Skip to content

Commit 97d74a2

Browse files
alessfgalessfg
authored
feat: Add support for the NGINX ngx_mgmt_module module. (#562)
1 parent ccf373a commit 97d74a2

File tree

9 files changed

+227
-1
lines changed

9 files changed

+227
-1
lines changed

‎.github/workflows/molecule.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ jobs:
4949
- complete
5050
- complete_plus
5151
- default
52+
- entitlement_plus
5253
- push_config
5354
- reverse_proxy
5455
- stub_status

‎CHANGELOG.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ FEATURES:
66

77
- Add validation tasks to check the Ansible version, the Jinja2 version, and whether the required Ansible collections for this role are installed.
88
- Bump the Ansible `community.general` collection to `9.2.0`, `community.crypto` collection to `2.21.1` and `community.docker` collection to `3.11.0`.
9-
- Add templating support for the `ngx_http_gzip_static_module` and `ngx_stream_map_module` NGINX modules.
9+
- Add templating support for the `ngx_mgmt_module`, `ngx_http_gzip_static_module`, and `ngx_stream_map_module` NGINX modules.
1010

1111
BUG FIXES:
1212

‎defaults/main/template.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,25 @@ nginx_config_main_template:
6666
worker_connections: 1024 # Number
6767
# include: # String or a list of strings
6868
# - /etc/nginx/modules.conf
69+
mgmt: # Configure NGINX management directives. Only required when using NGINX Plus >R33.
70+
enforce_initial_report: true # Boolean
71+
license_token: license.jwt
72+
# proxy: 123.456.789:8353
73+
# proxy_username: username
74+
# proxy_password: password
75+
resolver:
76+
address: 127.0.0.1 # Required -- String or a list of strings
77+
valid: 30s
78+
ipv4: true # Boolean
79+
ipv6: true # Boolean
80+
status_zone: mgmt_mem_zone
81+
# ssl_crl: /path/to/file
82+
# ssl_trusted_certificate: /path/to/file
83+
ssl_verify: false # Boolean
84+
state_path: /var/lib/nginx/state
85+
usage_report:
86+
endpoint: product.connect.nginx.com
87+
interval: 30m
6988
http:
7089
include: # String or a list of strings
7190
- /etc/nginx/mime.types

‎molecule/entitlement_plus/converge.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
---
2+
- name: Converge
3+
hosts: all
4+
tasks:
5+
- name: Configure NGINX
6+
ansible.builtin.include_role:
7+
name: ansible-role-nginx-config
8+
vars:
9+
nginx_config_debug_output: true
10+
11+
nginx_config_main_template_enable: true
12+
nginx_config_main_template:
13+
template_file: nginx.conf.j2
14+
deployment_location: /etc/nginx/nginx.conf
15+
config:
16+
main:
17+
user: nginx
18+
worker_processes: auto
19+
error_log:
20+
- file: /var/log/nginx/error.log
21+
level: notice
22+
pid: /var/run/nginx.pid
23+
worker_rlimit_nofile: 2048
24+
events:
25+
worker_connections: 1024
26+
mgmt:
27+
enforce_initial_report: true
28+
license_token: license.jwt
29+
# proxy:
30+
# proxy_username:
31+
# proxy_password:
32+
resolver:
33+
address: 127.0.0.1
34+
valid: 30s
35+
ipv4: true
36+
ipv6: true
37+
status_zone: mgmt_mem_zone
38+
# ssl_crl: /path/to/file
39+
# ssl_trusted_certificate: /path/to/file
40+
ssl_verify: false
41+
state_path: /var/lib/nginx/state
42+
usage_report:
43+
endpoint: product.connect.nginx.com
44+
interval: 30m
45+
http:
46+
include:
47+
- /etc/nginx/conf.d/*.conf

