fix linting issues (#30)

* fix linting issues

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

* set file permissions

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>

.github/workflows/release.yml

@@ -1,6 +1,7 @@
+---
 name: New release
 
-on:
+on:  # yamllint disable-line rule:truthy
   push:
     branches:
       - master

.kitchen.vagrant.yml

@@ -25,31 +25,31 @@ transport:
   max_ssh_sessions: 5
 
 platforms:
-- name: ubuntu-16.04
+  - name: ubuntu-16.04
     driver_config:
       box: bento/ubuntu-16.04
-- name: ubuntu-18.04
+  - name: ubuntu-18.04
     driver_config:
       box: bento/ubuntu-18.04
-- name: centos-6
+  - name: centos-6
     driver_config:
       box: bento/centos-6
-- name: centos-7
+  - name: centos-7
     driver_config:
       box: bento/centos-7
-- name: oracle-6
+  - name: oracle-6
     driver_config:
       box: bento/oracle-6
-- name: oracle-7
+  - name: oracle-7
     driver_config:
       box: bento/oracle-7
-- name: debian-9
+  - name: debian-9
     driver_config:
       box: bento/debian-9
-- name: debian-10
+  - name: debian-10
     driver_config:
       box: bento/debian-10
-- name: amazon
+  - name: amazon
     driver_config:
       box: bento/amazonlinux-2
 
@@ -60,4 +60,4 @@ verifier:
     - https://github.com/dev-sec/nginx-baseline/
 
 suites:
-- name: nginx
+  - name: nginx

.kitchen.yml

@@ -26,11 +26,11 @@ provisioner:
   galaxy_ignore_certs: true
 
 platforms:
-- name: centos6-ansible-latest
+  - name: centos6-ansible-latest
     driver:
       image: rndmh3ro/docker-centos6-ansible:latest
       platform: centos
-- name: centos7-ansible-latest
+  - name: centos7-ansible-latest
     driver:
       image: rndmh3ro/docker-centos7-ansible:latest
       platform: centos
@@ -38,11 +38,11 @@ platforms:
       provision_command:
         - sed -i 's/UsePAM yes/UsePAM no/g' /etc/ssh/sshd_config
         - systemctl enable sshd.service
-- name: oracle6-ansible-latest
+  - name: oracle6-ansible-latest
     driver:
       image: rndmh3ro/docker-oracle6-ansible:latest
       platform: centos
-- name: oracle7-ansible-latest
+  - name: oracle7-ansible-latest
     driver:
       image: rndmh3ro/docker-oracle7-ansible:latest
       run_command: /sbin/init
@@ -50,21 +50,21 @@ platforms:
       provision_command:
         - sed -i 's/UsePAM yes/UsePAM no/g' /etc/ssh/sshd_config
         - systemctl enable sshd.service
-- name: ubuntu1604-ansible-latest
+  - name: ubuntu1604-ansible-latest
     driver:
       image: rndmh3ro/docker-ubuntu1604-ansible:latest
       platform: ubuntu
       run_command: /sbin/init
       provision_command:
         - systemctl enable ssh.service
-- name: ubuntu1804-ansible-latest
+  - name: ubuntu1804-ansible-latest
     driver:
       image: rndmh3ro/docker-ubuntu1804-ansible:latest
       platform: ubuntu
       run_command: /sbin/init
       provision_command:
         - systemctl enable ssh.service
-- name: debian9-ansible-latest
+  - name: debian9-ansible-latest
     driver:
       image: rndmh3ro/docker-debian9-ansible:latest
       platform: debian
@@ -72,7 +72,7 @@ platforms:
       provision_command:
         - apt install -y systemd-sysv
         - systemctl enable ssh.service
-- name: debian10-ansible-latest
+  - name: debian10-ansible-latest
     driver:
       image: rndmh3ro/docker-debian10-ansible:latest
       platform: debian
@@ -80,7 +80,7 @@ platforms:
       provision_command:
         - apt install -y systemd-sysv
         - systemctl enable ssh.service
-- name: amazon-ansible-latest
+  - name: amazon-ansible-latest
     driver:
       image: rndmh3ro/docker-amazon-ansible:latest
       platform: centos
@@ -93,8 +93,7 @@ verifier:
   name: inspec
   sudo: true
   inspec_tests:
-    - ../nginx-baseline
-    #- https://github.com/dev-sec/nginx-baseline
+    - https://github.com/dev-sec/nginx-baseline
   controls:
     - nginx-01
     - nginx-02
@@ -113,4 +112,4 @@ verifier:
     - nginx-17
 
 suites:
-- name: nginx
+  - name: nginx

.travis.yml

@@ -42,17 +42,17 @@ env:
     run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
     test_playbook: test.yml
 
