main.yml (7053B)
1 --- 2 - name: Get the list of services 3 service_facts: 4 5 - name: Install latest Taler exchange package 6 ansible.builtin.apt: 7 policy_rc_d: 101 8 name: 9 - taler-exchange 10 - taler-exchange-typst 11 - taler-terms-generator 12 state: latest 13 when: ansible_facts["os_family"] == 'Debian' 14 15 - name: Install pdftk 16 ansible.builtin.apt: 17 policy_rc_d: 101 18 name: 19 - pdftk 20 state: latest 21 when: ansible_facts["os_family"] == 'Debian' 22 23 - name: Refresh the list of services after the installation 24 service_facts: 25 26 27 - name: Check if Typst binary exists 28 ansible.builtin.stat: 29 path: "{{ typst_bin_path | default('/usr/local/bin/typst') }}" 30 register: typst_stat 31 32 - name: Get current Typst version 33 ansible.builtin.command: "{{ typst_bin_path | default('/usr/local/bin/typst') }} --version" 34 register: typst_version_check 35 changed_when: false 36 failed_when: false 37 check_mode: false 38 when: typst_stat.stat.exists 39 40 - name: Determine whether Typst must be installed 41 ansible.builtin.set_fact: 42 exchange_typst_install_required: >- 43 {{ 44 not typst_stat.stat.exists or 45 typst_version not in (typst_version_check.stdout | default('')) 46 }} 47 48 - name: Report pending Typst installation in check mode 49 ansible.builtin.debug: 50 msg: Typst {{ typst_version }} would be installed. 51 changed_when: true 52 when: 53 - ansible_check_mode 54 - exchange_typst_install_required 55 56 - name: Install or update Typst 57 when: 58 - exchange_typst_install_required 59 - not ansible_check_mode 60 block: 61 - name: Create temporary directory for extraction 62 ansible.builtin.tempfile: 63 state: directory 64 suffix: typst_install 65 register: temp_dir 66 67 - name: Download Typst release archive 68 ansible.builtin.get_url: 69 url: "{{ typst_download_url }}" 70 dest: "{{ temp_dir.path }}/typst.tar.xz" 71 checksum: "{{ typst_checksum }}" 72 mode: '0644' 73 74 - name: Unarchive Typst binary 75 ansible.builtin.unarchive: 76 src: "{{ temp_dir.path }}/typst.tar.xz" 77 dest: "{{ temp_dir.path }}" 78 remote_src: true 79 80 - name: Copy binary to destination 81 ansible.builtin.copy: 82 # Note: The folder inside the tar.xz matches the release name 83 src: "{{ temp_dir.path }}/typst-x86_64-unknown-linux-musl/typst" 84 dest: "{{ typst_bin_path | default('/usr/local/bin/typst') }}" 85 mode: '0755' 86 owner: root 87 group: root 88 remote_src: true 89 90 - name: Cleanup temporary directory 91 ansible.builtin.file: 92 path: "{{ temp_dir.path }}" 93 state: absent 94 95 - name: Verify Typst is functional 96 ansible.builtin.command: "{{ typst_bin_path | default('/usr/local/bin/typst') }} --version" 97 register: typst_final_check 98 changed_when: false 99 failed_when: "typst_version not in typst_final_check.stdout" 100 check_mode: false 101 when: not (ansible_check_mode and exchange_typst_install_required) 102 103 - name: Ensure Taler exchange virtualhost configuration file exists 104 ansible.builtin.template: 105 src: templates/etc/nginx/sites-available/exchange-nginx.conf.j2 106 dest: /etc/nginx/sites-available/exchange-nginx.conf 107 owner: root 108 group: root 109 mode: "0644" 110 notify: Restart nginx 111 112 - name: Ensure Taler exchange HTTP virtualhost configuration file exists 113 ansible.builtin.template: 114 src: templates/etc/nginx/sites-available/exchange-http.conf.j2 115 dest: /etc/nginx/sites-available/exchange-http.conf 116 owner: root 117 group: root 118 mode: "0644" 119 120 - name: Secure the exchange site with Letsencrypt 121 when: exchange_use_letsencrypt 122 ansible.builtin.include_role: 