Update to roots/trellis@e140c05 (fix #17)

CHANGELOG.md

@@ -1,4 +1,15 @@
 ### HEAD
+* Verify `wp-cli.phar` checksum ([#996](https://github.com/roots/trellis/pull/996))
+* Enable `fastcgi_cache_background_update` by default ([#962](https://github.com/roots/trellis/pull/962))
+* Bump Ansible `version_tested_max` to 2.5.3 ([#981](https://github.com/roots/trellis/pull/981))
+* deploy.sh: Return non-zero exit code when misuse  ([#990](https://github.com/roots/trellis/pull/990))
+* Add CSP `frame-ancestors`, make `X-Frame-Options` conditional ([#977](https://github.com/roots/trellis/pull/977))
+* Common: Install `git` instead of `git-core`  ([#989](https://github.com/roots/trellis/pull/989))
+* Add `xdebug.remote_autostart` to simplify xdebug sessions  ([#985](https://github.com/roots/trellis/pull/985))
+* Enable nginx to start on boot ([#980](https://github.com/roots/trellis/pull/980))
+* Update geerlingguy.ntp 1.5.2->1.6.0 ([#984](https://github.com/roots/trellis/pull/984))
+* Update geerlingguy.composer 1.6.1->1.7.0 ([#983](https://github.com/roots/trellis/pull/983))
+* Update wp-cli to 1.5.1 ([#982](https://github.com/roots/trellis/pull/982))
 * Support git url format `ssh://user@host/path/to/repo` ([#975](https://github.com/roots/trellis/pull/975))
 * Fix path to h5bp/mime.types ([#974](https://github.com/roots/trellis/pull/974))
 * Vendor h5bp Nginx configs ([#973](https://github.com/roots/trellis/pull/973))

bin/deploy.sh

@@ -21,7 +21,7 @@ Examples:
 "
 }
 
-[[ $# -lt 2 ]] && { show_usage; exit 0; }
+[[ $# -lt 2 ]] && { show_usage; exit 127; }
 
 for arg
 do
@@ -39,7 +39,7 @@ if [[ ! -e $HOSTS_FILE ]]; then
   echo
   echo "Available environments:"
   ( IFS=$'\n'; echo "${ENVIRONMENTS[*]}" )
-  exit 0
+  exit 1
 fi
 
 $DEPLOY_CMD

deploy-hooks/build-before.yml

@@ -19,7 +19,7 @@
 #     chdir: "{{ deploy_helper.new_release_path }}/web/app/themes/sage"
 #
 # - name: Compile assets for production
-#   command: yarn run build:production
+#   command: yarn build:production
 #   connection: local
 #   args:
 #     chdir: "{{ project_local_path }}/web/app/themes/sage"

deploy.yml

@@ -28,6 +28,6 @@
           Ensure that your site's `repo` variable is defined in `group_vars/{{ env }}/wordpress_sites.yml` and uses the SSH format (example: [email protected]:roots/bedrock.git)
           More info:
           > https://roots.io/trellis/docs/deploys/
-      when: project.repo is not defined or not project.repo | match("^ssh://.+@.+|.+@.+:.+")
+      when: project.repo is not defined or project.repo is not match("^ssh://.+@.+|.+@.+:.+")
   roles:
     - deploy

group_vars/all/logrotate.yml

@@ -1,4 +1,4 @@
-# Documentation: https://galaxy.ansible.com/list#/roles/1117
+# Documentation: https://github.com/nickhammond/ansible-logrotate
 logrotate_scripts:
   - name: wordpress-sites
     path: "{{ www_root }}/**/logs/*.log"

group_vars/development/php.yml

@@ -7,3 +7,4 @@ php_opcache_enable: 0
 
 xdebug_remote_enable: 1
 xdebug_remote_connect_back: 1
+xdebug_remote_autostart: 1

lib/trellis/plugins/vars/version.py

@@ -5,16 +5,21 @@
 from ansible import __version__
 from ansible.errors import AnsibleError
 from distutils.version import LooseVersion
-from operator import ge, gt
+from operator import eq, ge, gt
+from sys import version_info
 
 try:
     from __main__ import display
 except ImportError:
     from ansible.utils.display import Display
     display = Display()
 
