diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 90d21ecb..6ba08fa4 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -50,6 +50,32 @@ jobs: AUTH_SECRET: ci-placeholder DATABASE_URL: ":memory:" + ansible-quality: + runs-on: ubuntu-latest + defaults: + run: + working-directory: ansible + env: + ANSIBLE_INVENTORY: localhost, + ANSIBLE_COLLECTIONS_PATH: ./collections + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-python@v5 + with: + python-version: '3.12' + cache: pip + cache-dependency-path: ansible/requirements.txt + - name: Install Ansible and lint tools + run: pip install -r requirements.txt + - name: Install Ansible collections + run: ansible-galaxy collection install -r requirements.yml -p ./collections --force + - name: Ansible lint – PaaS + run: ansible-lint --offline playbooks/paas/main.yml + - name: Ansible lint – SaaS deploy + run: ansible-lint --offline playbooks/saas/main.yml playbooks/saas/operate.yml + - name: Ansible lint – SaaS image build + run: ansible-lint --offline playbooks/saas/image-forkable.yml + build-ui: needs: [setup, quality] uses: ./.github/workflows/docker-build.yml @@ -75,7 +101,7 @@ jobs: registry_token: ${{ secrets.GITHUB_TOKEN }} build-ansible: - needs: [setup, quality] + needs: [setup, quality, ansible-quality] uses: ./.github/workflows/docker-build.yml with: image_name: ${{ github.repository }}-ansible diff --git a/ansible/.ansible-lint b/ansible/.ansible-lint new file mode 100644 index 00000000..672e8aac --- /dev/null +++ b/ansible/.ansible-lint @@ -0,0 +1,27 @@ +# ansible-lint configuration +# https://ansible.readthedocs.io/projects/lint/configuring/ + +profile: basic + +exclude_paths: + - collections/ + +# Downgrade to warnings: style issues acceptable in the current codebase +warn_list: + - yaml[truthy] + - yaml[line-length] + - name[casing] + - name[template] + - no-changed-when + - risky-shell-pipe + - var-naming + - jinja[spacing] + - command-instead-of-module + +# Skip rules that don't apply to internal roles (no galaxy metadata required) +skip_list: + - galaxy + - var-naming + - jinja[spacing] + - yaml[line-length] + - yaml[truthy] diff --git a/ansible/Dockerfile b/ansible/Dockerfile index 44467a34..e219c129 100644 --- a/ansible/Dockerfile +++ b/ansible/Dockerfile @@ -1,6 +1,8 @@ FROM ubuntu:25.04 ARG JAVA_VERSION=21 +ARG TERRAFORM_VERSION=1.12.1 +ARG TARGETARCH RUN apt-get update && apt-get install --no-install-recommends -y \ bash \ @@ -16,9 +18,13 @@ RUN apt-get update && apt-get install --no-install-recommends -y \ && rm -rf /var/lib/apt/lists/* RUN mkdir /tmp/terraform /root/.ssh && \ + case "${TARGETARCH}" in \ + amd64|arm64) TF_ARCH="${TARGETARCH}" ;; \ + *) echo "Unsupported TARGETARCH: ${TARGETARCH}" && exit 1 ;; \ + esac && \ cd /tmp/terraform && \ - wget https://releases.hashicorp.com/terraform/1.12.1/terraform_1.12.1_linux_arm64.zip && \ - unzip terraform_1.12.1_linux_arm64.zip && \ + wget "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_${TF_ARCH}.zip" && \ + unzip "terraform_${TERRAFORM_VERSION}_linux_${TF_ARCH}.zip" && \ mv terraform /usr/local/bin/ COPY . /ansible diff --git a/ansible/ansible.cfg b/ansible/ansible.cfg index 64413104..c85efda7 100644 --- a/ansible/ansible.cfg +++ b/ansible/ansible.cfg @@ -2,7 +2,7 @@ callbacks_enabled = minimal, webhook_notifier collections_path = ./collections deprecation_warnings = False -host_key_checking = False +host_key_checking = True interpreter_python = auto_silent inventory = inventory.py library = ./library @@ -19,7 +19,7 @@ fact_caching_connection = tmp/facts [ssh_connection] retries = 5 scp_if_ssh = True -ssh_args = -F ~/.ssh/config +ssh_args = -F ~/.ssh/config -o StrictHostKeyChecking=accept-new pipelining = True [url_lookup] diff --git a/ansible/demo-inventory.yml b/ansible/demo-inventory.yml index 3009ca79..e95615ec 100644 --- a/ansible/demo-inventory.yml +++ b/ansible/demo-inventory.yml @@ -3,5 +3,5 @@ plugin: cloud.terraform.terraform_provider project_path: - ../terraform/demo-openstack-instances - ../terraform/demo-openstack-loadbalancer - - ../terraform/demo-openstack-instances + - ../terraform/demo-standalone-instances binary_path: terraform diff --git a/ansible/inventory.py b/ansible/inventory.py index 8ccc1e53..a3831e94 100755 --- a/ansible/inventory.py +++ b/ansible/inventory.py @@ -4,10 +4,31 @@ import requests import os import logging +import sys +import time # Configure logging logging.basicConfig(level=logging.INFO) +REQUIRED_ENV_VARS = [ + "SIMPLE_STACK_UI_URL", + "SIMPLE_STACK_UI_USER", + "SIMPLE_STACK_UI_PASSWORD", +] + + +def get_required_env(): + missing = [var for var in REQUIRED_ENV_VARS if not os.environ.get(var)] + if missing: + logging.error("Missing required environment variables: %s", ", ".join(missing)) + return None + + return { + "url": os.environ["SIMPLE_STACK_UI_URL"], + "user": os.environ["SIMPLE_STACK_UI_USER"], + "password": os.environ["SIMPLE_STACK_UI_PASSWORD"], + } + def fetch_inventory(): """ Fetches inventory data from the SIMPLE STACK UI API. @@ -15,24 +36,42 @@ def fetch_inventory(): Returns: dict or None: The inventory data as a dictionary if successful, None otherwise. """ + env = get_required_env() + if env is None: + return None + session = requests.Session() - session.auth = (os.environ["SIMPLE_STACK_UI_USER"], os.environ["SIMPLE_STACK_UI_PASSWORD"]) + session.auth = (env["user"], env["password"]) + retries = int(os.environ.get("SIMPLE_STACK_UI_RETRIES", "3")) + timeout = float(os.environ.get("SIMPLE_STACK_UI_TIMEOUT", "10")) try: - url = f"{os.environ['SIMPLE_STACK_UI_URL']}/api/inventory" - logging.debug(f"Fetching inventory from {url}") - r = session.get(url) - r.raise_for_status() # Raise an error for bad responses - result = r.json() # Directly parse JSON response - return result - except requests.exceptions.HTTPError as e: - logging.error(f"HTTP error occurred: {e}") - except requests.exceptions.ConnectionError as e: - logging.error(f"Connection error occurred: {e}") - except requests.exceptions.Timeout as e: - logging.error(f"Timeout error occurred: {e}") - except requests.exceptions.RequestException as e: - logging.error(f"An error occurred: {e}") + url = f"{env['url']}/api/inventory" + logging.debug("Fetching inventory from %s", url) + + for attempt in range(1, retries + 1): + try: + response = session.get(url, timeout=timeout) + response.raise_for_status() + return response.json() + except requests.exceptions.HTTPError as e: + status = getattr(e.response, "status_code", 0) + is_retryable = 500 <= status < 600 + if is_retryable and attempt < retries: + logging.warning("HTTP %s while fetching inventory (attempt %s/%s)", status, attempt, retries) + time.sleep(attempt) + continue + logging.error("HTTP error occurred: %s", e) + break + except (requests.exceptions.ConnectionError, requests.exceptions.Timeout) as e: + if attempt < retries: + logging.warning("Connection error while fetching inventory (attempt %s/%s): %s", attempt, retries, e) + time.sleep(attempt) + continue + logging.error("Connection error occurred: %s", e) + except requests.exceptions.RequestException as e: + logging.error("An error occurred: %s", e) + break finally: session.close() # Ensure the session is closed @@ -44,3 +83,4 @@ def fetch_inventory(): print(json.dumps(inventory, indent=2)) else: logging.error("Failed to retrieve inventory data.") + sys.exit(1) diff --git a/ansible/playbooks/paas/main.yml b/ansible/playbooks/paas/main.yml index dd1a0f03..1f234538 100644 --- a/ansible/playbooks/paas/main.yml +++ b/ansible/playbooks/paas/main.yml @@ -58,8 +58,6 @@ - unattended-upgrades - ansible-ufw -- name: Configure sshd - ansible.builtin.import_playbook: sshd.yml - name: Configure timesyncd ansible.builtin.import_playbook: timesyncd.yml - name: Configure systemd resolved diff --git a/ansible/playbooks/paas/nomad-clean-errors.yml b/ansible/playbooks/paas/nomad-clean-errors.yml index fdca111a..b365bcba 100644 --- a/ansible/playbooks/paas/nomad-clean-errors.yml +++ b/ansible/playbooks/paas/nomad-clean-errors.yml @@ -3,13 +3,19 @@ hosts: "{{ hosts_limit | default('infrastructure') }}" become: true gather_facts: false + vars: + nomad_tls_skip_verify: true tasks: - name: Nomad system reconcile summaries - ansible.builtin.shell: nomad system reconcile summaries -address=https://127.0.0.1:4646 -tls-skip-verify + ansible.builtin.command: > + nomad system reconcile summaries -address=https://127.0.0.1:4646 + {% if nomad_tls_skip_verify | bool %}-tls-skip-verify{% endif %} environment: - NOMAD_TOKEN: "{{ lookup('simple-stack-ui', type='secret', key=inventory_hostname, subkey='nomad_management_token', missing='error') }}" + NOMAD_TOKEN: "{{ lookup('simple-stack-ui', type='secret', key2=inventory_hostname, subkey='nomad_management_token', missing='error') }}" - name: Nomad system gc - ansible.builtin.shell: nomad system gc -address=https://127.0.0.1:4646 -tls-skip-verify + ansible.builtin.command: > + nomad system gc -address=https://127.0.0.1:4646 + {% if nomad_tls_skip_verify | bool %}-tls-skip-verify{% endif %} environment: - NOMAD_TOKEN: "{{ lookup('simple-stack-ui', type='secret', key=inventory_hostname, subkey='nomad_management_token', missing='error') }}" + NOMAD_TOKEN: "{{ lookup('simple-stack-ui', type='secret', key2=inventory_hostname, subkey='nomad_management_token', missing='error') }}" diff --git a/ansible/playbooks/paas/nvidia.yml b/ansible/playbooks/paas/nvidia.yml index 2796d11c..7ff4c53c 100644 --- a/ansible/playbooks/paas/nvidia.yml +++ b/ansible/playbooks/paas/nvidia.yml @@ -39,12 +39,18 @@ cmd: "gpg --dearmor -o {{ nvidia_keyring_path }} /tmp/nvidia-container-toolkit.gpg" creates: "{{ nvidia_keyring_path }}" - - name: Télécharger le fichier de dépôt NVIDIA et ajouter le signed-by - ansible.builtin.shell: | - curl -s -L {{ nvidia_repo_list_url }} | \ - sed 's#deb https://#deb [signed-by={{ nvidia_keyring_path }}] https://#g' > {{ nvidia_list_path }} - args: - creates: "{{ nvidia_list_path }}" + - name: Télécharger le fichier de dépôt NVIDIA + ansible.builtin.get_url: + url: "{{ nvidia_repo_list_url }}" + dest: "{{ nvidia_list_path }}" + mode: "0644" + force: false + + - name: Ajouter signed-by au dépôt NVIDIA + ansible.builtin.replace: + path: "{{ nvidia_list_path }}" + regexp: '^deb\s+https://' + replace: 'deb [signed-by={{ nvidia_keyring_path }}] https://' - name: Activer la section experimental (décommenter) ansible.builtin.replace: @@ -134,7 +140,9 @@ ansible.builtin.command: nvidia-ctk runtime configure --runtime=docker - name: Nomad-nvidia-plugin | Restart docker - ansible.builtin.command: systemctl restart docker + ansible.builtin.systemd: + name: docker + state: restarted # https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/sample-workload.html - name: Nomad-nvidia-plugin | Test nvidia support diff --git a/ansible/playbooks/paas/roles/ansible-ufw/tasks/main.yml b/ansible/playbooks/paas/roles/ansible-ufw/tasks/main.yml index bce2b8a7..c926c0e9 100644 --- a/ansible/playbooks/paas/roles/ansible-ufw/tasks/main.yml +++ b/ansible/playbooks/paas/roles/ansible-ufw/tasks/main.yml @@ -11,7 +11,7 @@ delay: 6 retries: 10 -- name: reset firewall +- name: Reset firewall ufw: state: reset when: ufw_reset diff --git a/ansible/playbooks/paas/roles/nomad/handlers/main.yml b/ansible/playbooks/paas/roles/nomad/handlers/main.yml index 7ce58f2c..cdebf8c0 100644 --- a/ansible/playbooks/paas/roles/nomad/handlers/main.yml +++ b/ansible/playbooks/paas/roles/nomad/handlers/main.yml @@ -22,7 +22,7 @@ chdir: "{{ nomad_job_files_dir }}" environment: NOMAD_ADDR: "https://{{ nomad_http_ip }}:4646" - NOMAD_TOKEN: "{{ lookup('simple-stack-ui', type='secret', key=inventory_hostname, subkey='nomad_management_token', missing='error') }}" + NOMAD_TOKEN: "{{ lookup('simple-stack-ui', type='secret', key2=inventory_hostname, subkey='nomad_management_token', missing='error') }}" NOMAD_CLIENT_CERT: "{{ nomad_tls_host_certificate_dir }}/{{ nomad_tls_cert_server }}" NOMAD_CLIENT_KEY: "{{ nomad_tls_host_certificate_dir }}/{{ nomad_tls_privatekey_server }}" NOMAD_CACERT: "{{ nomad_tls_host_certificate_dir }}/{{ nomad_tls_ca_pubkey }}" diff --git a/ansible/playbooks/paas/roles/nomad/tasks/06_configuration.yml b/ansible/playbooks/paas/roles/nomad/tasks/06_configuration.yml index 98f5629f..6f51bae2 100644 --- a/ansible/playbooks/paas/roles/nomad/tasks/06_configuration.yml +++ b/ansible/playbooks/paas/roles/nomad/tasks/06_configuration.yml @@ -3,7 +3,7 @@ block: - name: "Nomad Install | Read Gossip Encryption Key" ansible.builtin.set_fact: - nomad_encrypt_key: "{{ lookup('simple-stack-ui', type='secret', key=inventory_hostname, subkey='nomad_encrypt_key', missing='error') }}" + nomad_encrypt_key: "{{ lookup('simple-stack-ui', type='secret', key2=inventory_hostname, subkey='nomad_encrypt_key', missing='error') }}" rescue: - name: "Nomad Install | Generate Gossip Encryption Key" ansible.builtin.command: "openssl rand -base64 32" @@ -13,7 +13,7 @@ - name: "Nomad Install | Save Gossip Encryption Key" ansible.builtin.set_fact: - nomad_encrypt_key: "{{ lookup('simple-stack-ui', type='secret', key=inventory_hostname, subkey='nomad_encrypt_key', missing='create', userpass=nomad_encrypt_key_out.stdout) }}" + nomad_encrypt_key: "{{ lookup('simple-stack-ui', type='secret', key2=inventory_hostname, subkey='nomad_encrypt_key', missing='create', userpass=nomad_encrypt_key_out.stdout) }}" - name: "Nomad Configuration | Add user nomad to docker group" ansible.builtin.user: diff --git a/ansible/playbooks/paas/roles/nomad/tasks/07_autoeligibility.yml b/ansible/playbooks/paas/roles/nomad/tasks/07_autoeligibility.yml index dcf859b4..df123eff 100644 --- a/ansible/playbooks/paas/roles/nomad/tasks/07_autoeligibility.yml +++ b/ansible/playbooks/paas/roles/nomad/tasks/07_autoeligibility.yml @@ -10,7 +10,7 @@ client_key: "{{ nomad_tls_host_certificate_dir }}/{{ nomad_tls_privatekey_server }}" method: GET headers: - X-Nomad-Token: "{{ lookup('simple-stack-ui', type='secret', key=inventory_hostname, subkey='nomad_management_token', missing='error') }}" + X-Nomad-Token: "{{ lookup('simple-stack-ui', type='secret', key2=inventory_hostname, subkey='nomad_management_token', missing='error') }}" status_code: - 200 - 404 @@ -29,7 +29,7 @@ client_key: "{{ nomad_tls_host_certificate_dir }}/{{ nomad_tls_privatekey_server }}" method: POST headers: - X-Nomad-Token: "{{ lookup('simple-stack-ui', type='secret', key=inventory_hostname, subkey='nomad_management_token', missing='error') }}" + X-Nomad-Token: "{{ lookup('simple-stack-ui', type='secret', key2=inventory_hostname, subkey='nomad_management_token', missing='error') }}" body: | { "Name": "autoeligibility", @@ -56,7 +56,7 @@ client_key: "{{ nomad_tls_host_certificate_dir }}/{{ nomad_tls_privatekey_server }}" method: GET headers: - X-Nomad-Token: "{{ lookup('simple-stack-ui', type='secret', key=inventory_hostname, subkey='nomad_management_token', missing='error') }}" + X-Nomad-Token: "{{ lookup('simple-stack-ui', type='secret', key2=inventory_hostname, subkey='nomad_management_token', missing='error') }}" status_code: - 200 - 404 @@ -76,7 +76,7 @@ block: - name: "Nomad Install | Read Nomad nomad autoeligibility token" ansible.builtin.set_fact: - nomad_autoeligibility_token: "{{ lookup('simple-stack-ui', type='secret', key=inventory_hostname, subkey='nomad_autoeligibility_token', missing='error') }}" + nomad_autoeligibility_token: "{{ lookup('simple-stack-ui', type='secret', key2=inventory_hostname, subkey='nomad_autoeligibility_token', missing='error') }}" rescue: - name: "Nomad Token | Create token for Nomad access autoeligibility" @@ -87,7 +87,7 @@ client_key: "{{ nomad_tls_host_certificate_dir }}/{{ nomad_tls_privatekey_server }}" method: PUT headers: - X-Nomad-Token: "{{ lookup('simple-stack-ui', type='secret', key=inventory_hostname, subkey='nomad_management_token', missing='error') }}" + X-Nomad-Token: "{{ lookup('simple-stack-ui', type='secret', key2=inventory_hostname, subkey='nomad_management_token', missing='error') }}" body: | { "Name": "autoeligibility", @@ -102,4 +102,4 @@ - name: "Nomad Install | Save Nomad Autoeligibility token" ansible.builtin.set_fact: - nomad_autoeligibility_token: "{{ lookup('simple-stack-ui', type='secret', key=inventory_hostname, subkey='nomad_autoeligibility_token', missing='create', userpass=nomad_new_token_name.json.SecretID) }}" + nomad_autoeligibility_token: "{{ lookup('simple-stack-ui', type='secret', key2=inventory_hostname, subkey='nomad_autoeligibility_token', missing='create', userpass=nomad_new_token_name.json.SecretID) }}" diff --git a/ansible/playbooks/paas/roles/nomad/tasks/10_juicefs.yml b/ansible/playbooks/paas/roles/nomad/tasks/10_juicefs.yml index d5414e97..9c567c8b 100644 --- a/ansible/playbooks/paas/roles/nomad/tasks/10_juicefs.yml +++ b/ansible/playbooks/paas/roles/nomad/tasks/10_juicefs.yml @@ -25,7 +25,7 @@ chdir: "{{ nomad_job_files_dir }}" environment: NOMAD_ADDR: "https://{{ nomad_http_ip }}:4646" - NOMAD_TOKEN: "{{ lookup('simple-stack-ui', type='secret', key=inventory_hostname, subkey='nomad_management_token', missing='error') }}" + NOMAD_TOKEN: "{{ lookup('simple-stack-ui', type='secret', key2=inventory_hostname, subkey='nomad_management_token', missing='error') }}" NOMAD_CLIENT_CERT: "{{ nomad_tls_host_certificate_dir }}/{{ nomad_tls_cert_server }}" NOMAD_CLIENT_KEY: "{{ nomad_tls_host_certificate_dir }}/{{ nomad_tls_privatekey_server }}" NOMAD_CACERT: "{{ nomad_tls_host_certificate_dir }}/{{ nomad_tls_ca_pubkey }}" @@ -44,7 +44,7 @@ chdir: "{{ nomad_job_files_dir }}" environment: NOMAD_ADDR: "https://{{ nomad_http_ip }}:4646" - NOMAD_TOKEN: "{{ lookup('simple-stack-ui', type='secret', key=inventory_hostname, subkey='nomad_management_token', missing='error') }}" + NOMAD_TOKEN: "{{ lookup('simple-stack-ui', type='secret', key2=inventory_hostname, subkey='nomad_management_token', missing='error') }}" NOMAD_CLIENT_CERT: "{{ nomad_tls_host_certificate_dir }}/{{ nomad_tls_cert_server }}" NOMAD_CLIENT_KEY: "{{ nomad_tls_host_certificate_dir }}/{{ nomad_tls_privatekey_server }}" NOMAD_CACERT: "{{ nomad_tls_host_certificate_dir }}/{{ nomad_tls_ca_pubkey }}" diff --git a/ansible/playbooks/paas/roles/sshd/defaults/main.yml b/ansible/playbooks/paas/roles/sshd/defaults/main.yml deleted file mode 100644 index bcd0e977..00000000 --- a/ansible/playbooks/paas/roles/sshd/defaults/main.yml +++ /dev/null @@ -1,223 +0,0 @@ ---- - -# true if IPv6 is needed -network_ipv6_enable: true # sshd + ssh - -# Paths of the config files -ssh_client_config_file: /etc/ssh/ssh_config # ssh -ssh_server_config_file: /etc/ssh/sshd_config # sshd - -# true if sshd should be started -ssh_server_enabled: true # sshd - -# true if sshd should be enabled at boot -ssh_server_service_enabled: true # sshd - -# true if DNS resolutions are needed, look up the remote host name, -# defaults to false from 6.8, see: http://www.openssh.com/txt/release-6.8 -ssh_use_dns: false # sshd - -# true or value if compression is needed -ssh_client_compression: false # ssh -ssh_compression: false # sshd - -# If true, password login is allowed -ssh_client_password_login: false # ssh -ssh_server_password_login: false # sshd - -# ports on which ssh-server should listen -ssh_server_ports: ["22"] # sshd - -# port to which ssh-client should connect -ssh_client_port: "22" # ssh - -# one or more ip addresses, to which ssh-server should listen to. -# Default is empty, but should be configured for security reasons! -ssh_listen_to: [0.0.0.0] # sshd - -# Host RSA key size in bits -ssh_host_rsa_key_size: 4096 # sshd - -# Host certificates to look for when starting sshd. -ssh_host_certificates: [] # sshd - -# Specifies the host key algorithms that the server offers -ssh_host_key_algorithms: [] # sshd - -# Specifies the host key algorithms order the client will try -ssh_client_host_key_algorithms: [] # ssh - -# specifies the time allowed for successful authentication to the SSH server -ssh_login_grace_time: 30s - -# Specifies the maximum number of authentication attempts permitted per connection. -# Once the number of failures reaches half this value, additional failures are logged. -ssh_max_auth_retries: 2 - -# Specifies the maximum number of open sessions permitted from a given connection -ssh_max_sessions: 10 - -ssh_client_alive_interval: 300 # sshd -ssh_client_alive_count: 3 # sshd - -# Allow SSH Tunnels -ssh_permit_tunnel: "no" - -# Hosts with custom options. # ssh -# Example: -# ssh_remote_hosts: -# - names: ['example.com', 'example2.com'] -# options: ['Port 2222', 'ForwardAgent yes'] -# - names: ['example3.com'] -# options: ['StrictHostKeyChecking no'] -ssh_remote_hosts: [] -# Set this to "without-password" or "yes" to allow root to login -ssh_permit_root_login: "no" # sshd - -# false to disable TCP Forwarding. Set to 'yes', 'no', 'local', 'all' or 'remote' -# to allow TCP Forwarding. -ssh_allow_tcp_forwarding: "yes" # sshd - -# false to disable binding forwarded ports to non-loopback addresses. -# Set to true to force binding on wildcard address. -# Set to 'clientspecified' to allow the client to specify which address to bind to. -ssh_gateway_ports: false # sshd - -# false to disable Agent Forwarding. Set to true to allow Agent Forwarding. -ssh_allow_agent_forwarding: false # sshd - -# false to disable X11 Forwarding. Set to true to allow X11 Forwarding. -ssh_x11_forwarding: false # sshd - -# false to disable pam authentication. -ssh_use_pam: true # sshd - -# false to disable publickey authentication -ssh_pubkey_authentication: true - -# specify AuthenticationMethods -sshd_authenticationmethods: publickey - -# Set to true to enable GSSAPI authentication (both client and server) -ssh_gssapi_support: false - -# Set to true to enable GSSAPI credential forwarding -ssh_gssapi_delegation: false - -# if specified, login is disallowed for user names that match one of the patterns. -ssh_deny_users: "" # sshd - -# if specified, login is allowed only for user names that match one of the patterns. -ssh_allow_users: "" # sshd - -# if specified, login is disallowed for users whose primary group or supplementary group list matches one of the patterns. -ssh_deny_groups: "" # sshd - -# if specified, login is allowed only for users whose primary group or supplementary group list matches one of the patterns. -ssh_allow_groups: "" # sshd - -# change default file that contains the public keys that can be used for user authentication. -ssh_authorized_keys_file: "" # sshd - -# specifies the file containing trusted certificate authorities public keys used to sign user certificates. -ssh_trusted_user_ca_keys_file: "" # sshd - -# set the trusted certificate authorities public keys used to sign user certificates. -# Example: -# ssh_trusted_user_ca_keys: -# - 'ssh-rsa ... comment1' -# - 'ssh-rsa ... comment2' -ssh_trusted_user_ca_keys: [] # sshd - -# specifies the file containing principals that are allowed. Only used if ssh_trusted_user_ca_keys_file is set. -# Example: -# ssh_authorized_principals_file: '/etc/ssh/auth_principals/%u' -# -# %h is replaced by the home directory of the user being authenticated, and %u is -# replaced by the username of that user. After expansion, the path is taken to be -# an absolute path or one relative to the user's home directory. -# -ssh_authorized_principals_file: "" # sshd - -# list of hashes containing file paths and authorized principals. Only used if ssh_authorized_principals_file is set. -# Example: -# ssh_authorized_principals: -# - { path: '/etc/ssh/auth_principals/root', principals: [ 'root' ], owner: "{{ ssh_owner }}", -# group: "{{ ssh_group }}", directoryowner: "{{ ssh_owner }}", directorygroup: "{{ ssh_group}}" } -# - { path: '/etc/ssh/auth_principals/myuser', principals: [ 'masteradmin', 'webserver' ] } -ssh_authorized_principals: [] # sshd - -# false to disable printing of the MOTD -ssh_print_motd: false # sshd -ssh_print_pam_motd: false # sshd - -# false to disable display of last login information -ssh_print_last_log: false # sshd - -# false to disable serving ssh warning banner before authentication is allowed -ssh_banner: false # sshd - -# path to file with ssh warning banner -ssh_banner_path: /etc/ssh/banner.txt - -# false to disable distribution version leakage during initial protocol handshake -ssh_print_debian_banner: false # sshd (Debian OS family only) - -# false to disable sftp configuration -sftp_enabled: true - -# false to disable sftp chroot -sftp_chroot: true - -# sftp default umask -sftp_umask: "0027" - -# change default sftp chroot location -sftp_chroot_dir: /home/%u - -# enable experimental client roaming -ssh_client_roaming: false - -# list of hashes (containing user and rules) to generate Match User blocks for -ssh_server_match_user: false # sshd - -# list of hashes (containing group and rules) to generate Match Group blocks for -ssh_server_match_group: false # sshd - -# list of hashes (containing addresses/subnets and rules) to generate Match Address blocks for -ssh_server_match_address: false # sshd - -# list of hashes (containing port and rules) to generate Match LocalPort blocks for -ssh_server_match_local_port: false # sshd - -ssh_server_permit_environment_vars: "no" -ssh_server_accept_env_vars: "" - -# maximum number of concurrent unauthenticated connections to the SSH daemon -ssh_max_startups: 10:30:60 # sshd - -ssh_ps59: sandbox - -sshd_moduli_minimum: 2048 - -# disable ChallengeResponseAuthentication -ssh_challengeresponseauthentication: false - -# a list of public keys that are never accepted by the ssh server -ssh_server_revoked_keys: [] -# Set to false to turn the role into a no-op. Useful when using -# the Ansible role dependency mechanism. -ssh_hardening_enabled: true - -# Custom options for SSH client configuration file -ssh_custom_options: [] -# Custom options for SSH daemon configuration file -sshd_custom_options: [] -# Logging -sshd_syslog_facility: AUTH -sshd_log_level: INFO - -sshd_strict_modes: true - -ssh_user: ansible -# ssh_custom_users: | diff --git a/ansible/playbooks/paas/roles/sshd/files/ssh_password b/ansible/playbooks/paas/roles/sshd/files/ssh_password deleted file mode 100644 index 160d7396..00000000 --- a/ansible/playbooks/paas/roles/sshd/files/ssh_password +++ /dev/null @@ -1,10 +0,0 @@ -module ssh_password 1.0; - -require { - type sshd_t; - type shadow_t; - class file { read open }; -} - -#============= sshd_t ============== -allow sshd_t shadow_t:file { read open }; diff --git a/ansible/playbooks/paas/roles/sshd/files/sshd b/ansible/playbooks/paas/roles/sshd/files/sshd deleted file mode 100644 index 085c2082..00000000 --- a/ansible/playbooks/paas/roles/sshd/files/sshd +++ /dev/null @@ -1,17 +0,0 @@ -# Configuration file for the sshd service. - -# The server keys are automatically generated if they are missing. -# To change the automatic creation, adjust sshd.service options for -# example using systemctl enable sshd-keygen@dsa.service to allow creation -# of DSA key or systemctl mask sshd-keygen@rsa.service to disable RSA key -# creation. - -# Do not change this option unless you have hardware random -# generator and you REALLY know what you are doing - -SSH_USE_STRONG_RNG=0 -# SSH_USE_STRONG_RNG=1 - -# System-wide crypto policy: -# To opt-out, uncomment the following line -CRYPTO_POLICY= diff --git a/ansible/playbooks/paas/roles/sshd/handlers/main.yml b/ansible/playbooks/paas/roles/sshd/handlers/main.yml deleted file mode 100644 index 4a2976e6..00000000 --- a/ansible/playbooks/paas/roles/sshd/handlers/main.