Skip to content
This repository has been archived by the owner on Aug 13, 2024. It is now read-only.

Configuring modules is currently limited to Centos/RHEL only #236

Open
perryk opened this issue Jan 6, 2019 · 1 comment
Open

Configuring modules is currently limited to Centos/RHEL only #236

perryk opened this issue Jan 6, 2019 · 1 comment

Comments

@perryk
Copy link
Contributor

perryk commented Jan 6, 2019

As mentioned in #232 and #233 the configuring modules section is currently limited to Centos/RHEL only.

I'm working on a PR to expand this and standardise the process if possible.

The current idea is to not follow the current method adding a symlink:
/etc/nginx/modules-enabled/<shortname>.conf -> /usr/share/nginx/modules/<shortname>.conf

To instead first create a .conf file for a given filename.so module file and save as:
/etc/nginx/modules-available/filename.conf

There was some functionality to do this removed however the template file still exists.

Then add a symlink:
/etc/nginx/modules-enabled/<filename>.conf -> /etc/nginx/modules-available/<filename>.conf

Personally I think this is cleaner as it keeps to the <something>-available and <something>-enabled model used in other parts of the configuration.

Potentially we could keep support for using the <shortname> and EPEL provided .conf files already for when using EPEL and only use the template created <filename>.conf files for Official Nginx repo provided modules and for Ubuntu/Debian also.

The concern however is if anyone is already managing modules with links only directly to /usr/share/nginx/modules files, they would need to remove these links. Considering how new the recent commits are however and that there was a typo preventing their use at all I'd hazard a guess to say not many people are in this situation.

n.b I do understand other distros may use something other than /etc/nginx for the main configuration folder. I've just used this above as an example and to make things a little clearer.

@perryk
Copy link
Contributor Author

perryk commented Jan 12, 2019

I'm making progress on the PR for this, actually, it is pretty much done, I'm just testing it further currently.

It isn't quite as clean as may have been hoped, simply due to the variation in different operating systems and package repositories.

I figured I would record a some detail of this so if anyone goes looking there is some rationale behind it.

There are 4 configurations I'll look to cater for.

  1. Centos/RHEL with EPEL repo
  2. Centos/RHEL with official Nginx repo
  3. Debian/Ubuntu with APT repo
  4. Debian/Ubuntu with official Nginx repo

Config 1 - Centos/RHEL with EPEL repo

With the default setting for installing only the package "nginx", the installation task should bring down Nginx, a bunch of modules, and a nicely configured filesystem all ready for use with SELinux. Module .so files live in /usr/lib64/nginx/modules and Module.conf files live in /usr/share/nginx/modules/ with a short-name file naming convention e.g mod-http-geoip.conf.

The nginx_module_configs role variable will need to be specified as a list of configuration file names, minus the .conf file name extension. e.g mod-http-geoip

n.b this will allow backward compatibility, as anyone already managing modules will only be using EPEL and will be specifying config files and not module files.

Config 2 - Centos/RHEL with official Nginx repo

Any modules needed should be added to and specified in the nginx_pkgs role variable and named something like nginx-module-geoip as the installation task will only install Nginx, not any modules. Also, currently only some SELinux settings are set and I've found it necessary to also set the SELinux boolean of httpd_can_network_connect when acting as a reverse proxy. Module .so files live in /usr/lib64/nginx/modules/ and there are no Module.conf files provided. The role will use a template to create these files as needed.

The nginx_module_configs role variable will need to be specified as a list of module file names, minus the .so file name extension. e.g ngx_http_geoip_module

Config 3 - Debian/Ubuntu with APT repo

With the default setting for installing only the package "nginx", the installation task should bring down Nginx and a bunch of modules. Module .so files live in /usr/lib/nginx/modules and Module.conf files live in /usr/share/nginx/modules-available/ . with a short-name naming convention e.g mod-http-geoip.conf. Additional Module.conf files are created, perhaps by a post-install script, in /etc/nginx/modules-enabled with filenames starting with 50-. Presumably, these are to allow /usr/share files to remain as a reference and then people can add/remove the 50- files. Worth noting also there are lots more modules available if nginx-extras or nginx-full is set in nginx_pkgs role variable or manually installed later.

These 50- files are in the way for us, so I've added tasks to rename these files out of way if they exist for any particular module which we choose to manage. The file is renamed to something like mod-name.conf.renamedasmanagednow. With this extension they won't be loaded. Perhaps one case not yet considered is if you wish to manage the disabling of a specific module before ever enabling it via the role. Either set the role to enable this module once, then disable it, or manually move the 50- file out of the way.

n.b the functionality to disable modules via the role is not working yet, the code doing the enabling however is aware to not enable anything if it is specified in the do not enable section, even if it is also in the enable section.

