diff --git a/defaults/main.yml b/defaults/main.yml index eb491701..87146f41 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -219,6 +219,15 @@ nexus_config_go: false nexus_config_cocoapods: false nexus_config_conan: false +# routing_rules.yml +nexus_routing_rules_config: + nexus: + deleteUnknownItems: + routingRules: true + # customLocalUsers: false +nexus_routing_rules: + routingRules: [] + nexus_content_selectors: [] # example selector item : # - name: docker-login @@ -441,11 +450,7 @@ nexus_repos_pypi_hosted: version_policy: release write_policy: allow # one of "allow", "allow_once" or "deny" -nexus_repos_pypi_group: - - name: pypi-all - member_repos: - - pypi-internal - - pypi +nexus_repos_pypi_group: [] nexus_repos_pypi_proxy: - name: pypi @@ -481,11 +486,7 @@ nexus_repos_raw_hosted: version_policy: release write_policy: allow_once # one of "allow", "allow_once" or "deny" -nexus_repos_raw_group: - - name: raw-all - member_repos: - - raw-internal - - ubuntu-archive +nexus_repos_raw_group: [] # Docker support _nexus_repos_docker_defaults: @@ -522,7 +523,7 @@ nexus_repos_docker_proxy: # maximum_component_age: 1440 # maximum_metadata_age: 1440 # negative_cache_enabled: true - # negative_cache_ttl: 1440 + # negative_cache_ttl: 1440x nexus_repos_docker_group: - name: docker-group @@ -636,12 +637,7 @@ nexus_repos_nuget_hosted: - name: nuget-internal blob_store: "{{ nexus_blob_names.nuget.blob }}" -nexus_repos_nuget_group: - - name: nuget-all - blob_store: "{{ nexus_blob_names.nuget.blob }}" - member_repos: - - nuget-internal - - nuget-proxy +nexus_repos_nuget_group: [] nexus_repos_nuget_proxy: - name: nuget-proxy diff --git a/molecule/default-converge.yml b/molecule/default-converge.yml index 04ae647f..f61b8266 100644 --- a/molecule/default-converge.yml +++ b/molecule/default-converge.yml @@ -2,11 +2,16 @@ - name: Converge hosts: nexus roles: - - role: nexus3-oss + - role: nexus3-repository-templates + - role: nexus3-pro vars_files: - ssl-{{ ansible_os_family }}.yml - nexus_common_test_vars.yml - nexus_ldap_test_vars.yml + - .nexus-downloads/hosted-result.yml + - .nexus-downloads/proxies-result.yml + - .nexus-downloads/roles-result.yml + - .nexus-downloads/routing-rules-result.yml environment: http_proxy: "{{ lookup('env', 'http_proxy') }}" diff --git a/molecule/nexus_common_test_vars.yml b/molecule/nexus_common_test_vars.yml index 77ba722d..bc49ecd6 100644 --- a/molecule/nexus_common_test_vars.yml +++ b/molecule/nexus_common_test_vars.yml @@ -5,6 +5,9 @@ httpd_ssl_cert_file_location: "{{ default_cert }}" httpd_ssl_cert_key_location: "{{ default_key }}" nexus_public_hostname: localhost nexus_api_timeout: 45 +nexus_use_api_for_provisioning: true + +nexus_transform: true nexus_custom_jvm_settings: - XX:+UseG1GC @@ -240,22 +243,22 @@ nexus_repos_maven_hosted: cleanup_policies: - mvn_cleanup -nexus_repos_maven_group: - - name: public-mixed-permissive - member_repos: - - private-release-cleanup-mvn-cleanup - - jcenter-api - layout_policy: permissive - version_policy: mixed - - - name: public-offline-mixed-permissive - online: false - member_repos: - - private-release-cleanup-mvn-cleanup - - jcenter-api - - jboss-api-blob-default - layout_policy: permissive - version_policy: mixed +nexus_repos_maven_group: [] + # - name: public-mixed-permissive + # member_repos: + # - private-release-cleanup-mvn-cleanup + # - jcenter-api + # layout_policy: permissive + # version_policy: mixed + + # - name: public-offline-mixed-permissive + # online: false + # member_repos: + # - private-release-cleanup-mvn-cleanup + # - jcenter-api + # - jboss-api-blob-default + # layout_policy: permissive + # version_policy: mixed nexus_repos_npm_hosted: - name: npm-registry-hosted @@ -270,12 +273,12 @@ nexus_repos_npm_hosted: write_policy: deny blocked: true auto_block: false -nexus_repos_npm_group: - - name: npm-public - member_repos: - - npm-registry - - npm-registry-blocked - - npm-registry-hosted +nexus_repos_npm_group: [] + # - name: npm-public + # member_repos: + # - npm-registry + # - npm-registry-blocked + # - npm-registry-hosted nexus_repos_npm_proxy: - name: npm-registry remote_url: https://registry.npmjs.org/ @@ -305,24 +308,28 @@ nexus_repos_yum_proxy: negative_cache_ttl: 60 enable_circular_redirects: true enable_cookies: true -nexus_repos_yum_group: - - name: yum_all - member_repos: - - private_yum_centos_7 - - epel_centos_7_x86_64 - -nexus_repos_docker_hosted: - - name: docker-private - http_port: "5000" - force_basic_auth: true - v1_enabled: true - write_policy: allow - - name: docker-private-redeploy - write_policy: deny # will be ignored when allow_redeploy_latest is true - allow_redeploy_latest: true - - name: docker-private-no-redeploy - write_policy: deny # will be effective when allow_redeploy_latest is false - allow_redeploy_latest: false +nexus_repos_yum_group: [] + # - name: yum_all + # member_repos: + # - private_yum_centos_7 + # - epel_centos_7_x86_64 + +# nexus_repos_yum_hosted: +# - name: private_yum_centos_7 +# repodata_depth: 1 +# nexus_repos_yum_proxy: +# - name: epel_centos_7_x86_64 +# remote_url: http://download.fedoraproject.org/pub/epel/7/x86_64 +# maximum_component_age: -1 +# maximum_metadata_age: -1 +# negative_cache_ttl: 60 +# enable_circular_redirects: true +# enable_cookies: true +# nexus_repos_yum_group: +# - name: yum_all +# member_repos: +# - private_yum_centos_7 +# - epel_centos_7_x86_64 nexus_repos_docker_proxy: - name: docker-hub @@ -334,11 +341,11 @@ nexus_repos_docker_proxy: v1_enabled: true write_policy: allow -nexus_repos_docker_group: - - name: docker-all - member_repos: - - docker-private - - docker-hub +nexus_repos_docker_group: [] + # - name: docker-all + # member_repos: + # - docker-private + # - docker-hub nexus_repos_pypi_proxy: - name: pypi-proxy remote_url: https://pypi.python.org/simple/ @@ -352,112 +359,111 @@ nexus_repos_pypi_hosted: force_basic_auth: true v1_enabled: true write_policy: allow -nexus_repos_pypi_group: - - name: pypi-all - member_repos: - - pypi-hosted - - pypi-proxy +# nexus_repos_pypi_group: +# - name: pypi-all +# member_repos: +# - pypi-hosted +# - pypi-proxy nexus_repos_apt_hosted: - name: private_apt distribution: all keypair: |- -----BEGIN PGP PRIVATE KEY BLOCK----- - lQWGBGNSbLEBDADGJXWoQwhjjgmGbMdnhfneYU2qjfMlgdoTH2oqkir6aaqHdS6l - 88YUt/4mBAzaQhcETm7sIlrlAvXyfH4/i3ATwI4SUYUCl1fIZ9beRD3WWBwCiYMZ - XT0ZByrDL+aGpRO6xl0LCPr1loqHbvt2ZesoSn77Zv4tGHVLPiryG1KTxQPRCU4d - Ydg9wCwlrGseExA4O8ujgOeyo/ObxXrCilxJzvNf/21/KGSa54FzMyGiWvN7tOMT - Z9kau/bToIjwi4ME4nLx4T5c5qtYAoqlnbRR12pHBlx7RckncS1M/r+E1nX6GzeJ - cx4qAgd0HD226Kro3bahfM8ZWktbtJ7cytbPBwZ64Fu7kTzS0tfMPu0VBNK+EfrK - woDOoqg1i92r8VgTL6BQ+ouQy7BwWLKc6AEk/+M2f/L1ifDWay/uQdjNa27OKn0R - 3cBBSYhmu7swnQqJ5Xl/M6qSFZXd0O6qiddZ/wynAsw7AHmi/BLWrd867hRHYLaS - a29lQPgU8+WRVzUAEQEAAf4HAwLjlFgkkxZE9v9sCLksoRlKptpG5OATXAzFslcf - RUjsBFVX86QvHLrYYJix5E3LD2+RLOl4Z97yZAdmhGZhJRN5r02jcZHD4nO9I1bT - JXN2OwVP0zgv5bxscXiFYa274O3pvPbhbqZ6tGqZ8/gPv2dbMUc2Xgv+CdJB9j1p - ytPomh0wQHIohnVuZQ2A/BYs/fG6SFaGHwHwBOD3kQvlDf5egdzKrY9e4xIKvAEL - M8ZuatSJf2plvawkJDKlWYSm8gxIb1ZiT3BdiiyYTP2ZFQpwVwFUSKhqZtv37b51 - 197U1kUNloQF4nmf4mDYXuyLmXknp4l8LOvO2x527A8BBP6DuPUSFH/0+YYZmJ3q - vbUvEIvkwEU/GtfpMr24yaFglxPbOK+DYmGt6LXeFAxxL/EM3/BqBU3+exZqMzGx - n+F7zy2QWyYjyvJGX0V9TH0b2rUqvc14C0GQLpB7+aDrsJKXBndPLThlIIDLSp9w - 8zo78jddUqRrhyxcJiszP6HAEz7ubpgi0ZCUydBRjdbNmzOf0fTi8/2vLOOu9s5k - IE5JAdv3MMVSoXhR8JNvWk8HvtdqqzPcqoQuxaO2NfycEUEvKFbMhuc8EL1nEgqx - MvVr8tUlPDwP9rEg+YBTC4EAi8d8OiWWna0SxALv8dayOKShjsUwfSYCjmzAqVK8 - 4q3/pf0mMoe3m/JBsWfmJqdSXXQ8gJ0WUL/EBuzNyrbHZ07Mo7gUeV35Ks2cX7Uu - Ayrm41n0aSjnjfeWW11WCv8VlOV7CuXXaEnd0GQ1fY4E9g92A4bag/NXN+tOOoLp - llj6XTBfQ1l/YbBcatdUMIjcXX9hDmkMBrrLKBdChBVYMMe+E8/Nv4AEUkt5I3m7 - dDDFADxSm0IQKVHHR6jspm13S55wwDUz0clD9RVa5O0SCckkiQllhaz4kxSt3oDW - gy6WZNnJS4gK9N75kZMrMhc44pRV7nW3KUB/HPHwmNk83cFA55R3WiQJkfwySvPQ - wKdmvUrTlPlycnKbXgPbDPRDndcnC3ZPKNPYwIPkiSB5iksFjZkviXMWIy+dGXrh - tyfY0wLlkM2EnrQCfjWs6emm+8W0sKNow4yrdUAJ6cHDh3Cx5UePrNFc4GZmGsc4 - 619lS9cBRHrN0n2UskdcFeQAxA4Aj4MMWGj0M+vPE4tz9DLUUGE1nHU8OlIE+MUe - cymaqPAr3OBLkQhtSROOjsIpk7jNuhQxByOQywDQa1WUn7ewhmCJl6GW9Q2QPPAz - pIXAbfDWClXDmcfxO35C7WCQOTOoJvLPV0AdHpKYDhybwKg7urBC1Uhg5WXxMzTT - upyu3plDsKZLVCUfMiRQg1pGjpONO9SQ4bRsVGhvVGVhbSBOZXh1czMgQ0kgKEtl - eSBmb3IgYXB0IGNpIHRlc3Qgb24gaHR0cHM6Ly9naXRodWIuY29tL2Fuc2libGUt - VGhvVGVhbS9uZXh1czMtb3NzKSA8dGhvdGVhbUBuZXh1czMuY2k+iQHOBBMBCgA4 - FiEEB5LYtM4/VAJnIFfdA/IJDIG6oBMFAmNSbLECGwMFCwkIBwIGFQoJCAsCBBYC - AwECHgECF4AACgkQA/IJDIG6oBO0AwwAsC/mtjOi/SAsDeDVNoaOOT9iGI02Ddjp - z+FzucSL384VrBwQVrIEYRJ0OYCTdKVeArAer7CAe34vtPMAm3tTWwQg4hTYeTR6 - 59Iq5t2a+zyT9EGB3y7bzpGU9yZ8V/4cFva2pvTXjIv5HjEu0nuHQlau9pXSeKxE - DHkxG2DeCmIs+QPohtizP7ZlBkAiOd094p1SlEs8ZmgjqZ+MyN30I/BpPIGxwrWN - QqichYmLNP0TIl+ZMukx2qVnNhfls+2ZtXWzERg2OkEHhyLcLsIqr24/WusWkqwn - QnswPPiIV9bjpigh3GEb6xw2/JhZyMOnSFeND7B/9MqR5tWkaq8bnxviIct71kga - tYVIhZbEcg51cm9Pwncd/HeOFokuVrYsk+40yc6lIdqYAPJhOPdr0G/BFXjQ5m/Z - AmQHr8ykUwGy+bjN4AzuX4sfkazkYRLP8Wnt4WnrPAU4Y3FEGTnueYK/w0f8sk9X - 6QY5qkwjqglEgOyDqKVcJ0GEwYp9C+0OnQWGBGNSbLEBDADIix1iE8wJb3y9pl0N - XJO4D1LFzGQXVupzOKUeHPAO03tSv3nBSpWtbQBz8eK1CaLDXnRhGA3SppHwtv5r - jTp/FWohRl2CEUGKZFYft3o0jshysOpd4SdDm5n+ONQWY17YozCaf+ic0pYkIx5C - taAhguJSe6hHfjfDAz2Xt51CjKafsa5Hvbya0NbYKkOu+6n06XYJhghSWkYr0SyV - R7ejxQBsrdQU69d9mOouL7QJGPmhPLtGG+yX/dw85qT45AXri0hsAy5bfKIMhGpl - vZTbIsSLEmItVDnil3wwAXDD/czbsg39MdA2r7bgtixjtaP9t4S4jkrZqS9yl6sC - GhcLMr6TiSdfibKs9f2MxYZRV3Js439WjppGTLgwTICcdW+qna1bmqc1oGewrr1l - aOER3q3+C221cVjr8Puac0aBZuGPcBIGsd9L8MwzNAu1t8zHKc3jlfs7B0++NSKT - AJNyJRhw9CKUqL9xenUazaqpe5n60i//cB1aOF0qb8vCEocAEQEAAf4HAwLhYZJ1 - q2iPB/+luVezfm77sp1ngSNNaRTtnmSKo6u5csOFcrJLAfPcslDC2kFOu9KzL4uw - VLWalWLqhuDGO0KGqiAbRyM7Jj68SsSKXMfIbbuWxJFNBqEwoqK81UvQhqJmk0qI - foOWfMP4covr9I1vSohHF3AZxnCPcaU4n3nBRL2XOYb++HmO3oRwRUIwWJZOFW94 - 9Hy3ImY01VbGf+CUkGXNTRqATV85utjZjGbb99k8aIv5qS4ZOCnGcnL2qx+H579V - ngsB4IKiC//jP35qSvbi3TN1BxWB0qs5qNNzprjosrC7vUqLWZH2vU0SHLLZ5rA0 - a1ZhICCv5UjEmG5JnJtSa6T7LxLWdCLnfX3J4SJ5Jc+qbIAH+fL5J0xoJGN0ttRn - +yllt6YA2PtwEUGeZJh4qlswYVltlAggjwkLu0HQOkkrOiQhwM7O3/oRhjVb3EPy - wa5BcgfZBUjP2D3KHnrm6iYI3W+P+EMVZ9GGGufHdSk8rhWnU6+UENUbUUR/QlMC - 3gOLD5Q80+R7SG51J6j1aPTDJWlzQppfabHqZBstMvef4bhiZDfyZimzbwyr8oim - 0P1ZBbp9PN0olNsF9bfh9N+3wb0B8QKAIpprV8wLOpp/713nJ6pNi37o0ErlGmYK - 4PnpMw659g+ZnwpYRvIMb3IRMN55Bs5vEPCpxLjTi8ze9Il7tGuhhX/NwpS6+Fbg - awvHxCKLfl6vderWkbHg4voMvzWgg3+phwYvRI2UoSzff1T5yFHBQQBg75K2xAWZ - toI7mMbWEi8digk7Ry54t2A+3y/VwRbI6hOVDaKn/cLlCZwBzOZxw6VPC7RIAhCt - TQJqDNQ3znE+yARRgeT60oXfqPzIEagrrjMHJMRCFseo6Mzk3RGVyAVxzoMdi/20 - wbi1lS7R23OpfO7nzJVLtaPSN34N4kfEbVK4+e0oW1PfzgrNdEBMWPU3nByIyRW1 - J4GwcFEUcltQLGo885VoK3ob+sm/ymw9Zus78H6li8UHt4/dWvIxtb/o79cS7kbS - vaiViQZHLe1hBV4+jPglQyxyVGZ+w6R+kurO6sT6ESi5v4jjOx1ytCcPWVkNgrLw - 5chwlbnodzBDKs6g3ROd7fTCD9q84vjMbk3G2PS8tMpyRY9rN7o1tLwcEM4CjkSV - HIX5FRt5vhjYc8y8g3SvufpkxL7V/ttlmqFDQz2nPICV4Jys+ImxUMySGyfPu7tJ - cd9HppAoeyR6edB0c8U8uVRx/0x+5TW81z2+ILvdp9VlyWDMFyVHtV7TxIu7LS6H - 7KcHeYnaydNRh56BKsosxy9V9TEZoWJeQGSkm8PVb7xJWaXb2nsaQNeyo9EpUO2Y - a4kBtgQYAQoAIBYhBAeS2LTOP1QCZyBX3QPyCQyBuqATBQJjUmyxAhsMAAoJEAPy - CQyBuqAT6qsMAI9tFK4C4I01o6sD5MI6lnXHGFXfsN6/QJV6AOHC64g+s3K6+XM+ - 8dOy4KcnfDdouEQYs5X1n2zxnOV760YmnqCA7yk4p32LsW4zRp9Hs4rNPU0K4MnL - LkEs24S99ohNQQhKauMxmFAZyH767j1oN2vFTdwANKswpkszfzEnGo0rFN+uIok1 - ENsB0cQWoyF/BSpOX2/MvCapLvf8yzAWqdQiF1zgcShKrpXny+rbI3owrDBSJ4VT - AsKWbiXgbEh7gx7kZQOj4IlubEKDmCbp2KH1RTlYGxR36x4B2i6oC+wJ1KYqbX/Z - OsyXajH6s35fR551Ttlkz1HHkUFDmTnFRhIhaiG8aytyHrQpNdXQz9pUcLZEtttB - cAvelj5iWiWg86nkPGR/fFzsKETG0Jx8lydvuBtPlK+MgTRsPDr3sntDrkdmE5CW - vk75VekDO5zTuLFS2QTkhWSIztL8V2T47uABUGCunyFxhVRM7q9VQIRC+i7bEO3v - 0J6R2RZlI2A7tQ== - =GPnF - -----END PGP PRIVATE KEY BLOCK----- - passphrase: password - # Allow redeploy to allow repeated failing tests when debugging - # !! Don't do this for a release repo on production - write_policy: allow - -nexus_repos_apt_proxy: - - name: apt_ubuntu_18.04 - remote_url: http://archive.ubuntu.com/ubuntu/ - distribution: bionic - maximum_component_age: -1 - maximum_metadata_age: -1 - negative_cache_ttl: 60 +# nexus_repos_docker_proxy: [] +# nexus_repos_apt_hosted: +# - name: private_apt +# distribution: all +# keypair: |- +# -----BEGIN PGP PRIVATE KEY BLOCK----- + +# lQWGBGNSbLEBDADGJXWoQwhjjgmGbMdnhfneYU2qjfMlgdoTH2oqkir6aaqHdS6l +# 88YUt/4mBAzaQhcETm7sIlrlAvXyfH4/i3ATwI4SUYUCl1fIZ9beRD3WWBwCiYMZ +# XT0ZByrDL+aGpRO6xl0LCPr1loqHbvt2ZesoSn77Zv4tGHVLPiryG1KTxQPRCU4d +# Ydg9wCwlrGseExA4O8ujgOeyo/ObxXrCilxJzvNf/21/KGSa54FzMyGiWvN7tOMT +# Z9kau/bToIjwi4ME4nLx4T5c5qtYAoqlnbRR12pHBlx7RckncS1M/r+E1nX6GzeJ +# cx4qAgd0HD226Kro3bahfM8ZWktbtJ7cytbPBwZ64Fu7kTzS0tfMPu0VBNK+EfrK +# woDOoqg1i92r8VgTL6BQ+ouQy7BwWLKc6AEk/+M2f/L1ifDWay/uQdjNa27OKn0R +# 3cBBSYhmu7swnQqJ5Xl/M6qSFZXd0O6qiddZ/wynAsw7AHmi/BLWrd867hRHYLaS +# a29lQPgU8+WRVzUAEQEAAf4HAwLjlFgkkxZE9v9sCLksoRlKptpG5OATXAzFslcf +# RUjsBFVX86QvHLrYYJix5E3LD2+RLOl4Z97yZAdmhGZhJRN5r02jcZHD4nO9I1bT +# JXN2OwVP0zgv5bxscXiFYa274O3pvPbhbqZ6tGqZ8/gPv2dbMUc2Xgv+CdJB9j1p +# ytPomh0wQHIohnVuZQ2A/BYs/fG6SFaGHwHwBOD3kQvlDf5egdzKrY9e4xIKvAEL +# M8ZuatSJf2plvawkJDKlWYSm8gxIb1ZiT3BdiiyYTP2ZFQpwVwFUSKhqZtv37b51 +# 197U1kUNloQF4nmf4mDYXuyLmXknp4l8LOvO2x527A8BBP6DuPUSFH/0+YYZmJ3q +# vbUvEIvkwEU/GtfpMr24yaFglxPbOK+DYmGt6LXeFAxxL/EM3/BqBU3+exZqMzGx +# n+F7zy2QWyYjyvJGX0V9TH0b2rUqvc14C0GQLpB7+aDrsJKXBndPLThlIIDLSp9w +# 8zo78jddUqRrhyxcJiszP6HAEz7ubpgi0ZCUydBRjdbNmzOf0fTi8/2vLOOu9s5k +# IE5JAdv3MMVSoXhR8JNvWk8HvtdqqzPcqoQuxaO2NfycEUEvKFbMhuc8EL1nEgqx +# MvVr8tUlPDwP9rEg+YBTC4EAi8d8OiWWna0SxALv8dayOKShjsUwfSYCjmzAqVK8 +# 4q3/pf0mMoe3m/JBsWfmJqdSXXQ8gJ0WUL/EBuzNyrbHZ07Mo7gUeV35Ks2cX7Uu +# Ayrm41n0aSjnjfeWW11WCv8VlOV7CuXXaEnd0GQ1fY4E9g92A4bag/NXN+tOOoLp +# llj6XTBfQ1l/YbBcatdUMIjcXX9hDmkMBrrLKBdChBVYMMe+E8/Nv4AEUkt5I3m7 +# dDDFADxSm0IQKVHHR6jspm13S55wwDUz0clD9RVa5O0SCckkiQllhaz4kxSt3oDW +# gy6WZNnJS4gK9N75kZMrMhc44pRV7nW3KUB/HPHwmNk83cFA55R3WiQJkfwySvPQ +# wKdmvUrTlPlycnKbXgPbDPRDndcnC3ZPKNPYwIPkiSB5iksFjZkviXMWIy+dGXrh +# tyfY0wLlkM2EnrQCfjWs6emm+8W0sKNow4yrdUAJ6cHDh3Cx5UePrNFc4GZmGsc4 +# 619lS9cBRHrN0n2UskdcFeQAxA4Aj4MMWGj0M+vPE4tz9DLUUGE1nHU8OlIE+MUe +# cymaqPAr3OBLkQhtSROOjsIpk7jNuhQxByOQywDQa1WUn7ewhmCJl6GW9Q2QPPAz +# pIXAbfDWClXDmcfxO35C7WCQOTOoJvLPV0AdHpKYDhybwKg7urBC1Uhg5WXxMzTT +# upyu3plDsKZLVCUfMiRQg1pGjpONO9SQ4bRsVGhvVGVhbSBOZXh1czMgQ0kgKEtl +# eSBmb3IgYXB0IGNpIHRlc3Qgb24gaHR0cHM6Ly9naXRodWIuY29tL2Fuc2libGUt +# VGhvVGVhbS9uZXh1czMtb3NzKSA8dGhvdGVhbUBuZXh1czMuY2k+iQHOBBMBCgA4 +# FiEEB5LYtM4/VAJnIFfdA/IJDIG6oBMFAmNSbLECGwMFCwkIBwIGFQoJCAsCBBYC +# AwECHgECF4AACgkQA/IJDIG6oBO0AwwAsC/mtjOi/SAsDeDVNoaOOT9iGI02Ddjp +# z+FzucSL384VrBwQVrIEYRJ0OYCTdKVeArAer7CAe34vtPMAm3tTWwQg4hTYeTR6 +# 59Iq5t2a+zyT9EGB3y7bzpGU9yZ8V/4cFva2pvTXjIv5HjEu0nuHQlau9pXSeKxE +# DHkxG2DeCmIs+QPohtizP7ZlBkAiOd094p1SlEs8ZmgjqZ+MyN30I/BpPIGxwrWN +# QqichYmLNP0TIl+ZMukx2qVnNhfls+2ZtXWzERg2OkEHhyLcLsIqr24/WusWkqwn +# QnswPPiIV9bjpigh3GEb6xw2/JhZyMOnSFeND7B/9MqR5tWkaq8bnxviIct71kga +# tYVIhZbEcg51cm9Pwncd/HeOFokuVrYsk+40yc6lIdqYAPJhOPdr0G/BFXjQ5m/Z +# AmQHr8ykUwGy+bjN4AzuX4sfkazkYRLP8Wnt4WnrPAU4Y3FEGTnueYK/w0f8sk9X +# 6QY5qkwjqglEgOyDqKVcJ0GEwYp9C+0OnQWGBGNSbLEBDADIix1iE8wJb3y9pl0N +# XJO4D1LFzGQXVupzOKUeHPAO03tSv3nBSpWtbQBz8eK1CaLDXnRhGA3SppHwtv5r +# jTp/FWohRl2CEUGKZFYft3o0jshysOpd4SdDm5n+ONQWY17YozCaf+ic0pYkIx5C +# taAhguJSe6hHfjfDAz2Xt51CjKafsa5Hvbya0NbYKkOu+6n06XYJhghSWkYr0SyV +# R7ejxQBsrdQU69d9mOouL7QJGPmhPLtGG+yX/dw85qT45AXri0hsAy5bfKIMhGpl +# vZTbIsSLEmItVDnil3wwAXDD/czbsg39MdA2r7bgtixjtaP9t4S4jkrZqS9yl6sC +# GhcLMr6TiSdfibKs9f2MxYZRV3Js439WjppGTLgwTICcdW+qna1bmqc1oGewrr1l +# aOER3q3+C221cVjr8Puac0aBZuGPcBIGsd9L8MwzNAu1t8zHKc3jlfs7B0++NSKT +# AJNyJRhw9CKUqL9xenUazaqpe5n60i//cB1aOF0qb8vCEocAEQEAAf4HAwLhYZJ1 +# q2iPB/+luVezfm77sp1ngSNNaRTtnmSKo6u5csOFcrJLAfPcslDC2kFOu9KzL4uw +# VLWalWLqhuDGO0KGqiAbRyM7Jj68SsSKXMfIbbuWxJFNBqEwoqK81UvQhqJmk0qI +# foOWfMP4covr9I1vSohHF3AZxnCPcaU4n3nBRL2XOYb++HmO3oRwRUIwWJZOFW94 +# 9Hy3ImY01VbGf+CUkGXNTRqATV85utjZjGbb99k8aIv5qS4ZOCnGcnL2qx+H579V +# ngsB4IKiC//jP35qSvbi3TN1BxWB0qs5qNNzprjosrC7vUqLWZH2vU0SHLLZ5rA0 +# a1ZhICCv5UjEmG5JnJtSa6T7LxLWdCLnfX3J4SJ5Jc+qbIAH+fL5J0xoJGN0ttRn +# +yllt6YA2PtwEUGeZJh4qlswYVltlAggjwkLu0HQOkkrOiQhwM7O3/oRhjVb3EPy +# wa5BcgfZBUjP2D3KHnrm6iYI3W+P+EMVZ9GGGufHdSk8rhWnU6+UENUbUUR/QlMC +# 3gOLD5Q80+R7SG51J6j1aPTDJWlzQppfabHqZBstMvef4bhiZDfyZimzbwyr8oim +# 0P1ZBbp9PN0olNsF9bfh9N+3wb0B8QKAIpprV8wLOpp/713nJ6pNi37o0ErlGmYK +# 4PnpMw659g+ZnwpYRvIMb3IRMN55Bs5vEPCpxLjTi8ze9Il7tGuhhX/NwpS6+Fbg +# awvHxCKLfl6vderWkbHg4voMvzWgg3+phwYvRI2UoSzff1T5yFHBQQBg75K2xAWZ +# toI7mMbWEi8digk7Ry54t2A+3y/VwRbI6hOVDaKn/cLlCZwBzOZxw6VPC7RIAhCt +# TQJqDNQ3znE+yARRgeT60oXfqPzIEagrrjMHJMRCFseo6Mzk3RGVyAVxzoMdi/20 +# wbi1lS7R23OpfO7nzJVLtaPSN34N4kfEbVK4+e0oW1PfzgrNdEBMWPU3nByIyRW1 +# J4GwcFEUcltQLGo885VoK3ob+sm/ymw9Zus78H6li8UHt4/dWvIxtb/o79cS7kbS +# vaiViQZHLe1hBV4+jPglQyxyVGZ+w6R+kurO6sT6ESi5v4jjOx1ytCcPWVkNgrLw +# 5chwlbnodzBDKs6g3ROd7fTCD9q84vjMbk3G2PS8tMpyRY9rN7o1tLwcEM4CjkSV +# HIX5FRt5vhjYc8y8g3SvufpkxL7V/ttlmqFDQz2nPICV4Jys+ImxUMySGyfPu7tJ +# cd9HppAoeyR6edB0c8U8uVRx/0x+5TW81z2+ILvdp9VlyWDMFyVHtV7TxIu7LS6H +# 7KcHeYnaydNRh56BKsosxy9V9TEZoWJeQGSkm8PVb7xJWaXb2nsaQNeyo9EpUO2Y +# a4kBtgQYAQoAIBYhBAeS2LTOP1QCZyBX3QPyCQyBuqATBQJjUmyxAhsMAAoJEAPy +# CQyBuqAT6qsMAI9tFK4C4I01o6sD5MI6lnXHGFXfsN6/QJV6AOHC64g+s3K6+XM+ +# 8dOy4KcnfDdouEQYs5X1n2zxnOV760YmnqCA7yk4p32LsW4zRp9Hs4rNPU0K4MnL +# LkEs24S99ohNQQhKauMxmFAZyH767j1oN2vFTdwANKswpkszfzEnGo0rFN+uIok1 +# ENsB0cQWoyF/BSpOX2/MvCapLvf8yzAWqdQiF1zgcShKrpXny+rbI3owrDBSJ4VT +# AsKWbiXgbEh7gx7kZQOj4IlubEKDmCbp2KH1RTlYGxR36x4B2i6oC+wJ1KYqbX/Z +# OsyXajH6s35fR551Ttlkz1HHkUFDmTnFRhIhaiG8aytyHrQpNdXQz9pUcLZEtttB +# cAvelj5iWiWg86nkPGR/fFzsKETG0Jx8lydvuBtPlK+MgTRsPDr3sntDrkdmE5CW +# vk75VekDO5zTuLFS2QTkhWSIztL8V2T47uABUGCunyFxhVRM7q9VQIRC+i7bEO3v +# 0J6R2RZlI2A7tQ== +# =GPnF +# -----END PGP PRIVATE KEY BLOCK----- +# passphrase: password +# # Allow redeploy to allow repeated failing tests when debugging +# # !! Don't do this for a release repo on production +# write_policy: allow nexus_repos_raw_proxy: - name: raw-proxy @@ -472,11 +478,11 @@ nexus_repos_raw_hosted: - name: raw-hosted write_policy: allow -nexus_repos_raw_group: - - name: raw-all - member_repos: - - raw-hosted - - raw-proxy +# nexus_repos_raw_group: +# - name: raw-all +# member_repos: +# - raw-hosted +# - raw-proxy nexus_repos_rubygems_proxy: - name: rubygems-proxy @@ -509,28 +515,27 @@ nexus_repos_bower_group: nexus_repos_helm_hosted: - name: helm-hosted -nexus_repos_helm_proxy: - - name: helm-proxy - remote_url: https://kubernetes-charts.storage.googleapis.com/ +# nexus_repos_helm_hosted: +# - name: helm-hosted -nexus_repos_r_proxy: - - name: r-proxy - remote_url: https://cran.r-project.org/ +# nexus_repos_helm_proxy: +# - name: helm-proxy +# remote_url: https://kubernetes-charts.storage.googleapis.com/ -nexus_repos_r_hosted: - - name: r-internal - version_policy: release - write_policy: allow +# nexus_repos_r_proxy: +# - name: r-proxy +# remote_url: https://cran.r-project.org/ -nexus_repos_r_group: - - name: r-all - member_repos: - - r-internal - - r-proxy +# nexus_repos_r_hosted: +# - name: r-internal +# version_policy: release +# write_policy: allow -nexus_repos_conda_proxy: - - name: conda-proxy - remote_url: https://repo.continuum.io/pkgs/ +# nexus_repos_r_group: +# - name: r-all +# member_repos: +# - r-internal +# - r-proxy nexus_repos_conan_proxy: - name: conan-proxy @@ -549,20 +554,19 @@ nexus_repos_nuget_hosted: - name: nuget-internal blob_store: "{{ nexus_blob_names.nuget.blob }}" -nexus_repos_nuget_group: - - name: nuget-all - blob_store: "{{ nexus_blob_names.nuget.blob }}" - member_repos: - - nuget-internal - - nuget-proxy-with-version +# nexus_repos_nuget_group: +# - name: nuget-all +# blob_store: "{{ nexus_blob_names.nuget.blob }}" +# member_repos: +# - nuget-internal +# - nuget-proxy-with-version -nexus_repos_nuget_proxy: - - name: nuget-proxy-with-version - blob_store: "{{ nexus_blob_names.nuget.blob }}" - remote_url: http://www.nuget.org/api/v2 - nuget_version: v2 - - name: nuget-proxy-default - remote_url: https://api.nuget.org/v3/index.json +# nexus_repos_nuget_group: +# - name: nuget-all +# blob_store: "{{ nexus_blob_names.nuget.blob }}" +# member_repos: +# - nuget-internal +# - nuget-proxy nexus_repos_p2_proxy: - name: p2-proxy @@ -585,115 +589,128 @@ nexus_content_selectors: description: Selector for docker team2 search_expression: format == "docker" and path =^ "/v2/team2/" -nexus_privileges: - - name: all-repos-read - description: Read & Browse access to all repos - repository: "*" - actions: - - read - - browse - - name: wildcard1 - type: wildcard - description: first wilcard - pattern: nexus:repository-view:yum:* - - name: some_application - type: application - description: some nexus configuration - domain: some_nexus_domain - actions: - - some action - - name: script1 - type: script - description: first script - script_name: the_script_name - actions: - - some actions - - name: docker-login-search-all - type: repository-content-selector - contentSelector: docker-login-search - description: Login to and search docker registry - repository: "*" - actions: - - read - - name: docker-private-team1-rw - type: repository-content-selector - contentSelector: docker-private-team1 - description: write access to /team1 namespace on docker-private - repository: docker-private - actions: - - read, - - add - - edit - - browse - - name: docker-private-team2-rw - type: repository-content-selector - contentSelector: docker-private-team2 - description: write access to /team2 namespace on docker-hosted - repository: docker-private - actions: - - read - - add - - edit - - browse - -nexus_roles: - - name: c-ro-private_yum_centos_7 - id: c-ro-private_yum_centos_7 - description: Custom read-only role for private_yum_centos_7 hosted repository - privileges: - - nx-repository-view-yum-private_yum_centos_7-read - - nx-repository-view-yum-private_yum_centos_7-browse - - name: developers - id: developers - description: Developers - privileges: - - all-repos-read - - wildcard1 - - docker-login-search-all - - name: role-team1 - id: role-team1 - description: team1 - privileges: - - docker-private-team1-rw - - name: role-team2 - id: role-team2 - description: team2 - privileges: - - docker-private-team2-rw - -nexus_local_users: - - username: jenkins - first_name: Jenkins - last_name: CI - email: support@company.com - password: s3cr3t - roles: - - developers - - username: olduser # make sure this old account is removed - state: absent - - username: test_roles - first_name: Test - last_name: Roles - email: test@roles.com - password: s3cr3t - roles: - - c-ro-private_yum_centos_7 - - username: team1 - first_name: team - last_name: one - email: team@one.com - password: theone - roles: - - developers - - role-team1 - - username: team2 - first_name: team - last_name: two - email: team@two.com - password: thetwo - roles: - - developers - - role-team2 +# nexus_content_selectors: +# # Docker by namespace. For mode details see: +# # https://help.sonatype.com/repomanager3/formats/docker-registry/content-selectors-and-docker +# - name: docker-login-search +# description: Selector for docker login privilege +# search_expression: format == "docker" and (path == "/v2/" of path == "/v1/search") +# - name: docker-private-team1 +# description: Selector for docker team1 +# search_expression: format == "docker" and path =^ "/v2/team1/" +# - name: docker-private-team2 +# description: Selector for docker team2 +# search_expression: format == "docker" and path =^ "/v2/team2/" + +# nexus_privileges: +# - name: all-repos-read +# description: Read & Browse access to all repos +# repository: "*" +# actions: +# - read +# - browse +# - name: wildcard1 +# type: wildcard +# description: first wilcard +# pattern: nexus:repository-view:yum:* +# - name: some_application +# type: application +# description: some nexus configuration +# domain: some_nexus_domain +# actions: +# - some action +# - name: script1 +# type: script +# description: first script +# script_name: the_script_name +# actions: +# - some actions +# - name: docker-login-search-all +# type: repository-content-selector +# contentSelector: docker-login-search +# description: Login to and search docker registry +# repository: "*" +# actions: +# - read +# - name: docker-private-team1-rw +# type: repository-content-selector +# contentSelector: docker-private-team1 +# description: write access to /team1 namespace on docker-private +# repository: docker-private +# actions: +# - read, +# - add +# - edit +# - browse +# - name: docker-private-team2-rw +# type: repository-content-selector +# contentSelector: docker-private-team2 +# description: write access to /team2 namespace on docker-hosted +# repository: docker-private +# actions: +# - read +# - add +# - edit +# - browse + +# nexus_roles: +# - name: c-ro-private_yum_centos_7 +# id: c-ro-private_yum_centos_7 +# description: Custom read-only role for private_yum_centos_7 hosted repository +# privileges: +# - nx-repository-view-yum-private_yum_centos_7-read +# - nx-repository-view-yum-private_yum_centos_7-browse +# - name: developers +# id: developers +# description: Developers +# privileges: +# - all-repos-read +# - wildcard1 +# - docker-login-search-all +# - name: role-team1 +# id: role-team1 +# description: team1 +# privileges: +# - docker-private-team1-rw +# - name: role-team2 +# id: role-team2 +# description: team2 +# privileges: +# - docker-private-team2-rw + +# nexus_local_users: +# - username: jenkins +# first_name: Jenkins +# last_name: CI +# email: support@company.com +# password: s3cr3t +# roles: +# - developers +# - username: olduser # make sure this old account