fuz/ansible
9
0
Fork 0
Code Issues Pull Requests 1 Releases Wiki Activity

cleaner ansible+docker setting

Browse Source
This commit is contained in:
J. Doe 2019-11-21 17:19:03 +01:00
parent 3eb36e6c0b
commit 0042c045a0
110 changed files with 1958 additions and 2567 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -1 +1,3 @@
.vagrant .vagrant
hosts.ini
ubuntu-bionic-18.04-cloudimg-console.log

65
Vagrantfile vendored
View File

@ -1,65 +0,0 @@
# -*- mode: ruby -*-
# vi: set ft=ruby :
# All Vagrant configuration is done below. The "2" in Vagrant.configure
# configures the configuration version (we support older styles for
# backwards compatibility). Please don't change it unless you know what
# you're doing.
Vagrant.configure("2") do |config|
# The most common configuration options are documented and commented below.
# For a complete reference, please see the online documentation at
# https://docs.vagrantup.com.
# Every Vagrant development environment requires a box. You can search for
# boxes at https://vagrantcloud.com/search.
config.vm.box = "ubuntu/bionic64"
# Disable automatic box update checking. If you disable this, then
# boxes will only be checked for updates when the user runs
# `vagrant box outdated`. This is not recommended.
# config.vm.box_check_update = false
# Create a forwarded port mapping which allows access to a specific port
# within the machine from a port on the host machine. In the example below,
# accessing "localhost:8080" will access port 80 on the guest machine.
# NOTE: This will enable public access to the opened port
# config.vm.network "forwarded_port", guest: 80, host: 8080
# Create a forwarded port mapping which allows access to a specific port
# within the machine from a port on the host machine and only allow access
# via 127.0.0.1 to disable public access
config.vm.network "forwarded_port", guest: 8008, host: 8008
config.vm.network "forwarded_port", guest: 8448, host: 8448
config.vm.network "forwarded_port", guest: 443, host: 443
# Create a private network, which allows host-only access to the machine
# using a specific IP.
config.vm.network "private_network", ip: "192.168.33.10"
# Create a public network, which generally matched to bridged network.
# Bridged networks make the machine appear as another physical device on
# your network.
# config.vm.network "public_network"
# Share an additional folder to the guest VM. The first argument is
# the path on the host to the actual folder. The second argument is
# the path on the guest to mount the folder. And the optional third
# argument is a set of non-required options.
# config.vm.synced_folder "../data", "/vagrant_data"
# Provider-specific configuration so you can fine-tune various
# backing providers for Vagrant. These expose provider-specific options.
# Example for VirtualBox:
#
config.vm.provider "virtualbox" do |vb|
# Display the VirtualBox GUI when booting the machine
# vb.gui = true
# Customize the amount of memory on the VM:
vb.memory = "4096"
end
config.vm.provision "ansible" do |ansible|
ansible.playbook = "setup.yml"
end
end

9
certbot.yml
View File

@ -1,9 +0,0 @@
- hosts: synapse
vars:
- certbot_certs:
- email: core@fuz.re
domains:
- "{{ ansible_host }}"
# - riot.fuz.re
roles:
- ansible-role-certbot

3
group_vars/all/vars.yml
View File

@ -1,3 +0,0 @@
synapse_dbname: synapse
synapse_dbuser: synapse_db
synapse_dbpw: synapse_db

39
main.yml
View File

@ -1,42 +1,17 @@
--- ---
- hosts: - hosts:
- synapse - sonic-preprod
# vars:
# -
handlers: handlers:
- name: reboot - name: reboot
reboot: reboot:
pre_tasks: pre_tasks:
- apt: - apt:
update_cache: yes update_cache: yes
# - apt:
# name: python-pip
# roles:
# - geerlingguy.pip
- name: Disable IPv6 # - import_playbook: nginx-certbot.yml
blockinfile: - import_playbook: matrix.yml
path: /etc/sysctl.conf
block: |
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
notify: reboot
- name: apply ipv6 disable
command: sysctl -p
become: yes
- name: check ipv6 state
shell: cat /proc/sys/net/ipv6/conf/all/disable_ipv6
register: command_result
failed_when: "'1' not in command_result.stdout"
- apt:
name: python-pip
roles:
- geerlingguy.pip
- import_playbook: postgres.yml
- import_playbook: certbot.yml
# todo: create synapse user
- import_playbook: synapse.yml

11
matrix-telegram-bridge.yml Normal file
View File

@ -0,0 +1,11 @@
# https://github.com/tulir/mautrix-telegram/wiki/Bridge-setup-with-Docker
# version: "3.7"
# services:
# mautrix-telegram:
# container_name: mautrix-telegram
# image: dock.mau.dev/tulir/mautrix-telegram:<version>
# restart: unless-stopped
# volumes:
# - .:/data

55
matrix.yml Normal file
View File

@ -0,0 +1,55 @@
---
- hosts: synapse
# todo: create user for synapse
vars:
matrix_synapse_version: "v1.5.1-py3"
# matrix_synapse_version: "v1.5.1"
matrix_server_name: matrix-sonic-beta.local
matrix_synapse_pg_host: synapse-postgres
# matrix_synapse_pg_user: ""
# matrix_synapse_pg_pass: ""
# matrix_synapse_pg_db: ""
matrix_synapse_report_stats: false
# matrix_synapse_extra_config:
# no_tls: true
tasks:
# - docker_volume:
# name: synapse-data
- template:
src: templates/synapse_homeserver.yaml.j2
dest: /synapse-data/homeserver.yaml
# - docker_container:
# name: synapse-fuz-beta # required. Assign a name to a new container or match an existing container.,When identifying an existing container name may be a name or a long or short container ID.
# image: "matrixdotorg/synapse:{{ matrix_synapse_version }}"
# published_ports: 8008:8008
# domainname: undefined # not required. Container domainname.
# # env_file: undefined # not required. Path to a file, present on the target, containing environment variables I(FOO=BAR).,If variable also present in C(env), then C(env) value will override.
# hostname: undefined # not required. Container hostname.
# state: started
# env:
# SYNAPSE_SERVER_NAME: "{{ matrix_server_name }}"
# SYNAPSE_REPORT_STATS: {{ matrix_synapse_report_stats }}
# # SYNAPSE_CONFIG_DIR: where additional config files (such as the log config and event signing key) will be stored. Defaults to /data.
# # SYNAPSE_CONFIG_PATH: path to the file to be generated. Defaults to <SYNAPSE_CONFIG_DIR>/homeserver.yaml.
# # SYNAPSE_DATA_DIR: where the generated config will put persistent data such as the datatase and media store. Defaults to /data.
# keep_volumes: yes # not required. Retain volumes associated with a removed container.
# volumes: /synapse-data:/data # not required. List of volumes to mount within the container.,Use docker CLI-style syntax: C(/host:/container[:mode]),You can specify a read mode for the mount with either C(ro) or C(rw).,SELinux hosts can additionally use C(z) or C(Z) to use a shared or private label for the volume.
# detach: true
- template:
src: templates/docker-compose-matrix.yml.j2
dest: /synapse-data/homeserver.yaml
- name: Create and start matrix services
docker_compose:
project_src: matrix
register: output

1
nextcloud.yml
View File

@ -1 +0,0 @@
# Nextcloud with Calendar, Notes and Kanban enabled.

28
postgres.yml
View File

@ -1,28 +0,0 @@
- hosts: synapse
# become: yes
pre_tasks:
- apt:
name: sudo
- lineinfile:
path: /etc/sudoers
line: 'root ALL = (ALL) ALL'
tasks:
- pip:
name: psycopg2
state: present
roles:
- role: geerlingguy.postgresql
postgresql_databases:
- name: "{{ synapse_dbname }}"
postgresql_users:
- name: "{{ synapse_dbuser }}"
password: "{{ synapse_dbpw }}"
postgresql_global_config_options:
- option: listen_addresses
value: "*"
# username: "postgres",
# password: "postgres",
# database: "imago_dev",
# hostname: "localhost",

12
requirements.yml
View File

@ -1,8 +1,8 @@
# from galaxy # from galaxy
- src: geerlingguy.pip # - src: geerlingguy.pip
- src: geerlingguy.postgresql # - src: geerlingguy.postgresql
- src: https://github.com/geerlingguy/ansible-role-certbot # - src: https://github.com/geerlingguy/ansible-role-certbot
scm: git # scm: git
# from GitHub, overriding the name and specifying a specific tag # from GitHub, overriding the name and specifying a specific tag
# - src: https://github.com/bennojoy/nginx # - src: https://github.com/bennojoy/nginx
@ -15,6 +15,6 @@
# from GitLab or other git-based scm, using git+ssh # from GitLab or other git-based scm, using git+ssh
- src: https://gitlab.com/famedly/ansible/synapse # - src: https://gitlab.com/famedly/ansible/synapse
scm: git # scm: git
# version: "0.1" # quoted, so YAML doesn't parse this as a floating-point value # version: "0.1" # quoted, so YAML doesn't parse this as a floating-point value

3
roles/ansible-role-certbot/.gitignore vendored
View File

@ -1,3 +0,0 @@
*.retry
*/__pycache__
*.pyc

33
roles/ansible-role-certbot/.travis.yml
View File

@ -1,33 +0,0 @@
---
language: python
services: docker
env:
global:
- ROLE_NAME: certbot
matrix:
- MOLECULE_DISTRO: centos7
- MOLECULE_DISTRO: centos6
MOLECULE_PLAYBOOK: playbook-source-install.yml
- MOLECULE_DISTRO: ubuntu1804
- MOLECULE_DISTRO: ubuntu1604
- MOLECULE_DISTRO: ubuntu1404
MOLECULE_PLAYBOOK: playbook-source-install.yml
- MOLECULE_DISTRO: debian9
install:
# Install test dependencies.
- pip install molecule docker
before_script:
# Use actual Ansible Galaxy role name for the project directory.
- cd ../
- mv ansible-role-$ROLE_NAME geerlingguy.$ROLE_NAME
- cd geerlingguy.$ROLE_NAME
script:
# Run tests.
- molecule test
notifications:
webhooks: https://galaxy.ansible.com/api/v1/notifications/

