main.yml (8120B)
1 --- 2 - name: Get the list of services 3 service_facts: 4 5 - name: Ensure libeufin-nexus service is stopped before we upgrade 6 systemd: 7 name: libeufin-nexus.target 8 state: stopped 9 enabled: false 10 when: '"libeufin-nexus.target" in ansible_facts["services"]' 11 12 - name: Ensure libeufin-nexus-httpd service is stopped before we upgrade 13 service: 14 name: libeufin-nexus-httpd.service 15 state: stopped 16 enabled: false 17 when: '"libeufin-nexus-httpd.service" in ansible_facts["services"]' 18 19 - name: Install libeufin-nexus package 20 apt: 21 name: 22 - libeufin-nexus 23 state: latest 24 when: ansible_facts["os_family"] == 'Debian' 25 26 - name: Ensure libeufin config dir exists from installation 27 file: 28 path: "/etc/libeufin" 29 state: directory 30 mode: "0755" 31 owner: root 32 group: root 33 34 - name: Ensure nexus virtualhost configuration file exists 35 ansible.builtin.template: 36 src: templates/etc/nginx/sites-available/nexus-nginx.conf.j2 37 dest: /etc/nginx/sites-available/nexus-nginx.conf 38 owner: root 39 group: root 40 mode: "0644" 41 42 - name: Ensure nexus HTTP virtualhost configuration file exists 43 ansible.builtin.template: 44 src: templates/etc/nginx/sites-available/nexus-http.conf.j2 45 dest: /etc/nginx/sites-available/nexus-http.conf 46 owner: root 47 group: root 48 mode: "0644" 49 50 - name: Secure the libeufin with Letsencrypt 51 when: nexus_use_letsencrypt 52 ansible.builtin.include_role: 53 name: cert 54 vars: 55 cert_name: nexus 56 wanted_cert_domains: 57 - "{{ nexus_domain }}" 58 nginx_sites: 59 - nexus-http.conf 60 - nexus-nginx.conf 61 62 - name: Enable Taler nexus HTTP reverse proxy configuration 63 ansible.builtin.file: 64 src: /etc/nginx/sites-available/nexus-http.conf 65 dest: /etc/nginx/sites-enabled/nexus-http.conf 66 state: link 67 notify: Restart nginx 68 69 - name: Enable Taler nexus reverse proxy configuration 70 ansible.builtin.file: 71 src: /etc/nginx/sites-available/nexus-nginx.conf 72 dest: /etc/nginx/sites-enabled/nexus-nginx.conf 73 state: link 74 notify: Restart nginx 75 76 - name: Ensure Ansible facts directory dir exists 77 file: 78 path: "/etc/ansible/facts.d/" 79 state: directory 80 mode: "0700" 81 owner: root 82 group: root 83 84 - name: Libeufin-nexus access secret setup 85 ansible.builtin.command: 86 argv: 87 - setup-secret-fact 88 - /etc/ansible/facts.d/libeufin-nexus-access-token.fact 89 - "secret-token:" 90 creates: /etc/ansible/facts.d/libeufin-nexus-access-token.fact 91 92 - name: Libeufin-nexus force ansible to regather just created fact(s) 93 ansible.builtin.setup: 94 95 # FIXME: 96 # Once the libeufin package has the proper config structure, 97 # use a secrets include instead. 98 99 - name: Place libeufin-nexus config 100 ansible.builtin.template: 101 src: templates/etc/libeufin/libeufin-nexus.conf.j2 102 dest: "/etc/libeufin/libeufin-nexus.conf" 103 owner: libeufin-nexus 104 group: libeufin-nexus 105 mode: "0444" 106 107 - name: Place libeufin-nexus EBICS config 108 ansible.builtin.template: 109 src: templates/etc/libeufin/libeufin-nexus-ebics.conf.j2 110 dest: "/etc/libeufin/libeufin-nexus-ebics.conf" 111 owner: libeufin-nexus 112 group: libeufin-nexus 113 mode: "0400" 114 when: use_ebics or configure_ebics 115 116 - name: Place wire gateway secret config 117 ansible.builtin.template: 118 src: templates/etc/libeufin/wire-gateway.secret.conf.j2 119 dest: "/etc/libeufin/wire-gateway.secret.conf" 120 owner: libeufin-nexus 121 group: libeufin-nexus 122 mode: "0400" 123 124 - name: Setup libeufin database 125 ansible.builtin.command: 126 cmd: libeufin-dbconfig --only-nexus 127 chdir: /tmp 128 129 - name: Show vars 130 ansible.builtin.setup: 131 132 - name: Check if EBICS client keys exist. 133 stat: 134 path: /var/lib/libeufin-nexus/client-ebics-keys.json 135 register: stat_result 136 137 - name: Fail if external client keys are missing. 138 fail: 139 msg: External EBICS client keys missing 140 when: ebics_keys_external and not stat_result.stat.exists 141 142 - name: Adjust EBICS client keys permissions 143 file: 144 path: "/var/lib/libeufin-nexus/client-ebics-keys.json" 145 state: file 146 mode: "0400" 147 owner: libeufin-nexus 148 group: libeufin-nexus 149 when: ebics_keys_external and stat_result.stat.exists 150 151 - name: Check if EBICS bank keys exist. 