main.yml (7273B)
1 --- 2 - name: Get the list of services 3 service_facts: 4 5 - name: Install libeufin-nexus package 6 apt: 7 policy_rc_d: 101 8 name: 9 - libeufin-nexus 10 state: latest 11 when: ansible_facts["os_family"] == 'Debian' 12 13 - name: Ensure libeufin config dir exists from installation 14 file: 15 path: "/etc/libeufin" 16 state: directory 17 mode: "0755" 18 owner: root 19 group: root 20 21 - name: Ensure nexus virtualhost configuration file exists 22 ansible.builtin.template: 23 src: templates/etc/nginx/sites-available/nexus-nginx.conf.j2 24 dest: /etc/nginx/sites-available/nexus-nginx.conf 25 owner: root 26 group: root 27 mode: "0644" 28 29 - name: Ensure nexus HTTP virtualhost configuration file exists 30 ansible.builtin.template: 31 src: templates/etc/nginx/sites-available/nexus-http.conf.j2 32 dest: /etc/nginx/sites-available/nexus-http.conf 33 owner: root 34 group: root 35 mode: "0644" 36 37 - name: Secure the libeufin with Letsencrypt 38 when: nexus_use_letsencrypt 39 ansible.builtin.include_role: 40 name: cert 41 vars: 42 cert_name: nexus 43 wanted_cert_domains: 44 - "{{ nexus_domain }}" 45 nginx_sites: 46 - nexus-http.conf 47 - nexus-nginx.conf 48 49 - name: Enable Taler nexus HTTP reverse proxy configuration 50 ansible.builtin.file: 51 src: /etc/nginx/sites-available/nexus-http.conf 52 dest: /etc/nginx/sites-enabled/nexus-http.conf 53 state: link 54 notify: Restart nginx 55 56 - name: Enable Taler nexus reverse proxy configuration 57 ansible.builtin.file: 58 src: /etc/nginx/sites-available/nexus-nginx.conf 59 dest: /etc/nginx/sites-enabled/nexus-nginx.conf 60 state: link 61 notify: Restart nginx 62 63 - name: Ensure Ansible facts directory dir exists 64 file: 65 path: "/etc/ansible/facts.d/" 66 state: directory 67 mode: "0700" 68 owner: root 69 group: root 70 71 - name: Libeufin-nexus access secret setup 72 ansible.builtin.command: 73 argv: 74 - setup-secret-fact 75 - /etc/ansible/facts.d/libeufin-nexus-access-token.fact 76 - "secret-token:" 77 creates: /etc/ansible/facts.d/libeufin-nexus-access-token.fact 78 no_log: true 79 80 - name: Libeufin-nexus force ansible to regather just created fact(s) 81 ansible.builtin.setup: 82 no_log: true 83 84 - name: Place libeufin-nexus config 85 ansible.builtin.template: 86 src: templates/etc/libeufin/libeufin-nexus.conf.j2 87 dest: "/etc/libeufin/libeufin-nexus.conf" 88 owner: libeufin-nexus 89 group: libeufin-nexus 90 mode: "0444" 91 92 - name: Place libeufin-nexus EBICS config 93 ansible.builtin.template: 94 src: templates/etc/libeufin/libeufin-nexus-ebics.conf.j2 95 dest: "/etc/libeufin/libeufin-nexus-ebics.conf" 96 owner: libeufin-nexus 97 group: libeufin-nexus 98 mode: "0400" 99 when: use_ebics or configure_ebics 100 no_log: true 101 diff: false 102 103 - name: Place wire gateway secret config 104 ansible.builtin.template: 105 src: templates/etc/libeufin/wire-gateway.secret.conf.j2 106 dest: "/etc/libeufin/wire-gateway.secret.conf" 107 owner: libeufin-nexus 108 group: libeufin-nexus 109 mode: "0400" 110 no_log: true 111 diff: false 112 113 - name: Setup libeufin database 114 ansible.builtin.command: 115 cmd: libeufin-dbconfig --only-nexus 116 chdir: /tmp 117 118 - name: Check if EBICS client keys exist. 119 stat: 120 path: /var/lib/libeufin-nexus/client-ebics-keys.json 121 register: stat_result 122 123 - name: Fail if external client keys are missing. 124 fail: 125 msg: External EBICS client keys missing 126 when: ebics_keys_external and not stat_result.stat.exists 127 128 - name: Adjust EBICS client keys permissions 129 file: 130 path: "/var/lib/libeufin-nexus/client-ebics-keys.json" 131 state: file 132 mode: "0400" 133 owner: libeufin-nexus 134 group: libeufin-nexus 135 when: ebics_keys_external and stat_result.stat.exists 136 137 - name: Check if EBICS bank keys exist. 