123 name: cert 124 vars: 125 cert_name: exchange 126 wanted_cert_domains: 127 - "{{ exchange_domain }}" 128 nginx_sites: 129 - exchange-http.conf 130 - exchange-nginx.conf 131 132 - name: Enable Taler exchange HTTP reverse proxy configuration 133 ansible.builtin.file: 134 src: /etc/nginx/sites-available/exchange-http.conf 135 dest: /etc/nginx/sites-enabled/exchange-http.conf 136 state: link 137 notify: Restart nginx 138 139 - name: Enable Taler exchange reverse proxy configuration 140 ansible.builtin.file: 141 src: /etc/nginx/sites-available/exchange-nginx.conf 142 dest: /etc/nginx/sites-enabled/exchange-nginx.conf 143 state: link 144 notify: Restart nginx 145 146 - name: Check that /etc/taler-exchange/conf.d/ directory exists 147 ansible.builtin.stat: 148 path: "/etc/taler-exchange/conf.d/" 149 register: st 150 failed_when: not (st.stat.exists is defined and st.stat.exists) 151 152 - name: Check that /etc/taler-exchange/secrets/ directory exists 153 ansible.builtin.stat: 154 path: "/etc/taler-exchange/secrets/" 155 register: st 156 failed_when: not (st.stat.exists is defined and st.stat.exists) 157 158 - name: Place taler-exchange account credentials 159 ansible.builtin.template: 160 src: templates/etc/taler-exchange/secrets/exchange-accountcredentials-primary.secret.conf.j2 161 dest: /etc/taler-exchange/secrets/exchange-accountcredentials-primary.secret.conf 162 owner: taler-exchange-wire 163 group: root 164 mode: "0400" 165 no_log: true 166 diff: false 167 168 - name: Place the existing KYC attribute encryption key in a restricted include 169 ansible.builtin.template: 170 src: etc/taler-exchange/secrets/exchange-attributes.secret.conf.j2 171 dest: /etc/taler-exchange/secrets/exchange-attributes.secret.conf 172 owner: root 173 group: taler-exchange-kyc 174 mode: "0440" 175 no_log: true 176 diff: false 177 178 - name: Place taler-exchange business config 179 ansible.builtin.template: 180 src: templates/etc/taler-exchange/conf.d/exchange-business.conf.j2 181 dest: /etc/taler-exchange/conf.d/exchange-business.conf 182 owner: root 183 group: root 184 mode: "0644" 185 no_log: true 186 diff: false 187 188 - name: Setup or upgrade Taler Exchange database 189 ansible.builtin.command: 190 cmd: taler-exchange-dbconfig -c /etc/taler-exchange/taler-exchange.conf 191 chdir: /tmp 192 193 - name: Ensure /var/lib/taler-exchange/terms/ directory exists 194 ansible.builtin.file: 195 path: "/var/lib/taler-exchange/terms/" 196 state: directory 197 owner: taler-exchange-httpd 198 group: root 199 mode: "0755" 200 201 - name: Apply deployment-specific exchange configuration 202 ansible.builtin.include_role: 203 name: "exchange_{{ deployment_kind }}" 204 205 - name: Check if local sanction list file exists 206 delegate_to: localhost 207 run_once: true 208 ansible.builtin.stat: 209 path: "{{ role_path }}/files/var/lib/taler-exchange/{{ sanction_list }}" 210 register: sanction_list_stat 211 when: sanction_list is defined 212 213 - name: Fail if sanction list file does not exist 214 delegate_to: localhost 215 run_once: true 216 ansible.builtin.fail: 217 msg: "The local file 'files/var/lib/taler-exchange/{{ sanction_list }}' does not exist. Aborting." 218 when: 219 - sanction_list is defined 220 - not sanction_list_stat.stat.exists 221 222 - name: Copy sanction list to server if sanction_list is defined 223 ansible.builtin.copy: 224 src: "var/lib/taler-exchange/{{ sanction_list }}" 225 dest: "/var/lib/taler-exchange/{{ sanction_list }}" 226 owner: root 227 group: root 228 mode: "0644" 229 when: sanction_list is defined 230 notify: sanctions-reset