is removed +# state: absent +# - username: test_roles +# first_name: Test +# last_name: Roles +# email: test@roles.com +# password: s3cr3t +# roles: +# - c-ro-private_yum_centos_7 +# - username: team1 +# first_name: team +# last_name: one +# email: team@one.com +# password: theone +# roles: +# - developers +# - role-team1 +# - username: team2 +# first_name: team +# last_name: two +# email: team@two.com +# password: thetwo +# roles: +# - developers +# - role-team2 nexus_scheduled_tasks: # Example task to purge maven snapshots with cron schedule diff --git a/molecule/nexus_postgres_test_vars.yml b/molecule/nexus_postgres_test_vars.yml index f51e03d3..5b75ea6d 100644 --- a/molecule/nexus_postgres_test_vars.yml +++ b/molecule/nexus_postgres_test_vars.yml @@ -27,3 +27,362 @@ nexus_postgres_db_username: nexus nexus_postgres_db_password: nexus nexus_postgres_max_lifetime: 840000 nexus_postgres_max_pool_size: 85 + +nexus_transform: true + +proxy_defaults: + - maven: + - name: maven-central + format: maven2 + online: true + blocked: false + auto_block: true + remote: + url: https://repo.maven.apache.org/maven2 + username: username + password: password + connection: + useTrustStore: false + retries: 2 + user_agent_suffix: agent + enable_cookies: true + enable_circular_redirects: true + timeout: 1440 + maximum_component_age: 1440 + maximum_metadata_age: 1440 + negative_cache_enabled: true + negative_cache_ttl: 1440 + cleanup_policies: + - policy-1 + version_policy: RELEASE + layout_policy: PERMISSIVE + content_disposition: INLINE + - name: maven-central-02 + format: maven2 + online: true + blocked: false + auto_block: true + remote: + url: https://repo.maven.apache.org/maven2 + username: username + password: password + connection: + useTrustStore: false + retries: 2 + user_agent_suffix: agent + enable_cookies: true + enable_circular_redirects: true + timeout: 1440 + maximum_component_age: 1440 + maximum_metadata_age: 1440 + negative_cache_enabled: true + negative_cache_ttl: 1440 + cleanup_policies: + - policy-1 + version_policy: RELEASE + layout_policy: PERMISSIVE + content_disposition: INLINE + # - python: + # - name: pypi-central + # format: pypi + # online: true + # blocked: false + # auto_block: true + # remote: + # url: https://pypi.org/simple + # username: + # password: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + # - npm: + # - name: npm-registry + # format: npm + # online: true + # blocked: false + # auto_block: true + # remote: + # url: https://registry.npmjs.org/ + # username: + # password: + # bearerToken: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + # - nuget: + # - name: nuget-gallery + # format: nuget + # online: true + # blocked: false + # auto_block: true + # nuget_version: v3 + # remote: + # url: https://api.nuget.org/v3/index.json + # username: + # password: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + # - apt: + # - name: ubuntu-apt + # format: apt + # online: true + # blocked: false + # auto_block: true + # distribution: bionic + # flat: false + # remote: + # url: http://archive.ubuntu.com/ubuntu/ + # username: + # password: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + # - helm: + # - name: helm-proxy + # format: helm + # online: true + # blocked: false + # auto_block: true + # remote: + # url: https://kubernetes-charts.storage.googleapis.com + # username: + # password: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + # - r: + # - name: r-proxy + # format: r + # online: true + # blocked: false + # auto_block: true + # remote: + # url: https://cran.r-project.org + # username: + # password: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + # - raw: + # - name: raw-proxy + # format: raw + # online: true + # blocked: false + # auto_block: true + # remote: + # url: https://www.jfrog.com/ + # username: + # password: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + # contentDisposition: + # - conda: + # - name: conda-proxy + # format: conda + # online: true + # blocked: false + # auto_block: true + # remote: + # url: https://repo.anaconda.com/pkgs/main + # username: + # password: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + # - go: + # - name: go-proxy + # format: go + # online: true + # blocked: false + # auto_block: true + # remote: + # url: https://proxy.golang.org + # username: + # password: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + - yum: + - name: yum-proxy + format: yum + online: true + blocked: false + auto_block: true + remote: + url: http://mirror.centos.org/centos/ + username: username + password: password + connection: + useTrustStore: false + retries: 2 + user_agent_suffix: agent + enable_cookies: true + enable_circular_redirects: true + timeout: 1440 + maximum_component_age: 1440 + maximum_metadata_age: 1440 + negative_cache_enabled: true + negative_cache_ttl: 1440 + cleanup_policies: + - policy-1 + +nexus_repos_maven_proxy: + - name: maven-central + format: maven2 + online: True + blocked: False + auto_block: True + remote: + url: https://repo.maven.apache.org/maven2 + username: username + password: password + connection: + useTrustStore: False + retries: 2 + user_agent_suffix: agent + enable_cookies: True + enable_circular_redirects: True + timeout: 1440 + maximum_component_age: 1440 + maximum_metadata_age: 1440 + negative_cache_enabled: True + negative_cache_ttl: 1440 + cleanup_policies: + - policy-1 + - name: maven-central-02 + format: maven2 + online: True + blocked: False + auto_block: True + remote: + url: https://repo.maven.apache.org/maven2 + username: username + password: password + connection: + useTrustStore: False + retries: 2 + user_agent_suffix: agent + enable_cookies: True + enable_circular_redirects: True + timeout: 1440 + maximum_component_age: 1440 + maximum_metadata_age: 1440 + negative_cache_enabled: True + negative_cache_ttl: 1440 + cleanup_policies: + - policy-1 +nexus_repos_yum_proxy: + - name: yum-proxy + format: yum + online: True + blocked: False + auto_block: True + remote: + url: http://mirror.centos.org/centos/ + username: username + password: password + connection: + useTrustStore: False + retries: 2 + user_agent_suffix: agent + enable_cookies: True + enable_circular_redirects: True + timeout: 1440 + maximum_component_age: 1440 + maximum_metadata_age: 1440 + negative_cache_enabled: True + negative_cache_ttl: 1440 + cleanup_policies: + - policy-1 diff --git a/molecule/roles/nexus3-repository-templates/README.md b/molecule/roles/nexus3-repository-templates/README.md new file mode 100644 index 00000000..225dd44b --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/molecule/roles/nexus3-repository-templates/defaults/main.yml b/molecule/roles/nexus3-repository-templates/defaults/main.yml new file mode 100644 index 00000000..920a991c --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/defaults/main.yml @@ -0,0 +1,539 @@ +--- +nexus_delete_default_repos: true + +# defaults file for nexus3-repository-templates +teams: + - ID: Team1 + name: Team1 + repos: + requestedBy: + hosted: + - name: maven-repo1 + format: maven2 + - name: maven-repo2 + format: maven2 + - name: python-repo1 + format: pypi + - name: npm-repo1 + format: npm + - name: apt-repo1 + format: apt + - name: docker-repo1 + format: docker + - name: helm-repo1 + format: helm + - name: raw-repo1 + format: raw + proxy: + - name: mvn-proxy-repo1 + format: maven2 + routing_rule_matcher: test + - name: mvn-proxy-team1 + format: maven2 + routing_rule_matcher: alleenimages + - name: yum-proxy-repo1 + format: yum + routing_rule_matcher: yumtest + - name: docker-proxy-repo1 + format: docker + - name: raw-proxy-repo1 + format: raw + - name: helm-proxy-repo1 + format: helm + - name: python-proxy-repo1 + format: pypi + - name: npm-proxy-repo1 + format: npm + group: + - name: group-repo-1 + format: maven2 + members: + - maven-repo2 + - maven-repo1 + - mvn-proxy-repo1 + - name: group-repo-2 + format: npm + members: + - npm-proxy-repo1 + - npm-repo1 + sharedAccessTo: + hosted: + - name: raw-repo1 + teams: [Team2] + proxy: + - name: raw-proxy-repo1 + teams: [Team2] + group: [] + - ID: Team2 + name: Team2 + repos: + requestedBy: + hosted: + - name: maven-repo-team2 + format: maven2 + - name: python-repo-team2 + format: pypi + proxy: + - name: python-proxy-team2 + format: pypi + group: [] + sharedAccessTo: + hosted: + - name: maven-repo-team2 + teams: [Team1] + proxy: + - name: python-proxy-team2 + teams: [Team1] + group: [] + + +hosted_defaults: + apt: + blob_store: blob-apt + online: true + distribution: dist + keypair: 'none' + passphrase: 'none' + strict_content_validation: true + layout_policy: strict # strict or permissive + write_policy: allow_once # one of "allow", "allow_once" or "deny" + cleanup_policies: + - apt_cleanup + docker: + online: true + blob_store: blob-docker + remote_url: 'https://a.a' + force_basic_auth: true + strict_content_validation: true + allow_redeploy_latest: false + version_policy: release # release, snapshot or mixed + write_policy: allow_once + layout_policy: strict # strict or permissive + http_port: + https_port: + sub_domain: + v1_enabled: false + cleanup_policies: + - docker_cleanup + gitlfs: + repositoryName: -repo + recipeName: recipeName, + online: true + blob_store: blob-gitlfs + layout_policy: strict # strict or permissive + write_policy: allow_once # ALLOW_ONCE or ALLOW + strict_content_validation: true + cleanup_policies: + - gitlfs_cleanup + helm: + repositoryName: -repo + recipeName: recipeName, + online: true + blob_store: blob-helm + layout_policy: strict # strict or permissive + write_policy: allow_once # ALLOW_ONCE or ALLOW + strict_content_validation: true + cleanup_policies: + - helm_cleanup + maven2: + online: true + blob_store: blob-mvn + strict_content_validation: true + version_policy: release # release, snapshot or mixed + layout_policy: strict # strict or permissive + write_policy: allow_once # one of "allow", "allow_once" or "deny" + cleanup_policies: + - mvn_cleanup + npm: + repositoryName: -repo + recipeName: recipeName, + online: true + blob_store: blob-npm + layout_policy: strict # strict or permissive + write_policy: allow_once # ALLOW_ONCE or ALLOW + strict_content_validation: true + cleanup_policies: + - npm_cleanup + nuget: + repositoryName: -repo + recipeName: recipeName, + online: true + blob_store: blob-nuget + layout_policy: strict # strict or permissive + write_policy: allow_once # ALLOW_ONCE or ALLOW + strict_content_validation: true + cleanup_policies: + - nuget_cleanup + pypi: + repositoryName: -repo + recipeName: recipeName, + online: true + blob_store: blob-pypi + layout_policy: strict # strict or permissive + write_policy: allow_once # ALLOW_ONCE or ALLOW + strict_content_validation: true + cleanup_policies: + - python_cleanup + raw: + repositoryName: -repo + recipeName: recipeName, + online: true + blob_store: blob-raw + layout_policy: strict # strict or permissive + write_policy: allow_once # ALLOW_ONCE or ALLOW + strict_content_validation: true + cleanup_policies: + - raw_cleanup + content_disposition: INLINE + yum: + repositoryName: -repo + recipeName: recipeName, + online: true + blob_store: blob-yum + layout_policy: strict # strict or permissive + write_policy: allow_once # ALLOW_ONCE or ALLOW + strict_content_validation: true + cleanup_policies: + - yum_cleanup + repodataDepth: 1 + deployPolicy: strict # strict or permissive + +proxy_defaults: + maven2: + online: true + blocked: false + auto_block: true + blob_store: blob-mvn + strict_content_validation: true + remote: + url: https://repo.maven.apache.org/maven2 + username: '' + password: '' + connection: + retries: 5 + user_agent_suffix: '' + enable_cookies: false + enable_circular_redirects: false + timeout: '' + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: true + negative_cache_ttl: 1440 + version_policy: release + layout_policy: strict + write_policy: allow_once + content_disposition: inline + routing_rule_matcher: '' + cleanup_policies: + - mvn_cleanup + docker: + online: true + blocked: false + auto_block: true + blob_store: blob-docker + strict_content_validation: true + force_basic_auth: true + v1_enabled: false + http_port: + remote: + url: https://registry-1.docker.io + username: + password: + connection: + retries: 5 + user_agent_suffix: + enable_cookies: false + enable_circular_redirects: false + timeout: + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: true + negative_cache_ttl: 1440 + version_policy: release + layout_policy: strict + write_policy: allow_once + content_disposition: inline + index_type: HUB + use_nexus_certificates_to_access_index: false + cache_foreign_layers: true + foreign_layer_url_whitelist: [] + sub_domain: + routing_rule_matcher: '' + cleanup_policies: + - docker_cleanup + pypi: + name: pypi-central + format: pypi + blob_store: blob-pypi + online: true + blocked: false + auto_block: true + remote: + url: https://pypi.org/simple + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + layout_policy: strict + write_policy: allow_once # one of "allow", "allow_once" or "deny" + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: True + negative_cache_ttl: 1440 + routing_rule_matcher: '' + cleanup_policies: + - policy-1 + npm: + name: npm-registry + format: npm + online: true + blob_store: blob-npm + blocked: false + auto_block: true + remote: + url: https://registry.npmjs.org/ + username: + password: + bearerToken: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + strict_content_validation: true + layout_policy: strict + write_policy: allow_once # one of "allow", "allow_once" or "deny" + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: True + negative_cache_ttl: 1440 + routing_rule_matcher: '' + cleanup_policies: + - policy-1 + nuget: + name: nuget-gallery + format: nuget + online: true + blob_store: blob-nuget + blocked: false + auto_block: true + nuget_version: v3 + remote: + url: https://api.nuget.org/v3/index.json + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: True + negative_cache_ttl: 1440 + write_policy: allow_once # one of "allow", "allow_once" or "deny" + routing_rule_matcher: '' + cleanup_policies: + - policy-1 + apt: + name: ubuntu-apt + format: apt + online: true + blob_store: blob-apt + blocked: false + auto_block: true + distribution: bionic + flat: false + remote: + url: http://archive.ubuntu.com/ubuntu/ + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: True + negative_cache_ttl: 1440 + write_policy: allow_once # one of "allow", "allow_once" or "deny" + routing_rule_matcher: '' + cleanup_policies: + - policy-1 + helm: + name: helm-proxy + format: helm + online: true + blob_store: blob-helm + blocked: false + auto_block: true + remote: + url: https://kubernetes-charts.storage.googleapis.com + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + strict_content_validation: true + layout_policy: strict # strict or permissive + write_policy: allow_once # one of "allow", "allow_once" or "deny" + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: True + negative_cache_ttl: 1440 + routing_rule_matcher: '' + cleanup_policies: + - policy-1 + r: + name: r-proxy + format: r + online: true + blocked: false + blob_store: blob-r + auto_block: true + remote: + url: https://cran.r-project.org + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: True + negative_cache_ttl: 1440 + write_policy: allow_once # one of "allow", "allow_once" or "deny" + routing_rule_matcher: '' + cleanup_policies: + - policy-1 + raw: + name: raw-proxy + blob_store: blob-raw + format: raw + online: true + blocked: false + auto_block: true + remote: + url: https://www.jfrog.com/ + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + layout_policy: strict + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: True + negative_cache_ttl: 1440 + write_policy: allow_once # one of "allow", "allow_once" or "deny" + routing_rule_matcher: '' + cleanup_policies: + - policy-1 + content_disposition: inline + conda: + name: conda-proxy + blob_store: blob-conda + format: conda + online: true + blocked: false + auto_block: true + remote: + url: https://repo.anaconda.com/pkgs/main + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: True + negative_cache_ttl: 1440 + write_policy: allow_once # one of "allow", "allow_once" or "deny" + routing_rule_matcher: '' + cleanup_policies: + - policy-1 + go: + name: go-proxy + blob_store: blob-go + format: go + online: true + blocked: false + auto_block: true + remote: + url: https://proxy.golang.org + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: True + negative_cache_ttl: 1440 + write_policy: allow_once # one of "allow", "allow_once" or "deny" + routing_rule_matcher: '' + cleanup_policies: + - policy-1 + yum: + online: true + blocked: false + auto_block: true + blob_store: blob-yum + remote: + url: http://mirror.centos.org/centos/ + username: '' + password: '' + connection: + retries: 5 + user_agent_suffix: 'cn' + enable_cookies: false + enable_circular_redirects: false + timeout: '' + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: true + negative_cache_ttl: 1440 + strict_content_validation: true + version_policy: release + layout_policy: strict + write_policy: allow_once + content_disposition: inline + routing_rule_matcher: '' + cleanup_policies: + - policy-1 + +group_defaults: + maven: + python: diff --git a/molecule/roles/nexus3-repository-templates/handlers/main.yml b/molecule/roles/nexus3-repository-templates/handlers/main.yml new file mode 100644 index 00000000..9cd987b1 --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/handlers/main.yml @@ -0,0 +1,2 @@ +--- +# handlers file for nexus3-repository-templates diff --git a/molecule/roles/nexus3-repository-templates/meta/main.yml b/molecule/roles/nexus3-repository-templates/meta/main.yml new file mode 100644 index 00000000..563930b6 --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/meta/main.yml @@ -0,0 +1,52 @@ +galaxy_info: + author: your name + description: your role description + company: your company (optional) + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: license (GPL-2.0-or-later, MIT, etc) + + min_ansible_version: '2.1' + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + # + # Provide a list of supported platforms, and for each platform a list of versions. + # If you don't wish to enumerate all versions for a particular platform, use 'all'. + # To view available platforms and versions (or releases), visit: + # https://galaxy.ansible.com/api/v1/platforms/ + # + # platforms: + # - name: Fedora + # versions: + # - all + # - 25 + # - name: SomePlatform + # versions: + # - all + # - 1.0 + # - 7 + # - 99.99 + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. diff --git a/molecule/roles/nexus3-repository-templates/tasks/main.yml b/molecule/roles/nexus3-repository-templates/tasks/main.yml new file mode 100644 index 00000000..6476003a --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/tasks/main.yml @@ -0,0 +1,26 @@ +--- +# tasks file for nexus3-repository-templates +- name: Transform proxy_defaults into nexus_repos + ansible.builtin.template: + src: "proxies.yml.j2" + dest: "/nexus-downloads/proxies-result.yml" + #remote_src: true + tags: transform +- name: Transform hosted_defaults into nexus_repos + ansible.builtin.template: + src: "hosted.yml.j2" + dest: "/nexus-downloads/hosted-result.yml" + #remote_src: true + tags: transform +- name: Transform roles_defaults into nexus_repos + ansible.builtin.template: + src: "roles.yml.j2" + dest: "/nexus-downloads/roles-result.yml" + #remote_src: true + tags: transform +- name: Transform routing-rules_defaults into nexus_repos + ansible.builtin.template: + src: "routing-rules.yml.j2" + dest: "/nexus-downloads/routing-rules-result.yml" + #remote_src: true + tags: transform diff --git a/molecule/roles/nexus3-repository-templates/templates/cleanup-policies.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/cleanup-policies.yml.j2 new file mode 100644 index 00000000..18ed3871 --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/templates/cleanup-policies.yml.j2 @@ -0,0 +1,42 @@ +--- +nexus_repos_cleanup_policies: +{% for item in proxy_repos %} + - name: base-image-{{ item.proxyname }}-cleanup + format: docker + notes: Clean up policy for base images {{ item.proxyname }}-proxy + criteria: +{% if item.cleanup.lastupdated != "" %} + lastBlobUpdated: {{ item.cleanup.lastupdated }} +{% endif %} +{% if item.cleanup.lastdownloaded != "" %} + lastDownloaded: {{ item.cleanup.lastdownloaded }} +{% endif %} +{% if item.cleanup.regex != "" %} + regexKey: "{{ item.cleanup.regex }}" +{% endif %} +{% endfor %} + - name: base-image-docker-cleanup + format: docker + notes: "Clean up policy for base images docker-proxy" + criteria: + lastBlobUpdated: 90 + lastDownloaded: 30 + regexKey: ".*(library|linuxserver|xebialabs).*" + - name: remove-snapshot-containers + format: docker + notes: Policy for removing temporary container images + criteria: + lastDownloaded: 14 + lastBlobUpdated: 30 + regexKey: ".*(SNAPSHOT|snapshot|DEVELOP|develop|BUILD|build).*" + - name: remove-release-containers + format: docker + notes: Policy for removing that were considered release at some time + criteria: + lastBlobUpdated: 90 + - name: base-image-cleanup + format: docker + notes: Clean up policy for base images + criteria: + lastBlobUpdated: 90 + lastDownloaded: 30 diff --git a/molecule/roles/nexus3-repository-templates/templates/content-selectors.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/content-selectors.yml.j2 new file mode 100644 index 00000000..cf14bcc7 --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/templates/content-selectors.yml.j2 @@ -0,0 +1,19 @@ +--- +nexus_content_selectors: +{% for item in docker_repo_teams | selectattr("repo", "equalto", "true") %} + - name: {{ item.team }}-container-content + description: {{ item.team }}-repo push conventions + search_expression: format == 'docker' and path=^ "/v2/{{ item.team }}/" +{% endfor %} + - name: all-gitlfs + description: Selector for Git LFS repositories + search_expression: format=='gitlfs' + - name: container-content + description: only allowed to download images + search_expression: format == 'docker' + - name: amos-container-content + description: amos-repo push conventions + search_expression: format == 'docker' and ( path =^ "/v2/pet-system/" or path =^ "/v2/amos-pet/" ) + - name: sens-container-content + description: sens-repo push conventions + search_expression: format == 'docker' and ( path =^ "/v2/sens/" or path =^ "/v2/viz/" or path =^ "/v2/anpr/" or path =^ "/v2/kolibrie/" ) diff --git a/molecule/roles/nexus3-repository-templates/templates/hosted.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/hosted.yml.j2 new file mode 100644 index 00000000..7e61e4ea --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/templates/hosted.yml.j2 @@ -0,0 +1,44 @@ +{% for key, value in hosted_defaults.items() %} +{% for team in teams %} +{% set teams_loop = loop %} +{% for team_hosted_repo in team.repos.requestedBy.hosted | selectattr("format", "equalto", key) %} +{% set team_hosted_repo_loop = loop %} +{% if team_hosted_repo|length > 0 and team_hosted_repo_loop.first and teams_loop.first %} +{% if key == 'maven2' %} +nexus_repos_{{ key[:-1] }}_hosted: +{% else %} +nexus_repos_{{ key }}_hosted: +{% endif %} +{% endif %} + - name: {{ team_hosted_repo.name }} + online: {{ team_hosted_repo.online if team_hosted_repo.online is defined else value.online }} + blob_store: {{ team_hosted_repo.blob_store if team_hosted_repo.blob_store is defined else value.blob_store }} + layout_policy: {{ team_hosted_repo.layout_policy if team_hosted_repo.layout_policy is defined else value.layout_policy }} + write_policy: {{ team_hosted_repo.write_policy if team_hosted_repo.write_policy is defined else value.write_policy }} + cleanup_policies: +{% if team.policy is defined %} +{% for policy in team.cleanup_policies %} + - {{ policy }} +{% endfor %} +{% else %} +{% for policy in value.cleanup_policies %} + - {{ policy }} +{% endfor %} +{% endif %} +{% if key == 'apt' %} + distribution: {{ team_hosted_repo.distribution if team_hosted_repo.distribution is defined else value.distribution }} + keypair: {{ team_hosted_repo.keypair if team_hosted_repo.keypair is defined else value.keypair }} + passphrase: {{ team_hosted_repo.passphrase if team_hosted_repo.passphrase is defined else value.passphrase }} +{% endif %} +{% if key == 'docker' %} + force_basic_auth: {{ team_hosted_repo.force_basic_auth if team_hosted_repo.force_basic_auth is defined else value.force_basic_auth }} + v1_enabled: {{ team_hosted_repo.v1_enabled if team_hosted_repo.v1_enabled is defined else value.v1_enabled }} + http_port: {{ team_hosted_repo.http_port if team_hosted_repo.http_port is defined else value.http_port }} + sub_domain: {{ team_hosted_repo.sub_domain if team_hosted_repo.sub_domain is defined else value.sub_domain }} +{% endif %} +{% if key == 'raw' %} + content_disposition: {{ team_hosted_repo.content_disposition if team_hosted_repo.content_disposition is defined else value.content_disposition }} +{% endif %} +{% endfor %} +{% endfor %} +{% endfor %} \ No newline at end of file diff --git a/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 new file mode 100644 index 00000000..421f5f40 --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 @@ -0,0 +1,66 @@ +{% for key, value in proxy_defaults.items() %} +{% for team in teams %} +{% set teams_loop = loop %} +{% for team_proxy_repo in team.repos.requestedBy.proxy | selectattr("format", "equalto", key) %} +{% set team_hosted_repo_loop = loop %} +{% if team_proxy_repo|length > 0 and team_hosted_repo_loop.first and teams_loop.first %} +{% if key == 'maven2' %} +nexus_repos_{{ key[:-1] }}_proxy: +{% else %} +nexus_repos_{{ key }}_proxy: +{% endif %} +{% endif %} + - name: {{ team_proxy_repo.name }} + online: {{ team_proxy_repo.online if team_proxy_repo.online is defined else value.online }} + blob_store: {{ team_proxy_repo.blob_store if team_proxy_repo.blob_store is defined else value.blob_store }} + layout_policy: {{ team_proxy_repo.layout_policy if team_proxy_repo.layout_policy is defined else value.layout_policy }} + write_policy: {{ team_proxy_repo.write_policy if team_proxy_repo.write_policy is defined else value.write_policy }} + blocked: {{ team_proxy_repo.blocked if team_proxy_repo.blocked is defined else value.blocked }} + auto_block: {{ team_proxy_repo.auto_block if team_proxy_repo.auto_block is defined else value.auto_block }} + remote: + username: {{ team_proxy_repo.remote.username if team_proxy_repo.remote.username is defined else value.remote.username }} + password: {{ team_proxy_repo.remote.password if team_proxy_repo.remote.password is defined else value.remote.password }} + remote_url: {{ team_proxy_repo.remote_url if team_proxy_repo.remote_url is defined else value.remote.url }} + connection: + retries: {{ team_proxy_repo.connection.retries if team_proxy_repo.connection.retries is defined else value.connection.retries }} + user_agent_suffix: {{ team_proxy_repo.connection.user_agent_suffix if team_proxy_repo.connection.user_agent_suffix is defined else value.connection.user_agent_suffix }} + enable_cookies: {{ team_proxy_repo.connection.enable_cookies if team_proxy_repo.connection.enable_cookies is defined else value.connection.enable_cookies }} + enable_circular_redirects: {{ team_proxy_repo.connection.enable_circular_redirects if team_proxy_repo.connection.enable_circular_redirects is defined else value.connection.enable_circular_redirects }} + timeout: {{ team_proxy_repo.connection.timeout if team_proxy_repo.connection.timeout is defined else value.connection.timeout }} + maximum_component_age: {{ team_proxy_repo.maximum_component_age if team_proxy_repo.maximum_component_age is defined else value.maximum_component_age }} + maximum_metadata_age: {{ team_proxy_repo.maximum_metadata_age if team_proxy_repo.maximum_metadata_age is defined else value.maximum_metadata_age }} + negative_cache_enabled: {{ team_proxy_repo.negative_cache_enabled if team_proxy_repo.negative_cache_enabled is defined else value.negative_cache_enabled }} + negative_cache_ttl: {{ team_proxy_repo.negative_cache_ttl if team_proxy_repo.negative_cache_ttl is defined else value.negative_cache_ttl }} + routing_rule: {{ team_proxy_repo.name+'-routing-rule' if team_proxy_repo.routing_rule_matcher is defined | default(omit) }} + routing_rule_matcher: {{ team_proxy_repo.routing_rule_matcher if team_proxy_repo.routing_rule_matcher is defined else value.routing_rule_matcher }} + cleanup_policies: +{% if team.policy is defined %} +{% for policy in team.cleanup_policies %} + - {{ policy }} +{% endfor %} +{% else %} +{% for policy in value.cleanup_policies %} + - {{ policy }} +{% endfor %} +{% endif %} +{% if key == 'apt' %} + distribution: {{ team_proxy_repo.distribution if team_proxy_repo.distribution is defined else value.distribution }} + keypair: {{ team_proxy_repo.keypair if team_proxy_repo.keypair is defined else value.keypair }} + passphrase: {{ team_proxy_repo.passphrase if team_proxy_repo.passphrase is defined else value.passphrase }} +{% endif %} +{% if key == 'docker' %} + force_basic_auth: {{ team_proxy_repo.force_basic_auth if team_proxy_repo.force_basic_auth is defined else value.force_basic_auth }} + v1_enabled: {{ team_proxy_repo.v1_enabled if team_proxy_repo.v1_enabled is defined else value.v1_enabled }} + http_port: {{ team_proxy_repo.http_port if team_proxy_repo.http_port is defined else value.http_port }} + sub_domain: {{ team_proxy_repo.sub_domain if team_proxy_repo.sub_domain is defined else value.sub_domain }} + index_type: {{ team_proxy_repo.index_type if team_proxy_repo.index_type is defined else value.index_type }} + use_nexus_certificates_to_access_index: {{ team_proxy_repo.use_nexus_certificates_to_access_index if team_proxy_repo.use_nexus_certificates_to_access_index is defined else value.use_nexus_certificates_to_access_index }} + cache_foreign_layers: {{ team_proxy_repo.cache_foreign_layers if team_proxy_repo.cache_foreign_layers is defined else value.cache_foreign_layers }} + foreign_layer_url_whitelist: {{ team_proxy_repo.foreign_layer_url_whitelist if team_proxy_repo.foreign_layer_url_whitelist is defined else value.foreign_layer_url_whitelist }} +{% endif %} +{% if key == 'raw' %} + content_disposition: {{ team_proxy_repo.content_disposition if team_proxy_repo.content_disposition is defined else value.content_disposition }} +{% endif %} +{% endfor %} +{% endfor %} +{% endfor %} \ No newline at end of file diff --git a/molecule/roles/nexus3-repository-templates/templates/roles.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/roles.yml.j2 new file mode 100644 index 00000000..61eb9a2a --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/templates/roles.yml.j2 @@ -0,0 +1,82 @@ +--- +{% for team in teams %} +{% if teams|length > 0 and loop.first %} +nexus_roles: +{% endif %} + - id: {{ team.ID|upper }}-members + name: {{ team.ID|upper }}-members + description: '{{ team.name|upper }} role.' + privileges: +{% for team_hosted_repo in team.repos.requestedBy.hosted %} +{% if team_hosted_repo|length > 0 %} + - nx-repository-view-{{ team_hosted_repo.format }}-{{ team_hosted_repo.name }}-read + - nx-repository-view-{{ team_hosted_repo.format }}-{{ team_hosted_repo.name }}-browse +{% endif %} +{% endfor %} +{% for team_proxy_repo in team.repos.requestedBy.proxy %} +{% if team_proxy_repo|length > 0 %} + - nx-repository-view-{{ team_proxy_repo.format }}-{{ team_proxy_repo.name }}-read + - nx-repository-view-{{ team_proxy_repo.format }}-{{ team_proxy_repo.name }}-browse +{% endif %} +{% endfor %} +{# {% for team_group_repo in team.repos.requestedBy.group %} +{% if team_group_repo|length > 0 %} + - nx-repository-view-{{ team_group_repo.format }}-{{ team_group_repo.name }}-read + - nx-repository-view-{{ team_group_repo.format }}-{{ team_group_repo.name }}-browse +{% endif %} +{% endfor %} #} +{# Start shared loop #} +{% for team_shared in teams %} +{# Start shared Hosted repo #} +{% for hosted_shared in team_shared.repos.sharedAccessTo.hosted %} +{% for repo_shared in hosted_shared.teams %} +{% if repo_shared == team.ID %} +{% for team_data in teams %} +{% for repo_data in team_data.repos.requestedBy.hosted %} +{% if hosted_shared.name == repo_data.name %} + - nx-repository-view-{{ repo_data.format }}-{{ repo_data.name }}-read + - nx-repository-view-{{ repo_data.format }}-{{ repo_data.name }}-browse +{% endif %} +{% endfor %} +{% endfor %} +{% endif %} +{% endfor %} +{% endfor %} +{# End shared Hosted repo #} +{# Start shared Proxy repo #} +{% for proxy_shared in team_shared.repos.sharedAccessTo.proxy %} +{% for repo_shared in proxy_shared.teams %} +{% if repo_shared == team.ID %} +{% for team_data in teams %} +{% for repo_data in team_data.repos.requestedBy.proxy %} +{% if proxy_shared.name == repo_data.name %} + - nx-repository-view-{{ repo_data.format }}-{{ repo_data.name }}-read + - nx-repository-view-{{ repo_data.format }}-{{ repo_data.name }}-browse +{% endif %} +{% endfor %} +{% endfor %} +{% endif %} +{% endfor %} +{% endfor %} +{# End shared Proxy repo #} +{# Start shared Group repo #} +{% for group_shared in team_shared.repos.sharedAccessTo.group %} +{% for repo_shared in group_shared.teams %} +{% if repo_shared == team.ID %} +{% for team_data in teams %} +{% for repo_data in team_data.repos.requestedBy.group %} +{% if group_shared.name == repo_data.name %} + - nx-repository-view-{{ repo_data.format }}-{{ repo_data.name }}-read + - nx-repository-view-{{ repo_data.format }}-{{ repo_data.name }}-browse +{% endif %} +{% endfor %} +{% endfor %} +{% endif %} +{% endfor %} +{% endfor %} +{# End shared Group repo #} +{% endfor %} +{# End shared loop #} + roles: [] +{# TODO: depending on data impolementation #} +{% endfor %} diff --git a/molecule/roles/nexus3-repository-templates/templates/routing-rules.