test: fix syntax for ansible lint

.forgejo/workflows/molecule.yml

@@ -0,0 +1,18 @@
+---
+on: [push]
+jobs:
+  lint:
+    runs-on: docker
+    container:
+      image: code.waks.be/nishiki/molecule:docker
+    steps:
+      - uses: actions/checkout@v3
+      - run: ansible-lint .
+      - run: yamllint .
+  molecule:
+    runs-on: docker
+    container:
+      image: code.waks.be/nishiki/molecule:docker
+    steps:
+      - uses: actions/checkout@v3
+      - run: molecule test

.gitignore

@@ -1 +1,2 @@
 .kitchen/*
+*.pyc

.gitlab-ci.yml

@@ -0,0 +1,10 @@
+---
+image: nishiki/molecule:docker
+
+before_script:
+  - molecule --version
+
+molecule:
+  stage: test
+  script:
+    - molecule test

.kitchen.yml

@@ -1,27 +0,0 @@
----
-driver:
-  name: docker_cli
-
-transport:
-  name: docker_cli
-
-provisioner:
-  name: ansible_playbook
-  hosts: localhost
-  require_ansible_repo: false
-  require_ansible_omnibus: false
-  require_chef_for_busser: true
-  ansible_verbose: false
-  ansible_inventory: ./test/integration/inventory
-
-platforms:
-  - name: debian-9
-    driver_config:
-      image: "nishiki/debian9:ansible-<%= ENV['ANSIBLE_VERSION'] ? ENV['ANSIBLE_VERSION'] : '2.7' %>"
-      command: /bin/systemd
-      volume:
-        - /sys/fs/cgroup:/sys/fs/cgroup:ro
-      security_opt: seccomp=unconfined
-
-suites:
-  - name: default

.travis.yml

@@ -1,28 +1,29 @@
 ---
 sudo: required
-language: ruby
+dist: bionic
+addons:
+  apt:
+    packages:
+      - python3
+      - python3-pip
+      - python3-setuptools
 
 env:
-  - ANSIBLE_VERSION=2.5
-  - ANSIBLE_VERSION=2.6
-  - ANSIBLE_VERSION=2.7
+  - ANSIBLE_VERSION=2.7.16
+  - ANSIBLE_VERSION=2.8.8
+  - ANSIBLE_VERSION=2.9.4
 
 services:
   - docker
 
 before_install:
-  - bundle install
-  - sudo pip install --upgrade pip
-  - sudo pip install yamllint
-  - sudo pip install ansible-lint
+  - sudo pip3 install ansible==${ANSIBLE_VERSION}
+  - sudo pip3 install molecule 'molecule[docker]' docker testinfra ansible-lint yamllint
   - git clone https://github.com/ansible/galaxy-lint-rules.git
 
 script:
-  - kitchen conv
-  - kitchen conv | grep changed=0
-  - kitchen verify
-  - ansible-lint -r galaxy-lint-rules/rules .
-  - yamllint .
+  - ansible --version
+  - molecule test
 
 notifications:
   webhooks: https://galaxy.ansible.com/api/v1/notifications/

.yamllint

@@ -2,11 +2,11 @@
 extends: default
 
 ignore: |
-  .kitchen/*
+  .kitchen*
   vendor/
+  .forgejo/
 
 rules:
   line-length:
     max: 120
     level: warning
-  truthy: false

CHANGELOG.md

@@ -3,12 +3,48 @@
 This project adheres to [Semantic Versioning](http://semver.org/).
 Which is based on [Keep A Changelog](http://keepachangelog.com/)
 
-## [Unreleased]
+## Unreleased
+
+### Fixed
+
+- fix: change gpg key
+
+## v2.1.0 - 2021-08-22
+
+### Added
+
+- test: add support debian 11
+
+### Fixed
+
+- fix: bug with multiple privileges
+
+### Changed
+
+- chore: use FQCN for module name
+- fix: replace no_log to loop label
+- test: use personal docker registry
+
+## v2.0.1 - 2020-03-28
+
+### Changed
+
+- fix: remove default value for mariadb_password
+- test: replace kitchen to molecule
+
+## v2.0.0 - 2019-06-05
+
+- breaking: remove support for ansible < 2.8
+- feat: add official repository
+- feat: remove unused users in init
+- feat: install database if datadir doesn't exist
+
+## v1.0.1 - 2019-03-16
 
-## [v1.0.1] - 2019-03-16
 - fix: add client-server option in default configuration
 - fix: install python-mysqldb package
 - test: add tests with travis-ci
 
