From ef705ce01fdf8c644ff4febb4717f26c83d3ed38 Mon Sep 17 00:00:00 2001 From: tymofiisobchenko <104431720+tymofiisobchenko@users.noreply.github.com> Date: Tue, 17 Dec 2024 11:29:28 +0200 Subject: [PATCH] Efs version fix for old debian pr devel 2.x (#2150) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Bug fixes 2.x pr 2.x (#1357) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Bug fixes 2.x pr 2.x (#1359) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Bug fixes 2.x pr 2.x (#1361) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Ensuring cloud-init gets installed. * Bug fixes 2.x pr 2.x (#1371) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * Increasing-swap-rewriting-readme (#1377) * 2.x (#1363) * Devel 2.x (#1216) * R62347 fix postfix mail delivery pr devel (#791) * GitHub Actions - Rebuilt documentation. * Need to check if is_local is defined in webserver meta dependencies. (#522) * Ce dev refactor pr 1.x (#518) * Making it easier to test with provision-target and ce-dev. * Moving the provision forcing var back to plays so _init has it. * Adding defaults vars and test script extra options. * Adding a web server test to CI. * examples string needs to be in quotes. * Making sure is_local and _ce_provision_force_play are available to the _init role. * Adding SSH keys to the provision user. * Adding a --force to the test script. * Explicitly adding vars to role. * Fixing _init behaviour and adding SSH key for web role. * Setting default PHP version to 7.4. * Looking up the generated ce-dev SSH key instead of hard-coding one. * We cannot run the ssh_server role locally, so excluding for tests of webserver role. * Trying to remove user_root.yml in case it's breaking CI. * Adding a verbose mode to the test script. * Exposing the command in the test script. * Trying hard-coded keys again. * Changing location of data dir for test containers. * Putting vars back and restricting CI to the 'web' example. * Adding backup handling to ldap_server. (#525) * Adding backup handling to ldap_server. * Improving SSL docs and handling perms for openldap and letsencrypt. * Cron user must be specified with file. * Running as root, do not need a 'sudo' in this cron. * Allowing 'gitLab' to disable Prometheus. (#530) * Allowing 'gitLab' to disable Prometheus. * Booleans to use in jinja2 as strings must be cast as strings. * GitHub Actions - Rebuilt documentation. (#526) Co-authored-by: Code Enigma CI * Prometheus pr 1.x (#533) * Allowing 'gitLab' to disable Prometheus. * Booleans to use in jinja2 as strings must be cast as strings. * Tidying up CI and adding a GitLab test. * Fixing CI job description. * Add private files support for Drupal in Nginx. (#535) * Prometheus pr 1.x (#539) * Allowing 'gitLab' to disable Prometheus. * Booleans to use in jinja2 as strings must be cast as strings. * Tidying up CI and adding a GitLab test. * Fixing CI job description. * Adding a firewall config preset to open port 80 for LetsEncrypt. * Removing our unused ClamAV roles and adding a Galaxy role to common base. (#541) * Revert "Moving OSSEC pkill to use process_manager role instead. (#258)" (#544) This reverts commit 73c7bd0adb1105436e484fe794182c915b2d25dd. * Moving key servers to a variable so we can set them. (#555) * Moving key servers to a variable so we can set them. * Allowing us to disable sending keys completely. * Oops, doubled up on existing functionality. * Fixing var name. * Adding a reboot option to the patching role. (#557) * Add minimal support for Aurora RDS instances (#567) * Attempt to create an RDS read replica. * Use new task to create Aurora RDS instances. * Try and fix linting issues. * Don't pass max_storage variable for Aurora instances. * Remove more storage related vars from Aurora RDS instance creation task. * Add profile and region to read replica creation. * Try creating the Aurora read replica another way. * Add some debug info. * Work around the silly registering of variables in Ansible. * Rename an RDS CloudWatch task for Aurora DBs and remove RDS debug info. * Add some Aurora info to aws_rds README file. * Use reader instead of replica for Aurora readers. * Remove db_cluster_identifier variable from non-Aurora RDS task. * Gpg servers fix pr 1.x (#571) * Moving key servers to a variable so we can set them. * Allowing us to disable sending keys completely. * Oops, doubled up on existing functionality. * Fixing var name. * Using a pipe to grep with 'command' cannot work, refactoring. * Making CI use the meta deploy role to test gitlab. * We mustn't assume AWS servers for deploy and controller. * Support termination protection in EC2. (#573) * Support termination protection in EC2. * Fixing CI vars. * Fixing CI vars. * Fix managed SSL key perms and the variable used for the private key. (#575) * Ec2 subnet lookup pr 1.x (#583) * First pass at EC2 subnet detection. * Touching subnet file to ensure it exists. * Trying a different approach, file module didn't work. * Switching back to file module. * We need to create the directory for new servers too. * Bad variable name. * Ec2 subnet lookup pr 1.x (#589) * First pass at EC2 subnet detection. * Touching subnet file to ensure it exists. * Trying a different approach, file module didn't work. * Switching back to file module. * We need to create the directory for new servers too. * Bad variable name. * Changing subnet lookup order to check for defined subnet first. * Fixing gitlab-runner overriders so upgrades do not break the runner. (#586) * Fixing gitlab-runner overriders so upgrades do not break the runner. * Fixing override file template. * Hopefully fixing CI. * Making sure the service directory exists. * We cannot use the deploy meta role in CI because of LDAP. * Changing dir perms and adding a force. * Gitlab runner service override pr 1.x (#591) * Fixing gitlab-runner overriders so upgrades do not break the runner. * Fixing override file template. * Hopefully fixing CI. * Making sure the service directory exists. * We cannot use the deploy meta role in CI because of LDAP. * Changing dir perms and adding a force. * Debugging gitlab-runner directory creation issues in CI. * Fixing linting error. * Removing verbosity again but leaving 'stat' command in. * Pass db_cluster_identifier for RDS instance during ASG build (#600) * Pass RDS db_cluster_identifier, if present, during an ASG build. * Use correct variable name for RDS db_cluster_identifier. * Add a commented variable to ASG role for db_cluster_identifier so it's documented. * Also pass in the aurora_reader var from the ASG role when including the aws_rds role. (#605) * Removing obsolete MySQL config option log_syslog from template. (#607) * GitHub Actions - Rebuilt documentation. (#536) Co-authored-by: Code Enigma CI * Consistent default region pr 1.x (#611) * Moving all region settings to _aws_region var and adding README update. * Documentation update. * No need for region, IAM SAML setup is global, (#617) * Support ebs encryption pr 1.x (#609) * Adding volume encryption and type options plus a bit more flexibility on EBS control for EC2. * Setting more sane default instance sizes. * Adding more EBS options for ASGs. * Setting encryption to match AMI settings. * Setting encryption to match AMI settings. * We also need to dynamically set the ASGs own encrypt_boot var. * We need to merge the new branch changes before we can rebuild the docs. * Fixing merge command in CI. * Not sure toc.sh is actually executing. * Refactoring encrypt EBS flags to avoid detected loop condition in vars. * Safer CI, only adds .md files. * Trying to figure out CI logic for building docs. * Trying to figure out CI logic for building docs. * Trying to figure out CI logic for building docs. * Trying adding a git pull. * Setting git pull config options. * Reordering things. * Adding --allow-unrelated-histories to the git pull. * Trying a feature branch approach. * Forcing the GitHub action to fetch all git history. * Bad whitespace, naughty whitespace. * Trying a different PR action. * Do not merge the branch in, we only want the markdown changes. * Keeping the documentation branch clean. * We need to push a detached HEAD. * Do we need the checkout at all? * Adding a docs pull. * Allow install|update scripts in Drupal8+ (#599) * Add some flexibility to Packer (#633) * Add ability to pass on-error and force to Packer. * Add new Packer options to the ASG role as well. * Packer build options need to be declared before the file that is being built. * Allow Packer ssh_username to be set. * Making PHP >= 8.0 compatible (#634) * Packer VPC filtering (#638) * Add ability to set vpc_filter and subnet AZ for Packer builds. * Add fqcn-builtins to .ansible-lint warn_list for now. * GitHub Actions seemingly ignores warn_list. * Use simplified variables for Packer VPC stuff. * Only use one filter when filtering VPCs for Packer. * Cert management pr 1.x (#640) * Making sure we can't accidentally commit AWS API credentials. * Initial commit of ACM role. * Only pause for a get-certificate call if we want to export. * Updating docs. * Cert management pr 1.x (#642) * Making sure we can't accidentally commit AWS API credentials. * Initial commit of ACM role. * Only pause for a get-certificate call if we want to export. * Updating docs. * Missed a couple of variables to update. * Cert management pr 1.x (#644) * Making sure we can't accidentally commit AWS API credentials. * Initial commit of ACM role. * Only pause for a get-certificate call if we want to export. * Updating docs. * Missed a couple of variables to update. * We cannot rely on the variable being nonexistent here. * Cert management pr 1.x (#647) * Making sure we can't accidentally commit AWS API credentials. * Initial commit of ACM role. * Only pause for a get-certificate call if we want to export. * Updating docs. * Missed a couple of variables to update. * We cannot rely on the variable being nonexistent here. * Allowing ce-provision to set the basic auth message for Nginx. * Supporting SAN certs and tags on ACM certificates. * Fixing namespacing. * Auto-generating SSL certs for ALB and CloudFront. * More namespace fixes. * Fixing CI issue with missing AWS region var. * Reinstating replace_batch_size for ASGs to see if it speeds up infra builds. * Adding public IP option to LC config for ASGs. * Refactoring ACM domain handling so we can create DNS entries for each SAN domain. * Fixing mistake in domains set_fact. * Fixing AnsibleUndefined bug caused by skipped task. * Fix Nginx auth_message in vhost (#653) * Revert auth_message change in Nginx role for now. * Revert "Revert auth_message change in Nginx role for now." This reverts commit d030e4c628728ab553a0f5687497cf566bcd1179. * Add default for Nginx auth_message. * Cert management pr 1.x (#655) * Making sure we can't accidentally commit AWS API credentials. * Initial commit of ACM role. * Only pause for a get-certificate call if we want to export. * Updating docs. * Missed a couple of variables to update. * We cannot rely on the variable being nonexistent here. * Allowing ce-provision to set the basic auth message for Nginx. * Supporting SAN certs and tags on ACM certificates. * Fixing namespacing. * Auto-generating SSL certs for ALB and CloudFront. * More namespace fixes. * Fixing CI issue with missing AWS region var. * Reinstating replace_batch_size for ASGs to see if it speeds up infra builds. * Adding public IP option to LC config for ASGs. * Refactoring ACM domain handling so we can create DNS entries for each SAN domain. * Fixing mistake in domains set_fact. * Fixing AnsibleUndefined bug caused by skipped task. * Handling multiple domain validations for SAN certs. * Fixing bad variable name. * Fixing ASG DNS entries so it adds entries for SAN cert domains too. * For DNS validation we should not use --domain-validation-options at all. * Writing over the aws_acm.extra_domains var didn't work, setting a new var instead. * Bad dict structure. * Improving multi domain handling for ASG DNS. * Supporting multiple CloudFront aliases for an ASG. * Adding options to disable sign-up, sign-in and private projects. (#663) * Making ALB healthchecks optional and defaulting to disabled. (#670) * Making ALB healthchecks optional and defaulting to disabled. * Defaulting back to ELB health checks. * Remove alb healthchecks pr 1.x (#673) * Making ALB healthchecks optional and defaulting to disabled. * Defaulting back to ELB health checks. * Making sure new clusters won't fail because no ALB yet. * Allow user to set cachetool version in the opcache role. (#665) * Allow user to set cachetool version in the opcache role. * Adding a comment for a future improvement. * Adding a 'repack' option for AMIs and ASGs. (#675) * Adding a 'repack' option for AMIs and ASGs. * Adding an option to force a Packer rebuild in an ASG. * Fixing EC2 instance look-up to use cluster name. * Separating AMI provisioning tasks into a tasks file that can be included. * Refactoring AMI operation to allow current behaviour to remain default. * Trying to delegate tasks to target repack instance. * Switching from import_tasks to include_tasks. * Fixing the instance DNS name var. * Changing approach to make a standalone machine to generate AMI from. * Gah! Typo! * AMI generation requires region and profile. * Didn't wrap instance_id lookup properly. * Fixing some missing namespaces. * Missed a bad var when fixing. * Adding full set of variables for EC2 instance. * Fixing AWS SSH key name. * Decided not to use the EC2 + EIP role. * Trying to add a pause after instance launch. * Passing the target branch to Ansible as a var. * Support absolute paths to playbooks. * Refactoring to make ce-provision call itself for AMI packing tasks. * Doubled up the script path. * Switching to base dir var for ce-provision call. * Moving temp EC2 instances for AMI creation to subnet with IGW. * State of EC2 instance needs to be started instead of running. * We need to delete the AMI we created before making another one. * Refactoring AMI repack variables for readability and removing volume size. * Missed a refactored var. * Defending against AMI volume size issues for ASGs. * Refactoring extra vars handling. * For some reason Packer seems to double the brackets. * Revert "For some reason Packer seems to double the brackets." This reverts commit 13ee8df42b80b102e9e19a01407b3afb69952ee5. * Fixing packer.json white space. * We need to reset the _aws_ami_extra_vars variable to an empty string before we rebuild it. * Slight refactor to move the extra vars building to the relevant included tasks. * Slight documentation change. * Moved config extra vars to ce-provision as they are globally sane. * Error in jinja list building for RDS. * Ami repack option pr 1.x (#707) * Adding a 'repack' option for AMIs and ASGs. * Adding an option to force a Packer rebuild in an ASG. * Fixing EC2 instance look-up to use cluster name. * Separating AMI provisioning tasks into a tasks file that can be included. * Refactoring AMI operation to allow current behaviour to remain default. * Trying to delegate tasks to target repack instance. * Switching from import_tasks to include_tasks. * Fixing the instance DNS name var. * Changing approach to make a standalone machine to generate AMI from. * Gah! Typo! * AMI generation requires region and profile. * Didn't wrap instance_id lookup properly. * Fixing some missing namespaces. * Missed a bad var when fixing. * Adding full set of variables for EC2 instance. * Fixing AWS SSH key name. * Decided not to use the EC2 + EIP role. * Trying to add a pause after instance launch. * Passing the target branch to Ansible as a var. * Support absolute paths to playbooks. * Refactoring to make ce-provision call itself for AMI packing tasks. * Doubled up the script path. * Switching to base dir var for ce-provision call. * Moving temp EC2 instances for AMI creation to subnet with IGW. * State of EC2 instance needs to be started instead of running. * We need to delete the AMI we created before making another one. * Refactoring AMI repack variables for readability and removing volume size. * Missed a refactored var. * Defending against AMI volume size issues for ASGs. * Refactoring extra vars handling. * For some reason Packer seems to double the brackets. * Revert "For some reason Packer seems to double the brackets." This reverts commit 13ee8df42b80b102e9e19a01407b3afb69952ee5. * Fixing packer.json white space. * We need to reset the _aws_ami_extra_vars variable to an empty string before we rebuild it. * Slight refactor to move the extra vars building to the relevant included tasks. * Slight documentation change. * Moved config extra vars to ce-provision as they are globally sane. * Error in jinja list building for RDS. * Trailing VPC ID fields using the wrong variable. * Editing GitLab config so LE is enabled and auto-renewing by default. (#709) * Provide profile and region when creating an RDS parameter group, and also provide ability to set the parameter group for an Aurora RDS instance. (#712) * Add a task in ASG role to add an Aurora RDS endpoint. (#714) * Ssl le fixes pr 1.x (#725) * Allow multiple domains to be passed. * Ensuring we don't break older implementations. * First pass at a bash script we can run on cron for LE renewals. * Place the autorenewal script and create a cron entry. * Allowing the HTTP-01 listen port to be set to something other than 80. * Need single quotes within our double quotes. * Adding optional proxy for LE. * Revert "Adding optional proxy for LE." This reverts commit cf5720b450744915872eacafee82164300df90aa. * Adding support for apache and nginx plugins for certbot. * Fixing quote error. * Fixing SSL LE handilng and ensuring other handlers work with multiple provided domains. * Fixing issue with selecting first domain. * Correcting variable names. * LE cron template missing an endfor. * Missing carriage return in LE cron script. * Turns out you can't alter facts passed in via vars by include_role. * Fixing SSL defaults. * Realised if there are multiple different LE runs each needs it's own renewal cron. * Ensure builds don't fail if ssl.web_server isn't provided. * Defending against empty SSL services list. * Improving vhost template LE handling. * Adjusting SSL cert and key var names. * Adding a temporary vhost so newly added domains can request LE certs. * Tabbing error. * Fixing possible 'resolver' errors in Nginx if you use localhost. * Renaming loopvar from domain to certificate_domain to avoid clash with nginx role. * Tweaking Nginx LE handling and making certbot commands customisable. * Fixing minor typo. * Trying giving include_role the public flag. * Documentation updates. * Adding default value to Nginx vhost template. * Move drupal8 install/update config to drupal_common under if local block. (#733) * WIP: 58848 apache role pr 1.x (#667) * Catching up devel. (#243) * Devel (#175) * Wrong filter for efs info * Fix indentation error * Do not purge tags on existing EFS * Wrong name for updating EFS targets * Remove leftover loop * Fix error in subnet gathering * Split EFS creation * Use subnet ids * Wrong var name * Remove dead code * Wrong var * Missing subnet ids * Try not to loose existing SGs * Try to dedupe targets * Wrong syntax for combine * Typo in combining tupples * Wrong var name for append items * Fix appending subnets * Wrong list transformation * Switch to community module for efs * Remove unecessary complexity * Update documentation * Comment out Redefine Autoscale groups task for now and move some of its parameters to the other ASG creation task. * Remove replace_batch_size from ASG creation task, so it now defaults to 1. * Wrap Postfix handler commands in quotes. (#26) * Try using shell instead of command in Postfix handlers. * GitHub Actions integration (#29) * Adding Super Linter workflow for GitHub Actions. * Adding the documentation checker. * Getting GitHub Actions to continue on failure. * Seeing if Git exists. * Missing space. * Re-adding the checkout and the git commands. * Trying Pascal's script. * Adding both lines to the same 'run' command. * GitHub Actions wtf - splitting into two steps. * Trying steps on branch name. * Trying steps on branch name AGAIN. * Would be good to get the syntax right. * Trying different quotes. * Checking the contents of the github.ref variable. * Trying to add in Pascal's testing step. * Adding in /bin/sh to hopefully make test.sh run. * Google says try it with /bin/bash. * Trying a different Ubuntu version. * Installing net-tools to have ifconfig. * Updating testing shell (#28) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Fixing test.sh to explicitly call bash. GitHub Actions only supports Ubuntu containers and Ubuntu shell is dash by default, not bash. Consequently /bin/sh doesn't invoke bash, but dash, which causes some unexpected errors down the line. Co-authored-by: EmlynK * We probably don't need /bin/bash * Making test.sh executable. * Checking shell. * Explicitly setting shell to bash in provision.sh. * Trying ubuntu-16.04 as Travis used this. * Putting shell back. * Update provision.sh * Making /bin/bash the shell. * Making /bin/bash the shell for provision. * Explicitly stating bash again in YML. * Turns out the mkcert binary is out of date. * Compiled mkcert from source. * Fixing curl error. * Switching to wget. * Starting the linter again and renaming job. * Only lint changed files. * Linting a non-existent branch! * Tidying the documentation check. * Revert "Making /bin/bash the shell for provision." This reverts commit f5f35818205cd364a66a6e51c9f9d8254f016422. * Revert "Making /bin/bash the shell." This reverts commit df585b36877aa2328adc228cd8f76950e2853d36. * Revert "Tidying the documentation check." This reverts commit a0c964e15003c8486f4d01232af6e855a475298e. * Swapping Super-Linter for ansible-lint. * Running ansible-lint directly in the container. * Updating to latest Ubuntu. * Revert "Fixing test.sh to explicitly call bash." This reverts commit 521279ebc16a4c4459c981bfb813cf6aa4d4f3ad. * Fixing ansible-lint issues. * Revert "Fixing ansible-lint issues." This reverts commit 08a74046d567ea80acc080ec3cec60a7f8ceed48. * Removing old travis config. * Spacing issue fix. * Running tests on pull_request only. Co-authored-by: EmlynK * Use correct variable when setting the RDS instance type as part of ASG creation. (#32) Co-authored-by: Emlyn Kinzett * Fix alb health check (#31) * It's traffic-port, not target-port. Doh. * Update documentation. Co-authored-by: Emlyn Kinzett * Adding note on existence of 'config' directory for de-deploy to work. * Adding link to provided example config directory. * Generate saml sso requirements (#33) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Adding AWS CLI and credentials files to local ce-dev. * New AWS IAM Ansible role for creating the necessary IdP and role for admin access. Co-authored-by: EmlynK * Generate saml sso requirements devel (#36) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Adding AWS CLI and credentials files to local ce-dev. * New AWS IAM Ansible role for creating the necessary IdP and role for admin access. * Cleaning variables to be generic and improving LDAP role handling. Co-authored-by: EmlynK * Generate saml sso requirements devel (#37) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Adding AWS CLI and credentials files to local ce-dev. * New AWS IAM Ansible role for creating the necessary IdP and role for admin access. * GitHub actions into v1. (#30) * Adding Super Linter workflow for GitHub Actions. * Adding the documentation checker. * Getting GitHub Actions to continue on failure. * Seeing if Git exists. * Missing space. * Re-adding the checkout and the git commands. * Trying Pascal's script. * Adding both lines to the same 'run' command. * GitHub Actions wtf - splitting into two steps. * Trying steps on branch name. * Trying steps on branch name AGAIN. * Would be good to get the syntax right. * Trying different quotes. * Checking the contents of the github.ref variable. * Trying to add in Pascal's testing step. * Adding in /bin/sh to hopefully make test.sh run. * Google says try it with /bin/bash. * Trying a different Ubuntu version. * Installing net-tools to have ifconfig. * Updating testing shell (#28) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Fixing test.sh to explicitly call bash. GitHub Actions only supports Ubuntu containers and Ubuntu shell is dash by default, not bash. Consequently /bin/sh doesn't invoke bash, but dash, which causes some unexpected errors down the line. Co-authored-by: EmlynK * We probably don't need /bin/bash * Making test.sh executable. * Checking shell. * Explicitly setting shell to bash in provision.sh. * Trying ubuntu-16.04 as Travis used this. * Putting shell back. * Update provision.sh * Making /bin/bash the shell. * Making /bin/bash the shell for provision. * Explicitly stating bash again in YML. * Turns out the mkcert binary is out of date. * Compiled mkcert from source. * Fixing curl error. * Switching to wget. * Starting the linter again and renaming job. * Only lint changed files. * Linting a non-existent branch! * Tidying the documentation check. * Revert "Making /bin/bash the shell for provision." This reverts commit f5f35818205cd364a66a6e51c9f9d8254f016422. * Revert "Making /bin/bash the shell." This reverts commit df585b36877aa2328adc228cd8f76950e2853d36. * Revert "Tidying the documentation check." This reverts commit a0c964e15003c8486f4d01232af6e855a475298e. * Swapping Super-Linter for ansible-lint. * Running ansible-lint directly in the container. * Updating to latest Ubuntu. * Revert "Fixing test.sh to explicitly call bash." This reverts commit 521279ebc16a4c4459c981bfb813cf6aa4d4f3ad. * Fixing ansible-lint issues. * Revert "Fixing ansible-lint issues." This reverts commit 08a74046d567ea80acc080ec3cec60a7f8ceed48. * Removing old travis config. * Spacing issue fix. * Running tests on pull_request only. Co-authored-by: EmlynK * Cleaning variables to be generic and improving LDAP role handling. * Adding modified iam_alis module found on GitHub. * Adding management of IAM account alias. * Revert "Merge branch 'devel' into generate_saml_sso_requirements" This reverts commit a4051979f45aa2518db36fd2f9c9751b0364b69c, reversing changes made to b9e67325e2b69b9dd22483acaaec77ef80fa7177. * Adding note on existence of 'config' directory for de-deploy to work. * Adding link to provided example config directory. Co-authored-by: EmlynK * phpfpm variables (#38) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * GitHub actions into v1. (#30) * Adding Super Linter workflow for GitHub Actions. * Adding the documentation checker. * Getting GitHub Actions to continue on failure. * Seeing if Git exists. * Missing space. * Re-adding the checkout and the git commands. * Trying Pascal's script. * Adding both lines to the same 'run' command. * GitHub Actions wtf - splitting into two steps. * Trying steps on branch name. * Trying steps on branch name AGAIN. * Would be good to get the syntax right. * Trying different quotes. * Checking the contents of the github.ref variable. * Trying to add in Pascal's testing step. * Adding in /bin/sh to hopefully make test.sh run. * Google says try it with /bin/bash. * Trying a different Ubuntu version. * Installing net-tools to have ifconfig. * Updating testing shell (#28) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Fixing test.sh to explicitly call bash. GitHub Actions only supports Ubuntu containers and Ubuntu shell is dash by default, not bash. Consequently /bin/sh doesn't invoke bash, but dash, which causes some unexpected errors down the line. Co-authored-by: EmlynK * We probably don't need /bin/bash * Making test.sh executable. * Checking shell. * Explicitly setting shell to bash in provision.sh. * Trying ubuntu-16.04 as Travis used this. * Putting shell back. * Update provision.sh * Making /bin/bash the shell. * Making /bin/bash the shell for provision. * Explicitly stating bash again in YML. * Turns out the mkcert binary is out of date. * Compiled mkcert from source. * Fixing curl error. * Switching to wget. * Starting the linter again and renaming job. * Only lint changed files. * Linting a non-existent branch! * Tidying the documentation check. * Revert "Making /bin/bash the shell for provision." This reverts commit f5f35818205cd364a66a6e51c9f9d8254f016422. * Revert "Making /bin/bash the shell." This reverts commit df585b36877aa2328adc228cd8f76950e2853d36. * Revert "Tidying the documentation check." This reverts commit a0c964e15003c8486f4d01232af6e855a475298e. * Swapping Super-Linter for ansible-lint. * Running ansible-lint directly in the container. * Updating to latest Ubuntu. * Revert "Fixing test.sh to explicitly call bash." This reverts commit 521279ebc16a4c4459c981bfb813cf6aa4d4f3ad. * Fixing ansible-lint issues. * Revert "Fixing ansible-lint issues." This reverts commit 08a74046d567ea80acc080ec3cec60a7f8ceed48. * Removing old travis config. * Spacing issue fix. * Running tests on pull_request only. Co-authored-by: EmlynK * Adding some PHP pool values that can be tweaked and the default_socket_timeout in php.ini. Co-authored-by: Greg Harvey * Generate saml sso requirements devel (#39) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Adding AWS CLI and credentials files to local ce-dev. * New AWS IAM Ansible role for creating the necessary IdP and role for admin access. * GitHub actions into v1. (#30) * Adding Super Linter workflow for GitHub Actions. * Adding the documentation checker. * Getting GitHub Actions to continue on failure. * Seeing if Git exists. * Missing space. * Re-adding the checkout and the git commands. * Trying Pascal's script. * Adding both lines to the same 'run' command. * GitHub Actions wtf - splitting into two steps. * Trying steps on branch name. * Trying steps on branch name AGAIN. * Would be good to get the syntax right. * Trying different quotes. * Checking the contents of the github.ref variable. * Trying to add in Pascal's testing step. * Adding in /bin/sh to hopefully make test.sh run. * Google says try it with /bin/bash. * Trying a different Ubuntu version. * Installing net-tools to have ifconfig. * Updating testing shell (#28) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Fixing test.sh to explicitly call bash. GitHub Actions only supports Ubuntu containers and Ubuntu shell is dash by default, not bash. Consequently /bin/sh doesn't invoke bash, but dash, which causes some unexpected errors down the line. Co-authored-by: EmlynK * We probably don't need /bin/bash * Making test.sh executable. * Checking shell. * Explicitly setting shell to bash in provision.sh. * Trying ubuntu-16.04 as Travis used this. * Putting shell back. * Update provision.sh * Making /bin/bash the shell. * Making /bin/bash the shell for provision. * Explicitly stating bash again in YML. * Turns out the mkcert binary is out of date. * Compiled mkcert from source. * Fixing curl error. * Switching to wget. * Starting the linter again and renaming job. * Only lint changed files. * Linting a non-existent branch! * Tidying the documentation check. * Revert "Making /bin/bash the shell for provision." This reverts commit f5f35818205cd364a66a6e51c9f9d8254f016422. * Revert "Making /bin/bash the shell." This reverts commit df585b36877aa2328adc228cd8f76950e2853d36. * Revert "Tidying the documentation check." This reverts commit a0c964e15003c8486f4d01232af6e855a475298e. * Swapping Super-Linter for ansible-lint. * Running ansible-lint directly in the container. * Updating to latest Ubuntu. * Revert "Fixing test.sh to explicitly call bash." This reverts commit 521279ebc16a4c4459c981bfb813cf6aa4d4f3ad. * Fixing ansible-lint issues. * Revert "Fixing ansible-lint issues." This reverts commit 08a74046d567ea80acc080ec3cec60a7f8ceed48. * Removing old travis config. * Spacing issue fix. * Running tests on pull_request only. Co-authored-by: EmlynK * Cleaning variables to be generic and improving LDAP role handling. * Adding modified iam_alis module found on GitHub. * Adding management of IAM account alias. * Revert "Merge branch 'devel' into generate_saml_sso_requirements" This reverts commit a4051979f45aa2518db36fd2f9c9751b0364b69c, reversing changes made to b9e67325e2b69b9dd22483acaaec77ef80fa7177. * Fixing conflict with ce-dev/README.md. * Adding a template for SimpleSAMLphp account SPs. * Renaming template file for SAML and adding an include file for SAML admins. * Renaming template file for SAML admins. * Adding tasks for handling SimpleSAMLphp repo actions. * Refactoring git commits to defend against existing files causing commit fails. * Moving X509Certificate to a variable. Co-authored-by: EmlynK * Override fastcgi_read_timeout in Nginx (#41) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * GitHub actions into v1. (#30) * Adding Super Linter workflow for GitHub Actions. * Adding the documentation checker. * Getting GitHub Actions to continue on failure. * Seeing if Git exists. * Missing space. * Re-adding the checkout and the git commands. * Trying Pascal's script. * Adding both lines to the same 'run' command. * GitHub Actions wtf - splitting into two steps. * Trying steps on branch name. * Trying steps on branch name AGAIN. * Would be good to get the syntax right. * Trying different quotes. * Checking the contents of the github.ref variable. * Trying to add in Pascal's testing step. * Adding in /bin/sh to hopefully make test.sh run. * Google says try it with /bin/bash. * Trying a different Ubuntu version. * Installing net-tools to have ifconfig. * Updating testing shell (#28) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Fixing test.sh to explicitly call bash. GitHub Actions only supports Ubuntu containers and Ubuntu shell is dash by default, not bash. Consequently /bin/sh doesn't invoke bash, but dash, which causes some unexpected errors down the line. Co-authored-by: EmlynK * We probably don't need /bin/bash * Making test.sh executable. * Checking shell. * Explicitly setting shell to bash in provision.sh. * Trying ubuntu-16.04 as Travis used this. * Putting shell back. * Update provision.sh * Making /bin/bash the shell. * Making /bin/bash the shell for provision. * Explicitly stating bash again in YML. * Turns out the mkcert binary is out of date. * Compiled mkcert from source. * Fixing curl error. * Switching to wget. * Starting the linter again and renaming job. * Only lint changed files. * Linting a non-existent branch! * Tidying the documentation check. * Revert "Making /bin/bash the shell for provision." This reverts commit f5f35818205cd364a66a6e51c9f9d8254f016422. * Revert "Making /bin/bash the shell." This reverts commit df585b36877aa2328adc228cd8f76950e2853d36. * Revert "Tidying the documentation check." This reverts commit a0c964e15003c8486f4d01232af6e855a475298e. * Swapping Super-Linter for ansible-lint. * Running ansible-lint directly in the container. * Updating to latest Ubuntu. * Revert "Fixing test.sh to explicitly call bash." This reverts commit 521279ebc16a4c4459c981bfb813cf6aa4d4f3ad. * Fixing ansible-lint issues. * Revert "Fixing ansible-lint issues." This reverts commit 08a74046d567ea80acc080ec3cec60a7f8ceed48. * Removing old travis config. * Spacing issue fix. * Running tests on pull_request only. Co-authored-by: EmlynK * Adding some PHP pool values that can be tweaked and the default_socket_timeout in php.ini. (#40) * Add ability to override Nginx fastcgi_read_timeout value. Co-authored-by: Greg Harvey * Generate saml sso requirements devel (#42) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Adding AWS CLI and credentials files to local ce-dev. * New AWS IAM Ansible role for creating the necessary IdP and role for admin access. * GitHub actions into v1. (#30) * Adding Super Linter workflow for GitHub Actions. * Adding the documentation checker. * Getting GitHub Actions to continue on failure. * Seeing if Git exists. * Missing space. * Re-adding the checkout and the git commands. * Trying Pascal's script. * Adding both lines to the same 'run' command. * GitHub Actions wtf - splitting into two steps. * Trying steps on branch name. * Trying steps on branch name AGAIN. * Would be good to get the syntax right. * Trying different quotes. * Checking the contents of the github.ref variable. * Trying to add in Pascal's testing step. * Adding in /bin/sh to hopefully make test.sh run. * Google says try it with /bin/bash. * Trying a different Ubuntu version. * Installing net-tools to have ifconfig. * Updating testing shell (#28) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Fixing test.sh to explicitly call bash. GitHub Actions only supports Ubuntu containers and Ubuntu shell is dash by default, not bash. Consequently /bin/sh doesn't invoke bash, but dash, which causes some unexpected errors down the line. Co-authored-by: EmlynK * We probably don't need /bin/bash * Making test.sh executable. * Checking shell. * Explicitly setting shell to bash in provision.sh. * Trying ubuntu-16.04 as Travis used this. * Putting shell back. * Update provision.sh * Making /bin/bash the shell. * Making /bin/bash the shell for provision. * Explicitly stating bash again in YML. * Turns out the mkcert binary is out of date. * Compiled mkcert from source. * Fixing curl error. * Switching to wget. * Starting the linter again and renaming job. * Only lint changed files. * Linting a non-existent branch! * Tidying the documentation check. * Revert "Making /bin/bash the shell for provision." This reverts commit f5f35818205cd364a66a6e51c9f9d8254f016422. * Revert "Making /bin/bash the shell." This reverts commit df585b36877aa2328adc228cd8f76950e2853d36. * Revert "Tidying the documentation check." This reverts commit a0c964e15003c8486f4d01232af6e855a475298e. * Swapping Super-Linter for ansible-lint. * Running ansible-lint directly in the container. * Updating to latest Ubuntu. * Revert "Fixing test.sh to explicitly call bash." This reverts commit 521279ebc16a4c4459c981bfb813cf6aa4d4f3ad. * Fixing ansible-lint issues. * Revert "Fixing ansible-lint issues." This reverts commit 08a74046d567ea80acc080ec3cec60a7f8ceed48. * Removing old travis config. * Spacing issue fix. * Running tests on pull_request only. Co-authored-by: EmlynK * Cleaning variables to be generic and improving LDAP role handling. * Adding modified iam_alis module found on GitHub. * Adding management of IAM account alias. * Revert "Merge branch 'devel' into generate_saml_sso_requirements" This reverts commit a4051979f45aa2518db36fd2f9c9751b0364b69c, reversing changes made to b9e67325e2b69b9dd22483acaaec77ef80fa7177. * Fixing conflict with ce-dev/README.md. * Adding a template for SimpleSAMLphp account SPs. * Renaming template file for SAML and adding an include file for SAML admins. * Renaming template file for SAML admins. * Adding tasks for handling SimpleSAMLphp repo actions. * Refactoring git commits to defend against existing files causing commit fails. * Moving X509Certificate to a variable. * Wrapping the LinOTP code in the SAML template in an 'if' statement. Co-authored-by: EmlynK * Generate saml sso requirements devel (#43) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Adding AWS CLI and credentials files to local ce-dev. * New AWS IAM Ansible role for creating the necessary IdP and role for admin access. * GitHub actions into v1. (#30) * Adding Super Linter workflow for GitHub Actions. * Adding the documentation checker. * Getting GitHub Actions to continue on failure. * Seeing if Git exists. * Missing space. * Re-adding the checkout and the git commands. * Trying Pascal's script. * Adding both lines to the same 'run' command. * GitHub Actions wtf - splitting into two steps. * Trying steps on branch name. * Trying steps on branch name AGAIN. * Would be good to get the syntax right. * Trying different quotes. * Checking the contents of the github.ref variable. * Trying to add in Pascal's testing step. * Adding in /bin/sh to hopefully make test.sh run. * Google says try it with /bin/bash. * Trying a different Ubuntu version. * Installing net-tools to have ifconfig. * Updating testing shell (#28) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Fixing test.sh to explicitly call bash. GitHub Actions only supports Ubuntu containers and Ubuntu shell is dash by default, not bash. Consequently /bin/sh doesn't invoke bash, but dash, which causes some unexpected errors down the line. Co-authored-by: EmlynK * We probably don't need /bin/bash * Making test.sh executable. * Checking shell. * Explicitly setting shell to bash in provision.sh. * Trying ubuntu-16.04 as Travis used this. * Putting shell back. * Update provision.sh * Making /bin/bash the shell. * Making /bin/bash the shell for provision. * Explicitly stating bash again in YML. * Turns out the mkcert binary is out of date. * Compiled mkcert from source. * Fixing curl error. * Switching to wget. * Starting the linter again and renaming job. * Only lint changed files. * Linting a non-existent branch! * Tidying the documentation check. * Revert "Making /bin/bash the shell for provision." This reverts commit f5f35818205cd364a66a6e51c9f9d8254f016422. * Revert "Making /bin/bash the shell." This reverts commit df585b36877aa2328adc228cd8f76950e2853d36. * Revert "Tidying the documentation check." This reverts commit a0c964e15003c8486f4d01232af6e855a475298e. * Swapping Super-Linter for ansible-lint. * Running ansible-lint directly in the container. * Updating to latest Ubuntu. * Revert "Fixing test.sh to explicitly call bash." This reverts commit 521279ebc16a4c4459c981bfb813cf6aa4d4f3ad. * Fixing ansible-lint issues. * Revert "Fixing ansible-lint issues." This reverts commit 08a74046d567ea80acc080ec3cec60a7f8ceed48. * Removing old travis config. * Spacing issue fix. * Running tests on pull_request only. Co-authored-by: EmlynK * Cleaning variables to be generic and improving LDAP role handling. * Adding modified iam_alis module found on GitHub. * Adding management of IAM account alias. * Revert "Merge branch 'devel' into generate_saml_sso_requirements" This reverts commit a4051979f45aa2518db36fd2f9c9751b0364b69c, reversing changes made to b9e67325e2b69b9dd22483acaaec77ef80fa7177. * Fixing conflict with ce-dev/README.md. * Adding a template for SimpleSAMLphp account SPs. * Renaming template file for SAML and adding an include file for SAML admins. * Renaming template file for SAML admins. * Adding tasks for handling SimpleSAMLphp repo actions. * Refactoring git commits to defend against existing files causing commit fails. * Moving X509Certificate to a variable. * Wrapping the LinOTP code in the SAML template in an 'if' statement. * Extending the check to make sure LinOTP var isn't empty. * Removing references to LDAP in SAML groups attribute config, no need to assume. * Adding docs for the aws_iam_saml role. Co-authored-by: EmlynK * Adding aws_iam_saml docs (#45) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * GitHub actions into v1. (#30) * Adding Super Linter workflow for GitHub Actions. * Adding the documentation checker. * Getting GitHub Actions to continue on failure. * Seeing if Git exists. * Missing space. * Re-adding the checkout and the git commands. * Trying Pascal's script. * Adding both lines to the same 'run' command. * GitHub Actions wtf - splitting into two steps. * Trying steps on branch name. * Trying steps on branch name AGAIN. * Would be good to get the syntax right. * Trying different quotes. * Checking the contents of the github.ref variable. * Trying to add in Pascal's testing step. * Adding in /bin/sh to hopefully make test.sh run. * Google says try it with /bin/bash. * Trying a different Ubuntu version. * Installing net-tools to have ifconfig. * Updating testing shell (#28) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Fixing test.sh to explicitly call bash. GitHub Actions only supports Ubuntu containers and Ubuntu shell is dash by default, not bash. Consequently /bin/sh doesn't invoke bash, but dash, which causes some unexpected errors down the line. Co-authored-by: EmlynK * We probably don't need /bin/bash * Making test.sh executable. * Checking shell. * Explicitly setting shell to bash in provision.sh. * Trying ubuntu-16.04 as Travis used this. * Putting shell back. * Update provision.sh * Making /bin/bash the shell. * Making /bin/bash the shell for provision. * Explicitly stating bash again in YML. * Turns out the mkcert binary is out of date. * Compiled mkcert from source. * Fixing curl error. * Switching to wget. * Starting the linter again and renaming job. * Only lint changed files. * Linting a non-existent branch! * Tidying the documentation check. * Revert "Making /bin/bash the shell for provision." This reverts commit f5f35818205cd364a66a6e51c9f9d8254f016422. * Revert "Making /bin/bash the shell." This reverts commit df585b36877aa2328adc228cd8f76950e2853d36. * Revert "Tidying the documentation check." This reverts commit a0c964e15003c8486f4d01232af6e855a475298e. * Swapping Super-Linter for ansible-lint. * Running ansible-lint directly in the container. * Updating to latest Ubuntu. * Revert "Fixing test.sh to explicitly call bash." This reverts commit 521279ebc16a4c4459c981bfb813cf6aa4d4f3ad. * Fixing ansible-lint issues. * Revert "Fixing ansible-lint issues." This reverts commit 08a74046d567ea80acc080ec3cec60a7f8ceed48. * Removing old travis config. * Spacing issue fix. * Running tests on pull_request only. Co-authored-by: EmlynK * Adding some PHP pool values that can be tweaked and the default_socket_timeout in php.ini. (#40) * Generate saml sso requirements 1x (#44) * Wrong filter for efs info * Fix indentation error * Do not purge tags on existing EFS * Wrong name for updating EFS targets * Remove leftover loop * Fix error in subnet gathering * Split EFS creation * Use subnet ids * Wrong var name * Remove dead code * Wrong var * Missing subnet ids * Try not to loose existing SGs * Try to dedupe targets * Wrong syntax for combine * Typo in combining tupples * Wrong var name for append items * Fix appending subnets * Wrong list transformation * Switch to community module for efs * Remove unecessary complexity * Update documentation * Comment out Redefine Autoscale groups task for now and move some of its parameters to the other ASG creation task. * Remove replace_batch_size from ASG creation task, so it now defaults to 1. * Wrap Postfix handler commands in quotes. (#26) * Try using shell instead of command in Postfix handlers. * GitHub Actions integration (#29) * Adding Super Linter workflow for GitHub Actions. * Adding the documentation checker. * Getting GitHub Actions to continue on failure. * Seeing if Git exists. * Missing space. * Re-adding the checkout and the git commands. * Trying Pascal's script. * Adding both lines to the same 'run' command. * GitHub Actions wtf - splitting into two steps. * Trying steps on branch name. * Trying steps on branch name AGAIN. * Would be good to get the syntax right. * Trying different quotes. * Checking the contents of the github.ref variable. * Trying to add in Pascal's testing step. * Adding in /bin/sh to hopefully make test.sh run. * Google says try it with /bin/bash. * Trying a different Ubuntu version. * Installing net-tools to have ifconfig. * Updating testing shell (#28) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Fixing test.sh to explicitly call bash. GitHub Actions only supports Ubuntu containers and Ubuntu shell is dash by default, not bash. Consequently /bin/sh doesn't invoke bash, but dash, which causes some unexpected errors down the line. Co-authored-by: EmlynK * We probably don't need /bin/bash * Making test.sh executable. * Checking shell. * Explicitly setting shell to bash in provision.sh. * Trying ubuntu-16.04 as Travis used this. * Putting shell back. * Update provision.sh * Making /bin/bash the shell. * Making /bin/bash the shell for provision. * Explicitly stating bash again in YML. * Turns out the mkcert binary is out of date. * Compiled mkcert from source. * Fixing curl error. * Switching to wget. * Starting the linter again and renaming job. * Only lint changed files. * Linting a non-existent branch! * Tidying the documentation check. * Revert "Making /bin/bash the shell for provision." This reverts commit f5f35818205cd364a66a6e51c9f9d8254f016422. * Revert "Making /bin/bash the shell." This reverts commit df585b36877aa2328adc228cd8f76950e2853d36. * Revert "Tidying the documentation check." This reverts commit a0c964e15003c8486f4d01232af6e855a475298e. * Swapping Super-Linter for ansible-lint. * Running ansible-lint directly in the container. * Updating to latest Ubuntu. * Revert "Fixing test.sh to explicitly call bash." This reverts commit 521279ebc16a4c4459c981bfb813cf6aa4d4f3ad. * Fixing ansible-lint issues. * Revert "Fixing ansible-lint issues." This reverts commit 08a74046d567ea80acc080ec3cec60a7f8ceed48. * Removing old travis config. * Spacing issue fix. * Running tests on pull_request only. Co-authored-by: EmlynK * Use correct variable when setting the RDS instance type as part of ASG creation. (#32) Co-authored-by: Emlyn Kinzett * Fix alb health check (#31) * It's traffic-port, not target-port. Doh. * Update documentation. Co-authored-by: Emlyn Kinzett * Adding note on existence of 'config' directory for de-deploy to work. * Adding link to provided example config directory. * Adding AWS CLI and credentials files to local ce-dev. * New AWS IAM Ansible role for creating the necessary IdP and role for admin access. * Generate saml sso requirements (#33) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Adding AWS CLI and credentials files to local ce-dev. * New AWS IAM Ansible role for creating the necessary IdP and role for admin access. Co-authored-by: EmlynK * Cleaning variables to be generic and improving LDAP role handling. * Adding modified iam_alis module found on GitHub. * Generate saml sso requirements devel (#36) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Adding AWS CLI and credentials files to local ce-dev. * New AWS IAM Ansible role for creating the necessary IdP and role for admin access. * Cleaning variables to be generic and improving LDAP role handling. Co-authored-by: EmlynK * Adding management of IAM account alias. * Revert "Merge branch 'devel' into generate_saml_sso_requirements" This reverts commit a4051979f45aa2518db36fd2f9c9751b0364b69c, reversing changes made to b9e67325e2b69b9dd22483acaaec77ef80fa7177. * Generate saml sso requirements devel (#37) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Adding AWS CLI and credentials files to local ce-dev. * New AWS IAM Ansible role for creating the necessary IdP and role for admin access. * GitHub actions into v1. (#30) * Adding Super Linter workflow for GitHub Actions. * Adding the documentation checker. * Getting GitHub Actions to continue on failure. * Seeing if Git exists. * Missing space. * Re-adding the checkout and the git commands. * Trying Pascal's script. * Adding both lines to the same 'run' command. * GitHub Actions wtf - splitting into two steps. * Trying steps on branch name. * Trying steps on branch name AGAIN. * Would be good to get the syntax right. * Trying different quotes. * Checking the contents of the github.ref variable. * Trying to add in Pascal's testing step. * Adding in /bin/sh to hopefully make test.sh run. * Google says try it with /bin/bash. * Trying a different Ubuntu version. * Installing net-tools to have ifconfig. * Updating testing shell (#28) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Fixing test.sh to explicitly call bash. GitHub Actions only supports Ubuntu containers and Ubuntu shell is dash by default, not bash. Consequently /bin/sh doesn't invoke bash, but dash, which causes some unexpected errors down the line. Co-authored-by: EmlynK * We probably don't need /bin/bash * Making test.sh executable. * Checking shell. * Explicitly setting shell to bash in provision.sh. * Trying ubuntu-16.04 as Travis used this. * Putting shell back. * Update provision.sh * Making /bin/bash the shell. * Making /bin/bash the shell for provision. * Explicitly stating bash again in YML. * Turns out the mkcert binary is out of date. * Compiled mkcert from source. * Fixing curl error. * Switching to wget. * Starting the linter again and renaming job. * Only lint changed files. * Linting a non-existent branch! * Tidying the documentation check. * Revert "Making /bin/bash the shell for provision." This reverts commit f5f35818205cd364a66a6e51c9f9d8254f016422. * Revert "Making /bin/bash the shell." This reverts commit df585b36877aa2328adc228cd8f76950e2853d36. * Revert "Tidying the documentation check." This reverts commit a0c964e15003c8486f4d01232af6e855a475298e. * Swapping Super-Linter for ansible-lint. * Running ansible-lint directly in the container. * Updating to latest Ubuntu. * Revert "Fixing test.sh to explicitly call bash." This reverts commit 521279ebc16a4c4459c981bfb813cf6aa4d4f3ad. * Fixing ansible-lint issues. * Revert "Fixing ansible-lint issues." This reverts commit 08a74046d567ea80acc080ec3cec60a7f8ceed48. * Removing old travis config. * Spacing issue fix. * Running tests on pull_request only. Co-authored-by: EmlynK * Cleaning variables to be generic and improving LDAP role handling. * Adding modified iam_alis module found on GitHub. * Adding management of IAM account alias. * Revert "Merge branch 'devel' into generate_saml_sso_requirements" This reverts commit a4051979f45aa2518db36fd2f9c9751b0364b69c, reversing changes made to b9e67325e2b69b9dd22483acaaec77ef80fa7177. * Adding note on existence of 'config' directory for de-deploy to work. * Adding link to provided example config directory. Co-authored-by: EmlynK * Fixing conflict with ce-dev/README.md. * Adding a template for SimpleSAMLphp account SPs. * Renaming template file for SAML and adding an include file for SAML admins. * Renaming template file for SAML admins. * phpfpm variables (#38) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * GitHub actions into v1. (#30) * Adding Super Linter workflow for GitHub Actions. * Adding the documentation checker. * Getting GitHub Actions to continue on failure. * Seeing if Git exists. * Missing space. * Re-adding the checkout and the git commands. * Trying Pascal's script. * Adding both lines to the same 'run' command. * GitHub Actions wtf - splitting into two steps. * Trying steps on branch name. * Trying steps on branch name AGAIN. * Would be good to get the syntax right. * Trying different quotes. * Checking the contents of the github.ref variable. * Trying to add in Pascal's testing step. * Adding in /bin/sh to hopefully make test.sh run. * Google says try it with /bin/bash. * Trying a different Ubuntu version. * Installing net-tools to have ifconfig. * Updating testing shell (#28) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Fixing test.sh to explicitly call bash. GitHub Actions only supports Ubuntu containers and Ubuntu shell is dash by default, not bash. Consequently /bin/sh doesn't invoke bash, but dash, which causes some unexpected errors down the line. Co-authored-by: EmlynK * We probably don't need /bin/bash * Making test.sh executable. * Checking shell. * Explicitly setting shell to bash in provision.sh. * Trying ubuntu-16.04 as Travis used this. * Putting shell back. * Update provision.sh * Making /bin/bash the shell. * Making /bin/bash the shell for provision. * Explicitly stating bash again in YML. * Turns out the mkcert binary is out of date. * Compiled mkcert from source. * Fixing curl error. * Switching to wget. * Starting the linter again and renaming job. * Only lint changed files. * Linting a non-existent branch! * Tidying the documentation check. * Revert "Making /bin/bash the shell for provision." This reverts commit f5f35818205cd364a66a6e51c9f9d8254f016422. * Revert "Making /bin/bash the shell." This reverts commit df585b36877aa2328adc228cd8f76950e2853d36. * Revert "Tidying the documentation check." This reverts commit a0c964e15003c8486f4d01232af6e855a475298e. * Swapping Super-Linter for ansible-lint. * Running ansible-lint directly in the container. * Updating to latest Ubuntu. * Revert "Fixing test.sh to explicitly call bash." This reverts commit 521279ebc16a4c4459c981bfb813cf6aa4d4f3ad. * Fixing ansible-lint issues. * Revert "Fixing ansible-lint issues." This reverts commit 08a74046d567ea80acc080ec3cec60a7f8ceed48. * Removing old travis config. * Spacing issue fix. * Running tests on pull_request only. Co-authored-by: EmlynK * Adding some PHP pool values that can be tweaked and the default_socket_timeout in php.ini. Co-authored-by: Greg Harvey * Adding tasks for handling SimpleSAMLphp repo actions. * Refactoring git commits to defend against existing files causing commit fails. * Moving X509Certificate to a variable. * Generate saml sso requirements devel (#39) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Adding AWS CLI and credentials files to local ce-dev. * New AWS IAM Ansible role for creating the necessary IdP and role for admin access. * GitHub actions into v1. (#30) * Adding Super Linter workflow for GitHub Actions. * Adding the documentation checker. * Getting GitHub Actions to continue on failure. * Seeing if Git exists. * Missing space. * Re-adding the checkout and the git commands. * Trying Pascal's script. * Adding both lines to the same 'run' command. * GitHub Actions wtf - splitting into two steps. * Trying steps on branch name. * Trying steps on branch name AGAIN. * Would be good to get the syntax right. * Trying different quotes. * Checking the contents of the github.ref variable. * Trying to add in Pascal's testing step. * Adding in /bin/sh to hopefully make test.sh run. * Google says try it with /bin/bash. * Trying a different Ubuntu version. * Installing net-tools to have ifconfig. * Updating testing shell (#28) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Fixing test.sh to explicitly call bash. GitHub Actions only supports Ubuntu containers and Ubuntu shell is dash by default, not bash. Consequently /bin/sh doesn't invoke bash, but dash, which causes some unexpected errors down the line. Co-authored-by: EmlynK * We probably don't need /bin/bash * Making test.sh executable. * Checking shell. * Explicitly setting shell to bash in provision.sh. * Trying ubuntu-16.04 as Travis used this. * Putting shell back. * Update provision.sh * Making /bin/bash the shell. * Making /bin/bash the shell for provision. * Explicitly stating bash again in YML. * Turns out the mkcert binary is out of date. * Compiled mkcert from source. * Fixing curl error. * Switching to wget. * Starting the linter again and renaming job. * Only lint changed files. * Linting a non-existent branch! * Tidying the documentation check. * Revert "Making /bin/bash the shell for provision." This reverts commit f5f35818205cd364a66a6e51c9f9d8254f016422. * Revert "Making /bin/bash the shell." This reverts commit df585b36877aa2328adc228cd8f76950e2853d36. * Revert "Tidying the documentation check." This reverts commit a0c964e15003c8486f4d01232af6e855a475298e. * Swapping Super-Linter for ansible-lint. * Running ansible-lint directly in the container. * Updating to latest Ubuntu. * Revert "Fixing test.sh to explicitly call bash." This reverts commit 521279ebc16a4c4459c981bfb813cf6aa4d4f3ad. * Fixing ansible-lint issues. * Revert "Fixing ansible-lint issues." This reverts commit 08a74046d567ea80acc080ec3cec60a7f8ceed48. * Removing old travis config. * Spacing issue fix. * Running tests on pull_request only. Co-authored-by: EmlynK * Cleaning variables to be generic and improving LDAP role handling. * Adding modified iam_alis module found on GitHub. * Adding management of IAM account alias. * Revert "Merge branch 'devel' into generate_saml_sso_requirements" This reverts commit a4051979f45aa2518db36fd2f9c9751b0364b69c, reversing changes made to b9e67325e2b69b9dd22483acaaec77ef80fa7177. * Fixing conflict with ce-dev/README.md. * Adding a template fo… * Bug fixes 2.x pr 2.x (#1380) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Bug fixes 2.x pr 2.x (#1383) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Bug fixes 2.x pr 2.x (#1385) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Bug fixes 2.x pr 2.x (#1395) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Ansible install perms pr 2.x (#1398) * 2.x (#1363) * Devel 2.x (#1216) * R62347 fix postfix mail delivery pr devel (#791) * GitHub Actions - Rebuilt documentation. * Need to check if is_local is defined in webserver meta dependencies. (#522) * Ce dev refactor pr 1.x (#518) * Making it easier to test with provision-target and ce-dev. * Moving the provision forcing var back to plays so _init has it. * Adding defaults vars and test script extra options. * Adding a web server test to CI. * examples string needs to be in quotes. * Making sure is_local and _ce_provision_force_play are available to the _init role. * Adding SSH keys to the provision user. * Adding a --force to the test script. * Explicitly adding vars to role. * Fixing _init behaviour and adding SSH key for web role. * Setting default PHP version to 7.4. * Looking up the generated ce-dev SSH key instead of hard-coding one. * We cannot run the ssh_server role locally, so excluding for tests of webserver role. * Trying to remove user_root.yml in case it's breaking CI. * Adding a verbose mode to the test script. * Exposing the command in the test script. * Trying hard-coded keys again. * Changing location of data dir for test containers. * Putting vars back and restricting CI to the 'web' example. * Adding backup handling to ldap_server. (#525) * Adding backup handling to ldap_server. * Improving SSL docs and handling perms for openldap and letsencrypt. * Cron user must be specified with file. * Running as root, do not need a 'sudo' in this cron. * Allowing 'gitLab' to disable Prometheus. (#530) * Allowing 'gitLab' to disable Prometheus. * Booleans to use in jinja2 as strings must be cast as strings. * GitHub Actions - Rebuilt documentation. (#526) Co-authored-by: Code Enigma CI * Prometheus pr 1.x (#533) * Allowing 'gitLab' to disable Prometheus. * Booleans to use in jinja2 as strings must be cast as strings. * Tidying up CI and adding a GitLab test. * Fixing CI job description. * Add private files support for Drupal in Nginx. (#535) * Prometheus pr 1.x (#539) * Allowing 'gitLab' to disable Prometheus. * Booleans to use in jinja2 as strings must be cast as strings. * Tidying up CI and adding a GitLab test. * Fixing CI job description. * Adding a firewall config preset to open port 80 for LetsEncrypt. * Removing our unused ClamAV roles and adding a Galaxy role to common base. (#541) * Revert "Moving OSSEC pkill to use process_manager role instead. (#258)" (#544) This reverts commit 73c7bd0adb1105436e484fe794182c915b2d25dd. * Moving key servers to a variable so we can set them. (#555) * Moving key servers to a variable so we can set them. * Allowing us to disable sending keys completely. * Oops, doubled up on existing functionality. * Fixing var name. * Adding a reboot option to the patching role. (#557) * Add minimal support for Aurora RDS instances (#567) * Attempt to create an RDS read replica. * Use new task to create Aurora RDS instances. * Try and fix linting issues. * Don't pass max_storage variable for Aurora instances. * Remove more storage related vars from Aurora RDS instance creation task. * Add profile and region to read replica creation. * Try creating the Aurora read replica another way. * Add some debug info. * Work around the silly registering of variables in Ansible. * Rename an RDS CloudWatch task for Aurora DBs and remove RDS debug info. * Add some Aurora info to aws_rds README file. * Use reader instead of replica for Aurora readers. * Remove db_cluster_identifier variable from non-Aurora RDS task. * Gpg servers fix pr 1.x (#571) * Moving key servers to a variable so we can set them. * Allowing us to disable sending keys completely. * Oops, doubled up on existing functionality. * Fixing var name. * Using a pipe to grep with 'command' cannot work, refactoring. * Making CI use the meta deploy role to test gitlab. * We mustn't assume AWS servers for deploy and controller. * Support termination protection in EC2. (#573) * Support termination protection in EC2. * Fixing CI vars. * Fixing CI vars. * Fix managed SSL key perms and the variable used for the private key. (#575) * Ec2 subnet lookup pr 1.x (#583) * First pass at EC2 subnet detection. * Touching subnet file to ensure it exists. * Trying a different approach, file module didn't work. * Switching back to file module. * We need to create the directory for new servers too. * Bad variable name. * Ec2 subnet lookup pr 1.x (#589) * First pass at EC2 subnet detection. * Touching subnet file to ensure it exists. * Trying a different approach, file module didn't work. * Switching back to file module. * We need to create the directory for new servers too. * Bad variable name. * Changing subnet lookup order to check for defined subnet first. * Fixing gitlab-runner overriders so upgrades do not break the runner. (#586) * Fixing gitlab-runner overriders so upgrades do not break the runner. * Fixing override file template. * Hopefully fixing CI. * Making sure the service directory exists. * We cannot use the deploy meta role in CI because of LDAP. * Changing dir perms and adding a force. * Gitlab runner service override pr 1.x (#591) * Fixing gitlab-runner overriders so upgrades do not break the runner. * Fixing override file template. * Hopefully fixing CI. * Making sure the service directory exists. * We cannot use the deploy meta role in CI because of LDAP. * Changing dir perms and adding a force. * Debugging gitlab-runner directory creation issues in CI. * Fixing linting error. * Removing verbosity again but leaving 'stat' command in. * Pass db_cluster_identifier for RDS instance during ASG build (#600) * Pass RDS db_cluster_identifier, if present, during an ASG build. * Use correct variable name for RDS db_cluster_identifier. * Add a commented variable to ASG role for db_cluster_identifier so it's documented. * Also pass in the aurora_reader var from the ASG role when including the aws_rds role. (#605) * Removing obsolete MySQL config option log_syslog from template. (#607) * GitHub Actions - Rebuilt documentation. (#536) Co-authored-by: Code Enigma CI * Consistent default region pr 1.x (#611) * Moving all region settings to _aws_region var and adding README update. * Documentation update. * No need for region, IAM SAML setup is global, (#617) * Support ebs encryption pr 1.x (#609) * Adding volume encryption and type options plus a bit more flexibility on EBS control for EC2. * Setting more sane default instance sizes. * Adding more EBS options for ASGs. * Setting encryption to match AMI settings. * Setting encryption to match AMI settings. * We also need to dynamically set the ASGs own encrypt_boot var. * We need to merge the new branch changes before we can rebuild the docs. * Fixing merge command in CI. * Not sure toc.sh is actually executing. * Refactoring encrypt EBS flags to avoid detected loop condition in vars. * Safer CI, only adds .md files. * Trying to figure out CI logic for building docs. * Trying to figure out CI logic for building docs. * Trying to figure out CI logic for building docs. * Trying adding a git pull. * Setting git pull config options. * Reordering things. * Adding --allow-unrelated-histories to the git pull. * Trying a feature branch approach. * Forcing the GitHub action to fetch all git history. * Bad whitespace, naughty whitespace. * Trying a different PR action. * Do not merge the branch in, we only want the markdown changes. * Keeping the documentation branch clean. * We need to push a detached HEAD. * Do we need the checkout at all? * Adding a docs pull. * Allow install|update scripts in Drupal8+ (#599) * Add some flexibility to Packer (#633) * Add ability to pass on-error and force to Packer. * Add new Packer options to the ASG role as well. * Packer build options need to be declared before the file that is being built. * Allow Packer ssh_username to be set. * Making PHP >= 8.0 compatible (#634) * Packer VPC filtering (#638) * Add ability to set vpc_filter and subnet AZ for Packer builds. * Add fqcn-builtins to .ansible-lint warn_list for now. * GitHub Actions seemingly ignores warn_list. * Use simplified variables for Packer VPC stuff. * Only use one filter when filtering VPCs for Packer. * Cert management pr 1.x (#640) * Making sure we can't accidentally commit AWS API credentials. * Initial commit of ACM role. * Only pause for a get-certificate call if we want to export. * Updating docs. * Cert management pr 1.x (#642) * Making sure we can't accidentally commit AWS API credentials. * Initial commit of ACM role. * Only pause for a get-certificate call if we want to export. * Updating docs. * Missed a couple of variables to update. * Cert management pr 1.x (#644) * Making sure we can't accidentally commit AWS API credentials. * Initial commit of ACM role. * Only pause for a get-certificate call if we want to export. * Updating