idealista/apache_httpd_role

Ansible role to install an Apache HTTP server

apache_httpd_role's Issues

[FEATURE] Support for debian bullseye

Description

[Description of the issue]

Why is this needed?

[A clear and concise description of why do you think this is needed]

Additional Information

[Any additional information, configuration or data.]

Generate Docker Image

Prerequisites

• Put an X between the brackets on this line if you have done all of the following:
  • Checked that your issue isn't already filled: https://github.com/issues?utf8=✓&q=is%3Aissue+user%3Aidealista
  • Checked that there is not already provided the described functionality

Description

[Description of the issue]

It would be nice to have a Docker Image ready to use with volumes.

Add logrotate option

Test Apache configuration before initialize service

Remove support for installing logrotate

Description

Remove support for installing logrotate.

Additional Information

This is because logrotate should not be installed using this role, but the logrorate role instead.

Include rewrites file

Prerequisites

• Put an X between the brackets on this line if you have done all of the following:
  • Checked that your issue isn't already filled: https://github.com/issues?utf8=✓&q=is%3Aissue+user%3Aidealista
  • Checked that there is not already provided the described functionality

Description

In case users need Apache to rewrite URLs, it is needed that the role can include a rewrites file.

Upgrade Molecule version

Prerequisites

• Put an X between the brackets on this line if you have done all of the following:
  • Checked that your issue isn't already filled: https://github.com/issues?utf8=✓&q=is%3Aissue+user%3Aidealista
  • Checked that there is not already provided the described functionality

Description

Upgrade tests to latest Molecule version (2.12, at the moment).

Brotli fails in some hosts due to some libraries

Description

Deploying this role with Brotli in a Debian 9 machine, it fails to start the Apache server due to some missing library that is actually installed:

 libbrotlienc.so.1: cannot open shared object file: No such file or directory

Googling the error, I stumbled upon with this issue and a solution: google/ngx_brotli#23 (comment)

So from now on, after doing Brotli's make install, ldconfig will be performed.

Playbook fails when no/wrong sites-enabled files are provided

Add symlink in sites-enabled task in config.yml is a bit error prone because it expects the prior task to copy configuration files. If no configuration files are copied, Add symlink in sites-enabled will fail

[BUG] Error in modpagespeed installation

Description

[Description of the issue]

Steps to Reproduce

1. Run role with moppagespeed config defined

Expected behavior:
Installation complete

Actual behavior:
Installation failed with this error:
The task includes an option with an undefined variable. The error was: 'apache_modjk_pagespeed_files' is undefined

Reproduces how often:
100%

Maybe is not necessary to restart the service every time

Do a little research on reloading instead of restarting Apache after some changes (virtualhosts, for instance)

Add the ability to configure any file under /etc/apache/conf using provided files or templates

Prerequisites

• Put an X between the brackets on this line if you have done all of the following:
  • Checked that your issue isn't already filled: https://github.com/issues?utf8=✓&q=is%3Aissue+user%3Aidealista
  • Checked that there is not already provided the described functionality

Description

We should add the ability to confgure any file under /etc/apache/conf using provided files or templates. Currently this role only supports the override of the main httpd config file.

Expected behavior: I would expect to provide a file or template called httpd-mpm.conf(.j2) to be used

Actual behavior: Only copies httpd.conf provided as template

Enabling modules with prerrequisites in ./configure

Prerequisites

• Put an X between the brackets on this line if you have done all of the following:
  • Checked that your issue isn't already filled: https://github.com/issues?utf8=✓&q=is%3Aissue+user%3Aidealista
  • Checked that there is not already provided the described functionality

Description

To enable, for instance deflate module, there has to be the possibility of passing extra parameters to the ./configure step in Apache build and install possible prerrequisites of these modules.

Set less strict files permissions

Prerequisites

• Put an X between the brackets on this line if you have done all of the following:
  • Checked that your issue isn't already filled: https://github.com/issues?utf8=✓&q=is%3Aissue+user%3Aidealista
  • Checked that there is not already provided the described functionality

Description

All extracted, copied or templated files are set wit 640 permissions. As stated in https://www.owasp.org/index.php/SCG_WS_Apache#Apache_File_Ownership_and_Permissions, 755 permissions should be set.

