
# https://nginx.org/en/docs/install.html
17-
nginx_distributions: [
18-
AlmaLinux, Alpine, Amazon, CentOS, Debian, FreeBSD, OracleLinux, RedHat, Rocky, SLES, Ubuntu,
19-
NetBSD, OpenBSD, DragonFlyBSD, HardenedBSD,
20-
]
23+
nginx_supported_distributions:
24+
almalinux:
25+
name: AlmaLinux
26+
versions: [8, 9]
27+
architectures: [x86_64, aarch64, s390x]
28+
alpine:
29+
name: Alpine Linux
30+
versions: [3.14, 3.15, 3.16, 3.17]
31+
architectures: [x86_64, aarch64]
32+
amazon:
33+
name: Amazon Linux
34+
versions: [2]
35+
architectures: [x86_64, aarch64]
36+
centos:
37+
name: CentOS
38+
versions: [7]
39+
architectures: [x86_64, aarch64]
40+
debian:
41+
name: Debian
42+
versions: [11]
43+
architectures: [x86_64, aarch64]
44+
oraclelinux:
45+
name: Oracle Linux
46+
versions: [7, 8, 9]
47+
architectures: "{{ (['x86_64', 'aarch64'] + ['s390x']) if (ansible_facts['distribution_major_version'] is version('8', '>=')) else ['x86_64', 'aarch64'] }}"
48+
redhat:
49+
name: Red Hat Enterprise Linux
50+
versions: [7, 8, 9]
51+
architectures: "{{ (['x86_64', 'aarch64'] + ['s390x']) if (ansible_facts['distribution_major_version'] is version('8', '>=')) else ['x86_64', 'aarch64'] }}"
52+
rocky:
53+
name: Rocky Linux
54+
versions: [8, 9]
55+
architectures: [x86_64, aarch64, s390x]
56+
sles:
57+
name: SUSE Linux Enterprise Server
58+
versions: [12, 15]
59+
architectures: [x86_64]
60+
ubuntu:
61+
name: Ubuntu
62+
versions: [18.04, 20.04, 22.04, 22.10]
63+
architectures: "{{ (['x86_64', 'aarch64'] + ['s390x']) if ((ansible_facts['distribution_version'] is version('20.04', '==')) or (ansible_facts['distribution_version'] is version('22.04', '=='))) else ['x86_64', 'aarch64'] }}"
2164

2265
# Supported NGINX Plus distributions
2366
# https://docs.nginx.com/nginx/technical-specs/
24-
nginx_plus_distributions: [
25-
AlmaLinux, Alpine, Amazon, CentOS, Debian, FreeBSD, OracleLinux, RedHat, Rocky, SLES, Ubuntu,
26-
]
67+
nginx_plus_supported_distributions:
68+
almalinux:
69+
name: AlmaLinux
70+
versions: [8, 9]
71+
architectures: [x86_64, aarch64]
72+
alpine:
73+
name: Alpine Linux
74+
versions: [3.13, 3.14, 3.15, 3.16, 3.17]
75+
architectures: [x86_64, aarch64]
76+
amazon:
77+
name: Amazon Linux
78+
versions: [2]
79+
architectures: [x86_64, aarch64]
80+
centos:
81+
name: CentOS
82+
versions: [7]
83+
architectures: [x86_64, aarch64]
84+
debian:
85+
name: Debian
86+
versions: [11]
87+
architectures: [x86_64, aarch64]
88+
freebsd:
89+
name: FreeBSD
90+
versions: [12, 13]
91+
architectures: [x86_64]
92+
oraclelinux:
93+
name: Oracle Linux
94+
versions: [7, 8, 9]
95+
architectures: "{{ (['x86_64'] + ['aarch64']) if (ansible_facts['distribution_major_version'] is version('8', '==')) else ['x86_64'] }}"
96+
redhat:
97+
name: Red Hat Enterprise Linux
98+
versions: [7, 8, 9]
99+
architectures: "{{ (['x86_64', 'aarch64'] + ['s390x']) if (ansible_facts['distribution_major_version'] is version('8', '>=')) else ['x86_64', 'aarch64'] }}"
100+
rocky:
101+
name: Rocky Linux
102+
versions: [8, 9]
103+
architectures: [x86_64, aarch64]
104+
sles:
105+
name: SUSE Linux Enterprise Server
106+
versions: [12, 15]
107+
architectures: [x86_64]
108+
ubuntu:
109+
name: Ubuntu
110+
versions: [18.04, 20.04, 22.04]
111+
architectures: "{{ (['x86_64', 'aarch64'] + ['s390x']) if (ansible_facts['distribution_version'] is version('20.04', '>=')) else ['x86_64', 'aarch64'] }}"
27112

28113
# Default NGINX signing key
29114
nginx_default_signing_key_pgp: https://nginx.org/keys/nginx_signing.key
@@ -47,29 +132,19 @@ nginx_plus_default_repository_redhat: https://pkgs.nginx.com/plus/{{ (ansible_fa
47132
nginx_plus_default_repository_suse: https://pkgs.nginx.com/plus/sles/{{ ansible_facts['distribution_major_version'] }}?ssl_clientcert=/etc/ssl/nginx/nginx-repo-bundle.crt&ssl_verify=peer
48133

49134
# Alpine dependencies
50-
nginx_alpine_dependencies: [
51-
ca-certificates, coreutils, openssl, pcre2,
52-
]
135+
nginx_alpine_dependencies: [ca-certificates, coreutils, openssl, pcre2]
53136

54137
# Debian dependencies
55-
nginx_debian_dependencies: [
56-
apt-transport-https, ca-certificates, gpg-agent,
57-
]
138+
nginx_debian_dependencies: [apt-transport-https, ca-certificates, gpg-agent]
139+
140+
# FreeBSD dependencies
141+
nginx_freebsd_dependencies: [security/ca_root_nss]
58142

59143
# Red Hat dependencies
60-
nginx_redhat_dependencies: [
61-
ca-certificates,
62-
]
144+
nginx_redhat_dependencies: [ca-certificates]
63145

64146
# SLES dependencies
65-
nginx_sles_dependencies: [
66-
ca-certificates,
67-
]
68-
69-
# FreeBSD dependencies
70-
nginx_freebsd_dependencies: [
71-
security/ca_root_nss,
72-
]
147+
nginx_sles_dependencies: [ca-certificates]
73148

74149
# Default locations and versions when 'nginx_install_from' is set to 'source'.
75150
# Set 'pcre_release' to 1 to install PCRE 1, modify the 'openssl_version' to move back to 1.1.1.
@@ -79,12 +154,7 @@ zlib_version: 1.2.13
79154
openssl_version: 3.0.7
80155

81156
# Supported NGINX Open Source dynamic modules
82-
nginx_modules_list: [
83-
geoip, image-filter, njs, perl, xslt,
84-
]
157+
nginx_modules_list: [geoip, image-filter, njs, perl, xslt]
85158

86159
# Supported NGINX Plus dynamic modules
87-
nginx_plus_modules_list: [
88-
auth-spnego, brotli, encrypted-session, geoip, geoip2, headers-more, image-filter,
89-
lua, ndk, njs, opentracing, passenger, perl, prometheus, rtmp, set-misc, subs-filter, xslt,
90-
]
160+
nginx_plus_modules_list: [auth-spnego, brotli, encrypted-session, geoip, geoip2, headers-more, image-filter, lua, ndk, njs, opentracing, passenger, perl, prometheus, rtmp, set-misc, subs-filter, xslt]

0 commit comments

Comments
 (0)