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/routing-rules.yml.j2 new file mode 100644 index 00000000..14798110 --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/templates/routing-rules.yml.j2 @@ -0,0 +1,20 @@ +--- +nexus_routing_rules: +{% set nexus_combined_repos_proxy = nexus_repos_maven_proxy + + nexus_repos_yum_proxy + + nexus_repos_npm_proxy + + nexus_repos_docker_proxy + + nexus_repos_pypi_proxy + + nexus_repos_helm_proxy + + nexus_repos_raw_proxy %} +{% for item in nexus_combined_repos_proxy%} +{% if item.routing_rule_matcher is defined and item.routing_rule_matcher != None %} + - name: {{ item.name }}-routing-rule + description: Restrict only to {{ item.name }} images + mode: Allow + matchers: +{% for matcher in item.routing_rule_matcher %} + - {{ matcher }} +{% endfor %} +{% endif %} +{% endfor %} diff --git a/molecule/roles/nexus3-repository-templates/templates/scheduled-tasks.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/scheduled-tasks.yml.j2 new file mode 100644 index 00000000..c75357d0 --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/templates/scheduled-tasks.yml.j2 @@ -0,0 +1,61 @@ +--- +nexus_scheduled_tasks: +{% for item in docker_repo_teams | selectattr('repo', 'equalto', 'true') %} +{% if item.cleanup != 'NONE'%} + - name: docker-delete-unused-manifests-and-images-{{ item.team }}-repo + cron: 0 15 1 * * ? + typeId: "repository.docker.gc" + taskProperties: + repositoryName: {{ item.team }}-repo + deployOffset: "24" +{% endif %} + - name: {{ item.team }}-compact-blobstore + cron: 0 45 1 * * ? + typeId: blobstore.compact + taskProperties: + blobstoreName: {{ item.team }}-blob +{% endfor %} +{% for item in docker_repo_teams | selectattr('gitlfs', 'equalto', 'true') %} + - name: {{ item.team }}-compact-blobstore-gitlfs + cron: 0 0 0 * * ? + typeId: blobstore.compact + taskProperties: + blobstoreName: {{ item.team }} +{% endfor %} +{% for item in proxy_repos %} + - name: docker-delete-unused-manifests-and-images-{{ item.proxyname }} + cron: 0 15 0 * * ? + typeId: "repository.docker.gc" + taskProperties: + repositoryName: docker-{{ item.proxyname }} + deployOffset: "24" +{% endfor %} + - name: proxy-compact-blobstore + cron: 0 50 0 * * ? + typeId: blobstore.compact + taskProperties: + blobstoreName: proxy-blob + - name: docker-delete-unused-manifests-and-images-docker-proxy + cron: 0 30 1 * * ? + typeId: "repository.docker.gc" + taskProperties: + repositoryName: docker-proxy + deployOffset: "24" + - name: dockerhub-blob-compact-blobstore + cron: 0 50 0 * * ? + typeId: blobstore.compact + taskProperties: + blobstoreName: dockerhub-blob + - name: docker-delete-incomplete-uploads + cron: 0 45 1 * * ? + typeId: "repository.docker.upload-purge" + taskProperties: + age: "24" + - name: Nexus export configuration and metadata backup + cron: 0 0 1 * * ? + typeId: "db.backup" + task_alert_email: "monitoring-tpe@politie.nl" + taskProperties: + notificationCondition: Failure + location: "{{ nexus_nfs_mount_path }}/orientdb_backup" +... diff --git a/molecule/roles/nexus3-repository-templates/tests/inventory b/molecule/roles/nexus3-repository-templates/tests/inventory new file mode 100644 index 00000000..878877b0 --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/tests/inventory @@ -0,0 +1,2 @@ +localhost + diff --git a/molecule/roles/nexus3-repository-templates/tests/test.yml b/molecule/roles/nexus3-repository-templates/tests/test.yml new file mode 100644 index 00000000..192d0d6d --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/tests/test.yml @@ -0,0 +1,5 @@ +--- +- hosts: localhost + remote_user: root + roles: + - nexus3-repository-templates diff --git a/molecule/roles/nexus3-repository-templates/vars/main.yml b/molecule/roles/nexus3-repository-templates/vars/main.yml new file mode 100644 index 00000000..b3f817a7 --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/vars/main.yml @@ -0,0 +1,2 @@ +--- +# vars file for nexus3-repository-templates diff --git a/nexus.drawio b/nexus.drawio new file mode 100644 index 00000000..31db1089 --- /dev/null +++ b/nexus.drawio @@ -0,0 +1,551 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/tasks/enable_postgres.yml b/tasks/enable_postgres.yml index 3ee82fc7..4669d164 100644 --- a/tasks/enable_postgres.yml +++ b/tasks/enable_postgres.yml @@ -49,3 +49,5 @@ notify: - wait-for-nexus - wait-for-nexus-port + + # wait for nexus to be started succesfully \ No newline at end of file diff --git a/tasks/main.yml b/tasks/main.yml index 0a359f8e..411e2c29 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -29,6 +29,7 @@ - name: Run installation tasks ansible.builtin.import_tasks: nexus_install.yml + tags: nexus-install - name: Configure apache reverse proxy ansible.builtin.include_tasks: httpd_reverse_proxy_config.yml @@ -165,6 +166,27 @@ call_args: "{{ nexus_repos_cleanup_policies }}" when: nexus_repos_cleanup_policies | length > 0 tags: cleanup + + - name: Get all existing routing rules + ansible.builtin.uri: + url: "{{ nexus_api_scheme }}://{{ nexus_api_hostname }}:{{ nexus_api_port }}{{ nexus_api_context_path }}service/rest/v1/routing-rules" + user: admin + password: "{{ current_nexus_admin_password }}" + method: GET + force_basic_auth: true + validate_certs: "{{ nexus_api_validate_certs }}" + body_format: json + return_content: yes + status_code: 200 + register: __nexus_existing_routing_rules__ + tags: repos + when: nexus_use_api_for_provisioning | default(false) | bool + + - name: Create/Update routing rules using API + ansible.builtin.include_tasks: routing_rules.yml + vars: + api_payload: "{{ nexus_routing_rules | d([]) }}" + tags: repos - name: Apply defaults to repositories configurations and process a single list ansible.builtin.include_tasks: process_repos_list.yml diff --git a/tasks/nexus_install.yml b/tasks/nexus_install.yml index c8be7e7e..d9beb930 100644 --- a/tasks/nexus_install.yml +++ b/tasks/nexus_install.yml @@ -3,12 +3,14 @@ ansible.builtin.set_fact: nexus_version_detected_from: fixed when: nexus_version | length > 0 + tags: nexus-install - name: Check nexus-latest link stat in {{ nexus_installation_dir }} ansible.builtin.stat: path: "{{ nexus_installation_dir }}/nexus-latest" register: nexus_latest_link check_mode: false + tags: nexus-install - name: Register current running version if any ansible.builtin.set_fact: @@ -20,6 +22,7 @@ when: - nexus_latest_link.stat.exists | default(false) - nexus_latest_link.stat.islnk | default(false) + tags: nexus-install - name: No version given => Version detection when: @@ -98,6 +101,7 @@ Current running version: {{ nexus_version_running | default('none') }} ansible.builtin.debug: msg: "{{ version_info.split('\n') }}" + tags: nexus-install - name: Register nexus package name ansible.builtin.set_fact: @@ -125,6 +129,7 @@ (download_status.status_code == 200) or (download_status.status_code == 304) retries: "{{ nexus_download_retries }}" delay: "{{ nexus_download_delay }}" + tags: nexus-install notify: - nexus-service-stop @@ -473,6 +478,7 @@ - name: Config Postgres ansible.builtin.include_tasks: enable_postgres.yml + when: nexus_enable_pro_version | default(false) | bool tags: nexus-postgres - name: Enable nexus systemd service and make sure it is started diff --git a/tasks/routing_rules.yml b/tasks/routing_rules.yml new file mode 100644 index 00000000..1c7c5394 --- /dev/null +++ b/tasks/routing_rules.yml @@ -0,0 +1,32 @@ +--- +- name: Create Routing rules + ansible.builtin.uri: + url: "{{ nexus_api_scheme }}://{{ nexus_api_hostname }}:{{ nexus_api_port }}{{ nexus_api_context_path }}service/rest/v1/routing-rules" + user: admin + password: "{{ current_nexus_admin_password }}" + method: POST + force_basic_auth: true + validate_certs: "{{ nexus_api_validate_certs }}" + body_format: json + body: "{{ routing_rules }}" + status_code: 204 + loop: "{{ api_payload }}" + loop_control: + loop_var: routing_rules + when: routing_rules.name not in __nexus_existing_routing_rules__.json | map(attribute='name') | list + +- name: Update Routing rules when Routing rules exists + ansible.builtin.uri: + url: "{{ nexus_api_scheme }}://{{ nexus_api_hostname }}:{{ nexus_api_port }}{{ nexus_api_context_path }}service/rest/v1/routing-rules/{{ routing_rules.name }}" + user: admin + password: "{{ current_nexus_admin_password }}" + method: PUT + force_basic_auth: true + validate_certs: "{{ nexus_api_validate_certs }}" + body_format: json + body: "{{ routing_rules }}" + status_code: 204 + loop: "{{ api_payload }}" + loop_control: + loop_var: routing_rules + when: routing_rules.name in __nexus_existing_routing_rules__.json | map(attribute='name') | list \ No newline at end of file