aboutsummaryrefslogtreecommitdiff
path: root/ansible/roles
diff options
context:
space:
mode:
Diffstat (limited to 'ansible/roles')
-rw-r--r--ansible/roles/java8/handlers/main.yml2
-rw-r--r--ansible/roles/knot-apache/tasks/main.yml21
-rw-r--r--ansible/roles/knot-apache/templates/etc/apache2/sites-enabled/sz-ds.trygvis.io.conf31
-rw-r--r--ansible/roles/lxc-host/tasks/main.yml2
-rw-r--r--ansible/roles/lxc-machine/tasks/main.yml31
-rw-r--r--ansible/roles/sz-ds/files/etc/systemd/system/sz-ds.service14
-rw-r--r--ansible/roles/sz-ds/handlers/main.yml5
-rw-r--r--ansible/roles/sz-ds/tasks/flyway.yml30
-rw-r--r--ansible/roles/sz-ds/tasks/main.yml67
-rw-r--r--ansible/roles/sz-ds/tasks/sz-ds-app.yml41
-rw-r--r--ansible/roles/sz-ds/tasks/sz-ds-pg.yml28
-rw-r--r--ansible/roles/sz-ds/templates/etc/sz-ds/env.conf.j23
-rw-r--r--ansible/roles/sz-ds/templates/opt/sz-ds/bin/flyway.j24
13 files changed, 210 insertions, 69 deletions
diff --git a/ansible/roles/java8/handlers/main.yml b/ansible/roles/java8/handlers/main.yml
index 0298ff9..90bca76 100644
--- a/ansible/roles/java8/handlers/main.yml
+++ b/ansible/roles/java8/handlers/main.yml
@@ -1,5 +1,5 @@
---
-- name: update apt cache
+- name: apt update
become: yes
apt:
update_cache: yes
diff --git a/ansible/roles/knot-apache/tasks/main.yml b/ansible/roles/knot-apache/tasks/main.yml
new file mode 100644
index 0000000..a3d1be6
--- /dev/null
+++ b/ansible/roles/knot-apache/tasks/main.yml
@@ -0,0 +1,21 @@
+- name: /etc/apache2/sites-enabled/{{ item.hostname }}.trygvis.io.conf
+ template:
+ src: etc/apache2/sites-enabled/sz-ds.trygvis.io.conf
+ dest: /etc/apache2/sites-enabled/{{ item.hostname }}.trygvis.io.conf
+ with_items: &backends
+ - hostname: sz
+ backend: sz-prod
+# - hostname: sz-test
+# backend: sz-test
+
+- name: "mkdir /var/www/{{ item.hostname }}.trygvis.io"
+ file:
+ dest: "/var/www/{{ item.hostname }}.trygvis.io"
+ state: directory
+ with_items: *backends
+
+- name: "mkdir /var/www/{{ item.hostname }}.trygvis.io/htdocs"
+ file:
+ dest: "/var/www/{{ item.hostname }}.trygvis.io/htdocs"
+ state: directory
+ with_items: *backends
diff --git a/ansible/roles/knot-apache/templates/etc/apache2/sites-enabled/sz-ds.trygvis.io.conf b/ansible/roles/knot-apache/templates/etc/apache2/sites-enabled/sz-ds.trygvis.io.conf
new file mode 100644
index 0000000..0172ff5
--- /dev/null
+++ b/ansible/roles/knot-apache/templates/etc/apache2/sites-enabled/sz-ds.trygvis.io.conf
@@ -0,0 +1,31 @@
+# Ansible
+<IfModule mod_ssl.c>
+<VirtualHost *:443>
+ ServerAdmin root@trygvis.io
+ ServerName {{ item.hostname }}.trygvis.io
+
+ LogLevel warn
+ ErrorLog ${APACHE_LOG_DIR}/{{ item.hostname }}.trygvis.io-error.log
+ CustomLog ${APACHE_LOG_DIR}/{{ item.hostname }}.trygvis.io-access.log combined
+
+ DocumentRoot /var/www/{{ item.hostname }}.trygvis.io/htdocs
+ <Directory />
+ Options FollowSymLinks
+ AllowOverride None
+ </Directory>
+ <Directory /var/www/{{ item.hostname }}.trygvis.io/htdocs/>
+ Options Indexes FollowSymLinks MultiViews
+ AllowOverride None
+ Order allow,deny
