main.yml (8074B)
1 --- 2 - name: Get the list of services 3 service_facts: 4 5 - name: Ensure libeufin-nexus service is stopped before we upgrade 6 systemd: 7 name: libeufin-nexus.target 8 state: stopped 9 enabled: false 10 when: '"libeufin-nexus.target" in ansible_facts["services"]' 11 12 - name: Ensure libeufin-nexus-httpd service is stopped before we upgrade 13 service: 14 name: libeufin-nexus-httpd.service 15 state: stopped 16 enabled: false 17 when: '"libeufin-nexus-httpd.service" in ansible_facts["services"]' 18 19 - name: Install libeufin-nexus package 20 apt: 21 name: 22 - libeufin-nexus 23 state: latest 24 when: ansible_facts["os_family"] == 'Debian' 25 26 - name: Ensure libeufin config dir exists from installation 27 file: 28 path: "/etc/libeufin" 29 state: directory 30 mode: "0755" 31 owner: root 32 group: root 33 34 - name: Ensure nexus virtualhost configuration file exists 35 ansible.builtin.template: 36 src: templates/etc/nginx/sites-available/nexus-nginx.conf.j2 37 dest: /etc/nginx/sites-available/nexus-nginx.conf 38 owner: root 39 group: root 40 mode: "0644" 41 42 - name: Ensure nexus HTTP virtualhost configuration file exists 43 ansible.builtin.template: 44 src: templates/etc/nginx/sites-available/nexus-http.conf.j2 45 dest: /etc/nginx/sites-available/nexus-http.conf 46 owner: root 47 group: root 48 mode: "0644" 49 50 - name: Secure the libeufin with Letsencrypt 51 when: nexus_use_letsencrypt 52 ansible.builtin.include_role: 53 name: cert 54 vars: 55 cert_name: nexus 56 wanted_cert_domains: 57 - "{{ nexus_domain }}" 58 nginx_sites: 59 - nexus-http.conf 60 - nexus-nginx.conf 61 62 - name: Enable Taler nexus HTTP reverse proxy configuration 63 ansible.builtin.file: 64 src: /etc/nginx/sites-available/nexus-http.conf 65 dest: /etc/nginx/sites-enabled/nexus-http.conf 66 state: link 67 notify: Restart nginx 68 69 - name: Enable Taler nexus reverse proxy configuration 70 ansible.builtin.file: 71 src: /etc/nginx/sites-available/nexus-nginx.conf 72 dest: /etc/nginx/sites-enabled/nexus-nginx.conf 73 state: link 74 notify: Restart nginx 75 76 - name: Ensure Ansible facts directory dir exists 77 file: 78 path: "/etc/ansible/facts.d/" 79 state: directory 80 mode: "0700" 81 owner: root 82 group: root 83 84 - name: Libeufin-nexus access secret setup 85 ansible.builtin.command: 86 argv: 87 - setup-secret-fact 88 - /etc/ansible/facts.d/libeufin-nexus-access-token.fact 89 - "secret-token:" 90 creates: /etc/ansible/facts.d/libeufin-nexus-access-token.fact 91 92 - name: Libeufin-nexus force ansible to regather just created fact(s) 93 ansible.builtin.setup: 94 95 # FIXME: 96 # Once the libeufin package has the proper config structure, 97 # use a secrets include instead. 98 99 - name: Place libeufin-nexus config 100 ansible.builtin.template: 101 src: templates/etc/libeufin/libeufin-nexus.conf.j2 102 dest: "/etc/libeufin/libeufin-nexus.conf" 103 owner: libeufin-nexus 104 group: libeufin-nexus 105 mode: "0444" 106 107 - name: Place libeufin-nexus EBICS config 108 ansible.builtin.template: 109 src: templates/etc/libeufin/libeufin-nexus-ebics.conf.j2 110 dest: "/etc/libeufin/libeufin-nexus-ebics.conf" 111 owner: libeufin-nexus 112 group: libeufin-nexus 113 mode: "0400" 114 when: use_ebics or configure_ebics 115 116 - name: Place wire gateway secret config 117 ansible.builtin.template: 118 src: templates/etc/libeufin/wire-gateway.secret.conf.j2 119 dest: "/etc/libeufin/wire-gateway.secret.conf" 120 owner: libeufin-nexus 121 group: libeufin-nexus 122 mode: "0400" 123 124 - name: Setup libeufin database 125 ansible.builtin.command: 126 cmd: libeufin-dbconfig --only-nexus 127 chdir: /tmp 128 129 - name: Check if EBICS client keys exist. 130 stat: 131 path: /var/lib/libeufin-nexus/client-ebics-keys.json 132 register: stat_result 133 134 - name: Fail if external client keys are missing. 135 fail: 136 msg: External EBICS client keys missing 137 when: ebics_keys_external and not stat_result.stat.exists 138 139 - name: Adjust EBICS client keys permissions 140 file: 141 path: "/var/lib/libeufin-nexus/client-ebics-keys.json" 142 state: file 143 mode: "0400" 144 owner: libeufin-nexus 145 group: libeufin-nexus 146 when: ebics_keys_external and stat_result.stat.exists 147 148 - name: Check if EBICS bank keys exist. 