Changelog
=========

v0.1.7
------

*Unreleased*

- Added ``nginx__deploy_state`` to allow to specify the desired state this role
  should achieve. State ``absent`` is not fully implemented yet. [ypid]

v0.1.6
------

*Released: 2016-03-07*

- Add support for defining error pages in a list, with better control over
  their configuration. [drybjed]

- Do not create welcome pages automatically if creation of webroot directories
  is disabled. [drybjed]

- Make sure that ``/var/lib/nginx/`` directory exists. [pedroluislopez]

- Ensure that list of site referers is unique. [drybjed]

- Use an absolute path in the ``nginx`` PKI hook for ``service`` command, since
  it's outside of the default ``$PATH`` defined by ``cron``. [drybjed]

v0.1.5
------

*Released: 2016-02-07*

- Create a proof-of-concept "solo" version of the role, that does not include
  additional Ansible role dependencies. [drybjed]

- Fix https site detection when using debops.nginx as a dependency.
  [patrickheeney]

- Remove ``item.pki`` in favor of ``item.ssl`` in the nginx site configuration.
  [patrickheeney]

- Remove the "solo" version of the role, a different concept will be created in
  its place. [drybjed]

- Switch from using Diffie-Hellman parameters generated by ``debops.pki`` role
  to DH parameters managed by ``debops.dhparam`` role. [drybjed]

- Most of the file paths used by ``nginx`` are now configurable using default
  variables. This allows to run ``nginx`` on an unprivileged account.

  ``nginx_root_www_path`` variable has been renamed to ``nginx_www``. [drybjed]

- Allow configuration of default ``listen`` and ``listen_ssl`` directives using
  default variables. [drybjed]

- Add default ``localhost`` nginx server. It has disabled HTTPS support and can
  be used by other applications to get the nginx status page locally. [drybjed]

- Add support for getting the client IP address from a custom header, when
  ``nginx`` is used behind a proxy server. [drybjed]

- Move configuration of ``debops.nginx`` role dependencies to default
  variables. It can be used to configure firewall and APT preferences using
  Ansible playbooks instead of hardcoding the dependencies in the role itself.

  Existing role dependencies are still used, and will be removed once all
  involved application playbooks which depend on ``debops.nginx`` are updated.
  [drybjed]

- Add a way to control if ``debops.nginx`` role automatically adds
  ``ipv6only=false`` to the configuration to support dual-stack IPv4/IPv6
  connections. This was the default, now it can be disabled so that users can
  control the listening ports themselves. [drybjed]

- Update ``localhost`` server to also accept connections on loopback IP
  addresses, so that check plugins like ``check_mk`` can work correctly. [ypid]

- Add support for ``HTTP/2`` deprecating ``SPDY`` in ``nginx`` 1.9.5.
  [MatthewMi11er]

- Wrap the default HTTP redirect configuration in ``location / {}`` section.
  This allows addition of other location sections as necessary without breaking
  the page. [drybjed]

- Support ``item.options`` YAML text block in nginx upstreams. [drybjed]

- Move the ``root`` parameter to its own macro block and use it separately in
  HTTP and HTTPS server configuration section. This is needed for the HTTP
  configuration to serve files from a sane directory. [drybjed]

- Add support for Automated Certificate Management Environment (ACME)
  challenges. [drybjed]

- Don't print ``root`` option in the ``nginx`` server configuration if it's set
  as ``False`` (shouldn't be used, but it is checked just in case). [drybjed]

- Make sure that ``root`` and ACME configuration is not added two times when
  HTTP listen configuration is disabled. [drybjed]

- Clean up default variables related to ``debops.pki`` role, add variables that
  configure client CA and trusted CA for OCSP stapling in ``default.conf``
  template. [drybjed]

- Update OCSP stapling support. Two new default variables are added to better
  control OCSP configuration.

  The ``debops.nginx`` role will now use the trusted certificate chain from
  ``debops.pki`` by default. The caveat is, if at least a Root CA certificate
  is not provided in the ``debops.pki`` realm, ``nginx`` configuration will be
  invalid and restarting the webserver will fail. Right now you can avoid this
  by setting ``nginx_ocsp_verify`` variable to ``False`` if needed, there's
  also per-vhost ``item.ocsp_verify`` rquivalent.

  The internal ``debops.pki`` certificates should work out of the box.
  [drybjed]

- Support autodetection of PKI realms.

  The ``debops.nginx`` role will check if any of the server names for a given
  vhost have corresponding PKI realms. If a corresponding realm is found, its
  certificates will be used for that server, unless overriden by
  ``item.pki_realm`` parameter. If a corresponding realm is not found, that
  vhost will use the default PKI realm. [drybjed]

- Support `HSTS preloading <https://hstspreload.appspot.com/>`_ in ``nginx``
  server configuration. [drybjed]

- Reorganize server, upstream and map default variables.

  The ``nginx_servers`` variable has been split into

  - ``nginx_default_servers`` (default welcome page of the server);
  - ``nginx_internal_servers`` (``localhost`` and ``acme`` servers);
  - ``nginx_dependent_servers`` (webservers managed by other roles);

  Similar split has been done with ``nginx_upstreams`` and ``nginx_maps``
  variables. The order of the variables is designed so that if you configure an
  ``nginx`` website in the ``nginx_servers`` list (the same as up until now),
  the first one on the list will be marked as default, easily overriding the
  welcome page defined in ``nginx_default_servers``.