+ allow from all
+ </Directory>
+
+ ProxyTimeout 600
+ ProxyPreserveHost On
+ ProxyPass / http://{{ lxc_containers[item.backend].ipv4.address }}:5000/
+
+ SSLCertificateFile /etc/letsencrypt/live/{{ item.hostname }}.trygvis.io/fullchain.pem
+ SSLCertificateKeyFile /etc/letsencrypt/live/{{ item.hostname }}.trygvis.io/privkey.pem
+ Include /etc/letsencrypt/options-ssl-apache.conf
+</VirtualHost>
+</IfModule>
diff --git a/ansible/roles/lxc-host/tasks/main.yml b/ansible/roles/lxc-host/tasks/main.yml
index a043d4c..676e27e 100644
--- a/ansible/roles/lxc-host/tasks/main.yml
+++ b/ansible/roles/lxc-host/tasks/main.yml
@@ -6,7 +6,7 @@
lineinfile:
path: "/var/lib/lxc/{{ item.key }}/config"
regexp: "lxc.network.ipv4 *="
- line: "lxc.network.ipv4 = {{ item.value.ipv4.address }}"
+ line: "lxc.network.ipv4 = {{ item.value.ipv4.address }}/{{ item.value.ipv4.netmask }}"
with_dict: "{{ lxc_containers }}"
- name: Set IPv4 gateway
lineinfile:
diff --git a/ansible/roles/lxc-machine/tasks/main.yml b/ansible/roles/lxc-machine/tasks/main.yml
index b4f4aee..e75dcd9 100644
--- a/ansible/roles/lxc-machine/tasks/main.yml
+++ b/ansible/roles/lxc-machine/tasks/main.yml
@@ -1,17 +1,3 @@
-- name: system setup
- tags:
- - packages
- block:
- - name: misc packages
- apt:
- name: "{{ item }}"
- install_recommends: no
- with_items:
- - systemd-cron
- - ca-certificates
- - unzip
- - sudo
-
- name: disable ipv6
tags:
- disable-ipv6
@@ -32,4 +18,19 @@
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
-# TODO: postfix client
+- name: system setup
+ tags:
+ - packages
+ block:
+ - name: misc packages
+ apt:
+ name: "{{ item }}"
+ install_recommends: no
+ with_items:
+ - systemd-cron
+ - ca-certificates
+ - unzip
+ - sudo
+ - vim
+ - less
+ - ack
diff --git a/ansible/roles/sz-ds/files/etc/systemd/system/sz-ds.service b/ansible/roles/sz-ds/files/etc/systemd/system/sz-ds.service
new file mode 100644
index 0000000..5e55de4
--- /dev/null
+++ b/ansible/roles/sz-ds/files/etc/systemd/system/sz-ds.service
@@ -0,0 +1,14 @@
+[Unit]
+After=network.target postgresql.service
+
+[Service]
+ExecStart=/opt/sz-ds/src/SweetzpotCentral/infrastructure/run-data-server
+WorkingDirectory=/opt/sz-ds
+KillMode=process
+Restart=on-failure
+User=sz-ds
+Group=sz-ds
+EnvironmentFile=/etc/sz-ds/env.conf
+
+[Install]
+WantedBy=multi-user.target
diff --git a/ansible/roles/sz-ds/handlers/main.yml b/ansible/roles/sz-ds/handlers/main.yml
new file mode 100644
index 0000000..846f076
--- /dev/null
+++ b/ansible/roles/sz-ds/handlers/main.yml
@@ -0,0 +1,5 @@
+- name: restart sz-ds
+ service:
+ name: sz-ds
+ state: restarted
+
diff --git a/ansible/roles/sz-ds/tasks/flyway.yml b/ansible/roles/sz-ds/tasks/flyway.yml
new file mode 100644
index 0000000..c34ef44
--- /dev/null
+++ b/ansible/roles/sz-ds/tasks/flyway.yml
@@ -0,0 +1,30 @@
+- name: mkdir /opt/sz-ds/flyway
+ file:
+ state: directory
+ path: /opt/sz-ds/flyway
+- template:
+ src: opt/sz-ds/bin/flyway.j2
+ dest: /opt/sz-ds/bin/flyway
+ become: no
+# mode: a=rx
+- name: /etc/sz-ds/flyway.conf