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -- name: Restart sshd - ansible.builtin.service: - name: "{{ sshd_service_name }}" - state: restarted - when: ssh_server_enabled | bool - become: true diff --git a/ansible/playbooks/paas/roles/sshd/tasks/ca_keys_and_principals.yml b/ansible/playbooks/paas/roles/sshd/tasks/ca_keys_and_principals.yml deleted file mode 100644 index e4822cb5..00000000 --- a/ansible/playbooks/paas/roles/sshd/tasks/ca_keys_and_principals.yml +++ /dev/null @@ -1,27 +0,0 @@ ---- -- name: Set ssh CA pub keys - ansible.builtin.template: - src: trusted_user_ca_keys.j2 - dest: "{{ ssh_trusted_user_ca_keys_file }}" - mode: "0644" - owner: "{{ ssh_owner }}" - group: "{{ ssh_group }}" - notify: Restart sshd - -- name: Create ssh authorized principals directories - ansible.builtin.file: - path: "{{ item.path | dirname }}" - mode: '{{ item.directorymode | default("700") }}' - owner: "{{ item.directoryowner | default(ssh_owner) }}" - group: "{{ item.directorygroup | default(ssh_group) }}" - state: directory - loop: "{{ ssh_authorized_principals }}" - -- name: Set ssh authorized principals - ansible.builtin.template: - src: authorized_principals.j2 - dest: "{{ item.path }}" - mode: '{{ item.filemode | default("600") }}' - owner: "{{ item.owner | default(ssh_owner) }}" - group: "{{ item.group | default(ssh_group) }}" - loop: "{{ ssh_authorized_principals }}" diff --git a/ansible/playbooks/paas/roles/sshd/tasks/crypto_ciphers.yml b/ansible/playbooks/paas/roles/sshd/tasks/crypto_ciphers.yml deleted file mode 100644 index baa6d9df..00000000 --- a/ansible/playbooks/paas/roles/sshd/tasks/crypto_ciphers.yml +++ /dev/null @@ -1,10 +0,0 @@ ---- -- name: Set ciphers according to openssh-version if openssh >= 5.3 - ansible.builtin.set_fact: - ssh_ciphers: "{{ ssh_ciphers_53_default }}" - when: sshd_version is version('5.3', '>=') - -- name: Set ciphers according to openssh-version if openssh >= 6.6 - ansible.builtin.set_fact: - ssh_ciphers: "{{ ssh_ciphers_66_default }}" - when: sshd_version is version('6.6', '>=') diff --git a/ansible/playbooks/paas/roles/sshd/tasks/crypto_hostkeys.yml b/ansible/playbooks/paas/roles/sshd/tasks/crypto_hostkeys.yml deleted file mode 100644 index cd318134..00000000 --- a/ansible/playbooks/paas/roles/sshd/tasks/crypto_hostkeys.yml +++ /dev/null @@ -1,38 +0,0 @@ ---- -- name: Replace default 2048 bits RSA keypair - community.crypto.openssh_keypair: - state: present - type: rsa - size: "{{ ssh_host_rsa_key_size }}" - path: "{{ ssh_host_keys_dir }}/ssh_host_rsa_key" - force: false - regenerate: partial_idempotence - -- name: Set hostkeys according to openssh-version if openssh >= 5.3 - ansible.builtin.set_fact: - ssh_host_key_files: - - "{{ ssh_host_keys_dir }}/ssh_host_rsa_key" - when: sshd_version is version('5.3', '>=') - -- name: Set hostkeys according to openssh-version if openssh >= 6.0 - ansible.builtin.set_fact: - ssh_host_key_files: - - "{{ ssh_host_keys_dir }}/ssh_host_rsa_key" - - "{{ ssh_host_keys_dir }}/ssh_host_ecdsa_key" - when: sshd_version is version('6.0', '>=') - -- name: Set hostkeys according to openssh-version if openssh >= 6.3 - ansible.builtin.set_fact: - ssh_host_key_files: - - "{{ ssh_host_keys_dir }}/ssh_host_rsa_key" - - "{{ ssh_host_keys_dir }}/ssh_host_ecdsa_key" - - "{{ ssh_host_keys_dir }}/ssh_host_ed25519_key" - when: sshd_version is version('6.3', '>=') - -- name: Change host private key ownership, group and permissions - ansible.builtin.file: - path: "{{ item }}" - owner: "{{ ssh_host_keys_owner }}" - group: "{{ ssh_host_keys_group }}" - mode: "{{ ssh_host_keys_mode }}" - loop: "{{ ssh_host_key_files }}" diff --git a/ansible/playbooks/paas/roles/sshd/tasks/crypto_kex.yml b/ansible/playbooks/paas/roles/sshd/tasks/crypto_kex.yml deleted file mode 100644 index a37efd85..00000000 --- a/ansible/playbooks/paas/roles/sshd/tasks/crypto_kex.yml +++ /dev/null @@ -1,20 +0,0 @@ ---- -- name: Set kex according to openssh-version if openssh >= 5.9 - ansible.builtin.set_fact: - ssh_kex: "{{ ssh_kex_59_default }}" - when: sshd_version is version('5.9', '>=') - -- name: Set kex according to openssh-version if openssh >= 6.6 - ansible.builtin.set_fact: - ssh_kex: "{{ ssh_kex_66_default }}" - when: sshd_version is version('6.6', '>=') - -- name: Set kex according to openssh-version if openssh >= 8.0 - ansible.builtin.set_fact: - ssh_kex: "{{ ssh_kex_80_default }}" - when: sshd_version is version('8.0', '>=') - -- name: Set kex according to openssh-version if openssh >= 8.5 - ansible.builtin.set_fact: - ssh_kex: "{{ ssh_kex_85_default }}" - when: sshd_version is version('8.5', '>=') diff --git a/ansible/playbooks/paas/roles/sshd/tasks/crypto_macs.yml b/ansible/playbooks/paas/roles/sshd/tasks/crypto_macs.yml deleted file mode 100644 index 9bfaf11a..00000000 --- a/ansible/playbooks/paas/roles/sshd/tasks/crypto_macs.yml +++ /dev/null @@ -1,20 +0,0 @@ ---- -- name: Set macs according to openssh-version if openssh >= 5.3 - ansible.builtin.set_fact: - ssh_macs: "{{ ssh_macs_53_default }}" - when: sshd_version is version('5.3', '>=') - -- name: Set macs according to openssh-version if openssh >= 5.9 - ansible.builtin.set_fact: - ssh_macs: "{{ ssh_macs_59_default }}" - when: sshd_version is version('5.9', '>=') - -- name: Set macs according to openssh-version if openssh >= 6.6 - ansible.builtin.set_fact: - ssh_macs: "{{ ssh_macs_66_default }}" - when: sshd_version is version('6.6', '>=') - -- name: Set macs according to openssh-version if openssh >= 7.6 - ansible.builtin.set_fact: - ssh_macs: "{{ ssh_macs_76_default }}" - when: sshd_version is version('7.6', '>=') diff --git a/ansible/playbooks/paas/roles/sshd/tasks/disable-systemd-socket.yml b/ansible/playbooks/paas/roles/sshd/tasks/disable-systemd-socket.yml deleted file mode 100644 index 04878ec3..00000000 --- a/ansible/playbooks/paas/roles/sshd/tasks/disable-systemd-socket.yml +++ /dev/null @@ -1,16 +0,0 @@ ---- -- name: Remove ssh service systemd-socket file - ansible.builtin.file: - path: "{{ item }}" - state: absent - loop: - - /etc/systemd/system/ssh.service.d/00-socket.conf - - /etc/systemd/system/ssh.service.requires/ssh.socket - - /etc/systemd/system/sockets.target.wants/ssh.socket - -- name: Disable systemd-socket activation - ansible.builtin.systemd: - name: ssh.socket - state: stopped - enabled: false - masked: true diff --git a/ansible/playbooks/paas/roles/sshd/tasks/install.yml b/ansible/playbooks/paas/roles/sshd/tasks/install.yml deleted file mode 100644 index 3a7793a2..00000000 --- a/ansible/playbooks/paas/roles/sshd/tasks/install.yml +++ /dev/null @@ -1,24 +0,0 @@ ---- -- name: Install openssh package(s) - ansible.builtin.package: - name: "{{ item }}" - state: present - loop: "{{ ssh_pkgs }}" - -# see https://github.com/dev-sec/ansible-collection-hardening/issues/763 -- name: Change Debian/Ubuntu systems so ssh starts traditionally instead of socket-activated - ansible.builtin.include_tasks: disable-systemd-socket.yml - when: (ansible_facts.distribution == 'Ubuntu' and ansible_facts.distribution_major_version is version('22.04', '>=')) - -- name: Ensure privilege separation directory exists - ansible.builtin.file: - path: /run/sshd - state: directory - owner: root - group: root - mode: '0755' - -- name: Enable or disable sshd service - ansible.builtin.service: - name: "{{ sshd_service_name }}" - enabled: "{{ ssh_server_service_enabled }}" diff --git a/ansible/playbooks/paas/roles/sshd/tasks/main.yml b/ansible/playbooks/paas/roles/sshd/tasks/main.yml deleted file mode 100644 index a8fbc268..00000000 --- a/ansible/playbooks/paas/roles/sshd/tasks/main.yml +++ /dev/null @@ -1,96 +0,0 @@ ---- -- name: Install openssh package and configure the service - ansible.builtin.include_tasks: install.yml - -- name: Get openssh-version - ansible.builtin.command: ssh -V - register: sshd_version_raw - changed_when: false - check_mode: false - -- name: Parse openssh-version - ansible.builtin.set_fact: - sshd_version: "{{ sshd_version_raw.stderr | regex_replace('.*_([0-9]*.[0-9]).*', '\\1') }}" - -- name: Set default for ssh_host_key_files if not supplied - ansible.builtin.include_tasks: crypto_hostkeys.yml - when: ssh_host_key_files is undefined - -- name: Set default for ssh_macs if not supplied - ansible.builtin.include_tasks: crypto_macs.yml - when: ssh_macs is undefined - -- name: Set default for ssh_ciphers if not supplied - ansible.builtin.include_tasks: crypto_ciphers.yml - when: ssh_ciphers is undefined - -- name: Set default for ssh_kex if not supplied - ansible.builtin.include_tasks: crypto_kex.yml - when: ssh_kex is undefined - -- name: Create revoked_keys and set permissions to root/600 - ansible.builtin.template: - src: revoked_keys.j2 - dest: /etc/ssh/revoked_keys - mode: "0600" - owner: "{{ ssh_owner }}" - group: "{{ ssh_group }}" - notify: Restart sshd - -- name: Create sshd_config and set permissions to root/600 - ansible.builtin.template: - src: opensshd.conf.j2 - dest: "{{ ssh_server_config_file }}" - mode: "0600" - owner: "{{ ssh_owner }}" - group: "{{ ssh_group }}" - validate: "{{ sshd_path }} -T -C user=root -C host=localhost -C addr=localhost -C lport=22 -f %s" - notify: Restart sshd - -- name: Disable dynamic MOTD - community.general.pamd: - name: sshd - type: session - control: optional - module_path: pam_motd.so - state: absent - backup: true - when: - - ssh_pam_support | bool - - not (ssh_print_pam_motd | bool) - -- name: Create ssh_config and set permissions to root/644 - ansible.builtin.template: - src: openssh.conf.j2 - dest: "{{ ssh_client_config_file }}" - mode: "0644" - owner: "{{ ssh_owner }}" - group: "{{ ssh_group }}" - -- name: Check if for weak DH parameters in {{ sshd_moduli_file }} - ansible.builtin.shell: awk '$5 < {{ sshd_moduli_minimum }}' {{ sshd_moduli_file }} - register: sshd_register_moduli - changed_when: false - check_mode: false - -- name: Remove all small primes # noqa no-changed-when - ansible.builtin.shell: > - awk '$5 >= {{ sshd_moduli_minimum }}' {{ sshd_moduli_file }} > {{ sshd_moduli_file }}.new ; [ -r {{ sshd_moduli_file }}.new - -a -s {{ sshd_moduli_file }}.new ] && mv {{ sshd_moduli_file }}.new {{ sshd_moduli_file }} || true - notify: Restart sshd - when: - - sshd_register_moduli.stdout is truthy - -- name: Include tasks to setup ca keys and principals - ansible.builtin.include_tasks: ca_keys_and_principals.yml - when: - - ssh_trusted_user_ca_keys_file | length > 0 - - ssh_trusted_user_ca_keys | length > 0 - -- name: Enable or disable sshd service - ansible.builtin.service: - name: "{{ sshd_service_name }}" - enabled: "{{ ssh_server_service_enabled }}" - -- name: Set custom ssh keys to default ansible user - ansible.builtin.include_tasks: user.yml diff --git a/ansible/playbooks/paas/roles/sshd/tasks/user.yml b/ansible/playbooks/paas/roles/sshd/tasks/user.yml deleted file mode 100644 index fd70a28b..00000000 --- a/ansible/playbooks/paas/roles/sshd/tasks/user.yml +++ /dev/null @@ -1,8 +0,0 @@ ---- -- name: Set up multiple authorized keys - ansible.posix.authorized_key: - user: "{{ ssh_user }}" - state: present - key: "{{ ssh_custom_users }}" - exclusive: true - when: ssh_custom_users is defined diff --git a/ansible/playbooks/paas/roles/sshd/templates/openssh.conf.j2 b/ansible/playbooks/paas/roles/sshd/templates/openssh.conf.j2 deleted file mode 100644 index 97a5685e..00000000 --- a/ansible/playbooks/paas/roles/sshd/templates/openssh.conf.j2 +++ /dev/null @@ -1,137 +0,0 @@ -#jinja2: trim_blocks:True, lstrip_blocks:True -{{ ansible_managed | comment }} -# Generated by Ansible role {{ ansible_role_name }} - -# This is the ssh client system-wide configuration file. -# See ssh_config(5) for more information on any settings used. - -{% if ssh_custom_options %} -# Custom configuration that overwrites default configuration -# ========================================================== -{% for line in ssh_custom_options %} -{{ line }} -{% endfor %} -{% endif %} - -# Basic configuration -# =================== - -# Address family should always be limited to the active network configuration. -AddressFamily {{ 'any' if network_ipv6_enable else 'inet' }} - -{% for host in ssh_remote_hosts %} -{% if loop.first %} -# Host-specific configuration -{% endif %} -Host {{ host.names | join(' ') }} - {{ host.options | join('\n') | indent(2) }} - -{% endfor %} -# Global defaults for all Hosts -Host * - -# The port at the destination should be defined -Port {{ ssh_client_port }} - -# Identity file configuration. You may restrict available identity files. -# Otherwise ssh will search for a pattern and use any that matches. -#IdentityFile ~/.ssh/identity -#IdentityFile ~/.ssh/id_rsa -#IdentityFile ~/.ssh/id_dsa - - -# Security configuration -# ====================== - -{# Support for legacy SSHv1 has been completely removed from OpenSSH in version 7.6 -#} -{% if sshd_version is version('7.6', '<') %} -# Set the protocol version explicitly to 2. Version 1 is obsolete and should not be used. -Protocol 2 - -{% endif %} -# Make sure passphrase querying is enabled -BatchMode no - -# Prevent IP spoofing by checking to host IP against the `known_hosts` file. -CheckHostIP yes - -# Always ask before adding keys to the `known_hosts` file. Do not set to `yes`. -StrictHostKeyChecking ask - -# **Ciphers** -- If your clients don't support CTR (eg older versions), cbc will be added -# CBC: is true if you want to connect with OpenSSL-base libraries -# eg ruby Net::SSH::Transport::CipherFactory requires cbc-versions of the given openssh ciphers to work -# -- see: (http://net-ssh.github.com/net-ssh/classes/Net/SSH/Transport/CipherFactory.html) -# -{# This outputs 'Ciphers ' if ssh_ciphers is defined or '#Ciphers' if ssh_ciphers is undefined -#} -{{ 'Ciphers ' ~ ssh_ciphers|join(',') if ssh_ciphers else 'Ciphers'|comment }} - -# **Hash algorithms** -- Make sure not to use SHA1 for hashing, unless it is really necessary. -# Weak HMAC is sometimes required if older package versions are used -# eg Ruby's Net::SSH at around 2.2.* doesn't support sha2 for hmac, so this will have to be set true in this case. -# -{# This outputs 'MACs ' if ssh_macs is defined or '#MACs' if ssh_macs is undefined -#} -{{ 'MACs ' ~ ssh_macs|join(',') if ssh_macs else 'MACs'|comment }} - -# **Key Exchange Algorithms** -- Make sure not to use SHA1 for kex, unless it is really necessary -# Weak kex is sometimes required if older package versions are used -# eg ruby's Net::SSH at around 2.2.