‎molecule/entitlement_plus/molecule.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
---
2+
dependency:
3+
name: galaxy
4+
options:
5+
role-file: molecule/common/requirements/oss_requirements.yml
6+
driver:
7+
name: docker
8+
lint: |
9+
set -e
10+
ansible-lint --force-color
11+
platforms:
12+
- name: alpine-3.19
13+
image: alpine:3.19
14+
dockerfile: ../common/Dockerfile.j2
15+
privileged: true
16+
cgroupns_mode: host
17+
volumes:
18+
- /sys/fs/cgroup:/sys/fs/cgroup:rw
19+
command: /sbin/init
20+
- name: debian-bullseye
21+
image: debian:bullseye-slim
22+
dockerfile: ../common/Dockerfile.j2
23+
privileged: true
24+
cgroupns_mode: host
25+
volumes:
26+
- /sys/fs/cgroup:/sys/fs/cgroup:rw
27+
command: /sbin/init
28+
- name: rhel-9
29+
image: redhat/ubi9:9.4
30+
dockerfile: ../common/Dockerfile.j2
31+
privileged: true
32+
cgroupns_mode: host
33+
volumes:
34+
- /sys/fs/cgroup:/sys/fs/cgroup:rw
35+
command: /usr/sbin/init
36+
- name: ubuntu-jammy
37+
image: ubuntu:jammy
38+
dockerfile: ../common/Dockerfile.j2
39+
privileged: true
40+
cgroupns_mode: host
41+
volumes:
42+
- /sys/fs/cgroup:/sys/fs/cgroup:rw
43+
command: /sbin/init
44+
provisioner:
45+
name: ansible
46+
playbooks:
47+
prepare: prepare.yml
48+
converge: converge.yml
49+
verify: verify.yml
50+
env:
51+
ANSIBLE_ROLES_PATH: ~/.cache/molecule/ansible-role-nginx-config/${MOLECULE_SCENARIO_NAME}/roles:${MOLECULE_PROJECT_DIRECTORY}/..:~/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles

‎molecule/entitlement_plus/prepare.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
- name: Prepare
3+
hosts: localhost
4+
gather_facts: false
5+
tasks:
6+
- name: Create ephemeral license certificate file from b64 decoded env var
7+
ansible.builtin.copy:
8+
content: "{{ lookup('env', 'NGINX_CRT') | b64decode }}"
9+
dest: ../common/files/license/nginx-repo.crt
10+
force: false
11+
mode: "0444"
12+
13+
- name: Create ephemeral license key file from b64 decoded env var
14+
ansible.builtin.copy:
15+
content: "{{ lookup('env', 'NGINX_KEY') | b64decode }}"
16+
dest: ../common/files/license/nginx-repo.key
17+
force: false
18+
mode: "0444"
19+
20+
- name: Create ephemeral license JWT file from b64 encoded env var
21+
ansible.builtin.copy:
22+
content: "{{ lookup('env', 'NGINX_JWT') }}"
23+
dest: ../common/files/license/license.jwt
24+
force: false
25+
mode: "0444"
26+
27+
- name: Install NGINX Plus
28+
hosts: all
29+
tasks:
30+
- name: Install NGINX Plus
31+
ansible.builtin.include_role:
32+
name: nginxinc.nginx
33+
vars:
34+
nginx_type: plus
35+
nginx_license:
36+
certificate: ../common/files/license/nginx-repo.crt
37+
key: ../common/files/license/nginx-repo.key
38+
jwt: ../common/files/license/license.jwt
39+
nginx_remove_license: false

‎molecule/entitlement_plus/verify.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
- name: Verify
3+
hosts: all
4+
tasks:
5+
- name: Check if NGINX Plus is installed
6+
ansible.builtin.package:
7+
name: nginx-plus
8+
state: present
9+
check_mode: true
10+
register: install
11+
failed_when: (install is changed) or (install is failed)
12+
13+
- name: Check if NGINX service is running
14+
ansible.builtin.service:
15+
name: nginx
16+
state: started
17+
enabled: true
18+
check_mode: true
19+
register: service
20+
failed_when: (service is changed) or (service is failed)