20
roles/ansible-role-certbot/LICENSE
View File

@ -1,20 +0,0 @@
The MIT License (MIT)
Copyright (c) 2017 Jeff Geerling
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

140
roles/ansible-role-certbot/README.md
View File

@ -1,140 +0,0 @@
# Ansible Role: Certbot (for Let's Encrypt)
[![Build Status](https://travis-ci.org/geerlingguy/ansible-role-certbot.svg?branch=master)](https://travis-ci.org/geerlingguy/ansible-role-certbot)
Installs and configures Certbot (for Let's Encrypt).
## Requirements
If installing from source, Git is required. You can install Git using the `geerlingguy.git` role.
Generally, installing from source (see section `Source Installation from Git`) leads to a better experience using Certbot and Let's Encrypt, especially if you're using an older OS release.
## Role Variables
The variable `certbot_install_from_source` controls whether to install Certbot from Git or package management. The latter is the default, so the variable defaults to `no`.
certbot_auto_renew: true
certbot_auto_renew_user: "{{ ansible_user | default(lookup('env', 'USER')) }}"
certbot_auto_renew_hour: "3"
certbot_auto_renew_minute: "30"
certbot_auto_renew_options: "--quiet --no-self-upgrade"
By default, this role configures a cron job to run under the provided user account at the given hour and minute, every day. The defaults run `certbot renew` (or `certbot-auto renew`) via cron every day at 03:30:00 by the user you use in your Ansible playbook. It's preferred that you set a custom user/hour/minute so the renewal is during a low-traffic period and done by a non-root user account.
### Automatic Certificate Generation
Currently there is one built-in method for generating new certificates using this role: `standalone`. Other methods (e.g. using nginx or apache and a webroot) may be added in the future.
**For a complete example**: see the fully functional test playbook in [molecule/default/playbook-standalone-nginx-aws.yml](molecule/default/playbook-standalone-nginx-aws.yml).
certbot_create_if_missing: false
certbot_create_method: standalone
Set `certbot_create_if_missing` to `yes` or `True` to let this role generate certs. Set the method used for generating certs with the `certbot_create_method` variable—current allowed values include: `standalone`.
certbot_admin_email: email@example.com
The email address used to agree to Let's Encrypt's TOS and subscribe to cert-related notifications. This should be customized and set to an email address that you or your organization regularly monitors.
certbot_certs: []
# - email: janedoe@example.com
# domains:
# - example1.com
# - example2.com
# - domains:
# - example3.com
A list of domains (and other data) for which certs should be generated. You can add an `email` key to any list item to override the `certbot_admin_email`.
certbot_create_command: "{{ certbot_script }} certonly --standalone --noninteractive --agree-tos --email {{ cert_item.email | default(certbot_admin_email) }} -d {{ cert_item.domains | join(',') }}"
The `certbot_create_command` defines the command used to generate the cert.
#### Standalone Certificate Generation
certbot_create_standalone_stop_services:
- nginx
Services that should be stopped while `certbot` runs it's own standalone server on ports 80 and 443. If you're running Apache, set this to `apache2` (Ubuntu), or `httpd` (RHEL), or if you have Nginx on port 443 and something else on port 80 (e.g. Varnish, a Java app, or something else), add it to the list so it is stopped when the certificate is generated.
These services will only be stopped the first time a new cert is generated.
### Source Installation from Git
You can install Certbot from it's Git source repository if desired. This might be useful in several cases, but especially when older distributions don't have Certbot packages available (e.g. CentOS < 7, Ubuntu < 16.10 and Debian < 8).
certbot_install_from_source: false
certbot_repo: https://github.com/certbot/certbot.git
certbot_version: master
certbot_keep_updated: true
Certbot Git repository options. To install from source, set `certbot_install_from_source` to `yes`. This clones the configured `certbot_repo`, respecting the `certbot_version` setting. If `certbot_keep_updated` is set to `yes`, the repository is updated every time this role runs.
certbot_dir: /opt/certbot
The directory inside which Certbot will be cloned.
### Wildcard Certificates
Let's Encrypt supports [generating wildcard certificates](https://community.letsencrypt.org/t/acme-v2-and-wildcard-certificate-support-is-live/55579), but the process for generating and using them is slightly more involved. See comments in [this pull request](https://github.com/geerlingguy/ansible-role-certbot/pull/60#issuecomment-423919284) for an example of how to use this role to maintain wildcard certs.
Michael Porter also has a walkthrough of [Creating A Let’s Encrypt Wildcard Cert With Ansible](https://www.michaelpporter.com/2018/09/creating-a-wildcard-cert-with-ansible/), specifically with Cloudflare.
## Dependencies
None.
## Example Playbook
- hosts: servers
vars:
certbot_auto_renew_user: your_username_here
certbot_auto_renew_minute: "20"
certbot_auto_renew_hour: "5"
roles:
- geerlingguy.certbot
See other examples in the `tests/` directory.
### Manually creating certificates with certbot
_Note: You can have this role automatically generate certificates; see the "Automatic Certificate Generation" documentation above._
You can manually create certificates using the `certbot` (or `certbot-auto`) script (use `letsencrypt` on Ubuntu 16.04, or use `/opt/certbot/certbot-auto` if installing from source/Git. Here are some example commands to configure certificates with Certbot:
# Automatically add certs for all Apache virtualhosts (use with caution!).
certbot --apache
# Generate certs, but don't modify Apache configuration (safer).
certbot --apache certonly
If you want to fully automate the process of adding a new certificate, but don't want to use this role's built in functionality, you can do so using the command line options to register, accept the terms of service, and then generate a cert using the standalone server:
1. Make sure any services listening on ports 80 and 443 (Apache, Nginx, Varnish, etc.) are stopped.
2. Register with something like `certbot register --agree-tos --email [your-email@example.com]`
- Note: You won't need to do this step in the future, when generating additional certs on the same server.
3. Generate a cert for a domain whose DNS points to this server: `certbot certonly --noninteractive --standalone -d example.com -d www.example.com`
4. Re-start whatever was listening on ports 80 and 443 before.
5. Update your webserver's virtualhost TLS configuration to point at the new certificate (`fullchain.pem`) and private key (`privkey.pem`) Certbot just generated for the domain you passed in the `certbot` command.
6. Reload or restart your webserver so it uses the new HTTPS virtualhost configuration.
### Certbot certificate auto-renewal
By default, this role adds a cron job that will renew all installed certificates once per day at the hour and minute of your choosing.
You can test the auto-renewal (without actually renewing the cert) with the command:
/opt/certbot/certbot-auto renew --dry-run
See full documentation and options on the [Certbot website](https://certbot.eff.org/).
## License
MIT / BSD
## Author Information
This role was created in 2016 by [Jeff Geerling](https://www.jeffgeerling.com/), author of [Ansible for DevOps](https://www.ansiblefordevops.com/).

38
roles/ansible-role-certbot/defaults/main.yml
View File

@ -1,38 +0,0 @@
---
# Certbot auto-renew cron job configuration (for certificate renewals).
certbot_auto_renew: true
certbot_auto_renew_user: "{{ ansible_user | default(lookup('env', 'USER')) }}"
certbot_auto_renew_hour: "3"
certbot_auto_renew_minute: "30"
certbot_auto_renew_options: "--quiet --no-self-upgrade"
# Parameters used when creating new Certbot certs.
certbot_create_if_missing: false
certbot_create_method: standalone
certbot_admin_email: email@example.com
certbot_certs: []
# - email: janedoe@example.com
# domains:
# - example1.com
# - example2.com
# - domains:
# - example3.com
certbot_create_command: >-
{{ certbot_script }} certonly --standalone --noninteractive --agree-tos
--email {{ cert_item.email | default(certbot_admin_email) }}
-d {{ cert_item.domains | join(',') }}
certbot_create_standalone_stop_services:
- nginx
# - apache
# - varnish
# To install from source (on older OSes or if you need a specific or newer
# version of Certbot), set this variable to `yes` and configure other options.
certbot_install_from_source: false
certbot_repo: https://github.com/certbot/certbot.git
certbot_version: master
certbot_keep_updated: true
# Where to put Certbot when installing from source.
certbot_dir: /opt/certbot

2
roles/ansible-role-certbot/meta/.galaxy_install_info
View File

@ -1,2 +0,0 @@
install_date: Thu Oct 3 21:08:16 2019
version: ''

33
roles/ansible-role-certbot/meta/main.yml
View File

@ -1,33 +0,0 @@
---
dependencies: []
galaxy_info:
author: geerlingguy
description: "Installs and configures Certbot (for Let's Encrypt)."
company: "Midwestern Mac, LLC"
license: "license (BSD, MIT)"
min_ansible_version: 2.4
platforms:
- name: EL
versions:
- 6
- 7
- name: Fedora
versions:
- all
- name: Ubuntu
versions:
- all
- name: Debian
versions:
- all
galaxy_tags:
- networking
- system
- web
- certbot
- letsencrypt
- encryption
- certificates
- ssl
- https

29
roles/ansible-role-certbot/molecule/default/molecule.yml
View File

@ -1,29 +0,0 @@
---
dependency:
name: galaxy
driver:
name: docker
lint:
name: yamllint
options:
config-file: molecule/default/yaml-lint.yml
platforms:
- name: instance
image: "geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible:latest"
command: ${MOLECULE_DOCKER_COMMAND:-""}
volumes:
- /sys/fs/cgroup:/sys/fs/cgroup:ro
privileged: true
pre_build_image: true
provisioner:
name: ansible
lint:
name: ansible-lint
playbooks:
converge: ${MOLECULE_PLAYBOOK:-playbook.yml}
scenario:
name: default
verifier:
name: testinfra
lint:
name: flake8

26
roles/ansible-role-certbot/molecule/default/playbook-source-install.yml
View File

