Fix SELinux behavior and tidy up installation (#156)

* moved SELinux related stuff to own file

- conditionally included only when SELinux enabled, fixes #28
- unification of the way how Python SELinux libs are installed on RedHat and Debian based systems

* simplified install tasks

- reduced number of tasks in installation.packages.yml to 3
- this utilizes the package module instead of apt, yum, zypper, ...
- replaced nginx_redhat_pkg, nginx_ubuntu_pkg, nginx_freebsd_pkg, nginx_suse_pkg which all hold the same content with a new variable
- new variable nginx_pkgs contains "nginx" by default but is still a list to allow users to configure further nginx related packages they want to install

* set SELinux boolean httpd_setrlimit to allow nginx setting the rlimit

- is necessary because this role forces the setting of worker_rlimit_nofile
- introduces the need of libsemanage-python/python-semanage but since installation of SELinux modules is conditional, this does not hurt

defaults/main.yml

@@ -1,15 +1,5 @@
 ---
-nginx_redhat_pkg:
-  - nginx
-
-nginx_ubuntu_pkg:
-  - python-selinux
-  - nginx
-
-nginx_freebsd_pkg:
-  - nginx
-
-nginx_suse_pkg:
+nginx_pkgs:
   - nginx
 
 nginx_install_epel_repo: True

tasks/installation.packages.yml

@@ -1,35 +1,15 @@
 ---
-- name: Install the selinux python module
-  package: name=libselinux-python state=present
-  when: ansible_os_family == "RedHat"
-
 - name: Install the epel packages
-  yum: name=epel-release state=present
+  package: name=epel-release state=present
   when: nginx_is_el|bool and nginx_install_epel_repo|bool
 
-- name: Install the nginx packages
-  yum: name={{ item }} state=present enablerepo={{ "nginx" if nginx_official_repo else "" }}
-  with_items: "{{ nginx_redhat_pkg }}"
-  when:  nginx_is_el|bool
+- name: Install the nginx packages from official repo
+  yum: name={{ item }} state=present enablerepo="nginx"
+  with_items: "{{ nginx_pkgs }}"
+  when: nginx_is_el|bool and nginx_official_repo
 
 - name: Install the nginx packages
   package: name={{ item }} state=present
-  with_items: "{{ nginx_redhat_pkg }}"
-  when: ansible_os_family == "RedHat" and not nginx_is_el|bool
-
-- name: Install the nginx packages
-  apt: name={{ item }} state=present
-  with_items: "{{ nginx_ubuntu_pkg }}"
+  with_items: "{{ nginx_pkgs }}"
   environment: "{{ nginx_env }}"
-  when: ansible_os_family == "Debian"
-
-- name: Install the nginx packages
-  pkgng: name={{ item }} state=present
-  with_items: "{{ nginx_freebsd_pkg }}"
-  environment: "{{ nginx_env }}"
-  when: ansible_os_family == "FreeBSD"
-
-- name: Install the nginx packages
-  zypper: name={{ item }} state=present
-  with_items: "{{ nginx_suse_pkg }}"
-  when: ansible_os_family == "Suse"
+  when: not nginx_official_repo

tasks/main.yml

@@ -1,4 +1,8 @@
 ---
+- include: selinux.yml
+  when: ansible_selinux and ansible_selinux.status == "enabled"
+  tags: [packages,selinux,nginx]
+
 - include: nginx-official-repo.yml
   when: nginx_official_repo == True
   tags: [packages,nginx]

tasks/selinux.yml

@@ -0,0 +1,17 @@
+---
+- name: Install the selinux python module
+  package: name={{ item }} state=present
+  with_items:
+    - libselinux-python
+    - libsemanage-python
+  when: ansible_os_family == "RedHat"
+
+- name: Install the selinux python module
+  package: name={{ item }} state=present
+  with_items:
+    - python-selinux
+    - python-semanage
+  when: ansible_os_family == "Debian"
+
+- name: Set SELinux boolean to allow nginx to set rlimit
+  seboolean: name=httpd_setrlimit state=yes persistent=yes