-## [v1.0.0] - 2019-02-23
+## v1.0.0 - 2019-02-23
+
 - first version

Gemfile

@@ -1,8 +0,0 @@
-source 'https://rubygems.org'
-
-group :development do
-  gem 'kitchen-ansible'
-  gem 'kitchen-docker_cli'
-  gem 'rubocop', '0.50.0'
-  gem 'test-kitchen'
-end

README.md

@@ -1,39 +1,70 @@
 # Ansible role: MariaDB
-[![Version](https://img.shields.io/badge/latest_version-1.0.1-green.svg)](https://git.yaegashi.fr/nishiki/ansible-role-mariadb/releases)
-[![Build Status](https://travis-ci.org/nishiki/ansible-role-mariadb.svg?branch=master)](https://travis-ci.org/nishiki/ansible-role-mariadb)
-[![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](https://git.yaegashi.fr/nishiki/ansible-role-mariadb/src/branch/master/LICENSE)
+
+[![Version](https://img.shields.io/badge/latest_version-2.1.0-green.svg)](https://code.waks.be/nishiki/ansible-role-mariadb/releases)
+[![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](https://code.waks.be/nishiki/ansible-role-mariadb/src/branch/master/LICENSE)
+[![Build](https://code.waks.be/nishiki/ansible-role-mariadb/actions/workflows/molecule.yml/badge.svg?branch=main)](https://code.waks.be/nishiki/ansible-role-mariadb/actions?workflow=molecule.yml)
 
 Install and configure MariaDB
 
 ## Requirements
 
-* Ansible >= 2.7
-* Debian Stretch
+- Ansible >= 2.9
+- Debian
+  - Bullseye
+  - Bookworm
 
 ## Role variables
 
-- `mariadb_user` - login to connect on mariadb (default: `root`)
-- `mariadb_password` - password to connect on mariadb (default: `secret`)
-- `mariadb_master` - the server is master (default: `no`)
-- `mariadb_autorestart` - restart mariadb when the config change (default: `no`)
-- `mariadb_users` - array with the users to manage
+| Name                            | Type  | Required | Default | Comment                                |
+| ------------------------------- | ----- | -------- | ------- | -------------------------------------- |
+| mariadb_use_official_repository | bool  | no       | true    | use the official repository            |
+| mariadb_branch                  | str   | no       | 10.3    | the branch version to install          |
+| mariadb_user                    | str   | no       | root    | login to connect on mariadb            |
+| mariadb_password                | str   | yes      |         | password to connect on mariadb         |
+| mariadb_master                  | bool  | no       | false   | the server is master                   |
+| mariadb_autorestart             | bool  | no       | false   | restart mariadb when the config change |
+| mariadb_users                   | array | no       |         | the users to manage                    |
+| mariadb_databases               | array | no       |         | the databases to manage                |
+| mariadb_config                  | hash  | no       |         | extra options for configuration        |
+
+### mariadb_users
+
+| Name       | Type  | Required | Default | Comment                                                   |
+| ---------- | ----- | -------- | ------- | --------------------------------------------------------- |
+| name       | str   | yes      |         | the username                                              |
+| host       | str   | yes      |         | the mysql user host                                       |
+| password   | str   | yes      |         | the user password                                         |
+| privileges | array | no       |         | the privileges with this form `database.*:SELECT,UPDATE`) |
+| state      | str   | no       | present | if state is `absent` the user is deleted                  |
+
+Example:
 
 ```
 - name: johndoe
+  host: '%'
   password: supersecret
   privileges:
     - 'database.*:SELECT,UPDATE'
   state: present
 ```
 
-- `mariadb_databases` -  array with the databases to manage
+### mariadb_databases
+
+| Name  | Type | Required | Default | Comment                                      |
+| ----- | ---- | -------- | ------- | -------------------------------------------- |
+| name  | str  | yes      |         | the dabase name                              |
+| state | str  | no       | present | if state is `absent` the database is deleted |
+
+Example:
 
 ```
 - name: superprogram
   state: present
 ```
 
-- `mariadb_config` -  hash with mariadb configuration
+### mariadb_config
+
+Example:
 
 ```
   mysqld:
@@ -45,30 +76,31 @@ Install and configure MariaDB
 