docs. * Missed a couple of variables to update. * We cannot rely on the variable being nonexistent here. * Cert management pr 1.x (#647) * Making sure we can't accidentally commit AWS API credentials. * Initial commit of ACM role. * Only pause for a get-certificate call if we want to export. * Updating docs. * Missed a couple of variables to update. * We cannot rely on the variable being nonexistent here. * Allowing ce-provision to set the basic auth message for Nginx. * Supporting SAN certs and tags on ACM certificates. * Fixing namespacing. * Auto-generating SSL certs for ALB and CloudFront. * More namespace fixes. * Fixing CI issue with missing AWS region var. * Reinstating replace_batch_size for ASGs to see if it speeds up infra builds. * Adding public IP option to LC config for ASGs. * Refactoring ACM domain handling so we can create DNS entries for each SAN domain. * Fixing mistake in domains set_fact. * Fixing AnsibleUndefined bug caused by skipped task. * Fix Nginx auth_message in vhost (#653) * Revert auth_message change in Nginx role for now. * Revert "Revert auth_message change in Nginx role for now." This reverts commit d030e4c628728ab553a0f5687497cf566bcd1179. * Add default for Nginx auth_message. * Cert management pr 1.x (#655) * Making sure we can't accidentally commit AWS API credentials. * Initial commit of ACM role. * Only pause for a get-certificate call if we want to export. * Updating docs. * Missed a couple of variables to update. * We cannot rely on the variable being nonexistent here. * Allowing ce-provision to set the basic auth message for Nginx. * Supporting SAN certs and tags on ACM certificates. * Fixing namespacing. * Auto-generating SSL certs for ALB and CloudFront. * More namespace fixes. * Fixing CI issue with missing AWS region var. * Reinstating replace_batch_size for ASGs to see if it speeds up infra builds. * Adding public IP option to LC config for ASGs. * Refactoring ACM domain handling so we can create DNS entries for each SAN domain. * Fixing mistake in domains set_fact. * Fixing AnsibleUndefined bug caused by skipped task. * Handling multiple domain validations for SAN certs. * Fixing bad variable name. * Fixing ASG DNS entries so it adds entries for SAN cert domains too. * For DNS validation we should not use --domain-validation-options at all. * Writing over the aws_acm.extra_domains var didn't work, setting a new var instead. * Bad dict structure. * Improving multi domain handling for ASG DNS. * Supporting multiple CloudFront aliases for an ASG. * Adding options to disable sign-up, sign-in and private projects. (#663) * Making ALB healthchecks optional and defaulting to disabled. (#670) * Making ALB healthchecks optional and defaulting to disabled. * Defaulting back to ELB health checks. * Remove alb healthchecks pr 1.x (#673) * Making ALB healthchecks optional and defaulting to disabled. * Defaulting back to ELB health checks. * Making sure new clusters won't fail because no ALB yet. * Allow user to set cachetool version in the opcache role. (#665) * Allow user to set cachetool version in the opcache role. * Adding a comment for a future improvement. * Adding a 'repack' option for AMIs and ASGs. (#675) * Adding a 'repack' option for AMIs and ASGs. * Adding an option to force a Packer rebuild in an ASG. * Fixing EC2 instance look-up to use cluster name. * Separating AMI provisioning tasks into a tasks file that can be included. * Refactoring AMI operation to allow current behaviour to remain default. * Trying to delegate tasks to target repack instance. * Switching from import_tasks to include_tasks. * Fixing the instance DNS name var. * Changing approach to make a standalone machine to generate AMI from. * Gah! Typo! * AMI generation requires region and profile. * Didn't wrap instance_id lookup properly. * Fixing some missing namespaces. * Missed a bad var when fixing. * Adding full set of variables for EC2 instance. * Fixing AWS SSH key name. * Decided not to use the EC2 + EIP role. * Trying to add a pause after instance launch. * Passing the target branch to Ansible as a var. * Support absolute paths to playbooks. * Refactoring to make ce-provision call itself for AMI packing tasks. * Doubled up the script path. * Switching to base dir var for ce-provision call. * Moving temp EC2 instances for AMI creation to subnet with IGW. * State of EC2 instance needs to be started instead of running. * We need to delete the AMI we created before making another one. * Refactoring AMI repack variables for readability and removing volume size. * Missed a refactored var. * Defending against AMI volume size issues for ASGs. * Refactoring extra vars handling. * For some reason Packer seems to double the brackets. * Revert "For some reason Packer seems to double the brackets." This reverts commit 13ee8df42b80b102e9e19a01407b3afb69952ee5. * Fixing packer.json white space. * We need to reset the _aws_ami_extra_vars variable to an empty string before we rebuild it. * Slight refactor to move the extra vars building to the relevant included tasks. * Slight documentation change. * Moved config extra vars to ce-provision as they are globally sane. * Error in jinja list building for RDS. * Ami repack option pr 1.x (#707) * Adding a 'repack' option for AMIs and ASGs. * Adding an option to force a Packer rebuild in an ASG. * Fixing EC2 instance look-up to use cluster name. * Separating AMI provisioning tasks into a tasks file that can be included. * Refactoring AMI operation to allow current behaviour to remain default. * Trying to delegate tasks to target repack instance. * Switching from import_tasks to include_tasks. * Fixing the instance DNS name var. * Changing approach to make a standalone machine to generate AMI from. * Gah! Typo! * AMI generation requires region and profile. * Didn't wrap instance_id lookup properly. * Fixing some missing namespaces. * Missed a bad var when fixing. * Adding full set of variables for EC2 instance. * Fixing AWS SSH key name. * Decided not to use the EC2 + EIP role. * Trying to add a pause after instance launch. * Passing the target branch to Ansible as a var. * Support absolute paths to playbooks. * Refactoring to make ce-provision call itself for AMI packing tasks. * Doubled up the script path. * Switching to base dir var for ce-provision call. * Moving temp EC2 instances for AMI creation to subnet with IGW. * State of EC2 instance needs to be started instead of running. * We need to delete the AMI we created before making another one. * Refactoring AMI repack variables for readability and removing volume size. * Missed a refactored var. * Defending against AMI volume size issues for ASGs. * Refactoring extra vars handling. * For some reason Packer seems to double the brackets. * Revert "For some reason Packer seems to double the brackets." This reverts commit 13ee8df42b80b102e9e19a01407b3afb69952ee5. * Fixing packer.json white space. * We need to reset the _aws_ami_extra_vars variable to an empty string before we rebuild it. * Slight refactor to move the extra vars building to the relevant included tasks. * Slight documentation change. * Moved config extra vars to ce-provision as they are globally sane. * Error in jinja list building for RDS. * Trailing VPC ID fields using the wrong variable. * Editing GitLab config so LE is enabled and auto-renewing by default. (#709) * Provide profile and region when creating an RDS parameter group, and also provide ability to set the parameter group for an Aurora RDS instance. (#712) * Add a task in ASG role to add an Aurora RDS endpoint. (#714) * Ssl le fixes pr 1.x (#725) * Allow multiple domains to be passed. * Ensuring we don't break older implementations. * First pass at a bash script we can run on cron for LE renewals. * Place the autorenewal script and create a cron entry. * Allowing the HTTP-01 listen port to be set to something other than 80. * Need single quotes within our double quotes. * Adding optional proxy for LE. * Revert "Adding optional proxy for LE." This reverts commit cf5720b450744915872eacafee82164300df90aa. * Adding support for apache and nginx plugins for certbot. * Fixing quote error. * Fixing SSL LE handilng and ensuring other handlers work with multiple provided domains. * Fixing issue with selecting first domain. * Correcting variable names. * LE cron template missing an endfor. * Missing carriage return in LE cron script. * Turns out you can't alter facts passed in via vars by include_role. * Fixing SSL defaults. * Realised if there are multiple different LE runs each needs it's own renewal cron. * Ensure builds don't fail if ssl.web_server isn't provided. * Defending against empty SSL services list. * Improving vhost template LE handling. * Adjusting SSL cert and key var names. * Adding a temporary vhost so newly added domains can request LE certs. * Tabbing error. * Fixing possible 'resolver' errors in Nginx if you use localhost. * Renaming loopvar from domain to certificate_domain to avoid clash with nginx role. * Tweaking Nginx LE handling and making certbot commands customisable. * Fixing minor typo. * Trying giving include_role the public flag. * Documentation updates. * Adding default value to Nginx vhost template. * Move drupal8 install/update config to drupal_common under if local block. (#733) * WIP: 58848 apache role pr 1.x (#667) * Catching up devel. (#243) * Devel (#175) * Wrong filter for efs info * Fix indentation error * Do not purge tags on existing EFS * Wrong name for updating EFS targets * Remove leftover loop * Fix error in subnet gathering * Split EFS creation * Use subnet ids * Wrong var name * Remove dead code * Wrong var * Missing subnet ids * Try not to loose existing SGs * Try to dedupe targets * Wrong syntax for combine * Typo in combining tupples * Wrong var name for append items * Fix appending subnets * Wrong list transformation * Switch to community module for efs * Remove unecessary complexity * Update documentation * Comment out Redefine Autoscale groups task for now and move some of its parameters to the other ASG creation task. * Remove replace_batch_size from ASG creation task, so it now defaults to 1. * Wrap Postfix handler commands in quotes. (#26) * Try using shell instead of command in Postfix handlers. * GitHub Actions integration (#29) * Adding Super Linter workflow for GitHub Actions. * Adding the documentation checker. * Getting GitHub Actions to continue on failure. * Seeing if Git exists. * Missing space. * Re-adding the checkout and the git commands. * Trying Pascal's script. * Adding both lines to the same 'run' command. * GitHub Actions wtf - splitting into two steps. * Trying steps on branch name. * Trying steps on branch name AGAIN. * Would be good to get the syntax right. * Trying different quotes. * Checking the contents of the github.ref variable. * Trying to add in Pascal's testing step. * Adding in /bin/sh to hopefully make test.sh run. * Google says try it with /bin/bash. * Trying a different Ubuntu version. * Installing net-tools to have ifconfig. * Updating testing shell (#28) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Fixing test.sh to explicitly call bash. GitHub Actions only supports Ubuntu containers and Ubuntu shell is dash by default, not bash. Consequently /bin/sh doesn't invoke bash, but dash, which causes some unexpected errors down the line. Co-authored-by: EmlynK * We probably don't need /bin/bash * Making test.sh executable. * Checking shell. * Explicitly setting shell to bash in provision.sh. * Trying ubuntu-16.04 as Travis used this. * Putting shell back. * Update provision.sh * Making /bin/bash the shell. * Making /bin/bash the shell for provision. * Explicitly stating bash again in YML. * Turns out the mkcert binary is out of date. * Compiled mkcert from source. * Fixing curl error. * Switching to wget. * Starting the linter again and renaming job. * Only lint changed files. * Linting a non-existent branch! * Tidying the documentation check. * Revert "Making /bin/bash the shell for provision." This reverts commit f5f35818205cd364a66a6e51c9f9d8254f016422. * Revert "Making /bin/bash the shell." This reverts commit df585b36877aa2328adc228cd8f76950e2853d36. * Revert "Tidying the documentation check." This reverts commit a0c964e15003c8486f4d01232af6e855a475298e. * Swapping Super-Linter for ansible-lint. * Running ansible-lint directly in the container. * Updating to latest Ubuntu. * Revert "Fixing test.sh to explicitly call bash." This reverts commit 521279ebc16a4c4459c981bfb813cf6aa4d4f3ad. * Fixing ansible-lint issues. * Revert "Fixing ansible-lint issues." This reverts commit 08a74046d567ea80acc080ec3cec60a7f8ceed48. * Removing old travis config. * Spacing issue fix. * Running tests on pull_request only. Co-authored-by: EmlynK * Use correct variable when setting the RDS instance type as part of ASG creation. (#32) Co-authored-by: Emlyn Kinzett * Fix alb health check (#31) * It's traffic-port, not target-port. Doh. * Update documentation. Co-authored-by: Emlyn Kinzett * Adding note on existence of 'config' directory for de-deploy to work. * Adding link to provided example config directory. * Generate saml sso requirements (#33) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Adding AWS CLI and credentials files to local ce-dev. * New AWS IAM Ansible role for creating the necessary IdP and role for admin access. Co-authored-by: EmlynK * Generate saml sso requirements devel (#36) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Adding AWS CLI and credentials files to local ce-dev. * New AWS IAM Ansible role for creating the necessary IdP and role for admin access. * Cleaning variables to be generic and improving LDAP role handling. Co-authored-by: EmlynK * Generate saml sso requirements devel (#37) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Adding AWS CLI and credentials files to local ce-dev. * New AWS IAM Ansible role for creating the necessary IdP and role for admin access. * GitHub actions into v1. (#30) * Adding Super Linter workflow for GitHub Actions. * Adding the documentation checker. * Getting GitHub Actions to continue on failure. * Seeing if Git exists. * Missing space. * Re-adding the checkout and the git commands. * Trying Pascal's script. * Adding both lines to the same 'run' command. * GitHub Actions wtf - splitting into two steps. * Trying steps on branch name. * Trying steps on branch name AGAIN. * Would be good to get the syntax right. * Trying different quotes. * Checking the contents of the github.ref variable. * Trying to add in Pascal's testing step. * Adding in /bin/sh to hopefully make test.sh run. * Google says try it with /bin/bash. * Trying a different Ubuntu version. * Installing net-tools to have ifconfig. * Updating testing shell (#28) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Fixing test.sh to explicitly call bash. GitHub Actions only supports Ubuntu containers and Ubuntu shell is dash by default, not bash. Consequently /bin/sh doesn't invoke bash, but dash, which causes some unexpected errors down the line. Co-authored-by: EmlynK * We probably don't need /bin/bash * Making test.sh executable. * Checking shell. * Explicitly setting shell to bash in provision.sh. * Trying ubuntu-16.04 as Travis used this. * Putting shell back. * Update provision.sh * Making /bin/bash the shell. * Making /bin/bash the shell for provision. * Explicitly stating bash again in YML. * Turns out the mkcert binary is out of date. * Compiled mkcert from source. * Fixing curl error. * Switching to wget. * Starting the linter again and renaming job. * Only lint changed files. * Linting a non-existent branch! * Tidying the documentation check. * Revert "Making /bin/bash the shell for provision." This reverts commit f5f35818205cd364a66a6e51c9f9d8254f016422. * Revert "Making /bin/bash the shell." This reverts commit df585b36877aa2328adc228cd8f76950e2853d36. * Revert "Tidying the documentation check." This reverts commit a0c964e15003c8486f4d01232af6e855a475298e. * Swapping Super-Linter for ansible-lint. * Running ansible-lint directly in the container. * Updating to latest Ubuntu. * Revert "Fixing test.sh to explicitly call bash." This reverts commit 521279ebc16a4c4459c981bfb813cf6aa4d4f3ad. * Fixing ansible-lint issues. * Revert "Fixing ansible-lint issues." This reverts commit 08a74046d567ea80acc080ec3cec60a7f8ceed48. * Removing old travis config. * Spacing issue fix. * Running tests on pull_request only. Co-authored-by: EmlynK * Cleaning variables to be generic and improving LDAP role handling. * Adding modified iam_alis module found on GitHub. * Adding management of IAM account alias. * Revert "Merge branch 'devel' into generate_saml_sso_requirements" This reverts commit a4051979f45aa2518db36fd2f9c9751b0364b69c, reversing changes made to b9e67325e2b69b9dd22483acaaec77ef80fa7177. * Adding note on existence of 'config' directory for de-deploy to work. * Adding link to provided example config directory. Co-authored-by: EmlynK * phpfpm variables (#38) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * GitHub actions into v1. (#30) * Adding Super Linter workflow for GitHub Actions. * Adding the documentation checker. * Getting GitHub Actions to continue on failure. * Seeing if Git exists. * Missing space. * Re-adding the checkout and the git commands. * Trying Pascal's script. * Adding both lines to the same 'run' command. * GitHub Actions wtf - splitting into two steps. * Trying steps on branch name. * Trying steps on branch name AGAIN. * Would be good to get the syntax right. * Trying different quotes. * Checking the contents of the github.ref variable. * Trying to add in Pascal's testing step. * Adding in /bin/sh to hopefully make test.sh run. * Google says try it with /bin/bash. * Trying a different Ubuntu version. * Installing net-tools to have ifconfig. * Updating testing shell (#28) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Fixing test.sh to explicitly call bash. GitHub Actions only supports Ubuntu containers and Ubuntu shell is dash by default, not bash. Consequently /bin/sh doesn't invoke bash, but dash, which causes some unexpected errors down the line. Co-authored-by: EmlynK * We probably don't need /bin/bash * Making test.sh executable. * Checking shell. * Explicitly setting shell to bash in provision.sh. * Trying ubuntu-16.04 as Travis used this. * Putting shell back. * Update provision.sh * Making /bin/bash the shell. * Making /bin/bash the shell for provision. * Explicitly stating bash again in YML. * Turns out the mkcert binary is out of date. * Compiled mkcert from source. * Fixing curl error. * Switching to wget. * Starting the linter again and renaming job. * Only lint changed files. * Linting a non-existent branch! * Tidying the documentation check. * Revert "Making /bin/bash the shell for provision." This reverts commit f5f35818205cd364a66a6e51c9f9d8254f016422. * Revert "Making /bin/bash the shell." This reverts commit df585b36877aa2328adc228cd8f76950e2853d36. * Revert "Tidying the documentation check." This reverts commit a0c964e15003c8486f4d01232af6e855a475298e. * Swapping Super-Linter for ansible-lint. * Running ansible-lint directly in the container. * Updating to latest Ubuntu. * Revert "Fixing test.sh to explicitly call bash." This reverts commit 521279ebc16a4c4459c981bfb813cf6aa4d4f3ad. * Fixing ansible-lint issues. * Revert "Fixing ansible-lint issues." This reverts commit 08a74046d567ea80acc080ec3cec60a7f8ceed48. * Removing old travis config. * Spacing issue fix. * Running tests on pull_request only. Co-authored-by: EmlynK * Adding some PHP pool values that can be tweaked and the default_socket_timeout in php.ini. Co-authored-by: Greg Harvey * Generate saml sso requirements devel (#39) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Adding AWS CLI and credentials files to local ce-dev. * New AWS IAM Ansible role for creating the necessary IdP and role for admin access. * GitHub actions into v1. (#30) * Adding Super Linter workflow for GitHub Actions. * Adding the documentation checker. * Getting GitHub Actions to continue on failure. * Seeing if Git exists. * Missing space. * Re-adding the checkout and the git commands. * Trying Pascal's script. * Adding both lines to the same 'run' command. * GitHub Actions wtf - splitting into two steps. * Trying steps on branch name. * Trying steps on branch name AGAIN. * Would be good to get the syntax right. * Trying different quotes. * Checking the contents of the github.ref variable. * Trying to add in Pascal's testing step. * Adding in /bin/sh to hopefully make test.sh run. * Google says try it with /bin/bash. * Trying a different Ubuntu version. * Installing net-tools to have ifconfig. * Updating testing shell (#28) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Fixing test.sh to explicitly call bash. GitHub Actions only supports Ubuntu containers and Ubuntu shell is dash by default, not bash. Consequently /bin/sh doesn't invoke bash, but dash, which causes some unexpected errors down the line. Co-authored-by: EmlynK * We probably don't need /bin/bash * Making test.sh executable. * Checking shell. * Explicitly setting shell to bash in provision.sh. * Trying ubuntu-16.04 as Travis used this. * Putting shell back. * Update provision.sh * Making /bin/bash the shell. * Making /bin/bash the shell for provision. * Explicitly stating bash again in YML. * Turns out the mkcert binary is out of date. * Compiled mkcert from source. * Fixing curl error. * Switching to wget. * Starting the linter again and renaming job. * Only lint changed files. * Linting a non-existent branch! * Tidying the documentation check. * Revert "Making /bin/bash the shell for provision." This reverts commit f5f35818205cd364a66a6e51c9f9d8254f016422. * Revert "Making /bin/bash the shell." This reverts commit df585b36877aa2328adc228cd8f76950e2853d36. * Revert "Tidying the documentation check." This reverts commit a0c964e15003c8486f4d01232af6e855a475298e. * Swapping Super-Linter for ansible-lint. * Running ansible-lint directly in the container. * Updating to latest Ubuntu. * Revert "Fixing test.sh to explicitly call bash." This reverts commit 521279ebc16a4c4459c981bfb813cf6aa4d4f3ad. * Fixing ansible-lint issues. * Revert "Fixing ansible-lint issues." This reverts commit 08a74046d567ea80acc080ec3cec60a7f8ceed48. * Removing old travis config. * Spacing issue fix. * Running tests on pull_request only. Co-authored-by: EmlynK * Cleaning variables to be generic and improving LDAP role handling. * Adding modified iam_alis module found on GitHub. * Adding management of IAM account alias. * Revert "Merge branch 'devel' into generate_saml_sso_requirements" This reverts commit a4051979f45aa2518db36fd2f9c9751b0364b69c, reversing changes made to b9e67325e2b69b9dd22483acaaec77ef80fa7177. * Fixing conflict with ce-dev/README.md. * Adding a template for SimpleSAMLphp account SPs. * Renaming template file for SAML and adding an include file for SAML admins. * Renaming template file for SAML admins. * Adding tasks for handling SimpleSAMLphp repo