|
|
|
@ -16,40 +16,40 @@
|
|
|
|
|
# We support various distros, with various versions of Python. Installing additional Python modules can be a hassle.
|
|
|
|
|
# As a workaround, we run `htpasswd` from an Apache container image.
|
|
|
|
|
- block:
|
|
|
|
|
- name: Ensure Apache Docker image is pulled for generating matrix-metrics-htpasswd from username/password (protecting /metrics/* URIs)
|
|
|
|
|
docker_image:
|
|
|
|
|
name: "{{ matrix_nginx_proxy_proxy_matrix_metrics_basic_auth_apache_container_image }}"
|
|
|
|
|
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
|
|
|
|
|
force_source: "{{ matrix_nginx_proxy_proxy_matrix_metrics_basic_auth_apache_container_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
|
|
|
|
|
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_nginx_proxy_proxy_matrix_metrics_basic_auth_apache_container_force_pull }}"
|
|
|
|
|
- name: Ensure Apache Docker image is pulled for generating matrix-metrics-htpasswd from username/password (protecting /metrics/* URIs)
|
|
|
|
|
docker_image:
|
|
|
|
|
name: "{{ matrix_nginx_proxy_proxy_matrix_metrics_basic_auth_apache_container_image }}"
|
|
|
|
|
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
|
|
|
|
|
force_source: "{{ matrix_nginx_proxy_proxy_matrix_metrics_basic_auth_apache_container_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
|
|
|
|
|
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_nginx_proxy_proxy_matrix_metrics_basic_auth_apache_container_force_pull }}"
|
|
|
|
|
|
|
|
|
|
# We store the password in a file and make the `htpasswd` tool read it from there,
|
|
|
|
|
# as opposed to passing it directly on stdin (which will expose it to other processes on the server).
|
|
|
|
|
- name: Store metrics password in a temporary file
|
|
|
|
|
copy:
|
|
|
|
|
content: "{{ matrix_nginx_proxy_proxy_matrix_metrics_basic_auth_password }}"
|
|
|
|
|
dest: "/tmp/matrix-nginx-proxy-metrics-password"
|
|
|
|
|
mode: 0400
|
|
|
|
|
owner: "{{ matrix_user_uid }}"
|
|
|
|
|
group: "{{ matrix_user_gid }}"
|
|
|
|
|
# We store the password in a file and make the `htpasswd` tool read it from there,
|
|
|
|
|
# as opposed to passing it directly on stdin (which will expose it to other processes on the server).
|
|
|
|
|
- name: Store metrics password in a temporary file
|
|
|
|
|
copy:
|
|
|
|
|
content: "{{ matrix_nginx_proxy_proxy_matrix_metrics_basic_auth_password }}"
|
|
|
|
|
dest: "/tmp/matrix-nginx-proxy-metrics-password"
|
|
|
|
|
mode: 0400
|
|
|
|
|
owner: "{{ matrix_user_uid }}"
|
|
|
|
|
group: "{{ matrix_user_gid }}"
|
|
|
|
|
|
|
|
|
|
- name: Generate matrix-metrics-htpasswd from username/password (protecting /metrics/* URIs)
|
|
|
|
|
command:
|
|
|
|
|
cmd: >-
|
|
|
|
|
{{ matrix_host_command_docker }} run
|
|
|
|
|
--rm
|
|
|
|
|
--user={{ matrix_user_uid }}:{{ matrix_user_gid }}
|
|
|
|
|
--cap-drop=ALL
|
|
|
|
|
--network=none
|
|
|
|
|
--mount type=bind,src={{ matrix_nginx_proxy_data_path }},dst=/data
|
|
|
|
|
--mount type=bind,src=/tmp/matrix-nginx-proxy-metrics-password,dst=/password,ro
|
|
|
|
|
--entrypoint=/bin/sh
|
|
|
|
|
{{ matrix_nginx_proxy_proxy_matrix_metrics_basic_auth_apache_container_image }}
|
|
|
|
|
-c
|
|
|
|
|
'cat /password | htpasswd -i -c /data/matrix-metrics-htpasswd {{ matrix_nginx_proxy_proxy_matrix_metrics_basic_auth_username }} && chmod 600 /data/matrix-metrics-htpasswd'
|
|
|
|
|
- name: Generate matrix-metrics-htpasswd from username/password (protecting /metrics/* URIs)
|
|
|
|
|
command:
|
|
|
|
|
cmd: >-
|
|
|
|
|
{{ matrix_host_command_docker }} run
|
|
|
|
|
--rm
|
|
|
|
|
--user={{ matrix_user_uid }}:{{ matrix_user_gid }}
|
|
|
|
|
--cap-drop=ALL
|
|
|
|
|
--network=none
|
|
|
|
|
--mount type=bind,src={{ matrix_nginx_proxy_data_path }},dst=/data
|
|
|
|
|
--mount type=bind,src=/tmp/matrix-nginx-proxy-metrics-password,dst=/password,ro
|
|
|
|
|
--entrypoint=/bin/sh
|
|
|
|
|
{{ matrix_nginx_proxy_proxy_matrix_metrics_basic_auth_apache_container_image }}
|
|
|
|
|
-c
|
|
|
|
|
'cat /password | htpasswd -i -c /data/matrix-metrics-htpasswd {{ matrix_nginx_proxy_proxy_matrix_metrics_basic_auth_username }} && chmod 600 /data/matrix-metrics-htpasswd'
|
|
|
|
|
|
|
|
|
|
- name: Delete temporary metrics password file
|
|
|
|
|
file:
|
|
|
|
|
path: /tmp/matrix-nginx-proxy-metrics-password
|
|
|
|
|
state: absent
|
|
|
|
|
- name: Delete temporary metrics password file
|
|
|
|
|
file:
|
|
|
|
|
path: /tmp/matrix-nginx-proxy-metrics-password
|
|
|
|
|
state: absent
|
|
|
|
|
when: matrix_nginx_proxy_proxy_matrix_metrics_basic_auth_username != ''
|
|
|
|
|