pre-exchange.yml (10745B)
1 --- 2 - name: Install Challenger packages (and dependencies) 3 ansible.builtin.apt: 4 policy_rc_d: 101 5 name: 6 - challenger-httpd 7 - taler-challenger-helpers 8 - texlive-latex-base # for pdflatex of the postal challenger 9 - texlive-latex-recommended # for the scrlttr2.cls 10 state: latest 11 when: ansible_facts["os_family"] == 'Debian' 12 13 - name: Populate service facts 14 service_facts: 15 16 - name: Ensure default challenger service is stopped 17 ansible.builtin.systemd: 18 name: challenger-httpd 19 state: stopped 20 enabled: false 21 when: '"challenger-httpd.service" in ansible_facts["services"]' 22 23 - name: Ensure group "challenger-sms" exists 24 ansible.builtin.group: 25 name: challenger-sms 26 state: present 27 28 - name: Ensure user "challenger-sms" exists 29 ansible.builtin.user: 30 name: challenger-sms 31 group: challenger-sms 32 password: "!" 33 system: true 34 state: present 35 36 - name: Ensure group "challenger-postal" exists 37 ansible.builtin.group: 38 name: challenger-postal 39 state: present 40 41 - name: Ensure user "challenger-postal" exists 42 ansible.builtin.user: 43 name: challenger-postal 44 group: challenger-postal 45 password: "!" 46 system: true 47 state: present 48 49 - name: Ensure group "challenger-email" exists 50 ansible.builtin.group: 51 name: challenger-email 52 state: present 53 54 - name: Ensure user "challenger-email" exists 55 ansible.builtin.user: 56 name: challenger-email 57 group: challenger-email 58 password: "!" 59 system: true 60 state: present 61 62 - name: Ensure mock MFA group exists 63 ansible.builtin.group: 64 name: challenger-mock-mfa 65 state: present 66 when: devtesting_mock_mfa | bool 67 68 - name: Grant challenger services and nginx access to mock MFA messages 69 ansible.builtin.user: 70 name: "{{ item }}" 71 groups: challenger-mock-mfa 72 append: true 73 loop: 74 - challenger-sms 75 - challenger-email 76 - challenger-postal 77 - www-data 78 notify: Restart nginx 79 when: devtesting_mock_mfa | bool 80 81 - name: Ensure mock MFA message directory exists 82 ansible.builtin.file: 83 path: /var/www/mock-mfa 84 state: directory 85 owner: root 86 group: challenger-mock-mfa 87 mode: "2770" 88 when: devtesting_mock_mfa | bool 89 90 - name: Remove mock MFA messages when mock MFA is disabled 91 ansible.builtin.file: 92 path: /var/www/mock-mfa 93 state: absent 94 when: not (devtesting_mock_mfa | bool) 95 96 - name: Install mock MFA delivery helpers 97 ansible.builtin.copy: 98 src: "usr/local/bin/mock-mfa-{{ item }}" 99 dest: "/usr/local/bin/mock-mfa-{{ item }}" 100 owner: root 101 group: root 102 mode: "0755" 103 loop: 104 - sms 105 - email 106 when: devtesting_mock_mfa | bool 107 108 - name: Remove mock MFA delivery helpers when mock MFA is disabled 109 ansible.builtin.file: 110 path: "/usr/local/bin/mock-mfa-{{ item }}" 111 state: absent 112 loop: 113 - sms 114 - email 115 when: not (devtesting_mock_mfa | bool) 116 117 - name: Remove obsolete generic mock MFA helper 118 ansible.builtin.file: 119 path: /usr/local/bin/mock-mfa 120 state: absent 121 122 - name: Ensure Ansible facts directory exists 123 ansible.builtin.file: 124 path: "/etc/ansible/facts.d/" 125 state: directory 126 owner: root 127 group: root 128 mode: "0700" 129 130 - name: Ensure /etc/taler-exchange/secrets directory exists 131 ansible.builtin.file: 132 path: "/etc/taler-exchange/secrets" 133 state: directory 134 owner: root 135 group: root 136 mode: "0755" 137 138 - name: Secret setup for sms-challenger 139 ansible.builtin.command: 140 argv: 141 - setup-secret-fact 142 - /etc/ansible/facts.d/sms-challenger-client-secret.fact 143 - "secret-token:" 144 creates: /etc/ansible/facts.d/sms-challenger-client-secret.fact 145 no_log: true 146 147 - name: Secret setup for email-challenger 148 ansible.builtin.command: 149 argv: 150 - setup-secret-fact 151 - /etc/ansible/facts.d/email-challenger-client-secret.fact 152 - "secret-token:" 153 creates: /etc/ansible/facts.d/email-challenger-client-secret.fact 154 no_log: true 155 156 - name: Secret setup for postal-challenger 157 ansible.builtin.command: 158 argv: 159 - setup-secret-fact 160 - /etc/ansible/facts.d/postal-challenger-client-secret.fact 161 - "secret-token:" 162 creates: /etc/ansible/facts.d/postal-challenger-client-secret.fact 163 no_log: true 164 165 - name: Force ansible to regather just created fact(s) about challenger 166 ansible.builtin.setup: 167 no_log: true 168 169 - name: Place SMS challenger config 170 ansible.builtin.template: 171 src: templates/etc/challenger/challenger-sms.conf.j2 172 dest: "/etc/challenger/challenger-sms.conf" 173 owner: root 174 group: challenger-sms 175 mode: "0640" 176 177 - name: Place Postal challenger config 178 ansible.builtin.template: 179 src: templates/etc/challenger/challenger-postal.conf.j2 180 dest: "/etc/challenger/challenger-postal.conf" 181 owner: root 182 group: challenger-postal 183 mode: "0640" 184 185 - name: Place email challenger config 186 ansible.builtin.template: 187 src: templates/etc/challenger/challenger-email.conf.j2 188 dest: "/etc/challenger/challenger-email.conf" 189 owner: root 190 group: challenger-email 191 mode: "0640" 192 193 - name: Place SMS challenger environment data 194 ansible.builtin.template: 195 src: templates/etc/challenger/sms-challenger.env.j2 196 dest: /etc/challenger/sms-challenger.env 197 owner: root 198 group: challenger-sms 199 mode: "0640" 200 no_log: true 201 diff: false 202 203 - name: Place postal challenger environment data 204 ansible.builtin.template: 205 src: templates/etc/challenger/postal-challenger.env.j2 206 dest: /etc/challenger/postal-challenger.env 207 owner: root 208 group: challenger-postal 209 mode: "0640" 210 no_log: true 211 diff: false 212 213 - name: Setup SMS Challenger database 214 ansible.builtin.command: 215 cmd: challenger-dbconfig -c /etc/challenger/challenger-sms.conf -u challenger-sms 216 chdir: /tmp 217 218 - name: Setup Postal Challenger database 219 ansible.builtin.command: 220 cmd: challenger-dbconfig -c /etc/challenger/challenger-postal.conf -u challenger-postal 221 chdir: /tmp 222 223 - name: Setup email Challenger database 224 ansible.builtin.command: 225 cmd: challenger-dbconfig -c /etc/challenger/challenger-email.conf -u challenger-email 226 chdir: /tmp 227 228 - name: Setup SMS Challenger exchange account 229 ansible.builtin.command: 230 argv: 231 - setup-challenger-client-id-fact 232 - /etc/ansible/facts.d/sms-challenger-client-id.fact 233 - challenger-sms 234 - /etc/challenger/challenger-sms.conf 235 - "{{ ansible_local['sms-challenger-client-secret'] }}" 236 - "{{ exchange_base_url }}kyc-proof/sms-challenger" 237 creates: /etc/ansible/facts.d/sms-challenger-client-id.fact 238 no_log: true 239 240 - name: Setup Email Challenger exchange account 241 ansible.builtin.command: 242 argv: 243 - setup-challenger-client-id-fact 244 - /etc/ansible/facts.d/email-challenger-client-id.fact 245 - challenger-email 246 - /etc/challenger/challenger-email.conf 247 - "{{ ansible_local['email-challenger-client-secret'] }}" 248 - "{{ exchange_base_url }}kyc-proof/email-challenger" 249 creates: /etc/ansible/facts.d/email-challenger-client-id.fact 250 no_log: true 251 252 - name: Setup Postal Challenger exchange account 253 ansible.builtin.command: 254 argv: 255 - setup-challenger-client-id-fact 256 - /etc/ansible/facts.d/postal-challenger-client-id.fact 257 - challenger-postal 258 - /etc/challenger/challenger-postal.conf 259 - "{{ ansible_local['postal-challenger-client-secret'] }}" 260 - "{{ exchange_base_url }}kyc-proof/postal-challenger" 261 creates: /etc/ansible/facts.d/postal-challenger-client-id.fact 262 no_log: true 263 264 - name: Force ansible to regather the challenger client IDs 265 ansible.builtin.setup: 266 no_log: true 267 268 - name: Place sms-challenger systemd service file 269 copy: 270 src: etc/systemd/system/sms-challenger-httpd.service 271 dest: /etc/systemd/system/sms-challenger-httpd.service 272 owner: root 273 group: root 274 mode: "0644" 275 276 - name: Create file for sms-challenger logs 277 ansible.builtin.file: 278 path: /var/log/sms.log 279 state: touch 280 owner: challenger-sms 281 group: root 282 mode: "0664" 283 modification_time: preserve 284 access_time: preserve 285 286 - name: Place postal message template 287 copy: 288 src: etc/challenger/postal-message-template.txt 289 dest: /etc/challenger/postal-message-template.txt 290 owner: root 291 group: root 292 mode: "0644" 293 294 - name: Place SMS message template 295 copy: 296 src: etc/challenger/sms-message-template.txt 297 dest: /etc/challenger/sms-message-template.txt 298 owner: root 299 group: root 300 mode: "0644" 301 302 - name: Place email message template 303 copy: 304 src: etc/challenger/email-message-template.txt 305 dest: /etc/challenger/email-message-template.txt 306 owner: root 307 group: root 308 mode: "0644" 309 310 - name: Place postal-challenger systemd service file 311 copy: 312 src: etc/systemd/system/postal-challenger-httpd.service 313 dest: /etc/systemd/system/postal-challenger-httpd.service 314 owner: root 315 group: root 316 mode: "0644" 317 318 - name: Place email-challenger systemd service file 319 copy: 320 src: etc/systemd/system/email-challenger-httpd.service 321 dest: /etc/systemd/system/email-challenger-httpd.service 322 owner: root 323 group: root 324 mode: "0644" 325 326 - name: Generate challenger nginx configuration files (tls config) 327 ansible.builtin.template: 328 src: templates/etc/nginx/conf.d/challenger-tls.conf.inc 329 dest: /etc/nginx/conf.d/challenger-tls.conf.inc 330 owner: root 331 group: root 332 mode: "0644" 333 334 - name: Generate challenger nginx configuration files 335 ansible.builtin.template: 336 src: templates/etc/nginx/sites-available/{{ item }}.j2 337 dest: /etc/nginx/sites-available/{{ item }} 338 owner: root 339 group: root 340 mode: "0644" 341 with_items: 342 - sms-challenger-nginx.conf 343 - sms-challenger-http.conf 344 - email-challenger-nginx.conf 345 - email-challenger-http.conf 346 - postal-challenger-nginx.conf 347 - postal-challenger-http.conf 348 349 - name: Secure the challenger sites with Letsencrypt 350 ansible.builtin.include_role: 351 name: cert 352 vars: 353 cert_name: challenger 354 wanted_cert_domains: 355 - "sms.challenger.{{ domain_name }}" 356 - "email.challenger.{{ domain_name }}" 357 - "postal.challenger.{{ domain_name }}" 358 nginx_sites: 359 - sms-challenger-nginx.conf 360 - postal-challenger-nginx.conf 361 - email-challenger-nginx.conf 362 - sms-challenger-http.conf 363 - postal-challenger-http.conf 364 - email-challenger-http.conf 365 366 - name: Enable postal challenger reverse proxy configuration 367 ansible.builtin.file: 368 src: "/etc/nginx/sites-available/{{ item }}" 369 dest: "/etc/nginx/sites-enabled/{{ item }}" 370 state: link 371 notify: Restart nginx 372 with_items: 373 - sms-challenger-nginx.conf 374 - postal-challenger-nginx.conf 375 - email-challenger-nginx.conf 376 - sms-challenger-http.conf 377 - postal-challenger-http.conf 378 - email-challenger-http.conf