actions. * Refactoring git commits to defend against existing files causing commit fails. * Moving X509Certificate to a variable. Co-authored-by: EmlynK * Override fastcgi_read_timeout in Nginx (#41) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * GitHub actions into v1. (#30) * Adding Super Linter workflow for GitHub Actions. * Adding the documentation checker. * Getting GitHub Actions to continue on failure. * Seeing if Git exists. * Missing space. * Re-adding the checkout and the git commands. * Trying Pascal's script. * Adding both lines to the same 'run' command. * GitHub Actions wtf - splitting into two steps. * Trying steps on branch name. * Trying steps on branch name AGAIN. * Would be good to get the syntax right. * Trying different quotes. * Checking the contents of the github.ref variable. * Trying to add in Pascal's testing step. * Adding in /bin/sh to hopefully make test.sh run. * Google says try it with /bin/bash. * Trying a different Ubuntu version. * Installing net-tools to have ifconfig. * Updating testing shell (#28) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Fixing test.sh to explicitly call bash. GitHub Actions only supports Ubuntu containers and Ubuntu shell is dash by default, not bash. Consequently /bin/sh doesn't invoke bash, but dash, which causes some unexpected errors down the line. Co-authored-by: EmlynK * We probably don't need /bin/bash * Making test.sh executable. * Checking shell. * Explicitly setting shell to bash in provision.sh. * Trying ubuntu-16.04 as Travis used this. * Putting shell back. * Update provision.sh * Making /bin/bash the shell. * Making /bin/bash the shell for provision. * Explicitly stating bash again in YML. * Turns out the mkcert binary is out of date. * Compiled mkcert from source. * Fixing curl error. * Switching to wget. * Starting the linter again and renaming job. * Only lint changed files. * Linting a non-existent branch! * Tidying the documentation check. * Revert "Making /bin/bash the shell for provision." This reverts commit f5f35818205cd364a66a6e51c9f9d8254f016422. * Revert "Making /bin/bash the shell." This reverts commit df585b36877aa2328adc228cd8f76950e2853d36. * Revert "Tidying the documentation check." This reverts commit a0c964e15003c8486f4d01232af6e855a475298e. * Swapping Super-Linter for ansible-lint. * Running ansible-lint directly in the container. * Updating to latest Ubuntu. * Revert "Fixing test.sh to explicitly call bash." This reverts commit 521279ebc16a4c4459c981bfb813cf6aa4d4f3ad. * Fixing ansible-lint issues. * Revert "Fixing ansible-lint issues." This reverts commit 08a74046d567ea80acc080ec3cec60a7f8ceed48. * Removing old travis config. * Spacing issue fix. * Running tests on pull_request only. Co-authored-by: EmlynK * Adding some PHP pool values that can be tweaked and the default_socket_timeout in php.ini. (#40) * Add ability to override Nginx fastcgi_read_timeout value. Co-authored-by: Greg Harvey * Generate saml sso requirements devel (#42) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Adding AWS CLI and credentials files to local ce-dev. * New AWS IAM Ansible role for creating the necessary IdP and role for admin access. * GitHub actions into v1. (#30) * Adding Super Linter workflow for GitHub Actions. * Adding the documentation checker. * Getting GitHub Actions to continue on failure. * Seeing if Git exists. * Missing space. * Re-adding the checkout and the git commands. * Trying Pascal's script. * Adding both lines to the same 'run' command. * GitHub Actions wtf - splitting into two steps. * Trying steps on branch name. * Trying steps on branch name AGAIN. * Would be good to get the syntax right. * Trying different quotes. * Checking the contents of the github.ref variable. * Trying to add in Pascal's testing step. * Adding in /bin/sh to hopefully make test.sh run. * Google says try it with /bin/bash. * Trying a different Ubuntu version. * Installing net-tools to have ifconfig. * Updating testing shell (#28) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Fixing test.sh to explicitly call bash. GitHub Actions only supports Ubuntu containers and Ubuntu shell is dash by default, not bash. Consequently /bin/sh doesn't invoke bash, but dash, which causes some unexpected errors down the line. Co-authored-by: EmlynK * We probably don't need /bin/bash * Making test.sh executable. * Checking shell. * Explicitly setting shell to bash in provision.sh. * Trying ubuntu-16.04 as Travis used this. * Putting shell back. * Update provision.sh * Making /bin/bash the shell. * Making /bin/bash the shell for provision. * Explicitly stating bash again in YML. * Turns out the mkcert binary is out of date. * Compiled mkcert from source. * Fixing curl error. * Switching to wget. * Starting the linter again and renaming job. * Only lint changed files. * Linting a non-existent branch! * Tidying the documentation check. * Revert "Making /bin/bash the shell for provision." This reverts commit f5f35818205cd364a66a6e51c9f9d8254f016422. * Revert "Making /bin/bash the shell." This reverts commit df585b36877aa2328adc228cd8f76950e2853d36. * Revert "Tidying the documentation check." This reverts commit a0c964e15003c8486f4d01232af6e855a475298e. * Swapping Super-Linter for ansible-lint. * Running ansible-lint directly in the container. * Updating to latest Ubuntu. * Revert "Fixing test.sh to explicitly call bash." This reverts commit 521279ebc16a4c4459c981bfb813cf6aa4d4f3ad. * Fixing ansible-lint issues. * Revert "Fixing ansible-lint issues." This reverts commit 08a74046d567ea80acc080ec3cec60a7f8ceed48. * Removing old travis config. * Spacing issue fix. * Running tests on pull_request only. Co-authored-by: EmlynK * Cleaning variables to be generic and improving LDAP role handling. * Adding modified iam_alis module found on GitHub. * Adding management of IAM account alias. * Revert "Merge branch 'devel' into generate_saml_sso_requirements" This reverts commit a4051979f45aa2518db36fd2f9c9751b0364b69c, reversing changes made to b9e67325e2b69b9dd22483acaaec77ef80fa7177. * Fixing conflict with ce-dev/README.md. * Adding a template for SimpleSAMLphp account SPs. * Renaming template file for SAML and adding an include file for SAML admins. * Renaming template file for SAML admins. * Adding tasks for handling SimpleSAMLphp repo actions. * Refactoring git commits to defend against existing files causing commit fails. * Moving X509Certificate to a variable. * Wrapping the LinOTP code in the SAML template in an 'if' statement. Co-authored-by: EmlynK * Generate saml sso requirements devel (#43) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Adding AWS CLI and credentials files to local ce-dev. * New AWS IAM Ansible role for creating the necessary IdP and role for admin access. * GitHub actions into v1. (#30) * Adding Super Linter workflow for GitHub Actions. * Adding the documentation checker. * Getting GitHub Actions to continue on failure. * Seeing if Git exists. * Missing space. * Re-adding the checkout and the git commands. * Trying Pascal's script. * Adding both lines to the same 'run' command. * GitHub Actions wtf - splitting into two steps. * Trying steps on branch name. * Trying steps on branch name AGAIN. * Would be good to get the syntax right. * Trying different quotes. * Checking the contents of the github.ref variable. * Trying to add in Pascal's testing step. * Adding in /bin/sh to hopefully make test.sh run. * Google says try it with /bin/bash. * Trying a different Ubuntu version. * Installing net-tools to have ifconfig. * Updating testing shell (#28) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Fixing test.sh to explicitly call bash. GitHub Actions only supports Ubuntu containers and Ubuntu shell is dash by default, not bash. Consequently /bin/sh doesn't invoke bash, but dash, which causes some unexpected errors down the line. Co-authored-by: EmlynK * We probably don't need /bin/bash * Making test.sh executable. * Checking shell. * Explicitly setting shell to bash in provision.sh. * Trying ubuntu-16.04 as Travis used this. * Putting shell back. * Update provision.sh * Making /bin/bash the shell. * Making /bin/bash the shell for provision. * Explicitly stating bash again in YML. * Turns out the mkcert binary is out of date. * Compiled mkcert from source. * Fixing curl error. * Switching to wget. * Starting the linter again and renaming job. * Only lint changed files. * Linting a non-existent branch! * Tidying the documentation check. * Revert "Making /bin/bash the shell for provision." This reverts commit f5f35818205cd364a66a6e51c9f9d8254f016422. * Revert "Making /bin/bash the shell." This reverts commit df585b36877aa2328adc228cd8f76950e2853d36. * Revert "Tidying the documentation check." This reverts commit a0c964e15003c8486f4d01232af6e855a475298e. * Swapping Super-Linter for ansible-lint. * Running ansible-lint directly in the container. * Updating to latest Ubuntu. * Revert "Fixing test.sh to explicitly call bash." This reverts commit 521279ebc16a4c4459c981bfb813cf6aa4d4f3ad. * Fixing ansible-lint issues. * Revert "Fixing ansible-lint issues." This reverts commit 08a74046d567ea80acc080ec3cec60a7f8ceed48. * Removing old travis config. * Spacing issue fix. * Running tests on pull_request only. Co-authored-by: EmlynK * Cleaning variables to be generic and improving LDAP role handling. * Adding modified iam_alis module found on GitHub. * Adding management of IAM account alias. * Revert "Merge branch 'devel' into generate_saml_sso_requirements" This reverts commit a4051979f45aa2518db36fd2f9c9751b0364b69c, reversing changes made to b9e67325e2b69b9dd22483acaaec77ef80fa7177. * Fixing conflict with ce-dev/README.md. * Adding a template for SimpleSAMLphp account SPs. * Renaming template file for SAML and adding an include file for SAML admins. * Renaming template file for SAML admins. * Adding tasks for handling SimpleSAMLphp repo actions. * Refactoring git commits to defend against existing files causing commit fails. * Moving X509Certificate to a variable. * Wrapping the LinOTP code in the SAML template in an 'if' statement. * Extending the check to make sure LinOTP var isn't empty. * Removing references to LDAP in SAML groups attribute config, no need to assume. * Adding docs for the aws_iam_saml role. Co-authored-by: EmlynK * Adding aws_iam_saml docs (#45) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * GitHub actions into v1. (#30) * Adding Super Linter workflow for GitHub Actions. * Adding the documentation checker. * Getting GitHub Actions to continue on failure. * Seeing if Git exists. * Missing space. * Re-adding the checkout and the git commands. * Trying Pascal's script. * Adding both lines to the same 'run' command. * GitHub Actions wtf - splitting into two steps. * Trying steps on branch name. * Trying steps on branch name AGAIN. * Would be good to get the syntax right. * Trying different quotes. * Checking the contents of the github.ref variable. * Trying to add in Pascal's testing step. * Adding in /bin/sh to hopefully make test.sh run. * Google says try it with /bin/bash. * Trying a different Ubuntu version. * Installing net-tools to have ifconfig. * Updating testing shell (#28) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Fixing test.sh to explicitly call bash. GitHub Actions only supports Ubuntu containers and Ubuntu shell is dash by default, not bash. Consequently /bin/sh doesn't invoke bash, but dash, which causes some unexpected errors down the line. Co-authored-by: EmlynK * We probably don't need /bin/bash * Making test.sh executable. * Checking shell. * Explicitly setting shell to bash in provision.sh. * Trying ubuntu-16.04 as Travis used this. * Putting shell back. * Update provision.sh * Making /bin/bash the shell. * Making /bin/bash the shell for provision. * Explicitly stating bash again in YML. * Turns out the mkcert binary is out of date. * Compiled mkcert from source. * Fixing curl error. * Switching to wget. * Starting the linter again and renaming job. * Only lint changed files. * Linting a non-existent branch! * Tidying the documentation check. * Revert "Making /bin/bash the shell for provision." This reverts commit f5f35818205cd364a66a6e51c9f9d8254f016422. * Revert "Making /bin/bash the shell." This reverts commit df585b36877aa2328adc228cd8f76950e2853d36. * Revert "Tidying the documentation check." This reverts commit a0c964e15003c8486f4d01232af6e855a475298e. * Swapping Super-Linter for ansible-lint. * Running ansible-lint directly in the container. * Updating to latest Ubuntu. * Revert "Fixing test.sh to explicitly call bash." This reverts commit 521279ebc16a4c4459c981bfb813cf6aa4d4f3ad. * Fixing ansible-lint issues. * Revert "Fixing ansible-lint issues." This reverts commit 08a74046d567ea80acc080ec3cec60a7f8ceed48. * Removing old travis config. * Spacing issue fix. * Running tests on pull_request only. Co-authored-by: EmlynK * Adding some PHP pool values that can be tweaked and the default_socket_timeout in php.ini. (#40) * Generate saml sso requirements 1x (#44) * Wrong filter for efs info * Fix indentation error * Do not purge tags on existing EFS * Wrong name for updating EFS targets * Remove leftover loop * Fix error in subnet gathering * Split EFS creation * Use subnet ids * Wrong var name * Remove dead code * Wrong var * Missing subnet ids * Try not to loose existing SGs * Try to dedupe targets * Wrong syntax for combine * Typo in combining tupples * Wrong var name for append items * Fix appending subnets * Wrong list transformation * Switch to community module for efs * Remove unecessary complexity * Update documentation * Comment out Redefine Autoscale groups task for now and move some of its parameters to the other ASG creation task. * Remove replace_batch_size from ASG creation task, so it now defaults to 1. * Wrap Postfix handler commands in quotes. (#26) * Try using shell instead of command in Postfix handlers. * GitHub Actions integration (#29) * Adding Super Linter workflow for GitHub Actions. * Adding the documentation checker. * Getting GitHub Actions to continue on failure. * Seeing if Git exists. * Missing space. * Re-adding the checkout and the git commands. * Trying Pascal's script. * Adding both lines to the same 'run' command. * GitHub Actions wtf - splitting into two steps. * Trying steps on branch name. * Trying steps on branch name AGAIN. * Would be good to get the syntax right. * Trying different quotes. * Checking the contents of the github.ref variable. * Trying to add in Pascal's testing step. * Adding in /bin/sh to hopefully make test.sh run. * Google says try it with /bin/bash. * Trying a different Ubuntu version. * Installing net-tools to have ifconfig. * Updating testing shell (#28) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Fixing test.sh to explicitly call bash. GitHub Actions only supports Ubuntu containers and Ubuntu shell is dash by default, not bash. Consequently /bin/sh doesn't invoke bash, but dash, which causes some unexpected errors down the line. Co-authored-by: EmlynK * We probably don't need /bin/bash * Making test.sh executable. * Checking shell. * Explicitly setting shell to bash in provision.sh. * Trying ubuntu-16.04 as Travis used this. * Putting shell back. * Update provision.sh * Making /bin/bash the shell. * Making /bin/bash the shell for provision. * Explicitly stating bash again in YML. * Turns out the mkcert binary is out of date. * Compiled mkcert from source. * Fixing curl error. * Switching to wget. * Starting the linter again and renaming job. * Only lint changed files. * Linting a non-existent branch! * Tidying the documentation check. * Revert "Making /bin/bash the shell for provision." This reverts commit f5f35818205cd364a66a6e51c9f9d8254f016422. * Revert "Making /bin/bash the shell." This reverts commit df585b36877aa2328adc228cd8f76950e2853d36. * Revert "Tidying the documentation check." This reverts commit a0c964e15003c8486f4d01232af6e855a475298e. * Swapping Super-Linter for ansible-lint. * Running ansible-lint directly in the container. * Updating to latest Ubuntu. * Revert "Fixing test.sh to explicitly call bash." This reverts commit 521279ebc16a4c4459c981bfb813cf6aa4d4f3ad. * Fixing ansible-lint issues. * Revert "Fixing ansible-lint issues." This reverts commit 08a74046d567ea80acc080ec3cec60a7f8ceed48. * Removing old travis config. * Spacing issue fix. * Running tests on pull_request only. Co-authored-by: EmlynK * Use correct variable when setting the RDS instance type as part of ASG creation. (#32) Co-authored-by: Emlyn Kinzett * Fix alb health check (#31) * It's traffic-port, not target-port. Doh. * Update documentation. Co-authored-by: Emlyn Kinzett * Adding note on existence of 'config' directory for de-deploy to work. * Adding link to provided example config directory. * Adding AWS CLI and credentials files to local ce-dev. * New AWS IAM Ansible role for creating the necessary IdP and role for admin access. * Generate saml sso requirements (#33) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Adding AWS CLI and credentials files to local ce-dev. * New AWS IAM Ansible role for creating the necessary IdP and role for admin access. Co-authored-by: EmlynK * Cleaning variables to be generic and improving LDAP role handling. * Adding modified iam_alis module found on GitHub. * Generate saml sso requirements devel (#36) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Adding AWS CLI and credentials files to local ce-dev. * New AWS IAM Ansible role for creating the necessary IdP and role for admin access. * Cleaning variables to be generic and improving LDAP role handling. Co-authored-by: EmlynK * Adding management of IAM account alias. * Revert "Merge branch 'devel' into generate_saml_sso_requirements" This reverts commit a4051979f45aa2518db36fd2f9c9751b0364b69c, reversing changes made to b9e67325e2b69b9dd22483acaaec77ef80fa7177. * Generate saml sso requirements devel (#37) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Adding AWS CLI and credentials files to local ce-dev. * New AWS IAM Ansible role for creating the necessary IdP and role for admin access. * GitHub actions into v1. (#30) * Adding Super Linter workflow for GitHub Actions. * Adding the documentation checker. * Getting GitHub Actions to continue on failure. * Seeing if Git exists. * Missing space. * Re-adding the checkout and the git commands. * Trying Pascal's script. * Adding both lines to the same 'run' command. * GitHub Actions wtf - splitting into two steps. * Trying steps on branch name. * Trying steps on branch name AGAIN. * Would be good to get the syntax right. * Trying different quotes. * Checking the contents of the github.ref variable. * Trying to add in Pascal's testing step. * Adding in /bin/sh to hopefully make test.sh run. * Google says try it with /bin/bash. * Trying a different Ubuntu version. * Installing net-tools to have ifconfig. * Updating testing shell (#28) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Fixing test.sh to explicitly call bash. GitHub Actions only supports Ubuntu containers and Ubuntu shell is dash by default, not bash. Consequently /bin/sh doesn't invoke bash, but dash, which causes some unexpected errors down the line. Co-authored-by: EmlynK * We probably don't need /bin/bash * Making test.sh executable. * Checking shell. * Explicitly setting shell to bash in provision.sh. * Trying ubuntu-16.04 as Travis used this. * Putting shell back. * Update provision.sh * Making /bin/bash the shell. * Making /bin/bash the shell for provision. * Explicitly stating bash again in YML. * Turns out the mkcert binary is out of date. * Compiled mkcert from source. * Fixing curl error. * Switching to wget. * Starting the linter again and renaming job. * Only lint changed files. * Linting a non-existent branch! * Tidying the documentation check. * Revert "Making /bin/bash the shell for provision." This reverts commit f5f35818205cd364a66a6e51c9f9d8254f016422. * Revert "Making /bin/bash the shell." This reverts commit df585b36877aa2328adc228cd8f76950e2853d36. * Revert "Tidying the documentation check." This reverts commit a0c964e15003c8486f4d01232af6e855a475298e. * Swapping Super-Linter for ansible-lint. * Running ansible-lint directly in the container. * Updating to latest Ubuntu. * Revert "Fixing test.sh to explicitly call bash." This reverts commit 521279ebc16a4c4459c981bfb813cf6aa4d4f3ad. * Fixing ansible-lint issues. * Revert "Fixing ansible-lint issues." This reverts commit 08a74046d567ea80acc080ec3cec60a7f8ceed48. * Removing old travis config. * Spacing issue fix. * Running tests on pull_request only. Co-authored-by: EmlynK * Cleaning variables to be generic and improving LDAP role handling. * Adding modified iam_alis module found on GitHub. * Adding management of IAM account alias. * Revert "Merge branch 'devel' into generate_saml_sso_requirements" This reverts commit a4051979f45aa2518db36fd2f9c9751b0364b69c, reversing changes made to b9e67325e2b69b9dd22483acaaec77ef80fa7177. * Adding note on existence of 'config' directory for de-deploy to work. * Adding link to provided example config directory. Co-authored-by: EmlynK * Fixing conflict with ce-dev/README.md. * Adding a template for SimpleSAMLphp account SPs. * Renaming template file for SAML and adding an include file for SAML admins. * Renaming template file for SAML admins. * phpfpm variables (#38) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * GitHub actions into v1. (#30) * Adding Super Linter workflow for GitHub Actions. * Adding the documentation checker. * Getting GitHub Actions to continue on failure. * Seeing if Git exists. * Missing space. * Re-adding the checkout and the git commands. * Trying Pascal's script. * Adding both lines to the same 'run' command. * GitHub Actions wtf - splitting into two steps. * Trying steps on branch name. * Trying steps on branch name AGAIN. * Would be good to get the syntax right. * Trying different quotes. * Checking the contents of the github.ref variable. * Trying to add in Pascal's testing step. * Adding in /bin/sh to hopefully make test.sh run. * Google says try it with /bin/bash. * Trying a different Ubuntu version. * Installing net-tools to have ifconfig. * Updating testing shell (#28) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Fixing test.sh to explicitly call bash. GitHub Actions only supports Ubuntu containers and Ubuntu shell is dash by default, not bash. Consequently /bin/sh doesn't invoke bash, but dash, which causes some unexpected errors down the line. Co-authored-by: EmlynK * We probably don't need /bin/bash * Making test.sh executable. * Checking shell. * Explicitly setting shell to bash in provision.sh. * Trying ubuntu-16.04 as Travis used this. * Putting shell back. * Update provision.sh * Making /bin/bash the shell. * Making /bin/bash the shell for provision. * Explicitly stating bash again in YML. * Turns out the mkcert binary is out of date. * Compiled mkcert from source. * Fixing curl error. * Switching to wget. * Starting the linter again and renaming job. * Only