149 stat: 150 path: /var/lib/libeufin-nexus/bank-ebics-keys.json 151 register: stat_result 152 153 - name: Fail if external bank keys are missing. 154 fail: 155 msg: External EBICS bank keys missing 156 when: ebics_keys_external and not stat_result.stat.exists 157 158 - name: Adjust EBICS bank keys permissions 159 file: 160 path: "/var/lib/libeufin-nexus/bank-ebics-keys.json" 161 state: file 162 mode: "0400" 163 owner: libeufin-nexus 164 group: libeufin-nexus 165 when: ebics_keys_external and stat_result.stat.exists 166 167 # FIXME: this step currently fails with pofi, seems command wants 168 # extra arguments to do PDF letter generation? 169 - name: EBICS setup 170 become: true 171 become_user: libeufin-nexus 172 ansible.builtin.command: 173 cmd: libeufin-nexus ebics-setup 174 when: use_ebics 175 176 - name: Ensure libeufin-nexus target is enabled and started 177 service: 178 daemon_reload: true 179 name: libeufin-nexus.target 180 state: started 181 enabled: true 182 when: use_ebics 183 184 - name: Ensure libeufin-nexus-httpd service is enabled and started 185 service: 186 daemon_reload: true 187 name: libeufin-nexus-httpd.service 188 state: started 189 enabled: true 190 191 - name: Place login script for libeufin-nexus-import technical user 192 ansible.builtin.copy: 193 src: usr/local/bin/libeufin-nexus-import.sh 194 dest: "/usr/local/bin/libeufin-nexus-import.sh" 195 owner: root 196 group: root 197 mode: "0755" 198 when: not use_ebics 199 200 - name: Place login script for libeufin-nexus-export technical user 201 ansible.builtin.copy: 202 src: usr/local/bin/libeufin-nexus-export.sh 203 dest: "/usr/local/bin/libeufin-nexus-export.sh" 204 owner: root 205 group: root 206 mode: "0755" 207 when: not use_ebics 208 209 - name: Ensure group for libeufin-nexus-import exists 210 group: 211 name: libeufin-nexus-import 212 when: not use_ebics 213 214 - name: Ensure group for libeufin-nexus-export exists 215 group: 216 name: libeufin-nexus-export 217 when: not use_ebics 218 219 - name: Ensure technical user for libeufin-nexus import exists 220 user: 221 name: libeufin-nexus-import 222 group: libeufin-nexus-import 223 shell: /usr/local/bin/libeufin-nexus-import.sh 224 password: "!" 225 when: not use_ebics 226 227 - name: Ensure technical user for libeufin-nexus export exists 228 user: 229 name: libeufin-nexus-export 230 group: libeufin-nexus-export 231 shell: /usr/local/bin/libeufin-nexus-export.sh 232 password: "!" 233 when: not use_ebics 234 235 - name: Grant sudo rights to login script for importer 236 ansible.builtin.copy: 237 src: etc/sudoers.d/libeufin-nexus-import 238 dest: "/etc/sudoers.d/libeufin-nexus-import" 239 owner: root 240 group: root 241 mode: "0644" 242 when: not use_ebics 243 244 - name: Grant sudo rights to login script for exporter 245 ansible.builtin.copy: 246 src: etc/sudoers.d/libeufin-nexus-export 247 dest: "/etc/sudoers.d/libeufin-nexus-export" 248 owner: root 249 group: root 250 mode: "0644" 251 when: not use_ebics 252 253 - name: Ensure .ssh dir exists for libeufin-nexus-import user 254 file: 255 path: "/home/libeufin-nexus-import/.ssh/" 256 state: directory 257 owner: libeufin-nexus-import 258 group: libeufin-nexus-import 259 mode: "0755" 260 when: not use_ebics 261 262 - name: Ensure .ssh dir exists for libeufin-nexus-export user 263 file: 264 path: "/home/libeufin-nexus-export/.ssh/" 265 state: directory 266 owner: libeufin-nexus-export 267 group: libeufin-nexus-export 268 mode: "0755" 269 when: not use_ebics 270 271 - name: Allow technical users access to import account. 272 ansible.builtin.copy: 273 src: home/libeufin-nexus-import/.ssh/authorized_keys 274 dest: "/home/libeufin-nexus-import/.ssh/authorized_keys" 275 owner: libeufin-nexus-import 276 group: libeufin-nexus-import 277 mode: "0644" 278 when: not use_ebics 279 280 - name: Allow technical users access to export account. 281 ansible.builtin.copy: 282 src: home/libeufin-nexus-export/.ssh/authorized_keys 283 dest: "/home/libeufin-nexus-export/.ssh/authorized_keys" 284 owner: libeufin-nexus-export 285 group: libeufin-nexus-export 286 mode: "0644" 287 when: not use_ebics