+ tags: update-password
+ file:
+ dest: /etc/sz-ds/flyway.conf
+ content: |
+ flyway.url=jdbc:postgresql://localhost/sz-ds
+ flyway.user=sz-ds-flyway
+ flyway.password={{ sz_ds_secret.db_password_flyway }}
+
+ flyway.locations=filesystem:/opt/sz-ds/src/SweetzpotCentral/data-server/migrations
+ flyway.schemas=public
+
+- name: Download and extract Flyway {{ flyway_version }}
+ unarchive:
+ src: "https://repo1.maven.org/maven2/org/flywaydb/flyway-commandline/{{ flyway_version }}/flyway-commandline-{{ flyway_version }}.zip"
+ dest: /opt/sz-ds/flyway
+ creates: "/opt/sz-ds/flyway/flyway-{{ flyway_version }}"
+ remote_src: yes
+- file:
+ path: "/opt/sz-ds/flyway/flyway-{{ flyway_version }}/flyway"
+ mode: a=rx
diff --git a/ansible/roles/sz-ds/tasks/main.yml b/ansible/roles/sz-ds/tasks/main.yml
index 9e55292..559937c 100644
--- a/ansible/roles/sz-ds/tasks/main.yml
+++ b/ansible/roles/sz-ds/tasks/main.yml
@@ -4,8 +4,10 @@
name: "{{ item }}"
install_recommends: no
with_items:
+ - git
- python-psycopg2
- python3-psycopg2
+ - virtualenv
- name: accounts for sz-ds
tags: user
@@ -17,12 +19,18 @@
createhome: no
home: /opt/sz-ds
system: yes
- - file:
+ - name: mkdir /etc/sz-ds
+ file:
+ state: directory
+ path: /etc/sz-ds
+ - name: mkdir /opt/sz-ds
+ file:
state: directory
path: /opt/sz-ds
owner: sz-ds
mode: u=rwx,go=
- - file:
+ - name: mkdir /opt/sz-ds/bin
+ file:
state: directory
path: /opt/sz-ds/bin
- copy:
@@ -31,57 +39,16 @@
- name: flyway for sz-ds
tags: flyway
- block:
- - name: mkdir /opt/sz-ds/flyway
- file:
- state: directory
- path: /opt/sz-ds/flyway
- - template:
- src: opt/sz-ds/bin/flyway.j2
- dest: /opt/sz-ds/bin/flyway
- mode: a=rx
- - name: Download and extract Flyway {{ flyway_version }}
- unarchive:
- src: "https://repo1.maven.org/maven2/org/flywaydb/flyway-commandline/{{ flyway_version }}/flyway-commandline-{{ flyway_version }}.zip"
- dest: /opt/sz-ds/flyway
- creates: "/opt/sz-ds/flyway/flyway-{{ flyway_version }}"
- remote_src: yes
- - file:
- path: "/opt/sz-ds/flyway/flyway-{{ flyway_version }}/flyway"
- mode: a=rx
- # flyway.conf is created later
+ include: flyway.yml
+
- name: sz-ds database
tags: sz-ds-pg
become: yes
become_user: postgres
vars:
ansible_ssh_pipelining: true
- block:
- - name: sz-ds
- postgresql_user:
- name: sz-ds
- role_attr_flags: "NOLOGIN"
- - name: sz-ds-flyway
- tags: update-password
- postgresql_user:
- name: sz-ds-flyway
- password: "{{ sz_ds_secret.db_password_flyway }}"
- encrypted: yes
- - name: sz-ds-web
- tags: update-password
- postgresql_user:
- name: sz-ds-web
- password: "{{ sz_ds_secret.db_password_web }}"
- encrypted: yes
- - name: sz-ds db
- postgresql_db:
- name: "sz-ds"
- encoding: "utf-8"
- owner: "sz-ds"
- - postgresql_privs:
- database: sz-ds
- state: present
- privs: USAGE
- type: schema
- objs: public
- roles: sz-ds-web,sz-ds-flyway
+ include: sz-ds-pg.yml
+
+- name: sz-ds app
+ tags: sz-ds-app
+ include: sz-ds-app.yml
diff --git a/ansible/roles/sz-ds/tasks/sz-ds-app.yml b/ansible/roles/sz-ds/tasks/sz-ds-app.yml
new file mode 100644