+if version_info[0] > 2:
+    raise AnsibleError(('Trellis does not yet support Python {}.{}.{}. \n'
+        'Please use Python 2.7.').format(version_info[0], version_info[1], version_info[2]))
+
 version_requirement = '2.4.0.0'
-version_tested_max = '2.4.3.0'
+version_tested_max = '2.5.3'
 
 if not ge(LooseVersion(__version__), LooseVersion(version_requirement)):
     raise AnsibleError(('Trellis no longer supports Ansible {}.\n'
@@ -24,6 +29,10 @@
             u'compatability with Ansible {} -> {}. It is advisable to check for Trellis updates or '
             u'downgrade your Ansible version.'.format(__version__, version_requirement, version_tested_max))
 
+if eq(LooseVersion(__version__), LooseVersion('2.5.0')):
+    display.warning(u'You Ansible version is {}. Consider upgrading your Ansible version to avoid '
+            u'erroneous warnings such as `Removed restricted key from module data...`'.format(__version__))
+
 # Import BaseVarsPlugin after Ansible version check.
 # Otherwise import error for Ansible versions older than 2.4 would prevent display of version check message.
 from ansible.plugins.vars import BaseVarsPlugin

lib/trellis/utils/output.py

@@ -29,7 +29,7 @@ def system(vagrant_version=None):
         else:
             change = re.search(r'^\*\s?(\[BREAKING\])?([^\(\n\[]+)', str, re.M|re.I)
             if change is not None:
-                changelog_msg = '\n  Trellis at "{0}"'.format(change.group(2).strip())
+                changelog_msg = '\n  Trellis version (per changelog): "{0}"'.format(change.group(2).strip())
 
     # Vagrant info, if available
     vagrant = ' Vagrant {0};'.format(vagrant_version) if vagrant_version else ''

requirements.yml

@@ -1,10 +1,10 @@
 - name: composer
   src: geerlingguy.composer
-  version: 1.6.1
+  version: 1.7.0
 
 - name: ntp
   src: geerlingguy.ntp
-  version: 1.5.2
+  version: 1.6.0
 
 - name: logrotate
   src: nickhammond.logrotate

roles/common/defaults/main.yml

@@ -26,14 +26,14 @@ apt_packages_default:
   build-essential: "{{ apt_package_state }}"
   python-mysqldb: "{{ apt_package_state }}"
   curl: "{{ apt_package_state }}"
-  git-core: "{{ apt_package_state }}"
+  git: "{{ apt_package_state }}"
   dbus: "{{ apt_package_state }}"
   libnss-myhostname: "{{ apt_package_state }}"
 
 apt_packages_custom: {}
 apt_packages: "{{ apt_packages_default | combine(apt_packages_custom) }}"
 
-openssh_6_8_plus: "{{ (lookup('pipe', 'ssh -V 2>&1')) | regex_replace('(.*OpenSSH_([\\d\\.]*).*)', '\\2') | version_compare('6.8', '>=') }}"
+openssh_6_8_plus: "{{ (lookup('pipe', 'ssh -V 2>&1')) | regex_replace('(.*OpenSSH_([\\d\\.]*).*)', '\\2') is version_compare('6.8', '>=') }}"
 overlapping_ciphers: "[{% for cipher in (sshd_ciphers_default + sshd_ciphers_extra) if cipher in ssh_client_ciphers %}'{{ cipher }}',{% endfor %}]"
 overlapping_kex: "[{% for kex in (sshd_kex_algorithms_default + sshd_kex_algorithms_extra) if kex in ssh_client_kex %}'{{ kex }}',{% endfor %}]"
 overlapping_macs: "[{% for mac in (sshd_macs_default + sshd_macs_extra) if mac in ssh_client_macs %}'{{ mac }}',{% endfor %}]"

roles/common/tasks/main.yml

@@ -78,8 +78,7 @@
       Development via Vagrant: `vagrant destroy && vagrant up`
 
       Staging/Production: Create a new server with Ubuntu 16.04 and provision
-  when: ansible_distribution_release == 'trusty'
-  run_once: true
+  when: ansible_distribution_release != 'xenial'
 