-#  - distro: amazon
-#    init: /lib/systemd/systemd
-#    version: latest
-#    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
-#    test_playbook: test.yml
-#
-#  - distro: fedora
-#    init: /lib/systemd/systemd
-#    version: latest
-#    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
-#    test_playbook: test.yml
+  #  - distro: amazon
+  #    init: /lib/systemd/systemd
+  #    version: latest
+  #    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
+  #    test_playbook: test.yml
+  #
+  #  - distro: fedora
+  #    init: /lib/systemd/systemd
+  #    version: latest
+  #    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
+  #    test_playbook: test.yml
 
   - distro: centos6
     version: latest
@@ -89,19 +89,6 @@ env:
     run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
     test_playbook: official-nginx-role-debian.yml
 
-#  - distro: amazon
-#    init: /lib/systemd/systemd
-#    version: latest
-#    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
-#    test_playbook: official-nginx-role-debian.yml
-#
-#  - distro: fedora
-#    init: /lib/systemd/systemd
-#    version: latest
-#    run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
-#    test_playbook: official-nginx-role-debian.yml
-
-
 before_install:
   # Pull container
   - 'docker pull rndmh3ro/docker-${distro}-ansible:${version}'

handlers/main.yml

@@ -1,3 +1,4 @@
+---
 - name: restart nginx
   service:
     name: "nginx"

requirements.yml

@@ -1,2 +1,3 @@
+---
 - src: nginxinc.nginx
 - src: geerlingguy.nginx

tasks/main.yml

@@ -5,12 +5,13 @@
     mode: "o-rw"
     owner: "root"
     group: "root"
-    recurse: yes
+    recurse: true
 
 - name: create additional configuration
   template:
     src: "hardening.conf.j2"
     dest: "/etc/nginx/conf.d/90.hardening.conf"
+    mode: '0600'
     owner: "root"
     group: "root"
   notify: restart nginx
@@ -21,6 +22,9 @@
     regexp: '^\s*server_tokens'
     line: "    server_tokens {{ nginx_server_tokens }};"
     insertafter: "http {"
+    mode: '0640'
+    owner: "root"
+    group: "root"
   notify: restart nginx
 
 - name: change ssl_protocols in main nginx.conf
@@ -29,6 +33,9 @@
     regexp: '^\s*ssl_protocols'
     line: "    ssl_protocols {{ nginx_ssl_protocols }};"
     insertafter: "http {"
+    mode: '0640'
+    owner: "root"
+    group: "root"
   notify: restart nginx
 
 - name: change ssl_prefer_server_ciphers in main nginx.conf
@@ -37,6 +44,9 @@
     regexp: '^\s*ssl_prefer_server_ciphers'
     line: "    ssl_prefer_server_ciphers {{ nginx_ssl_prefer_server_ciphers }};"
     insertafter: "http {"
+    mode: '0640'
+    owner: "root"
+    group: "root"
   notify: restart nginx
 
 - name: change client_max_body_size in main nginx.conf
@@ -45,6 +55,9 @@
     regexp: '^\s*client_max_body_size'
     line: "    client_max_body_size {{ nginx_client_max_body_size }};"
     insertafter: "http {"
+    mode: '0640'
+    owner: "root"
+    group: "root"
   notify: restart nginx
 
 - name: change client_body_buffer_size in main nginx.conf
@@ -53,6 +66,9 @@
     regexp: '^\s*client_body_buffer_size'
     line: "    client_body_buffer_size {{ nginx_client_body_buffer_size }};"
     insertafter: "http {"
+    mode: '0640'
+    owner: "root"
+    group: "root"
   notify: restart nginx
 
 - name: change keepalive_timeout in main nginx.conf
@@ -61,6 +77,9 @@
     regexp: '^\s*keepalive_timeout'
     line: "    keepalive_timeout {{ nginx_keepalive_timeout }};"
     insertafter: "http {"
+    mode: '0640'
+    owner: "root"
+    group: "root"
   notify: restart nginx
 
 - name: remove default.conf