 ```
 - hosts: server
+  vars:
+    mariadb_password: supersecret
+    mariadb_users:
+      - name: johndoe
+        host: '%'
+        password: usersecret
+        privileges:
+          - 'myappli.*:ALL'
+    mariadb_databases:
+      - name: myappli
+    mariadb_config:
+      server-id: 1
+      bind-address: 0.0.0.0
   roles:
     - mariadb
 ```
 
 ## Development
-### Test syntax with yamllint
 
-* install `python` and `python-pip`
-* install yamllint `pip install yamllint`
-* run `yamllint .`
+### Test with molecule and docker
 
-### Test syntax with ansible-lint
-
-* install `python` and `python-pip`
-* install yamllint `pip install ansible-lint`
-* run `ansible-lint .`
-
-### Tests with docker
-
-* install [docker](https://docs.docker.com/engine/installation/)
-* install ruby
-* install bundler `gem install bundler`
-* install dependencies `bundle install`
-* run the tests `kitchen test`
+- install [docker](https://docs.docker.com/engine/installation/)
+- install `python3` and `python3-pip`
+- install molecule and dependencies `pip3 install molecule molecule-docker docker ansible-lint pytest-testinfra yamllint`
+- run `molecule test`
 
 ## License
 

defaults/main.yml

@@ -1,8 +1,13 @@
 ---
+mariadb_use_official_repository: true
+mariadb_branch: 10.6
+mariadb_repository: |
+  deb http://mariadb.mirrors.ovh.net/MariaDB/repo/{{ mariadb_branch }}/debian {{ ansible_distribution_release }} main
+mariadb_repository_key_id: '0xF1656F24C74CD1D8'
+mariadb_repository_key_server: hkp://keyserver.ubuntu.com:80
 mariadb_user: root
-mariadb_password: secret
-mariadb_master: no
-mariadb_autorestart: no
+mariadb_master: false
+mariadb_autorestart: false
 mariadb_users: []
 mariadb_databases: []
 mariadb_config: {}

handlers/main.yml

@@ -1,6 +1,6 @@
 ---
-- name: restart mariadb
-  service:
+- name: Restart mariadb
+  ansible.builtin.service:
     name: mysql
     state: restarted
-  when: mariadb_autorestart
+  when: mariadb_autorestart|bool

meta/main.yml

@@ -1,16 +1,18 @@
 ---
 galaxy_info:
   role_name: mariadb
+  namespace: nishiki
   author: Adrien Waksberg
   company: Adrien Waksberg
   description: Install and configure mariadb
   license: Apache2
-  min_ansible_version: 2.7
+  min_ansible_version: "2.9"
 
   platforms:
     - name: Debian
       versions:
-        - stretch
+        - bullseye
+        - bookworm
 
   galaxy_tags:
     - database

molecule/default/converge.yml

@@ -1,12 +1,16 @@
 ---
-- hosts: localhost
-  connection: local
+- name: Converge
+  hosts: all
+  roles:
+    - ansible-role-mariadb
   vars:
+    mariadb_password: secret
     mariadb_autorestart: yes
     mariadb_master: yes
     mariadb_config:
       client-server: {}
       mysqld:
+        datadir: /opt/mariadb
         server-id: 5
         log-bin: mysql-bin
     mariadb_databases:
@@ -18,5 +22,7 @@
         privileges:
           - 'test.*:ALL'
 
-  roles:
-    - ansible-role-mariadb
+  pre_tasks:
+    - name: update apt cache
+      ansible.builtin.apt:
+        update_cache: true

molecule/default/molecule.yml

@@ -0,0 +1,24 @@
+---
+driver:
+  name: docker
+platforms:
+  - name: debian12
+    image: code.waks.be/nishiki/molecule:debian12
+    privileged: true
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
+    command: /bin/systemd
+    capabilities:
+      - SYS_ADMIN
+provisioner:
+  inventory:
+    host_vars:
+      debian12:
+        mariadb_use_official_repository: false
+lint: |
+  set -e
+  yamllint .
+  ansible-lint .
+verifier:
+  name: testinfra

molecule/default/tests/test_default.py

@@ -0,0 +1,49 @@
+import os, re
+import testinfra.utils.ansible_runner
+
+def test_packages(host):
+  for package_name in ['mariadb-server', 'python3-mysqldb']:
+    package = host.package(package_name)
+    assert package.is_installed
+
+def test_config_file(host):
+  config = host.file('/etc/mysql/my.cnf')
+  assert config.exists
+  assert config.is_file
+  assert config.user == 'root'
+  assert config.group == 'root'
+  assert config.mode == 0o644
+  assert config.contains('server-id = 5')
