main.yml (3727B)
1 --- 2 - name: Get the list of services 3 service_facts: 4 5 - name: Install Taler auditor package 6 apt: 7 policy_rc_d: 101 8 name: 9 - taler-auditor 10 state: latest 11 when: ansible_facts["os_family"] == 'Debian' 12 13 - name: Ensure Taler auditor config dir exists from installation 14 ansible.builtin.stat: 15 path: "/etc/taler-auditor" 16 register: st 17 failed_when: not (st.stat.exists is defined and st.stat.exists) 18 19 - name: Place restricted auditor authentication configuration 20 ansible.builtin.template: 21 src: etc/nginx/auditor-auth.conf.inc.j2 22 dest: /etc/nginx/auditor-auth.conf.inc 23 owner: root 24 group: root 25 mode: "0600" 26 no_log: true 27 diff: false 28 notify: Restart nginx 29 30 - name: Ensure Taler auditor virtualhost configuration file exists 31 template: 32 src: templates/etc/nginx/sites-available/auditor-nginx.conf.j2 33 dest: "/etc/nginx/sites-available/auditor-nginx.conf" 34 owner: root 35 group: root 36 mode: "0644" 37 notify: Restart nginx 38 no_log: true 39 diff: false 40 41 - name: Ensure Taler auditor HTTP virtualhost configuration file exists 42 template: 43 src: templates/etc/nginx/sites-available/auditor-http.conf.j2 44 dest: "/etc/nginx/sites-available/auditor-http.conf" 45 owner: root 46 group: root 47 mode: "0644" 48 notify: Restart nginx 49 50 51 # We need to make sure that our handler notifies nginx to restart NOW 52 - name: Flush handlers 53 meta: flush_handlers 54 55 - name: Secure the auditor site with Letsencrypt 56 ansible.builtin.include_role: 57 name: cert 58 vars: 59 cert_name: auditor 60 wanted_cert_domains: 61 - "auditor.{{ domain_name }}" 62 nginx_sites: 63 - auditor-http.conf 64 - auditor-nginx.conf 65 66 - name: Ensure /etc/taler-auditor/conf.d/ directory exists 67 ansible.builtin.stat: 68 path: "/etc/taler-auditor/conf.d/" 69 register: st 70 failed_when: not (st.stat.exists is defined and st.stat.exists) 71 72 - name: Place taler-auditor master config 73 template: 74 src: templates/etc/taler-auditor/conf.d/taler-auditor-master.conf.j2 75 dest: "/etc/taler-auditor/conf.d/taler-auditor-master.conf" 76 owner: root 77 group: root 78 mode: "0644" 79 80 - name: Setup Taler Auditor database 81 ansible.builtin.command: 82 cmd: taler-auditor-dbconfig -c /etc/taler-auditor/taler-auditor.conf 83 chdir: /tmp 84 85 - name: Configure auditor access to exchange bank account 86 ansible.builtin.template: 87 src: templates/etc/taler-auditor/secrets/auditor-accountcredentials-primary.secret.conf.j2 88 dest: /etc/taler-auditor/secrets/auditor-accountcredentials-primary.secret.conf 89 owner: taler-auditor-httpd 90 group: root 91 mode: "0400" 92 no_log: true 93 diff: false 94 95 - name: Grant usage to exchange and _v schema 96 community.postgresql.postgresql_privs: 97 database: taler-exchange 98 state: present 99 privs: USAGE 100 objs: exchange,_v 101 type: schema 102 role: taler-auditor-httpd 103 grant_option: false 104 become: true 105 become_user: postgres 106 107 - name: Grant access to exchange database 108 community.postgresql.postgresql_privs: 109 database: taler-exchange 110 state: present 111 privs: SELECT 112 schema: exchange 113 objs: ALL_IN_SCHEMA 114 role: taler-auditor-httpd 115 grant_option: false 116 become: true 117 become_user: postgres 118 119 - name: Grant access to exchange database versioning 120 community.postgresql.postgresql_privs: 121 database: taler-exchange 122 state: present 123 privs: SELECT 124 schema: _v 125 objs: ALL_IN_SCHEMA 126 role: taler-auditor-httpd 127 grant_option: false 128 become: true 129 become_user: postgres 130 131 - name: Inject auditor logic into exchange database 132 ansible.builtin.command: 133 cmd: taler-exchange-dbinit -c /etc/taler-exchange/taler-exchange.conf --inject-auditor 134 chdir: /tmp 135 become: true 136 become_user: taler-exchange-httpd