@ -1,26 +0,0 @@
---
- name: Converge
hosts: all
become: true
vars:
certbot_install_from_source: true
certbot_auto_renew_user: root
pre_tasks:
- name: Update apt cache.
apt: update_cache=yes cache_valid_time=600
when: ansible_os_family == 'Debian'
changed_when: false
- name: Install cron (RedHat).
yum: name=cronie state=present
when: ansible_os_family == 'RedHat'
- name: Install cron (Debian).
apt: name=cron state=present
when: ansible_os_family == 'Debian'
roles:
- geerlingguy.git
- geerlingguy.certbot

179
roles/ansible-role-certbot/molecule/default/playbook-standalone-nginx-aws.yml
View File

@ -1,179 +0,0 @@
---
# To run:
# 1. Ensure Ansible and Boto are installed (pip install ansible boto).
# 2. Ensure you have AWS credentials stored where Boto can find them, and they
# are under the profile 'mm'.
# 3. Ensure you have a pubkey available at ~/.ssh/id_rsa.pub.
# 3. Run the playbook: ansible-playbook test-standalone-nginx-aws.yml
# Play 1: Provision EC2 instance and A record.
- hosts: localhost
connection: local
gather_facts: false
tasks:
- name: Configure EC2 Security Group.
ec2_group:
profile: mm
name: certbot_test_http
description: HTTP security group for Certbot testing.
region: "us-east-1"
state: present
rules:
- proto: tcp
from_port: 80
to_port: 80
cidr_ip: 0.0.0.0/0
- proto: tcp
from_port: 443
to_port: 443
cidr_ip: 0.0.0.0/0
- proto: tcp
from_port: 22
to_port: 22
cidr_ip: 0.0.0.0/0
rules_egress: []
- name: Add EC2 Key Pair.
ec2_key:
profile: mm
region: "us-east-1"
name: certbot_test
key_material: "{{ item }}"
with_file: ~/.ssh/id_rsa.pub
- name: Provision EC2 instance.
ec2:
profile: mm
key_name: certbot_test
instance_tags:
Name: "certbot-standalone-nginx-test"
group: ['default', 'certbot_test_http']
instance_type: t2.micro
# CentOS Linux 7 x86_64 HVM EBS
image: ami-02e98f78
region: "us-east-1"
wait: true
wait_timeout: 500
exact_count: 1
count_tag:
Name: "certbot-standalone-nginx-test"
register: created_instance
- name: Add A record for the new EC2 instance IP in Route53.
route53:
profile: mm
command: create
zone: servercheck.in
record: certbot-test.servercheck.in
type: A
ttl: 300
value: "{{ created_instance.tagged_instances.0.public_ip }}"
wait: true
overwrite: true
- name: Add EC2 instance to inventory groups.
add_host:
name: "certbot-test.servercheck.in"
groups: "aws,aws_nginx"
ansible_ssh_user: centos
host_key_checking: false
when: created_instance.tagged_instances.0.id is defined
# Play 2: Configure EC2 instance with Certbot and Nginx.
- hosts: aws_nginx
gather_facts: true
become: true
vars:
certbot_admin_email: https@servercheck.in
certbot_create_if_missing: true
certbot_create_standalone_stop_services: []
certbot_certs:
- domains:
- certbot-test.servercheck.in
nginx_vhosts:
- listen: "443 ssl http2"
server_name: "certbot-test.servercheck.in"
root: "/usr/share/nginx/html"
index: "index.html index.htm"
state: "present"
template: "{{ nginx_vhost_template }}"
filename: "certbot_test.conf"
extra_parameters: |
ssl_certificate /etc/letsencrypt/live/certbot-test.servercheck.in/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/certbot-test.servercheck.in/privkey.pem;
ssl_protocols TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
pre_tasks:
- name: Update apt cache.
apt: update_cache=true cache_valid_time=600
when: ansible_os_family == 'Debian'
changed_when: false
- name: Install dependencies (RedHat).
yum: name={{ item }} state=present
when: ansible_os_family == 'RedHat'
with_items:
- cronie
- epel-release
- name: Install cron (Debian).
apt: name=cron state=present
when: ansible_os_family == 'Debian'
roles:
- geerlingguy.certbot
- geerlingguy.nginx
tasks:
- name: Flush handlers in case any configs have changed.
meta: flush_handlers
- name: Test secure connection to SSL domain.
uri:
url: https://certbot-test.servercheck.in/
status_code: 200
delegate_to: localhost
become: false
# Play 3: Tear down EC2 instance and A record.
- hosts: localhost
connection: local
gather_facts: false
tasks:
- name: Destroy EC2 instance.
ec2:
profile: mm
instance_ids: ["{{ created_instance.tagged_instances.0.id }}"]
region: "us-east-1"
state: absent
wait: true
wait_timeout: 500
- name: Delete Security Group.
ec2_group:
profile: mm
name: certbot_test_http
region: "us-east-1"
state: absent
- name: Delete Key Pair.
ec2_key:
profile: mm
name: certbot_test
region: "us-east-1"
state: absent
- name: Delete Route53 record.
route53:
profile: mm
state: delete
zone: servercheck.in
record: certbot-test.servercheck.in
type: A
ttl: 300
# See: https://github.com/ansible/ansible/pull/32297
value: []

27
roles/ansible-role-certbot/molecule/default/playbook.yml
View File

@ -1,27 +0,0 @@
---
- name: Converge
hosts: all
become: true
vars:
certbot_auto_renew_user: root
pre_tasks:
- name: Update apt cache.
apt: update_cache=yes cache_valid_time=600
when: ansible_os_family == 'Debian'
changed_when: false
- name: Install dependencies (RedHat).
yum: name={{ item }} state=present
when: ansible_os_family == 'RedHat'
with_items:
- cronie
- epel-release
- name: Install cron (Debian).
apt: name=cron state=present
when: ansible_os_family == 'Debian'
roles:
- geerlingguy.certbot

3
roles/ansible-role-certbot/molecule/default/requirements.yml
View File

@ -1,3 +0,0 @@
---
- src: geerlingguy.git
- src: geerlingguy.nginx

6
roles/ansible-role-certbot/molecule/default/yaml-lint.yml
View File

@ -1,6 +0,0 @@
---
extends: default
rules:
line-length:
max: 120
level: warning

23
roles/ansible-role-certbot/tasks/create-cert-standalone.yml
View File

@ -1,23 +0,0 @@
---
- name: Check if certificate already exists.
stat:
path: /etc/letsencrypt/live/{{ cert_item.domains | first | replace('*.', '') }}/cert.pem
register: letsencrypt_cert
- name: Stop services to allow certbot to generate a cert.
service:
name: "{{ item }}"
state: stopped
when: not letsencrypt_cert.stat.exists
with_items: "{{ certbot_create_standalone_stop_services }}"
- name: Generate new certificate if one doesn't exist.
command: "{{ certbot_create_command }}"
when: not letsencrypt_cert.stat.exists
- name: Start services after cert has been generated.
service:
name: "{{ item }}"
state: started
when: not letsencrypt_cert.stat.exists
with_items: "{{ certbot_create_standalone_stop_services }}"

8
roles/ansible-role-certbot/tasks/include-vars.yml
View File

@ -1,8 +0,0 @@
---
- name: Load a variable file based on the OS type, or a default if not found.
include_vars: "{{ item }}"
with_first_found:
- "{{ ansible_distribution }}-{{ ansible_distribution_version }}.yml"
- "{{ ansible_distribution }}.yml"
- "{{ ansible_os_family }}.yml"
- "default.yml"

17
roles/ansible-role-certbot/tasks/install-from-source.yml
View File

@ -1,17 +0,0 @@
---
- name: Clone Certbot into configured directory.
git:
repo: "{{ certbot_repo }}"
dest: "{{ certbot_dir }}"
version: "{{ certbot_version }}"
update: "{{ certbot_keep_updated }}"
force: true
- name: Set Certbot script variable.
set_fact:
certbot_script: "{{ certbot_dir }}/certbot-auto"
- name: Ensure certbot-auto is executable.
file:
path: "{{ certbot_script }}"
mode: 0755

7
roles/ansible-role-certbot/tasks/install-with-package.yml
View File

@ -1,7 +0,0 @@
---
- name: Install Certbot.
package: "name={{ certbot_package }} state=present"
- name: Set Certbot script variable.
set_fact:
certbot_script: "{{ certbot_package }}"

19
roles/ansible-role-certbot/tasks/main.yml
View File

@ -1,19 +0,0 @@
---
- import_tasks: include-vars.yml
- import_tasks: install-with-package.yml
when: not certbot_install_from_source
- import_tasks: install-from-source.yml
when: certbot_install_from_source
- include_tasks: create-cert-standalone.yml
with_items: "{{ certbot_certs }}"
when:
- certbot_create_if_missing
- certbot_create_method == 'standalone'
loop_control:
loop_var: cert_item
- import_tasks: renew-cron.yml
when: certbot_auto_renew

8
roles/ansible-role-certbot/tasks/renew-cron.yml
View File

@ -1,8 +0,0 @@
---
- name: Add cron job for certbot renewal (if configured).
cron:
name: Certbot automatic renewal.
job: "{{ certbot_script }} renew {{ certbot_auto_renew_options }}"
minute: "{{ certbot_auto_renew_minute }}"
hour: "{{ certbot_auto_renew_hour }}"
user: "{{ certbot_auto_renew_user }}"

2
roles/ansible-role-certbot/vars/Ubuntu-16.04.yml
View File

@ -1,2 +0,0 @@
---
certbot_package: letsencrypt

2
roles/ansible-role-certbot/vars/default.yml
View File

@ -1,2 +0,0 @@
---
certbot_package: certbot

3
roles/geerlingguy.pip/.gitignore vendored
View File

@ -1,3 +0,0 @@
*.retry
*/__pycache__
*.pyc

29
roles/geerlingguy.pip/.travis.yml
View File

@ -1,29 +0,0 @@
---
language: python
services: docker
env:
global:
- ROLE_NAME: pip
matrix:
- MOLECULE_DISTRO: centos7
- MOLECULE_DISTRO: fedora29
- MOLECULE_DISTRO: ubuntu1804
- MOLECULE_DISTRO: debian9
install:
# Install test dependencies.
- pip install molecule docker
before_script:
# Use actual Ansible Galaxy role name for the project directory.
- cd ../
- mv ansible-role-$ROLE_NAME geerlingguy.$ROLE_NAME
- cd geerlingguy.$ROLE_NAME
script:
# Run tests.
- molecule test
notifications:
webhooks: https://galaxy.ansible.com/api/v1/notifications/

