pre-exchange.yml (11738B)
1 --- 2 - name: Populate service facts 3 service_facts: 4 5 - name: Ensure default challenger service is stopped 6 ansible.builtin.systemd: 7 name: challenger-httpd 8 state: stopped 9 enabled: false 10 when: '"challenger-httpd.service" in ansible_facts["services"]' 11 12 - name: Ensure SMS challenger service is stopped before we upgrade 13 ansible.builtin.systemd: 14 name: sms-challenger 15 state: stopped 16 enabled: false 17 when: '"sms-challenger.service" in ansible_facts["services"]' 18 19 - name: Ensure email challenger service is stopped before we upgrade 20 ansible.builtin.systemd: 21 name: email-challenger 22 state: stopped 23 enabled: false 24 when: '"email-challenger.service" in ansible_facts["services"]' 25 26 - name: Ensure postal challenger service is stopped before we upgrade 27 ansible.builtin.systemd: 28 name: postal-challenger 29 state: stopped 30 enabled: false 31 when: '"postal-challenger.service" in ansible_facts["services"]' 32 33 - name: Install Challenger packages (and dependencies) 34 ansible.builtin.apt: 35 name: 36 - challenger-httpd 37 - taler-challenger-helpers 38 - texlive-latex-base # for pdflatex of the postal challenger 39 - texlive-latex-recommended # for the scrlttr2.cls 40 state: latest 41 when: ansible_facts["os_family"] == 'Debian' 42 43 - name: Ensure group "challenger-sms" exists 44 ansible.builtin.group: 45 name: challenger-sms 46 state: present 47 48 - name: Ensure user "challenger-sms" exists 49 ansible.builtin.user: 50 name: challenger-sms 51 group: challenger-sms 52 password: "!" 53 system: true 54 state: present 55 56 - name: Ensure group "challenger-postal" exists 57 ansible.builtin.group: 58 name: challenger-postal 59 state: present 60 61 - name: Ensure user "challenger-postal" exists 62 ansible.builtin.user: 63 name: challenger-postal 64 group: challenger-postal 65 password: "!" 66 system: true 67 state: present 68 69 - name: Ensure group "challenger-email" exists 70 ansible.builtin.group: 71 name: challenger-email 72 state: present 73 74 - name: Ensure user "challenger-email" exists 75 ansible.builtin.user: 76 name: challenger-email 77 group: challenger-email 78 password: "!" 79 system: true 80 state: present 81 82 - name: Ensure mock MFA group exists 83 ansible.builtin.group: 84 name: challenger-mock-mfa 85 state: present 86 when: devtesting_mock_mfa | bool 87 88 - name: Grant challenger services and nginx access to mock MFA messages 89 ansible.builtin.user: 90 name: "{{ item }}" 91 groups: challenger-mock-mfa 92 append: true 93 loop: 94 - challenger-sms 95 - challenger-email 96 - challenger-postal 97 - www-data 98 notify: Restart nginx 99 when: devtesting_mock_mfa | bool 100 101 - name: Ensure mock MFA message directory exists 102 ansible.builtin.file: 103 path: /var/www/mock-mfa 104 state: directory 105 owner: root 106 group: challenger-mock-mfa 107 mode: "2770" 108 when: devtesting_mock_mfa | bool 109 110 - name: Remove mock MFA messages when mock MFA is disabled 111 ansible.builtin.file: 112 path: /var/www/mock-mfa 113 state: absent 114 when: not (devtesting_mock_mfa | bool) 115 116 - name: Install mock MFA delivery helpers 117 ansible.builtin.copy: 118 src: "usr/local/bin/mock-mfa-{{ item }}" 119 dest: "/usr/local/bin/mock-mfa-{{ item }}" 120 owner: root 121 group: root 122 mode: "0755" 123 loop: 124 - sms 125 - email 126 when: devtesting_mock_mfa | bool 127 128 - name: Remove mock MFA delivery helpers when mock MFA is disabled 129 ansible.builtin.file: 130 path: "/usr/local/bin/mock-mfa-{{ item }}" 131 state: absent 132 loop: 133 - sms 134 - email 135 when: not (devtesting_mock_mfa | bool) 136 137 - name: Remove obsolete generic mock MFA helper 138 ansible.builtin.file: 139 path: /usr/local/bin/mock-mfa 140 state: absent 141 142 - name: Ensure Ansible facts directory exists 143 ansible.builtin.file: 144 path: "/etc/ansible/facts.d/" 145 state: directory 146 owner: root 147 group: root 148 mode: "0700" 149 150 - name: Ensure /etc/taler-exchange/secrets directory exists 151 