hifis-net / ansible-role-zammad

:warning: PLEASE NOTE: This role has been migrated to our hifis.toolkit collection. :warning: An Ansible Role to install and configure the web-based open source user support/ticketing solution Zammad.

Ansible role: Zammad

⚠️ This project is archived! ⚠️

This role has been migrated to our hifis.toolkit collection:

• https://github.com/hifis-net/ansible-collection-toolkit
• https://galaxy.ansible.com/ui/repo/published/hifis/toolkit/

An Ansible Role that installs and configures the web-based open source user support/ticketing solution Zammad.

Note: This role does not install elasticsearch and postgresql server. See Dependencies.

Requirements

The below requirements are needed on the target host:

• cryptography >= 1.6.0

Role Variables

zammad_version: "6.2.0"

Zammad version to be installed.

zammad_release_channel: "stable"

Choose another release channel for the Zammad packages. Please refer to https://packager.io/gh/zammad/zammad for a complete list.

zammad_domain_name: "{{ ansible_fqdn }}"

Zammad's fully qualified domain name.

zammad_nginx_config_path: "/etc/nginx/sites-available/zammad.conf"

File path to Zammad's Nginx config.

zammad_ssl_cert_path: "/etc/ssl/certs/zammad_cert.pem"

File path to the SSL/TLS certificate which is used for HTTPS.

zammad_ssl_key_path: "/etc/ssl/private/zammad_key.pem"

File path to the SSL/TLS private key which is used for HTTPS.

zammad_ssl_cert:

Content of SSL/TLS certificate (required).

zammad_ssl_key:

Content of SSL/TLS private key (required).
Please note: In the special case, that you previously put an SSL keypair on the host, e.g. via Let's Encrypt, you must not configure the variables zammad_ssl_cert and zammad_ssl_key. Nevertheless, in each case the role will validate, if the SSL key pair is given under the paths zammad_ssl_key_path and zammad_ssl_cert_path are valid.

zammad_nginx_server_tokens: "off"

Enable or disable emitting nginx version information in error pages or in the Server response header field. Please read the nginx docs for further information.

zammad_nginx_additional_server_configs:
  - |
      server {
        listen 80;
        server_name zammad.example.com zammad-old.example.com;
        return 301 https://zammad.example.com$request_uri;
      }
  - |
      server {
        listen 443 ssl;

        # ... SSL configuration

        server_name zammad-old.example.com;
        return 301 https://zammad.example.com$request_uri;
      }

Configure additional server directives in the Nginx configuration. This allows to implement more use case specific adjustments, e.g. configuring multiple domains or the redirection of outdated domains to the most recent one.

elasticsearch_url: "http://localhost:9200"

Elasticsearch server address.

Dependencies

Zammad requires Elasticsearch and PostgreSQL database server. This role has been successfully tested together with the following roles:

• Elasticsearch - geerlingguy.elasticsearch
• PostgreSQL - geerlingguy.postgresql

Example Playbook

    - hosts: servers
      roles:
         - role: hifis.zammad
           become: yes

License

MIT

Author Information

This role was created in 2020 by HIFIS Software Services.

ansible-role-zammad's Issues

Rename default branch to main

Allow to optionally configure additional server directives in Nginx config

In order to give the end user more flexibility, e.g. for handling multiple domains, handling domain changes, it would be nice to allow to configure additional server directives in the Nginx configuration.

I'd like to implement this that way, that a user gets the opportunity to add a complete server directive list which is then put into the configuration.

Example

zammad_nginx_additional_servers:
  - |
      server {
        listen 80;
        server_name zammad.example.com zammad-old.example.com;
        return 301 https://zammad.example.com$request_uri;
      }
  - |
      server {
        listen 443;
        server_name zammad-old.example.com;
        return 301 https://zammad.example.com$request_uri;
      }
  

Unify the GitHub Actions workflow with other projects

Allow to disable Nginx version information

Currently, there is no option to prevent Nginx from sending its version number in the HTTP response. This can be configured via the server_tokens variable as described in the docs.

This can be solved by introducing a new configuration variable. It could be called zammad_nginx_server_tokens. As a default I suggest to set it to off. At the same time, this conifguration needs to be added to the Nginx configuration file: https://github.com/Helmholtz-UFZ/ansible-role-zammad/blob/83191ebdf7225067b30834ea9b36b8b597d55c9f/templates/nginx-zammad.conf.j2

Add CHANGELOG

Fix randomly failing CI jobs

Currently it happens that CI jobs randomly fail for no obvious reason.

See https://github.com/hifis-net/ansible-role-zammad/actions/runs/5449735660/jobs/9914276232#step:5:341.

{
  "...": "...",
  "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error",
  "rc": 0
}

Establish compatibility with Zammad >= 6.0

See https://zammad.com/de/releases/6-0 for details:

• Changes to Nginx config are required
• Redis will be installed as a mandatory dependency
• others?

Allow to specify SSL certificates via path only

In certain circumstances it is useful to be able to just reuse an existing private key and certificate already present on the machine. This can be especially useful, if one wants this role in combination with Let's Encrypt and certbot.

In principle, I suggest to use the given path only, if the variables zammad_ssl_key and zammad_ssl_cert are not containing a value.

Allow to install packages from the development channel

Currently, all packages are installed from the stable channel. It would be nice to be able to also configure the use of the develop channel for test instances.

The default will be stable. develop would have to be changed explicitly.

Relevant Lines

• https://github.com/Helmholtz-UFZ/ansible-role-zammad/blob/9c57a896c3b8f3f04fe3e54dc189181a515e7a68/tasks/install.yml#L16
• https://github.com/Helmholtz-UFZ/ansible-role-zammad/blob/9c57a896c3b8f3f04fe3e54dc189181a515e7a68/tasks/install.yml#L32

I would provide a PR.

Add CITATION.cff

Automate role import into Ansible Galaxy

Currently, it does not seem to automatically import new versions into Ansible galaxy. I would suggest to automate this procedure. According to the documentation of the Ansible Galaxy this could be done via Travis CI.

https://galaxy.ansible.com/docs/contributing/importing.html#import-roles-via-travis-ci

What do you think?

Update README

Add support for Ubuntu 22.04

Release version 2.0.0

Add Ubuntu 20.04 focal support

The role should support the latest Ubuntu LTS release focal fossa.