« Changelog History


xsrv v1.3.0 Release Notes

Release Date: 2021-06-08 // almost 3 years ago

  • ⬆️ Upgrade procedure:

    • 🚀 xsrv self-upgrade to upgrade the xsrv script to the latest release
    • 🚀 xsrv upgrade to upgrade roles in your playbook to the latest release
    • if you had defined custom netdata_http_checks, port them to the new netdata_http_checks/netdata_x509_checks syntax
    • 🚚 (optional/cleanup) xsrv edit-vault: remove all vault_ prefixes from encrypted host variables; xsrv edit-host: remove all variables that are just variable_name: {{ vault_variable_name }} references
    • (optional/cleanup) remove previous hardcoded/default netdata_modtime_checks and netdata_process_checks from your host variables
    • (optional) xsrv check to simulate and review changes
    • 🚀 xsrv deploy to apply changes

    ✂ Removed:

    • default playbook: remove hardcoded netdata_modtime_checks and netdata_process_checks (roles will automatically configure relevant checks)
    • default playbook/all roles: remove variable_name: {{ vault_variable_name }} indirections/references
    • monitoring/netdata: remove ability to configure netdata modules git clone URLs (netdata_*_git_url variables), always clone from upstream
    • monitoring/netdata: remove support for check_x509 parameter in netdata_httpchecks
    • 🔧 monitoring/rsyslog: remove hardcoded, service-specific configuration

    ➕ Added:

    • ➕ add graylog log analyzer role
    • ➕ add gotty role
    • monitoring/rsyslog: add ability forward logs to a remote syslog/graylog server over TCP/SSL/TLS (add [rsyslog_enable_forwarding, rsyslog_forward_to_hostname and rsyslog_forward_to_port](apt_unattended_upgrades_origins_patterns) variables)
    • jellyfin/common/apt: enable automatic upgrades for jellyfin by default (apt_unattended_upgrades_origins_patterns)
    • monitoring: support all httpcheck parameters in netdata_http_checks
    • monitoring/netdata: add netdata_x509_checks (list of x509 certificate checks, supports all x509check parameters)
    • rocketchat: allow disabling rocketchat/mongodb services (rocketchat_enable_service: yes/no)
    • ✅ xsrv: add xsrv edit-group subcommand (edit group variables - default group: all)
    • ✅ xsrv: add xsrv ls subcommand (list files in the playbooks directory - accepts a path)
    • ✅ xsrv: add xsrv edit-requirements subcommand (edit ansible collections/requirements)
    • 🔧 xsrv: add xsrv edit-cfg subcommand (edit ansible configuration/ansible.cfg)
    • 0️⃣ xsrv: add syntax highlighting to default text editor/pager (nano - requires manual installation of yaml syntax highlighting file), improve display
    • homepage: add favicon
    • 🔧 common: msmtp: make outgoing mail port configurable (msmtp_port, default 587)

    🔄 Changed:

    • gitea: enable API by default (gitea_enable_api)
    • ⬆️ gitea: upgrade gitea to 1.14.2
    • ⬆️ openldap: upgrade ldap-account-manager to 7.5
    • ⬆️ nextcloud: upgrade nextcloud to 21.0.2
    • ⚡️ rocketchat: update rocket.chat to 3.15.0
    • 📱 homepage: switch to a responsive grid layout
    • ⚠ monitoring: decrease logcount warning alarm sensitivity, warn when error rate >= 10/min
    • monitoring/all roles: let roles install their own syslog aggregation settings, if the nodiscc.xsrv.monitoring role is enabled.
    • monitoring/needrestart: by default, automatically restart services that require it after a security update (needrestart_autorestart_services: yes)
    • monitoring/netdata/default playbook: let roles install their own HTTP/x509/modtime/port checks under /etc/netdata/{python,go}.d/$module_name.conf.d/*.conf, if the nodiscc.xsrv.monitoring role is enabled
    • 👷 apache/common/mail: forward all local mail from www-data to root - allows root to receive webserver cron jobs output
    • apache/monitoring: disable aggregation of access logs to syslog by default, add variable allowing to enable it (apache_access_log_to_syslog)
    • 👷 common: cron: ensure only root can access cron job files and directories (CIS 5.1.2 - 5.1.7)
    • common: ssh: lower maximum concurrent unauthenticated connections to 60
    • 🔧 common/mail: don't overwrite /etc/aliases, ensure root mail is forwarded to the configured user (set to ansible_user by default)
    • ⚡️ docker: speed up role execution - dont't force APT cache update when not necessary
    • transmission: disable automatic backups of the downloads directory by default, add transmission_backup_downloads: yes/no variable allowing to enable it
    • 🔧 rocketchat/monitoring: disable HTTP check when rocketchat service is explicitly disabled in the configuration
    • mumble/checks: ensure that mumble_welcome_text is set
    • transmission/jellyfin: allow jellyfin to read/write transmission downloads directory
    • 👷 tools: add Pull Request template, speed up Gitlab CI test suite (prebuild an image with required tools)
    • ⚡️ update ansible tags
    • 📇 update roles metadata, remove coupling/dependencies between roles unless strictly required, make nodiscc.xsrv.common role mostly optional
    • 🔨 xsrv: cleanup/reorder/DRY/refactoring, make self-upgrade safer
    • 📚 doc: update documentation/formatting, fix manual backup command, fix ssh-copy-id instructions

    🛠 Fixed:

    • jellyfin: fix automatic samba share creation
    • 👉 common: fix linux_users creation when no authorized_ssh_keys/sudo_nopasswd_commands are defined
    • 🐧 common: users: allow creation of linux_users without a password (login to these user accounts will be denied, SSH login with authorized keys are still possible if the user is in the ssh group)
    • samba: fix error on LDAP domain creation
    • nextcloud: fix condition for dependency on postgresql role
    • ⬆️ nextcloud: fix allowed memory size exhausted during nextcloud upgrades
    • openldap: fix condition for dependency on apache role
    • 🔊 rsyslog: fix automatic aggregation fo fail2ban logs to syslog
    • rocketchat: fix automatic backups when the service is disabled
    • samba/rsnapshot/gitea: fix role when runing in 'check' mode, fix idempotence
    • 🚀 tools: fix release procedure/ansible-galaxy collection publication
    • xsrv: fix wrong inventory formatting after running xsrv init-host
    • ✂ remove unused/duplicate/leftover task files
    • 🛠 fix typos

    🔒 Security:

    • common: fail2ban: fix bantime for ssh jail (~49 days)

    Full changes since v1.2.2