138 stat: 139 path: /var/lib/libeufin-nexus/bank-ebics-keys.json 140 register: stat_result 141 142 - name: Fail if external bank keys are missing. 143 fail: 144 msg: External EBICS bank keys missing 145 when: ebics_keys_external and not stat_result.stat.exists 146 147 - name: Adjust EBICS bank keys permissions 148 file: 149 path: "/var/lib/libeufin-nexus/bank-ebics-keys.json" 150 state: file 151 mode: "0400" 152 owner: libeufin-nexus 153 group: libeufin-nexus 154 when: ebics_keys_external and stat_result.stat.exists 155 156 # FIXME: this step currently fails with pofi, seems command wants 157 # extra arguments to do PDF letter generation? 158 - name: EBICS setup 159 become: true 160 become_user: libeufin-nexus 161 ansible.builtin.command: 162 cmd: libeufin-nexus ebics-setup 163 when: use_ebics 164 165 - name: Place login script for libeufin-nexus-import technical user 166 ansible.builtin.copy: 167 src: usr/local/bin/libeufin-nexus-import.sh 168 dest: "/usr/local/bin/libeufin-nexus-import.sh" 169 owner: root 170 group: root 171 mode: "0755" 172 when: not use_ebics 173 174 - name: Place login script for libeufin-nexus-export technical user 175 ansible.builtin.copy: 176 src: usr/local/bin/libeufin-nexus-export.sh 177 dest: "/usr/local/bin/libeufin-nexus-export.sh" 178 owner: root 179 group: root 180 mode: "0755" 181 when: not use_ebics 182 183 - name: Ensure group for libeufin-nexus-import exists 184 group: 185 name: libeufin-nexus-import 186 when: not use_ebics 187 188 - name: Ensure group for libeufin-nexus-export exists 189 group: 190 name: libeufin-nexus-export 191 when: not use_ebics 192 193 - name: Ensure technical user for libeufin-nexus import exists 194 user: 195 name: libeufin-nexus-import 196 group: libeufin-nexus-import 197 shell: /usr/local/bin/libeufin-nexus-import.sh 198 password: "!" 199 when: not use_ebics 200 201 - name: Ensure technical user for libeufin-nexus export exists 202 user: 203 name: libeufin-nexus-export 204 group: libeufin-nexus-export 205 shell: /usr/local/bin/libeufin-nexus-export.sh 206 password: "!" 207 when: not use_ebics 208 209 - name: Grant sudo rights to login script for importer 210 ansible.builtin.copy: 211 src: etc/sudoers.d/libeufin-nexus-import 212 dest: "/etc/sudoers.d/libeufin-nexus-import" 213 owner: root 214 group: root 215 mode: "0644" 216 when: not use_ebics 217 218 - name: Grant sudo rights to login script for exporter 219 ansible.builtin.copy: 220 src: etc/sudoers.d/libeufin-nexus-export 221 dest: "/etc/sudoers.d/libeufin-nexus-export" 222 owner: root 223 group: root 224 mode: "0644" 225 when: not use_ebics 226 227 - name: Ensure .ssh dir exists for libeufin-nexus-import user 228 file: 229 path: "/home/libeufin-nexus-import/.ssh/" 230 state: directory 231 owner: libeufin-nexus-import 232 group: libeufin-nexus-import 233 mode: "0755" 234 when: not use_ebics 235 236 - name: Ensure .ssh dir exists for libeufin-nexus-export user 237 file: 238 path: "/home/libeufin-nexus-export/.ssh/" 239 state: directory 240 owner: libeufin-nexus-export 241 group: libeufin-nexus-export 242 mode: "0755" 243 when: not use_ebics 244 245 - name: Allow technical users access to import account. 246 ansible.builtin.copy: 247 src: home/libeufin-nexus-import/.ssh/authorized_keys 248 dest: "/home/libeufin-nexus-import/.ssh/authorized_keys" 249 owner: libeufin-nexus-import 250 group: libeufin-nexus-import 251 mode: "0644" 252 when: not use_ebics 253 254 - name: Allow technical users access to export account. 255 ansible.builtin.copy: 256 src: home/libeufin-nexus-export/.ssh/authorized_keys 257 dest: "/home/libeufin-nexus-export/.ssh/authorized_keys" 258 owner: libeufin-nexus-export 259 group: libeufin-nexus-export 260 mode: "0644" 261 when: not use_ebics