feat: adapt on nginx versionning

.gitea/workflows/cd.yaml

@@ -3,7 +3,7 @@ name: Continuous Delivery
 on:
   push:
     tags:
-      - "v[0-9]+.[0-9]+.[0-9]+"
+      - "**"
 
 jobs:
   build_n_upload:

Makefile

@@ -1,12 +1,17 @@
 NAME = netoik-rp
-VERSION = $(shell git describe --abbrev=0)
-RELEASE = $(shell git rev-parse --short HEAD)
+TAG = $(shell git describe --abbrev=0)
+TAG_SPLIT = $(subst -, ,$(TAG))
+EPOCH = $(word 1,$(TAG_SPLIT))
+VERSION = $(word 2,$(TAG_SPLIT))
+RELEASE = $(word 3,$(TAG_SPLIT))
+RELEASE_SPLIT = $(subst ., ,$(RELEASE))
+RELEASE_NGINX = $(word 1,$(RELEASE_SPLIT)).$(word 3,$(RELEASE_SPLIT))
 ARCH = noarch
 OWNER = netoik
 SUMMARY = "Netoïk Reverse Proxy"
 LICENSE = "MIT"
 URL = "https://git.netoik.io/$(OWNER)/$(NAME)"
-SOURCE0 = "$(NAME)-$(VERSION)-$(RELEASE).tar.gz"
+SOURCE0 = "$(NAME)-$(EPOCH)-$(VERSION)-$(RELEASE).tar.gz"
 
 RPM_RPMDIR = $(shell rpm --eval '%{_rpmdir}')
 RPM_SBINDIR = $(shell rpm --eval '%{_sbindir}')
@@ -19,12 +24,21 @@ RPM_BUILD_PATH = $(RPM_RPMDIR)/$(ARCH)/$(NAME)-$(VERSION)-$(RELEASE).$(ARCH).rpm
 
 .PHONY: help
 help:
-	@grep -E '^[a-zA-Z0-9_-]+:.*?## .*' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
+	@grep -E '^[a-zA-Z0-9_-]+:.*?## .*' $(MAKEFILE_LIST) | \
+	    awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
 
 .PHONY: name
 name:  ## Show project name
 	@echo "$(NAME)"
 
+.PHONY: tag
+tag:  ## Show last tag
+	@echo "$(TAG)"
+
+.PHONY: epoch
+epoch:  ## Show project epoch
+	@echo "$(EPOCH)"
+
 .PHONY: version
 version:  ## Show current project version
 	@echo "$(VERSION)"
@@ -33,6 +47,10 @@ version:  ## Show current project version
 release:  ## Show current project release
 	@echo "$(RELEASE)"
 
+.PHONY: release_nginx
+release_nginx:  ## Show nginx release
+	@echo "$(RELEASE_NGINX)"
+
 .PHONY: arch
 arch:  ## Show rpm arch target
 	@echo "$(ARCH)"
@@ -57,7 +75,7 @@ url:  ## Show project homepage URL
 source0:  ## Show rpm source0 file name
 	@echo "$(SOURCE0)"
 
-$(RPM_TARBALL_PATH): *
+$(RPM_TARBALL_PATH):
 	git archive --format=tar.gz \
 	            --output="$@" \
 	            --prefix="$(NAME)-$(VERSION)/" \
@@ -70,19 +88,37 @@ tarball: $(RPM_TARBALL_PATH)  ## Build rpm tarball
 .PHONY: install
 install:  ## Install files into rpm dest (requires env var DESTDIR)
 	@if [ -z "$(DESTDIR)" ]; then \
-		printf "[CRITICAL] Missing env var DESTDIR\n[CRITICAL] This command is designed to be called by rpmbuild only!\n" 1>&2; \
+		printf "[CRITICAL] Missing env var DESTDIR\n" 1>&2; \
+		printf "[CRITICAL] This command is designed to be called by rpmbuild only!\n" 1>&2; \
 		exit 1; \
 	fi
-	install --mode=755 --directory $(DESTDIR)$(RPM_SYSCONFDIR)/nginx/conf.d $(DESTDIR)$(RPM_SYSCONFDIR)/certbot $(DESTDIR)$(RPM_UNITDIR) $(DESTDIR)$(RPM_SBINDIR)
-	install --mode=644 --target-directory=$(DESTDIR)$(RPM_SYSCONFDIR)/nginx/conf.d files/nginx/0_security.conf files/nginx/z_default.conf
-	install --mode=600 --target-directory=$(DESTDIR)$(RPM_SYSCONFDIR)/certbot files/certbot/ovh.ini
-	install --mode=644 --target-directory=$(DESTDIR)$(RPM_UNITDIR) files/systemd/certbot-renew.service files/systemd/certbot-renew.timer
-	install --mode=755 --target-directory=$(DESTDIR)$(RPM_SBINDIR) files/sbin/certbot_renew
+	install --mode=755 \
+	        --directory $(DESTDIR)$(RPM_SYSCONFDIR)/nginx/conf.d \
+	                    $(DESTDIR)$(RPM_SYSCONFDIR)/certbot \
+	                    $(DESTDIR)$(RPM_UNITDIR) \
+	                    $(DESTDIR)$(RPM_SBINDIR)
+	install --mode=644 \
+	        --target-directory=$(DESTDIR)$(RPM_SYSCONFDIR)/nginx/conf.d \
+	        files/nginx/0_security.conf files/nginx/z_default.conf
+	install --mode=600 \
+	        --target-directory=$(DESTDIR)$(RPM_SYSCONFDIR)/certbot \
+	        files/certbot/ovh.ini
+	install --mode=644 \
+	        --target-directory=$(DESTDIR)$(RPM_UNITDIR) \
+	        files/systemd/certbot-renew.service \
+	        files/systemd/certbot-renew.timer
+	install --mode=755 \
+	        --target-directory=$(DESTDIR)$(RPM_SBINDIR) \
+	        files/sbin/certbot_renew
 
