pre-exchange.yml (10377B)
1 --- 2 - name: Populate service facts 3 service_facts: 4 5 - name: Ensure default challenger service is stopped 6 ansible.builtin.systemd: 7 name: challenger-httpd 8 state: stopped 9 enabled: false 10 11 - name: Ensure SMS challenger service is stopped before we upgrade 12 ansible.builtin.systemd: 13 name: sms-challenger 14 state: stopped 15 enabled: false 16 when: '"sms-challenger.service" in ansible_facts["services"]' 17 18 - name: Ensure email challenger service is stopped before we upgrade 19 ansible.builtin.systemd: 20 name: email-challenger 21 state: stopped 22 enabled: false 23 when: '"email-challenger.service" in ansible_facts["services"]' 24 25 - name: Ensure postal challenger service is stopped before we upgrade 26 ansible.builtin.systemd: 27 name: postal-challenger 28 state: stopped 29 enabled: false 30 when: '"postal-challenger.service" in ansible_facts["services"]' 31 32 - name: Install Challenger packages (and dependencies) 33 ansible.builtin.apt: 34 name: 35 - challenger-httpd 36 - taler-challenger-helpers 37 - texlive-latex-base # for pdflatex of the postal challenger 38 - texlive-latex-recommended # for the scrlttr2.cls 39 state: latest 40 when: ansible_facts["os_family"] == 'Debian' 41 42 - name: Ensure group "challenger-sms" exists 43 ansible.builtin.group: 44 name: challenger-sms 45 state: present 46 47 - name: Ensure user "challenger-sms" exists 48 ansible.builtin.user: 49 name: challenger-sms 50 group: challenger-sms 51 password: ! 52 system: true 53 state: present 54 55 - name: Ensure group "challenger-postal" exists 56 ansible.builtin.group: 57 name: challenger-postal 58 state: present 59 60 - name: Ensure user "challenger-postal" exists 61 ansible.builtin.user: 62 name: challenger-postal 63 group: challenger-postal 64 password: ! 65 system: true 66 state: present 67 68 - name: Ensure group "challenger-email" exists 69 ansible.builtin.group: 70 name: challenger-email 71 state: present 72 73 - name: Ensure user "challenger-email" exists 74 ansible.builtin.user: 75 name: challenger-email 76 group: challenger-email 77 password: ! 78 system: true 79 state: present 80 81 - name: Ensure Ansible facts directory exists 82 ansible.builtin.file: 83 path: "/etc/ansible/facts.d/" 84 state: directory 85 owner: root 86 group: root 87 mode: "0700" 88 89 - name: Ensure /etc/taler-exchange/secrets directory exists 90 ansible.builtin.file: 91 path: "/etc/taler-exchange/secrets" 92 state: directory 93 owner: root 94 group: root 95 mode: "0755" 96 97 - name: Secret setup for sms-challenger 98 when: not local_facts['sms-challenger-client-secret'] is defined 99 ansible.builtin.command: 100 argv: 101 - setup-secret-fact 102 - /etc/ansible/facts.d/sms-challenger-client-secret.fact 103 - "secret-token:" 104 creates: /etc/ansible/facts.d/sms-challenger-client-secret.fact 105 106 - name: Secret setup for email-challenger 107 ansible.builtin.command: 108 argv: 109 - setup-secret-fact 110 - /etc/ansible/facts.d/email-challenger-client-secret.fact 111 - "secret-token:" 112 creates: /etc/ansible/facts.d/email-challenger-client-secret.fact 113 114 - name: Secret setup for postal-challenger 115 ansible.builtin.command: 116 argv: 117 - setup-secret-fact 118 - /etc/ansible/facts.d/postal-challenger-client-secret.fact 119 - "secret-token:" 120 creates: /etc/ansible/facts.d/postal-challenger-client-secret.fact 121 122 - name: Force ansible to regather just created fact(s) about challenger 123 ansible.builtin.setup: 124 filter: 125 - 'sms-challenger-client-secret' 