+
+def test_data_directory(host):
+  config = host.file('/opt/mariadb')
+  assert config.exists
+  assert config.is_directory
+  assert config.user == 'mysql'
+  assert config.group == 'root'
+  assert config.mode == 0o750
+
+def test_service(host):
+  service = host.service('mysql')
+  assert service.is_running
+  assert service.is_enabled
+
+def test_socket(host):
+  socket = host.socket('tcp://127.0.0.1:3306')
+  assert socket.is_listening
+
+def test_user_exists(host):
+  result = host.check_output('mysql -uroot -psecret -e "show grants for toto@\'%\'"')
+  assert re.search('toto.*%', result)
+
+def test_root_user(host):
+  result = host.check_output('mysql -uroot -psecret -e "select count(*) from mysql.user where user=\'root\'"')
+  assert '1' in result
+
+def test_grant_access(host):
+  result = host.check_output('mysql -uroot -psecret -e "show grants for toto@\'%\'"')
+  assert "GRANT ALL PRIVILEGES ON `test`.* TO `toto`@`%`" in result
+
+def test_logbin_enabled(host):
+  result = host.check_output('mysql -uroot -psecret -e "show variables where variable_name = \'log_bin\'"')
+  assert 'ON' in result

tasks/initdb.yml

@@ -0,0 +1,57 @@
+---
+- name: Create the data directory
+  ansible.builtin.file:
+    path: '{{ mariadb_full_config.mysqld.datadir }}'
+    owner: '{{ mariadb_full_config.mysqld.user }}'
+    group: root
+    mode: 0750
+    state: directory
+  tags: mariadb
+
+- name: Initialize database  # noqa no-changed-when
+  ansible.builtin.command:
+  args:
+    argv:
+      - mysql_install_db
+      - '--datadir={{ mariadb_full_config.mysqld.datadir }}'
+      - '--user={{ mariadb_full_config.mysqld.user }}'
+      - '--skip-name-resolve'
+      - '--no-defaults'
+  tags: mariadb
+
+- name: Start mariadb
+  ansible.builtin.service:
+    name: mysql
+    state: started
+  tags: mariadb
+
+- name: Wait mysql start
+  ansible.builtin.pause:
+    seconds: 5
+  tags: mariadb
+
+- name: Set root password  # noqa no-changed-when
+  ansible.builtin.command: 'mysqladmin -u root password {{ mariadb_password }}'
+  tags: mariadb
+
+- name: Remove anonymous users
+  community.mysql.mysql_user:
+    name: ''
+    host_all: true
+    state: absent
+    login_user: '{{ mariadb_user }}'
+    login_password: '{{ mariadb_password }}'
+  tags: mariadb
+
+- name: Remove root user without password
+  community.mysql.mysql_user:
+    name: root
+    host: '{{ item }}'
+    state: absent
+    login_user: '{{ mariadb_user }}'
+    login_password: '{{ mariadb_password }}'
+  loop:
+    - 127.0.0.1
+    - '::1'
+    - '{{ ansible_nodename }}'
+  tags: mariadb

tasks/main.yml

@@ -1,68 +1,79 @@
 ---
-- name: install package
-  package:
-    name: '{{ packages }}'
-  vars:
-    packages:
-      - mariadb-server
-      - python-mysqldb
+- name: Install dependencies packages
+  ansible.builtin.package:
+    name:
+      - gpg
+      - python3-mysqldb
   retries: 2
   register: result
   until: result is succeeded
   tags: mariadb
 
-- name: copy configuration file
-  template:
+- name: Install official repository
+  ansible.builtin.import_tasks: repo.yml
+  when: mariadb_use_official_repository|bool
+
+- name: Install package
+  ansible.builtin.package:
+    name:
+      - mariadb-server
+  retries: 2
+  register: result
+  until: result is succeeded
+  tags: mariadb
+
+- name: Copy configuration file
+  ansible.builtin.template:
     src: my.cnf.j2
-    dest: /etc/mysql/mariadb.cnf
+    dest: /etc/mysql/my.cnf
     owner: root
     group: root
     mode: 0644
-  notify: restart mariadb
+  notify: Restart mariadb
   tags: mariadb
 
-- name: enable and start the service
-  service:
+- name: Check if datadir exist
+  ansible.builtin.stat:
+    path: "{{ mariadb_full_config.mysqld.datadir }}"
+  register: st
+  tags: mariadb
+
+- name: Initialize the database
+  ansible.builtin.import_tasks: initdb.yml
+  when: not st.stat.exists
+
+- name: Enable and start the service
+  ansible.builtin.service:
     name: mysql
     state: started
-    enabled: yes
