main.yml (7207B)
1 --- 2 - name: Get the list of services 3 service_facts: 4 5 - name: Ensure taler-exchange service is stopped before we upgrade 6 ansible.builtin.systemd: 7 name: taler-exchange.target 8 state: stopped 9 enabled: false 10 when: '"taler-exchange.target" in ansible_facts["services"]' 11 12 - name: Ensure sanctionscheck service is stopped before we upgrade 13 ansible.builtin.systemd: 14 name: taler-exchange-sanctionscheck 15 state: stopped 16 enabled: false 17 when: '"taler-exchange-sanctionscheck.service" in ansible_facts["services"]' 18 19 - name: Install latest Taler exchange package 20 ansible.builtin.apt: 21 name: 22 - taler-exchange 23 - taler-exchange-typst 24 - taler-terms-generator 25 state: latest 26 when: ansible_facts["os_family"] == 'Debian' 27 28 - name: Install pdftk 29 ansible.builtin.apt: 30 name: 31 - pdftk 32 state: latest 33 when: ansible_facts["os_family"] == 'Debian' 34 35 36 - name: Check if Typst binary exists 37 ansible.builtin.stat: 38 path: "{{ typst_bin_path | default('/usr/local/bin/typst') }}" 39 register: typst_stat 40 41 - name: Get current Typst version 42 ansible.builtin.command: "{{ typst_bin_path | default('/usr/local/bin/typst') }} --version" 43 register: typst_version_check 44 changed_when: false 45 failed_when: false 46 when: typst_stat.stat.exists 47 48 - name: Install or Update Typst 49 # Only runs if binary is missing OR the version string doesn't match our target 50 when: > 51 not typst_stat.stat.exists or 52 typst_version not in (typst_version_check.stdout | default('')) 53 block: 54 - name: Create temporary directory for extraction 55 ansible.builtin.tempfile: 56 state: directory 57 suffix: typst_install 58 register: temp_dir 59 60 - name: Download Typst release archive 61 ansible.builtin.get_url: 62 url: "https://github.com/typst/typst/releases/download/v{{ typst_version }}/typst-x86_64-unknown-linux-musl.tar.xz" 63 dest: "{{ temp_dir.path }}/typst.tar.xz" 64 checksum: "{{ typst_checksum }}" 65 mode: '0644' 66 67 - name: Unarchive Typst binary 68 ansible.builtin.unarchive: 69 src: "{{ temp_dir.path }}/typst.tar.xz" 70 dest: "{{ temp_dir.path }}" 71 remote_src: true 72 73 - name: Copy binary to destination 74 ansible.builtin.copy: 75 # Note: The folder inside the tar.xz matches the release name 76 src: "{{ temp_dir.path }}/typst-x86_64-unknown-linux-musl/typst" 77 dest: "{{ typst_bin_path | default('/usr/local/bin/typst') }}" 78 mode: '0755' 79 owner: root 80 group: root 81 remote_src: true 82 83 - name: Cleanup temporary directory 84 ansible.builtin.file: 85 path: "{{ temp_dir.path }}" 86 state: absent 87 88 - name: Verify Typst is functional 89 ansible.builtin.command: "{{ typst_bin_path | default('/usr/local/bin/typst') }} --version" 90 register: typst_final_check 91 changed_when: false 92 failed_when: "typst_version not in typst_final_check.stdout" 93 94 - name: Ensure Taler exchange virtualhost configuration file exists 95 ansible.builtin.template: 96 src: templates/etc/nginx/sites-available/exchange-nginx.conf.j2 97 dest: /etc/nginx/sites-available/exchange-nginx.conf 98 owner: root 99 group: root 100 mode: "0644" 101 notify: Restart nginx 102 103 - name: Ensure Taler exchange HTTP virtualhost configuration file exists 104 ansible.builtin.template: 105 src: templates/etc/nginx/sites-available/exchange-http.conf.j2 106 dest: /etc/nginx/sites-available/exchange-http.conf 107 owner: root 108 group: root 109 mode: "0644" 110 111 - name: Secure the exchange site with Letsencrypt 112 when: exchange_use_letsencrypt 113 ansible.builtin.include_role: 114 name: cert 115 vars: 116 cert_name: exchange 117 wanted_cert_domains: 118 - "{{ exchange_domain }}" 119 nginx_sites: 120 - exchange-http.conf 121 - exchange-nginx.conf 122 123 - name: Enable Taler exchange HTTP reverse proxy configuration 124 ansible.builtin.file: 125 src: /etc/nginx/sites-available/exchange-http.conf 126 dest: /etc/nginx/sites-enabled/exchange-http.conf 127 state: link 128 notify: Restart nginx 129 130 - name: Enable Taler exchange reverse proxy configuration 131 ansible.builtin.file: 132 src: /etc/nginx/sites-available/exchange-nginx.conf 133 dest: /etc/nginx/sites-enabled/exchange-nginx.conf 134 state: link 135 notify: Restart nginx 136 137 - name: Ensure /etc/taler-exchange/config.d/ directory exists 138 ansible.builtin.stat: 139 path: "/etc/taler-exchange/conf.d/" 140 register: st 141 failed_when: not (st.stat.exists is defined and st.stat.exists) 142 143 - name: Check that /etc/taler-exchange/secrets/ directory exists 144 ansible.builtin.stat: 145 path: "/etc/taler-exchange/secrets/" 146 register: st 147 failed_when: not (st.stat.exists is defined and st.stat.exists) 148 149 - name: Place taler-exchange account credentials 150 ansible.builtin.template: 151 src: templates/etc/taler-exchange/secrets/exchange-accountcredentials-primary.secret.conf.j2 152 dest: /etc/taler-exchange/secrets/exchange-accountcredentials-primary.secret.conf 153 owner: taler-exchange-wire 154 group: root 155 mode: "0400" 156 157 - name: Place taler-exchange business config 158 ansible.builtin.template: 159 src: templates/etc/taler-exchange/conf.d/exchange-business.conf.j2 160 dest: /etc/taler-exchange/conf.d/exchange-business.conf 161 owner: root 162 group: root 163 mode: "0644" 164 165 - name: Setup or upgrade Taler Exchange database 166 ansible.builtin.command: 167 cmd: taler-exchange-dbconfig -c /etc/taler-exchange/taler-exchange.conf 168 chdir: /tmp 169 170 - name: Ensure /var/lib/taler-exchange/terms/ directory exists 171 ansible.builtin.file: 172 path: "/var/lib/taler-exchange/terms/" 173 state: directory 174 owner: taler-exchange-httpd 175 group: root 176 mode: "0755" 177 178 - name: Apply deployment-specific exchange configuration 179 ansible.builtin.include_role: 180 name: "exchange_{{ DEPLOYMENT_KIND }}" 181 182 # FIXME: Implement this as handler, so it's only 183 # done when necessary. 184 - name: Ensure taler-exchange service is enabled and restarted 185 service: 186 daemon_reload: true 187 name: taler-exchange.target 188 state: restarted 189 enabled: true 190 191 # Setup sanction list 192 - name: Check if local sanction list file exists 193 delegate_to: localhost 194 run_once: true 195 ansible.builtin.stat: 196 path: "{{ role_path }}/files/var/lib/taler-exchange/{{ SANCTION_LIST }}" 197 register: sanction_list_stat 198 when: SANCTION_LIST is defined 199 200 - name: Fail if sanction list file does not exist 201 delegate_to: localhost 202 run_once: true 203 ansible.builtin.fail: 204 msg: "The local file 'files/var/lib/taler-exchange/{{ SANCTION_LIST }}' does not exist. Aborting." 205 when: 206 - SANCTION_LIST is defined 207 - not sanction_list_stat.stat.exists 208 209 - name: Copy sanction list to server if SANCTION_LIST is defined 210 ansible.builtin.copy: 211 src: "var/lib/taler-exchange/{{ SANCTION_LIST }}" 212 dest: "/var/lib/taler-exchange/{{ SANCTION_LIST }}" 213 owner: root 214 group: root 215 mode: "0644" 216 when: SANCTION_LIST is defined 217 notify: sanctions-reset 218 219 - name: Ensure sanctionscheck service is restarted after the upgrade 220 ansible.builtin.systemd: 221 daemon_reload: true 222 name: taler-exchange-sanctionscheck 223 state: started 224 enabled: true 225 when: 226 - '"taler-exchange-sanctionscheck.service" in ansible_facts["services"]' 227 - SANCTION_LIST is defined