diff options
21 files changed, 265 insertions, 83 deletions
diff --git a/ansible/group_vars/all/sz_ds.yml b/ansible/group_vars/all/sz_ds.yml new file mode 100644 index 0000000..2f1d235 --- /dev/null +++ b/ansible/group_vars/all/sz_ds.yml @@ -0,0 +1,10 @@ +$ANSIBLE_VAULT;1.1;AES256 +38623764363231303163656636386339653034663164353139393033356362633731336666653337 +3935633730626438393031373564313630643266383761650a653766363761313639663739373034 +62326664633231323063386530386137616138313563663665393833633337316366653438326636 +6564386334646563330a386133363466633533373238396364363566383166356333363062623234 +32653035306538616232656261346237306634346165333032613463636533643036363733383535 +30346265336361653866643665303164656566303439396563636664303762666562653763363330 +36663336346431623032353039396132383065323131306434343762653162643536313939623430 +31323436343663346537653433306438663537653165633530383231373234326534346135366335 +65653739646332363033313930383766393161343032653930323166343537323863 diff --git a/ansible/host_vars/knot.yml b/ansible/host_vars/knot.yml index ec97b6a..f7bc64a 100644 --- a/ansible/host_vars/knot.yml +++ b/ansible/host_vars/knot.yml @@ -1,9 +1,11 @@ lxc_containers: sz-prod: ipv4: - address: 10.0.3.3/24 + address: 10.0.3.3 + netmask: 24 gateway: 10.0.3.1 sz-test: ipv4: - address: 10.0.3.4/24 + address: 10.0.3.4 + netmask: 24 gateway: 10.0.3.1 diff --git a/ansible/host_vars/sz-prod/main.yml b/ansible/host_vars/sz-prod/main.yml new file mode 100644 index 0000000..88da296 --- /dev/null +++ b/ansible/host_vars/sz-prod/main.yml @@ -0,0 +1 @@ +sz_ds_env: sz-prod diff --git a/ansible/host_vars/sz-prod/sz_ds_secret.yml b/ansible/host_vars/sz-prod/sz_ds_secret.yml new file mode 100644 index 0000000..c14eac2 --- /dev/null +++ b/ansible/host_vars/sz-prod/sz_ds_secret.yml @@ -0,0 +1,11 @@ +$ANSIBLE_VAULT;1.1;AES256 +66656333353364366431623463613930373331333161313736306365623738613738353734333530 +3163653733313734663935613033623637393861356237310a323034396266373862323535633666 +35623963386536303637336337653637346262376634613065653763653735653532353331386233 +3863383365656166330a643666366138343734393833383337613530653462366361663764303862 +65636137333036633637663831613535316161303838616434343162383439616338313336643930 +64623534373062346434643436386230393437656262333435643131333938666337623339623636 +35636635323037316163346130643531633366663266303935303138393464643363313136616137 +63303531643633393131643362333565306430393734346435353730363561343736363139326261 +39653066363161633436343666313734613834653566633831353566373562323162376365653961 +3735313062356662356262663036633863376534663239363765 diff --git a/ansible/host_vars/sz-test/main.yml b/ansible/host_vars/sz-test/main.yml new file mode 100644 index 0000000..3f1cd48 --- /dev/null +++ b/ansible/host_vars/sz-test/main.yml @@ -0,0 +1 @@ +sz_ds_env: sz-test diff --git a/ansible/knot.yml b/ansible/knot.yml index 05207b8..4821271 100644 --- a/ansible/knot.yml +++ b/ansible/knot.yml @@ -14,3 +14,7 @@ import_role: name=lxc-host tags: lxc-host become: true + - name: knot-apache + import_role: name=knot-apache + tags: knot-apache + become: true diff --git a/ansible/roles/java8/handlers/main.yml b/ansible/roles/java8/handlers/main.yml index 0298ff9..90bca76 100644 --- a/ansible/roles/java8/handlers/main.yml +++ b/ansible/roles/java8/handlers/main.yml @@ -1,5 +1,5 @@ --- -- name: update apt cache +- name: apt update become: yes apt: update_cache: yes diff --git a/ansible/roles/knot-apache/tasks/main.yml b/ansible/roles/knot-apache/tasks/main.yml new file mode 100644 index 0000000..a3d1be6 --- /dev/null +++ b/ansible/roles/knot-apache/tasks/main.yml @@ -0,0 +1,21 @@ +- name: /etc/apache2/sites-enabled/{{ item.hostname }}.trygvis.io.conf + template: + src: etc/apache2/sites-enabled/sz-ds.trygvis.io.conf + dest: /etc/apache2/sites-enabled/{{ item.hostname }}.trygvis.io.conf + with_items: &backends + - hostname: sz + backend: sz-prod +# - hostname: sz-test +# backend: sz-test + +- name: "mkdir /var/www/{{ item.hostname }}.trygvis.io" + file: + dest: "/var/www/{{ item.hostname }}.trygvis.io" + state: directory + with_items: *backends + +- name: "mkdir /var/www/{{ item.hostname }}.trygvis.io/htdocs" + file: + dest: "/var/www/{{ item.hostname }}.trygvis.io/htdocs" + state: directory + with_items: *backends diff --git a/ansible/roles/knot-apache/templates/etc/apache2/sites-enabled/sz-ds.trygvis.io.conf b/ansible/roles/knot-apache/templates/etc/apache2/sites-enabled/sz-ds.trygvis.io.conf new file mode 100644 index 0000000..0172ff5 --- /dev/null +++ b/ansible/roles/knot-apache/templates/etc/apache2/sites-enabled/sz-ds.trygvis.io.conf @@ -0,0 +1,31 @@ +# Ansible +<IfModule mod_ssl.c> +<VirtualHost *:443> + ServerAdmin root@trygvis.io + ServerName {{ item.hostname }}.trygvis.io + + LogLevel warn + ErrorLog ${APACHE_LOG_DIR}/{{ item.hostname }}.trygvis.io-error.log + CustomLog ${APACHE_LOG_DIR}/{{ item.hostname }}.trygvis.io-access.log combined + + DocumentRoot /var/www/{{ item.hostname }}.trygvis.io/htdocs + <Directory /> + Options FollowSymLinks + AllowOverride None + </Directory> + <Directory /var/www/{{ item.hostname }}.trygvis.io/htdocs/> + Options Indexes FollowSymLinks MultiViews + AllowOverride None + Order allow,deny + allow from all + </Directory> + + ProxyTimeout 600 + ProxyPreserveHost On + ProxyPass / http://{{ lxc_containers[item.backend].ipv4.address }}:5000/ + + SSLCertificateFile /etc/letsencrypt/live/{{ item.hostname }}.trygvis.io/fullchain.pem + SSLCertificateKeyFile /etc/letsencrypt/live/{{ item.hostname }}.trygvis.io/privkey.pem + Include /etc/letsencrypt/options-ssl-apache.conf +</VirtualHost> +</IfModule> diff --git a/ansible/roles/lxc-host/tasks/main.yml b/ansible/roles/lxc-host/tasks/main.yml index a043d4c..676e27e 100644 --- a/ansible/roles/lxc-host/tasks/main.yml +++ b/ansible/roles/lxc-host/tasks/main.yml @@ -6,7 +6,7 @@ lineinfile: path: "/var/lib/lxc/{{ item.key }}/config" regexp: "lxc.network.ipv4 *=" - line: "lxc.network.ipv4 = {{ item.value.ipv4.address }}" + line: "lxc.network.ipv4 = {{ item.value.ipv4.address }}/{{ item.value.ipv4.netmask }}" with_dict: "{{ lxc_containers }}" - name: Set IPv4 gateway lineinfile: diff --git a/ansible/roles/lxc-machine/tasks/main.yml b/ansible/roles/lxc-machine/tasks/main.yml index b4f4aee..e75dcd9 100644 --- a/ansible/roles/lxc-machine/tasks/main.yml +++ b/ansible/roles/lxc-machine/tasks/main.yml @@ -1,17 +1,3 @@ -- name: system setup - tags: - - packages - block: - - name: misc packages - apt: - name: "{{ item }}" - install_recommends: no - with_items: - - systemd-cron - - ca-certificates - - unzip - - sudo - - name: disable ipv6 tags: - disable-ipv6 @@ -32,4 +18,19 @@ ff02::1 ip6-allnodes ff02::2 ip6-allrouters -# TODO: postfix client +- name: system setup + tags: + - packages + block: + - name: misc packages + apt: + name: "{{ item }}" + install_recommends: no + with_items: + - systemd-cron + - ca-certificates + - unzip + - sudo + - vim + - less + - ack diff --git a/ansible/roles/sz-ds/files/etc/systemd/system/sz-ds.service b/ansible/roles/sz-ds/files/etc/systemd/system/sz-ds.service new file mode 100644 index 0000000..5e55de4 --- /dev/null +++ b/ansible/roles/sz-ds/files/etc/systemd/system/sz-ds.service @@ -0,0 +1,14 @@ +[Unit] +After=network.target postgresql.service + +[Service] +ExecStart=/opt/sz-ds/src/SweetzpotCentral/infrastructure/run-data-server +WorkingDirectory=/opt/sz-ds +KillMode=process +Restart=on-failure +User=sz-ds +Group=sz-ds +EnvironmentFile=/etc/sz-ds/env.conf + +[Install] +WantedBy=multi-user.target diff --git a/ansible/roles/sz-ds/handlers/main.yml b/ansible/roles/sz-ds/handlers/main.yml new file mode 100644 index 0000000..846f076 --- /dev/null +++ b/ansible/roles/sz-ds/handlers/main.yml @@ -0,0 +1,5 @@ +- name: restart sz-ds + service: + name: sz-ds + state: restarted + diff --git a/ansible/roles/sz-ds/tasks/flyway.yml b/ansible/roles/sz-ds/tasks/flyway.yml new file mode 100644 index 0000000..c34ef44 --- /dev/null +++ b/ansible/roles/sz-ds/tasks/flyway.yml @@ -0,0 +1,30 @@ +- name: mkdir /opt/sz-ds/flyway + file: + state: directory + path: /opt/sz-ds/flyway +- template: + src: opt/sz-ds/bin/flyway.j2 + dest: /opt/sz-ds/bin/flyway + become: no +# mode: a=rx +- name: /etc/sz-ds/flyway.conf + tags: update-password + file: + dest: /etc/sz-ds/flyway.conf + content: | + flyway.url=jdbc:postgresql://localhost/sz-ds + flyway.user=sz-ds-flyway + flyway.password={{ sz_ds_secret.db_password_flyway }} + + flyway.locations=filesystem:/opt/sz-ds/src/SweetzpotCentral/data-server/migrations + flyway.schemas=public + +- name: Download and extract Flyway {{ flyway_version }} + unarchive: + src: "https://repo1.maven.org/maven2/org/flywaydb/flyway-commandline/{{ flyway_version }}/flyway-commandline-{{ flyway_version }}.zip" + dest: /opt/sz-ds/flyway + creates: "/opt/sz-ds/flyway/flyway-{{ flyway_version }}" + remote_src: yes +- file: + path: "/opt/sz-ds/flyway/flyway-{{ flyway_version }}/flyway" + mode: a=rx diff --git a/ansible/roles/sz-ds/tasks/main.yml b/ansible/roles/sz-ds/tasks/main.yml index 9e55292..559937c 100644 --- a/ansible/roles/sz-ds/tasks/main.yml +++ b/ansible/roles/sz-ds/tasks/main.yml @@ -4,8 +4,10 @@ name: "{{ item }}" install_recommends: no with_items: + - git - python-psycopg2 - python3-psycopg2 + - virtualenv - name: accounts for sz-ds tags: user @@ -17,12 +19,18 @@ createhome: no home: /opt/sz-ds system: yes - - file: + - name: mkdir /etc/sz-ds + file: + state: directory + path: /etc/sz-ds + - name: mkdir /opt/sz-ds + file: state: directory path: /opt/sz-ds owner: sz-ds mode: u=rwx,go= - - file: + - name: mkdir /opt/sz-ds/bin + file: state: directory path: /opt/sz-ds/bin - copy: @@ -31,57 +39,16 @@ - name: flyway for sz-ds tags: flyway - block: - - name: mkdir /opt/sz-ds/flyway - file: - state: directory - path: /opt/sz-ds/flyway - - template: - src: opt/sz-ds/bin/flyway.j2 - dest: /opt/sz-ds/bin/flyway - mode: a=rx - - name: Download and extract Flyway {{ flyway_version }} - unarchive: - src: "https://repo1.maven.org/maven2/org/flywaydb/flyway-commandline/{{ flyway_version }}/flyway-commandline-{{ flyway_version }}.zip" - dest: /opt/sz-ds/flyway - creates: "/opt/sz-ds/flyway/flyway-{{ flyway_version }}" - remote_src: yes - - file: - path: "/opt/sz-ds/flyway/flyway-{{ flyway_version }}/flyway" - mode: a=rx - # flyway.conf is created later + include: flyway.yml + - name: sz-ds database tags: sz-ds-pg become: yes become_user: postgres vars: ansible_ssh_pipelining: true - block: - - name: sz-ds - postgresql_user: - name: sz-ds - role_attr_flags: "NOLOGIN" - - name: sz-ds-flyway - tags: update-password - postgresql_user: - name: sz-ds-flyway - password: "{{ sz_ds_secret.db_password_flyway }}" - encrypted: yes - - name: sz-ds-web - tags: update-password - postgresql_user: - name: sz-ds-web - password: "{{ sz_ds_secret.db_password_web }}" - encrypted: yes - - name: sz-ds db - postgresql_db: - name: "sz-ds" - encoding: "utf-8" - owner: "sz-ds" - - postgresql_privs: - database: sz-ds - state: present - privs: USAGE - type: schema - objs: public - roles: sz-ds-web,sz-ds-flyway + include: sz-ds-pg.yml + +- name: sz-ds app + tags: sz-ds-app + include: sz-ds-app.yml diff --git a/ansible/roles/sz-ds/tasks/sz-ds-app.yml b/ansible/roles/sz-ds/tasks/sz-ds-app.yml new file mode 100644 index 0000000..78e300c --- /dev/null +++ b/ansible/roles/sz-ds/tasks/sz-ds-app.yml @@ -0,0 +1,41 @@ +- name: /etc/sz-ds/env.conf + tags: update-password + template: + src: etc/sz-ds/env.conf.j2 + dest: /etc/sz-ds/env.conf + mode: a=r + notify: + - restart sz-ds +- name: /etc/systemd/system/sz-ds.service + copy: + src: etc/systemd/system/sz-ds.service + dest: /etc/systemd/system/sz-ds.service +- name: git pull + tags: sz-ds-pull + notify: +# - flyway migrate + - restart sz-ds + register: git_checkout + git: + repo: "https://{{ sz_ds_secrets.github.username }}:{{ sz_ds_secrets.github.password }}@github.com/SweetzpotAS/SweetzpotCentral" + dest: /opt/sz-ds/src/SweetzpotCentral + version: master + +- name: Update GIT_REVISION + tags: sz-ds-pull + lineinfile: + path: "/etc/sz-ds/env.conf" + regexp: "^GIT_REVISION=" + line: "GIT_REVISION={{ git_checkout.after }}" + +- name: sz-ds pip + notify: restart sz-ds + tags: sz-ds-pull + pip: + virtualenv: /opt/sz-ds/env + virtualenv_python: python3 + chdir: /opt/sz-ds/src/SweetzpotCentral/data-server + requirements: requirements.txt +# editable: true + extra_args: --trusted-host github.com --process-dependency-links + diff --git a/ansible/roles/sz-ds/tasks/sz-ds-pg.yml b/ansible/roles/sz-ds/tasks/sz-ds-pg.yml new file mode 100644 index 0000000..48c6500 --- /dev/null +++ b/ansible/roles/sz-ds/tasks/sz-ds-pg.yml @@ -0,0 +1,28 @@ +- name: sz-ds + postgresql_user: + name: sz-ds + role_attr_flags: "NOLOGIN" +- name: sz-ds-flyway + tags: update-password + postgresql_user: + name: sz-ds-flyway + password: "{{ sz_ds_secret.db_password_flyway }}" + encrypted: yes +- name: sz-ds-web + tags: update-password + postgresql_user: + name: sz-ds-web + password: "{{ sz_ds_secret.db_password_web }}" + encrypted: yes +- name: sz-ds db + postgresql_db: + name: "sz-ds" + encoding: "utf-8" + owner: "sz-ds" +- postgresql_privs: + database: sz-ds + state: present + privs: USAGE + type: schema + objs: public + roles: sz-ds-web,sz-ds-flyway diff --git a/ansible/roles/sz-ds/templates/etc/sz-ds/env.conf.j2 