152 stat: 153 path: /var/lib/libeufin-nexus/bank-ebics-keys.json 154 register: stat_result 155 156 - name: Fail if external bank keys are missing. 157 fail: 158 msg: External EBICS bank keys missing 159 when: ebics_keys_external and not stat_result.stat.exists 160 161 - name: Adjust EBICS client keys permissions 162 file: 163 path: "/var/lib/libeufin-nexus/bank-ebics-keys.json" 164 state: file 165 mode: "0400" 166 owner: libeufin-nexus 167 group: libeufin-nexus 168 when: ebics_keys_external and stat_result.stat.exists 169 170 # FIXME: this step currently fails with pofi, seems command wants 171 # extra arguments to do PDF letter generation? 172 - name: EBICS setup 173 become: true 174 become_user: libeufin-nexus 175 ansible.builtin.command: 176 cmd: libeufin-nexus ebics-setup 177 when: use_ebics 178 179 - name: Ensure libeufin-nexus target is enabled and started 180 service: 181 daemon_reload: true 182 name: libeufin-nexus.target 183 state: started 184 enabled: true 185 when: use_ebics 186 187 - name: Ensure libeufin-nexus-httpd service is enabled and started 188 service: 189 daemon_reload: true 190 name: libeufin-nexus-httpd.service 191 state: started 192 enabled: true 193 194 - name: Place login script for libeufin-nexus-import technical user 195 ansible.builtin.copy: 196 src: usr/local/bin/libeufin-nexus-import.sh 197 dest: "/usr/local/bin/libeufin-nexus-import.sh" 198 owner: root 199 group: root 200 mode: "0755" 201 when: not use_ebics 202 203 - name: Place login script for libeufin-nexus-export technical user 204 ansible.builtin.copy: 205 src: usr/local/bin/libeufin-nexus-export.sh 206 dest: "/usr/local/bin/libeufin-nexus-export.sh" 207 owner: root 208 group: root 209 mode: "0755" 210 when: not use_ebics 211 212 - name: Ensure group for libeufin-nexus-import exists 213 group: 214 name: libeufin-nexus-import 215 when: not use_ebics 216 217 - name: Ensure group for libeufin-nexus-export exists 218 group: 219 name: libeufin-nexus-export 220 when: not use_ebics 221 222 - name: Ensure technical user for libeufin-nexus import exists 223 user: 224 name: libeufin-nexus-import 225 group: libeufin-nexus-import 226 shell: /usr/local/bin/libeufin-nexus-import.sh 227 password: "!" 228 when: not use_ebics 229 230 - name: Ensure technical user for libeufin-nexus export exists 231 user: 232 name: libeufin-nexus-export 233 group: libeufin-nexus-export 234 shell: /usr/local/bin/libeufin-nexus-export.sh 235 password: "!" 236 when: not use_ebics 237 238 - name: Grant sudo rights to login script for importer 239 ansible.builtin.copy: 240 src: etc/sudoers.d/libeufin-nexus-import 241 dest: "/etc/sudoers.d/libeufin-nexus-import" 242 owner: root 243 group: root 244 mode: "0644" 245 when: not use_ebics 246 247 - name: Grant sudo rights to login script for exporter 248 ansible.builtin.copy: 249 src: etc/sudoers.d/libeufin-nexus-export 250 dest: "/etc/sudoers.d/libeufin-nexus-export" 251 owner: root 252 group: root 253 mode: "0644" 254 when: not use_ebics 255 256 - name: Ensure .ssh dir exists for libeufin-nexus-import user 257 file: 258 path: "/home/libeufin-nexus-import/.ssh/" 259 state: directory 260 owner: libeufin-nexus-import 261 group: libeufin-nexus-import 262 mode: "0755" 263 when: not use_ebics 264 265 - name: Ensure .ssh dir exists for libeufin-nexus-export user 266 file: 267 path: "/home/libeufin-nexus-export/.ssh/" 268 state: directory 269 owner: libeufin-nexus-export 270 group: libeufin-nexus-export 271 mode: "0755" 272 when: not use_ebics 273 274 - name: Allow technical users access to import acocunt. 275 ansible.builtin.copy: 276 src: home/libeufin-nexus-import/.ssh/authorized_keys 277 dest: "/home/libeufin-nexus-import/.ssh/authorized_keys" 278 owner: libeufin-nexus-import 279 group: libeufin-nexus-import 280 mode: "0644" 281 when: not use_ebics 282 283 - name: Allow technical users access to export acocunt. 284 ansible.builtin.copy: 285 src: home/libeufin-nexus-export/.ssh/authorized_keys 286 dest: "/home/libeufin-nexus-export/.ssh/authorized_keys" 287 owner: libeufin-nexus-export 288 group: libeufin-nexus-export 289 mode: "0644" 290 when: not use_ebics