diff --git a/CHANGELOG.md b/CHANGELOG.md index e50d578f6..3222449c6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -31,6 +31,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Changed +* A repository file that carries mirror credentials is deployed with mode `0600` instead of `0644`, so an unprivileged `dnf` or `zypper` no longer lists those repositories (all `repo_*` roles). * **role:collabora**: A host running a Collabora version the role has no configuration template for aborts with that version and the list of supported ones, instead of failing on a missing file. * **role:collabora**: The `localhost` WOPI host is an ordinary entry of `collabora__coolwsd_storage_wopi__*` instead of being hard-coded in the template, so it can be dropped with `state: 'absent'` like any other host. * **role:php**: The PHP-FPM configuration is checked with `php-fpm --test` before the service is restarted, so a broken pool or ini aborts the run with the error message instead of taking PHP-FPM down on the restart. diff --git a/roles/repo_baseos/tasks/main.yml b/roles/repo_baseos/tasks/main.yml index ac4405734..38e4f9844 100644 --- a/roles/repo_baseos/tasks/main.yml +++ b/roles/repo_baseos/tasks/main.yml @@ -12,7 +12,8 @@ dest: '/etc/yum.repos.d/{{ item | basename }}' owner: 'root' group: 'root' - mode: 0o644 + # 0600 while the file carries the mirror credentials + mode: '{{ "0o600" if repo_baseos__basic_auth_login | default({}) | length > 0 else "0o644" }}' loop: '{{ __repo_baseos__repo_files }}' - name: 'Remove rpmnew / rpmsave (and Debian equivalents)' diff --git a/roles/repo_collabora/tasks/main.yml b/roles/repo_collabora/tasks/main.yml index 31feeee8f..581cb2626 100644 --- a/roles/repo_collabora/tasks/main.yml +++ b/roles/repo_collabora/tasks/main.yml @@ -12,7 +12,8 @@ dest: '/etc/yum.repos.d/Collabora.repo' owner: 'root' group: 'root' - mode: 0o644 + # 0600 while the file carries the mirror credentials + mode: '{{ "0o600" if repo_collabora__basic_auth_login | default({}) | length > 0 else "0o644" }}' - name: 'Remove rpmnew / rpmsave (and Debian equivalents)' ansible.builtin.include_role: diff --git a/roles/repo_collabora_code/tasks/main.yml b/roles/repo_collabora_code/tasks/main.yml index 052cdf8fd..8f3bb50db 100644 --- a/roles/repo_collabora_code/tasks/main.yml +++ b/roles/repo_collabora_code/tasks/main.yml @@ -13,7 +13,8 @@ dest: '/etc/yum.repos.d/Collabora.repo' owner: 'root' group: 'root' - mode: 0o644 + # 0600 while the file carries the mirror credentials + mode: '{{ "0o600" if repo_collabora_code__basic_auth_login | default({}) | length > 0 else "0o644" }}' - name: 'Remove rpmnew / rpmsave (and Debian equivalents)' ansible.builtin.include_role: diff --git a/roles/repo_docker/tasks/main.yml b/roles/repo_docker/tasks/main.yml index 4e03f17ba..2195a435f 100644 --- a/roles/repo_docker/tasks/main.yml +++ b/roles/repo_docker/tasks/main.yml @@ -8,7 +8,8 @@ dest: '/etc/yum.repos.d/docker-ce.repo' owner: 'root' group: 'root' - mode: 0o644 + # 0600 while the file carries the mirror credentials + mode: '{{ "0o600" if repo_docker__basic_auth_login | default({}) | length > 0 else "0o644" }}' - name: 'Remove rpmnew / rpmsave (and Debian equivalents)' ansible.builtin.include_role: diff --git a/roles/repo_elasticsearch/tasks/RedHat.yml b/roles/repo_elasticsearch/tasks/RedHat.yml index 4d67f84c8..ca160eb0a 100644 --- a/roles/repo_elasticsearch/tasks/RedHat.yml +++ b/roles/repo_elasticsearch/tasks/RedHat.yml @@ -8,7 +8,8 @@ dest: '/etc/yum.repos.d/elasticsearch.repo' owner: 'root' group: 'root' - mode: 0o644 + # 0600 while the file carries the