20
roles/geerlingguy.pip/LICENSE
View File

@ -1,20 +0,0 @@
The MIT License (MIT)
Copyright (c) 2017 Jeff Geerling
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

76
roles/geerlingguy.pip/README.md
View File

@ -1,76 +0,0 @@
# Ansible Role: Pip (for Python)
[![Build Status](https://travis-ci.org/geerlingguy/ansible-role-pip.svg?branch=master)](https://travis-ci.org/geerlingguy/ansible-role-pip)
An Ansible Role that installs [Pip](https://pip.pypa.io) on Linux.
## Requirements
On RedHat/CentOS, you may need to have EPEL installed before running this role. You can use the `geerlingguy.repo-epel` role if you need a simple way to ensure it's installed.
## Role Variables
Available variables are listed below, along with default values (see `defaults/main.yml`):
pip_package: python-pip
The name of the packge to install to get `pip` on the system. You can set to `python3-pip`, for example, when using Python 3 on Ubuntu.
pip_executable: pip
The role will try to autodetect the pip executable based on the `pip_package` (e.g. `pip` for Python 2 and `pip3` for Python 3). You can also override this explicitly, e.g. `pip_executable: pip3.6`.
pip_install_packages: []
A list of packages to install with pip. Examples below:
pip_install_packages:
# Specify names and versions.
- name: docker
version: "1.2.3"
- name: awscli
version: "1.11.91"
# Or specify bare packages to get the latest release.
- docker
- awscli
# Or uninstall a package.
- name: docker
state: absent
# Or update a package ot the latest version.
- name: docker
state: latest
# Or force a reinstall.
- name: docker
state: forcereinstall
# Or install a package in a particular virtualenv.
- name: docker
virtualenv: /my_app/venv
## Dependencies
None.
## Example Playbook
- hosts: all
vars:
pip_install_packages:
- name: docker
- name: awscli
roles:
- geerlingguy.pip
## License
MIT / BSD
## Author Information
This role was created in 2017 by [Jeff Geerling](https://www.jeffgeerling.com/), author of [Ansible for DevOps](https://www.ansiblefordevops.com/).

6
roles/geerlingguy.pip/defaults/main.yml
View File

@ -1,6 +0,0 @@
---
# For Python 3, use python3-pip.
pip_package: python-pip
pip_executable: "{{ 'pip3' if pip_package.startswith('python3') else 'pip' }}"
pip_install_packages: []

2
roles/geerlingguy.pip/meta/.galaxy_install_info
View File

@ -1,2 +0,0 @@
install_date: Tue Sep 24 09:13:41 2019
version: 1.3.0

30
roles/geerlingguy.pip/meta/main.yml
View File

@ -1,30 +0,0 @@
---
dependencies: []
galaxy_info:
author: geerlingguy
description: Pip (Python package manager) for Linux.
issue_tracker_url: https://github.com/geerlingguy/ansible-role-pip/issues
company: "Midwestern Mac, LLC"
license: "license (BSD, MIT)"
min_ansible_version: 2.0
platforms:
- name: EL
versions:
- all
- name: Fedora
versions:
- all
- name: Debian
versions:
- all
- name: Ubuntu
versions:
- all
galaxy_tags:
- system
- server
- packaging
- python
- pip
- tools

29
roles/geerlingguy.pip/molecule/default/molecule.yml
View File

@ -1,29 +0,0 @@
---
dependency:
name: galaxy
driver:
name: docker
lint:
name: yamllint
options:
config-file: molecule/default/yaml-lint.yml
platforms:
- name: instance
image: "geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible:latest"
command: ${MOLECULE_DOCKER_COMMAND:-""}
volumes:
- /sys/fs/cgroup:/sys/fs/cgroup:ro
privileged: true
pre_build_image: true
provisioner:
name: ansible
lint:
name: ansible-lint
playbooks:
converge: ${MOLECULE_PLAYBOOK:-playbook.yml}
scenario:
name: default
verifier:
name: testinfra
lint:
name: flake8

20
roles/geerlingguy.pip/molecule/default/playbook.yml
View File

@ -1,20 +0,0 @@
---
- name: Converge
hosts: all
become: true
vars:
pip_install_packages:
# Test installing a specific version of a package.
- name: ipaddress
version: "1.0.18"
# Test installing a package by name.
- colorama
pre_tasks:
- name: Update apt cache.
apt: update_cache=true cache_valid_time=600
when: ansible_os_family == 'Debian'
roles:
- role: geerlingguy.pip

14
roles/geerlingguy.pip/molecule/default/tests/test_default.py
View File

@ -1,14 +0,0 @@
import os
import testinfra.utils.ansible_runner
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
def test_hosts_file(host):
f = host.file('/etc/hosts')
assert f.exists
assert f.user == 'root'
assert f.group == 'root'

6
roles/geerlingguy.pip/molecule/default/yaml-lint.yml
View File

@ -1,6 +0,0 @@
---
extends: default
rules:
line-length:
max: 120
level: warning

14
roles/geerlingguy.pip/tasks/main.yml
View File

@ -1,14 +0,0 @@
---
- name: Ensure Pip is installed.
package:
name: "{{ pip_package }}"
state: present
- name: Ensure pip_install_packages are installed.
pip:
name: "{{ item.name | default(item) }}"
version: "{{ item.version | default(omit) }}"
virtualenv: "{{ item.virtualenv | default(omit) }}"
state: "{{ item.state | default(omit) }}"
executable: "{{ pip_executable }}"
with_items: "{{ pip_install_packages }}"

3
roles/geerlingguy.postgresql/.ansible-lint
View File

@ -1,3 +0,0 @@
skip_list:
- '405'
- '503'

3
roles/geerlingguy.postgresql/.gitignore vendored
View File

@ -1,3 +0,0 @@
*.retry
*/__pycache__
*.pyc

31
roles/geerlingguy.postgresql/.travis.yml
View File

@ -1,31 +0,0 @@
---
language: python
services: docker
env:
global:
- ROLE_NAME: postgresql
matrix:
- MOLECULE_DISTRO: centos7
- MOLECULE_DISTRO: fedora30
- MOLECULE_DISTRO: ubuntu1804
- MOLECULE_DISTRO: ubuntu1604
- MOLECULE_DISTRO: debian10
- MOLECULE_DISTRO: debian9
install:
# Install test dependencies.
- pip install molecule docker
before_script:
# Use actual Ansible Galaxy role name for the project directory.
- cd ../
- mv ansible-role-$ROLE_NAME geerlingguy.$ROLE_NAME
- cd geerlingguy.$ROLE_NAME
script:
# Run tests.
- molecule test
notifications:
webhooks: https://galaxy.ansible.com/api/v1/notifications/

20
roles/geerlingguy.postgresql/LICENSE
View File

@ -1,20 +0,0 @@
The MIT License (MIT)
Copyright (c) 2017 Jeff Geerling
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

145
roles/geerlingguy.postgresql/README.md
View File

@ -1,145 +0,0 @@
# Ansible Role: PostgreSQL
[![Build Status](https://travis-ci.org/geerlingguy/ansible-role-postgresql.svg?branch=master)](https://travis-ci.org/geerlingguy/ansible-role-postgresql)
Installs and configures PostgreSQL server on RHEL/CentOS or Debian/Ubuntu servers.
## Requirements
No special requirements; note that this role requires root access, so either run it in a playbook with a global `become: yes`, or invoke the role in your playbook like:
- hosts: database
roles:
- role: geerlingguy.postgresql
become: yes
## Role Variables
Available variables are listed below, along with default values (see `defaults/main.yml`):
postgresql_enablerepo: ""
(RHEL/CentOS only) You can set a repo to use for the PostgreSQL installation by passing it in here.
postgresql_restarted_state: "restarted"
Set the state of the service when configuration changes are made. Recommended values are `restarted` or `reloaded`.
postgresql_python_library: python-psycopg2
Library used by Ansible to communicate with PostgreSQL. If you are using Python 3 (e.g. set via `ansible_python_interpreter`), you should change this to `python3-psycopg2`.
postgresql_user: postgres
postgresql_group: postgres
The user and group under which PostgreSQL will run.
postgresql_unix_socket_directories:
- /var/run/postgresql
The directories (usually one, but can be multiple) where PostgreSQL's socket will be created.
postgresql_service_state: started
postgresql_service_enabled: true
Control the state of the postgresql service and whether it should start at boot time.
postgresql_global_config_options:
- option: unix_socket_directories
value: '{{ postgresql_unix_socket_directories | join(",") }}'
Global configuration options that will be set in `postgresql.conf`. Note that for RHEL/CentOS 6 (or very old versions of PostgreSQL), you need to at least override this variable and set the `option` to `unix_socket_directory`.
postgresql_hba_entries:
- { type: local, database: all, user: postgres, auth_method: peer }
- { type: local, database: all, user: all, auth_method: peer }
- { type: host, database: all, user: all, address: '127.0.0.1/32', auth_method: md5 }
- { type: host, database: all, user: all, address: '::1/128', auth_method: md5 }
Configure [host based authentication](https://www.postgresql.org/docs/current/static/auth-pg-hba-conf.html) entries to be set in the `pg_hba.conf`. Options for entries include:
- `type` (required)
- `database` (required)
- `user` (required)
- `address` (one of this or the following two are required)
- `ip_address`
- `ip_mask`
- `auth_method` (required)
- `auth_options` (optional)
If overriding, make sure you copy all of the existing entries from `defaults/main.yml` if you need to preserve existing entries.
postgresql_locales:
- 'en_US.UTF-8'
(Debian/Ubuntu only) Used to generate the locales used by PostgreSQL databases.
postgresql_databases:
- name: exampledb # required; the rest are optional
lc_collate: # defaults to 'en_US.UTF-8'
lc_ctype: # defaults to 'en_US.UTF-8'
encoding: # defaults to 'UTF-8'
template: # defaults to 'template0'
login_host: # defaults to 'localhost'
login_password: # defaults to not set
login_user: # defaults to 'postgresql_user'
login_unix_socket: # defaults to 1st of postgresql_unix_socket_directories
port: # defaults to not set
owner: # defaults to postgresql_user
state: # defaults to 'present'
A list of databases to ensure exist on the server. Only the `name` is required; all other properties are optional.
postgresql_users:
- name: jdoe #required; the rest are optional
password: # defaults to not set
encrypted: # defaults to not set
priv: # defaults to not set
role_attr_flags: # defaults to not set
db: # defaults to not set
login_host: # defaults to 'localhost'
login_password: # defaults to not set
login_user: # defaults to '{{ postgresql_user }}'
login_unix_socket: # defaults to 1st of postgresql_unix_socket_directories
port: # defaults to not set
state: # defaults to 'present'
A list of users to ensure exist on the server. Only the `name` is required; all other properties are optional.
postgresql_version: [OS-specific]
postgresql_data_dir: [OS-specific]
postgresql_bin_path: [OS-specific]
postgresql_config_path: [OS-specific]
postgresql_daemon: [OS-specific]
postgresql_packages: [OS-specific]
OS-specific variables that are set by include files in this role's `vars` directory. These shouldn't be overridden unless you're using a version of PostgreSQL that wasn't installed using system packages.
## Dependencies
None.
## Example Playbook
- hosts: database
become: yes
vars_files:
- vars/main.yml
roles:
- geerlingguy.postgresql
*Inside `vars/main.yml`*:
postgresql_databases:
- name: example_db
postgresql_users:
- name: example_user
password: supersecure
## License
MIT / BSD
## Author Information
This role was created in 2016 by [Jeff Geerling](https://www.jeffgeerling.com/), author of [Ansible for DevOps](https://www.ansiblefordevops.com/).