ansible.builtin.file: 152 path: "/etc/taler-exchange/secrets" 153 state: directory 154 owner: root 155 group: root 156 mode: "0755" 157 158 - name: Secret setup for sms-challenger 159 ansible.builtin.command: 160 argv: 161 - setup-secret-fact 162 - /etc/ansible/facts.d/sms-challenger-client-secret.fact 163 - "secret-token:" 164 creates: /etc/ansible/facts.d/sms-challenger-client-secret.fact 165 166 - name: Secret setup for email-challenger 167 ansible.builtin.command: 168 argv: 169 - setup-secret-fact 170 - /etc/ansible/facts.d/email-challenger-client-secret.fact 171 - "secret-token:" 172 creates: /etc/ansible/facts.d/email-challenger-client-secret.fact 173 174 - name: Secret setup for postal-challenger 175 ansible.builtin.command: 176 argv: 177 - setup-secret-fact 178 - /etc/ansible/facts.d/postal-challenger-client-secret.fact 179 - "secret-token:" 180 creates: /etc/ansible/facts.d/postal-challenger-client-secret.fact 181 182 - name: Force ansible to regather just created fact(s) about challenger 183 ansible.builtin.setup: 184 185 - name: Place SMS challenger config 186 ansible.builtin.template: 187 src: templates/etc/challenger/challenger-sms.conf.j2 188 dest: "/etc/challenger/challenger-sms.conf" 189 owner: root 190 group: challenger-sms 191 mode: "0640" 192 193 - name: Place Postal challenger config 194 ansible.builtin.template: 195 src: templates/etc/challenger/challenger-postal.conf.j2 196 dest: "/etc/challenger/challenger-postal.conf" 197 owner: root 198 group: challenger-postal 199 mode: "0640" 200 201 - name: Place email challenger config 202 ansible.builtin.template: 203 src: templates/etc/challenger/challenger-email.conf.j2 204 dest: "/etc/challenger/challenger-email.conf" 205 owner: root 206 group: challenger-email 207 mode: "0640" 208 209 - name: Place SMS challenger environment data 210 ansible.builtin.template: 211 src: templates/etc/challenger/sms-challenger.env.j2 212 dest: /etc/challenger/sms-challenger.env 213 owner: root 214 group: challenger-sms 215 mode: "0640" 216 217 - name: Place postal challenger environment data 218 ansible.builtin.template: 219 src: templates/etc/challenger/postal-challenger.env.j2 220 dest: /etc/challenger/postal-challenger.env 221 owner: root 222 group: challenger-postal 223 mode: "0640" 224 225 - name: Setup SMS Challenger database 226 ansible.builtin.command: 227 cmd: challenger-dbconfig -c /etc/challenger/challenger-sms.conf -u challenger-sms 228 chdir: /tmp 229 230 - name: Setup Postal Challenger database 231 ansible.builtin.command: 232 cmd: challenger-dbconfig -c /etc/challenger/challenger-postal.conf -u challenger-postal 233 chdir: /tmp 234 235 - name: Setup email Challenger database 236 ansible.builtin.command: 237 cmd: challenger-dbconfig -c /etc/challenger/challenger-email.conf -u challenger-email 238 chdir: /tmp 239 240 - name: Setup SMS Challenger exchange account 241 ansible.builtin.command: 242 argv: 243 - setup-challenger-client-id-fact 244 - /etc/ansible/facts.d/sms-challenger-client-id.fact 245 - challenger-sms 246 - /etc/challenger/challenger-sms.conf 247 - "{{ ansible_local['sms-challenger-client-secret'] }}" 248 - "{{ exchange_base_url }}kyc-proof/sms-challenger" 249 creates: /etc/ansible/facts.d/sms-challenger-client-id.fact 250 251 - name: Setup Email Challenger exchange account 252 ansible.builtin.command: 253 argv: 254 - setup-challenger-client-id-fact 255 - /etc/ansible/facts.d/email-challenger-client-id.fact 256 - challenger-email 257 - /etc/challenger/challenger-email.conf 258 - "{{ ansible_local['email-challenger-client-secret'] }}" 259 - "{{ exchange_base_url }}kyc-proof/email-challenger" 260 creates: /etc/ansible/facts.d/email-challenger-client-id.fact 261 262 - name: Setup Postal Challenger exchange account 263 ansible.builtin.command: 264 argv: 265 - setup-challenger-client-id-fact 266 - /etc/ansible/facts.d/postal-challenger-client-id.fact 267 - challenger-postal 268 - /etc/challenger/challenger-postal.conf 269 - "{{ ansible_local['postal-challenger-client-secret'] }}" 