mirror credentials + mode: '{{ "0o600" if repo_elasticsearch__basic_auth_login | default({}) | length > 0 else "0o644" }}' - name: 'Remove rpmnew / rpmsave (and Debian equivalents)' ansible.builtin.include_role: diff --git a/roles/repo_epel/tasks/main.yml b/roles/repo_epel/tasks/main.yml index f7447a9be..cdbae1967 100644 --- a/roles/repo_epel/tasks/main.yml +++ b/roles/repo_epel/tasks/main.yml @@ -17,7 +17,8 @@ dest: '/etc/yum.repos.d/{{ item | basename }}' owner: 'root' group: 'root' - mode: 0o644 + # 0600 while the file carries the mirror credentials + mode: '{{ "0o600" if repo_epel__basic_auth_login | default({}) | length > 0 else "0o644" }}' loop: '{{ __repo_epel__repo_files }}' - name: 'Remove rpmnew / rpmsave (and Debian equivalents)' diff --git a/roles/repo_gitlab_ce/tasks/main.yml b/roles/repo_gitlab_ce/tasks/main.yml index d2b630cdf..adcc190fb 100644 --- a/roles/repo_gitlab_ce/tasks/main.yml +++ b/roles/repo_gitlab_ce/tasks/main.yml @@ -8,7 +8,8 @@ dest: '/etc/yum.repos.d/gitlab_gitlab-ce.repo' owner: 'root' group: 'root' - mode: 0o644 + # 0600 while the file carries the mirror credentials + mode: '{{ "0o600" if repo_gitlab_ce__basic_auth_login | default({}) | length > 0 else "0o644" }}' - name: 'Remove rpmnew / rpmsave (and Debian equivalents)' ansible.builtin.include_role: diff --git a/roles/repo_gitlab_runner/tasks/main.yml b/roles/repo_gitlab_runner/tasks/main.yml index b9b9ff34d..6b8f56d43 100644 --- a/roles/repo_gitlab_runner/tasks/main.yml +++ b/roles/repo_gitlab_runner/tasks/main.yml @@ -7,7 +7,8 @@ dest: '/etc/yum.repos.d/gitlab_gitlab-ce.repo' owner: 'root' group: 'root' - mode: 0o644 + # 0600 while the file carries the mirror credentials + mode: '{{ "0o600" if repo_gitlab_runner__basic_auth_login | default({}) | length > 0 else "0o644" }}' - name: 'Remove rpmnew / rpmsave (and Debian equivalents)' ansible.builtin.include_role: diff --git a/roles/repo_grafana/tasks/RedHat.yml b/roles/repo_grafana/tasks/RedHat.yml index cd2fea8ad..937017538 100644 --- a/roles/repo_grafana/tasks/RedHat.yml +++ b/roles/repo_grafana/tasks/RedHat.yml @@ -22,7 +22,8 @@ dest: '/etc/yum.repos.d/grafana.repo' owner: 'root' group: 'root' - mode: 0o644 + # 0600 while the file carries the mirror credentials + mode: '{{ "0o600" if repo_grafana__basic_auth_login | default({}) | length > 0 else "0o644" }}' - name: 'Remove rpmnew / rpmsave (and Debian equivalents)' ansible.builtin.include_role: diff --git a/roles/repo_graylog/tasks/RedHat.yml b/roles/repo_graylog/tasks/RedHat.yml index de730997f..5de70e8a9 100644 --- a/roles/repo_graylog/tasks/RedHat.yml +++ b/roles/repo_graylog/tasks/RedHat.yml @@ -24,7 +24,8 @@ dest: '/etc/yum.repos.d/graylog.repo' owner: 'root' group: 'root' - mode: 0o644 + # 0600 while the file carries the mirror credentials + mode: '{{ "0o600" if repo_graylog__basic_auth_login | default({}) | length > 0 else "0o644" }}' - name: 'Remove rpmnew / rpmsave (and Debian equivalents)' ansible.builtin.include_role: diff --git a/roles/repo_icinga/tasks/RedHat.yml b/roles/repo_icinga/tasks/RedHat.yml index a8f551369..688eaebca 100644 --- a/roles/repo_icinga/tasks/RedHat.yml +++ b/roles/repo_icinga/tasks/RedHat.yml @@ -22,7 +22,8 @@ dest: '/etc/yum.repos.d/ICINGA-release.repo' owner: 'root' group: 'root' - mode: 0o644 + # 0600 while the file carries the mirror credentials + mode: '{{ "0o600" if repo_icinga__basic_auth_login | default({}) | length > 0 else "0o644" }}' - name: 'Remove rpmnew / rpmsave (and Debian equivalents)' ansible.builtin.include_role: @@ -38,7 +39,8 @@ dest: '/etc/yum.repos.d/ICINGA-snapshot.repo' owner: 