Merge pull request #13 from hispanico/enable-http2-over-https

Enable http2 over https and switch to molecule role test

.travis.yml

@@ -1,46 +1,32 @@
 ---
+os: linux
 language: python
-python: "2.7"
-
-sudo: required
-dist: xenial
-
-# Install ansible
-addons:
-  apt:
-    packages:
-    - python-pip
+services: docker
+
+env:
+  global:
+    - ROLE_NAME: nginx-revproxy
+  jobs:
+    # - MOLECULE_DISTRO: centos7
+    - MOLECULE_DISTRO: ubuntu1604
+    - MOLECULE_DISTRO: ubuntu1804
+    - MOLECULE_DISTRO: debian9
+    - MOLECULE_DISTRO: debian10
 
 install:
-  # Install ansible
-  - pip install ansible
+  # Install test dependencies.
+  - pip install molecule docker
 
-  # Check ansible version
-  - ansible --version
-
-  # Create ansible.cfg with correct roles_path
-  - printf '[defaults]\nroles_path=../' >ansible.cfg
+before_script:
+  # Use actual Ansible Galaxy role name for the project directory.
+  - cd ../
+  - mv ansible-$ROLE_NAME hispanico.$ROLE_NAME
+  - cd hispanico.$ROLE_NAME
 
 script:
-  # Basic role syntax check
-  - ansible-playbook tests/test.yml -i tests/inventory --syntax-check
-
-  # Run the role/playbook with ansible-playbook
-  - ansible-playbook tests/test.yml -i tests/inventory --connection=local --become
-
-  # Run the role/playbook again, checking to make sure it's idempotent
-  - >
-    ansible-playbook tests/test.yml -i tests/inventory --connection=local --become
-    | grep -q 'changed=0.*failed=0'
-    && (echo 'Idempotence test: pass' && exit 0)
-    || (echo 'Idempotence test: fail' && exit 1)
-
-  # Check for role is done
-  - sudo service nginx status
-  - sudo netstat -ntulp |grep nginx
-  - sudo ls /etc/nginx/sites-enabled/
-  - for i in $(sudo ls /etc/nginx/sites-enabled/); do echo $i;echo "------------------------------"; sudo cat /etc/nginx/sites-enabled/$i; echo "------------------------------";echo ""; done
-
+  # Run tests.
+  - molecule test
+  - pip install https://github.com/openwisp/openwisp-utils/tarball/master
 
 notifications:
   webhooks: https://galaxy.ansible.com/api/v1/notifications/

defaults/main.yml

@@ -6,8 +6,8 @@ nginx_revproxy_sites:                                         # List of sites to
       - example.com
       - www.example.com
     upstreams:                                                # List of Upstreams
-      - { backend_address: 192.168.0.100, backend_port: 80 }
-      - { backend_address: 192.168.0.101, backend_port: 8080 }
+      - {backend_address: 192.168.0.100, backend_port: 80}
+      - {backend_address: 192.168.0.101, backend_port: 8080}
     ssl: true                                                 # Set to True if you want to redirect http to https
     hsts_max_age: 63072000                                    # Set HSTS header with max-age defined
     letsencrypt: false                                        # Set to True if you want use letsencrypt

meta/main.yml

@@ -1,3 +1,5 @@
+---
+
 galaxy_info:
   author: Hispanico
   description: Manage Nginx as Reverse Proxy
@@ -6,18 +8,20 @@ galaxy_info:
   min_ansible_version: 2.4
 
   platforms:
-  - name: Ubuntu
-    versions:
-    - trusty
-    - xenial
+    - name: Debian
+      versions:
+        - all
+    - name: Ubuntu
+      versions:
+        - all
 
   galaxy_tags:
-  - development
-  - web
-  - nginx
-  - reverse
-  - proxy
-  - load
-  - balancer
+    - development
+    - web
+    - nginx
+    - reverse
+    - proxy
+    - load
+    - balancer
 
 dependencies: []

molecule/default/molecule.yml

@@ -0,0 +1,31 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: docker
+lint:
+  name: yamllint
+  options:
+    config-file: molecule/default/yaml-lint.yml
+  enabled: true
+platforms:
+  - name: "${ROLE_NAME}-${MOLECULE_DISTRO:-centos7}"
+    image: "geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible:latest"
+    command: ${MOLECULE_DOCKER_COMMAND:-""}
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+      - /var/lib/docker
+    privileged: true
+    pre_build_image: true
+provisioner:
+  name: ansible
+  lint:
+    name: ansible-lint
+  playbooks:
+    converge: ${MOLECULE_PLAYBOOK:-playbook.yml}
+scenario:
+  name: default
+verifier:
+  name: testinfra
+  lint:
+    name: flake8