 - name: Check whether passlib is needed
   fail:

roles/connection/defaults/main.yml

@@ -1,5 +1,5 @@
 ansible_host_known: "{{ lookup('pipe', 'ssh-keygen -F ' + ansible_host + ' > /dev/null 2>&1 && echo True || echo False') }}"
 ssh_config_host: "{{ lookup('pipe', 'ssh -G ' + ansible_host + ' 2>/dev/null | grep \"^hostname\" ||:') | regex_replace('^hostname ([^\\s]+)', '\\1') }}"
 ssh_config_host_known: "{{ lookup('pipe', 'ssh-keygen -F ' + ssh_config_host + ' > /dev/null 2>&1 && echo True || echo False') }}"
-openssh_6_5_plus: "{{ (lookup('pipe', 'ssh -V 2>&1')) | regex_replace('(.*OpenSSH_([\\d\\.]*).*)', '\\2') | version_compare('6.5', '>=') }}"
+openssh_6_5_plus: "{{ (lookup('pipe', 'ssh -V 2>&1')) | regex_replace('(.*OpenSSH_([\\d\\.]*).*)', '\\2') is version_compare('6.5', '>=') }}"
 host_key_algorithms: "{{ openssh_6_5_plus | ternary('[email protected],[email protected],ssh-ed25519,ssh-rsa', '[email protected],ssh-rsa') }}"

roles/connection/tasks/main.yml

@@ -60,7 +60,7 @@
     debug:
       msg: |
         Note: Ansible will attempt connections as user = {{ ansible_user }}
-        {% if not preferred_host_key_algorithms | skipped %}
+        {% if preferred_host_key_algorithms is not skipped %}
 
         Note: The host `{{ ansible_host }}` was not detected in known_hosts
         so Trellis prompted the host to offer a key type that will work with

roles/deploy/hooks/finalize-before.yml

@@ -10,7 +10,7 @@
     chdir: "{{ deploy_helper.new_release_path }}"
   register: wp_installed
   changed_when: false
-  failed_when: wp_installed.stderr != ""
+  failed_when: wp_installed.stderr | default("") != "" or wp_installed.rc > 1
 
 - name: Get WP theme template and stylesheet roots
   shell: >
@@ -23,7 +23,7 @@
     chdir: "{{ deploy_helper.current_path }}"
   register: wp_template_root
   changed_when: false
-  failed_when: not wp_template_root.stderr | default('') | match("(|.*Could not get '" + item + "' option\. Does it exist\?)")
+  failed_when: wp_template_root.stderr | default('') is not match("(|.*Could not get '" + item + "' option\. Does it exist\?)")
   when:
     - wp_installed.rc == 0
     - project.update_wp_theme_paths | default(update_wp_theme_paths | default(true)) | bool

roles/deploy/tasks/update.yml

@@ -49,7 +49,7 @@
       More info:
       > https://roots.io/trellis/docs/deploys/#ssh-keys
       > https://roots.io/trellis/docs/ssh-keys/#cloning-remote-repo-using-ssh-agent-forwarding
-  when: git_clone | failed
+  when: git_clone is failed
 
 - include_tasks: "{{ include_path }}"
   with_items: "{{ deploy_update_after | default([]) }}"

roles/letsencrypt/defaults/main.yml

@@ -1,7 +1,7 @@
 sites_using_letsencrypt: "[{% for name, site in wordpress_sites.iteritems() if site.ssl.enabled and site.ssl.provider | default('manual') == 'letsencrypt' %}'{{ name }}',{% endfor %}]"
 site_uses_letsencrypt: ssl_enabled and item.value.ssl.provider | default('manual') == 'letsencrypt'
 missing_hosts: "{{ site_hosts | difference((current_hosts.results | selectattr('item.key', 'equalto', item.key) | selectattr('stdout_lines', 'defined') | sum(attribute='stdout_lines', start=[]) | map('trim') | list | join(' ')).split(' ')) }}"
-letsencrypt_cert_ids: "{ {% for item in (generate_cert_ids | default({'results':[{'skipped':True}]})).results if not item | skipped %}'{{ item.item.key }}':'{{ item.stdout }}', {% endfor %} }"
+letsencrypt_cert_ids: "{ {% for item in (generate_cert_ids | default({'results':[{'skipped':True}]})).results if item is not skipped %}'{{ item.item.key }}':'{{ item.stdout }}', {% endfor %} }"
 
 acme_tiny_repo: 'https://github.com/diafygi/acme-tiny.git'
 acme_tiny_commit: '4ed13950c0a9cf61f1ca81ff1874cde1cf48ab32'

roles/letsencrypt/tasks/nginx.yml

@@ -36,7 +36,7 @@
   notify: disable temporary challenge sites
 
 - import_tasks: "{{ playbook_dir }}/roles/common/tasks/reload_nginx.yml"
-  when: challenge_site_confs | changed or challenge_sites_enabled | changed
+  when: challenge_site_confs is changed or challenge_sites_enabled is changed
 