lint changed files. * Linting a non-existent branch! * Tidying the documentation check. * Revert "Making /bin/bash the shell for provision." This reverts commit f5f35818205cd364a66a6e51c9f9d8254f016422. * Revert "Making /bin/bash the shell." This reverts commit df585b36877aa2328adc228cd8f76950e2853d36. * Revert "Tidying the documentation check." This reverts commit a0c964e15003c8486f4d01232af6e855a475298e. * Swapping Super-Linter for ansible-lint. * Running ansible-lint directly in the container. * Updating to latest Ubuntu. * Revert "Fixing test.sh to explicitly call bash." This reverts commit 521279ebc16a4c4459c981bfb813cf6aa4d4f3ad. * Fixing ansible-lint issues. * Revert "Fixing ansible-lint issues." This reverts commit 08a74046d567ea80acc080ec3cec60a7f8ceed48. * Removing old travis config. * Spacing issue fix. * Running tests on pull_request only. Co-authored-by: EmlynK * Adding some PHP pool values that can be tweaked and the default_socket_timeout in php.ini. Co-authored-by: Greg Harvey * Adding tasks for handling SimpleSAMLphp repo actions. * Refactoring git commits to defend against existing files causing commit fails. * Moving X509Certificate to a variable. * Generate saml sso requirements devel (#39) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Adding AWS CLI and credentials files to local ce-dev. * New AWS IAM Ansible role for creating the necessary IdP and role for admin access. * GitHub actions into v1. (#30) * Adding Super Linter workflow for GitHub Actions. * Adding the documentation checker. * Getting GitHub Actions to continue on failure. * Seeing if Git exists. * Missing space. * Re-adding the checkout and the git commands. * Trying Pascal's script. * Adding both lines to the same 'run' command. * GitHub Actions wtf - splitting into two steps. * Trying steps on branch name. * Trying steps on branch name AGAIN. * Would be good to get the syntax right. * Trying different quotes. * Checking the contents of the github.ref variable. * Trying to add in Pascal's testing step. * Adding in /bin/sh to hopefully make test.sh run. * Google says try it with /bin/bash. * Trying a different Ubuntu version. * Installing net-tools to have ifconfig. * Updating testing shell (#28) * Use correct variable when setting the RDS instance type as part of ASG creation. (#27) * Fixing test.sh to explicitly call bash. GitHub Actions only supports Ubuntu containers and Ubuntu shell is dash by default, not bash. Consequently /bin/sh doesn't invoke bash, but dash, which causes some unexpected errors down the line. Co-authored-by: EmlynK * We probably don't need /bin/bash * Making test.sh executable. * Checking shell. * Explicitly setting shell to bash in provision.sh. * Trying ubuntu-16.04 as Travis used this. * Putting shell back. * Update provision.sh * Making /bin/bash the shell. * Making /bin/bash the shell for provision. * Explicitly stating bash again in YML. * Turns out the mkcert binary is out of date. * Compiled mkcert from source. * Fixing curl error. * Switching to wget. * Starting the linter again and renaming job. * Only lint changed files. * Linting a non-existent branch! * Tidying the documentation check. * Revert "Making /bin/bash the shell for provision." This reverts commit f5f35818205cd364a66a6e51c9f9d8254f016422. * Revert "Making /bin/bash the shell." This reverts commit df585b36877aa2328adc228cd8f76950e2853d36. * Revert "Tidying the documentation check." This reverts commit a0c964e15003c8486f4d01232af6e855a475298e. * Swapping Super-Linter for ansible-lint. * Running ansible-lint directly in the container. * Updating to latest Ubuntu. * Revert "Fixing test.sh to explicitly call bash." This reverts commit 521279ebc16a4c4459c981bfb813cf6aa4d4f3ad. * Fixing ansible-lint issues. * Revert "Fixing ansible-lint issues." This reverts commit 08a74046d567ea80acc080ec3cec60a7f8ceed48. * Removing old travis config. * Spacing issue fix. * Running tests on pull_request only. Co-authored-by: EmlynK * Cleaning variables to be generic and improving LDAP role handling. * Adding modified iam_alis module found on GitHub. * Adding management of IAM account alias. * Revert "Merge branch 'devel' into generate_saml_sso_requirements" This reverts commit a4051979f45aa2518db36fd2f9c9751b0364b69c, reversing changes made to b9e67325e2b69b9dd22483acaaec77ef80fa7177. * Fixing conflict with ce-dev/README.md. * Adding a template for Si… * Bug fixes 2.x pr 2.x (#1400) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * updating-aws-cloudfront-distribution-to-enable-logging-2.x-branch (#1404) Co-authored-by: Matej Stajduhar * Adding default value if logging not defined 2.x (#1407) * adding-default-value-if-logging-not-defined-2.x * adding-example-for-logging --------- Co-authored-by: Matej Stajduhar * Cleaner-pipeline-output-2.x (#1412) Co-authored-by: Matej Stajduhar * Updating-extra-packages-2x (#1414) * updating-cloudfront-role-2.x (#1418) Co-authored-by: Matej Stajduhar * r68152-secure-symfony-app-for-prod 2.x (#1429) * r68152-put-new-prod-symfony-template 2.x (#1433) * Adding-wazuh-role-2x (#1441) * Fixing-wazuh (#1445) * Fixing wazuh pr 2.x (#1447) * Fixing-wazuh * Fixing-wazuh * Fixing wazuh pr 2.x (#1449) * Fixing-wazuh * Fixing-wazuh * Adding-ansible-builtin-modules * Adding-debug * Fixing-vars * Adding clamdscan package to clamav role. (#1452) * Bug fixes 2.x pr 2.x (#1454) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Fixing-wazuh-vars (#1456) * Fixing wazuh vars pr 2.x (#1460) * Fixing-wazuh-vars * Fixing-linting * Updating-sury-keys (#1463) * Replace ssl certs pr 2.x (#1467) * Documentation updates. * Tidying SSL role and allowing option to replace a cert. * Bug fixes 2.x pr 2.x (#1469) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Fixing-wazuh-variables (#1473) * Adding-wazuh-path-defaults (#1480) * Adding-wazuh-path-defaults * Changing-wazuh-path-location * Updating wazuh path2x pr 2.x (#1482) * Updating-wazuh-path2x * Updating-all-roles-path * Making Varnish template handling more flexible. (#1485) * Making Varnish template handling more flexible. * Adding empty line. * Varnish config pr 2.x (#1491) * Making Varnish template handling more flexible. * Adding empty line. * Minor template changes. * Tls for postfix pr 2.x (#1493) * Some Apache docs updates. * Sorting TLS for SMTP in Postfix config. * Left bad domain in example cert paths. * Setting-port-change-option-for-nginx (#1487) * Setting-port-change-option-for-nginx * Update main.yml * Update nginx.conf.j2 --------- Co-authored-by: Matej Stajduhar * Tls for postfix pr 2.x (#1498) * Some Apache docs updates. * Sorting TLS for SMTP in Postfix config. * Left bad domain in example cert paths. * Typo in template var names. * Changing-LE-default-vhost (#1500) * Handling allowing client config template for ovpn to have an FQDN. (#1502) * Openvpn client fqdn pr 2.x (#1504) * Supporting a fixed PHP version with a fixed port number. * Accidently re-added the old VPN role - re-deleting! * Handling allowing client config template for ovpn to have an FQDN. * Let's not assume port 1194 for ovpn. * Openvpn client fqdn pr 2.x (#1506) * Supporting a fixed PHP version with a fixed port number. * Accidently re-added the old VPN role - re-deleting! * Handling allowing client config template for ovpn to have an FQDN. * Let's not assume port 1194 for ovpn. * Tweaking FQDN handling in ovpn. * Adding volume handling options for Packer. (#1508) * Packer volume handling pr 2.x (#1510) * Adding volume handling options for Packer. * Missed a comma in the template, plus adding docs. * Upading-ssl-vars (#1512) * Upading-ssl-vars * Building-docs * Fixing-ldap-role-ssl-task (#1514) * r68725-Updating-ACL-role-to-include-ALB-2x (#1518) Co-authored-by: Matej Stajduhar * Changing import_role to include_vars for vars only Wazuh roles. (#1524) * Wazuh fixes pr 2.x (#1526) * Changing import_role to include_vars for vars only Wazuh roles. * We cannot use the _domain_name var in this context. * Adding cipher to client template and fixing default push route. (#1528) * Switching key server pr 2.x (#1531) * Switching-key-server * Switching-key-server-mysql * Fixing-empty-line * Fixing-mysql-role (#1534) * Fixing-mysql-role * Fixing-linting * Fixing-broken-mysql-role (#1536) * R68801 gzip nginx cloudfront pr 2.x (#1544) * r68801-r67628-gzip-nginx-cloudfront * r68801-r67628-gzip-nginx-cloudfront * remove test tasks * remove test tasks * remove test tasks * Making Duplicity use venvs. (#1547) * Making Duplicity use venvs. * Installing venvs as the correct user. * Setting Duplicity user back to root and installing 'fasteners' in the venv. * Duplicity --s3-european-buckets option deprecated. * Ansible in init pr 2.x (#1554) * Adding new Python pip package role. * Updating NGINX and Boto3 roles to use the new Python pip role. * Moving Ansible install to _init. * Detecting connection type before installing Ansible. * The _init role should not generate SSH keys and ce_provision should optionally install a new user. * Updating documentation. * Switching to using the user_provision role for controller user in _init. * Allowing for ce_provision to install Ansible in another location. * Passing vars to the core Ansible install. * We will need linters if the system didn't install them. * Duplicity role doesn't need to ensure permissions, it's done in python_pip_packages already. * Allowing ce-provision to set a different UID from the system user. * Mailpit role pr 2.x (#1522) * Stopping NGINX dropping a proxy vhost for LE if we have a services[] list. * Adding the new Mailpit role. * Updating docs. * Variable name typo. * Adding a mailpit_open firewall rule to make life easier in containers. * Final pass of Mailpit role, now works straight away in containers. * Acm san cert replacement pr 2.x (#1561) * Minor docs update for ASG role. * Adding logic to check if extra domains are in our SAN certificate already. * Fixing SAN cert list creation. * Simplying SAN look-up, sticking to selected certificate. * Ensure we have a SAN domains list before trying to loop over it. * Moving post-create ACM actions to a block. * Adding variable to store obsolete ARN in, could be useful. * Fixing bug with ACM certificate lookup, using ARN instead of domain to avoid multiple responses. * Making Bookworm the default base distro. (#1565) * Making Bookworm the default base distro. * Updating default volume type for EC2 instances to gp3. * Allow the setting of base AMI filter for Packer in ASG role. * Updating ASG docs. * Nginx domain handling pr 2.x (#1568) * Moving SSL handling to a separate tasks file. * Making more NGINX settings available for modification. * Allowing more variables to be set for PHP-FPM and the cli. * Adding template line-break for NGINX _common config for style. * Fixing timer backup job for LDAP servers. (#1574) * Ldap server schedule fixes pr 2.x (#1578) * Fixing timer backup job for LDAP servers. * Setting path to LDAP server backup log. * Adding-ami-cleanup-role (#1580) Co-authored-by: Matej Stajduhar * Adding ami cleanup role 2.x pr 2.x (#1582) * Adding-ami-cleanup-role * adding-domain-name-in-scheduler-to-differ-if-multiple-ASGs-are-in-same-region --------- Co-authored-by: Matej Stajduhar * r68801-improve-caching-behavior-and-some-nginx-fixes (#1572) * r68801-improve-caching-behavior-and-some-nginx-fixes * r68801-improve-caching-behavior-and-some-nginx-fixes * add_header to variable * add_header to variable * remove extra ; * MOAR blocks * moving-assume-role-to-files-folder (#1588) * moving-assume-role-to-files-folder * Changing-lookup-function * Changing-lookup-function-2 --------- Co-authored-by: Matej Stajduhar * Adding-retry-and-delay-on-lambda-creation-due-to-IAM-role-creation (#1593) Co-authored-by: Matej Stajduhar * Adding-wait-task-prior-to-lambda-creation (#1595) Co-authored-by: Matej Stajduhar * nginx-config-backup-and-cleaup-vhosts-on-rebuild (#1590) * nginx-config-backup-and-cleaup-vhosts-on-rebuild * change module from command to unarchive * change module from command to unarchive * Adding-CF-S3-logging (#1596) Co-authored-by: Matej Stajduhar * php clear_env config option (#1599) * move ssl to domain.yml to fix the loop; remove checking for existing vhost as the LE proxy handling may not be there if SSL wasn not configured before, and the vhost will not be there as we are recreating them by default (#1601) * Allowing multiple clamscan wrapper scripts and timers per server. (#1538) * Allowing multiple clamscan wrapper scripts and timers per server. * Updating docs.! * Giving the timer a consistent name. * r69219-Updating-Scheduler-json-target (#1603) Co-authored-by: Matej Stajduhar * R68069 alb healthchecks and nginx pr 2.x (#1609) * r68069-alb-healthchecks-and-nginx * r68069-alb-healthchecks-and-nginx * r68069-alb-healthchecks-and-nginx * r68069-nice-indentation * R69332 le cron mail alerts pr 2.x (#1605) * r69332-le-cron-mail-alerts * Changing-recipient-to-var * Changing-recipient-to-var-2 * Fixing-email-var * Fixing-email-var-2 * Aws acl defaults pr 2.x (#1614) * Fixing AWS ACL role defaults. * Docs update. * Punctuation fix! * Small-changes-to-roles (#1617) Co-authored-by: Matej Stajduhar * Updating-aws-acl-role (#1626) Co-authored-by: Matej Stajduhar * Apt repo role pr 2.x (#1620) * First pass at APT repo role. * Adding APT autoremove task to the _exit role. * Adding systemd timer for APT key renewal. * Adding role documentation. * Adding new role to MySQL role to test. * Adding python-debian dependency for deb822 repo handling. * Removing obsolete variable check. * Defaulting the APT 'suites' value to the Ansible-detected release name. * Adding APT suite to MySQL repo installation. * Better docs and fixed a syntax error. * Fixing shell script for refreshing APT keys. * Ensuring APT clean-up in _exit always runs as root. * Fixing up MySQL config for 8.0 and tidying vars. * Apt repo role pr 2.x (#1631) * First pass at APT repo role. * Adding APT autoremove task to the _exit role. * Adding systemd timer for APT key renewal. * Adding role documentation. * Adding new role to MySQL role to test. * Adding python-debian dependency for deb822 repo handling. * Removing obsolete variable check. * Defaulting the APT 'suites' value to the Ansible-detected release name. * Adding APT suite to MySQL repo installation. * Better docs and fixed a syntax error. * Fixing shell script for refreshing APT keys. * Ensuring APT clean-up in _exit always runs as root. * Fixing up MySQL config for 8.0 and tidying vars. * Adding MySQL repo to unattended upgrades. * Adding README for Docker CE, Docker Compose support and switching to apt_repository role. * Updating docker_registry role to use docker_ce and deleting obsolete docker_compose role. * Updating docs index. * Adding Docker repo to unattended upgrades. * Updating MySQL docs. * Updating repo handling for GitLab and GitLab Runner. * Ensuring wget is installed. * wget seems more reliable than cURL for key fetching. * Updating Jenkins repo handling. * Fixing openjdk default version and updating nodejs APT repo handling. * Removing OSSEC, replaced by Wazuh. * Updating repo handling for the PAM LinOTP role. * Updating repo handling for the LHCI role. * Updating repo handling for PHP components. * Trying out a different config for Jenkins. * Updating docs. * Forgot to remove old yarn repo code. * Adding python3-debian package to python_common defaults to avoid first build failures. * Adding list format support to APT role. * Testing list format support with jenkins role. * Downloading GPG public key. * Ensuring the _apt_repository.key_filename var exists. * Fixing SSL vars in Jenkins role. * Updating repo handling for jitsi role. * Updating docs. * Bad SSL var name. * required_paramater_for_gp3_storage_type_tidying_up_and_refactoring (#1641) * required_paramater_for_gp3_storage_type_tidying_up_and_refactoring * fix vars * fixing more vars * fixing more vars * fixing loop in template * fixing_rds_vars (#1652) * Fixing-aws-acl-condition (#1654) Co-authored-by: Matej Stajduhar * Apt repo role pr 2.x (#1661) * First pass at APT repo role. * Adding APT autoremove task to the _exit role. * Adding systemd timer for APT key renewal. * Adding role documentation. * Adding new role to MySQL role to test. * Adding python-debian dependency for deb822 repo handling. * Removing obsolete variable check. * Defaulting the APT 'suites' value to the Ansible-detected release name. * Adding APT suite to MySQL repo installation. * Better docs and fixed a syntax error. * Fixing shell script for refreshing APT keys. * Ensuring APT clean-up in _exit always runs as root. * Fixing up MySQL config for 8.0 and tidying vars. * Adding MySQL repo to unattended upgrades. * Adding README for Docker CE, Docker Compose support and switching to apt_repository role. * Updating docker_registry role to use docker_ce and deleting obsolete docker_compose role. * Updating docs index. * Adding Docker repo to unattended upgrades. * Updating MySQL docs. * Updating repo handling for GitLab and GitLab Runner. * Ensuring wget is installed. * wget seems more reliable than cURL for key fetching. * Updating Jenkins repo handling. * Fixing openjdk default version and updating nodejs APT repo handling. * Removing OSSEC, replaced by Wazuh. * Updating repo handling for the PAM LinOTP role. * Updating repo handling for the LHCI role. * Updating repo handling for PHP components. * Trying out a different config for Jenkins. * Updating docs. * Forgot to remove old yarn repo code. * Adding python3-debian package to python_common defaults to avoid first build failures. * Adding list format support to APT role. * Testing list format support with jenkins role. * Downloading GPG public key. * Ensuring the _apt_repository.key_filename var exists. * Fixing SSL vars in Jenkins role. * Updating repo handling for jitsi role. * Updating docs. * Bad SSL var name. * Making timer name dynamic. * Adding missing repo format var to all APT repo handling. * Updating docs. * Bug fixes 2.x pr 2.x (#1662) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * fix(scripts): Fix git checkout to fetch any new branches (#1655) * Apt repo role pr 2.x (#1666) * First pass at APT repo role. * Adding APT autoremove task to the _exit role. * Adding systemd timer for APT key renewal. * Adding role documentation. * Adding new role to MySQL role to test. * Adding python-debian dependency for deb822 repo handling. * Removing obsolete variable check. * Defaulting the APT 'suites' value to the Ansible-detected release name. * Adding APT suite to MySQL repo installation. * Better docs and fixed a syntax error. * Fixing shell script for refreshing APT keys. * Ensuring APT clean-up in _exit always runs as root. * Fixing up MySQL config for 8.0 and tidying vars. * Adding MySQL repo to unattended upgrades. * Adding README for Docker CE, Docker Compose support and switching to apt_repository role. * Updating docker_registry role to use docker_ce and deleting obsolete docker_compose role. * Updating docs index. * Adding Docker repo to unattended upgrades. * Updating MySQL docs. * Updating repo handling for GitLab and GitLab Runner. * Ensuring wget is installed. * wget seems more reliable than cURL for key fetching. * Updating Jenkins repo handling. * Fixing openjdk default version and updating nodejs APT repo handling. * Removing OSSEC, replaced by Wazuh. * Updating repo handling for the PAM LinOTP role. * Updating repo handling for the LHCI role. * Updating repo handling for PHP components. * Trying out a different config for Jenkins. * Updating docs. * Forgot to remove old yarn repo code. * Adding python3-debian package to python_common defaults to avoid first build failures. * Adding list format support to APT role. * Testing list format support with jenkins role. * Downloading GPG public key. * Ensuring the _apt_repository.key_filename var exists. * Fixing SSL vars in Jenkins role. * Updating repo handling for jitsi role. * Updating docs. * Bad SSL var name. * Making timer name dynamic. * Adding missing repo format var to all APT repo handling. * Updating docs. * Fixing bug where list is passed instead of dict for systemd timer. * Bug fixes 2.x pr 2.x (#1667) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * Setting more sane ASG defaults. * Bug fixes 2.x pr 2.x (#1670) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * Setting more sane ASG defaults. * Making ClamAV timers a list so they can be entirely replaced. * Updating-waf-acl-role (#1672) Co-authored-by: Matej Stajduhar * Setting up proxy vhost pr 2.x (#1674) * Setting-up-proxy-vhost * Setting-up-proxy-vhost-2 * Fixing-typo (#1676) * New-version-of-aws-acl-role (#1683) * New-version-of-aws-acl-role * Fixing-jinja-linting --------- Co-authored-by: Matej Stajduhar * Updating-nginx-template (#1688) * Updating-aws_backup-to-register-iam-arn-2 (#1696) Co-authored-by: Matej Stajduhar * Updating-nginx-htpasswd-task-2 (#1698) Co-authored-by: Matej Stajduhar * Bug fixes 2.x pr 2.x (#1702) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * Setting more sane ASG defaults. * Making ClamAV timers a list so they can be entirely replaced. * Spacing fix for linting. * Renaming npm module. * r69424-Adding-resource-group-task (#1706) Co-authored-by: Matej Stajduhar * Adding lock file behaviour to ce-provision. (#1708) * Adding lock file behaviour to ce-provision. * Updating documentation. * Adding extra lock file handling for ASG EC2 machines. * Moving lock file paths to variables. * Adding docs about connection management. * Fixing placement of lock files on ASGs. * Removing the 'Remove lock file' task for ASGs as it is doomed to fail (machine is gone). * Adding in a lock file removal if we do not replace the ASG. * Bug fixes 2.x pr 2.x (#1715) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * Setting more sane ASG defaults. * Making ClamAV timers a list so they can be entirely replaced. * Spacing fix for linting. * Renaming npm module. * Removing NGINX installation as part of phpMyAdmin role by default. * Bug fixes 2.x pr 2.x (#1717) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * Setting more sane ASG defaults. * Making ClamAV timers a list so they can be entirely replaced. * Spacing fix for linting. * Renaming npm module. * Removing NGINX installation as part of phpMyAdmin role by default. * Fixing Varnish handler names. * Excluding name[casing] rule from linting due to false positives. * Put rule in wrong place! * Creating a ce-provision installer script. (#1724) * Installer pr 2.x (#1726) * Creating a ce-provision installer script. * Updating installation docs. * Bug fixes 2.x pr 2.x (#1730) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * Setting more sane ASG defaults. * Making ClamAV timers a list so they can be entirely replaced. * Spacing fix for linting. * Renaming npm module. * Removing NGINX installation as part of phpMyAdmin role by default. * Fixing Varnish handler names. * Excluding name[casing] rule from linting due to false positives. * Put rule in wrong place! * Removing lock