64
roles/geerlingguy.postgresql/defaults/main.yml
View File

@ -1,64 +0,0 @@
---
# RHEL/CentOS only. Set a repository to use for PostgreSQL installation.
postgresql_enablerepo: ""
# Set postgresql state when configuration changes are made. Recommended values:
# `restarted` or `reloaded`
postgresql_restarted_state: "restarted"
postgresql_python_library: python-psycopg2
postgresql_user: postgres
postgresql_group: postgres
postgresql_unix_socket_directories:
- /var/run/postgresql
postgresql_service_state: started
postgresql_service_enabled: true
# Global configuration options that will be set in postgresql.conf.
postgresql_global_config_options:
- option: unix_socket_directories
value: '{{ postgresql_unix_socket_directories | join(",") }}'
# Host based authentication (hba) entries to be added to the pg_hba.conf. This
# variable's defaults reflect the defaults that come with a fresh installation.
postgresql_hba_entries:
- {type: local, database: all, user: postgres, auth_method: peer}
- {type: local, database: all, user: all, auth_method: peer}
- {type: host, database: all, user: all, address: '127.0.0.1/32', auth_method: md5}
- {type: host, database: all, user: all, address: '::1/128', auth_method: md5}
# Debian only. Used to generate the locales used by PostgreSQL databases.
postgresql_locales:
- 'en_US.UTF-8'
# Databases to ensure exist.
postgresql_databases: []
# - name: exampledb # required; the rest are optional
# lc_collate: # defaults to 'en_US.UTF-8'
# lc_ctype: # defaults to 'en_US.UTF-8'
# encoding: # defaults to 'UTF-8'
# template: # defaults to 'template0'
# login_host: # defaults to 'localhost'
# login_password: # defaults to not set
# login_user: # defaults to '{{ postgresql_user }}'
# login_unix_socket: # defaults to 1st of postgresql_unix_socket_directories
# port: # defaults to not set
# owner: # defaults to postgresql_user
# state: # defaults to 'present'
# Users to ensure exist.
postgresql_users: []
# - name: jdoe #required; the rest are optional
# password: # defaults to not set
# encrypted: # defaults to not set
# priv: # defaults to not set
# role_attr_flags: # defaults to not set
# db: # defaults to not set
# login_host: # defaults to 'localhost'
# login_password: # defaults to not set
# login_user: # defaults to '{{ postgresql_user }}'
# login_unix_socket: # defaults to 1st of postgresql_unix_socket_directories
# port: # defaults to not set
# state: # defaults to 'present'

6
roles/geerlingguy.postgresql/handlers/main.yml
View File

@ -1,6 +0,0 @@
---
- name: restart postgresql
service:
name: "{{ postgresql_daemon }}"
state: "{{ postgresql_restarted_state }}"
sleep: 5

2
roles/geerlingguy.postgresql/meta/.galaxy_install_info
View File

@ -1,2 +0,0 @@
install_date: Tue Sep 24 09:13:46 2019
version: 2.0.0

33
roles/geerlingguy.postgresql/meta/main.yml
View File

@ -1,33 +0,0 @@
---
dependencies: []
galaxy_info:
author: geerlingguy
description: PostgreSQL server for Linux.
company: "Midwestern Mac, LLC"
license: "license (BSD, MIT)"
min_ansible_version: 2.4
platforms:
- name: EL
versions:
- 6
- 7
- name: Fedora
versions:
- 29
- 30
- name: Ubuntu
versions:
- xenial
- bionic
- name: Debian
versions:
- wheezy
- jessie
- stretch
- buster
galaxy_tags:
- database
- postgresql
- postgres
- rdbms

29
roles/geerlingguy.postgresql/molecule/default/molecule.yml
View File

@ -1,29 +0,0 @@
---
dependency:
name: galaxy
driver:
name: docker
lint:
name: yamllint
options:
config-file: molecule/default/yaml-lint.yml
platforms:
- name: instance
image: "geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible:latest"
command: ${MOLECULE_DOCKER_COMMAND:-""}
volumes:
- /sys/fs/cgroup:/sys/fs/cgroup:ro
privileged: true
pre_build_image: true
provisioner:
name: ansible
lint:
name: ansible-lint
playbooks:
converge: ${MOLECULE_PLAYBOOK:-playbook.yml}
scenario:
name: default
verifier:
name: testinfra
lint:
name: flake8

46
roles/geerlingguy.postgresql/molecule/default/playbook.yml
View File

@ -1,46 +0,0 @@
---
- name: Converge
hosts: all
become: true
vars:
postgresql_databases:
- name: example
postgresql_users:
- name: jdoe
pre_tasks:
# The Fedora 30+ container images have only C.UTF-8 installed
- name: Set database locale if using Fedora 30+
set_fact:
postgresql_databases:
- name: example
lc_collate: 'C.UTF-8'
lc_ctype: 'C.UTF-8'
when:
- ansible_distribution == 'Fedora'
- ansible_distribution_major_version >= '30'
- name: Update apt cache.
apt: update_cache=true cache_valid_time=600
when: ansible_os_family == 'Debian'
- name: Set custom variables for old CentOS 6 PostgreSQL install.
set_fact:
postgresql_hba_entries: []
postgresql_global_config_options:
- option: unix_socket_directory
value: '{{ postgresql_unix_socket_directories[0] }}'
when:
- ansible_os_family == 'RedHat'
- ansible_distribution_version.split('.')[0] == '6'
roles:
- role: geerlingguy.postgresql
post_tasks:
- name: Verify postgres is running.
command: "{{ postgresql_bin_path }}/pg_ctl -D {{ postgresql_data_dir }} status"
changed_when: false
become: true
become_user: postgres

6
roles/geerlingguy.postgresql/molecule/default/yaml-lint.yml
View File

@ -1,6 +0,0 @@
---
extends: default
rules:
line-length:
max: 120
level: warning

28
roles/geerlingguy.postgresql/tasks/configure.yml
View File

@ -1,28 +0,0 @@
---
- name: Configure global settings.
lineinfile:
dest: "{{ postgresql_config_path }}/postgresql.conf"
regexp: "^#?{{ item.option }}.+$"
line: "{{ item.option }} = '{{ item.value }}'"
state: "{{ item.state | default('present') }}"
with_items: "{{ postgresql_global_config_options }}"
notify: restart postgresql
- name: Configure host based authentication (if entries are configured).
template:
src: "pg_hba.conf.j2"
dest: "{{ postgresql_config_path }}/pg_hba.conf"
owner: "{{ postgresql_user }}"
group: "{{ postgresql_group }}"
mode: 0600
notify: restart postgresql
when: postgresql_hba_entries | length > 0
- name: Ensure PostgreSQL unix socket dirs exist.
file:
path: "{{ item }}"
state: directory
owner: "{{ postgresql_user }}"
group: "{{ postgresql_group }}"
mode: 02775
with_items: "{{ postgresql_unix_socket_directories }}"

21
roles/geerlingguy.postgresql/tasks/databases.yml
View File

@ -1,21 +0,0 @@
---
- name: Ensure PostgreSQL databases are present.
postgresql_db:
name: "{{ item.name }}"
lc_collate: "{{ item.lc_collate | default('en_US.UTF-8') }}"
lc_ctype: "{{ item.lc_ctype | default('en_US.UTF-8') }}"
encoding: "{{ item.encoding | default('UTF-8') }}"
template: "{{ item.template | default('template0') }}"
login_host: "{{ item.login_host | default('localhost') }}"
login_password: "{{ item.login_password | default(omit) }}"
login_user: "{{ item.login_user | default(postgresql_user) }}"
login_unix_socket: "{{ item.login_unix_socket | default(postgresql_unix_socket_directories[0]) }}"
port: "{{ item.port | default(omit) }}"
owner: "{{ item.owner | default(postgresql_user) }}"
state: "{{ item.state | default('present') }}"
with_items: "{{ postgresql_databases }}"
become: true
become_user: "{{ postgresql_user }}"
# See: https://github.com/ansible/ansible/issues/16048#issuecomment-229012509
vars:
ansible_ssh_pipelining: true