‎templates/core.j2‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,3 +116,43 @@ worker_aio_requests {{ events['worker_aio_requests'] }};
116116
worker_connections {{ events['worker_connections'] }};
117117
{% endif %}
118118
{% endmacro %}
119+
120+
{% macro mgmt(mgmt) %}
121+
{% if mgmt['enforce_initial_report'] is defined and mgmt['enforce_initial_report'] is boolean %}
122+
enforce_initial_report {{ mgmt['enforce_initial_report'] | ternary('on', 'off') }};
123+
{% endif %}
124+
{% if mgmt['license_token'] is defined %}
125+
license_token {{ mgmt['license_token'] }};
126+
{% endif %}
127+
{% if mgmt['proxy'] is defined %}
128+
proxy {{ mgmt['proxy'] }};
129+
{% endif %}
130+
{% if mgmt['proxy_username'] is defined %}
131+
proxy_username {{ mgmt['proxy_username'] }};
132+
{% endif %}
133+
{% if mgmt['proxy_password'] is defined %}
134+
proxy_password {{ mgmt['proxy_password'] }};
135+
{% endif %}
136+
{% if mgmt['resolver'] is defined %}
137+
resolver {{ mgmt['resolver']['address'] if mgmt['resolver']['address'] is string else mgmt['resolver']['address'] | join(' ') -}}
138+
{{- (' valid=' + mgmt['resolver']['valid'] | string) if mgmt['resolver']['valid'] is defined -}}
139+
{{- (' ipv4=' + mgmt['resolver']['ipv4'] | ternary('on', 'off')) if mgmt['resolver']['ipv4'] is defined and mgmt['resolver']['ipv4'] is boolean -}}
140+
{{- (' ipv6=' + mgmt['resolver']['ipv6'] | ternary('on', 'off')) if mgmt['resolver']['ipv6'] is defined and mgmt['resolver']['ipv6'] is boolean -}}
141+
{{- (' status_zone=' + mgmt['resolver']['status_zone'] | string) if mgmt['resolver']['status_zone'] is defined }};
142+
{% endif %}
143+
{% if mgmt['ssl_crl'] is defined %}
144+
ssl_crl {{ mgmt['ssl_crl'] }};
145+
{% endif %}
146+
{% if mgmt['ssl_trusted_certificate'] is defined %}
147+
ssl_trusted_certificate {{ mgmt['ssl_trusted_certificate'] }};
148+
{% endif %}
149+
{% if mgmt['ssl_verify'] is defined and mgmt['ssl_verify'] is boolean %}
150+
ssl_verify {{ mgmt['ssl_verify'] | ternary('on', 'off') }};
151+
{% endif %}
152+
{% if mgmt['state_path'] is defined %}
153+
state_path {{ mgmt['state_path'] }};
154+
{% endif %}
155+
{% if mgmt['usage_report'] is defined %}
156+
usage_report{{ ' endpoint=' + mgmt['usage_report']['endpoint'] if mgmt['usage_report']['endpoint'] is defined }}{{ (' interval=' + mgmt['usage_report']['interval'] | string) if mgmt['usage_report']['interval'] is defined }};
157+
{% endif %}
158+
{% endmacro %}

‎templates/nginx.conf.j2‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,15 @@ events {
2222
{% endif %}
2323
}
2424

25+
{% if nginx_config_main_template['config']['mgmt'] is defined %}
26+
mgmt {
27+
{% from 'core.j2' import mgmt with context %}
28+
{% filter indent(4) %}
29+
{{ mgmt(nginx_config_main_template['config']['mgmt']) }}
30+
{%- endfilter %}
31+
}
32+
{% endif %}
33+
2534
{% if nginx_config_main_template['config']['http'] is defined %}
2635
http {
2736
{% if nginx_config_main_template['config']['http']['include'] is defined and nginx_config_main_template['config']['http']['include'] is not mapping %}

0 commit comments

Comments
 (0)