file behaviour from ASGs as it cannot work unless controller and ASG are in the same VPC. * Capturing lock file limitations in comment. * Installer pr 2.x (#1732) * Creating a ce-provision installer script. * Updating installation docs. * Adding pip upgrade line and python-debian. * Installing certbot in a python venv. (#1659) * Installing certbot in a python venv. * Changing default location for Python packages. * Allowing the ansible role to override venv settings. * Preventing ce_deploy from installing in an entirely separate venv by default. * Updating certbot installation to use _init venv variables. * Updating duplicity role to use _init venv variables by default. * Ordering pip docs. * Update documentation. * Fixing Ansible path in installer. * Fixing occurrences of path to venv. * Installer pr 2.x (#1735) * Creating a ce-provision installer script. * Updating installation docs. * Adding pip upgrade line and python-debian. * Updating docs. * Some minor installer bug fixes. * Bug fixes 2.x pr 2.x (#1737) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * Setting more sane ASG defaults. * Making ClamAV timers a list so they can be entirely replaced. * Spacing fix for linting. * Renaming npm module. * Removing NGINX installation as part of phpMyAdmin role by default. * Fixing Varnish handler names. * Excluding name[casing] rule from linting due to false positives. * Put rule in wrong place! * Removing lock file behaviour from ASGs as it cannot work unless controller and ASG are in the same VPC. * Capturing lock file limitations in comment. * Updating documentation for LE. * Using pip to install certbot plugins. * Updating README docs. * Bug fixes 2.x pr 2.x (#1738) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * Setting more sane ASG defaults. * Making ClamAV timers a list so they can be entirely replaced. * Spacing fix for linting. * Renaming npm module. * Removing NGINX installation as part of phpMyAdmin role by default. * Fixing Varnish handler names. * Excluding name[casing] rule from linting due to false positives. * Put rule in wrong place! * Removing lock file behaviour from ASGs as it cannot work unless controller and ASG are in the same VPC. * Capturing lock file limitations in comment. * Updating documentation for LE. * Using pip to install certbot plugins. * Updating README docs. * Docs error corrected. * Fixing-ACM-SAN-behaviour (#1739) * Bug fixes 2.x pr 2.x (#1742) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * Setting more sane ASG defaults. * Making ClamAV timers a list so they can be entirely replaced. * Spacing fix for linting. * Renaming npm module. * Removing NGINX installation as part of phpMyAdmin role by default. * Fixing Varnish handler names. * Excluding name[casing] rule from linting due to false positives. * Put rule in wrong place! * Removing lock file behaviour from ASGs as it cannot work unless controller and ASG are in the same VPC. * Capturing lock file limitations in comment. * Updating documentation for LE. * Using pip to install certbot plugins. * Updating README docs. * Docs error corrected. * Working around deprecated SSH algorithms. * Upgrading SSH key type standard for controller and deploy users. * Adding SCP args for legacy mode needed by Packer. * Bug fixes 2.x pr 2.x (#1749) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * Setting more sane ASG defaults. * Making ClamAV timers a list so they can be entirely replaced. * Spacing fix for linting. * Renaming npm module. * Removing NGINX installation as part of phpMyAdmin role by default. * Fixing Varnish handler names. * Excluding name[casing] rule from linting due to false positives. * Put rule in wrong place! * Removing lock file behaviour from ASGs as it cannot work unless controller and ASG are in the same VPC. * Capturing lock file limitations in comment. * Updating documentation for LE. * Using pip to install certbot plugins. * Updating README docs. * Docs error corrected. * Working around deprecated SSH algorithms. * Upgrading SSH key type standard for controller and deploy users. * Adding SCP args for legacy mode needed by Packer. * Adding an extra when clause to ACM SAN cert check. * Bug fixes 2.x pr 2.x (#1752) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * Setting more sane ASG defaults. * Making ClamAV timers a list so they can be entirely replaced. * Spacing fix for linting. * Renaming npm module. * Removing NGINX installation as part of phpMyAdmin role by default. * Fixing Varnish handler names. * Excluding name[casing] rule from linting due to false positives. * Put rule in wrong place! * Removing lock file behaviour from ASGs as it cannot work unless controller and ASG are in the same VPC. * Capturing lock file limitations in comment. * Updating documentation for LE. * Using pip to install certbot plugins. * Updating README docs. * Docs error corrected. * Working around deprecated SSH algorithms. * Upgrading SSH key type standard for controller and deploy users. * Adding SCP args for legacy mode needed by Packer. * Adding an extra when clause to ACM SAN cert check. * Trying different approach to ACM SAN cert check. * Bug fixes 2.x pr 2.x (#1754) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * Setting more sane ASG defaults. * Making ClamAV timers a list so they can be entirely replaced. * Spacing fix for linting. * Renaming npm module. * Removing NGINX installation as part of phpMyAdmin role by default. * Fixing Varnish handler names. * Excluding name[casing] rule from linting due to false positives. * Put rule in wrong place! * Removing lock file behaviour from ASGs as it cannot work unless controller and ASG are in the same VPC. * Capturing lock file limitations in comment. * Updating documentation for LE. * Using pip to install certbot plugins. * Updating README docs. * Docs error corrected. * Working around deprecated SSH algorithms. * Upgrading SSH key type standard for controller and deploy users. * Adding SCP args for legacy mode needed by Packer. * Adding an extra when clause to ACM SAN cert check. * Trying different approach to ACM SAN cert check. * Removing /bin/which from rkhunter defaults, it isn't present in Debian 11. * RDS param group module has changed name. * Bug fixes 2.x pr 2.x (#1756) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * Setting more sane ASG defaults. * Making ClamAV timers a list so they can be entirely replaced. * Spacing fix for linting. * Renaming npm module. * Removing NGINX installation as part of phpMyAdmin role by default. * Fixing Varnish handler names. * Excluding name[casing] rule from linting due to false positives. * Put rule in wrong place! * Removing lock file behaviour from ASGs as it cannot work unless controller and ASG are in the same VPC. * Capturing lock file limitations in comment. * Updating documentation for LE. * Using pip to install certbot plugins. * Updating README docs. * Docs error corrected. * Working around deprecated SSH algorithms. * Upgrading SSH key type standard for controller and deploy users. * Adding SCP args for legacy mode needed by Packer. * Adding an extra when clause to ACM SAN cert check. * Trying different approach to ACM SAN cert check. * Removing /bin/which from rkhunter defaults, it isn't present in Debian 11. * RDS param group module has changed name. * Adding passlib to libraries installed for ce-provision. * Adding in valid path for 'which' to rkhunter. * Redoing-changes-for-aws-acl-role (#1728) * Redoing-changes-for-aws-acl-role * retrigger checks * Fixing-conflicts-4 --------- Co-authored-by: Matej Stajduhar * Remvoing-scp-extra-args-temporary (#1761) Co-authored-by: Matej Stajduhar * Bug fixes 2.x pr 2.x (#1765) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * Setting more sane ASG defaults. * Making ClamAV timers a list so they can be entirely replaced. * Spacing fix for linting. * Renaming npm module. * Removing NGINX installation as part of phpMyAdmin role by default. * Fixing Varnish handler names. * Excluding name[casing] rule from linting due to false positives. * Put rule in wrong place! * Removing lock file behaviour from ASGs as it cannot work unless controller and ASG are in the same VPC. * Capturing lock file limitations in comment. * Updating documentation for LE. * Using pip to install certbot plugins. * Updating README docs. * Docs error corrected. * Working around deprecated SSH algorithms. * Upgrading SSH key type standard for controller and deploy users. * Adding SCP args for legacy mode needed by Packer. * Adding an extra when clause to ACM SAN cert check. * Trying different approach to ACM SAN cert check. * Removing /bin/which from rkhunter defaults, it isn't present in Debian 11. * RDS param group module has changed name. * Adding passlib to libraries installed for ce-provision. * Adding in valid path for 'which' to rkhunter. * Catching up documentation. * Catching up documentation. * Making user creation optional and home directories a variable. * Missed passing new home var to task. * Bug fixes 2.x pr 2.x (#1767) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * Setting more sane ASG defaults. * Making ClamAV timers a list so they can be entirely replaced. * Spacing fix for linting. * Renaming npm module. * Removing NGINX installation as part of phpMyAdmin role by default. * Fixing Varnish handler names. * Excluding name[casing] rule from linting due to false positives. * Put rule in wrong place! * Removing lock file behaviour from ASGs as it cannot work unless controller and ASG are in the same VPC. * Capturing lock file limitations in comment. * Updating documentation for LE. * Using pip to install certbot plugins. * Updating README docs. * Docs error corrected. * Working around deprecated SSH algorithms. * Upgrading SSH key type standard for controller and deploy users. * Adding SCP args for legacy mode needed by Packer. * Adding an extra when clause to ACM SAN cert check. * Trying different approach to ACM SAN cert check. * Removing /bin/which from rkhunter defaults, it isn't present in Debian 11. * RDS param group module has changed name. * Adding passlib to libraries installed for ce-provision. * Adding in valid path for 'which' to rkhunter. * Catching up documentation. * Catching up documentation. * Making user creation optional and home directories a variable. * Missed passing new home var to task. * Fixing firewall.bash deletion issues. * Bug fixes 2.x pr 2.x (#1769) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * Setting more sane ASG defaults. * Making ClamAV timers a list so they can be entirely replaced. * Spacing fix for linting. * Renaming npm module. * Removing NGINX installation as part of phpMyAdmin role by default. * Fixing Varnish handler names. * Excluding name[casing] rule from linting due to false positives. * Put rule in wrong place! * Removing lock file behaviour from ASGs as it cannot work unless controller and ASG are in the same VPC. * Capturing lock file limitations in comment. * Updating documentation for LE. * Using pip to install certbot plugins. * Updating README docs. * Docs error corrected. * Working around deprecated SSH algorithms. * Upgrading SSH key type standard for controller and deploy users. * Adding SCP args for legacy mode needed by Packer. * Adding an extra when clause to ACM SAN cert check. * Trying different approach to ACM SAN cert check. * Removing /bin/which from rkhunter defaults, it isn't present in Debian 11. * RDS param group module has changed name. * Adding passlib to libraries installed for ce-provision. * Adding in valid path for 'which' to rkhunter. * Catching up documentation. * Catching up documentation. * Making user creation optional and home directories a variable. * Missed passing new home var to task. * Fixing firewall.bash deletion issues. * Getting rid of accidental extra braces. * Bug fixes 2.x pr 2.x (#1771) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * Setting more sane ASG defaults. * Making ClamAV timers a list so they can be entirely replaced. * Spacing fix for linting. * Renaming npm module. * Removing NGINX installation as part of phpMyAdmin role by default. * Fixing Varnish handler names. * Excluding name[casing] rule from linting due to false positives. * Put rule in wrong place! * Removing lock file behaviour from ASGs as it cannot work unless controller and ASG are in the same VPC. * Capturing lock file limitations in comment. * Updating documentation for LE. * Using pip to install certbot plugins. * Updating README docs. * Docs error corrected. * Working around deprecated SSH algorithms. * Upgrading SSH key type standard for controller and deploy users. * Adding SCP args for legacy mode needed by Packer. * Adding an extra when clause to ACM SAN cert check. * Trying different approach to ACM SAN cert check. * Removing /bin/which from rkhunter defaults, it isn't present in Debian 11. * RDS param group module has changed name. * Adding passlib to libraries installed for ce-provision. * Adding in valid path for 'which' to rkhunter. * Catching up documentation. * Catching up documentation. * Making user creation optional and home directories a variable. * Missed passing new home var to task. * Fixing firewall.bash deletion issues. * Getting rid of accidental extra braces. * Simplifying usernames so you only need to set one var. * Managing-mime-types-nginx (#1773) * Whitelisting ce vpn ip wazuh pr 2.x (#1775) * Whitelisting-CE-VPN-IP-wazuh * Fixing-wazuh-whitelist-variable * Updating-wazuh-vars (#1777) * add community.postgresql collection and remove varnish master release (#1779) * Updating wazuh vars pr 2.x (#1781) * Updating-wazuh-vars * Updating-manager-vars * Updating wazuh vars pr 2.x (#1783) * Updating-wazuh-vars * Updating-manager-vars * Updating-wazuh-manager-active-response * Updating-wazuh-manager-active-response-2x * Updating wazuh vars pr 2.x (#1785) * Updating-wazuh-vars * Updating-manager-vars * Updating-wazuh-manager-active-response * Updating-wazuh-manager-active-response-2x * Fixing-wazuh-broken-pipeline * Updating wazuh vars pr 2.x (#1787) * Updating-wazuh-vars * Updating-manager-vars * Updating-wazuh-manager-active-response * Updating-wazuh-manager-active-response-2x * Fixing-wazuh-broken-pipeline * Tweaking-wazuh-vars * r68065 mattermost role first commit (#1789) * r68065 mattermost role first commit * fixing linting/syntax * reload systemd with ansible.builtin.systemd_service * handler for postgresql reloads * default systemd unit file for mattermost role * r68065 install python psycopg2 (#1791) * r68065 use psycopg binary package as compiling creates depsolve issues (#1793) * permissions for postgres setup (#1795) * r68065 add mattermost group before user (#1797) * Updating-duplicity (#1804) * enable mattermost systemd unit (#1810) * nginx include for mattermost (#1812) * nginx include for mattermost * add mattermost project type * ssl on handled by nginx role (#1814) * fix mattermost nginx include (#1822) * remove unsupported nginx option (#1824) * Restore testing update pr 2.x (#1832) * Restore-testing-update * Restore-testing-update-2 --------- Co-authored-by: Matej Stajduhar * Resolving conflicts pr 2.x (#1834) * Fixing-conflicts-and-updating-docs * Fixed-conflicts * Fixed-conflicts-2 --------- Co-authored-by: Matej Stajduhar * initial commit - mattermost local backups (#1838) * r69995-Updating-vhost-for-LE-validation (#1843) Co-authored-by: Matej Stajduhar * Changing priority flexibility pr 2.x (#1841) * Changing-priority-flexibility * Changing-priority-flexibility-2 * Adding-aws-acl-to-meta * Adding-cast-to-int-for-priority --------- Co-authored-by: Matej Stajduhar * Aws acl role changes for ip set pr 2.x (#1848) * aws_acl-role-changes-for-ip-set * aws_acl-role-changes-for-ip-set-docs-update --------- Co-authored-by: Matej Stajduhar * add_php_repo_before_apt_extra_packages_task_from_common_base (#1850) * fix_opensearch_vars (#1852) * wait_timeout_for_opensearch_domain_creation (#1854) * wait_timeout_for_opensearch_domain_creation * remove trailing space * Updating-aws-acl-task (#1856) Co-authored-by: Matej Stajduhar * Bug fixes 2.x pr 2.x (#1859) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * Setting more sane ASG defaults. * Making ClamAV timers a list so they can be entirely replaced. * Spacing fix for linting. * Renaming npm module. * Removing NGINX installation as part of phpMyAdmin role by default. * Fixing Varnish handler names. * Excluding name[casing] rule from linting due to false positives. * Put rule in wrong place! * Removing lock file behaviour from ASGs as it cannot work unless controller and ASG are in the same VPC. * Capturing lock file limitations in comment. * Updating documentation for LE. * Using pip to install certbot plugins. * Updating README docs. * Docs error corrected. * Working around deprecated SSH algorithms. * Upgrading SSH key type standard for controller and deploy users. * Adding SCP args for legacy mode needed by Packer. * Adding an extra when clause to ACM SAN cert check. * Trying different approach to ACM SAN cert check. * Removing /bin/which from rkhunter defaults, it isn't present in Debian 11. * RDS param group module has changed name. * Adding passlib to libraries installed for ce-provision. * Adding in valid path for 'which' to rkhunter. * Catching up documentation. * Catching up documentation. * Making user creation optional and home directories a variable. * Missed passing new home var to task. * Fixing firewall.bash deletion issues. * Getting rid of accidental extra braces. * Simplifying usernames so you only need to set one var. * Docs update and making Ansible installation via _init an option. * Bug fixes 2.x pr 2.x (#1860) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * Setting more sane ASG defaults. * Making ClamAV timers a list so they can be entirely replaced. * Spacing fix for linting. * Renaming npm module. * Removing NGINX installation as part of phpMyAdmin role by default. * Fixing Varnish handler names. * Excluding name[casing] rule from linting due to false positives. * Put rule in wrong place! * Removing lock file behaviour from ASGs as it cannot work unless controller and ASG are in the same VPC. * Capturing lock file limitations in comment. * Updating documentation for LE. * Using pip to install certbot plugins. * Updating README docs. * Docs error corrected. * Working around deprecated SSH algorithms. * Upgrading SSH key type standard for controller and deploy users. * Adding SCP args for legacy mode needed by Packer. * Adding an extra when clause to ACM SAN cert check. * Trying different approach to ACM SAN cert check. * Removing /bin/which from rkhunter defaults, it isn't present in Debian 11. * RDS param group module has changed name. * Adding passlib to libraries installed for ce-provision. * Adding in valid path for 'which' to rkhunter. * Catching up documentation. * Catching up documentation. * Making user creation optional and home directories a variable. * Missed passing new home var to task. * Fixing firewall.bash deletion issues. * Getting rid of accidental extra braces. * Simplifying usernames so you only need to set one var. * Docs update and making Ansible installation via _init an option. * Variable path error. * Updating linter ignore paths. * Small-changes-on-aws-acl-and-RDS-validation (#1863) Co-authored-by: Matej Stajduhar * Updating-user-ansible-vars (#1864) * Updating user ansible vars pr 2.x (#1867) * Updating-user-ansible-vars * Fixing-syntax * add_vars_to_user_deploy_user_provision (#1869) * Disabling-general-log-mariadb (#1871) * Updating-aws_acl-role (#1873) Co-authored-by: Matej Stajduhar * r70260-rkhunter-whitelist (#1877) * fix(nginx): Remove default nginx dummy vhost that could clash with Varnish (#1750) * fix(nginx): Remove default nginx dummy vhost that could clash with Varnish * Fix variable naming and comment * Implement keep_default_vhost setting * Wazuh-var-update (#1903) * Wazuh-agent-vars-more-readable (#1905) * Filebeat-restart-task-wazuh (#1907) * Filebeat restart task wazuh pr 2.x (#1909) * Filebeat-restart-task-wazuh * Fixing-wazuh-filebeat-restart * Adding-gawk-to-extra-packages (#1910) * Updating-filebeat-restart-task (#1913) * Adding motd to exit role pr 2.x (#1915) * Fixing-backup-validation-role-plicies * Adding-parts-for-VPC-and-SG * Adding-region-to-vpc-and-subnet-tasks * Adding-region-to-vpc-and-subnet-tasks-2 * Updating-vars-for-vpc-and-subnet * Updating-vars-for-vpc-and-subnet-2 * Updating-vars-for-vpc-and-subnet-3 * Adding-json-file-for-restore-testing * Changing-user-where-json-file-is-generated * Updating-json-file-location * Updating-path-to-j2-file * Changing-force-valkue * Testing-file-creation * Testing-file-creation-via-command-task * Adding-motd-to-exit-role * Commenting-out-task-that-will-fail * Fixing-pipefail * Fixing-syntax-issue --------- Co-authored-by: Matej Stajduhar * Fixing-motd-task (#1917) * Motd-switch-egrep-with-awk (#1919) * Motd-task-update (#1922) * Motd-task-update * Restoring-deleted-task * Fixing motd task when running on localhost pr 2.x (#1924) * Fixing-backup-validation-role-plicies * Fixing-motd-task-when-running-on-localhost * Updating-when-statement * Adding-become-true-on-motd-update --------- Co-authored-by: Matej Stajduhar * Apt bug workaround pr 2.x (#1935) * apt_bug_workaround * apt_bug_workaround * apt_bug_workaround * apt_bug_workaround * fix_var_logic * Pushing-aws-backup-validation-role (#1944) * Pushing-aws-backup-validation-role * Fixing-linting --------- Co-authored-by: Matej Stajduhar * fix(redis): Convert maxmemory setting to int before comparing (#1897) * Reverting-nginx-username (#1945) * Reverting nginx username pr 2.x (#1947) * Reverting-nginx-username * Minor-fix-nginx-username * Updating-nginx-vars (#1950) * Bug fixes 2.x pr 2.x (#1952) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * Setting more sane ASG defaults. * Making ClamAV timers a list so they can be entirely replaced. * Spacing fix for linting. * Renaming npm module. * Removing NGINX installation as part of phpMyAdmin role by default. * Fixing Varnish handler names. * Excluding name[casing] rule from linting due to false positives. * Put rule in wrong place! * Removing lock file behaviour from ASGs as it cannot work unless controller and ASG are in the same VPC. * Capturing lock file limitations in comment. * Updating documentation for LE. * Using pip to install certbot plugins. * Updating README docs. * Docs error corrected. * Working around deprecated SSH algorithms. * Upgrading SSH key type standard for controller and deploy users. * Adding SCP args for legacy mode needed by Packer. * Adding an extra when clause to ACM SAN cert check. * Trying different approach to ACM SAN cert check. * Removing /bin/which from rkhunter defaults, it isn't present in Debian 11. * RDS param group module has changed name. * Adding passlib to libraries installed for ce-provision. * Adding in valid path for 'which' to rkhunter. * Catching up documentation. * Catching up documentation. * Making user creation