  The ``nginx_server_default`` dictionary variable has been renamed to
  ``nginx_server_welcome`` and now defines the default welcome page. You might
  need to update the Ansible inventory.

  The ``nginx_upstream_php5`` dictionary variable has been renamed to
  ``nginx_upstream_php5_www_data`` to be more specific. It defines an upstream
  for the default ``www-data`` PHP5 pool used by various services packaged in
  Debian. You might need to update the Ansible inventory. [drybjed]

- Fix bare variables due to deprecation. [drybjed]

- Remove ``nginx_default_root`` variable. A default root directory is managed
  dynamically in the ``default.conf`` server template. [drybjed]

- The default "welcome page" ``nginx`` server will use the ``welcome`` server
  name, so that role users can use empty name (``[]``) parameter in Ansible
  inventory without the configuration being constantly overwritten in an
  idempotency loop. The welcome page automatically gets its own web root
  directory ``/srv/www/sites/welcome/public/``, and shouldn't conflict with the
  default root.

  This shouldn't affect the effect of ``default_server`` option. The
  ``welcome`` "hostname" most likely won't ever be present in the DNS and
  nothing should directly point to it. [drybjed]

- Create the specified ``nginx`` maps and upstreams even when ``nginx_maps``
  and ``nginx_upstreams`` lists are empty. [drybjed]

- Provide a clean and simple welcome page which is displayed by default if
  specified server does not exist. The welcome page will be generated only if
  ``index.html`` is not present in the webroot directory. [drybjed]

- Add a hook script in ``/etc/pki/hooks/`` directory. When certificates used by
  ``nginx`` are changed, it will reload the webserver to enable them. [drybjed]

v0.1.4
------

*Released: 2015-09-24*

- Add an option to set ``client_max_body_size`` globally for entire nginx
  server, by setting ``nginx_http_client_max_body_size`` variable in Ansible
  inventory. [drybjed]

- Add DebOps pre-tasks and post-tasks hooks. [drybjed]

- Allow to override ``nginx_passenger_root`` and ``nginx_passenger_ruby``
  variables using Ansible inventory variables. [drybjed]

- Make sure that lists of IP addresses used in the templates are unique, this
  is required to eliminate duplicate IPv6 addresses in case of VLAN use.
  [drybjed]

- Add an option to set custom index files in nginx configuration. [drybjed]

- Add ``item.redirect_to`` key which lets you redirect connection from all
  server names listed in ``item.name`` to a specific server name (inverse
  ``item.redirect_from``). [drybjed]

- Move most of the http options from ``/etc/nginx/nginx.conf`` template to
  ``nginx_http_options`` YAML text block for easy modification if necessary.
  [drybjed]

- Add support for ``nginx`` package from upstream (http://nginx.org/), thanks
  to Pedro Luis López Sánchez. [drybjed]

- By default access to hidden files is blocked in ``nginx`` servers,
  ``item.deny_hidden`` key allows you to disable that. [drybjed]

- Filter out ``link-local`` IPv6 addresses from list of addresses that can
  access the ``/nginx_status`` page. [drybjed]

- Change how list of nameservers is gathered from ``/etc/resolv.conf`` to fix
  an issue with ``sed`` in shell command. [drybjed]

- Use ``fastcgi_params`` instead of ``fastcgi.conf`` as the FastCGI parameters
  file when ``nginx.org`` flavor is installed, because it is not provided by
  the non-Debian packages. On ``passenger`` and ``nginx.org`` flavors, missing
  ``SCRIPT_FILENAME`` parameter will be added directly in nginx server
  configuration. [drybjed]

- Update userdir support to be more configurable. [drybjed]

- Use all available nameservers as OCSP resolvers instead of just the first
  one. User can also override the list of OCSP resolvers if needed. [drybjed]

- Fix an issue where ``nginx`` used SSL configuration when support for it was
  disabled in ``debops.pki`` (or it was not present). [drybjed]

- Rearrange parts of the configuration templates and add more Jinja blocks to
  be able to remove ``index`` and ``root`` directives programatically.
  [drybjed]

- Add ``proxy`` nginx server template. [drybjed]

- Add ``item.ssl_crt``, ``item.ssl_key``, and ``item.ssl_dhparam`` to override
  pki nginx configuration per site. [patrickheeney]

- Added ``enabled`` to entries in ``item.location_list``. [scibi]

v0.1.3
------

*Released: 2015-03-27*

- Be more explicit while getting the list of nameservers from
  ``/etc/resolv.conf`` [drybjed]

- Add support for custom configuration templates using text blocks. [drybjed]

v0.1.2
------

*Released: 2015-03-13*

- Add a way to redirect HTTP site to HTTPS conditionally, with configuration
  being set in a separate file. [drybjed]

- Switch to older version of ``/etc/nginx/fastcgi_params`` when Phusion
  Passenger is enabled, because Passenger packages do not provide
  ``/etc/nginx/fastcgi.conf`` configuration file at the moment. [drybjed]

v0.1.1
------

*Released: 2015-03-12*

- Add support for `Phusion Passenger`_ nginx flavor, using external APT
  packages. [rchady, drybjed]

- Automatically enable or disable SSL support in ``nginx`` depending on the
  presence or absence of ``debops.pki`` local Ansible facts. [drybjed]

.. _Phusion Passenger: https://www.phusionpassenger.com/

v0.1.0
------

*Released: 2015-02-11*

- First release, add CHANGES.rst [drybjed]