* doesn't support sha2 for kex, so this will have to be set true in this case. -# based on: https://bettercrypto.org/static/applied-crypto-hardening.pdf -# -{# This outputs 'KexAlgorithms ' if ssh_kex is defined or '#KexAlgorithms' if ssh_kex is undefined #} -{{ 'KexAlgorithms ' ~ ssh_kex|join(',') if ssh_kex else 'KexAlgorithms'|comment }} - -# Specifies the host key algorithms that the client wants to use in order of preference. -{{ "HostKeyAlgorithms " ~ ssh_client_host_key_algorithms|join(',') if ssh_client_host_key_algorithms else "HostKeyAlgorithms"|comment }} - -{% if sshd_version is version('5.9', '<') %} -# Alternative setting, if OpenSSH version is below v5.9 -#MACs hmac-ripemd160 - -{% endif %} -# Disable agent forwarding, since local agent could be accessed through forwarded connection. - -ForwardAgent {{ ((ssh_forward_agent) if ssh_forward_agent is defined else 'no') }} - - -# Disable X11 forwarding, since local X11 display could be accessed through forwarded connection. -ForwardX11 no - -# Never use host-based authentication. It can be exploited. -HostbasedAuthentication no -{% if sshd_version is version('7.6', '<') %} -RhostsRSAAuthentication no -# Enable RSA authentication via identity files. -RSAAuthentication yes -{% endif %} - -# Disable password-based authentication, it can allow for potentially easier brute-force attacks. -PasswordAuthentication {{ 'yes' if ssh_client_password_login else 'no' }} - -{# OpenBSD does not support GSSAPIAuthentication, so leave this out if on OpenBSD #} -{% if ansible_facts.os_family != 'OpenBSD' %} -# Only use GSSAPIAuthentication if implemented on the network. -GSSAPIAuthentication {{ 'yes' if (ssh_gssapi_support|bool) else 'no' }} -GSSAPIDelegateCredentials {{ 'yes' if (ssh_gssapi_delegation|bool) else 'no' }} - -{% endif %} -# Disable tunneling -Tunnel no - -# Disable local command execution. -PermitLocalCommand no - - -# Misc. configuration -# =================== - -Compression {{ 'yes' if (ssh_client_compression|bool) else 'no' }} - -#EscapeChar ~ -#VisualHostKey yes - -{% if sshd_version is version('7.1', '<=') %} -# Disable experimental client roaming. -# This is known to cause potential issues with secrets being disclosed to malicious servers. Disabled by default. -UseRoaming {{ 'yes' if ssh_client_roaming else 'no' }} -{% endif %} diff --git a/ansible/playbooks/paas/roles/sshd/templates/opensshd.conf.j2 b/ansible/playbooks/paas/roles/sshd/templates/opensshd.conf.j2 deleted file mode 100644 index ce896194..00000000 --- a/ansible/playbooks/paas/roles/sshd/templates/opensshd.conf.j2 +++ /dev/null @@ -1,339 +0,0 @@ -#jinja2: trim_blocks:True, lstrip_blocks:True -{{ ansible_managed | comment }} -# Generated by Ansible role {{ ansible_role_name }} - -# This is the sshd server system-wide configuration file. -# See sshd_config(5) for more information. - -{% if sshd_custom_options %} -# Custom configuration that overwrites default configuration -# ========================================================== -{% for line in sshd_custom_options %} -{{ line }} -{% endfor %} -{% endif %} - -# Basic configuration -# =================== - -# Either disable or only allow root login via certificates. -PermitRootLogin {{ ssh_permit_root_login }} - -# TCP port sshd should listen on. Default is 22. -{% for port in ssh_server_ports %} -Port {{ port }} -{% endfor %} - -# Address family should always be limited to the active network configuration. -AddressFamily {{ 'any' if (network_ipv6_enable|bool) else 'inet' }} - -# Addresses sshd listens on. Default is 0.0.0.0. -# Specify desired address here if you don't want sshd to listen on all available addresses. -{% for address in ssh_listen_to %} -ListenAddress {{ address }} -{% endfor %} - -# HostKeys are listed here. -{% if ssh_host_key_files is defined and ssh_host_key_files -%} -{% for key in ssh_host_key_files %} -HostKey {{ key }} -{% endfor %} -{% endif %} - -# HostCertificates are listed here. -{% for certificate in ssh_host_certificates -%} -HostCertificate {{ certificate }} -{% endfor %} - -# Host key algorithms that the server offers. -{% if sshd_version is version('5.8', '>=') %} -{{ "HostKeyAlgorithms " ~ ssh_host_key_algorithms|join(',') if ssh_host_key_algorithms else "HostKeyAlgorithms"|comment }} -{% endif %} - -# Security configuration -# ====================== - -{# Support for legacy SSHv1 has been completely removed from OpenSSH in version 7.6 -#} -{% if sshd_version is version('7.6', '<') %} -# Set the protocol version explicitly to 2. Version 1 is obsolete and should not be used. -Protocol 2 - -{% endif %} -# Make sure sshd checks file modes and ownership before accepting logins. This prevents accidental misconfiguration. -StrictModes {{ 'yes' if (sshd_strict_modes|bool) else 'no' }} - -# Logging, obsoletes QuietMode and FascistLogging -SyslogFacility {{ sshd_syslog_facility }} -LogLevel {{ sshd_log_level }} - -# Cryptography -# ------------ - -# **Ciphers** -- If your clients don't support CTR (eg older versions), cbc will be added -# CBC: is true if you want to connect with OpenSSL-base libraries -# eg ruby Net::SSH::Transport::CipherFactory requires cbc-versions of the given openssh ciphers to work -# -- see: (http://net-ssh.github.com/net-ssh/classes/Net/SSH/Transport/CipherFactory.html) -# -{# This outputs 'Ciphers ' if ssh_ciphers is defined or '#Ciphers' if ssh_ciphers is undefined -#} -{% if ssh_ciphers is defined and ssh_ciphers -%} -{{ 'Ciphers ' ~ ssh_ciphers|join(',') }} -{% else -%} -{{ 'Ciphers'|comment }} -{% endif %} - -# **Hash algorithms** -- SHA-1 is formally deprecated by NIST in 2011 because of security issues. -# Weak HMAC is sometimes required if older package versions are used -# eg Ruby's Net::SSH at around 2.2.* doesn't support sha2 for hmac, so this will have to be set true in this case. -# -{# This outputs 'MACs ' if ssh_macs is defined or '#MACs' if ssh_macs is undefined -#} -{% if ssh_macs is defined and ssh_macs -%} -{{ 'MACs ' ~ ssh_macs|join(',') }} -{% else -%} -{{ 'MACs'|comment }} -{% endif %} - -{% if sshd_version is version('5.9', '<') %} -# Alternative setting, if OpenSSH version is below v5.9 -#MACs hmac-ripemd160 - -{% endif %} -# **Key Exchange Algorithms** -- SHA-1 is formally deprecated by NIST in 2011 because of security issues. -# Weak kex is sometimes required if older package versions are used -# eg ruby's Net::SSH at around 2.2.* doesn't support sha2 for kex, so this will have to be set true in this case. -# based on: https://bettercrypto.org/static/applied-crypto-hardening.pdf -# -{# This outputs 'KexAlgorithms ' if ssh_kex is defined and ssh_kex or '#KexAlgorithms' if ssh_kex is undefined #} -{% if ssh_kex is defined and ssh_kex -%} -{{ 'KexAlgorithms ' ~ ssh_kex|join(',') }} -{% else -%} -{{ 'KexAlgorithms'|comment }} -{% endif %} - -# Authentication -# -------------- - -# Secure Login directives. -{% if sshd_version is version('7.4', '<') %} -UseLogin no -{% endif %} -{% if sshd_version is version('7.5', '<') %} -UsePrivilegeSeparation {{ ssh_ps59 }} -{% endif %} - -LoginGraceTime {{ ssh_login_grace_time }} -MaxAuthTries {{ ssh_max_auth_retries }} -MaxSessions {{ ssh_max_sessions }} -MaxStartups {{ ssh_max_startups }} - -# Enable public key authentication -PubkeyAuthentication {{ 'yes' if (ssh_pubkey_authentication|bool) else 'no' }} - -# Never use host-based authentication. It can be exploited. -IgnoreRhosts yes -IgnoreUserKnownHosts yes -HostbasedAuthentication no - -{% if ssh_pam_support %} -# Enable PAM to enforce system wide rules. -UsePAM {{ 'yes' if (ssh_use_pam|bool) else 'no' }} - -{% endif %} -{# Set AuthenticationMethods per default to publickey -#} -{# AuthenticationMethods was introduced in OpenSSH 6.2 - https://www.openssh.com/txt/release-6.2 -#} -{% if sshd_version is version('6.2', '>=') %} -AuthenticationMethods {{ sshd_authenticationmethods }} - -{% endif %} -# Disable password-based authentication, it can allow for potentially easier brute-force attacks. -PasswordAuthentication {{ 'yes' if (ssh_server_password_login|bool) else 'no' }} -PermitEmptyPasswords no -ChallengeResponseAuthentication {{ 'yes' if (ssh_challengeresponseauthentication|bool) else 'no' }} - -{% if ssh_kerberos_support %} -# Only enable Kerberos authentication if it is configured. -KerberosAuthentication no -KerberosOrLocalPasswd no -KerberosTicketCleanup yes -#KerberosGetAFSToken no -{% endif %} - -{# OpenBSD does not support GSSAPIAuthentication, so leave this out if on OpenBSD #} -{% if ansible_facts.os_family != 'OpenBSD' -%} -# Only enable GSSAPI authentication if it is configured. -GSSAPIAuthentication {{ 'yes' if ssh_gssapi_support else 'no' }} -GSSAPICleanupCredentials yes - -{% endif %} -{% if ssh_deny_users %} -# In case you don't use PAM (`UsePAM no`), you can alternatively restrict users and groups here. -# For key-based authentication this is not necessary, since all keys must be explicitly enabled. -DenyUsers {{ ssh_deny_users }} - -{% endif %} -{% if ssh_allow_users %} -AllowUsers {{ ssh_allow_users }} - -{% endif %} -{% if ssh_deny_groups %} -DenyGroups {{ ssh_deny_groups }} - -{% endif %} -{% if ssh_allow_groups %} -AllowGroups {{ ssh_allow_groups }} - -{% endif %} -{% if ssh_authorized_keys_file %} -AuthorizedKeysFile {{ ssh_authorized_keys_file }} - -{% endif %} -{% if ssh_trusted_user_ca_keys_file %} -TrustedUserCAKeys {{ ssh_trusted_user_ca_keys_file }} -{% if ssh_authorized_principals_file %} -AuthorizedPrincipalsFile {{ ssh_authorized_principals_file }} -{% endif %} -{% endif %} - -# Network -# ------- - -# Disable TCP keep alive since it is spoofable. Use ClientAlive messages instead, they use the encrypted channel -TCPKeepAlive no - -# Manage `ClientAlive..` signals via interval and maximum count. -# This will periodically check up to a `..CountMax` number of times within `..Interval` timeframe, -# and abort the connection once these fail. -ClientAliveInterval {{ ssh_client_alive_interval }} -ClientAliveCountMax {{ ssh_client_alive_count }} - -# Disable tunneling -PermitTunnel {{ ssh_permit_tunnel }} - -# Disable forwarding tcp connections. -# no real advantage without denied shell access -{% if sshd_version is version('6.2', '>=') %} -AllowTcpForwarding {{ ssh_allow_tcp_forwarding if (ssh_allow_tcp_forwarding in ('yes', 'no', 'local', 'all', 'remote')) else ('yes' if (ssh_allow_tcp_forwarding|bool) else 'no') }} -{% else %} -AllowTcpForwarding {{ ssh_allow_tcp_forwarding if (ssh_allow_tcp_forwarding in ('yes', 'no')) else ('yes' if (ssh_allow_tcp_forwarding|bool) else 'no') }} -{% endif %} - -# Disable agent forwarding, since local agent could be accessed through forwarded connection. -# no real advantage without denied shell access -AllowAgentForwarding {{ 'yes' if (ssh_allow_agent_forwarding|bool) else 'no' }} - -{% if ssh_gateway_ports|bool %} -# Port forwardings are forced to bind to the wildcard address -GatewayPorts yes -{% elif ssh_gateway_ports == 'clientspecified' %} -# Clients allowed to specify which address to bind port forwardings to -GatewayPorts clientspecified -{% else %} -# Do not allow remote port forwardings to bind to non-loopback addresses. -GatewayPorts no -{% endif %} - -# Disable X11 forwarding, since local X11 display could be accessed through forwarded connection. -X11Forwarding {{ 'yes' if (ssh_x11_forwarding|bool) else 'no' }} -X11UseLocalhost yes - -# User environment configuration -# ============================== - -PermitUserEnvironment {{ ssh_server_permit_environment_vars }} - -{% if ssh_server_accept_env_vars %} -AcceptEnv {{ ssh_server_accept_env_vars }} -{% endif %} - -# Misc. configuration -# =================== - -Compression {{ 'yes' if (ssh_compression|bool) else 'no' }} - -UseDNS {{ 'yes' if (ssh_use_dns|bool) else 'no' }} - -PrintMotd {{ 'yes' if (ssh_print_motd|bool) else 'no' }} - -{% if ansible_facts.os_family != 'FreeBSD' %} -PrintLastLog {{ 'yes' if (ssh_print_last_log|bool) else 'no' }} -{% endif %} - -Banner {{ ssh_banner_path if (ssh_banner|bool) else 'none' }} - -{% if ansible_facts.os_family == 'Debian' %} -DebianBanner {{ 'yes' if (ssh_print_debian_banner|bool) else 'no' }} - -{% endif %} -# Reject keys that are explicitly blacklisted -RevokedKeys /etc/ssh/revoked_keys - -{% if sftp_enabled %} -# SFTP matching configuration -# =========================== -# Configuration, in case SFTP is used -# override default of no subsystems -# Subsystem sftp /opt/app/openssh5/libexec/sftp-server - -Subsystem sftp internal-sftp -l INFO -f LOCAL6 -u {{ sftp_umask }} -{% endif %} -{% if ssh_server_match_address %} - -# Address matching configuration -# ============================ - -{% for item in ssh_server_match_address %} -Match Address {{ item.address }} - {% for rule in item.rules %} - {{ rule | indent(4) }} - {% endfor %} -{% endfor %} -{% endif %} -{% if ssh_server_match_group %} - -# Group matching configuration -# ============================ - -{% for item in ssh_server_match_group %} -Match Group {{ item.group }} - {% for rule in item.rules %} - {{ rule | indent(4) }} - {% endfor %} -{% endfor %} -{% endif %} -{% if ssh_server_match_user %} - -# User matching configuration -# =========================== - -{% for item in ssh_server_match_user %} -Match User {{ item.user }} - {% for rule in item.rules %} - {{ rule | indent(4) }} - {% endfor %} -{% endfor %} -{% endif %} -{% if ssh_server_match_local_port %} - -# LocalPort matching configuration -# ================================ - -{% for item in ssh_server_match_local_port %} -Match LocalPort {{ item.port }} - {% for rule in item.rules %} - {{ rule | indent(4) }} - {% endfor %} -{% endfor %} -{% endif %} - -{% if sftp_enabled %} -# These lines must appear at the *end* of sshd_config -Match Group sftponly - ForceCommand internal-sftp -l INFO -f LOCAL6 -u {{ sftp_umask }} -{% if sftp_chroot %} - ChrootDirectory {{ sftp_chroot_dir }} -{% endif %} - AllowTcpForwarding no - AllowAgentForwarding no - PasswordAuthentication {{ 'yes' if (ssh_server_password_login|bool) else 'no' }} - PermitRootLogin no - X11Forwarding no -{% endif %} diff --git a/ansible/playbooks/paas/roles/sshd/templates/revoked_keys.j2 b/ansible/playbooks/paas/roles/sshd/templates/revoked_keys.j2 deleted file mode 100644 index 5d1b5b3f..00000000 --- a/ansible/playbooks/paas/roles/sshd/templates/revoked_keys.j2 +++ /dev/null @@ -1,6 +0,0 @@ -{{ ansible_managed | comment }} -# Generated by Ansible role {{ ansible_role_name }} - -{% for key in ssh_server_revoked_keys %} -{{ key }} -{% endfor %} diff --git a/ansible/playbooks/paas/roles/sshd/templates/trusted_user_ca_keys.j2 b/ansible/playbooks/paas/roles/sshd/templates/trusted_user_ca_keys.j2 deleted file mode 100644 index dddd12ba..00000000 --- a/ansible/playbooks/paas/roles/sshd/templates/trusted_user_ca_keys.j2 +++ /dev/null @@ -1,6 +0,0 @@ -{{ ansible_managed | comment }} -# Generated by Ansible role {{ ansible_role_name }} - -{% for key in ssh_trusted_user_ca_keys %} -{{ key }} -{% endfor %} diff --git a/ansible/playbooks/paas/roles/sshd/vars/main.yml b/ansible/playbooks/paas/roles/sshd/vars/main.yml deleted file mode 100644 index 44c7f618..00000000 --- a/ansible/playbooks/paas/roles/sshd/vars/main.yml +++ /dev/null @@ -1,73 +0,0 @@ ---- -ssh_pkgs: - - openssh-server - - openssh-client -sshd_path: /usr/sbin/sshd -ssh_host_keys_dir: /etc/ssh -sshd_service_name: ssh -ssh_owner: root -ssh_group: root -ssh_host_keys_owner: root -ssh_host_keys_group: root -ssh_host_keys_mode: "0600" - -# true if SSH support Kerberos -ssh_kerberos_support: false - -# true if SSH has PAM support -ssh_pam_support: true - -sshd_moduli_file: /etc/ssh/moduli - -ssh_macs_53_default: - - hmac-ripemd160 - - hmac-sha1 - -ssh_macs_59_default: - - hmac-sha2-512 - - hmac-sha2-256 - - hmac-ripemd160 - -ssh_macs_66_default: - - hmac-sha2-512-etm@openssh.com - - hmac-sha2-256-etm@openssh.com - - umac-128-etm@openssh.com - - hmac-sha2-512 - - hmac-sha2-256 - -ssh_macs_76_default: - - hmac-sha2-512-etm@openssh.com - - hmac-sha2-256-etm@openssh.com - - umac-128-etm@openssh.com - - hmac-sha2-512 - - hmac-sha2-256 - -ssh_ciphers_53_default: - - aes256-ctr - - aes192-ctr - - aes128-ctr - -ssh_ciphers_66_default: - - chacha20-poly1305@openssh.com - - aes256-gcm@openssh.com - - aes128-gcm@openssh.com - - aes256-ctr - - aes192-ctr - - aes128-ctr - -ssh_kex_59_default: - - diffie-hellman-group-exchange-sha256 - -ssh_kex_66_default: - - curve25519-sha256@libssh.org - - diffie-hellman-group-exchange-sha256 - -ssh_kex_80_default: - - sntrup4591761x25519-sha512@tinyssh.org - - curve25519-sha256@libssh.org - - diffie-hellman-group-exchange-sha256 - -ssh_kex_85_default: - - sntrup761x25519-sha512@openssh.com - - curve25519-sha256@libssh.org - - diffie-hellman-group-exchange-sha256 diff --git a/ansible/playbooks/paas/sshd.yml b/ansible/playbooks/paas/sshd.yml deleted file mode 100644 index 24728021..00000000 --- a/ansible/playbooks/paas/sshd.yml +++ /dev/null @@ -1,12 +0,0 @@ ---- -- name: Install ssh hardening - any_errors_fatal: true - hosts: "{{ hosts_limit | default('infrastructure') }}" - gather_facts: true - become: true - pre_tasks: - - name: End the play for hosts that are not in frontends group - ansible.builtin.meta: end_host - when: fact_instance.location != 'frontends' - roles: - - sshd diff --git a/ansible/playbooks/saas/main.yml b/ansible/playbooks/saas/main.yml index 7f1df3c9..fc45d458 100644 --- a/ansible/playbooks/saas/main.yml +++ b/ansible/playbooks/saas/main.yml @@ -33,10 +33,6 @@ ansible.builtin.debug: msg: "{{ software }}" - - name: Debug softwares - ansible.builtin.debug: - msg: "{{ softwares }}" - tasks: - name: Deploy service ansible.builtin.include_role: diff --git a/ansible/playbooks/saas/mimirtools.yml b/ansible/playbooks/saas/mimirtools.yml index cf617e17..b9f3bbe2 100644 --- a/ansible/playbooks/saas/mimirtools.yml +++ b/ansible/playbooks/saas/mimirtools.yml @@ -14,8 +14,8 @@ mimir_env: MIMIR_TENANT_ID: demo MIMIR_ADDRESS: "https://{{ endpoint }}" - MIMIR_API_USER: "{{ lookup('simple-stack-ui', type='secret', key=endpoint, subkey='login', missing='error') }}" - MIMIR_API_KEY: "{{ lookup('simple-stack-ui', type='secret', key=endpoint, subkey='passwd', missing='error') }}" + MIMIR_API_USER: "{{ lookup('simple-stack-ui', type='secret', key2=endpoint, subkey='login', missing='error') }}" + MIMIR_API_KEY: "{{ lookup('simple-stack-ui', type='secret', key2=endpoint, subkey='passwd', missing='error') }}" pre_tasks: - name: Create temporary directory ansible.builtin.file: @@ -25,7 +25,7 @@ - name: Get alertmanager configuration set_fact: - alertmanager: "{{ lookup('simple-stack-ui', type='secret', key=endpoint, subkey='alertmanager', missing='warn') | from_json }}" + alertmanager: "{{ lookup('simple-stack-ui', type='secret', key2=endpoint, subkey='alertmanager', missing='warn') | from_json }}" tasks: - name: Deploy configuration diff --git a/ansible/playbooks/saas/roles/adguard/tasks/destroy.yml b/ansible/playbooks/saas/roles/adguard/tasks/destroy.yml index ce77a12b..a246acc0 100644 --- a/ansible/playbooks/saas/roles/adguard/tasks/destroy.yml +++ b/ansible/playbooks/saas/roles/adguard/tasks/destroy.yml @@ -1,10 +1,5 @@ --- -- name: Stop nomad job +- name: Destroy service ansible.builtin.include_role: - name: nomad - tasks_from: job_stop.yml - -- name: Remove software directory - ansible.builtin.file: - path: "{{ software_path }}" - state: absent + name: common + tasks_from: destroy.yml diff --git a/ansible/playbooks/saas/roles/arangodb/tasks/backup.yml b/ansible/playbooks/saas/roles/arangodb/tasks/backup.yml index d6e4002d..2ed501bb 100644 --- a/ansible/playbooks/saas/roles/arangodb/tasks/backup.yml +++ b/ansible/playbooks/saas/roles/arangodb/tasks/backup.yml @@ -1,7 +1,5 @@ --- -- name: Run nomad job +- name: Backup service ansible.builtin.include_role: - name: nomad - tasks_from: job_periodic_run.yml - vars: - job_name: "{{ domain }}-periodic" + name: common + tasks_from: backup_periodic.yml diff --git a/ansible/playbooks/saas/roles/arangodb/tasks/destroy.yml b/ansible/playbooks/saas/roles/arangodb/tasks/destroy.yml index 55799c65..e867a5b3 100644 --- a/ansible/playbooks/saas/roles/arangodb/tasks/destroy.yml +++ b/ansible/playbooks/saas/roles/arangodb/tasks/destroy.yml @@ -1,15 +1,5 @@ --- -- name: Stop nomad job +- name: Destroy service ansible.builtin.include_role: - name: nomad - tasks_from: job_stop.yml - vars: - job_name: "{{ item }}" - loop: - - "{{ domain }}" - - "{{ domain }}-periodic" - -- name: Remove software directory - ansible.builtin.file: - path: "{{ software_path }}" - state: absent + name: common + tasks_from: destroy_with_periodic.yml diff --git a/ansible/playbooks/saas/roles/arangodb/tasks/restore.yml b/ansible/playbooks/saas/roles/arangodb/tasks/restore.yml index c92e4b1b..b96e3037 100644 --- a/ansible/playbooks/saas/roles/arangodb/tasks/restore.yml +++ b/ansible/playbooks/saas/roles/arangodb/tasks/restore.yml @@ -2,12 +2,9 @@ - name: Include actions variables ansible.builtin.include_vars: actions.yml -- name: Run nomad restore job +- name: Restore service ansible.builtin.include_role: - name: nomad - tasks_from: job_action.yml + name: common + tasks_from: restore_with_action.yml vars: - operation: restore - job_name: "{{ domain }}-restore" - periodic: false - actions: "{{ arangodb_actions }}" + restore_actions: "{{ arangodb_actions }}" diff --git a/ansible/playbooks/saas/roles/caddy/tasks/destroy.yml b/ansible/playbooks/saas/roles/caddy/tasks/destroy.yml index ce77a12b..a246acc0 100644 --- a/ansible/playbooks/saas/roles/caddy/tasks/destroy.yml +++ b/ansible/playbooks/saas/roles/caddy/tasks/destroy.yml @@ -1,10 +1,5 @@ --- -- name: Stop nomad job +- name: Destroy service ansible.builtin.include_role: - name: nomad - tasks_from: job_stop.yml - -- name: Remove software directory - ansible.builtin.file: - path: "{{ software_path }}" - state: absent + name: common + tasks_from: destroy.yml diff --git a/ansible/playbooks/saas/roles/common/tasks/backup_periodic.yml b/ansible/playbooks/saas/roles/common/tasks/backup_periodic.yml new file mode 100644 index 00000000..22f0ae97 --- /dev/null +++ b/ansible/playbooks/saas/roles/common/tasks/backup_periodic.yml @@ -0,0 +1,7 @@ +--- +- name: Run nomad backup job + ansible.builtin.include_role: + name: nomad + tasks_from: job_periodic_run.yml + vars: + job_name: "{{ domain }}-periodic" diff --git a/ansible/playbooks/saas/roles/common/tasks/backup_with_action.yml b/ansible/playbooks/saas/roles/common/tasks/backup_with_action.yml new file mode 100644 index 00000000..d6355461 --- /dev/null +++ b/ansible/playbooks/saas/roles/common/tasks/backup_with_action.yml @@ -0,0 +1,10 @@ +--- +- name: Run nomad backup job + ansible.builtin.include_role: + name: nomad + tasks_from: job_action.yml + vars: + operation: backup + job_name: "{{ domain }}-backup" + periodic: false + actions: "{{ backup_actions }}" diff --git a/ansible/playbooks/saas/roles/common/tasks/destroy.yml b/ansible/playbooks/saas/roles/common/tasks/destroy.yml new file mode 100644 index 00000000..ce77a12b --- /dev/null +++ b/ansible/playbooks/saas/roles/common/tasks/destroy.yml @@ -0,0 +1,10 @@ +--- +- name: Stop nomad job + ansible.builtin.include_role: + name: nomad + tasks_from: job_stop.yml + +- name: Remove software directory + ansible.builtin.file: + path: "{{ software_path }}" + state: absent diff --git a/ansible/playbooks/saas/roles/common/tasks/destroy_delegated.yml b/ansible/playbooks/saas/roles/common/tasks/destroy_delegated.yml new file mode 100644 index 00000000..15f1ec71 --- /dev/null +++ b/ansible/playbooks/saas/roles/common/tasks/destroy_delegated.yml @@ -0,0 +1,11 @@ +--- +- name: Stop nomad job + ansible.builtin.include_role: + name: nomad + tasks_from: job_stop.yml + +- name: Remove software directory + ansible.builtin.file: + path: "{{ software_path }}" + state: absent + delegate_to: "{{ software.instance }}" diff --git a/ansible/playbooks/saas/roles/common/tasks/destroy_with_mysql.yml b/ansible/playbooks/saas/roles/common/tasks/destroy_with_mysql.yml new file mode 100644 index 00000000..44168d82 --- /dev/null +++ b/ansible/playbooks/saas/roles/common/tasks/destroy_with_mysql.yml @@ -0,0 +1,29 @@ +--- +- name: Stop nomad job + ansible.builtin.include_role: + name: nomad + tasks_from: job_stop.yml + +- name: Mysql delete database + community.mysql.mysql_db: + login_user: root + login_password: "{{ lookup('simple-stack-ui', type='secret', key2=software.dbhost, subkey='passwd', missing='error') }}" + login_unix_socket: "/data/{{ software.dbhost }}/run/mysqld/mysqld.sock" + name: "{{ service_name[:32] }}" + state: absent + +- name: Mysql delete user + community.mysql.mysql_user: + login_user: root + login_password: "{{ lookup('simple-stack-ui', type='secret', key2=software.dbhost, subkey='passwd', missing='error') }}" + login_unix_socket: "/data/{{ software.dbhost }}/run/mysqld/mysqld.sock" + name: "{{ lookup('simple-stack-ui', type='secret', key=domain, subkey='mysql_user', missing='error') }}" + host: '%' + priv: "{{ service_name[:32] }}.*:ALL" + state: absent + column_case_sensitive: false + +- name: Remove software directory + ansible.builtin.file: + path: "{{ software_path }}" + state: absent diff --git a/ansible/playbooks/saas/roles/common/tasks/destroy_with_periodic.yml b/ansible/playbooks/saas/roles/common/tasks/destroy_with_periodic.yml new file mode 100644 index 00000000..ac2f07c5 --- /dev/null +++ b/ansible/playbooks/saas/roles/common/tasks/destroy_with_periodic.yml @@ -0,0 +1,15 @@ +--- +- name: Stop nomad jobs + ansible.builtin.include_role: + name: nomad + tasks_from: job_stop.yml + vars: + job_name: "{{ item }}" + loop: + - "{{ domain }}" + - "{{ domain }}-periodic" + +- name: Remove software directory + ansible.builtin.file: + path: "{{ software_path }}" + state: absent diff --git a/ansible/playbooks/saas/roles/common/tasks/destroy_with_periodic_and_mysql.yml b/ansible/playbooks/saas/roles/common/tasks/destroy_with_periodic_and_mysql.yml new file mode 100644 index 00000000..2d72f138 --- /dev/null +++ b/ansible/playbooks/saas/roles/common/tasks/destroy_with_periodic_and_mysql.yml @@ -0,0 +1,34 @@ +--- +- name: Stop nomad jobs + ansible.builtin.include_role: + name: nomad + tasks_from: job_stop.yml + vars: + job_name: "{{ item }}" + loop: + - "{{ domain }}" + - "{{ domain }}-periodic" + +- name: Mysql delete database + community.mysql.mysql_db: + login_user: root + login_password: "{{ lookup('simple-stack-ui', type='secret', key2=software.dbhost, subkey='passwd', missing='error') }}" + login_unix_socket: "/data/{{ software.dbhost }}/run/mysqld/mysqld.sock" + name: "{{ service_name[:32] }}" + state: absent + +- name: Mysql delete user + community.mysql.mysql_user: + login_user: root + login_password: "{{ lookup('simple-stack-ui', type='secret', key2=software.dbhost, subkey='passwd', missing='error') }}" + login_unix_socket: "/data/{{ software.dbhost }}/run/mysqld/mysqld.sock" + name: "{{ lookup('simple-stack-ui', type='secret', key=domain, subkey='mysql_user', missing='error') }}" + host: '%' + priv: "{{ service_name[:32] }}.*:ALL" + state: absent + column_case_sensitive: false + +- name: Remove software directory + ansible.builtin.file: + path: "{{ software_path }}" + state: absent diff --git a/ansible/playbooks/saas/roles/common/tasks/restore_with_action.yml b/ansible/playbooks/saas/roles/common/tasks/restore_with_action.yml new file mode 100644 index 00000000..e5839ae3 --- /dev/null +++ b/ansible/playbooks/saas/roles/common/tasks/restore_with_action.yml @@ -0,0 +1,10 @@ +--- +- name: Run nomad restore job + ansible.builtin.include_role: + name: nomad + tasks_from: job_action.yml + vars: + operation: restore + job_name: "{{ domain }}-restore" + periodic: false + actions: "{{ restore_actions }}" diff --git a/ansible/playbooks/saas/roles/dolibarr/tasks/backup.yml b/ansible/playbooks/saas/roles/dolibarr/tasks/backup.yml index 26dde046..5cb542dd 100644 --- a/ansible/playbooks/saas/roles/dolibarr/tasks/backup.yml +++ b/ansible/playbooks/saas/roles/dolibarr/tasks/backup.yml @@ -2,12 +2,9 @@ - name: Include actions variables ansible.builtin.include_vars: actions.yml -- name: Run nomad backup job +- name: Backup service ansible.builtin.include_role: - name: nomad - tasks_from: job_action.yml + name: common + tasks_from: backup_with_action.yml vars: - operation: backup - job_name: "{{ domain }}-backup" - periodic: false - actions: "{{ dolibarr_actions }}" + backup_actions: "{{ dolibarr_actions }}" diff --git a/ansible/playbooks/saas/roles/dolibarr/tasks/destroy.yml b/ansible/playbooks/saas/roles/dolibarr/tasks/destroy.yml index 97a9a16b..3d3b5e78 100644 --- a/ansible/playbooks/saas/roles/dolibarr/tasks/destroy.yml +++ b/ansible/playbooks/saas/roles/dolibarr/tasks/destroy.yml @@ -1,34 +1,5 @@ --- -- name: Stop nomad job +- name: Destroy service ansible.builtin.include_role: - name: nomad - tasks_from: job_stop.yml - vars: - job_name: "{{ item }}" - loop: - - "{{ domain }}" - - "{{ domain }}-periodic" - -- name: Mysql delete database - community.mysql.mysql_db: - login_user: root - login_password: "{{ lookup('simple-stack-ui', type='secret', key=software.dbhost, subkey='passwd', missing='error') }}" - login_unix_socket: "/data/{{ software.dbhost }}/run/mysqld/mysqld.sock" - name: "{{ service_name[:32] }}" - state: absent - -- name: Mysql delete user - community.mysql.mysql_user: - login_user: root - login_password: "{{ lookup('simple-stack-ui', type='secret', key=software.dbhost, subkey='passwd', missing='error') }}" - login_unix_socket: "/data/{{ software.dbhost }}/run/mysqld/mysqld.sock" - name: "{{ lookup('simple-stack-ui', type='secret', key=domain, subkey='mysql_user', missing='error') }}" - host: '%' - priv: "{{ service_name[:32] }}.