 .PHONY: upload
 upload:  ## Upload rpm package to Gitea repository (requires env var PKG_TOKEN)
 	@if [ -z "$(PKG_TOKEN)" ]; then \
-		printf "[CRITICAL] Missing env var PKG_TOKEN\n[CRITICAL] This command is designed to be called by Gitea Actions only!\n" 1>&2; \
+		printf "[CRITICAL] Missing env var PKG_TOKEN\n" 1>&2; \
+		printf "[CRITICAL]This command is designed to be called by Gitea Actions only!\n" 1>&2; \
 		exit 1; \
 	fi
-	curl --fail-with-body --upload-file "$(RPM_BUILD_PATH)" --user "$(OWNER):$(PKG_TOKEN)" https://git.netoik.io/api/packages/$(OWNER)/rpm/upload
+	curl --fail-with-body \
+	     --upload-file "$(RPM_BUILD_PATH)" \
+	     --user "$(OWNER):$(PKG_TOKEN)" \
+	     https://git.netoik.io/api/packages/$(OWNER)/rpm/upload

README.md

@@ -1,4 +1,4 @@
-# Netoïk reverse proxy ![badge](https://git.netoik.io/samuel/netoik-rp/actions/workflows/ci.yaml/badge.svg)
+# Netoïk reverse proxy ![badge](https://git.netoik.io/netoik/netoik-rp/actions/workflows/ci.yaml/badge.svg)
 
 Build an RPM package which will install several tools.
 
@@ -11,7 +11,7 @@ Build an RPM package which will install several tools.
 - `Certbot` certificates with:
     - ovh configuration to renew certs
     - a command tool certbot_renew
-    - a systemctl certbot renew timer
+    - a systemctl Certbot renew timer
 
 
 # Development
@@ -32,7 +32,7 @@ A `Makefile` is integrated to let you run some basic commands.
   make tarball 
   ```
   
-- Build an rpm package:
+- Build a rpm package:
   ```shell
   rpmbuild -ba netoik-rp.spec
   ```
@@ -75,10 +75,10 @@ Some commands to deploy the RPM package on server
   dnf search --showduplicates netoik-rp
   ```
 
-- Create certbot ovh credentials here: 
+- Create Certbot ovh credentials here: 
   [www.ovh.com/auth/api/createToken](https://www.ovh.com/auth/api/createToken)
 
-- Setup environemnt file (fill values):
+- Setup environment file (fill values):
   ```shell
   cat > ~/.netoik-rp.env << EOF
   OVH_ENDPOINT=""
@@ -98,7 +98,7 @@ Some commands to deploy the RPM package on server
   set +a
   ```
 
-- Install or upgrade without certbot (for testing environment)
+- Install or upgrade without Certbot (for testing environment)
   ```shell
   SKIP_CERTBOT=true dnf --nogpgcheck --refresh --assumeyes --best install netoik-rp
   ```

