setup.yml (5480B)
1 --- 2 - name: Deploy gnu Taler 3 hosts: all 4 gather_facts: false 5 any_errors_fatal: true 6 pre_tasks: 7 - name: Gather host facts without logging stored local secrets 8 ansible.builtin.setup: 9 no_log: true 10 11 - name: Validate the external monitoring bundle before stopping applications 12 ansible.builtin.include_role: 13 name: monitoring 14 tasks_from: preflight 15 when: enable_monitoring | default(false) | bool 16 17 - name: Reject the removed in-deployment restore switch 18 ansible.builtin.assert: 19 that: not (enable_restore_backup | default(false) | bool) 20 fail_msg: >- 21 enable_restore_backup is no longer supported. Restore a fresh host 22 with restore before running the normal deployment. 23 quiet: true 24 25 - name: "Fail if the deployment kind is not defined" 26 ansible.builtin.fail: 27 msg: "deployment_kind is not set; it selects the exchange_$KIND role" 28 when: deployment_kind is undefined 29 30 - name: "Check the secrets every deployment needs" 31 ansible.builtin.assert: 32 that: exchange_attribute_encryption_key is defined 33 quiet: true 34 35 - name: Restrict mock MFA to the Rusty staging host 36 ansible.builtin.assert: 37 that: inventory_hostname == 'rusty' 38 fail_msg: >- 39 devtesting_mock_mfa exposes MFA codes and may only be enabled on 40 the Rusty staging host. 41 quiet: true 42 when: devtesting_mock_mfa | bool 43 44 - name: "Check the KYCAID secrets" 45 when: deployment_kind == 'tops' 46 ansible.builtin.assert: 47 that: exchange_kycaid_access_token is defined 48 quiet: true 49 50 - name: "Check the auditor secrets" 51 when: deploy_auditor | bool 52 ansible.builtin.assert: 53 that: auditor_access_token is defined 54 quiet: true 55 56 - name: "Check the challenger secrets" 57 when: deploy_challenger | bool 58 ansible.builtin.assert: 59 that: 60 - sms_challenger_telesign_auth_token is defined 61 - postal_challenger_pingen_client_id is defined 62 - postal_challenger_pingen_client_secret is defined 63 - postal_challenger_pingen_org_id is defined 64 quiet: true 65 66 - name: "Check the EBICS secrets" 67 when: use_ebics | bool or configure_ebics | bool 68 ansible.builtin.assert: 69 that: 70 - libeufin_nexus_ebics_host_base_url is defined 71 - libeufin_nexus_ebics_host_id is defined 72 - libeufin_nexus_ebics_user_id is defined 73 - libeufin_nexus_ebics_partner_id is defined 74 - libeufin_nexus_ebics_system_id is defined 75 quiet: true 76 77 tasks: 78 - name: Deploy with applications stopped until configuration is complete 79 block: 80 - name: Stop existing applications before any package upgrades 81 ansible.builtin.include_role: 82 name: stop_services 83 vars: 84 stop_services_include_merchant: false 85 86 - name: Remember previously active applications 87 ansible.builtin.set_fact: 88 deployment_previously_active_units: "{{ stop_services_active_units }}" 89 90 - name: Configure common_packages 91 ansible.builtin.include_role: 92 name: common_packages 93 94 - name: Configure webserver 95 ansible.builtin.include_role: 96 name: webserver 97 98 - name: Configure monitoring 99 ansible.builtin.include_role: 100 name: monitoring 101 when: enable_monitoring | default(false) | bool 102 103 - name: Configure database 104 ansible.builtin.include_role: 105 name: database 106 107 - name: Configure libeufin-nexus 108 ansible.builtin.include_role: 109 name: libeufin-nexus 110 111 - name: Configure challenger 112 ansible.builtin.include_role: 113 name: challenger 114 when: deploy_challenger | bool 115 vars: 116 postexchange: false 117 118 - name: Configure exchange 119 ansible.builtin.include_role: 120 name: exchange 121 122 - name: Configure challenger after exchange 123 ansible.builtin.include_role: 124 name: challenger 125 when: deploy_challenger | bool 126 vars: 127 postexchange: true 128 129 - name: Configure auditor 130 ansible.builtin.include_role: 131 name: auditor 132 when: deploy_auditor | bool 133 134 - name: Configure devtesting 135 ansible.builtin.include_role: 136 name: devtesting 137 138 - name: Apply pending configuration handlers before starting applications 139 ansible.builtin.meta: flush_handlers 140 141 - name: Start configured applications 142 ansible.builtin.include_role: 143 name: start_services 144 145 - name: Run post-deployment sanity checks 146 ansible.builtin.include_role: 147 name: post_deployment_checks 148 149 rescue: 150 - name: Leave applications stopped after a deployment failure 151 ansible.builtin.include_role: 152 name: stop_services 153 vars: 154 stop_services_include_merchant: false 155 when: not ansible_check_mode 156 157 - name: Report the failed deployment 158 ansible.builtin.fail: 159 msg: >- 160 Deployment failed at {{ ansible_failed_task.name }}. 161 {{ 'Check mode made no service changes.' if ansible_check_mode else 162 'Applications remain stopped; inspect the preceding error and correct it before redeploying.' }}