*:ALL" - state: absent - column_case_sensitive: false - -- name: Remove software directory - ansible.builtin.file: - path: "{{ software_path }}" - state: absent + name: common + tasks_from: destroy_with_periodic_and_mysql.yml diff --git a/ansible/playbooks/saas/roles/dolibarr/tasks/install.yml b/ansible/playbooks/saas/roles/dolibarr/tasks/install.yml index dcbd10bb..9baaad03 100644 --- a/ansible/playbooks/saas/roles/dolibarr/tasks/install.yml +++ b/ansible/playbooks/saas/roles/dolibarr/tasks/install.yml @@ -18,7 +18,7 @@ - name: Create mysql database community.mysql.mysql_db: login_user: root - login_password: "{{ lookup('simple-stack-ui', type='secret', key=software.dbhost, subkey='passwd', missing='error') }}" + login_password: "{{ lookup('simple-stack-ui', type='secret', key2=software.dbhost, subkey='passwd', missing='error') }}" login_unix_socket: "/data/{{ software.dbhost }}/run/mysqld/mysqld.sock" name: "{{ software.dbname | default(service_name[:32]) }}" encoding: utf8 @@ -28,7 +28,7 @@ - name: Create mysql user community.mysql.mysql_user: login_user: root - login_password: "{{ lookup('simple-stack-ui', type='secret', key=software.dbhost, subkey='passwd', missing='error') }}" + login_password: "{{ lookup('simple-stack-ui', type='secret', key2=software.dbhost, subkey='passwd', missing='error') }}" login_unix_socket: "/data/{{ software.dbhost }}/run/mysqld/mysqld.sock" name: "{{ lookup('simple-stack-ui', type='secret', key=domain, subkey='mysql_user', missing='create', nosymbols=true, length=8, userpass=software.dbuser | default(none)) }}" host: '%' diff --git a/ansible/playbooks/saas/roles/dolibarr/tasks/restore.yml b/ansible/playbooks/saas/roles/dolibarr/tasks/restore.yml index 61320d9f..fb5e0675 100644 --- a/ansible/playbooks/saas/roles/dolibarr/tasks/restore.yml +++ b/ansible/playbooks/saas/roles/dolibarr/tasks/restore.yml @@ -2,12 +2,9 @@ - name: Include actions variables ansible.builtin.include_vars: actions.yml -- name: Run nomad restore job +- name: Restore service ansible.builtin.include_role: - name: nomad - tasks_from: job_action.yml + name: common + tasks_from: restore_with_action.yml vars: - operation: restore - job_name: "{{ domain }}-restore" - periodic: false - actions: "{{ dolibarr_actions }}" + restore_actions: "{{ dolibarr_actions }}" diff --git a/ansible/playbooks/saas/roles/forgejo/tasks/backup.yml b/ansible/playbooks/saas/roles/forgejo/tasks/backup.yml index d6e4002d..2ed501bb 100644 --- a/ansible/playbooks/saas/roles/forgejo/tasks/backup.yml +++ b/ansible/playbooks/saas/roles/forgejo/tasks/backup.yml @@ -1,7 +1,5 @@ --- -- name: Run nomad job +- name: Backup service ansible.builtin.include_role: - name: nomad - tasks_from: job_periodic_run.yml - vars: - job_name: "{{ domain }}-periodic" + name: common + tasks_from: backup_periodic.yml diff --git a/ansible/playbooks/saas/roles/forgejo/tasks/destroy.yml b/ansible/playbooks/saas/roles/forgejo/tasks/destroy.yml index a391035f..1dc12747 100644 --- a/ansible/playbooks/saas/roles/forgejo/tasks/destroy.yml +++ b/ansible/playbooks/saas/roles/forgejo/tasks/destroy.yml @@ -1,29 +1,5 @@ --- -- name: Stop nomad job +- name: Destroy service ansible.builtin.include_role: - name: nomad - tasks_from: job_stop.yml - -- name: Mysql delete database - community.mysql.mysql_db: - login_user: root - login_password: "{{ lookup('simple-stack-ui', type='secret', key=software.dbhost, subkey='passwd', missing='error') }}" - login_unix_socket: "/data/{{ software.dbhost }}/run/mysqld/mysqld.sock" - name: "{{ service_name[:32] }}" - state: absent - -- name: Mysql delete user - community.mysql.mysql_user: - login_user: root - login_password: "{{ lookup('simple-stack-ui', type='secret', key=software.dbhost, subkey='passwd', missing='error') }}" - login_unix_socket: "/data/{{ software.dbhost }}/run/mysqld/mysqld.sock" - name: "{{ lookup('simple-stack-ui', type='secret', key=domain, subkey='mysql_user', missing='error') }}" - host: '%' - priv: "{{ service_name[:32] }}.*:ALL" - state: absent - column_case_sensitive: false - -- name: Remove software directory - ansible.builtin.file: - path: "{{ software_path }}" - state: absent + name: common + tasks_from: destroy_with_mysql.yml diff --git a/ansible/playbooks/saas/roles/forgejo/tasks/main.yml b/ansible/playbooks/saas/roles/forgejo/tasks/main.yml index 3e40fe09..e58d1dd2 100644 --- a/ansible/playbooks/saas/roles/forgejo/tasks/main.yml +++ b/ansible/playbooks/saas/roles/forgejo/tasks/main.yml @@ -28,7 +28,7 @@ - name: Create mysql database community.mysql.mysql_db: login_user: root - login_password: "{{ lookup('simple-stack-ui', type='secret', key=software.dbhost, subkey='passwd', missing='error') }}" + login_password: "{{ lookup('simple-stack-ui', type='secret', key2=software.dbhost, subkey='passwd', missing='error') }}" login_unix_socket: "/data/{{ software.dbhost }}/run/mysqld/mysqld.sock" name: "{{ software.dbname | default(service_name[:32]) }}" encoding: utf8 @@ -38,7 +38,7 @@ - name: Create mysql user community.mysql.mysql_user: login_user: root - login_password: "{{ lookup('simple-stack-ui', type='secret', key=software.dbhost, subkey='passwd', missing='error') }}" + login_password: "{{ lookup('simple-stack-ui', type='secret', key2=software.dbhost, subkey='passwd', missing='error') }}" login_unix_socket: "/data/{{ software.dbhost }}/run/mysqld/mysqld.sock" name: "{{ lookup('simple-stack-ui', type='secret', key=domain, subkey='mysql_user', missing='create', nosymbols=true, length=8) }}" host: '%' diff --git a/ansible/playbooks/saas/roles/forgejo/tasks/restore.yml b/ansible/playbooks/saas/roles/forgejo/tasks/restore.yml index 94c81fce..25abbd5b 100644 --- a/ansible/playbooks/saas/roles/forgejo/tasks/restore.yml +++ b/ansible/playbooks/saas/roles/forgejo/tasks/restore.yml @@ -2,12 +2,9 @@ - name: Include actions variables ansible.builtin.include_vars: actions.yml -- name: Run nomad job +- name: Restore service ansible.builtin.include_role: - name: nomad - tasks_from: job_action.yml + name: common + tasks_from: restore_with_action.yml vars: - operation: restore - job_name: "{{ domain }}-restore" - periodic: false - actions: "{{ forgejo_actions }}" + restore_actions: "{{ forgejo_actions }}" diff --git a/ansible/playbooks/saas/roles/freshrss/tasks/destroy.yml b/ansible/playbooks/saas/roles/freshrss/tasks/destroy.yml index ce77a12b..a246acc0 100644 --- a/ansible/playbooks/saas/roles/freshrss/tasks/destroy.yml +++ b/ansible/playbooks/saas/roles/freshrss/tasks/destroy.yml @@ -1,10 +1,5 @@ --- -- name: Stop nomad job +- name: Destroy service ansible.builtin.include_role: - name: nomad - tasks_from: job_stop.yml - -- name: Remove software directory - ansible.builtin.file: - path: "{{ software_path }}" - state: absent + name: common + tasks_from: destroy.yml diff --git a/ansible/playbooks/saas/roles/grafana/tasks/destroy.yml b/ansible/playbooks/saas/roles/grafana/tasks/destroy.yml index 15f1ec71..b700905c 100644 --- a/ansible/playbooks/saas/roles/grafana/tasks/destroy.yml +++ b/ansible/playbooks/saas/roles/grafana/tasks/destroy.yml @@ -1,11 +1,5 @@ --- -- name: Stop nomad job +- name: Destroy service ansible.builtin.include_role: - name: nomad - tasks_from: job_stop.yml - -- name: Remove software directory - ansible.builtin.file: - path: "{{ software_path }}" - state: absent - delegate_to: "{{ software.instance }}" + name: common + tasks_from: destroy_delegated.yml diff --git a/ansible/playbooks/saas/roles/homeassistant/tasks/destroy.yml b/ansible/playbooks/saas/roles/homeassistant/tasks/destroy.yml index ce77a12b..a246acc0 100644 --- a/ansible/playbooks/saas/roles/homeassistant/tasks/destroy.yml +++ b/ansible/playbooks/saas/roles/homeassistant/tasks/destroy.yml @@ -1,10 +1,5 @@ --- -- name: Stop nomad job +- name: Destroy service ansible.builtin.include_role: - name: nomad - tasks_from: job_stop.yml - -- name: Remove software directory - ansible.builtin.file: - path: "{{ software_path }}" - state: absent + name: common + tasks_from: destroy.yml diff --git a/ansible/playbooks/saas/roles/kresus/tasks/destroy.yml b/ansible/playbooks/saas/roles/kresus/tasks/destroy.yml index ce77a12b..a246acc0 100644 --- a/ansible/playbooks/saas/roles/kresus/tasks/destroy.yml +++ b/ansible/playbooks/saas/roles/kresus/tasks/destroy.yml @@ -1,10 +1,5 @@ --- -- name: Stop nomad job +- name: Destroy service ansible.builtin.include_role: - name: nomad - tasks_from: job_stop.yml - -- name: Remove software directory - ansible.builtin.file: - path: "{{ software_path }}" - state: absent + name: common + tasks_from: destroy.yml diff --git a/ansible/playbooks/saas/roles/kresus/tasks/main.yml b/ansible/playbooks/saas/roles/kresus/tasks/main.yml index ad8ecf42..73702f7c 100644 --- a/ansible/playbooks/saas/roles/kresus/tasks/main.yml +++ b/ansible/playbooks/saas/roles/kresus/tasks/main.yml @@ -13,7 +13,7 @@ - name: Create postgresql database community.postgresql.postgresql_db: - login_password: "{{ lookup('simple-stack-ui', type='secret', key=software.dbhost, subkey='passwd', missing='error') }}" + login_password: "{{ lookup('simple-stack-ui', type='secret', key2=software.dbhost, subkey='passwd', missing='error') }}" login_unix_socket: "/data/{{ software.dbhost }}/tmp" login_user: postgres name: "{{ service_name }}" @@ -22,7 +22,7 @@ - name: Create postgresql user community.postgresql.postgresql_user: - login_password: "{{ lookup('simple-stack-ui', type='secret', key=software.dbhost, subkey='passwd', missing='error') }}" + login_password: "{{ lookup('simple-stack-ui', type='secret', key2=software.dbhost, subkey='passwd', missing='error') }}" login_unix_socket: "/data/{{ software.dbhost }}/tmp" login_user: postgres login_db: "{{ service_name }}" @@ -32,7 +32,7 @@ - name: Create postgresql priviledges community.postgresql.postgresql_privs: - login_password: "{{ lookup('simple-stack-ui', type='secret', key=software.dbhost, subkey='passwd', missing='error') }}" + login_password: "{{ lookup('simple-stack-ui', type='secret', key2=software.dbhost, subkey='passwd', missing='error') }}" login_unix_socket: "/data/{{ software.dbhost }}/tmp" login_user: postgres db: "{{ service_name }}" diff --git a/ansible/playbooks/saas/roles/litellm/tasks/destroy.yml b/ansible/playbooks/saas/roles/litellm/tasks/destroy.yml index 15f1ec71..b700905c 100644 --- a/ansible/playbooks/saas/roles/litellm/tasks/destroy.yml +++ b/ansible/playbooks/saas/roles/litellm/tasks/destroy.yml @@ -1,11 +1,5 @@ --- -- name: Stop nomad job +- name: Destroy service ansible.builtin.include_role: - name: nomad - tasks_from: job_stop.yml - -- name: Remove software directory - ansible.builtin.file: - path: "{{ software_path }}" - state: absent - delegate_to: "{{ software.instance }}" + name: common + tasks_from: destroy_delegated.yml diff --git a/ansible/playbooks/saas/roles/litellm/tasks/main.yml b/ansible/playbooks/saas/roles/litellm/tasks/main.yml index 6bda2d69..c5498802 100644 --- a/ansible/playbooks/saas/roles/litellm/tasks/main.yml +++ b/ansible/playbooks/saas/roles/litellm/tasks/main.yml @@ -6,8 +6,8 @@ - name: Create postgresql database community.postgresql.postgresql_db: - login_password: "{{ lookup('simple-stack-ui', type='secret', key=software.litellm_dbhost, subkey='passwd', missing='error') }}" - login_host: "{{ lookup('simple-stack-ui', type='secret', key=software.litellm_dbhost, subkey='service_name', missing='error') }}" + login_password: "{{ lookup('simple-stack-ui', type='secret', key2=software.litellm_dbhost, subkey='passwd', missing='error') }}" + login_host: "{{ lookup('simple-stack-ui', type='secret', key2=software.litellm_dbhost, subkey='service_name', missing='error') }}" login_user: postgres name: "{{ service_name }}" encoding: UTF8 @@ -15,8 +15,8 @@ - name: Create postgresql user community.postgresql.postgresql_user: - login_password: "{{ lookup('simple-stack-ui', type='secret', key=software.litellm_dbhost, subkey='passwd', missing='error') }}" - login_host: "{{ lookup('simple-stack-ui', type='secret', key=software.litellm_dbhost, subkey='service_name', missing='error') }}" + login_password: "{{ lookup('simple-stack-ui', type='secret', key2=software.litellm_dbhost, subkey='passwd', missing='error') }}" + login_host: "{{ lookup('simple-stack-ui', type='secret', key2=software.litellm_dbhost, subkey='service_name', missing='error') }}" login_user: postgres login_db: "{{ service_name }}" name: "{{ service_name }}" @@ -25,8 +25,8 @@ - name: Create postgresql privileges community.postgresql.postgresql_privs: - login_password: "{{ lookup('simple-stack-ui', type='secret', key=software.litellm_dbhost, subkey='passwd', missing='error') }}" - login_host: "{{ lookup('simple-stack-ui', type='secret', key=software.litellm_dbhost, subkey='service_name', missing='error') }}" + login_password: "{{ lookup('simple-stack-ui', type='secret', key2=software.litellm_dbhost, subkey='passwd', missing='error') }}" + login_host: "{{ lookup('simple-stack-ui', type='secret', key2=software.litellm_dbhost, subkey='service_name', missing='error') }}" login_user: postgres db: "{{ service_name }}" roles: "{{ service_name }}" diff --git a/ansible/playbooks/saas/roles/loki/tasks/destroy.yml b/ansible/playbooks/saas/roles/loki/tasks/destroy.yml index ce77a12b..a246acc0 100644 --- a/ansible/playbooks/saas/roles/loki/tasks/destroy.yml +++ b/ansible/playbooks/saas/roles/loki/tasks/destroy.yml @@ -1,10 +1,5 @@ --- -- name: Stop nomad job +- name: Destroy service ansible.builtin.include_role: - name: nomad - tasks_from: job_stop.yml - -- name: Remove software directory - ansible.builtin.file: - path: "{{ software_path }}" - state: absent + name: common + tasks_from: destroy.yml diff --git a/ansible/playbooks/saas/roles/mariadb/tasks/backup.yml b/ansible/playbooks/saas/roles/mariadb/tasks/backup.yml index d6e4002d..2ed501bb 100644 --- a/ansible/playbooks/saas/roles/mariadb/tasks/backup.yml +++ b/ansible/playbooks/saas/roles/mariadb/tasks/backup.yml @@ -1,7 +1,5 @@ --- -- name: Run nomad job +- name: Backup service ansible.builtin.include_role: - name: nomad - tasks_from: job_periodic_run.yml - vars: - job_name: "{{ domain }}-periodic" + name: common + tasks_from: backup_periodic.yml diff --git a/ansible/playbooks/saas/roles/mariadb/tasks/destroy.yml b/ansible/playbooks/saas/roles/mariadb/tasks/destroy.yml index 55799c65..e867a5b3 100644 --- a/ansible/playbooks/saas/roles/mariadb/tasks/destroy.yml +++ b/ansible/playbooks/saas/roles/mariadb/tasks/destroy.yml @@ -1,15 +1,5 @@ --- -- name: Stop nomad job +- name: Destroy service ansible.builtin.include_role: - name: nomad - tasks_from: job_stop.yml - vars: - job_name: "{{ item }}" - loop: - - "{{ domain }}" - - "{{ domain }}-periodic" - -- name: Remove software directory - ansible.builtin.file: - path: "{{ software_path }}" - state: absent + name: common + tasks_from: destroy_with_periodic.yml diff --git a/ansible/playbooks/saas/roles/mariadb/tasks/restore.yml b/ansible/playbooks/saas/roles/mariadb/tasks/restore.yml index 9e093f8a..f01705c3 100644 --- a/ansible/playbooks/saas/roles/mariadb/tasks/restore.yml +++ b/ansible/playbooks/saas/roles/mariadb/tasks/restore.yml @@ -2,12 +2,9 @@ - name: Include actions variables ansible.builtin.include_vars: actions.yml -- name: Run nomad restore job +- name: Restore service ansible.builtin.include_role: - name: nomad - tasks_from: job_action.yml + name: common + tasks_from: restore_with_action.yml vars: - operation: restore - job_name: "{{ domain }}-restore" - periodic: false - actions: "{{ mariadb_actions }}" + restore_actions: "{{ mariadb_actions }}" diff --git a/ansible/playbooks/saas/roles/milvus/tasks/destroy.yml b/ansible/playbooks/saas/roles/milvus/tasks/destroy.yml index 15f1ec71..b700905c 100644 --- a/ansible/playbooks/saas/roles/milvus/tasks/destroy.yml +++ b/ansible/playbooks/saas/roles/milvus/tasks/destroy.yml @@ -1,11 +1,5 @@ --- -- name: Stop nomad job +- name: Destroy service ansible.builtin.include_role: - name: nomad - tasks_from: job_stop.yml - -- name: Remove software directory - ansible.builtin.file: - path: "{{ software_path }}" - state: absent - delegate_to: "{{ software.instance }}" + name: common + tasks_from: destroy_delegated.yml diff --git a/ansible/playbooks/saas/roles/minio/tasks/destroy.yml b/ansible/playbooks/saas/roles/minio/tasks/destroy.yml index ce77a12b..a246acc0 100644 --- a/ansible/playbooks/saas/roles/minio/tasks/destroy.yml +++ b/ansible/playbooks/saas/roles/minio/tasks/destroy.yml @@ -1,10 +1,5 @@ --- -- name: Stop nomad job +- name: Destroy service ansible.builtin.include_role: - name: nomad - tasks_from: job_stop.yml - -- name: Remove software directory - ansible.builtin.file: - path: "{{ software_path }}" - state: absent + name: common + tasks_from: destroy.yml diff --git a/ansible/playbooks/saas/roles/mosquitto/tasks/destroy.yml b/ansible/playbooks/saas/roles/mosquitto/tasks/destroy.yml index ce77a12b..a246acc0 100644 --- a/ansible/playbooks/saas/roles/mosquitto/tasks/destroy.yml +++ b/ansible/playbooks/saas/roles/mosquitto/tasks/destroy.yml @@ -1,10 +1,5 @@ --- -- name: Stop nomad job +- name: Destroy service ansible.builtin.include_role: - name: nomad - tasks_from: job_stop.yml - -- name: Remove software directory - ansible.builtin.file: - path: "{{ software_path }}" - state: absent + name: common + tasks_from: destroy.yml diff --git a/ansible/playbooks/saas/roles/nextcloud/tasks/backup.yml b/ansible/playbooks/saas/roles/nextcloud/tasks/backup.yml index d6e4002d..2ed501bb 100644 --- a/ansible/playbooks/saas/roles/nextcloud/tasks/backup.yml +++ b/ansible/playbooks/saas/roles/nextcloud/tasks/backup.yml @@ -1,7 +1,5 @@ --- -- name: Run nomad job +- name: Backup service ansible.builtin.include_role: - name: nomad - tasks_from: job_periodic_run.yml - vars: - job_name: "{{ domain }}-periodic" + name: common + tasks_from: backup_periodic.yml diff --git a/ansible/playbooks/saas/roles/nextcloud/tasks/destroy.yml b/ansible/playbooks/saas/roles/nextcloud/tasks/destroy.yml index a391035f..1dc12747 100644 --- a/ansible/playbooks/saas/roles/nextcloud/tasks/destroy.yml +++ b/ansible/playbooks/saas/roles/nextcloud/tasks/destroy.yml @@ -1,29 +1,5 @@ --- -- name: Stop nomad job +- name: Destroy service ansible.builtin.include_role: - name: nomad - tasks_from: job_stop.yml - -- name: Mysql delete database - community.mysql.mysql_db: - login_user: root - login_password: "{{ lookup('simple-stack-ui', type='secret', key=software.dbhost, subkey='passwd', missing='error') }}" - login_unix_socket: "/data/{{ software.dbhost }}/run/mysqld/mysqld.sock" - name: "{{ service_name[:32] }}" - state: absent - -- name: Mysql delete user - community.mysql.mysql_user: - login_user: root - login_password: "{{ lookup('simple-stack-ui', type='secret', key=software.dbhost, subkey='passwd', missing='error') }}" - login_unix_socket: "/data/{{ software.dbhost }}/run/mysqld/mysqld.sock" - name: "{{ lookup('simple-stack-ui', type='secret', key=domain, subkey='mysql_user', missing='error') }}" - host: '%' - priv: "{{ service_name[:32] }}.*:ALL" - state: absent - column_case_sensitive: false - -- name: Remove software directory - ansible.builtin.file: - path: "{{ software_path }}" - state: absent + name: common + tasks_from: destroy_with_mysql.yml diff --git a/ansible/playbooks/saas/roles/nextcloud/tasks/main.yml b/ansible/playbooks/saas/roles/nextcloud/tasks/main.yml index b18f3afe..6689a828 100644 --- a/ansible/playbooks/saas/roles/nextcloud/tasks/main.yml +++ b/ansible/playbooks/saas/roles/nextcloud/tasks/main.yml @@ -23,7 +23,7 @@ - name: Create mysql database community.mysql.mysql_db: login_user: root - login_password: "{{ lookup('simple-stack-ui', type='secret', key=software.dbhost, subkey='passwd', missing='error') }}" + login_password: "{{ lookup('simple-stack-ui', type='secret', key2=software.dbhost, subkey='passwd', missing='error') }}" login_unix_socket: "/data/{{ software.dbhost }}/run/mysqld/mysqld.sock" name: "{{ software.dbname | default(service_name[:32]) }}" encoding: utf8 @@ -33,7 +33,7 @@ - name: Create mysql user community.mysql.mysql_user: login_user: root - login_password: "{{ lookup('simple-stack-ui', type='secret', key=software.dbhost, subkey='passwd', missing='error') }}" + login_password: "{{ lookup('simple-stack-ui', type='secret', key2=software.dbhost, subkey='passwd', missing='error') }}" login_unix_socket: "/data/{{ software.dbhost }}/run/mysqld/mysqld.sock" name: "{{ lookup('simple-stack-ui', type='secret', key=domain, subkey='mysql_user', missing='create', nosymbols=true, length=8) }}" host: '%' diff --git a/ansible/playbooks/saas/roles/nextcloud/tasks/restore.yml b/ansible/playbooks/saas/roles/nextcloud/tasks/restore.yml index 45b9b6e9..72388320 100644 --- a/ansible/playbooks/saas/roles/nextcloud/tasks/restore.yml +++ b/ansible/playbooks/saas/roles/nextcloud/tasks/restore.yml @@ -2,12 +2,9 @@ - name: Include actions variables ansible.builtin.include_vars: actions.yml -- name: Run nomad job +- name: Restore service ansible.builtin.include_role: - name: nomad - tasks_from: job_action.yml + name: common + tasks_from: restore_with_action.yml vars: - operation: restore - job_name: "{{ domain }}-restore" - periodic: false - actions: "{{ nextcloud_actions }}" + restore_actions: "{{ nextcloud_actions }}" diff --git a/ansible/playbooks/saas/roles/nginx/tasks/destroy.yml b/ansible/playbooks/saas/roles/nginx/tasks/destroy.yml index ce77a12b..a246acc0 100644 --- a/ansible/playbooks/saas/roles/nginx/tasks/destroy.yml +++ b/ansible/playbooks/saas/roles/nginx/tasks/destroy.yml @@ -1,10 +1,5 @@ --- -- name: Stop nomad job +- name: Destroy service ansible.builtin.include_role: - name: nomad - tasks_from: job_stop.yml - -- name: Remove software directory - ansible.builtin.file: - path: "{{ software_path }}" - state: absent + name: common + tasks_from: destroy.yml diff --git a/ansible/playbooks/saas/roles/nomad/tasks/job_action.yml b/ansible/playbooks/saas/roles/nomad/tasks/job_action.yml index affd3419..04dee05c 100644 --- a/ansible/playbooks/saas/roles/nomad/tasks/job_action.yml +++ b/ansible/playbooks/saas/roles/nomad/tasks/job_action.yml @@ -13,13 +13,11 @@ chdir: "{{ nomad_job_dir }}" environment: NOMAD_ADDR: "https://{{ nomad_http_ip }}:4646" - NOMAD_TOKEN: "{{ lookup('simple-stack-ui', type='secret', key=inventory_hostname, subkey='nomad_management_token', missing='error') }}" + NOMAD_TOKEN: "{{ lookup('simple-stack-ui', type='secret', key2=inventory_hostname, subkey='nomad_management_token', missing='error') }}" NOMAD_SKIP_VERIFY: true # NOMAD_CLIENT_CERT: "{{ nomad_tls_host_certificate_dir }}/{{ nomad_tls_cert_server }}" # NOMAD_CLIENT_KEY: "{{ nomad_tls_host_certificate_dir }}/{{ nomad_tls_privatekey_server }}" # NOMAD_CACERT: "{{ nomad_tls_host_certificate_dir }}/{{ nomad_tls_ca_pubkey }}" register: nomad_job_start failed_when: nomad_job_start.rc >= 2 - changed_when: - - '"error" in nomad_job_start.stdout' - - nomad_job_start.rc >= 2 + changed_when: nomad_job_start.rc == 0 and 'No changes to job' not in nomad_job_start.stdout diff --git a/ansible/playbooks/saas/roles/nomad/tasks/job_periodic_run.yml b/ansible/playbooks/saas/roles/nomad/tasks/job_periodic_run.yml index 4d812a43..ab46a4da 100644 --- a/ansible/playbooks/saas/roles/nomad/tasks/job_periodic_run.yml +++ b/ansible/playbooks/saas/roles/nomad/tasks/job_periodic_run.yml @@ -5,7 +5,7 @@ chdir: "{{ nomad_job_dir }}" environment: NOMAD_ADDR: "https://{{ nomad_http_ip }}:4646" - NOMAD_TOKEN: "{{ lookup('simple-stack-ui', type='secret', key=inventory_hostname, subkey='nomad_management_token', missing='error') }}" + NOMAD_TOKEN: "{{ lookup('simple-stack-ui', type='secret', key2=inventory_hostname, subkey='nomad_management_token', missing='error') }}" NOMAD_SKIP_VERIFY: true # NOMAD_CLIENT_CERT: "{{ nomad_tls_host_certificate_dir }}/{{ nomad_tls_cert_server }}" # NOMAD_CLIENT_KEY: "{{ nomad_tls_host_certificate_dir }}/{{ nomad_tls_privatekey_server }}" diff --git a/ansible/playbooks/saas/roles/nomad/tasks/job_restart.yml b/ansible/playbooks/saas/roles/nomad/tasks/job_restart.yml index 146a8071..e98bbaee 100644 --- a/ansible/playbooks/saas/roles/nomad/tasks/job_restart.yml +++ b/ansible/playbooks/saas/roles/nomad/tasks/job_restart.yml @@ -3,7 +3,7 @@ ansible.builtin.command: "/usr/bin/nomad job restart -yes {{ nomad_job_name }}" environment: NOMAD_ADDR: "https://{{ nomad_http_ip }}:4646" - NOMAD_TOKEN: "{{ lookup('simple-stack-ui', type='secret', key=inventory_hostname, subkey='nomad_management_token', missing='error') }}" + NOMAD_TOKEN: "{{ lookup('simple-stack-ui', type='secret', key2=inventory_hostname, subkey='nomad_management_token', missing='error') }}" NOMAD_SKIP_VERIFY: true # NOMAD_CLIENT_CERT: "{{ nomad_tls_host_certificate_dir }}/{{ nomad_tls_cert_server }}" # NOMAD_CLIENT_KEY: "{{ nomad_tls_host_certificate_dir }}/{{ nomad_tls_privatekey_server }}" diff --git a/ansible/playbooks/saas/roles/nomad/tasks/job_run.yml b/ansible/playbooks/saas/roles/nomad/tasks/job_run.yml index c83d58ce..1c24094c 100644 --- a/ansible/playbooks/saas/roles/nomad/tasks/job_run.yml +++ b/ansible/playbooks/saas/roles/nomad/tasks/job_run.yml @@ -5,13 +5,11 @@ chdir: "{{ nomad_job_dir }}" environment: NOMAD_ADDR: "https://{{ nomad_http_ip }}:4646" - NOMAD_TOKEN: "{{ lookup('simple-stack-ui', type='secret', key=inventory_hostname, subkey='nomad_management_token', missing='error') }}" + NOMAD_TOKEN: "{{ lookup('simple-stack-ui', type='secret', key2=inventory_hostname, subkey='nomad_management_token', missing='error') }}" NOMAD_SKIP_VERIFY: true # NOMAD_CLIENT_CERT: "{{ nomad_tls_host_certificate_dir }}/{{ nomad_tls_cert_server }}" # NOMAD_CLIENT_KEY: "{{ nomad_tls_host_certificate_dir }}/{{ nomad_tls_privatekey_server }}" # NOMAD_CACERT: "{{ nomad_tls_host_certificate_dir }}/{{ nomad_tls_ca_pubkey }}" register: nomad_job_start failed_when: nomad_job_start.rc >= 2 - changed_when: - - '"error" in nomad_job_start.stdout' - - nomad_job_start.rc >= 2 + changed_when: nomad_job_start.rc == 0 and 'No changes to job' not in nomad_job_start.stdout diff --git a/ansible/playbooks/saas/roles/nomad/tasks/job_stop.yml b/ansible/playbooks/saas/roles/nomad/tasks/job_stop.yml index 73b49d9c..c5a69945 100644 --- a/ansible/playbooks/saas/roles/nomad/tasks/job_stop.yml +++ b/ansible/playbooks/saas/roles/nomad/tasks/job_stop.yml @@ -3,7 +3,7 @@ ansible.builtin.command: "/usr/bin/nomad job stop {{ nomad_job_name }}" environment: NOMAD_ADDR: "https://{{ nomad_http_ip }}:4646" - NOMAD_TOKEN: "{{ lookup('simple-stack-ui', type='secret', key=inventory_hostname, subkey='nomad_management_token', missing='error') }}" + NOMAD_TOKEN: "{{ lookup('simple-stack-ui', type='secret', key2=inventory_hostname, subkey='nomad_management_token', missing='error') }}" NOMAD_SKIP_VERIFY: true # NOMAD_CLIENT_CERT: "{{ nomad_tls_host_certificate_dir }}/{{ nomad_tls_cert_server }}" # NOMAD_CLIENT_KEY: "{{ nomad_tls_host_certificate_dir }}/{{ nomad_tls_privatekey_server }}" diff --git a/ansible/playbooks/saas/roles/open-webui/tasks/destroy.yml b/ansible/playbooks/saas/roles/open-webui/tasks/destroy.yml index ce77a12b..a246acc0 100644 --- a/ansible/playbooks/saas/roles/open-webui/tasks/destroy.yml +++ b/ansible/playbooks/saas/roles/open-webui/tasks/destroy.yml @@ -1,10 +1,5 @@ --- -- name: Stop nomad job +- name: Destroy service ansible.builtin.include_role: - name: nomad - tasks_from: job_stop.yml - -- name: Remove software directory - ansible.builtin.file: - path: "{{ software_path }}" - state: absent + name: common + tasks_from: destroy.yml diff --git a/ansible/playbooks/saas/roles/postgresql/tasks/backup.yml b/ansible/playbooks/saas/roles/postgresql/tasks/backup.yml index 17f93f52..68ea53fb 100644 --- a/ansible/playbooks/saas/roles/postgresql/tasks/backup.yml +++ b/ansible/playbooks/saas/roles/postgresql/tasks/backup.yml @@ -2,12 +2,9 @@ - name: Include actions variables ansible.builtin.include_vars: actions.yml -- name: Run nomad backup job +- name: Backup service ansible.builtin.include_role: - name: nomad - tasks_from: job_action.yml + name: common + tasks_from: backup_with_action.yml vars: - operation: backup - job_name: "{{ domain }}-backup" - periodic: false - actions: "{{ postgresql_actions }}" + backup_actions: "{{ postgresql_actions }}" diff --git a/ansible/playbooks/saas/roles/postgresql/tasks/destroy.yml b/ansible/playbooks/saas/roles/postgresql/tasks/destroy.yml index 55799c65..e867a5b3 100644 --- a/ansible/playbooks/saas/roles/postgresql/tasks/destroy.yml +++ b/ansible/playbooks/saas/roles/postgresql/tasks/destroy.yml @@ -1,15 +1,5 @@ --- -- name: Stop nomad job +- name: Destroy service ansible.builtin.include_role: - name: nomad - tasks_from: job_stop.yml - vars: - job_name: "{{ item }}" - loop: - - "{{ domain }}" - - "{{ domain }}-periodic" - -- name: Remove software directory - ansible.builtin.file: - path: "{{ software_path }}" - state: absent + name: common + tasks_from: destroy_with_periodic.yml diff --git a/ansible/playbooks/saas/roles/postgresql/tasks/restore.yml b/ansible/playbooks/saas/roles/postgresql/tasks/restore.yml index c5d36dc2..d0453428 100644 --- a/ansible/playbooks/saas/roles/postgresql/tasks/restore.yml +++ b/ansible/playbooks/saas/roles/postgresql/tasks/restore.yml @@ -2,12 +2,9 @@ - name: Include actions variables ansible.builtin.include_vars: actions.yml -- name: Run nomad restore job +- name: Restore service ansible.builtin.include_role: - name: nomad - tasks_from: job_action.yml + name: common + tasks_from: restore_with_action.yml vars: - operation: restore - job_name: "{{ domain }}-restore" - periodic: false - actions: "{{ postgresql_actions }}" + restore_actions: "{{ postgresql_actions }}" diff --git a/ansible/playbooks/saas/roles/rocketchat/tasks/backup.yml b/ansible/playbooks/saas/roles/rocketchat/tasks/backup.yml index ffcd9f21..3c95a2a1 100644 --- a/ansible/playbooks/saas/roles/rocketchat/tasks/backup.yml +++ b/ansible/playbooks/saas/roles/rocketchat/tasks/backup.yml @@ -2,12 +2,9 @@ - name: Include actions variables ansible.builtin.include_vars: actions.yml -- name: Run nomad backup job +- name: Backup service ansible.builtin.include_role: - name: nomad - tasks_from: job_action.yml + name: common + tasks_from: backup_with_action.yml vars: - operation: backup - job_name: "{{ domain }}-backup" - periodic: false - actions: "{{ rocketchat_actions }}" + backup_actions: "{{ rocketchat_actions }}" diff --git a/ansible/playbooks/saas/roles/rocketchat/tasks/restore.yml b/ansible/playbooks/saas/roles/rocketchat/tasks/restore.yml