29
roles/geerlingguy.postgresql/tasks/initialize.yml
View File

@ -1,29 +0,0 @@
---
- name: Set PostgreSQL environment variables.
template:
src: postgres.sh.j2
dest: /etc/profile.d/postgres.sh
mode: 0644
notify: restart postgresql
- name: Ensure PostgreSQL data directory exists.
file:
path: "{{ postgresql_data_dir }}"
owner: "{{ postgresql_user }}"
group: "{{ postgresql_group }}"
state: directory
mode: 0700
- name: Check if PostgreSQL database is initialized.
stat:
path: "{{ postgresql_data_dir }}/PG_VERSION"
register: pgdata_dir_version
- name: Ensure PostgreSQL database is initialized.
command: "{{ postgresql_bin_path }}/initdb -D {{ postgresql_data_dir }}"
when: not pgdata_dir_version.stat.exists
become: true
become_user: "{{ postgresql_user }}"
# See: https://github.com/ansible/ansible/issues/16048#issuecomment-229012509
vars:
ansible_ssh_pipelining: true

23
roles/geerlingguy.postgresql/tasks/main.yml
View File

@ -1,23 +0,0 @@
---
# Variable configuration.
- include_tasks: variables.yml
# Setup/install tasks.
- include_tasks: setup-RedHat.yml
when: ansible_os_family == 'RedHat'
- include_tasks: setup-Debian.yml
when: ansible_os_family == 'Debian'
- include_tasks: initialize.yml
- include_tasks: configure.yml
- name: Ensure PostgreSQL is started and enabled on boot.
service:
name: "{{ postgresql_daemon }}"
state: "{{ postgresql_service_state }}"
enabled: "{{ postgresql_service_enabled }}"
# Configure PostgreSQL.
- import_tasks: users.yml
- import_tasks: databases.yml

21
roles/geerlingguy.postgresql/tasks/setup-Debian.yml
View File

@ -1,21 +0,0 @@
---
- name: Ensure PostgreSQL Python libraries are installed.
apt:
name: "{{ postgresql_python_library }}"
state: present
- name: Ensure PostgreSQL packages are installed.
apt:
name: "{{ postgresql_packages }}"
state: present
- name: Ensure all configured locales are present.
locale_gen: "name={{ item }} state=present"
with_items: "{{ postgresql_locales }}"
register: locale_gen_result
- name: Force-restart PostgreSQL after new locales are generated.
service:
name: "{{ postgresql_daemon }}"
state: restarted
when: locale_gen_result.changed

16
roles/geerlingguy.postgresql/tasks/setup-RedHat.yml
View File

@ -1,16 +0,0 @@
---
- name: Ensure PostgreSQL packages are installed.
yum:
name: "{{ postgresql_packages }}"
state: present
enablerepo: "{{ postgresql_enablerepo | default(omit, true) }}"
# Don't let postgresql-contrib cause the /usr/bin/python symlink
# to be installed, which breaks later Ansible runs on Fedora 30,
# and affects system behavior in multiple ways.
exclude: python-unversioned-command
- name: Ensure PostgreSQL Python libraries are installed.
yum:
name: "{{ postgresql_python_library }}"
state: present
enablerepo: "{{ postgresql_enablerepo | default(omit, true) }}"

22
roles/geerlingguy.postgresql/tasks/users.yml
View File

@ -1,22 +0,0 @@
---
- name: Ensure PostgreSQL users are present.
postgresql_user:
name: "{{ item.name }}"
password: "{{ item.password | default(omit) }}"
encrypted: "{{ item.encrypted | default(omit) }}"
priv: "{{ item.priv | default(omit) }}"
role_attr_flags: "{{ item.role_attr_flags | default(omit) }}"
db: "{{ item.db | default(omit) }}"
login_host: "{{ item.login_host | default('localhost') }}"
login_password: "{{ item.login_password | default(omit) }}"
login_user: "{{ item.login_user | default(postgresql_user) }}"
login_unix_socket: "{{ item.login_unix_socket | default(postgresql_unix_socket_directories[0]) }}"
port: "{{ item.port | default(omit) }}"
state: "{{ item.state | default('present') }}"
with_items: "{{ postgresql_users }}"
# no_log: true
become: true
become_user: "{{ postgresql_user }}"
# See: https://github.com/ansible/ansible/issues/16048#issuecomment-229012509
vars:
ansible_ssh_pipelining: true

45
roles/geerlingguy.postgresql/tasks/variables.yml
View File

@ -1,45 +0,0 @@
---
# Variable configuration.
- name: Include OS-specific variables (Debian).
include_vars: "{{ ansible_distribution }}-{{ ansible_distribution_version.split('.')[0] }}.yml"
when: ansible_os_family == 'Debian'
- name: Include OS-specific variables (RedHat).
include_vars: "{{ ansible_os_family }}-{{ ansible_distribution_version.split('.')[0] }}.yml"
when:
- ansible_os_family == 'RedHat'
- ansible_distribution != 'Fedora'
- name: Include OS-specific variables (Fedora).
include_vars: "{{ ansible_distribution }}-{{ ansible_distribution_version.split('.')[0] }}.yml"
when: ansible_distribution == 'Fedora'
- name: Define postgresql_packages.
set_fact:
postgresql_packages: "{{ __postgresql_packages | list }}"
when: postgresql_packages is not defined
- name: Define postgresql_version.
set_fact:
postgresql_version: "{{ __postgresql_version }}"
when: postgresql_version is not defined
- name: Define postgresql_daemon.
set_fact:
postgresql_daemon: "{{ __postgresql_daemon }}"
when: postgresql_daemon is not defined
- name: Define postgresql_data_dir.
set_fact:
postgresql_data_dir: "{{ __postgresql_data_dir }}"
when: postgresql_data_dir is not defined
- name: Define postgresql_bin_path.
set_fact:
postgresql_bin_path: "{{ __postgresql_bin_path }}"
when: postgresql_bin_path is not defined
- name: Define postgresql_config_path.
set_fact:
postgresql_config_path: "{{ __postgresql_config_path }}"
when: postgresql_config_path is not defined

9
roles/geerlingguy.postgresql/templates/pg_hba.conf.j2
View File

@ -1,9 +0,0 @@
{{ ansible_managed | comment }}
# PostgreSQL Client Authentication Configuration File
# ===================================================
#
# See: https://www.postgresql.org/docs/current/static/auth-pg-hba-conf.html
{% for client in postgresql_hba_entries %}
{{ client.type }} {{ client.database }} {{ client.user }} {{ client.address|default('') }} {{ client.ip_address|default('') }} {{ client.ip_mask|default('') }} {{ client.auth_method }} {{ client.auth_options|default("") }}
{% endfor %}

2
roles/geerlingguy.postgresql/templates/postgres.sh.j2
View File

@ -1,2 +0,0 @@
export PGDATA={{ postgresql_data_dir }}
export PATH=$PATH:{{ postgresql_bin_path }}

10
roles/geerlingguy.postgresql/vars/Debian-10.yml
View File

@ -1,10 +0,0 @@
---
__postgresql_version: "11"
__postgresql_data_dir: "/var/lib/postgresql/{{ __postgresql_version }}/main"
__postgresql_bin_path: "/usr/lib/postgresql/{{ __postgresql_version }}/bin"
__postgresql_config_path: "/etc/postgresql/{{ __postgresql_version }}/main"
__postgresql_daemon: "postgresql@{{ postgresql_version }}-main"
__postgresql_packages:
- postgresql
- postgresql-contrib
- libpq-dev

10
roles/geerlingguy.postgresql/vars/Debian-7.yml
View File

@ -1,10 +0,0 @@
---
__postgresql_version: "9.1"
__postgresql_data_dir: "/var/lib/postgresql/{{ __postgresql_version }}/main"
__postgresql_bin_path: "/usr/lib/postgresql/{{ __postgresql_version }}/bin"
__postgresql_config_path: "/etc/postgresql/{{ __postgresql_version }}/main"
__postgresql_daemon: postgresql
__postgresql_packages:
- postgresql
- postgresql-contrib
- libpq-dev

10
roles/geerlingguy.postgresql/vars/Debian-8.yml
View File

@ -1,10 +0,0 @@
---
__postgresql_version: "9.4"
__postgresql_data_dir: "/var/lib/postgresql/{{ __postgresql_version }}/main"
__postgresql_bin_path: "/usr/lib/postgresql/{{ __postgresql_version }}/bin"
__postgresql_config_path: "/etc/postgresql/{{ __postgresql_version }}/main"
__postgresql_daemon: "postgresql@{{ postgresql_version }}-main"
__postgresql_packages:
- postgresql
- postgresql-contrib
- libpq-dev

10
roles/geerlingguy.postgresql/vars/Debian-9.yml
View File

@ -1,10 +0,0 @@
---
__postgresql_version: "9.6"
__postgresql_data_dir: "/var/lib/postgresql/{{ __postgresql_version }}/main"
__postgresql_bin_path: "/usr/lib/postgresql/{{ __postgresql_version }}/bin"
__postgresql_config_path: "/etc/postgresql/{{ __postgresql_version }}/main"
__postgresql_daemon: "postgresql@{{ postgresql_version }}-main"
__postgresql_packages:
- postgresql
- postgresql-contrib
- libpq-dev

12
roles/geerlingguy.postgresql/vars/Fedora-29.yml
View File

@ -1,12 +0,0 @@
---
__postgresql_version: "10.5"
__postgresql_data_dir: "/var/lib/pgsql/data"
__postgresql_bin_path: "/usr/bin"
__postgresql_config_path: "/var/lib/pgsql/data"
__postgresql_daemon: postgresql
__postgresql_packages:
- postgresql
- postgresql-server
- postgresql-contrib
- postgresql-libs
postgresql_python_library: python2-psycopg2