 - name: Create test Acme Challenge file
   shell: touch {{ acme_tiny_challenges_directory }}/ping.txt
@@ -60,5 +60,5 @@
       Make sure that a valid DNS record exists for {{ item.failed_hosts | join(', ') }} and that they point to this server's IP.
       If you don't want these domains in your SSL certificate, then remove them from `site_hosts`.
       See https://roots.io/trellis/docs/ssl for more details.
-  when: not item | skipped and letsencrypt_test_challenges | failed
+  when: item is not skipped and item is failed
   with_items: "{{ letsencrypt_test_challenges.results }}"

roles/nginx/tasks/main.yml

@@ -43,3 +43,10 @@
     path: "{{ nginx_path }}/sites-enabled/default"
     state: absent
   notify: reload nginx
+
+- name: Enable Nginx to start on boot
+  service:
+    name: nginx
+    enabled: yes
+    state: started
+    use: service

roles/nginx/templates/h5bp/directive-only/extra-security.conf

@@ -1,6 +1,6 @@
 # The X-Frame-Options header indicates whether a browser should be allowed
 # to render a page within a frame or iframe.
-add_header X-Frame-Options SAMEORIGIN always;
+# add_header X-Frame-Options SAMEORIGIN always;
 
 # MIME type sniffing security protection
 #	There are very few edge cases where you wouldn't want this enabled.

roles/users/tasks/main.yml

@@ -67,5 +67,5 @@
   tags: [connection-tests, sshd]
 
 - import_tasks: connection-warnings.yml
-  when: not admin_user_status | skipped and admin_user_status.rc != 0
+  when: admin_user_status is not skipped and admin_user_status.rc != 0
   tags: [connection-tests, sshd]

roles/wordpress-install/tasks/main.yml

@@ -85,7 +85,7 @@
   args:
     chdir: "{{ www_root }}/{{ item.item.key }}/{{ item.item.value.current_path | default('current') }}/"
   with_items: "{{ wp_install.results }}"
-  when: item | changed
+  when: item is changed
 
 - name: Update WP Multisite Home URL
   command: wp option update home {{ site_env.wp_home }} --allow-root

roles/wordpress-setup/defaults/main.yml

@@ -30,6 +30,7 @@ hsts_preload: "{{ item.value.ssl.hsts_preload | default(nginx_hsts_preload) | te
 nginx_cache_duration: 30s
 nginx_skip_cache_uri: /wp-admin/|/wp-json/|/xmlrpc.php|wp-.*.php|/feed/|index.php|sitemap(_index)?.xml
 nginx_skip_cache_cookie: comment_author|wordpress_[a-f0-9]+|wp-postpass|wordpress_no_cache|wordpress_logged_in
+nginx_cache_background_update: "on"
 
 # Nginx includes
 nginx_includes_templates_path: nginx-includes

roles/wordpress-setup/templates/wordpress-site.conf.j2

@@ -160,6 +160,20 @@ server {
 
   {% endblock %}
 
+  {% block embed_security -%}
+  {% if item.value.nginx_embed_security | default(nginx_embed_security | default(true)) -%}
+  add_header Content-Security-Policy "frame-ancestors 'self'" always;
+
+  # Conditional X-Frame-Options until https://core.trac.wordpress.org/ticket/40020 is resolved
+  set $x_frame_options SAMEORIGIN;
+  if ($arg_customize_changeset_uuid) {
+    set $x_frame_options "";
+  }
+  add_header X-Frame-Options $x_frame_options always;
+
+  {% endif -%}
+  {% endblock -%}
+
   {% block location_php -%}
   location ~ \.php$ {
     {% block location_php_basic -%}
@@ -174,6 +188,7 @@ server {
     fastcgi_cache_valid {{ item.value.cache.duration | default(nginx_cache_duration) }};
     fastcgi_cache_bypass $skip_cache;
     fastcgi_no_cache $skip_cache;
+    fastcgi_cache_background_update {{ item.value.cache.background_update | default(nginx_cache_background_update) }};
 
