# install python2.7 on xenial nodes
- hosts: all
- sudo: yes
+ become: yes
user: admin
gather_facts: false
tasks:
- hosts: all
user: admin
- sudo: true
+ become: true
tasks:
- name: uncomment SSH port
# ansible-galaxy install -r requirements/sensu-requirements.yml
#
- hosts: sensu-server
- sudo: true
+ become: true
vars_files:
- vars/sensu-vars.yml
roles:
vhost: "%2Fsensu"
- hosts: sensu-clients
- sudo: true
+ become: true
vars_files:
- vars/sensu-vars.yml
roles:
#
# install python2.7 on xenial nodes
- hosts: all
- sudo: yes
+ become: yes
# this will most likely need changed
user: admin
gather_facts: false
failed_when: false
- hosts: all
- sudo: true
+ become: true
# this will most likely need changed
user: admin
vars:
authorized_key: user={{ jenkins_user }} key="{{ lookup('file', 'files/ssh/keys/jenkins_build.pub') }}"
- name: ensure {{ jenkins_user }} can sudo without a prompt
- sudo: yes
+ become: yes
lineinfile:
dest: /etc/sudoers
regexp: '^{{ jenkins_user }} ALL'
# smithi nodes do not have epel repos
- name: install an yum epel repo
- sudo: yes
+ become: yes
template:
src: "templates/yum-repos/epel.repo"
dest: "/etc/yum.repos.d/epel.repo"
when: ansible_pkg_mgr == "yum"
- name: Install RPM requirements (All distro versions)
- sudo: yes
+ become: yes
package:
name: "{{ item }}"
state: present
- ansible_os_family == "RedHat"
- name: Install RPM requirements (<=7)
- sudo: yes
+ become: yes
package:
name: "{{ item }}"
state: present
- ansible_distribution_major_version|int <= 7
- name: Install RPM requirements (>=8)
- sudo: yes
+ become: yes
package:
name: "{{ item }}"
state: present
when: ansible_pkg_mgr == "apt"
- name: Install DEB requirements
- sudo: yes
+ become: yes
apt: name={{ item }} state=present
with_items:
- git
when: ansible_pkg_mgr == "apt"
- name: Add the Debian Jessie Key
- sudo: yes
+ become: yes
when: ansible_pkg_mgr == "apt"
apt_key: id=2B90D010 url=https://ftp-master.debian.org/keys/archive-key-8.asc keyring=/etc/apt/trusted.gpg state=present
- name: Add the Debian Security Jessie Key
- sudo: yes
+ become: yes
when: ansible_pkg_mgr == "apt"
apt_key: id=C857C906 url=https://ftp-master.debian.org/keys/archive-key-8-security.asc keyring=/etc/apt/trusted.gpg state=present
- name: Add the Debian Jessie Stable Key
- sudo: yes
+ become: yes
when: ansible_pkg_mgr == "apt"
apt_key: id=518E17E1 url=http://download.ceph.com/keys/jessie-stable-release.asc keyring=/etc/apt/trusted.gpg state=present
owner: "{{ jenkins_user }}"
- name: Set Hostname with hostname command
- sudo: yes
+ become: yes
hostname:
name: "{{ ansible_hostname }}"
- name: ensure that the current host is in /etc/hosts. Yes this is a thing.
- sudo: true
+ become: true
replace:
backup: yes
dest: /etc/hosts
replace: '\1 {{ ansible_hostname }}'
- name: ensure that 127.0.1.1 is present with an actual hostname
- sudo: true
+ become: true
lineinfile:
dest: /etc/hosts
regexp: '^(127\.0\.1\.1(?!.*\b{{ ansible_hostname }}\b).*)$'
line: '127.0.1.1 {{ ansible_hostname }}'
- name: install six, latest one
- sudo: true
+ become: true
pip: name=six state=latest
- name: install python-jenkins
- sudo: true
+ become: true
# https://review.openstack.org/460363
pip: name=python-jenkins version=0.4.15
- name: add github.com host key
- sudo: true
+ become: true
known_hosts:
path: '/etc/ssh/ssh_known_hosts'
# we need to use 'host' here because prado currently uses ansible-playbook==1.9.1
template:
src: "templates/systemd/jenkins.service.j2"
dest: "/etc/systemd/system/jenkins.service"
- sudo: true
+ become: true
when: use_jnlp
- name: start jenkins service
name: jenkins
state: started
enabled: yes
- sudo: yes
+ become: yes
when: use_jnlp
---
- name: reload systemd
- sudo: yes
+ become: yes
command: systemctl daemon-reload
- name: restart app
- sudo: true
+ become: true
service:
name: grafana-server
state: restarted
enabled: yes
- name: restart nginx
- sudo: true
+ become: true
service:
name: nginx
state: restarted
- name: update apt cache
apt:
update_cache: yes
- sudo: yes
+ become: yes
- name: install ssl system requirements
- sudo: yes
+ become: yes
apt:
name: "{{ item }}"
state: present
- packages
- name: install system packages
- sudo: yes
+ become: yes
apt:
name: "{{ item }}"
state: present
dest: "/etc/grafana/grafana.ini"
notify:
- restart app
- sudo: true
+ become: true
- include: postgresql.yml
tags:
- include: nginx.yml
- name: ensure nginx is running
- sudo: true
+ become: true
service:
name: nginx
state: started
enabled: yes
- name: ensure grafana is restarted
- sudo: true
+ become: true
service:
name: grafana-server
state: restarted
---
- name: create nginx site config
action: template src=../templates/nginx_site.conf dest=/etc/nginx/sites-available/{{ app_name }}.conf
- sudo: true
+ become: true
notify:
- restart nginx
- name: link nginx config
action: file src=/etc/nginx/sites-available/{{ app_name }}.conf dest=/etc/nginx/sites-enabled/{{ app_name }}.conf state=link
- sudo: true
+ become: true
name: postgresql
state: started
enabled: yes
- sudo: yes
+ become: yes
- name: allow users to connect locally
- sudo: yes
+ become: yes
lineinfile:
# TODO: should not hardcode that version
dest: /etc/postgresql/9.5/main/pg_hba.conf
- service:
name: postgresql
state: restarted
- sudo: true
+ become: true
when: pg_hba_conf.changed
- name: make {{ app_name }} user
owner: "{{ app_name }}"
state: present
login_user: postgres
- sudo_user: postgres
- sudo: yes
+ become_user: postgres
+ become: yes
- name: ensure database service is up
service:
name: postgresql
state: started
enabled: yes
- sudo: yes
+ become: yes
---
- name: reload systemd
- sudo: yes
+ become: yes
command: systemctl daemon-reload
- name: restart app
- sudo: true
+ become: true
service:
name: graphite
state: restarted
name: carbon-cache
state: restarted
enabled: yes
- sudo: yes
+ become: yes
regexp: "^CARBON_CACHE_ENABLED=false"
line: "CARBON_CACHE_ENABLED=true"
state: present
- sudo: true
+ become: true
- name: enable whitelisting in carbon
lineinfile:
line: "USE_WHITELIST = True"
state: present
backrefs: true
- sudo: true
+ become: true
- name: create the rewrite config with the secret api key
template:
dest: "/etc/carbon/rewrite-rules.conf"
notify:
- restart carbon
- sudo: true
+ become: true
- name: create the whitelist/blacklist config allowing the api key only
template:
dest: "/etc/carbon/whitelist.conf"
notify:
- restart carbon
- sudo: true
+ become: true
- name: define the storage schemas
template:
dest: "/etc/carbon/storage-schemas.conf"
notify:
- restart carbon
- sudo: true
+ become: true
- name: ensure database service is up
service:
name: carbon-cache
state: restarted
enabled: yes
- sudo: yes
+ become: yes
---
- name: "Build hosts file"
- sudo: yes
+ become: yes
lineinfile:
dest: /etc/hosts
regexp: ".*{{ fqdn }}$"
state: present
- name: Set Hostname with hostname command
- sudo: yes
+ become: yes
hostname: name="{{ fqdn }}"
- name: update apt cache
apt:
update_cache: yes
- sudo: yes
+ become: yes
- name: install ssl system requirements
- sudo: yes
+ become: yes
apt:
name: "{{ item }}"
state: present
- packages
- name: install system packages
- sudo: yes
+ become: yes
apt:
name: "{{ item }}"
state: present
- command: cp /usr/share/graphite-web/graphite.wsgi /usr/lib/python2.7/dist-packages/graphite/graphite_web.py
args:
creates: "/usr/lib/python2.7/dist-packages/graphite/graphite_web.py"
- sudo: true
+ become: true
- include: carbon.yml
- postgresql
- name: ensure graphite is running
- sudo: true
+ become: true
service:
name: graphite
state: restarted
name: postgresql
state: started
enabled: yes
- sudo: yes
+ become: yes
- name: allow users to connect locally
- sudo: yes
+ become: yes
lineinfile:
# TODO: should not hardcode that version
dest: /etc/postgresql/9.5/main/pg_hba.conf
- service:
name: postgresql
state: restarted
- sudo: true
+ become: true
when: pg_hba_conf.changed
- name: generate pseudo-random password for the database connection
owner: "{{ app_name }}"
state: present
login_user: postgres
- sudo_user: postgres
- sudo: yes
+ become_user: postgres
+ become: yes
- name: ensure database service is up
service:
name: postgresql
state: started
enabled: yes
- sudo: yes
+ become: yes
- name: create the config file with the db password
template:
dest: "/etc/graphite/local_settings.py"
notify:
- restart app
- sudo: true
+ become: true
# there is a bug where if you don't migrate auth first only it will fail
# with "ProgrammingError: relation "auth_user" does not exist"
- name: run migrate for auth first
command: graphite-manage migrate --noinput auth
- sudo: true
+ become: true
- name: run migrate to ensure database schema
command: graphite-manage migrate --noinput
- sudo: true
+ become: true
---
- name: ensure /var/log/graphite dir exists
- sudo: true
+ become: true
file:
path: /var/log/graphite
state: directory
template:
src: systemd/graphite.service.j2
dest: /etc/systemd/system/graphite.service
- sudo: true
+ become: true
notify:
- reload systemd
- name: ensure graphite is enabled and running
- sudo: true
+ become: true
service:
name: graphite
state: running
# prevents issues when updating systemd files
- name: reload systemd
- sudo: yes
+ become: yes
command: systemctl daemon-reload
- name: ensure /etc/sysconfig/ dir exists
- sudo: true
+ become: true
file:
path: /etc/sysconfig
state: directory
# prevents issues when updating systemd files
- name: reload systemd
- sudo: yes
+ become: yes
command: systemctl daemon-reload
- name: install the systemd configuration file for celery
template:
src: helga.sysconfig.j2
dest: /etc/sysconfig/helga
- sudo: true
+ become: true
notify:
- reload systemd
template:
src: helga.service.j2
dest: /etc/systemd/system/helga.service
- sudo: true
+ become: true
notify:
- reload systemd
- name: ensure helga is enabled and running
- sudo: true
+ become: true
service:
name: helga
state: running
---
- name: restart nginx
- sudo: yes
+ become: yes
action: service name=nginx state=restarted enabled=yes
---
- name: install system packages
- sudo: yes
+ become: yes
apt:
name: "letsencrypt"
state: present
path: "{{ ssl_webroot_base_path }}/{{ item.fqdn }}"
state: "directory"
mode: 0755
- sudo: yes
+ become: yes
with_items: nginx_hosts
- name: unlink nginx configs
file:
path: "/etc/nginx/sites-enabled/{{ item.app_name }}.conf"
state: "absent"
- sudo: true
+ become: true
with_items: nginx_hosts
- name: create temporary nginx config
template:
src: "nginx_tmp_site.conf"
dest: "/etc/nginx/sites-enabled/{{ item.app_name }}.conf"
- sudo: true
+ become: true
with_items: nginx_hosts
- name: restart nginx
- sudo: yes
+ become: yes
service:
name: nginx
state: restarted
- name: create (or renew) letsencrypt ssl cert
command: "letsencrypt certonly --webroot -w {{ ssl_webroot_base_path }}/{{ item.fqdn }} -d {{ item.fqdn }} --email {{ ssl_support_email }} --agree-tos --renew-by-default"
- sudo: yes
+ become: yes
with_items: nginx_hosts
- name: setup a cron to renew the SSL cert every day
minute: "21"
hour: "6,18"
job: "letsencrypt renew --agree-tos --email {{ ssl_support_email }}"
- sudo: yes
+ become: yes
with_items: nginx_hosts
- name: unlink tmp nginx config
file:
path: "/etc/nginx/sites-enabled/{{ item.app_name }}.conf"
state: "absent"
- sudo: true
+ become: true
with_items: nginx_hosts
file:
path: /etc/nginx/sites-available
state: directory
- sudo: true
+ become: true
- name: ensure there is an nginx user
user:
name: nginx
comment: "Nginx user"
- sudo: true
+ become: true
- name: ensure sites-enable for nginx
file:
path: /etc/nginx/sites-enabled
state: directory
- sudo: true
+ become: true
- name: remove default nginx site
file:
path: /etc/nginx/sites-enabled/default
state: absent
- sudo: true
+ become: true
- name: write nginx.conf
template:
src: nginx.conf
dest: /etc/nginx/nginx.conf
- sudo: true
+ become: true
- name: enable nginx
- sudo: true
+ become: true
service:
name: nginx
enabled: true
template:
src: "nginx_site.conf"
dest: "/etc/nginx/sites-available/{{ item.app_name }}.conf"
- sudo: true
+ become: true
with_items: nginx_hosts
notify:
- restart nginx
src: "/etc/nginx/sites-available/{{ item.app_name }}.conf"
dest: "/etc/nginx/sites-enabled/{{ item.app_name }}.conf"
state: link
- sudo: true
+ become: true
with_items: nginx_hosts
- name: ensure nginx is restarted
- sudo: true
+ become: true
service:
name: nginx
state: restarted
file:
dest: /etc/ssl/certs
state: directory
- sudo: true
+ become: true
- name: ensure ssl private directory
file:
dest: /etc/ssl/private
state: directory
- sudo: true
+ become: true
- name: copy SSL cert
copy:
dest: "/etc/ssl/certs/{{ item.fqdn }}-bundled.crt"
mode: 0777
force: no
- sudo: true
+ become: true
notify: restart nginx
when: nginx_hosts is defined
with_items: nginx_hosts
src: "{{ ssl_key_path }}"
dest: "/etc/ssl/private/{{ item.fqdn }}.key"
force: no
- sudo: true
+ become: true
notify: restart nginx
when: nginx_hosts is defined
with_items: nginx_hosts
projects / ceph-build.git / commitdiff