optional and home directories a variable. * Missed passing new home var to task. * Fixing firewall.bash deletion issues. * Getting rid of accidental extra braces. * Simplifying usernames so you only need to set one var. * Docs update and making Ansible installation via _init an option. * Variable path error. * Updating linter ignore paths. * Making the NGINX test result var private. * Documentation update. * Fixing role dependency in NGINX role. * r70597 new system role for ipv6 disablement (#1954) * r70597 new system role for ipv6 disablement * fix linting problem * add readme for system role * Fixing-json-file-for-restore-testing (#1956) Co-authored-by: Matej Stajduhar * Fixing json file for restore testing pr 2.x (#1957) * Fixing-json-file-for-restore-testing * Missing-coma-in-json --------- Co-authored-by: Matej Stajduhar * updating asg role to support custom rule on http and https (#1959) Co-authored-by: filip * Bug fixes 2.x pr 2.x (#1962) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * Setting more sane ASG defaults. * Making ClamAV timers a list so they can be entirely replaced. * Spacing fix for linting. * Renaming npm module. * Removing NGINX installation as part of phpMyAdmin role by default. * Fixing Varnish handler names. * Excluding name[casing] rule from linting due to false positives. * Put rule in wrong place! * Removing lock file behaviour from ASGs as it cannot work unless controller and ASG are in the same VPC. * Capturing lock file limitations in comment. * Updating documentation for LE. * Using pip to install certbot plugins. * Updating README docs. * Docs error corrected. * Working around deprecated SSH algorithms. * Upgrading SSH key type standard for controller and deploy users. * Adding SCP args for legacy mode needed by Packer. * Adding an extra when clause to ACM SAN cert check. * Trying different approach to ACM SAN cert check. * Removing /bin/which from rkhunter defaults, it isn't present in Debian 11. * RDS param group module has changed name. * Adding passlib to libraries installed for ce-provision. * Adding in valid path for 'which' to rkhunter. * Catching up documentation. * Catching up documentation. * Making user creation optional and home directories a variable. * Missed passing new home var to task. * Fixing firewall.bash deletion issues. * Getting rid of accidental extra braces. * Simplifying usernames so you only need to set one var. * Docs update and making Ansible installation via _init an option. * Variable path error. * Updating linter ignore paths. * Making the NGINX test result var private. * Documentation update. * Fixing role dependency in NGINX role. * Adding installation path handling for Galaxy collections. * Bug fixes 2.x pr 2.x (#1966) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * Setting more sane ASG defaults. * Making ClamAV timers a list so they can be entirely replaced. * Spacing fix for linting. * Renaming npm module. * Removing NGINX installation as part of phpMyAdmin role by default. * Fixing Varnish handler names. * Excluding name[casing] rule from linting due to false positives. * Put rule in wrong place! * Removing lock file behaviour from ASGs as it cannot work unless controller and ASG are in the same VPC. * Capturing lock file limitations in comment. * Updating documentation for LE. * Using pip to install certbot plugins. * Updating README docs. * Docs error corrected. * Working around deprecated SSH algorithms. * Upgrading SSH key type standard for controller and deploy users. * Adding SCP args for legacy mode needed by Packer. * Adding an extra when clause to ACM SAN cert check. * Trying different approach to ACM SAN cert check. * Removing /bin/which from rkhunter defaults, it isn't present in Debian 11. * RDS param group module has changed name. * Adding passlib to libraries installed for ce-provision. * Adding in valid path for 'which' to rkhunter. * Catching up documentation. * Catching up documentation. * Making user creation optional and home directories a variable. * Missed passing new home var to task. * Fixing firewall.bash deletion issues. * Getting rid of accidental extra braces. * Simplifying usernames so you only need to set one var. * Docs update and making Ansible installation via _init an option. * Variable path error. * Updating linter ignore paths. * Making the NGINX test result var private. * Documentation update. * Fixing role dependency in NGINX role. * Adding installation path handling for Galaxy collections. * Removing -p option due to unexpected ill effects for role paths. * r70596 create swap directory (#1968) * r70596 create swap directory * remove stat check * 70325 adding asg redirect pr 2.x (#1963) * updating asg role to support custom rule on http and https * updating readme properly * updating docs for the asg role --------- Co-authored-by: filip * swapfile path and clamav exclusion (#1970) * Galaxy role pr 2.x (#1974) * Deleting obsolete Debian 10 requirements files. * Adding first pass at generic and reusable Ansible Galaxy role. * Docs update. * Updating README files. * Updating ce_provision and ce_deploy to use ansible_galaxy role. * Ansible Galaxy docs enhancement. * Cannot use _ansible in variable names, reserved. * Removing blocks for Galaxy installation, not needed. * Variables passed to Galaxy role were wrong. * Bug fixes 2.x pr 2.x (#1975) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * Setting more sane ASG defaults. * Making ClamAV timers a list so they can be entirely replaced. * Spacing fix for linting. * Renaming npm module. * Removing NGINX installation as part of phpMyAdmin role by default. * Fixing Varnish handler names. * Excluding name[casing] rule from linting due to false positives. * Put rule in wrong place! * Removing lock file behaviour from ASGs as it cannot work unless controller and ASG are in the same VPC. * Capturing lock file limitations in comment. * Updating documentation for LE. * Using pip to install certbot plugins. * Updating README docs. * Docs error corrected. * Working around deprecated SSH algorithms. * Upgrading SSH key type standard for controller and deploy users. * Adding SCP args for legacy mode needed by Packer. * Adding an extra when clause to ACM SAN cert check. * Trying different approach to ACM SAN cert check. * Removing /bin/which from rkhunter defaults, it isn't present in Debian 11. * RDS param group module has changed name. * Adding passlib to libraries installed for ce-provision. * Adding in valid path for 'which' to rkhunter. * Catching up documentation. * Catching up documentation. * Making user creation optional and home directories a variable. * Missed passing new home var to task. * Fixing firewall.bash deletion issues. * Getting rid of accidental extra braces. * Simplifying usernames so you only need to set one var. * Docs update and making Ansible installation via _init an option. * Variable path error. * Updating linter ignore paths. * Making the NGINX test result var private. * Documentation update. * Fixing role dependency in NGINX role. * Adding installation path handling for Galaxy collections. * Removing -p option due to unexpected ill effects for role paths. * Moving X-Content-Type-Options header to project type templates. * Adding some inline documentation. * Bug fixes 2.x pr 2.x (#1978) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * Setting more sane ASG defaults. * Making ClamAV timers a list so they can be entirely replaced. * Spacing fix for linting. * Renaming npm module. * Removing NGINX installation as part of phpMyAdmin role by default. * Fixing Varnish handler names. * Excluding name[casing] rule from linting due to false positives. * Put rule in wrong place! * Removing lock file behaviour from ASGs as it cannot work unless controller and ASG are in the same VPC. * Capturing lock file limitations in comment. * Updating documentation for LE. * Using pip to install certbot plugins. * Updating README docs. * Docs error corrected. * Working around deprecated SSH algorithms. * Upgrading SSH key type standard for controller and deploy users. * Adding SCP args for legacy mode needed by Packer. * Adding an extra when clause to ACM SAN cert check. * Trying different approach to ACM SAN cert check. * Removing /bin/which from rkhunter defaults, it isn't present in Debian 11. * RDS param group module has changed name. * Adding passlib to libraries installed for ce-provision. * Adding in valid path for 'which' to rkhunter. * Catching up documentation. * Catching up documentation. * Making user creation optional and home directories a variable. * Missed passing new home var to task. * Fixing firewall.bash deletion issues. * Getting rid of accidental extra braces. * Simplifying usernames so you only need to set one var. * Docs update and making Ansible installation via _init an option. * Variable path error. * Updating linter ignore paths. * Making the NGINX test result var private. * Documentation update. * Fixing role dependency in NGINX role. * Adding installation path handling for Galaxy collections. * Removing -p option due to unexpected ill effects for role paths. * Moving X-Content-Type-Options header to project type templates. * Adding some inline documentation. * Fixing Postfix template to allow external relays. * Bug fixes 2.x pr 2.x (#1980) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * Setting more sane ASG defaults. * Making ClamAV timers a list so they can be entirely replaced. * Spacing fix for linting. * Renaming npm module. * Removing NGINX installation as part of phpMyAdmin role by default. * Fixing Varnish handler names. * Excluding name[casing] rule from linting due to false positives. * Put rule in wrong place! * Removing lock file behaviour from ASGs as it cannot work unless controller and ASG are in the same VPC. * Capturing lock file limitations in comment. * Updating documentation for LE. * Using pip to install certbot plugins. * Updating README docs. * Docs error corrected. * Working around deprecated SSH algorithms. * Upgrading SSH key type standard for controller and deploy users. * Adding SCP args for legacy mode needed by Packer. * Adding an extra when clause to ACM SAN cert check. * Trying different approach to ACM SAN cert check. * Removing /bin/which from rkhunter defaults, it isn't present in Debian 11. * RDS param group module has changed name. * Adding passlib to libraries installed for ce-provision. * Adding in valid path for 'which' to rkhunter. * Catching up documentation. * Catching up documentation. * Making user creation optional and home directories a variable. * Missed passing new home var to task. * Fixing firewall.bash deletion issues. * Getting rid of accidental extra braces. * Simplifying usernames so you only need to set one var. * Docs update and making Ansible installation via _init an option. * Variable path error. * Updating linter ignore paths. * Making the NGINX test result var private. * Documentation update. * Fixing role dependency in NGINX role. * Adding installation path handling for Galaxy collections. * Removing -p option due to unexpected ill effects for role paths. * Moving X-Content-Type-Options header to project type templates. * Adding some inline documentation. * Fixing Postfix template to allow external relays. * Adding a FQDN postfix transport map. * Updating defaults pr 2.x (#1982) * Updated-defaults-for-aws_acl-role * Removing-Identity-search --------- Co-authored-by: Matej Stajduhar * Updating defaults pr 2.x (#1984) * Updated-defaults-for-aws_acl-role * Removing-Identity-search * Removing-undefined-variable --------- Co-authored-by: Matej Stajduhar * Removing-gawk-apt (#1985) * Adding-gawk-removing-gawk-csh (#1987) * Adding-when-statement-for-assigning-instance (#1990) * Adding-when-statement-for-assigning-instance * Adding-check-prior-to-assigning-resources * Adding-check-prior-to-assigning-resources * Adding-region-to-aws-cli-command * Print-protected-resource * Adding-resource-type-definition * Resolved-conflicts * Removing-empty-line * Disabling-assigning-instance-to-restore-testing-plan --------- Co-authored-by: Matej Stajduhar * Matching-2.x-and-devel-branches (#1999) Co-authored-by: Matej Stajduhar * Adding-aws-ses-role (#2003) * Adding-aws-ses-role * Removing-python-script * Changing-domain-name * Using-variable-for-domain-name --------- Co-authored-by: Matej Stajduhar * Resolving-conflicts (#2015) Co-authored-by: Matej Stajduhar * Resolving-conflicts (#2018) Co-authored-by: Matej Stajduhar * Updating nginx ssl le roles pr 2.x (#2021) * Updating-nginx-SSL-LE-roles * Updating-nginx-vars * r70260 Option to ignore false-positive shared memory segment warnings (#2023) * Adding-wazuh-ossec-from-enigma00a (#2027) * Updating-gitlab-runner-env (#2031) * r70987-decom-vpn-guest (#2034) * r70797 nodhcp module in system role for hetzner cloud systems (#2036) * r70797 nodhcp module in system role for hetzner cloud systems * fix syntax * r70797 set pipefail to resolve linting failure * fix pipefail with bash (#2038) * fix var in templ (#2040) * R70928 adding webroot option for le ssl task and fixing looping over domains pr 2.x (#2042) * r70928-adding-webroot-option-for-LE-SSL-task-and-fixing-looping-over-domains * Changing-LE-cron * Changing-script-from-sh-to-bash --------- Co-authored-by: Matej Stajduhar * Updating-local-ossec-rules (#2045) * Updating-local-ossec-rules * Fixing-syntax * Updating-wazuh-vars (#2048) * Updating-wazuh-vars * Changing-var-defaults * Removing-wrong-variables * r70260-rkhunter-tested-good-tweaks (#2051) * Fixing-LE-renew-timer (#2052) Co-authored-by: Matej Stajduhar * R70260 rkhunter tweak portpathwhitelist pr 2.x (#2055) * r70260-rkhunter-tweak-portpathwhitelist TEST * sanitise portpath items * Updating-system-role-condition (#2056) * Updating system role condition pr 2.x (#2059) * Updating-system-role-condition * Updating-system-role-condition-v2 * r71121-tweak-nohetznerdhcp-condition (#2061) * Changing-aws-acl-when-statement (#2063) Co-authored-by: Matej Stajduhar * R71127 r71052 check pr 2.x (#2073) * r71127-r71052-attemt-to-workaround-elb-module-change-or-bug * debug alb issue * revert changes as the bug is outside of ce-provision https://github.com/ansible-collections/amazon.aws/issues/2376 * Newer aws collection test pr 2.x (#2077) * newer_aws_collection_test * 8.2.1 didnt work, back to 8.0.1 * r71171-efs-client-upgrade (#2079) * Turning-off-ami-cleanup-task (#2083) Co-authored-by: Matej Stajduhar * Changing subnet for rds pr 2.x (#2087) * Changing-subnet-for-RDS * Uncommenting-tasks --------- Co-authored-by: Matej Stajduhar * fix(debian/duplicity): Fix missing compilation dependencies (#2029) * fix(php-fpm): Set a good process children default for bigger servers (#1895) * fix(php-fpm): Set a good process children default for bigger servers * Fix min max logic * formatting * Fixing-RDS-backup-validation (#2089) Co-authored-by: Matej Stajduhar * Updating-postfix-default-transport-maps (#2092) * Updated lambda backup validation reporting pr 2.x (#2099) * Updated-lambda-backup-validation-reporting * Updating-docs * Updating-lambda-handler * Adding-region-to-cloudwatch-task * Trimming-version-number-from-lambda * Fixing-text-manipulation * Updating-arn-for-cloudwatch-task --------- Co-authored-by: Matej Stajduhar * Bug fixes 2.x pr 2.x (#2096) * Improving AWS subnet docs. * Error in timers structure in the SSL role. * Removing obsolete backports requirements. * Allow the billing role to access Sustainability information. * Missing comma in IAM billing policy. * Removing broken GitLab Runner code. * Fixed the include_role task in gitlab_runner. * Suppressing a failure if there is no system pip to call. * Logic error in Ansible installer username, needs to be set from calling role. * ansible_user is a reserved variable, seems to be causing issues. * _ansible_ANYTHING is reserved, using _install_username instead. * python_boto role also needs the username set in the calling role. * Updating python_boto docs. * Making profile.d loading more robust. * Also pip removing ansible-core and trying with pip and pip3 to cover all bases. * Updating bad AWS SG role var namespacing in other roles. * Refactoring how we handle python3-pip. * Allow passing in of the Python interpreter to Ansible. * Updating the packages server for CE. * Installing Ansible in a venv on all machines. * Changing common_base format for readability. * No need to specify Python to the point release. * Docs update. * Fixing LDAP SSL to use systemd timer. * Allowing different systemd timer names for different Ansible installs. * Fixing dynamic key name in ansible role. * Trying to debug missing timer_command var. * Treating the timer string so it becomes a dict. * Moving default log location for clamav. * Updating ClamAV docs. * Grouping systemd timer tasks together. * Exposing ce-provision version in build output. * Wrong variable in meta role for controller username. * Removing any reference to _aws variables in debian role defaults. * Setting more sane ASG defaults. * Making ClamAV timers a list so they can be entirely replaced. * Spacing fix for linting. * Renaming npm module. * Removing NGINX installation as part of phpMyAdmin role by default. * Fixing Varnish handler names. * Excluding name[casing] rule from linting due to false positives. * Put rule in wrong place! * Removing lock file behaviour from ASGs as it cannot work unless controller and ASG are in the same VPC. * Capturing lock file limitations in comment. * Updating documentation for LE. * Using pip to install certbot plugins. * Updating README docs. * Docs error corrected. * Working around deprecated SSH algorithms. * Upgrading SSH key type standard for controller and deploy users. * Adding SCP args for legacy mode needed by Packer. * Adding an extra when clause to ACM SAN cert check. * Trying different approach to ACM SAN cert check. * Removing /bin/which from rkhunter defaults, it isn't present in Debian 11. * RDS param group module has changed name. * Adding passlib to libraries installed for ce-provision. * Adding in valid path for 'which' to rkhunter. * Catching up documentation. * Catching up documentation. * Making user creation optional and home directories a variable. * Missed passing new home var to task. * Fixing firewall.bash deletion issues. * Getting rid of accidental extra braces. * Simplifying usernames so you only need to set one var. * Docs update and making Ansible installation via _init an option. * Variable path error. * Updating linter ignore paths. * Making the NGINX test result var private. * Documentation update. * Fixing role dependency in NGINX role. * Adding installation path handling for Galaxy collections. * Removing -p option due to unexpected ill effects for role paths. * Moving X-Content-Type-Options header to project type templates. * Adding some inline documentation. * Fixing Postfix template to allow external relays. * Adding a FQDN postfix transport map. * Updating CI to 2.x. * Defending against missing Ansible. * Making the ce-provision-config branch in CI dynamic. * We do not want a 'ce-dev provision' because it breaks our controller. * Reverting 'ce-dev provision' change. * Trying a different ansible_facts var. * Testing using the source branch in ce-dev. * Setting max_childen to an integer to avoid CI issues. * Trying to change the python interpreter used. * Adding platform and cgroup values to ce-dev compose template. * Trying latest ubuntu containers in GitHub Actions. * Fixing the test.sh script to work with venvs. * Documentation for PHP in CI. * Avoiding-backup-restoration-for-dev-env (#2108) Co-authored-by: Matej Stajduhar * Updating-nodejs-to-nodistro (#2094) * Updating-nodejs-to-nodistro * Fixing-nodejs-unattended-upgrades * r71344-Updating-aws-acl-role (#2111) Co-authored-by: Matej Stajduhar * r71344-Updating-aws-acl-role (#2112) * r71344-Updating-aws-acl-role * Adding-option-to-avoid-recreating-ACLs * Updating-aws-acl-vars * Updating-aws-acl-vars-2 --------- Co-authored-by: Matej Stajduhar * Fixing-non-utf8-item (#2116) Co-authored-by: Matej Stajduhar * Fixing non utf8 item pr 2.x (#2117) * Fixing-non-utf8-item * Changing-var-name-for-when-condition --------- Co-authored-by: Matej Stajduhar * Fixing-utf8 (#2129) * Fixing utf8-2.x (#2131) * Fixing-utf8 * Adding-debug * Changing-lambda-creation-from-tip-file-to-s3 (#2122) * Changing-lambda-creation-from-tip-file-to-s3 * Fixing-syntax-error * indentation-fix * Finishing-backup-valdation-role --------- Co-authored-by: Matej Stajduhar * Updating email notification title pr 2.x (#2140) * Updating-email-notification-title * Resolving-conflicts * Resolving-conflicts-2 --------- Co-authored-by: Matej Stajduhar * Adding-defaults-to-max-children (#2141) * Adding defaults to max children pr 2.x (#2144) * Adding-defaults-to-max-children * Updating-max-children * Updating-php-defaults (#2145) * Updating php defaults pr 2.x (#2147) * Updating-php-defaults * Updating-php-defaults * Updating-php-defaults * efs_version_fix_for_old_debian_workaround --------- Co-authored-by: Greg Harvey Co-authored-by: drazenCE <140631110+drazenCE@users.noreply.github.com> Co-authored-by: nfawbert <62660788+nfawbert@users.noreply.github.com> Co-authored-by: Code Enigma CI Co-authored-by: EmlynK Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Dionisio Co-authored-by: pascal Co-authored-by: Jamie Wiseman Co-authored-by: mdecorniquet <43240244+mdecorniquet@users.noreply.github.com> Co-authored-by: Matthieu Decorniquet Co-authored-by: Dionisio Co-authored-by: Jean Pierre Dentone Co-authored-by: Nick Fawbert Co-authored-by: Miro Michalicka Co-authored-by: Miro Michalicka Co-authored-by: Matej Stajduhar Co-authored-by: Sunil Odedra <122627205+sunilodedra@users.noreply.github.com> Co-authored-by: Sunny Co-authored-by: Matej Štajduhar <30931414+matej5@users.noreply.github.com> Co-authored-by: Klaus Purer Co-authored-by: Klaus Purer Co-authored-by: Filip Rupic <123341158+filiprupic@users.noreply.github.com> Co-authored-by: filip --- roles/debian/aws_efs_client/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/debian/aws_efs_client/defaults/main.yml b/roles/debian/aws_efs_client/defaults/main.yml index 9450c4ff7..091662e43 100644 --- a/roles/debian/aws_efs_client/defaults/main.yml +++ b/roles/debian/aws_efs_client/defaults/main.yml @@ -4,7 +4,7 @@ _mount_state: present aws_efs_client: aws_profile: example # AWS boto profile name - can be substituted for "{{ _aws_profile }}" if set region: eu-west-1 # AWS region name - can be substituted for "{{ _aws_region }}" if set - version: 2.1.0 # version of AWS EFS utils to use + version: "{{ '1.35.0' if ansible_distribution_major_version | int < 12 else '2.1.0' }}" # 2.1.0 requires libssl v3 which is absent on Debian < 12 by default. build_suffix: "-1_all" # sometimes there is a suffix appended to the package name, e.g. `amazon-efs-utils-1.35.0-1_all.deb` deb_url: "" # provide an alternative location for the .deb package # See https://docs.ansible.com/ansible/latest/modules/mount_module.html