The nginx_module_configs role variable will need to be specified as a list of configuration file names, minus the .conf file name extension. e.g mod-http-geoip

Config 4 - Debian/Ubuntu with official Nginx repo

Fairly similar to Config 2. Any modules needed should be added to and specified in the nginx_pkgs role variable and named something like nginx-module-geoip as the installation task will only install Nginx, not any modules. Module .so files live in /usr/lib/nginx/modules/ and there are no Module.conf files provided. The role will use a template to create these files as needed.

The nginx_module_configs role variable will need to be specified as a list of module file names, minus the .so file name extension. e.g ngx_http_geoip_module

Other considerations

The 2 options for what is needed in nginx_module_configs variables is listed in each section above however worth noting.

The general idea is to have files in /etc/nginx/modules-available (even if just links to elsewhere) and then links to those in /etc/nginx/modules-enabled. This is kept in all cases.

The 2 options for where the actual module .so files live is catered for with a new variable nginx_modules_location, so this shouldn't need to be specified unless someone wants to override for use with a different distribution.

All in all, it isn't too bad, perhaps seeing the code will explain it all anyway. Hopefully, just another day or so and I'll send in a PR.

Cheers.

perryk added a commit to perryk/ansible-role-nginx that referenced this issue Jan 13, 2019
Module configuration should now work for the following:

 Centos/RHEL with either EPEL or Official Nginx repo
 Debian/Ubuntu with either standard APT repo or Official Nginx repo

Please see issue jdauphant#236 for further details.
jdauphant pushed a commit that referenced this issue Jan 13, 2019
Module configuration should now work for the following:

 Centos/RHEL with either EPEL or Official Nginx repo
 Debian/Ubuntu with either standard APT repo or Official Nginx repo

Please see issue #236 for further details.
mrwacky42 added a commit to HeadspaceMeditation/ansible-role-nginx that referenced this issue Jan 18, 2020
* Explicitly setting the nginx configuration file in (jdauphant#223)

the "check nginx configuration" handler.

* Fixing Ansible 2.7.0 deprication warnings (jdauphant#225)

* * Fixing Ansible 2.7.0 deprication warnings
  For further details take a look at: https://docs.ansible.com/ansible/devel/porting_guides/porting_guide_2.7.html#using-a-loop-on-a-package-module-via-squash-actions

* * Remving travis deprecation warning - Moving from "--sudo" to "--become"

* * Ignoring symlinks errors during ansible_check_mode

* Small spelling correction (jdauphant#228)

* Add support to declare nginx modules in config file (jdauphant#227)

* We can declare nginx modules now

* We can declare nginx modules now

* Correct load_module definition in template

* Add task to remove `default.conf` from sites-enabled/ (jdauphant#231)

* Add task to remove `default.conf` from sites-enabled/

* Check if `default` site is not inside user config

* fix modules definition and add README section about this feature (jdauphant#232)

* Fix typo in modules config and restrict to EPEL (jdauphant#232) (jdauphant#235)

* Fix typo in modules config and restrict to EPEL (jdauphant#232)

* Fixes warning from duplicate when's in modules configuration (jdauphant#233)

* Extends support for configuring modules (jdauphant#236) (jdauphant#237)

Module configuration should now work for the following:

 Centos/RHEL with either EPEL or Official Nginx repo
 Debian/Ubuntu with either standard APT repo or Official Nginx repo

Please see issue jdauphant#236 for further details.

* Update README.md

* download mime.types file if it's missing (jdauphant#241)

* configuration: allow templates for conf.d independent files (jdauphant#238)

* Fix for jdauphant#242 Stick to ansible-lint rules. (jdauphant#243)

* trailing whitespace

* [701] Role info should contain description

* [601] Don't compare to literal True/False

* [502] All tasks should be named

* [206] Variables should have spaces before and after: {{ var_name }}

* skip_ansible_lint rule [403] Package installs should not use latest

* [204] Lines should be no longer than 160 chars

Co-authored-by: Timo Runge <timorunge@users.noreply.github.com>
Co-authored-by: TheSycamore <TheSycamore@users.noreply.github.com>
Co-authored-by: Dmitry Ge <22640222+q2digger@users.noreply.github.com>
Co-authored-by: Tommaso <p.tommy93@gmail.com>
Co-authored-by: Perry Kollmorgen <pcjkollmorgen@hotmail.com>
Co-authored-by: Julien DAUPHANT <jdauphant@users.noreply.github.com>
Co-authored-by: Tony Crowe <hellotonycrowe@protonmail.com>
Co-authored-by: paulrbr-fl <43074087+paulrbr-fl@users.noreply.github.com>
Co-authored-by: Bas <bas.meijer@me.com>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant