main.yml (8157B)
1 --- 2 - name: Get the list of services 3 service_facts: 4 5 - name: Ensure libeufin-nexus service is stopped before we upgrade 6 systemd: 7 name: libeufin-nexus.target 8 state: stopped 9 enabled: false 10 when: '"libeufin-nexus.target" in ansible_facts["services"]' 11 12 - name: Ensure libeufin-nexus-httpd service is stopped before we upgrade 13 service: 14 name: libeufin-nexus-httpd.service 15 state: stopped 16 enabled: false 17 when: '"libeufin-nexus-httpd.service" in ansible_facts["services"]' 18 19 - name: Install libeufin-nexus package 20 apt: 21 name: 22 - libeufin-nexus 23 state: latest 24 when: ansible_facts["os_family"] == 'Debian' 25 26 - name: Ensure libeufin config dir exists from installation 27 file: 28 path: "/etc/libeufin" 29 state: directory 30 mode: "0755" 31 owner: root 32 group: root 33 34 - name: Ensure nexus virtualhost configuration file exists 35 ansible.builtin.template: 36 src: templates/etc/nginx/sites-available/nexus-nginx.conf.j2 37 dest: /etc/nginx/sites-available/nexus-nginx.conf 38 owner: root 39 group: root 40 mode: "0644" 41 42 - name: Ensure nexus HTTP virtualhost configuration file exists 43 ansible.builtin.template: 44 src: templates/etc/nginx/sites-available/nexus-http.conf.j2 45 dest: /etc/nginx/sites-available/nexus-http.conf 46 owner: root 47 group: root 48 mode: "0644" 49 50 - name: Secure the libeufin with Letsencrypt 51 when: nexus_use_letsencrypt 52 ansible.builtin.include_role: 53 name: cert 54 vars: 55 cert_name: nexus 56 wanted_cert_domains: 57 - "{{ nexus_domain }}" 58 nginx_sites: 59 - nexus-http.conf 60 - nexus-nginx.conf 61 62 - name: Enable Taler nexus HTTP reverse proxy configuration 63 ansible.builtin.file: 64 src: /etc/nginx/sites-available/nexus-http.conf 65 dest: /etc/nginx/sites-enabled/nexus-http.conf 66 state: link 67 notify: Restart nginx 68 69 - name: Enable Taler nexus reverse proxy configuration 70 ansible.builtin.file: 71 src: /etc/nginx/sites-available/nexus-nginx.conf 72 dest: /etc/nginx/sites-enabled/nexus-nginx.conf 73 state: link 74 notify: Restart nginx 75 76 - name: Ensure Ansible facts directory dir exists 77 file: 78 path: "/etc/ansible/facts.d/" 79 state: directory 80 mode: "0700" 81 owner: root 82 group: root 83 84 - name: Libeufin-nexus access secret setup 85 ansible.builtin.command: 86 argv: 87 - setup-secret-fact 88 - /etc/ansible/facts.d/libeufin-nexus-access-token.fact 89 - "secret-token:" 90 creates: /etc/ansible/facts.d/libeufin-nexus-access-token.fact 91 92 - name: Libeufin-nexus force ansible to regather just created fact(s) 93 ansible.builtin.setup: 94 95 # FIXME: 96 # Once the libeufin package has the proper config structure, 97 # use a secrets include instead. 98 99 - name: Place libeufin-nexus config 100 ansible.builtin.template: 101 src: templates/etc/libeufin/libeufin-nexus.conf.j2 102 dest: "/etc/libeufin/libeufin-nexus.conf" 103 owner: libeufin-nexus 104 group: libeufin-nexus 105 mode: "0444" 106 107 - name: Place libeufin-nexus EBICS config 108 ansible.builtin.template: 109 src: templates/etc/libeufin/libeufin-nexus-ebics.conf.j2 110 dest: "/etc/libeufin/libeufin-nexus-ebics.conf" 111 owner: libeufin-nexus 112 group: libeufin-nexus 113 mode: "0400" 114 when: use_ebics or configure_ebics 115 116 - name: Place wire gateway secret config 117 ansible.builtin.template: 118 src: templates/etc/libeufin/wire-gateway.secret.conf.j2 119 dest: "/etc/libeufin/wire-gateway.secret.conf" 120 owner: libeufin-nexus 121 group: libeufin-nexus 122 mode: "0400" 123 when: use_ebics or configure_ebics 124 125 - name: Setup libeufin database 126 ansible.builtin.command: 127 cmd: libeufin-dbconfig --only-nexus 128 chdir: /tmp 129 130 - name: Show vars 131 ansible.builtin.setup: 132 133 - name: Check if EBICS client keys exist. 134 stat: 135 path: /var/lib/libeufin-nexus/client-ebics-keys.json 136 register: stat_result 137 138 - name: Fail if external client keys are missing. 139 fail: 140 msg: External EBICS client keys missing 141 when: ebics_keys_external and not stat_result.stat.exists 142 143 - name: Adjust EBICS client keys permissions 144 file: 145 path: "/var/lib/libeufin-nexus/client-ebics-keys.json" 146 state: file 147 mode: "0400" 148 owner: libeufin-nexus 149 group: libeufin-nexus 150 when: ebics_keys_external and stat_result.stat.exists 151 152 - name: Check if EBICS bank keys exist. 153 stat: 154 path: /var/lib/libeufin-nexus/bank-ebics-keys.json 155 register: stat_result 156 157 - name: Fail if external bank keys are missing. 158 fail: 159 msg: External EBICS bank keys missing 160 when: ebics_keys_external and not stat_result.stat.exists 161 162 - name: Adjust EBICS client keys permissions 163 file: 164 path: "/var/lib/libeufin-nexus/bank-ebics-keys.json" 165 state: file 166 mode: "0400" 167 owner: libeufin-nexus 168 group: libeufin-nexus 169 when: ebics_keys_external and stat_result.stat.exists 170 171 # FIXME: this step currently fails with pofi, seems command wants 172 # extra arguments to do PDF letter generation? 173 - name: EBICS setup 174 become: true 175 become_user: libeufin-nexus 176 ansible.builtin.command: 177 cmd: libeufin-nexus ebics-setup 178 when: use_ebics 179 180 - name: Ensure libeufin-nexus target is enabled and started 181 service: 182 daemon_reload: true 183 name: libeufin-nexus.target 184 state: started 185 enabled: true 186 when: use_ebics 187 188 - name: Ensure libeufin-nexus-httpd service is enabled and started 189 service: 190 daemon_reload: true 191 name: libeufin-nexus-httpd.service 192 state: started 193 enabled: true 194 195 - name: Place login script for libeufin-nexus-import technical user 196 ansible.builtin.copy: 197 src: usr/local/bin/libeufin-nexus-import.sh 198 dest: "/usr/local/bin/libeufin-nexus-import.sh" 199 owner: root 200 group: root 201 mode: "0755" 202 when: not use_ebics 203 204 - name: Place login script for libeufin-nexus-export technical user 205 ansible.builtin.copy: 206 src: usr/local/bin/libeufin-nexus-export.sh 207 dest: "/usr/local/bin/libeufin-nexus-export.sh" 208 owner: root 209 group: root 210 mode: "0755" 211 when: not use_ebics 212 213 - name: Ensure group for libeufin-nexus-import exists 214 group: 215 name: libeufin-nexus-import 216 when: not use_ebics 217 218 - name: Ensure group for libeufin-nexus-export exists 219 group: 220 name: libeufin-nexus-export 221 when: not use_ebics 222 223 - name: Ensure technical user for libeufin-nexus import exists 224 user: 225 name: libeufin-nexus-import 226 group: libeufin-nexus-import 227 shell: /usr/local/bin/libeufin-nexus-import.sh 228 password: "!" 229 when: not use_ebics 230 231 - name: Ensure technical user for libeufin-nexus export exists 232 user: 233 name: libeufin-nexus-export 234 group: libeufin-nexus-export 235 shell: /usr/local/bin/libeufin-nexus-export.sh 236 password: "!" 237 when: not use_ebics 238 239 - name: Grant sudo rights to login script for importer 240 ansible.builtin.copy: 241 src: etc/sudoers.d/libeufin-nexus-import 242 dest: "/etc/sudoers.d/libeufin-nexus-import" 243 owner: root 244 group: root 245 mode: "0644" 246 when: not use_ebics 247 248 - name: Grant sudo rights to login script for exporter 249 ansible.builtin.copy: 250 src: etc/sudoers.d/libeufin-nexus-export 251 dest: "/etc/sudoers.d/libeufin-nexus-export" 252 owner: root 253 group: root 254 mode: "0644" 255 when: not use_ebics 256 257 - name: Ensure .ssh dir exists for libeufin-nexus-import user 258 file: 259 path: "/home/libeufin-nexus-import/.ssh/" 260 state: directory 261 owner: libeufin-nexus-import 262 group: libeufin-nexus-import 263 mode: "0755" 264 when: not use_ebics 265 266 - name: Ensure .ssh dir exists for libeufin-nexus-export user 267 file: 268 path: "/home/libeufin-nexus-export/.ssh/" 269 state: directory 270 owner: libeufin-nexus-export 271 group: libeufin-nexus-export 272 mode: "0755" 273 when: not use_ebics 274 275 - name: Allow technical users access to import acocunt. 276 ansible.builtin.copy: 277 src: home/libeufin-nexus-import/.ssh/authorized_keys 278 dest: "/home/libeufin-nexus-import/.ssh/authorized_keys" 279 owner: libeufin-nexus-import 280 group: libeufin-nexus-import 281 mode: "0644" 282 when: not use_ebics 283 284 - name: Allow technical users access to export acocunt. 285 ansible.builtin.copy: 286 src: home/libeufin-nexus-export/.ssh/authorized_keys 287 dest: "/home/libeufin-nexus-export/.ssh/authorized_keys" 288 owner: libeufin-nexus-export 289 group: libeufin-nexus-export 290 mode: "0644" 291 when: not use_ebics