Versions

All of them.

Install mod_jk from sources

Add Brotli compression

Description

Add optional Brotli installation with Apache.

References:
https://httpd.apache.org/docs/current/mod/mod_brotli.html
https://www.tunetheweb.com/performance/brotli/

[FEATURE] Add support to setup ulimit (max file opened) in apache service

Description

In order to avoid failures related with "too many open files" from a running process, we have to add support to setup systemd service in case expand this threshold would be a requirement.

Why is this needed?

Because there may be some situations where expand the ulimit is required.

Additional Information

There are some roles that have already had it, for example:

https://github.com/idealista/clickhouse_role/blob/3bda7a062f6a3ae924c21c7d21b071343da57150/templates/clickhouse-server.service.j2#L14

[BUG] Missing options --with in builds

Description

The role can't handle --with options. There is no way for adding it in configure execution before build.

Reproduces how often:
Always

Environment

• The release version/s you are using:
• OS: all

Assert that all included modules in /etc/apache2/mods-enabled are enabled using apachectl -M

Prerequisites

• Put an X between the brackets on this line if you have done all of the following:
  • Checked that your issue isn't already filled: https://github.com/issues?utf8=✓&q=is%3Aissue+user%3Aidealista
  • Checked that there is not already provided the described functionality

Description

Assert that all included modules in /etc/apache2/mods-enabled are enabled using apachectl -M

Expected behavior:

The modules listed by the built-in apachectl -M command are equals to the modules present in /etc/apache2/mods-enabled directory

Actual behavior:

We aren't actually asserting which modules are loaded :)

Versions

1.0.0

Add option to install PageSpeed module

Description

Add the option to install the PageSpeed module.

Why is this needed?

It is needed to optimize httpd's performance

Additional Information

N/A

Enable reinstall

Description

Using a apache_reinstall variable, there should exist the possibility of skipping the idempotence condition and reinstall apache

[BUG] CI is failling

Description

Build is failling in Travis CI

Steps to Reproduce

https://app.travis-ci.com/github/idealista/apache_httpd_role/builds/267144982

Expected behavior:

Build passed.

Actual behavior:

Build KO.

Reproduces how often:

100%.

Environment

N/A

Additional Information

N/A

Update mod_jk URL

And maybe move that variable to defaults/main.yml to make it easier to override when the URL changes

Follow Apache's Security Tips

Prerequisites

• Put an X between the brackets on this line if you have done all of the following:
  • Checked that your issue isn't already filled: https://github.com/issues?utf8=✓&q=is%3Aissue+user%3Aidealista
  • Checked that there is not already provided the described functionality

Description

Follow OWASP's recommendations: https://www.owasp.org/index.php/SCG_WS_Apache

Extract service state and enabled option to variables

Prerequisites

• Put an X between the brackets on this line if you have done all of the following:
  • Checked that your issue isn't already filled: https://github.com/issues?utf8=✓&q=is%3Aissue+user%3Aidealista
  • Checked that there is not already provided the described functionality

Description

Add ability to establish Apache service status and whether it is enabled or not via two variables: apache_service_state and apache_service_enabled

Httpd_conf template is not being overwritten using the playbook

Prerequisites

• Put an X between the brackets on this line if you have done all of the following:
  • Checked that your issue isn't already filled: https://github.com/issues?utf8=✓&q=is%3Aissue+user%3Aidealista
  • Checked that there is not already provided the described functionality

Description

Because of having the httpd.conf template under the role's template folder, playbooks aren't able to use any other template but that one.

Steps to Reproduce

1. Have a different httpd.conf template under the playbook's template folder.
2. Use this role (v1.2.0 or lower) in any playbook.
3. Check the rendered httpd.conf in the host.

Expected behavior:

The rendered httpd.confis the one in the playbook's template folder.

Actual behavior:

The rendered httpd.confis the one in the role's template folder.

Reproduces how often: [What percentage of the time does it reproduce?]

Versions

v1.2.0

Add Travis CI

Extra sites-enabled configurations is not getting included

As @jdvr noticed, the httpd.conf template doesn't include extra configurations for sites-enabled