Update default nginx version to 1.24 - #43
Merged
Merged
Conversation
FrankApiyo
force-pushed
the
update-default-nginx-version-to-1.24
branch
8 times, most recently
from
May 3, 2024 09:44
8941357 to
83d6c79
Compare
FrankApiyo
force-pushed
the
update-default-nginx-version-to-1.24
branch
from
May 3, 2024 09:54
83d6c79 to
35219bb
Compare
Sites that use uwsgi_pass include `uwsgi_params` (e.g. the onadata API
nginx config), which requires the file to exist under the nginx config
directory. Add a task to copy a bundled uwsgi_params file into
{{ nginx_dir }}/uwsgi_params and restart nginx on change.
FrankApiyo
force-pushed
the
update-default-nginx-version-to-1.24
branch
from
June 30, 2026 12:19
3bc11a1 to
4c9ef0b
Compare
ngx_http_auth_request_module has shipped in nginx core since 1.5.4, so build it with the --with-http_auth_request_module configure flag instead of fetching the obsolete standalone source from mdounin.ru. That host frequently returns 503 and was the cause of the failing Molecule CI run. Also clear assorted CI warnings surfaced in the logs: - bump actions/checkout v2 -> v4 (Node 20 deprecation) - install nginx build deps in a single apt call (drops the squash_actions with_items deprecation) - replace `wget` shell tasks with the get_url module (openssl source and the libssl1.1 deb), removing the command/wget warnings
The GeoIP DB download/unzip tasks ran whenever the module was compiled in, even though nginx_geoip defaults to 'off'. That pulled deprecated databases from unreliable third-party hosts (centminmod.com now 403s CI runners, returning HTML that breaks gunzip). Gate the downloads and unarchive steps on nginx_geoip being enabled, and install the GeoIP libs via a single apt call (drops the squash_actions with_items deprecation).
- molecule: test on ubuntu 22.04/24.04/26.04 (default + install-only scenarios) using the pre-built geerlingguy systemd images with cgroupns_mode=host and a /tmp-rooted remote_tmp, which fixes the "~/.ansible/tmp" unreachable errors - package install for >=22.04 (the source build / bundled OpenSSL 1.0.2h does not compile on modern Ubuntu); derive the nginx.org repo codename from ansible_distribution_release instead of hardcoding focal - modernize apt key handling: fetch the nginx.org signing key into /etc/apt/keyrings and reference it via signed-by (apt-key is gone in 24.04+) - drop dead 18.04/20.04 hacks: the libssl1.1 deb downgrade, the OpenSSL 1.0.2h source path (http_ssl_module.yml), and the libssl1.1 source build dependency - meta: advertise jammy/noble/resolute
onaio/molecule-action pins molecule 3.0.4, whose docker driver does not pass cgroupns_mode, so systemd (cgroup v2) instances - every Ubuntu >=22.04 - came up UNREACHABLE. Run molecule directly on the ubuntu-latest runner with a current toolchain (molecule + molecule-plugins[docker] + pytest-testinfra), whose docker driver forwards cgroupns_mode, while keeping the testinfra verifier and existing tests. - workflow: install molecule/ansible/testinfra + community.docker, run yamllint/flake8 as explicit steps, then molecule test per scenario - molecule.yml: drop the now-removed top-level lint block, provisioner.lint, and the lint test-sequence step (lint runs in the workflow instead)
Modern molecule does not add the project's parent directory to the roles
path, so converge.yml's 'role: ansible-nginx' could not be found. Point
ANSIBLE_ROLES_PATH at ${MOLECULE_PROJECT_DIRECTORY}/.. (the checkout dir is
named ansible-nginx) plus ~/.ansible/roles for the galaxy dependencies.
The role's galaxy dependencies use modules from community.general (e.g. zypper), which ansible-core does not bundle, so syntax-check failed to resolve them. Install the full 'ansible' distribution (as the old molecule image did), which ships community.general/community.docker/ansible.posix.
Gate the uwsgi_params file behind nginx_uwsgi_app (default false) so it is only deployed for sites that use uwsgi_pass, rather than on every nginx host.
Set nginx_uwsgi_app: true in both converge playbooks so the role's own CI covers the uwsgi_params install, and assert /etc/nginx/uwsgi_params exists.
Default nginx_uwsgi_app to true so the uwsgi_params file is installed out of the box; consumers that don't serve a uWSGI app can set it to false.
The ssl on; directive it used to guard was removed (not valid in nginx 1.26),
leaving an empty {% if %}{% endif %} block. Remove the dead wrapper too.
Folds in #44.
ukanga
approved these changes
Jun 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TODO