'root' group: 'root' - mode: 0o644 + # 0600 while the file carries the mirror credentials + mode: '{{ "0o600" if repo_icinga__basic_auth_login | default({}) | length > 0 else "0o644" }}' - name: 'Remove rpmnew / rpmsave (and Debian equivalents)' ansible.builtin.include_role: diff --git a/roles/repo_icinga/tasks/Suse.yml b/roles/repo_icinga/tasks/Suse.yml index 49fa9853b..01ed62666 100644 --- a/roles/repo_icinga/tasks/Suse.yml +++ b/roles/repo_icinga/tasks/Suse.yml @@ -29,7 +29,8 @@ dest: '/etc/zypp/repos.d/ICINGA-release.repo' owner: 'root' group: 'root' - mode: 0o644 + # 0600 while the file carries the mirror credentials + mode: '{{ "0o600" if repo_icinga__basic_auth_login | default({}) | length > 0 else "0o644" }}' - name: 'Remove rpmnew / rpmsave (and Debian equivalents)' ansible.builtin.include_role: @@ -45,7 +46,8 @@ dest: '/etc/zypp/repos.d/ICINGA-snapshot.repo' owner: 'root' group: 'root' - mode: 0o644 + # 0600 while the file carries the mirror credentials + mode: '{{ "0o600" if repo_icinga__basic_auth_login | default({}) | length > 0 else "0o644" }}' - name: 'Remove rpmnew / rpmsave (and Debian equivalents)' ansible.builtin.include_role: diff --git a/roles/repo_influxdb/tasks/RedHat.yml b/roles/repo_influxdb/tasks/RedHat.yml index 5e059da34..b7bb08c7d 100644 --- a/roles/repo_influxdb/tasks/RedHat.yml +++ b/roles/repo_influxdb/tasks/RedHat.yml @@ -21,7 +21,8 @@ dest: '/etc/yum.repos.d/influxdb.repo' owner: 'root' group: 'root' - mode: 0o644 + # 0600 while the file carries the mirror credentials + mode: '{{ "0o600" if repo_influxdb__basic_auth_login | default({}) | length > 0 else "0o644" }}' - name: 'Remove rpmnew / rpmsave (and Debian equivalents)' ansible.builtin.include_role: diff --git a/roles/repo_mariadb/tasks/RedHat.yml b/roles/repo_mariadb/tasks/RedHat.yml index 20780c7c2..c2de748ff 100644 --- a/roles/repo_mariadb/tasks/RedHat.yml +++ b/roles/repo_mariadb/tasks/RedHat.yml @@ -17,7 +17,8 @@ dest: '/etc/yum.repos.d/MariaDB.repo' owner: 'root' group: 'root' - mode: 0o644 + # 0600 while the file carries the mirror credentials + mode: '{{ "0o600" if repo_mariadb__basic_auth_login | default({}) | length > 0 else "0o644" }}' - name: 'Remove rpmnew / rpmsave (and Debian equivalents)' ansible.builtin.include_role: diff --git a/roles/repo_mongodb/tasks/RedHat.yml b/roles/repo_mongodb/tasks/RedHat.yml index 6ff1c52a1..98b415d67 100644 --- a/roles/repo_mongodb/tasks/RedHat.yml +++ b/roles/repo_mongodb/tasks/RedHat.yml @@ -24,7 +24,8 @@ dest: '/etc/yum.repos.d/mongodb-org.repo' owner: 'root' group: 'root' - mode: 0o644 + # 0600 while the file carries the mirror credentials + mode: '{{ "0o600" if repo_mongodb__basic_auth_login | default({}) | length > 0 else "0o644" }}' - name: 'Remove rpmnew / rpmsave (and Debian equivalents)' ansible.builtin.include_role: diff --git a/roles/repo_monitoring_plugins/tasks/RedHat.yml b/roles/repo_monitoring_plugins/tasks/RedHat.yml index eff2c244f..2879f61bb 100644 --- a/roles/repo_monitoring_plugins/tasks/RedHat.yml +++ b/roles/repo_monitoring_plugins/tasks/RedHat.yml @@ -34,7 +34,8 @@ dest: '/etc/yum.repos.d/linuxfabrik-monitoring-plugins.repo' owner: 'root' group: 'root' - mode: 0o644 + # 0600 while the file carries the mirror credentials + mode: '{{ "0o600" if repo_monitoring_plugins__basic_auth_login | default({}) | length > 0 else "0o644" }}' tags: - 'repo_monitoring_plugins' diff --git a/roles/repo_monitoring_plugins/tasks/Suse.yml b/roles/repo_monitoring_plugins/tasks/Suse.yml index 0d07cd68f..37ef5396f 100644 --- a/roles/repo_monitoring_plugins/tasks/Suse.yml +++ b/roles/repo_monitoring_plugins/tasks/Suse.yml @@ -29,7 +29,8 @@ dest: '/etc/zypp/repos.d/linuxfabrik-monitoring-plugins.repo' owner: 'root' group: 'root' - mode: 0o644 + # 0600 while the file carries the mirror credentials + mode: '{{ "0o600" if repo_monitoring_plugins__basic_auth_login | default({}) | length > 0 else "0o644" }}' tags: - 'repo_monitoring_plugins' diff --git a/roles/repo_mydumper/tasks/RedHat.yml b/roles/repo_mydumper/tasks/RedHat.yml index 2a2c37863..eb6a1dfc9 100644 --- a/roles/repo_mydumper/tasks/RedHat.yml +++ b/roles/repo_mydumper/tasks/RedHat.yml @@ -7,7 +7,8 @@ dest: '/etc/yum.repos.d/mydumper.repo' owner: 'root' group: 'root' - mode: 0o644 + # 0600 while the file carries the mirror credentials + mode: '{{ "0o600" if repo_mydumper__basic_auth_login | default({}) | length > 0 else "0o644" }}' tags: - 'repo_mydumper' diff --git a/roles/repo_opensearch/tasks/RedHat.yml b/roles/repo_opensearch/tasks/RedHat.yml index 3127034a6..b881563d6 100644 --- a/roles/repo_opensearch/tasks/RedHat.yml +++ b/roles/repo_opensearch/tasks/RedHat.yml @@ -23,7 +23,8 @@ dest: '/etc/yum.repos.d/opensearch.repo' owner: 'root' group: 'root' - mode: 0o644 + # 0600 while the file carries the mirror credentials + mode: '{{ "0o600" if repo_opensearch__basic_auth_login | default({}) | length > 0 else "0o644" }}' - name: 'Remove rpmnew / rpmsave (and Debian equivalents)' ansible.builtin.include_role: diff --git a/roles/repo_postgresql/tasks/main.yml b/roles/repo_postgresql/tasks/main.yml index c2835f48d..51f119407 100644 --- a/roles/repo_postgresql/tasks/main.yml +++ b/roles/repo_postgresql/tasks/main.yml @@ -15,7 +15,8 @@ dest: '/etc/yum.repos.d/pgdg-redhat-all.repo' owner: 'root' group: 'root' - mode: 0o644 + # 0600 while the file carries the mirror credentials + mode: '{{ "0o600" if repo_postgresql__basic_auth_login | default({}) | length > 0 else "0o644" }}' - name: 'Remove rpmnew / rpmsave (and Debian equivalents)' ansible.builtin.include_role: diff --git a/roles/repo_proxysql/tasks/RedHat.yml b/roles/repo_proxysql/tasks/RedHat.yml index b4cde2695..d72746f35 100644 --- a/roles/repo_proxysql/tasks/RedHat.yml +++ b/roles/repo_proxysql/tasks/RedHat.yml @@ -24,7 +24,8 @@ dest: '/etc/yum.repos.d/proxysql.repo' owner: 'root' group: 'root' - mode: 0o644 + # 0600 while the file carries the mirror credentials + mode: '{{ "0o600" if repo_proxysql__basic_auth_login | default({}) | length > 0 else "0o644" }}' - name: 'Remove rpmnew / rpmsave (and Debian equivalents)' ansible.builtin.include_role: diff --git a/roles/repo_remi/tasks/main.yml b/roles/repo_remi/tasks/main.yml index d257ea4ed..c19e9f98f 100644 --- a/roles/repo_remi/tasks/main.yml +++ b/roles/repo_remi/tasks/main.yml @@ -19,7 +19,8 @@ dest: '/etc/yum.repos.d/{{ item | basename }}' owner: 'root' group: 'root' - mode: 0o644 + # 0600 while the file carries the mirror credentials + mode: '{{ "0o600" if repo_remi__basic_auth_login | default({}) | length > 0 else "0o644" }}' loop: '{{ __repo_remi__repo_files }}' - name: 'Remove rpmnew / rpmsave (and Debian equivalents)' diff --git a/roles/repo_rpmfusion/tasks/main.yml b/roles/repo_rpmfusion/tasks/main.yml index 0ab3ec31a..3ebcecf56 100644 --- a/roles/repo_rpmfusion/tasks/main.yml +++ b/roles/repo_rpmfusion/tasks/main.yml @@ -7,7 +7,8 @@ dest: '/{{ item }}' owner: 'root' group: 'root' - mode: 0o644 + # 0600 while the file carries the mirror credentials + mode: '{{ "0o600" if repo_rpmfusion__basic_auth_login | default({}) | length > 0 else "0o644" }}' loop: - 'etc/yum.repos.d/rpmfusion-free-updates-testing.repo' - 'etc/yum.repos.d/rpmfusion-free-updates.repo'