molecule/default/playbook.yml

@@ -0,0 +1,26 @@
+---
+- name: Converge
+  hosts: all
+  become: true
+
+  pre_tasks:
+    - name: Install cron (RedHat).
+      yum:
+        name: cronie
+        state: present
+      when: ansible_os_family == 'RedHat'
+
+    - name: Install cron (Debian).
+      apt:
+        name: cron
+        state: present
+      when: ansible_distribution == 'Debian'
+
+    - name: Update apt cache.
+      apt:
+        update_cache: true
+        cache_valid_time: 600
+      when: ansible_distribution == 'Ubuntu'
+
+  roles:
+    - role: hispanico.nginx-revproxy

molecule/default/yaml-lint.yml

@@ -0,0 +1,6 @@
+---
+extends: default
+rules:
+  line-length:
+    max: 150
+    level: warning

tasks/letsencrypt.yml

@@ -12,7 +12,7 @@
 - name: Get Active Sites
   command: ls -1 /etc/nginx/sites-enabled/
   changed_when: "active.stdout_lines != nginx_revproxy_sites.keys()|sort()"
-  check_mode: no
+  check_mode: false
   register: active
   tags:
     - lesencrypt

tasks/main.yml

@@ -21,7 +21,7 @@
 - name: Install python-passlib for Python 3 hosts
   apt:
     name:
-        - "python3-passlib"
+      - "python3-passlib"
     state: present
   tags:
     - nginxrevproxy
@@ -32,7 +32,7 @@
 - name: Install python-passlib for Python 2 hosts
   apt:
     name:
-        - "python-passlib"
+      - "python-passlib"
     state: present
   tags:
     - nginxrevproxy
@@ -99,7 +99,7 @@
 - name: Get Active Sites
   command: ls -1 /etc/nginx/sites-enabled/
   changed_when: "active.stdout_lines != nginx_revproxy_sites.keys()|sort()"
-  check_mode: no
+  check_mode: false
   register: active
   tags:
     - nginxrevproxy
@@ -150,7 +150,7 @@
     state: directory
     owner: www-data
     group: www-data
-    recurse: yes
+    recurse: true
   with_dict: "{{ nginx_revproxy_sites }}"
   notify: Reload Nginx
   when:
@@ -161,7 +161,7 @@
 - name: Get WebRoot Sites
   command: ls -1 /var/www/
   changed_when: "webroot.stdout_lines != nginx_revproxy_sites.keys()|sort()"
-  check_mode: no
+  check_mode: false
   register: webroot
   tags:
     - nginxrevproxy

templates/reverseproxy_ssl.conf.j2

@@ -16,8 +16,8 @@ server {
 }
 
 server {
-   listen        {{ item.value.listen_ssl | default(443) }} ssl default_server;
-   listen   [::]:{{ item.value.listen_ssl | default(443) }} ssl default_server;
+   listen        {{ item.value.listen_ssl | default(443) }} ssl http2 default_server;
+   listen   [::]:{{ item.value.listen_ssl | default(443) }} ssl http2 default_server;
    server_name _;
    return        444;
 
@@ -33,6 +33,7 @@ server {
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
 }
+
 {% else %}
 upstream {{ item.key }}_backend  {
 {% for upstream in item.value.upstreams %}
@@ -58,8 +59,8 @@ server {
 }
 
 server {
-   listen        {{ item.value.listen_ssl | default(443) }} ssl;
-   listen   [::]:{{ item.value.listen_ssl | default(443) }} ssl;
+   listen        {{ item.value.listen_ssl | default(443) }} ssl http2;
+   listen   [::]:{{ item.value.listen_ssl | default(443) }} ssl http2;
    server_name {{ item.value.domains | join(' ') }};
 
 {% if item.value.hsts_max_age is defined %}

templates/reverseproxy_ssl_letsencrypt.conf.j2

@@ -27,8 +27,8 @@ server {
 }
 
 server {
-   listen        {{ item.value.listen_ssl | default(443) }} ssl;
-   listen   [::]:{{ item.value.listen_ssl | default(443) }} ssl;
+   listen        {{ item.value.listen_ssl | default(443) }} ssl http2;
+   listen   [::]:{{ item.value.listen_ssl | default(443) }} ssl http2;
    server_name {{ item.value.domains | join(' ') }};
 
 {% if item.value.hsts_max_age is defined %}