     {% endif -%}
     {% endblock -%}

roles/wp-cli/defaults/main.yml

@@ -1,4 +1,5 @@
-wp_cli_version: 1.5.0
+wp_cli_version: 1.5.1
+wp_cli_phar_checksum: "sha512:8dd68c98c6fa00e1acc5e036f9393c8b052937045b5232e4aa0eb4f15773908eae48760607bc853a4f951bd5ba69e5050337e5d9dcfa48df87a12cebb1de3432"
 wp_cli_bin_path: /usr/bin/wp
 wp_cli_phar_url: "https://github.com/wp-cli/wp-cli/releases/download/v{{ wp_cli_version }}/wp-cli-{{ wp_cli_version }}.phar"
 wp_cli_completion_url: "https://raw.githubusercontent.com/wp-cli/wp-cli/v{{ wp_cli_version }}/utils/wp-completion.bash"

roles/wp-cli/tasks/main.yml

@@ -3,6 +3,7 @@
   get_url:
     url: "{{ wp_cli_phar_url }}"
     dest: /tmp/wp-cli-{{ wp_cli_version }}.phar
+    checksum: "{{ wp_cli_phar_checksum }}"
 
 - name: Install WP-CLI
   command: rsync -c --chmod=0755 --info=name /tmp/wp-cli-{{ wp_cli_version }}.phar {{ wp_cli_bin_path }}

roles/xdebug-tunnel/tasks/main.yml

@@ -20,9 +20,9 @@
         SSH tunnel already closed!
       {% endif %}
       {{ xdebug_tunnel.stderr | default('Unknown error in handling Xdebug SSH tunnel') }}
-  when: xdebug_tunnel | failed or 'already' in xdebug_tunnel.stderr | default('')
+  when: xdebug_tunnel is failed or 'already' in xdebug_tunnel.stderr | default('')
 
 - name: Announce Xdebug SSH tunnel status
   debug:
     msg: SSH Tunnel was {{ xdebug_remote_enable | bool | ternary('created', 'closed') }}!
-  when: xdebug_tunnel | changed
+  when: xdebug_tunnel is changed

roles/xdebug/defaults/main.yml

@@ -3,6 +3,7 @@ php_xdebug_package: php-xdebug
 # XDebug Remote Debugging
 xdebug_remote_enable: 0
 xdebug_remote_connect_back: 0
+xdebug_remote_autostart: 0
 xdebug_remote_host: localhost
 xdebug_remote_port: 9000
 xdebug_remote_log: /tmp/xdebug.log

roles/xdebug/templates/xdebug.ini.j2

@@ -6,6 +6,7 @@ zend_extension=xdebug.so
 ; Remote Debugging
 xdebug.remote_enable={{ xdebug_remote_enable }}
 xdebug.remote_connect_back={{ xdebug_remote_connect_back }}
+xdebug.remote_autostart={{ xdebug_remote_autostart }}
 xdebug.remote_host={{ xdebug_remote_host }}
 xdebug.remote_port={{ xdebug_remote_port }}
 xdebug.remote_handler=dbgp

server.yml

@@ -17,7 +17,7 @@
     - name: Install Python 2.x
       raw: which python || sudo apt-get update && sudo apt-get install -qq -y python-simplejson
       register: python_check
-      changed_when: not python_check.stdout | search('/usr/bin/python')
+      changed_when: python_check.stdout is not search('/usr/bin/python')
 
 - name: WordPress Server - Install LEMP Stack with PHP 7.2 and MariaDB MySQL
   hosts: web:&{{ env }}

vagrant.default.yml

@@ -4,7 +4,7 @@ vagrant_cpus: 1
 vagrant_memory: 1024 # in MB
 vagrant_box: 'bento/ubuntu-16.04'
 vagrant_box_version: '>= 201801.02.0'
-vagrant_ansible_version: '2.4.3.0'
+vagrant_ansible_version: '2.5.3'
 vagrant_skip_galaxy: false
 
 vagrant_install_plugins: true