13
roles/geerlingguy.postgresql/vars/Fedora-30.yml
View File

@ -1,13 +0,0 @@
---
__postgresql_version: "11.2"
__postgresql_data_dir: "/var/lib/pgsql/data"
__postgresql_bin_path: "/usr/bin"
__postgresql_config_path: "/var/lib/pgsql/data"
__postgresql_daemon: postgresql
__postgresql_packages:
- postgresql
- postgresql-server
- postgresql-contrib
- postgresql-libs
# Fedora 30 containers only have python3 by default
postgresql_python_library: python3-psycopg2

11
roles/geerlingguy.postgresql/vars/RedHat-6.yml
View File

@ -1,11 +0,0 @@
---
__postgresql_version: "8.4"
__postgresql_data_dir: "/var/lib/pgsql/data"
__postgresql_bin_path: "/usr/bin"
__postgresql_config_path: "/var/lib/pgsql/data"
__postgresql_daemon: postgresql
__postgresql_packages:
- postgresql
- postgresql-server
- postgresql-contrib
- postgresql-libs

11
roles/geerlingguy.postgresql/vars/RedHat-7.yml
View File

@ -1,11 +0,0 @@
---
__postgresql_version: "9.2"
__postgresql_data_dir: "/var/lib/pgsql/data"
__postgresql_bin_path: "/usr/bin"
__postgresql_config_path: "/var/lib/pgsql/data"
__postgresql_daemon: postgresql
__postgresql_packages:
- postgresql
- postgresql-server
- postgresql-contrib
- postgresql-libs

10
roles/geerlingguy.postgresql/vars/Ubuntu-16.yml
View File

@ -1,10 +0,0 @@
---
__postgresql_version: "9.5"
__postgresql_data_dir: "/var/lib/postgresql/{{ __postgresql_version }}/main"
__postgresql_bin_path: "/usr/lib/postgresql/{{ __postgresql_version }}/bin"
__postgresql_config_path: "/etc/postgresql/{{ __postgresql_version }}/main"
__postgresql_daemon: postgresql
__postgresql_packages:
- postgresql
- postgresql-contrib
- libpq-dev

10
roles/geerlingguy.postgresql/vars/Ubuntu-18.yml
View File

@ -1,10 +0,0 @@
---
__postgresql_version: "10"
__postgresql_data_dir: "/var/lib/postgresql/{{ __postgresql_version }}/main"
__postgresql_bin_path: "/usr/lib/postgresql/{{ __postgresql_version }}/bin"
__postgresql_config_path: "/etc/postgresql/{{ __postgresql_version }}/main"
__postgresql_daemon: postgresql
__postgresql_packages:
- postgresql
- postgresql-contrib
- libpq-dev

7
roles/synapse/.editorconfig
View File

@ -1,7 +0,0 @@
root = true
trim_trailing_whitespace = true
[*.yml]
insert_final_newline = true
indent_style = space
indent_size = 2

1
roles/synapse/.gitignore vendored
View File

@ -1 +0,0 @@
tests/roles/

24
roles/synapse/.gitlab-ci.yml
View File

@ -1,24 +0,0 @@
---
# -*- coding: utf-8 -*-
before_script:
- apt-get update -qy
- apt-get install -y python-dev python-pip
- git submodule update --init
- pip install --upgrade ansible ansible-lint
- ansible --version
- ansible-lint --version
stages:
- ansible-lint
- ansible-syntax-check
ansible-lint-pip:
stage: ansible-lint
script:
- ansible-lint tests/test-pip.yml
ansible-lint-docker:
stage: ansible-lint
script:
- ansible-lint tests/test-docker.yml

64
roles/synapse/README.md
View File

@ -1,64 +0,0 @@
# matrix-synapse
Install a matrix synapse server.
## Requirements
The following should be present on the target system
* `pip`
* `systemd`
* `rsyslogd`
* `logrotate`
## Role Variables
### Mandatory Variables
| Name | Type | Description |
| :--- | :--- | :--- |
| **matrix_server_name** | __string__ | |
| **matrix_synapse_tls_cert** | __string__ | server's TLS certificate chain (_when matrix_synapse_extra_config.no_tls is set to true_)|
| **matrix_synapse_tls_key** | __string__ | server's TLS key (_when matrix_synapse_extra_config.no_tls is set to true_)|
| **matrix_synapse_report_stats** | __bool__ | Report the stats to matrix.org |
| **matrix_synapse_pg_host** | __sting__ | postgresql server |
| **matrix_synapse_pg_user** | __string__ | postgresql user |
| **matrix_synapse_pg_pass** | __string__ | postgresql user's password |
| **matrix_synapse_pg_db** | __string__ | postgresql database |
### Optional Variables
| Name | Value | Description |
| :--- | :--- | :--- |
| matrix_synapse_base_path | "/opt/synapse" |
| matrix_synapse_secrets_path | "{{ matrix_synapse_base_path }}/secrets"
| matrix_synapse_extra_config | _None_ | configuration parameters as given in the [synapse configuration file](https://github.com/matrix-org/synapse/tree/master/docs) |
| matrix_synapse_dh_path | "{{ matrix_synapse_base_path }}/tls/{{ matrix_server_name }}.dh" |
| matrix_synapse_baseurl | "https://{{ matrix_server_name }}" |
| matrix_synapse_signing_key_path | "{{ matrix_synapse_base_path }}/ssl/{{ matrix_server_name }}.signing.key" |
| matrix_synapse_version | "v1.0.0" |
| matrix_synapse_log_days_keep | 30 |
| matrix_synapse_deployment_method | pip | Either pip or docker [¹](#footnote_1) |
| matrix_synapse_supervision_method | systemd | Either systemd, runit or docker [¹](#footnote_1) |
| matrix_synapse_python_version | 3 | Default python version (2, 3) to be used |
<a name="footnote_1">¹</a>: Docker must be used for both or neither deployment and supervision
## Dependencies
__None__.
## Example Playbook
```yaml
#TODO: Add example
```
## License
Apache 2.0
# Author Information
* Michael Kaye
* Jan Christian Grünhage
* Emmanouil Kampitakis

1
roles/synapse/TODO.md
View File

@ -1 +0,0 @@
- Write a handler to restart the systemd service when upgrading

15
roles/synapse/defaults/main.yml
View File

@ -1,15 +0,0 @@
---
matrix_synapse_extra_config: {}
matrix_synapse_deployment_method: pip
matrix_synapse_supervision_method: systemd
matrix_synapse_base_path: "/opt/synapse"
matrix_synapse_secrets_path: "{{ matrix_synapse_base_path }}/secrets"
matrix_synapse_dh_path: "{{ matrix_synapse_base_path }}/tls/{{ matrix_server_name }}.dh"
matrix_synapse_baseurl: "https://{{ matrix_server_name }}"
matrix_synapse_signing_key_path: "{{ matrix_synapse_base_path }}/tls/{{ matrix_server_name }}.signing.key"
matrix_synapse_version: "v1.3.1"
matrix_synapse_log_dir: "/var/log/matrix_synapse"
matrix_synapse_log_days_keep: 30
matrix_synapse_pid_file: "{{ matrix_synapse_base_path }}/synapse.pid"
matrix_synapse_docker_ports: ["8008:8008", "8448:8448"]
matrix_synapse_docker_labels: {}

29
roles/synapse/files/log.config
View File

@ -1,29 +0,0 @@
version: 1
formatters:
precise:
format: '%(name)s - %(lineno)d - %(levelname)s - %(request)s- %(message)s'
filters:
context:
(): synapse.util.logcontext.LoggingContextFilter
request: ""
handlers:
console:
class: logging.StreamHandler
formatter: precise
filters: [context]
loggers:
synapse:
level: INFO
synapse.storage.SQL:
# beware: increasing this to DEBUG will make synapse log sensitive
# information such as access tokens.
level: INFO
root:
level: INFO
handlers: [console]

27
roles/synapse/handlers/main.yml
View File

@ -1,27 +0,0 @@
---
- name: "reload systemd"
systemd:
daemon_reload: yes
- name: "restart matrix-synapse using systemd"
service:
name: "matrix-synapse"
state: restarted
enabled: yes
when: matrix_synapse_supervision_method == "systemd"
listen: "restart matrix-synapse"
- name: "restart synapse using docker"
docker_container:
name: synapse
state: started
restart: yes
when: matrix_synapse_supervision_method == "docker"
listen: "restart matrix-synapse"
- name: restart rsyslog
become: yes
service:
name: rsyslog
state: restarted
when: matrix_synapse_supervision_method == "systemd"

51
roles/synapse/library/matrix_signing_key.py
View File

@ -1,51 +0,0 @@
#!/bin/python3
# Copyright: (c) 2018, Emmanouil Kampitakis <info@kampitakis.de>
# Apache 2.0
from ansible.module_utils.basic import AnsibleModule
from signedjson import key
import os
def write_signing_key(path):
with open(path,'w') as f:
key.write_signing_keys(
f,
[key.generate_signing_key('first')]
)
def run_module():
module_args = dict(
path=dict(type='str', required=True),
)
result = dict(
changed=False,
original_message='',
message=''
)
module = AnsibleModule(
argument_spec=module_args,
supports_check_mode=True
)
signing_key_path = module.params['path']
signing_key_exists = os.path.isfile(signing_key_path)
if not signing_key_exists:
result['changed'] = True
if module.check_mode:
return result
write_signing_key(signing_key_path)
module.exit_json(**result)
def main():
run_module()
if __name__ == '__main__':
main()

2
roles/synapse/meta/.galaxy_install_info
View File

@ -1,2 +0,0 @@
install_date: Tue Sep 24 09:13:48 2019
version: ''

16
roles/synapse/meta/main.yml
View File

@ -1,16 +0,0 @@
galaxy_info:
author: michaelkaye
description: Deploys a synapse server
license: Apache 2.0
min_ansible_version: 2.0
platforms:
- name: Debian
versions:
- jessie
galaxy_tags: []
dependencies: []