b/ansible/roles/sz-ds/templates/etc/sz-ds/env.conf.j2 new file mode 100644 index 0000000..1e2cebb --- /dev/null +++ b/ansible/roles/sz-ds/templates/etc/sz-ds/env.conf.j2 @@ -0,0 +1,3 @@ +GIT_REVISION= +SQLALCHEMY_DATABASE_URI="postgresql://sz-ds-web:{{ sz_ds_secret.db_password_web }}@localhost/sz-ds" +SZ_CONFIG=/opt/sz-ds/src/SweetzpotCentral/data-server/config/config-{{ sz_ds_env }}.py diff --git a/ansible/roles/sz-ds/templates/opt/sz-ds/bin/flyway.j2 b/ansible/roles/sz-ds/templates/opt/sz-ds/bin/flyway.j2 index 8113d96..2481feb 100644 --- a/ansible/roles/sz-ds/templates/opt/sz-ds/bin/flyway.j2 +++ b/ansible/roles/sz-ds/templates/opt/sz-ds/bin/flyway.j2 @@ -3,5 +3,5 @@ set -e v="{{ flyway_version }}" -flyway="/opt/p2k16/flyway/flyway-$v/flyway" -exec "$flyway" -configFile=/etc/p2k16/flyway.conf "$@" +flyway="/opt/sz-ds/flyway/flyway-$v/flyway" +exec "$flyway" -configFile=/etc/sz-ds/flyway.conf "$@" diff --git a/ansible/secrets.yml b/ansible/secrets.yml index 66268d4..3284771 100644 --- a/ansible/secrets.yml +++ b/ansible/secrets.yml @@ -1,12 +1,12 @@ $ANSIBLE_VAULT;1.1;AES256 -38666438656330623934626438306434326239326264613465336665346630663564643939393938 -3633356531623065363432336634373037613161393465330a393761613838666135376362643331 -63636534336133613035633835343030396466343866373131643330613831623931343639663337 -6134353932326462310a383536646533396339316163383734316432633933646164323535623330 -34643962343732623930386466353631623230633531336630623461343935636266393763613264 -39306638356464346339663166306438636234616331383964656538623362353332663662636136 -64633463383933346566613161303562323939303665316164366638313065353739613431356164 -64613661303239313638396231323635653136366531666233613932353133353965653130373762 -38303839346439653662653533363436353436663637633464656163343636396162326331643166 -31363164346361333966323666633365353666373035643333366539623039656131306363396261 -353935653035633035626436623862353062 +63326262383165613634636232363636363666616339653063346164373131386230373466666337 +6634373236646365356432306630623332663336353230340a313065313138353465663635393432 +63653931653437353536343933613033613230316561663837656638353864303334613138353839 +3133656139303531310a626461393131323831653139393235613438323665373330653839626265 +61323266356137303834376166323437323538643333363731363533303862643862633234343038 +32306536383731636533666437363539623636343763343164353031363435383564303734393761 +39326261333962313563313564383634663465356339373937333036393165396238666134656463 +32386264663362326365306231353437633134663231303164373830303930356165323462663261 +31343235316538323733633562303661393034353966343432653835353565306233313563303163 +64663433343961333231663464316163323830646633633130386432643363343565356438666139 +363430656261616130323637626364326636 diff --git a/ansible/sz-ds.yml b/ansible/sz-ds.yml index 2566f4c..354a069 100644 --- a/ansible/sz-ds.yml +++ b/ansible/sz-ds.yml @@ -4,9 +4,21 @@ - sz-test roles: - timezone - - lxc-machine tasks: + - name: lxc-machine + import_role: name=lxc-machine + tags: lxc-machine + - name: postgresql-server import_role: name=postgresql-server + tags: postgresql-server + + - name: java8 + tags: java8 + import_role: name=java8 + - name: sz-ds + tags: sz-ds import_role: name=sz-ds + +# TODO: postfix client |