126 - 'email-challenger-client-secret' 127 - 'postal-challenger-client-secret' 128 129 - name: Place SMS challenger config 130 ansible.builtin.template: 131 src: templates/etc/challenger/challenger-sms.conf.j2 132 dest: "/etc/challenger/challenger-sms.conf" 133 owner: root 134 group: challenger-sms 135 mode: "0640" 136 137 - name: Place Postal challenger config 138 ansible.builtin.template: 139 src: templates/etc/challenger/challenger-postal.conf.j2 140 dest: "/etc/challenger/challenger-postal.conf" 141 owner: root 142 group: challenger-postal 143 mode: "0640" 144 145 - name: Place email challenger config 146 ansible.builtin.template: 147 src: templates/etc/challenger/challenger-email.conf.j2 148 dest: "/etc/challenger/challenger-email.conf" 149 owner: root 150 group: challenger-email 151 mode: "0640" 152 153 - name: Place SMS challenger environment data 154 ansible.builtin.template: 155 src: templates/etc/challenger/sms-challenger.env.j2 156 dest: /etc/challenger/sms-challenger.env 157 owner: root 158 group: challenger-sms 159 mode: "0640" 160 161 - name: Place postal challenger environment data 162 ansible.builtin.template: 163 src: templates/etc/challenger/postal-challenger.env.j2 164 dest: /etc/challenger/postal-challenger.env 165 owner: root 166 group: challenger-postal 167 mode: "0640" 168 169 - name: Setup SMS Challenger database 170 ansible.builtin.command: 171 cmd: challenger-dbconfig -c /etc/challenger/challenger-sms.conf -u challenger-sms -n challenger-sms 172 chdir: /tmp 173 174 - name: Setup Postal Challenger database 175 ansible.builtin.command: 176 cmd: challenger-dbconfig -c /etc/challenger/challenger-postal.conf -u challenger-postal -n challenger-postal 177 chdir: /tmp 178 179 - name: Setup email Challenger database 180 ansible.builtin.command: 181 cmd: challenger-dbconfig -c /etc/challenger/challenger-email.conf -u challenger-email -n challenger-email 182 chdir: /tmp 183 184 - name: Force ansible to regather newly created fact(s) about sms-challenger 185 ansible.builtin.setup: 186 187 - name: Setup SMS Challenger exchange account 188 ansible.builtin.command: 189 argv: 190 - setup-challenger-client-id-fact 191 - /etc/ansible/facts.d/sms-challenger-client-id.fact 192 - challenger-sms 193 - /etc/challenger/challenger-sms.conf 194 - "{{ ansible_local['sms-challenger-client-secret'] }}" 195 - "{{ EXCHANGE_BASE_URL }}kyc-proof/sms-challenger" 196 creates: /etc/ansible/facts.d/sms-challenger-client-id.fact 197 198 - name: Setup Email Challenger exchange account 199 ansible.builtin.command: 200 argv: 201 - setup-challenger-client-id-fact 202 - /etc/ansible/facts.d/email-challenger-client-id.fact 203 - challenger-email 204 - /etc/challenger/challenger-email.conf 205 - "{{ ansible_local['email-challenger-client-secret'] }}" 206 - "{{ EXCHANGE_BASE_URL }}kyc-proof/email-challenger" 207 creates: /etc/ansible/facts.d/email-challenger-client-id.fact 208 209 - name: Setup Postal Challenger exchange account 210 ansible.builtin.command: 211 argv: 212 - setup-challenger-client-id-fact 213 - /etc/ansible/facts.d/postal-challenger-client-id.fact 214 - challenger-postal 215 - /etc/challenger/challenger-postal.conf 216 - "{{ ansible_local['postal-challenger-client-secret'] }}" 217 - "{{ EXCHANGE_BASE_URL }}kyc-proof/postal-challenger" 218 creates: /etc/ansible/facts.d/postal-challenger-client-id.fact 219 220 - name: Force ansible to regather fact(s) just created about sms-challenger 221 ansible.builtin.setup: 222 223 - name: Place sms-challenger systemd service file 224 copy: 225 src: etc/systemd/system/sms-challenger-httpd.service 226 dest: /etc/systemd/system/sms-challenger-httpd.service 227 owner: root 228 group: root 229 mode: "0700" 230 231 - name: Create file for sms-challenger logs 232 ansible.builtin.file: 233 path: /var/log/sms.log 234 state: touch 235 owner: challenger-sms 236 group: root 237 mode: "0664" 238 modification_time: preserve 239 access_time: preserve 240 241 - name: Place postal message template 242 copy: 243 src: etc/challenger/postal-message-template.txt 244 dest: /etc/challenger/postal-message-template.txt 245 246 - name: Place SMS message template 247 copy: 248 src: etc/challenger/sms-message-template.txt 249 dest: /etc/challenger/sms-message-template.txt 250 251 - name: Place email message template 252 copy: 253 src: etc/challenger/email-message-template.txt 254 dest: /etc/challenger/email-message-template.txt 255 256 - name: Place postal-challenger systemd service file 257 copy: 258 src: etc/systemd/system/postal-challenger-httpd.service 259 dest: /etc/systemd/system/postal-challenger-httpd.service 260 owner: root 261 group: root 262 mode: "0700" 263 264 - name: Place email-challenger systemd service file 265 copy: 266 src: etc/systemd/system/email-challenger-httpd.service 267 dest: /etc/systemd/system/email-challenger-httpd.service 268 mode: "0700" 269 270 - name: Ensure SMS challenger service is enabled and started 271 ansible.builtin.systemd: 272 daemon_reload: true 273 name: sms-challenger-httpd 274 state: restarted 275 enabled: true 276 277 - name: Ensure email challenger service is enabled and started 278 ansible.builtin.systemd: 279 name: email-challenger-httpd 280 state: restarted 281 enabled: true 282 283 - name: Ensure postal challenger service is enabled and started 284 ansible.builtin.systemd: 285 name: postal-challenger-httpd 286 state: restarted 287 enabled: true 288 289 - name: Generate challenger nginx configuration files (tls config) 290 ansible.builtin.template: 291 src: templates/etc/nginx/conf.d/challenger-tls.conf.inc 292 dest: /etc/nginx/conf.d/challenger-tls.conf.inc 293 owner: root 294 group: root 295 mode: "0644" 296 297 - name: Generate challenger nginx configuration files 298 ansible.builtin.template: 299 src: templates/etc/nginx/sites-available/{{ item }}.j2 300 dest: /etc/nginx/sites-available/{{ item }} 301 owner: root 302 group: root 303 mode: "0644" 304 with_items: 305 - sms-challenger-nginx.conf 306 - sms-challenger-http.conf 307 - email-challenger-nginx.conf 308 - email-challenger-http.conf 309 - postal-challenger-nginx.conf 310 - postal-challenger-http.conf 311 312 - name: Secure the auditor site with Letsencrypt 313 ansible.builtin.include_role: 314 name: cert 315 vars: 316 cert_name: challenger 317 wanted_cert_domains: 318 - "sms.challenger.{{ domain_name }}" 319 - "email.challenger.{{ domain_name }}" 320 - "postal.challenger.{{ domain_name }}" 321 nginx_sites: 322 - sms-challenger-nginx.conf 323 - postal-challenger-nginx.conf 324 - email-challenger-nginx.conf 325 - sms-challenger-http.conf 326 - postal-challenger-http.conf 327 - email-challenger-http.conf 328 329 - name: Enable postal challenger reverse proxy configuration 330 ansible.builtin.file: 331 src: "/etc/nginx/sites-available/{{ item }}" 332 dest: "/etc/nginx/sites-enabled/{{ item }}" 333 state: link 334 notify: Restart nginx 335 with_items: 336 - sms-challenger-nginx.conf 337 - postal-challenger-nginx.conf 338 - email-challenger-nginx.conf 339 - sms-challenger-http.conf 340 - postal-challenger-http.conf 341 - email-challenger-http.conf