1
roles/synapse/synapse
View File

@ -1 +0,0 @@
synapse

64
roles/synapse/tasks/configure.yml
View File

@ -1,64 +0,0 @@
---
- name: create user
user:
name: synapse
state: present
register: synapse_user
tags:
- pre_install
- name: create directory
file:
path: "{{ matrix_synapse_base_path }}"
state: directory
owner: synapse
group: synapse
tags:
- pre_install
- name: Create secrets directory
file:
path: "{{ matrix_synapse_secrets_path }}"
state: directory
owner: synapse
group: synapse
tags:
- pre_install
- name: Generate secrets
include_tasks: generate_secret.yml
loop:
- file: "macaroon.key"
var: "macaroon_file"
- file: "registration.key"
var: "registration_shared_secret_file"
- file: "form.key"
var: "form_secret_file"
loop_control:
loop_var: secret
- name: Create directory for media storage
file:
path: "{{ item }}"
state: directory
owner: synapse
group: synapse
loop:
- "{{ matrix_synapse_config.media_store_path }}"
- "{{ matrix_synapse_config.uploads_path }}"
- "{{ matrix_synapse_base_path }}/tls"
- name: Deploy config
copy:
content: "{{ matrix_synapse_config | to_nice_yaml }}"
dest: "{{ matrix_synapse_base_path }}/homeserver.yaml"
owner: synapse
group: synapse
notify:
- "restart matrix-synapse"
- name: Configure logging
import_tasks: logging.yml
- name: Create certificates
include_tasks: crypto.yml

32
roles/synapse/tasks/crypto.yml
View File

@ -1,32 +0,0 @@
---
- name: Install signedjson
pip:
name: signedjson
- name: Create signing key
matrix_signing_key:
path: "{{ matrix_synapse_config.signing_key_path }}"
notify:
- "restart matrix-synapse"
- name: Write server's certificate and private key
block:
- name: create DH parameters
openssl_dhparam:
path: "{{ matrix_synapse_dh_path }}"
owner: synapse
- name: Write certificate
copy:
content: "{{ matrix_synapse_tls_cert }}"
dest: "{{ matrix_synapse_config.tls_certificate_path }}"
owner: synapse
group: synapse
mode: "0644"
- name: Write keyfile
copy:
content: "{{ matrix_synapse_tls_key }}"
dest: "{{ matrix_synapse_config.tls_private_key_path }}"
owner: synapse
group: synapse
mode: "0600"
when: not matrix_synapse_config.no_tls

78
roles/synapse/tasks/deployment.yml
View File

@ -1,78 +0,0 @@
---
- name: install synapse with pip into virtualenv
block:
- name: Install dependencies
apt:
name:
- git
- build-essential
- python3-dev
- python-virtualenv
- python-pip
- python-setuptools
- sqlite3
- libffi-dev
- libssl-dev
- libjpeg-dev
- libxslt1-dev
- libpq-dev
state: present
cache_valid_time: 1800
tags:
- pre_install
- name: Create virtualenv
pip:
name:
- pip
- setuptools
virtualenv: "{{ matrix_synapse_base_path }}/env"
virtualenv_python: python3
extra_args: --upgrade
tags:
- pre_install
- name: Clone synapse
git:
repo: https://github.com/matrix-org/synapse
dest: "{{ matrix_synapse_base_path }}/synapse"
accept_hostkey: yes
version: "{{ matrix_synapse_version }}"
register: clone_synapse
tags:
- pre_install
- name: Install Synapse
pip:
name: "{{ matrix_synapse_base_path }}/synapse[matrix-synapse-ldap3,postgres,resources.consent,acme,url_preview]"
virtualenv: "{{ matrix_synapse_base_path }}/env"
when: clone_synapse.changed
tags:
- skip_ansible_lint # skip when clause
- pre_install
notify: restart matrix-synapse
when: matrix_synapse_deployment_method == "pip"
- name: install synapse with docker
docker_container:
name: synapse
image: "docker.io/matrixdotorg/synapse:{{ matrix_synapse_version }}"
ports: "{{ matrix_synapse_docker_ports }}"
labels: "{{ matrix_synapse_docker_labels }}"
restart_policy: unless-stopped
recreate: true
pull: true
entrypoint: "python"
command:
- "-m"
- "synapse.app.homeserver"
- "-c"
- "{{ matrix_synapse_base_path }}/homeserver.yaml"
user: "{{ synapse_user.uid }}:{{ synapse_user.group }}"
volumes:
- "{{ matrix_synapse_config.media_store_path }}:{{ matrix_synapse_config.media_store_path }}"
- "{{ matrix_synapse_config.uploads_path }}:{{ matrix_synapse_config.uploads_path }}"
- "{{ matrix_synapse_base_path }}/homeserver.yaml:{{ matrix_synapse_base_path }}/homeserver.yaml"
- "{{ matrix_synapse_base_path }}/log.config:{{ matrix_synapse_base_path }}/log.config"
- "{{ matrix_synapse_base_path }}/tls:{{ matrix_synapse_base_path }}/tls"
when: matrix_synapse_deployment_method == "docker"

27
roles/synapse/tasks/generate_secret.yml
View File

@ -1,27 +0,0 @@
---
- name: Set full file path
set_fact:
secret_file_path: "{{ matrix_synapse_secrets_path }}/{{ secret.file }}"
- name: Check if secret exists
stat:
path: "{{ secret_file_path }}"
register: secret_file_stat
- name: Generate random string
copy:
content: "{{ lookup('password', '/dev/null chars=ascii_letters,digits length=42') }}"
dest: "{{ secret_file_path }}"
owner: synapse
group: synapse
mode: "0600"
when:
- not secret_file_stat.stat.exists
# TODO: This below is a dirty hack and should be properly revisited
- name: Retrieve secret
slurp:
src: "{{ secret_file_path }}"
register: secret_var
- name: Set secret.var fact
set_fact: { "{{ secret.var }}": "{{ secret_var }}" }

35
roles/synapse/tasks/logging.yml
View File

@ -1,35 +0,0 @@
---
- name: Logging config (systemd)
block:
- name: create logging folder
file:
name: "{{ matrix_synapse_log_dir }}"
state: directory
owner: synapse
group: synapse
- name: copy syslog config
template:
src: syslog-synapse.conf.j2
dest: /etc/rsyslog.d/matrix_synapse.conf
owner: root
notify: restart rsyslog
- name: template logrotate config
template:
src: logrotate.j2
dest: /etc/logrotate.d/matrix_synapse
owner: root
when: matrix_synapse_supervision_method == "systemd"
# TODO: Figure out how to make sure that logging ends up in rsyslog no matter what system we run on
- name: Deploy log config
copy:
src: "log.config"
dest: "{{ matrix_synapse_base_path }}/log.config"
owner: synapse
group: synapse
notify:
- "restart matrix-synapse"

16
roles/synapse/tasks/main.yml
View File

@ -1,16 +0,0 @@
---
- name: check that sypervision and deployment are compatible
fail:
msg: "Either both or neither of deployment and supervision method should be docker."
when: (matrix_synapse_supervision_method == "docker" and matrix_synapse_deployment_method != "docker") or
(matrix_synapse_deployment_method == "docker" and matrix_synapse_supervision_method != "docker")
- name: configure synapse
import_tasks: configure.yml
- name: deploy synapse
import_tasks: deployment.yml
- name: configure service
import_tasks: systemd.yml
when: matrix_synapse_supervision_method == "systemd"

9
roles/synapse/tasks/systemd.yml
View File

@ -1,9 +0,0 @@
---
- name: Deploy service file
template:
src: "matrix-synapse.service.j2"
dest: "/etc/systemd/system/matrix-synapse.service"
mode: 0755
notify:
- "reload systemd"
- "restart matrix-synapse"

10
roles/synapse/templates/logrotate.j2
View File

@ -1,10 +0,0 @@
{{ ansible_managed | comment }}
/var/log/matrix_synapse/matrix_synapse.log {
daily
rotate {{ matrix_synapse_log_days_keep }}
compress
shred
postrotate
/usr/bin/pkill -HUP rsyslogd
endscript
}

16
roles/synapse/templates/matrix-synapse.service.j2
View File

@ -1,16 +0,0 @@
[Unit]
Description="Matrix Synapse Server (synapse)"
[Service]
Type=simple
WorkingDirectory={{ matrix_synapse_base_path }}
ExecStart={{ matrix_synapse_base_path }}/env/bin/python -m synapse.app.homeserver --config-path={{ matrix_synapse_base_path }}/homeserver.yaml
ExecStop={{ matrix_synapse_base_path }}/env/bin/synctl stop {{ matrix_synapse_base_path }}/homeserver.yaml
User=synapse
Group=synapse
Restart=always
StandardOutput=syslog
SyslogIdentifier=matrix_synapse
[Install]
WantedBy=default.target

2
roles/synapse/templates/syslog-synapse.conf.j2
View File

@ -1,2 +0,0 @@
if $programname == 'matrix_synapse' then {{ matrix_synapse_log_dir }}/matrix_synapse.log
if $programname == 'matrix_synapse' then ~

2
roles/synapse/tests/.gitignore vendored
View File

@ -1,2 +0,0 @@
.vagrant
*.retry

25
roles/synapse/tests/Vagrantfile vendored
View File

@ -1,25 +0,0 @@
# -*- mode: ruby -*-
# vi: set ft=ruby :
Vagrant.configure("2") do |config|
config.vm.define "pip" do |pip|
pip.vm.box = "debian/stretch64"
pip.vm.network "forwarded_port", guest: 8008, host: 8008
pip.vm.network "forwarded_port", guest: 8448, host: 8448
pip.vm.provision "ansible" do |ansible|
ansible.playbook = "test-pip.yml"
end
end
config.vm.define "docker" do |docker|
docker.vm.box = "debian/stretch64"
docker.vm.network "forwarded_port", guest: 8008, host: 8009
docker.vm.network "forwarded_port", guest: 8448, host: 8449
docker.vm.provision "ansible" do |ansible|
ansible.playbook = "test-docker.yml"
end
end
end

3
roles/synapse/tests/ansible.cfg
View File

@ -1,3 +0,0 @@
[defaults]
nocows=1
roles_path=./roles:./../../

Some files were not shown because too many files have changed in this diff Show More