commit 9e23d4eedaa24a7c54a7cb7630a6b829554143f3 parent 821d025d87ca6f618326f3955b538309caec1ffb Author: Florian Dold <dold@taler.net> Date: Fri, 31 Jul 2026 15:44:12 +0200 fix file modes, log format and the email address regex The systemd unit files were installed 0700 and the message templates with no explicit ownership at all; the challenger and KYC rule config files were installed executable. The "apm" nginx log format, used by all three challenger vhosts, quoted fields with U+201D instead of a double quote, so those access logs were not parseable. The challenger e-mail address restriction left the dot before the TLD unescaped, so it matched any character. Diffstat:
5 files changed, 19 insertions(+), 8 deletions(-)
diff --git a/roles/challenger/tasks/post-exchange.yml b/roles/challenger/tasks/post-exchange.yml @@ -29,7 +29,7 @@ dest: /etc/taler-exchange/conf.d/challenger.conf owner: taler-exchange-httpd group: taler-exchange-kyc - mode: "0744" + mode: "0644" - name: Ensure taler-exchange service is is restarted with new configuration service: diff --git a/roles/challenger/tasks/pre-exchange.yml b/roles/challenger/tasks/pre-exchange.yml @@ -219,7 +219,7 @@ dest: /etc/systemd/system/sms-challenger-httpd.service owner: root group: root - mode: "0700" + mode: "0644" - name: Create file for sms-challenger logs ansible.builtin.file: @@ -235,16 +235,25 @@ copy: src: etc/challenger/postal-message-template.txt dest: /etc/challenger/postal-message-template.txt + owner: root + group: root + mode: "0644" - name: Place SMS message template copy: src: etc/challenger/sms-message-template.txt dest: /etc/challenger/sms-message-template.txt + owner: root + group: root + mode: "0644" - name: Place email message template copy: src: etc/challenger/email-message-template.txt dest: /etc/challenger/email-message-template.txt + owner: root + group: root + mode: "0644" - name: Place postal-challenger systemd service file copy: @@ -252,13 +261,15 @@ dest: /etc/systemd/system/postal-challenger-httpd.service owner: root group: root - mode: "0700" + mode: "0644" - name: Place email-challenger systemd service file copy: src: etc/systemd/system/email-challenger-httpd.service dest: /etc/systemd/system/email-challenger-httpd.service - mode: "0700" + owner: root + group: root + mode: "0644" - name: Ensure SMS challenger service is enabled and started ansible.builtin.systemd: diff --git a/roles/challenger/templates/etc/challenger/challenger-email.conf.j2 b/roles/challenger/templates/etc/challenger/challenger-email.conf.j2 @@ -38,7 +38,7 @@ ADDRESS_TYPE = email ADDRESS_HINT = "user@example.com" # What addresses are allowed. -ADDRESS_RESTRICTIONS = {"CONTACT_EMAIL":{"hint":"valid e-mail address required","regex":"^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+.[a-zA-Z0-9-.]+$"}} +ADDRESS_RESTRICTIONS = {"CONTACT_EMAIL":{"hint":"valid e-mail address required","regex":"^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\\.[a-zA-Z0-9-.]+$"}} [challengerdb-postgres] #The connection string the plugin has to use for connecting to the database diff --git a/roles/exchange_tops/tasks/main.yml b/roles/exchange_tops/tasks/main.yml @@ -29,7 +29,7 @@ dest: /etc/taler-exchange/conf.d/kyc-rules.conf owner: root group: root - mode: "0744" + mode: "0644" - name: Place taler-exchange denominations config ansible.builtin.template: diff --git a/roles/webserver/files/etc/nginx/conf.d/log-format-apm.conf b/roles/webserver/files/etc/nginx/conf.d/log-format-apm.conf @@ -1,6 +1,6 @@ # Define log format where we also log latencies. -log_format apm '”$time_local” client=$remote_addr ' - 'method=$request_method request=”$request” ' +log_format apm '"$time_local" client=$remote_addr ' + 'method=$request_method request="$request" ' 'request_length=$request_length ' 'status=$status bytes_sent=$bytes_sent ' 'body_bytes_sent=$body_bytes_sent '