mirror of
https://github.com/dev-sec/ansible-nginx-hardening.git
synced 2024-11-26 07:03:49 +01:00
35d821809c
* test official nginx role with travis Signed-off-by: szEvEz <szivos.john@gmail.com> * split up test playbook for different distros due to required vars Signed-off-by: szEvEz <szivos.john@gmail.com> * make debian distros use the debian playbook Signed-off-by: szEvEz <szivos.john@gmail.com> * update README Signed-off-by: szEvEz <szivos.john@gmail.com>
116 lines
3.4 KiB
YAML
116 lines
3.4 KiB
YAML
---
|
|
services: docker
|
|
|
|
env:
|
|
- distro: centos6
|
|
version: latest
|
|
init: /sbin/init
|
|
test_playbook: test.yml
|
|
|
|
- distro: centos7
|
|
init: /lib/systemd/systemd
|
|
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
|
version: latest
|
|
test_playbook: test.yml
|
|
|
|
- distro: oracle6
|
|
version: latest
|
|
init: /sbin/init
|
|
test_playbook: test.yml
|
|
|
|
- distro: ubuntu1404
|
|
version: latest
|
|
init: /sbin/init
|
|
test_playbook: test.yml
|
|
|
|
- distro: ubuntu1604
|
|
version: latest
|
|
init: /lib/systemd/systemd
|
|
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
|
test_playbook: test.yml
|
|
|
|
- distro: ubuntu1804
|
|
version: latest
|
|
init: /lib/systemd/systemd
|
|
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
|
test_playbook: test.yml
|
|
|
|
- distro: debian8
|
|
version: latest
|
|
init: /sbin/init
|
|
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
|
test_playbook: test.yml
|
|
|
|
- distro: debian9
|
|
version: latest
|
|
init: /lib/systemd/systemd
|
|
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
|
test_playbook: test.yml
|
|
|
|
- distro: centos6
|
|
version: latest
|
|
init: /sbin/init
|
|
test_playbook: official-nginx-role-redhat.yml
|
|
|
|
- distro: centos7
|
|
init: /lib/systemd/systemd
|
|
container_id: $(mktemp)
|
|
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
|
version: latest
|
|
test_playbook: official-nginx-role-redhat.yml
|
|
|
|
- distro: oracle6
|
|
version: latest
|
|
init: /sbin/init
|
|
test_playbook: official-nginx-role-redhat.yml
|
|
|
|
- distro: ubuntu1404
|
|
version: latest
|
|
init: /sbin/init
|
|
test_playbook: official-nginx-role-debian.yml
|
|
|
|
- distro: ubuntu1604
|
|
version: latest
|
|
init: /lib/systemd/systemd
|
|
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
|
test_playbook: official-nginx-role-debian.yml
|
|
|
|
- distro: ubuntu1804
|
|
version: latest
|
|
init: /lib/systemd/systemd
|
|
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
|
test_playbook: official-nginx-role-debian.yml
|
|
|
|
- distro: debian8
|
|
version: latest
|
|
init: /sbin/init
|
|
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
|
test_playbook: official-nginx-role-debian.yml
|
|
|
|
- distro: debian9
|
|
version: latest
|
|
init: /lib/systemd/systemd
|
|
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
|
test_playbook: official-nginx-role-debian.yml
|
|
|
|
|
|
before_install:
|
|
# Pull container
|
|
- 'docker pull rndmh3ro/docker-${distro}-ansible:${version}'
|
|
|
|
script:
|
|
- container_id=$(mktemp)
|
|
# Run container in detached state
|
|
- 'docker run --detach --volume="${PWD}":/etc/ansible/roles/ansible-nginx-hardening:ro ${run_opts} rndmh3ro/docker-${distro}-ansible:${version} "${init}" > "${container_id}"'
|
|
|
|
# Install ansible galaxy requirements
|
|
- 'docker exec "$(cat ${container_id})" ansible-galaxy -c install -r /etc/ansible/roles/ansible-nginx-hardening/requirements.yml -p /etc/ansible/roles/'
|
|
|
|
# Test role
|
|
- 'docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/ansible-nginx-hardening/tests/"${test_playbook}" -vv'
|
|
|
|
# Verify role
|
|
- 'inspec exec https://github.com/dev-sec/nginx-baseline/ -t docker://$(cat ${container_id}) --controls=nginx-01 nginx-02 nginx-03 nginx-05 nginx-06 nginx-07 nginx-08 nginx-09 nginx-10 nginx-12 nginx-13 nginx-15 nginx-17 --no-distinct-exit'
|
|
|
|
notifications:
|
|
webhooks: https://galaxy.ansible.com/api/v1/notifications/ |