index 0000000..78e300c
--- /dev/null
+++ b/ansible/roles/sz-ds/tasks/sz-ds-app.yml
@@ -0,0 +1,41 @@
+- name: /etc/sz-ds/env.conf
+ tags: update-password
+ template:
+ src: etc/sz-ds/env.conf.j2
+ dest: /etc/sz-ds/env.conf
+ mode: a=r
+ notify:
+ - restart sz-ds
+- name: /etc/systemd/system/sz-ds.service
+ copy:
+ src: etc/systemd/system/sz-ds.service
+ dest: /etc/systemd/system/sz-ds.service
+- name: git pull
+ tags: sz-ds-pull
+ notify:
+# - flyway migrate
+ - restart sz-ds
+ register: git_checkout
+ git:
+ repo: "https://{{ sz_ds_secrets.github.username }}:{{ sz_ds_secrets.github.password }}@github.com/SweetzpotAS/SweetzpotCentral"
+ dest: /opt/sz-ds/src/SweetzpotCentral
+ version: master
+
+- name: Update GIT_REVISION
+ tags: sz-ds-pull
+ lineinfile:
+ path: "/etc/sz-ds/env.conf"
+ regexp: "^GIT_REVISION="
+ line: "GIT_REVISION={{ git_checkout.after }}"
+
+- name: sz-ds pip
+ notify: restart sz-ds
+ tags: sz-ds-pull
+ pip:
+ virtualenv: /opt/sz-ds/env
+ virtualenv_python: python3
+ chdir: /opt/sz-ds/src/SweetzpotCentral/data-server
+ requirements: requirements.txt
+# editable: true
+ extra_args: --trusted-host github.com --process-dependency-links
+
diff --git a/ansible/roles/sz-ds/tasks/sz-ds-pg.yml b/ansible/roles/sz-ds/tasks/sz-ds-pg.yml
new file mode 100644
index 0000000..48c6500
--- /dev/null
+++ b/ansible/roles/sz-ds/tasks/sz-ds-pg.yml
@@ -0,0 +1,28 @@
+- name: sz-ds
+ postgresql_user:
+ name: sz-ds
+ role_attr_flags: "NOLOGIN"
+- name: sz-ds-flyway
+ tags: update-password
+ postgresql_user:
+ name: sz-ds-flyway
+ password: "{{ sz_ds_secret.db_password_flyway }}"
+ encrypted: yes
+- name: sz-ds-web
+ tags: update-password
+ postgresql_user:
+ name: sz-ds-web
+ password: "{{ sz_ds_secret.db_password_web }}"
+ encrypted: yes
+- name: sz-ds db
+ postgresql_db:
+ name: "sz-ds"
+ encoding: "utf-8"
+ owner: "sz-ds"
+- postgresql_privs:
+ database: sz-ds
+ state: present
+ privs: USAGE
+ type: schema
+ objs: public
+ roles: sz-ds-web,sz-ds-flyway
diff --git a/ansible/roles/sz-ds/templates/etc/sz-ds/env.conf.j2 b/ansible/roles/sz-ds/templates/etc/sz-ds/env.conf.j2
new file mode 100644
index 0000000..1e2cebb
--- /dev/null
+++ b/ansible/roles/sz-ds/templates/etc/sz-ds/env.conf.j2
@@ -0,0 +1,3 @@
+GIT_REVISION=
+SQLALCHEMY_DATABASE_URI="postgresql://sz-ds-web:{{ sz_ds_secret.db_password_web }}@localhost/sz-ds"
+SZ_CONFIG=/opt/sz-ds/src/SweetzpotCentral/data-server/config/config-{{ sz_ds_env }}.py
diff --git a/ansible/roles/sz-ds/templates/opt/sz-ds/bin/flyway.j2 b/ansible/roles/sz-ds/templates/opt/sz-ds/bin/flyway.j2
index 8113d96..2481feb 100644
--- a/ansible/roles/sz-ds/templates/opt/sz-ds/bin/flyway.j2
+++ b/ansible/roles/sz-ds/templates/opt/sz-ds/bin/flyway.j2
@@ -3,5 +3,5 @@
set -e
v="{{ flyway_version }}"
-flyway="/opt/p2k16/flyway/flyway-$v/flyway"
-exec "$flyway" -configFile=/etc/p2k16/flyway.conf "$@"
+flyway="/opt/sz-ds/flyway/flyway-$v/flyway"
+exec "$flyway" -configFile=/etc/sz-ds/flyway.conf "$@"
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-03 07:46:29 +0000