+    enabled: true
   tags: mariadb
 
-- name: remove anonymous users
-  mysql_user:
-    name: ''
-    host_all: yes
-    state: absent
-    login_user: '{{ mariadb_user }}'
-    login_password: '{{ mariadb_password }}'
+- name: Manage users
+  community.mysql.mysql_user:
+    name: "{{ item.name }}"
+    host: "{{ item.host }}"
+    password: "{{ item.password }}"
+    priv: "{{ item.privileges | default('') | join('/') }}"
+    state: "{{ item.state | default('present') }}"
+    login_user: "{{ mariadb_user }}"
+    login_password: "{{ mariadb_password }}"
+  loop: "{{ mariadb_users }}"
+  loop_control:
+    label: "{{ item.name }}@{{ item.host }}"
   run_once: true
-  no_log: true
-  when: mariadb_master
+  when: mariadb_master|bool
   tags: mariadb
 
-- name: manage users
-  mysql_user:
-    name: '{{ item.name }}'
-    host: '{{ item.host }}'
-    password: '{{ item.password }}'
-    priv: '{{ item.privileges|default("")|join(",") }}'
-    state: '{{ item.state|default("present") }}'
-    login_user: '{{ mariadb_user }}'
-    login_password: '{{ mariadb_password }}'
-  loop: '{{ mariadb_users }}'
+- name: Manage databases
+  community.mysql.mysql_db:
+    name: "{{ item.name }}"
+    state: "{{ item.state | default('present') }}"
+    login_user: "{{ mariadb_user }}"
+    login_password: "{{ mariadb_password }}"
+  loop: "{{ mariadb_databases }}"
+  loop_control:
+    label: "{{ item.name }}"
   run_once: true
-  no_log: true
-  when: mariadb_master
-  tags: mariadb
-
-- name: manage databases
-  mysql_db:
-    name: '{{ item.name }}'
-    state: '{{ item.state|default("present") }}'
-    login_user: '{{ mariadb_user }}'
-    login_password: '{{ mariadb_password }}'
-  loop: '{{ mariadb_databases }}'
-  run_once: true
-  no_log: true
-  when: mariadb_master
+  when: mariadb_master|bool
   tags: mariadb

tasks/repo.yml

@@ -0,0 +1,10 @@
+---
+- name: Add gpg key for mariadb repository
+  ansible.builtin.apt_key:
+    url: https://supplychain.mariadb.com/MariaDB-Server-GPG-KEY
+  tags: mariadb
+
+- name: Add official repo
+  ansible.builtin.apt_repository:
+    repo: "{{ mariadb_repository }}"
+  tags: mariadb

templates/my.cnf.j2

@@ -1,8 +1,8 @@
 # {{ ansible_managed }}
 
-{% for section, options in mariadb_full_config.iteritems() %}
+{% for section, options in mariadb_full_config.items() %}
 [{{section}}]
-{% for option, value in options.iteritems() %}
+{% for option, value in options.items() %}
 {{ option }}{% if not value is sameas true %} = {{ value }}{% endif %}
 
 {% endfor %}

test/integration/default/serverspec/default_spec.rb

@@ -1,56 +0,0 @@
-require 'serverspec'
-
-set :backend, :exec
-
-puts
-puts '================================'
-puts %x(ansible --version)
-puts '================================'
-
-%w[
-  mariadb-server
-  python-mysqldb
-].each do |name|
-  describe package(name) do
-    it { should be_installed }
-  end
-end
-
-describe file('/etc/mysql/mariadb.cnf') do
-  it { should be_file }
-  it { should be_mode 644 }
-  it { should be_owned_by 'root' }
-  it { should be_grouped_into 'root' }
-  it { should contain 'server-id = 5' }
-end
-
-describe service('mysql') do
-  it { should be_enabled }
-  it { should be_running.under('systemd') }
-end
-
-describe port(3306) do
-  it { should be_listening }
-end
-
-describe command('mysql -u root -e "show databases"') do
-  its(:exit_status) { should eq 0 }
-  its(:stdout) { should contain 'test' }
-end
-
-describe command('mysql -u root -e "select user, host from mysql.user"') do
-  its(:exit_status) { should eq 0 }
-  its(:stdout) { should contain(/toto.*%/) }
-end
-
-describe command('mysql -u root -e "show grants for toto@\'%\'"') do
-  its(:exit_status) { should eq 0 }
-  its(:stdout) do
-    should contain "GRANT ALL PRIVILEGES ON `test`.* TO 'toto'@'%'"
-  end
-end
-
-describe command('mysql -u root -e "show variables where variable_name = \'log_bin\'"') do
-  its(:exit_status) { should eq 0 }
-  its(:stdout) { should contain 'ON' }
-end

test/integration/inventory

@@ -1 +0,0 @@
-localhost