main.yml (7203B)
1 --- 2 - name: Get the list of services 3 service_facts: 4 5 - name: Ensure taler-exchange service is stopped before we upgrade 6 ansible.builtin.systemd: 7 name: taler-exchange.target 8 state: stopped 9 enabled: false 10 when: '"taler-exchange.target" in ansible_facts["services"]' 11 12 - name: Ensure sanctionscheck service is stopped before we upgrade 13 ansible.builtin.systemd: 14 name: taler-exchange-sanctionscheck 15 state: stopped 16 enabled: false 17 when: '"taler-exchange-sanctionscheck.service" in ansible_facts["services"]' 18 19 - name: Install latest Taler exchange package 20 ansible.builtin.apt: 21 name: 22 - taler-exchange 23 - taler-exchange-typst 24 - taler-terms-generator 25 state: latest 26 when: ansible_facts["os_family"] == 'Debian' 27 28 - name: Install pdftk 29 ansible.builtin.apt: 30 name: 31 - pdftk 32 state: latest 33 when: ansible_facts["os_family"] == 'Debian' 34 35 - name: Refresh the list of services after the installation 36 service_facts: 37 38 39 - name: Check if Typst binary exists 40 ansible.builtin.stat: 41 path: "{{ typst_bin_path | default('/usr/local/bin/typst') }}" 42 register: typst_stat 43 44 - name: Get current Typst version 45 ansible.builtin.command: "{{ typst_bin_path | default('/usr/local/bin/typst') }} --version" 46 register: typst_version_check 47 changed_when: false 48 failed_when: false 49 when: typst_stat.stat.exists 50 51 - name: Install or Update Typst 52 # Only runs if binary is missing OR the version string doesn't match our target 53 when: > 54 not typst_stat.stat.exists or 55 typst_version not in (typst_version_check.stdout | default('')) 56 block: 57 - name: Create temporary directory for extraction 58 ansible.builtin.tempfile: 59 state: directory 60 suffix: typst_install 61 register: temp_dir 62 63 - name: Download Typst release archive 64 ansible.builtin.get_url: 65 url: "{{ typst_download_url }}" 66 dest: "{{ temp_dir.path }}/typst.tar.xz" 67 checksum: "{{ typst_checksum }}" 68 mode: '0644' 69 70 - name: Unarchive Typst binary 71 ansible.builtin.unarchive: 72 src: "{{ temp_dir.path }}/typst.tar.xz" 73 dest: "{{ temp_dir.path }}" 74 remote_src: true 75 76 - name: Copy binary to destination 77 ansible.builtin.copy: 78 # Note: The folder inside the tar.xz matches the release name 79 src: "{{ temp_dir.path }}/typst-x86_64-unknown-linux-musl/typst" 80 dest: "{{ typst_bin_path | default('/usr/local/bin/typst') }}" 81 mode: '0755' 82 owner: root 83 group: root 84 remote_src: true 85 86 - name: Cleanup temporary directory 87 ansible.builtin.file: 88 path: "{{ temp_dir.path }}" 89 state: absent 90 91 - name: Verify Typst is functional 92 ansible.builtin.command: "{{ typst_bin_path | default('/usr/local/bin/typst') }} --version" 93 register: typst_final_check 94 changed_when: false 95 failed_when: "typst_version not in typst_final_check.stdout" 96 97 - name: Ensure Taler exchange virtualhost configuration file exists 98 ansible.builtin.template: 99 src: templates/etc/nginx/sites-available/exchange-nginx.conf.j2 100 dest: /etc/nginx/sites-available/exchange-nginx.conf 101 owner: root 102 group: root 103 mode: "0644" 104 notify: Restart nginx 105 106 - name: Ensure Taler exchange HTTP virtualhost configuration file exists 107 ansible.builtin.template: 108 src: templates/etc/nginx/sites-available/exchange-http.conf.j2 109 dest: /etc/nginx/sites-available/exchange-http.conf 110 owner: root 111 group: root 112 mode: "0644" 113 114 - name: Secure the exchange site with Letsencrypt 115 when: exchange_use_letsencrypt 116 ansible.builtin.include_role: 117 name: cert 118 vars: 119 cert_name: exchange 120 wanted_cert_domains: 121 - "{{ exchange_domain }}" 122 nginx_sites: 123 - exchange-http.conf 124 - exchange-nginx.conf 125 126 - name: Enable Taler exchange HTTP reverse proxy configuration 127 ansible.builtin.file: 128 src: /etc/nginx/sites-available/exchange-http.conf 129 dest: /etc/nginx/sites-enabled/exchange-http.conf 130 state: link 131 notify: Restart nginx 132 133 - name: Enable Taler exchange reverse proxy configuration 134 ansible.builtin.file: 135 src: /etc/nginx/sites-available/exchange-nginx.conf 136 dest: /etc/nginx/sites-enabled/exchange-nginx.conf 137 state: link 138 notify: Restart nginx 139 140 - name: Check that /etc/taler-exchange/conf.d/ directory exists 141 ansible.builtin.stat: 142 path: "/etc/taler-exchange/conf.d/" 143 register: st 144 failed_when: not (st.stat.exists is defined and st.stat.exists) 145 146 - name: Check that /etc/taler-exchange/secrets/ directory exists 147 ansible.builtin.stat: 148 path: "/etc/taler-exchange/secrets/" 149 register: st 150 failed_when: not (st.stat.exists is defined and st.stat.exists) 151 152 - name: Place taler-exchange account credentials 153 ansible.builtin.template: 154 src: templates/etc/taler-exchange/secrets/exchange-accountcredentials-primary.secret.conf.j2 155 dest: /etc/taler-exchange/secrets/exchange-accountcredentials-primary.secret.conf 156 owner: taler-exchange-wire 157 group: root 158 mode: "0400" 159 160 - name: Place taler-exchange business config 161 ansible.builtin.template: 162 src: templates/etc/taler-exchange/conf.d/exchange-business.conf.j2 163 dest: /etc/taler-exchange/conf.d/exchange-business.conf 164 owner: root 165 group: root 166 mode: "0644" 167 168 - name: Setup or upgrade Taler Exchange database 169 ansible.builtin.command: 170 cmd: taler-exchange-dbconfig -c /etc/taler-exchange/taler-exchange.conf 171 chdir: /tmp 172 173 - name: Ensure /var/lib/taler-exchange/terms/ directory exists 174 ansible.builtin.file: 175 path: "/var/lib/taler-exchange/terms/" 176 state: directory 177 owner: taler-exchange-httpd 178 group: root 179 mode: "0755" 180 181 - name: Apply deployment-specific exchange configuration 182 ansible.builtin.include_role: 183 name: "exchange_{{ deployment_kind }}" 184 185 # FIXME: Implement this as handler, so it's only 186 # done when necessary. 187 - name: Ensure taler-exchange service is enabled and restarted 188 service: 189 daemon_reload: true 190 name: taler-exchange.target 191 state: restarted 192 enabled: true 193 194 # Setup sanction list 195 - name: Check if local sanction list file exists 196 delegate_to: localhost 197 run_once: true 198 ansible.builtin.stat: 199 path: "{{ role_path }}/files/var/lib/taler-exchange/{{ sanction_list }}" 200 register: sanction_list_stat 201 when: sanction_list is defined 202 203 - name: Fail if sanction list file does not exist 204 delegate_to: localhost 205 run_once: true 206 ansible.builtin.fail: 207 msg: "The local file 'files/var/lib/taler-exchange/{{ sanction_list }}' does not exist. Aborting." 208 when: 209 - sanction_list is defined 210 - not sanction_list_stat.stat.exists 211 212 - name: Copy sanction list to server if sanction_list is defined 213 ansible.builtin.copy: 214 src: "var/lib/taler-exchange/{{ sanction_list }}" 215 dest: "/var/lib/taler-exchange/{{ sanction_list }}" 216 owner: root 217 group: root 218 mode: "0644" 219 when: sanction_list is defined 220 notify: sanctions-reset 221 222 - name: Ensure sanctionscheck service is restarted after the upgrade 223 ansible.builtin.systemd: 224 daemon_reload: true 225 name: taler-exchange-sanctionscheck 226 state: started 227 enabled: true 228 when: 229 - '"taler-exchange-sanctionscheck.service" in ansible_facts["services"]' 230 - sanction_list is defined