files/nginx/0_security.conf

@@ -16,15 +16,15 @@ resolver                     127.0.0.1;
 # see: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html
 # And Nextcloud doc
 # see: https://docs.nextcloud.com/server/31/admin_manual/installation/harden_server.html
-add_header                   Strict-Transport-Security            "max-age=63072000; includeSubDomains; preload;"                                      always;
-add_header                   X-Frame-Options                      "sameorigin"                                                                         always;
-add_header                   X-XSS-Protection                     "1;mode=block"                                                                       always;
-add_header                   X-Content-Type-Options               "nosniff"                                                                            always;
-add_header                   X-Permitted-Cross-Domain-Policies    "none"                                                                               always;
-add_header                   Referrer-Policy                      "strict-origin-when-cross-origin"                                                    always;
+add_header                   Strict-Transport-Security            "max-age=63072000; includeSubDomains; preload;"                                            always;
+add_header                   X-Frame-Options                      "sameorigin"                                                                               always;
+add_header                   X-XSS-Protection                     "1;mode=block"                                                                             always;
+add_header                   X-Content-Type-Options               "nosniff"                                                                                  always;
+add_header                   X-Permitted-Cross-Domain-Policies    "none"                                                                                     always;
+add_header                   Referrer-Policy                      "strict-origin-when-cross-origin"                                                          always;
 add_header                   Content-Security-Policy              "default-src 'self' 'unsafe-inline' data:; frame-ancestors 'self'; form-action 'self';"    always;
-add_header                   Cross-Origin-Opener-Policy           "same-origin"                                                                        always;
-add_header                   Cross-Origin-Resource-Policy         "same-site"                                                                          always;
-add_header                   Permissions-Policy                   "geolocation=(), camera=(), microphone=()"                                           always;
-add_header                   Server                               "webserver"                                                                          always;
-add_header                   X-Robots-Tag                         "noindex, nofollow"                                                                  always;
+add_header                   Cross-Origin-Opener-Policy           "same-origin"                                                                              always;
+add_header                   Cross-Origin-Resource-Policy         "same-site"                                                                                always;
+add_header                   Permissions-Policy                   "geolocation=(), camera=(), microphone=()"                                                 always;
+add_header                   Server                               "webserver"                                                                                always;
+add_header                   X-Robots-Tag                         "noindex, nofollow"                                                                        always;

netoik-rp.spec

@@ -1,8 +1,10 @@
 %define debug_package %{nil}
 
 Name:           %(make name)
+Epoch:          %(make epoch)
 Version:        %(make version)
 Release:        %(make release)
+
 Summary:        %(make summary)
 License:        %(make license)
 URL:            %(make url)
@@ -10,7 +12,13 @@ URL:            %(make url)
 Source0:        %(make source0)
 Buildarch:      %(make arch)
 BuildRequires:  make
-Requires:       nginx python3 python-devel (augeas-devel or augeas-libs) gcc openssl
+
+Requires:       nginx = %{epoch}:%{version}-%(make release_nginx)
+Requires:       python3
+Requires:       python-devel
+Requires:       (augeas-devel or augeas-libs)
+Requires:       gcc
+Requires:       openssl
 
 %description
 Install the reverse proxy called nginx with a predefined configuration and with TLS certificates attached to netoik.io
@@ -45,12 +53,24 @@ if [ -z $SKIP_CERTBOT ]; then
 
 	# Create certbot certificates
 	if ! certbot certificates --cert-name netoik.io | grep --quiet netoik.io; then
-		certbot certonly --cert-name netoik.io --non-interactive --agree-tos --email samuel.campos@netoik.io --dns-ovh --dns-ovh-credentials %{_sysconfdir}/certbot/ovh.ini -d *.netoik.io -d *.samuel-campos.fr
+		certbot certonly --cert-name netoik.io \
+		                 --non-interactive \
+		                 --agree-tos \
+		                 --email samuel.campos@netoik.io \
+		                 --dns-ovh --dns-ovh-credentials %{_sysconfdir}/certbot/ovh.ini \
+		                 -d *.netoik.io \
+		                 -d *.samuel-campos.fr
 	fi
 else
 	# Skipping certbot, so create self-signed certificate
 	mkdir --parents /etc/letsencrypt/live/netoik.io
-	openssl req -newkey rsa:4096 -nodes -keyout /etc/letsencrypt/live/netoik.io/privkey.pem -x509 -days 365 -out /etc/letsencrypt/live/netoik.io/fullchain.pem -subj "/C=US/ST=State/L=City/O=Organization/OU=Department/CN=netoik.io"
+	openssl req -newkey rsa:4096 \
+	            -nodes \
+	            -keyout /etc/letsencrypt/live/netoik.io/privkey.pem \
+	            -x509 \
+	            -days 365 \
+	            -out /etc/letsencrypt/live/netoik.io/fullchain.pem \
+	            -subj "/C=US/ST=State/L=City/O=Organization/OU=Department/CN=netoik.io"
 fi
 
 # Create ssl dh params if not already exists
@@ -66,14 +86,14 @@ systemctl restart nginx.service certbot-renew.timer
 %postun
 # Remove folders after uninstall
 if [ $1 == 0 ]; then
-  /opt/certbot/bin/certbot delete --cert-name netoik.io --non-interactive
+	/opt/certbot/bin/certbot delete --cert-name netoik.io --non-interactive
 	rm --recursive --force /opt/certbot
-  rm --recursive --force %{_sysconfdir}/certbot
+	rm --recursive --force %{_sysconfdir}/certbot
 fi
 
 %files
-%attr(644, root, root) %{_sysconfdir}/nginx/conf.d/0_security.conf
-%attr(644, root, root) %{_sysconfdir}/nginx/conf.d/z_default.conf
+%config %attr(644, root, root) %{_sysconfdir}/nginx/conf.d/0_security.conf
+%config %attr(644, root, root) %{_sysconfdir}/nginx/conf.d/z_default.conf
 
 %attr(755, root, root) %dir %{_sysconfdir}/certbot
 %attr(600, root, root) %{_sysconfdir}/certbot/ovh.ini