270 - "{{ exchange_base_url }}kyc-proof/postal-challenger" 271 creates: /etc/ansible/facts.d/postal-challenger-client-id.fact 272 273 - name: Force ansible to regather the challenger client IDs 274 ansible.builtin.setup: 275 276 - name: Place sms-challenger systemd service file 277 copy: 278 src: etc/systemd/system/sms-challenger-httpd.service 279 dest: /etc/systemd/system/sms-challenger-httpd.service 280 owner: root 281 group: root 282 mode: "0644" 283 284 - name: Create file for sms-challenger logs 285 ansible.builtin.file: 286 path: /var/log/sms.log 287 state: touch 288 owner: challenger-sms 289 group: root 290 mode: "0664" 291 modification_time: preserve 292 access_time: preserve 293 294 - name: Place postal message template 295 copy: 296 src: etc/challenger/postal-message-template.txt 297 dest: /etc/challenger/postal-message-template.txt 298 owner: root 299 group: root 300 mode: "0644" 301 302 - name: Place SMS message template 303 copy: 304 src: etc/challenger/sms-message-template.txt 305 dest: /etc/challenger/sms-message-template.txt 306 owner: root 307 group: root 308 mode: "0644" 309 310 - name: Place email message template 311 copy: 312 src: etc/challenger/email-message-template.txt 313 dest: /etc/challenger/email-message-template.txt 314 owner: root 315 group: root 316 mode: "0644" 317 318 - name: Place postal-challenger systemd service file 319 copy: 320 src: etc/systemd/system/postal-challenger-httpd.service 321 dest: /etc/systemd/system/postal-challenger-httpd.service 322 owner: root 323 group: root 324 mode: "0644" 325 326 - name: Place email-challenger systemd service file 327 copy: 328 src: etc/systemd/system/email-challenger-httpd.service 329 dest: /etc/systemd/system/email-challenger-httpd.service 330 owner: root 331 group: root 332 mode: "0644" 333 334 - name: Ensure SMS challenger service is enabled and started 335 ansible.builtin.systemd: 336 daemon_reload: true 337 name: sms-challenger-httpd 338 state: restarted 339 enabled: true 340 341 - name: Ensure email challenger service is enabled and started 342 ansible.builtin.systemd: 343 name: email-challenger-httpd 344 state: restarted 345 enabled: true 346 347 - name: Ensure postal challenger service is enabled and started 348 ansible.builtin.systemd: 349 name: postal-challenger-httpd 350 state: restarted 351 enabled: true 352 353 - name: Generate challenger nginx configuration files (tls config) 354 ansible.builtin.template: 355 src: templates/etc/nginx/conf.d/challenger-tls.conf.inc 356 dest: /etc/nginx/conf.d/challenger-tls.conf.inc 357 owner: root 358 group: root 359 mode: "0644" 360 361 - name: Generate challenger nginx configuration files 362 ansible.builtin.template: 363 src: templates/etc/nginx/sites-available/{{ item }}.j2 364 dest: /etc/nginx/sites-available/{{ item }} 365 owner: root 366 group: root 367 mode: "0644" 368 with_items: 369 - sms-challenger-nginx.conf 370 - sms-challenger-http.conf 371 - email-challenger-nginx.conf 372 - email-challenger-http.conf 373 - postal-challenger-nginx.conf 374 - postal-challenger-http.conf 375 376 - name: Secure the challenger sites with Letsencrypt 377 ansible.builtin.include_role: 378 name: cert 379 vars: 380 cert_name: challenger 381 wanted_cert_domains: 382 - "sms.challenger.{{ domain_name }}" 383 - "email.challenger.{{ domain_name }}" 384 - "postal.challenger.{{ domain_name }}" 385 nginx_sites: 386 - sms-challenger-nginx.conf 387 - postal-challenger-nginx.conf 388 - email-challenger-nginx.conf 389 - sms-challenger-http.conf 390 - postal-challenger-http.conf 391 - email-challenger-http.conf 392 393 - name: Enable postal challenger reverse proxy configuration 394 ansible.builtin.file: 395 src: "/etc/nginx/sites-available/{{ item }}" 396 dest: "/etc/nginx/sites-enabled/{{ item }}" 397 state: link 398 notify: Restart nginx 399 with_items: 400 - sms-challenger-nginx.conf 401 - postal-challenger-nginx.conf 402 - email-challenger-nginx.conf 403 - sms-challenger-http.conf 404 - postal-challenger-http.conf 405 - email-challenger-http.conf