index 541ae77f..11505b32 100644 --- a/ansible/playbooks/saas/roles/rocketchat/tasks/restore.yml +++ b/ansible/playbooks/saas/roles/rocketchat/tasks/restore.yml @@ -2,12 +2,9 @@ - name: Include actions variables ansible.builtin.include_vars: actions.yml -- name: Run nomad restore job +- name: Restore service ansible.builtin.include_role: - name: nomad - tasks_from: job_action.yml + name: common + tasks_from: restore_with_action.yml vars: - operation: restore - job_name: "{{ domain }}-restore" - periodic: false - actions: "{{ rocketchat_actions }}" + restore_actions: "{{ rocketchat_actions }}" diff --git a/ansible/playbooks/saas/roles/simplestack_ansible/tasks/destroy.yml b/ansible/playbooks/saas/roles/simplestack_ansible/tasks/destroy.yml index ce77a12b..a246acc0 100644 --- a/ansible/playbooks/saas/roles/simplestack_ansible/tasks/destroy.yml +++ b/ansible/playbooks/saas/roles/simplestack_ansible/tasks/destroy.yml @@ -1,10 +1,5 @@ --- -- name: Stop nomad job +- name: Destroy service ansible.builtin.include_role: - name: nomad - tasks_from: job_stop.yml - -- name: Remove software directory - ansible.builtin.file: - path: "{{ software_path }}" - state: absent + name: common + tasks_from: destroy.yml diff --git a/ansible/playbooks/saas/roles/simplestack_ui/tasks/destroy.yml b/ansible/playbooks/saas/roles/simplestack_ui/tasks/destroy.yml index ce77a12b..a246acc0 100644 --- a/ansible/playbooks/saas/roles/simplestack_ui/tasks/destroy.yml +++ b/ansible/playbooks/saas/roles/simplestack_ui/tasks/destroy.yml @@ -1,10 +1,5 @@ --- -- name: Stop nomad job +- name: Destroy service ansible.builtin.include_role: - name: nomad - tasks_from: job_stop.yml - -- name: Remove software directory - ansible.builtin.file: - path: "{{ software_path }}" - state: absent + name: common + tasks_from: destroy.yml diff --git a/ansible/playbooks/saas/roles/traefik/tasks/main.yml b/ansible/playbooks/saas/roles/traefik/tasks/main.yml index 65d5fad2..c70251e4 100644 --- a/ansible/playbooks/saas/roles/traefik/tasks/main.yml +++ b/ansible/playbooks/saas/roles/traefik/tasks/main.yml @@ -7,7 +7,7 @@ client_key: "/etc/ssl/simplestack/{{ fact_instance.region }}-{{ fact_instance.provider }}-dc1-server-nomad.key" method: GET headers: - X-Nomad-Token: "{{ lookup('simple-stack-ui', type='secret', key=inventory_hostname, subkey='nomad_management_token', missing='error') }}" + X-Nomad-Token: "{{ lookup('simple-stack-ui', type='secret', key2=inventory_hostname, subkey='nomad_management_token', missing='error') }}" status_code: - 200 - 404 @@ -22,7 +22,7 @@ client_key: "/etc/ssl/simplestack/{{ fact_instance.region }}-{{ fact_instance.provider }}-dc1-server-nomad.key" method: POST headers: - X-Nomad-Token: "{{ lookup('simple-stack-ui', type='secret', key=inventory_hostname, subkey='nomad_management_token', missing='error') }}" + X-Nomad-Token: "{{ lookup('simple-stack-ui', type='secret', key2=inventory_hostname, subkey='nomad_management_token', missing='error') }}" body: | { "Name": "traefik", @@ -45,7 +45,7 @@ client_key: "/etc/ssl/simplestack/{{ fact_instance.region }}-{{ fact_instance.provider }}-dc1-server-nomad.key" method: GET headers: - X-Nomad-Token: "{{ lookup('simple-stack-ui', type='secret', key=inventory_hostname, subkey='nomad_management_token', missing='error') }}" + X-Nomad-Token: "{{ lookup('simple-stack-ui', type='secret', key2=inventory_hostname, subkey='nomad_management_token', missing='error') }}" status_code: - 200 - 404 @@ -60,7 +60,7 @@ client_key: "/etc/ssl/simplestack/{{ fact_instance.region }}-{{ fact_instance.provider }}-dc1-server-nomad.key" method: PUT headers: - X-Nomad-Token: "{{ lookup('simple-stack-ui', type='secret', key=inventory_hostname, subkey='nomad_management_token', missing='error') }}" + X-Nomad-Token: "{{ lookup('simple-stack-ui', type='secret', key2=inventory_hostname, subkey='nomad_management_token', missing='error') }}" body: | { "Name": "traefik", @@ -78,7 +78,7 @@ - name: "Traefik | Save token to passwordstore" ansible.builtin.set_fact: - nomad_traefik_token: "{{ lookup('simple-stack-ui', type='secret', key=inventory_hostname, subkey='nomad_traefik_token', missing='create', userpass=nomad_new_token_name.json.SecretID) }}" + nomad_traefik_token: "{{ lookup('simple-stack-ui', type='secret', key2=inventory_hostname, subkey='nomad_traefik_token', missing='create', userpass=nomad_new_token_name.json.SecretID) }}" when: nomad_new_token_name.json is defined - name: Create default directories diff --git a/ansible/playbooks/saas/roles/traefik/templates/traefik.toml b/ansible/playbooks/saas/roles/traefik/templates/traefik.toml index 72347538..876d3fb0 100644 --- a/ansible/playbooks/saas/roles/traefik/templates/traefik.toml +++ b/ansible/playbooks/saas/roles/traefik/templates/traefik.toml @@ -50,7 +50,7 @@ exposedByDefault = false [providers.nomad.endpoint] address = "https://{{ hostvars[nomad_primary_master_node | default(software.instance)]['ansible_ens3']['ipv4']['address'] | default('127.0.0.1') }}:4646" - token = "{{ lookup('simple-stack-ui', type='secret', key=inventory_hostname, subkey='nomad_traefik_token', missing='error') }}" + token = "{{ lookup('simple-stack-ui', type='secret', key2=inventory_hostname, subkey='nomad_traefik_token', missing='error') }}" [providers.nomad.endpoint.tls] ca = "/etc/ssl/simplestack/simplestack-ca.pem" cert = "/etc/ssl/simplestack/{{ software.instance }}-dc1-client-nomad.pem" diff --git a/ansible/playbooks/saas/roles/valkey/tasks/destroy.yml b/ansible/playbooks/saas/roles/valkey/tasks/destroy.yml index ce77a12b..a246acc0 100644 --- a/ansible/playbooks/saas/roles/valkey/tasks/destroy.yml +++ b/ansible/playbooks/saas/roles/valkey/tasks/destroy.yml @@ -1,10 +1,5 @@ --- -- name: Stop nomad job +- name: Destroy service ansible.builtin.include_role: - name: nomad - tasks_from: job_stop.yml - -- name: Remove software directory - ansible.builtin.file: - path: "{{ software_path }}" - state: absent + name: common + tasks_from: destroy.yml diff --git a/ansible/playbooks/saas/roles/vector/tasks/destroy.yml b/ansible/playbooks/saas/roles/vector/tasks/destroy.yml index 15f1ec71..b700905c 100644 --- a/ansible/playbooks/saas/roles/vector/tasks/destroy.yml +++ b/ansible/playbooks/saas/roles/vector/tasks/destroy.yml @@ -1,11 +1,5 @@ --- -- name: Stop nomad job +- name: Destroy service ansible.builtin.include_role: - name: nomad - tasks_from: job_stop.yml - -- name: Remove software directory - ansible.builtin.file: - path: "{{ software_path }}" - state: absent - delegate_to: "{{ software.instance }}" + name: common + tasks_from: destroy_delegated.yml diff --git a/ansible/playbooks/saas/roles/vllm/tasks/destroy.yml b/ansible/playbooks/saas/roles/vllm/tasks/destroy.yml index ce77a12b..a246acc0 100644 --- a/ansible/playbooks/saas/roles/vllm/tasks/destroy.yml +++ b/ansible/playbooks/saas/roles/vllm/tasks/destroy.yml @@ -1,10 +1,5 @@ --- -- name: Stop nomad job +- name: Destroy service ansible.builtin.include_role: - name: nomad - tasks_from: job_stop.yml - -- name: Remove software directory - ansible.builtin.file: - path: "{{ software_path }}" - state: absent + name: common + tasks_from: destroy.yml diff --git a/ansible/playbooks/saas/roles/wordpress/tasks/backup.yml b/ansible/playbooks/saas/roles/wordpress/tasks/backup.yml index 03f99e7e..6e408a49 100644 --- a/ansible/playbooks/saas/roles/wordpress/tasks/backup.yml +++ b/ansible/playbooks/saas/roles/wordpress/tasks/backup.yml @@ -2,12 +2,9 @@ - name: Include actions variables ansible.builtin.include_vars: actions.yml -- name: Run nomad backup job +- name: Backup service ansible.builtin.include_role: - name: nomad - tasks_from: job_action.yml + name: common + tasks_from: backup_with_action.yml vars: - operation: backup - job_name: "{{ domain }}-backup" - periodic: false - actions: "{{ wordpress_actions }}" + backup_actions: "{{ wordpress_actions }}" diff --git a/ansible/playbooks/saas/roles/wordpress/tasks/destroy.yml b/ansible/playbooks/saas/roles/wordpress/tasks/destroy.yml index 97a9a16b..3d3b5e78 100644 --- a/ansible/playbooks/saas/roles/wordpress/tasks/destroy.yml +++ b/ansible/playbooks/saas/roles/wordpress/tasks/destroy.yml @@ -1,34 +1,5 @@ --- -- name: Stop nomad job +- name: Destroy service ansible.builtin.include_role: - name: nomad - tasks_from: job_stop.yml - vars: - job_name: "{{ item }}" - loop: - - "{{ domain }}" - - "{{ domain }}-periodic" - -- name: Mysql delete database - community.mysql.mysql_db: - login_user: root - login_password: "{{ lookup('simple-stack-ui', type='secret', key=software.dbhost, subkey='passwd', missing='error') }}" - login_unix_socket: "/data/{{ software.dbhost }}/run/mysqld/mysqld.sock" - name: "{{ service_name[:32] }}" - state: absent - -- name: Mysql delete user - community.mysql.mysql_user: - login_user: root - login_password: "{{ lookup('simple-stack-ui', type='secret', key=software.dbhost, subkey='passwd', missing='error') }}" - login_unix_socket: "/data/{{ software.dbhost }}/run/mysqld/mysqld.sock" - name: "{{ lookup('simple-stack-ui', type='secret', key=domain, subkey='mysql_user', missing='error') }}" - host: '%' - priv: "{{ service_name[:32] }}.*:ALL" - state: absent - column_case_sensitive: false - -- name: Remove software directory - ansible.builtin.file: - path: "{{ software_path }}" - state: absent + name: common + tasks_from: destroy_with_periodic_and_mysql.yml diff --git a/ansible/playbooks/saas/roles/wordpress/tasks/install.yml b/ansible/playbooks/saas/roles/wordpress/tasks/install.yml index 5eaabc80..ab0d2b48 100644 --- a/ansible/playbooks/saas/roles/wordpress/tasks/install.yml +++ b/ansible/playbooks/saas/roles/wordpress/tasks/install.yml @@ -18,7 +18,7 @@ - name: Create mysql database community.mysql.mysql_db: login_user: root - login_password: "{{ lookup('simple-stack-ui', type='secret', key=software.dbhost, subkey='passwd', missing='error') }}" + login_password: "{{ lookup('simple-stack-ui', type='secret', key2=software.dbhost, subkey='passwd', missing='error') }}" login_unix_socket: "/data/{{ software.dbhost }}/run/mysqld/mysqld.sock" name: "{{ software.dbname | default(service_name[:32]) }}" encoding: utf8 @@ -28,7 +28,7 @@ - name: Create mysql user community.mysql.mysql_user: login_user: root - login_password: "{{ lookup('simple-stack-ui', type='secret', key=software.dbhost, subkey='passwd', missing='error') }}" + login_password: "{{ lookup('simple-stack-ui', type='secret', key2=software.dbhost, subkey='passwd', missing='error') }}" login_unix_socket: "/data/{{ software.dbhost }}/run/mysqld/mysqld.sock" name: "{{ lookup('simple-stack-ui', type='secret', key=domain, subkey='mysql_user', missing='create', nosymbols=true, length=8, userpass=software.dbuser | default(none)) }}" host: '%' diff --git a/ansible/playbooks/saas/roles/wordpress/tasks/restore.yml b/ansible/playbooks/saas/roles/wordpress/tasks/restore.yml index e1c46826..5758c684 100644 --- a/ansible/playbooks/saas/roles/wordpress/tasks/restore.yml +++ b/ansible/playbooks/saas/roles/wordpress/tasks/restore.yml @@ -2,12 +2,9 @@ - name: Include actions variables ansible.builtin.include_vars: actions.yml -- name: Run nomad restore job +- name: Restore service ansible.builtin.include_role: - name: nomad - tasks_from: job_action.yml + name: common + tasks_from: restore_with_action.yml vars: - operation: restore - job_name: "{{ domain }}-restore" - periodic: false - actions: "{{ wordpress_actions }}" + restore_actions: "{{ wordpress_actions }}" diff --git a/ansible/playbooks/saas/roles/zigbee2mqtt/tasks/destroy.yml b/ansible/playbooks/saas/roles/zigbee2mqtt/tasks/destroy.yml index ce77a12b..a246acc0 100644 --- a/ansible/playbooks/saas/roles/zigbee2mqtt/tasks/destroy.yml +++ b/ansible/playbooks/saas/roles/zigbee2mqtt/tasks/destroy.yml @@ -1,10 +1,5 @@ --- -- name: Stop nomad job +- name: Destroy service ansible.builtin.include_role: - name: nomad - tasks_from: job_stop.yml - -- name: Remove software directory - ansible.builtin.file: - path: "{{ software_path }}" - state: absent + name: common + tasks_from: destroy.yml diff --git a/ansible/plugins/lookup/simple-stack-ui.py b/ansible/plugins/lookup/simple-stack-ui.py index 54f55edd..29c7680a 100644 --- a/ansible/plugins/lookup/simple-stack-ui.py +++ b/ansible/plugins/lookup/simple-stack-ui.py @@ -50,7 +50,7 @@ def run(self, terms, variables=None, **kwargs): display.vvvv(f"mylookup2: Authorization headers {headers}") custom_keys = [ - "type", "key", "subkey", "delete", + "type", "key", "key2", "subkey", "delete", "missing", "nosymbols", "overwrite", "userpass", "length" ] diff --git a/ansible/requirements.txt b/ansible/requirements.txt index 2886cb19..3291c846 100644 --- a/ansible/requirements.txt +++ b/ansible/requirements.txt @@ -1,5 +1,6 @@ ansible ansible-rulebook +ansible-lint jmespath passlib bcrypt diff --git a/ansible/rulebook.yml b/ansible/rulebook.yml index 4bef2b38..def60259 100644 --- a/ansible/rulebook.yml +++ b/ansible/rulebook.yml @@ -107,11 +107,3 @@ catalog: "{{ event.payload.catalog }}" domain: "{{ event.payload.domain }}" task: "{{ event.payload.task }}" - - - name: saas-nomad-clean - condition: event.payload.type == "saas/nomad/clean" - actions: - - run_playbook: - name: playbooks/saas/nomad-clean-errors.yml - extra_vars: - hosts_limit: "{{ event.payload.meta.hosts }}" diff --git a/ui-next/.gitignore b/ui-next/.gitignore index 665a7be9..791295ff 100644 --- a/ui-next/.gitignore +++ b/ui-next/.gitignore @@ -53,3 +53,7 @@ yarn-error.log* # typescript *.tsbuildinfo next-env.d.ts + +# unit tests +playwright-report +test-results diff --git a/ui-next/app/(app)/infrastructures/page.tsx b/ui-next/app/(app)/infrastructures/page.tsx index 75ff025a..2af49e96 100644 --- a/ui-next/app/(app)/infrastructures/page.tsx +++ b/ui-next/app/(app)/infrastructures/page.tsx @@ -47,7 +47,7 @@ type VariableScope = { name: string; }; -type InfrastructureVariableType = "project" | "tfstate" | "settings"; +type InfrastructureVariableType = "project" | "secret" | "tfstate" | "settings"; type EditorMode = "json" | "yaml"; type PageSizeMode = "auto" | "10" | "20" | "50"; @@ -895,6 +895,15 @@ export default function InfrastructuresPage() { > Variables + + + +
{ + if (!validateContent(values.value ?? "", editorMode)) return; + return onSubmit(values as unknown as VariableFormValues); + })} + className="grid gap-4 p-6 md:grid-cols-2" + > +
+ + + {errors.type &&

{errors.type.message}

} +
+ +
+ + + {errors.key &&

{errors.key.message}

} +
+ +
+ + + {errors.key2 &&

{errors.key2.message}

} +
+ +
+ Format: + {(["yaml", "json"] as EditorMode[]).map((m) => ( + + ))} +
+ +
+ +