dangerously-reset-exchange.yml (5861B)
1 --- 2 - name: Require a testing deployment for exchange reset 3 ansible.builtin.assert: 4 that: 5 - regional_currency_testing_deployment | bool 6 fail_msg: >- 7 Refusing to reset the exchange because this inventory is not marked as a 8 testing deployment. 9 10 - name: Read the configured exchange database 11 ansible.builtin.command: 12 argv: 13 - taler-exchange-config 14 - -s 15 - exchangedb-postgres 16 - -o 17 - CONFIG 18 register: regional_currency_exchange_reset_database 19 changed_when: false 20 21 - name: Read the configured offline key paths 22 become: true 23 become_user: taler-exchange-offline 24 ansible.builtin.command: 25 argv: 26 - taler-exchange-config 27 - -s 28 - exchange-offline 29 - -f 30 - -o 31 - "{{ item.option }}" 32 loop: 33 - option: MASTER_PRIV_FILE 34 expected: /home/taler-exchange-offline/.local/share/taler/exchange/offline-keys/master.priv 35 - option: SECM_TOFU_FILE 36 expected: /home/taler-exchange-offline/.local/share/taler/exchange/offline-keys/secm_tofus.pub 37 register: regional_currency_exchange_reset_offline_paths 38 changed_when: false 39 40 - name: Read the configured online key paths 41 ansible.builtin.command: 42 argv: 43 - taler-exchange-config 44 - -s 45 - "{{ item.section }}" 46 - -f 47 - -o 48 - "{{ item.option }}" 49 loop: 50 - section: taler-exchange-secmod-rsa 51 option: KEY_DIR 52 expected: /var/lib/taler-exchange/secmod-rsa/keys 53 - section: taler-exchange-secmod-rsa 54 option: SM_PRIV_KEY 55 expected: /var/lib/taler-exchange/secmod-rsa/secmod-private-key 56 - section: taler-exchange-secmod-cs 57 option: KEY_DIR 58 expected: /var/lib/taler-exchange/secmod-cs/keys 59 - section: taler-exchange-secmod-cs 60 option: SM_PRIV_KEY 61 expected: /var/lib/taler-exchange/secmod-cs/secmod-private-key 62 - section: taler-exchange-secmod-eddsa 63 option: KEY_DIR 64 expected: /var/lib/taler-exchange/secmod-eddsa/keys 65 - section: taler-exchange-secmod-eddsa 66 option: SM_PRIV_KEY 67 expected: /var/lib/taler-exchange/secmod-eddsa/secmod-private-key 68 register: regional_currency_exchange_reset_online_paths 69 changed_when: false 70 71 - name: Validate the exchange database reset target 72 ansible.builtin.assert: 73 that: 74 - (regional_currency_exchange_reset_database.stdout | trim) == "postgres:///exchange" 75 fail_msg: >- 76 Refusing to reset an exchange database outside the role-managed 77 postgres:///exchange configuration. 78 79 - name: Validate the offline key reset targets 80 ansible.builtin.assert: 81 that: 82 - (item.stdout | trim) == item.item.expected 83 fail_msg: >- 84 Refusing to delete unexpected offline key path {{ item.stdout | trim }}. 85 loop: "{{ regional_currency_exchange_reset_offline_paths.results }}" 86 loop_control: 87 label: "{{ item.item.option }}" 88 89 - name: Validate the online key reset targets 90 ansible.builtin.assert: 91 that: 92 - (item.stdout | trim) == item.item.expected 93 fail_msg: >- 94 Refusing to delete unexpected online key path {{ item.stdout | trim }}. 95 loop: "{{ regional_currency_exchange_reset_online_paths.results }}" 96 loop_control: 97 label: "{{ item.item.section }} {{ item.item.option }}" 98 99 - name: Confirm the destructive exchange reset 100 ansible.builtin.pause: 101 prompt: >- 102 This permanently deletes the exchange database, all exchange keys, and 103 all existing coins and reserves. Type 104 "DANGEROUSLY RESET EXCHANGE {{ regional_currency_domain }}" to continue 105 echo: true 106 register: regional_currency_exchange_reset_confirmation 107 108 - name: Require the exact exchange reset confirmation 109 ansible.builtin.assert: 110 that: 111 - >- 112 regional_currency_exchange_reset_confirmation.user_input 113 == "DANGEROUSLY RESET EXCHANGE " ~ regional_currency_domain 114 fail_msg: Exchange reset cancelled because the confirmation did not match. 115 116 - name: Disable and stop exchange offline maintenance 117 ansible.builtin.systemd_service: 118 name: taler-exchange-offline.timer 119 enabled: false 120 state: stopped 121 122 - name: Stop exchange offline maintenance 123 ansible.builtin.systemd_service: 124 name: taler-exchange-offline.service 125 state: stopped 126 127 - name: Stop the merchant during exchange reset 128 ansible.builtin.systemd_service: 129 name: taler-merchant.target 130 state: stopped 131 132 - name: Stop the exchange 133 ansible.builtin.systemd_service: 134 name: taler-exchange.target 135 state: stopped 136 137 - name: Drop the exchange database 138 become: true 139 become_user: postgres 140 ansible.builtin.command: 141 argv: 142 - dropdb 143 - --if-exists 144 - --force 145 - exchange 146 changed_when: true 147 148 - name: Delete offline exchange key material 149 ansible.builtin.file: 150 path: "{{ item.stdout | trim }}" 151 state: absent 152 loop: "{{ regional_currency_exchange_reset_offline_paths.results }}" 153 loop_control: 154 label: "{{ item.item.option }}" 155 156 - name: Delete online exchange key material 157 ansible.builtin.file: 158 path: "{{ item.stdout | trim }}" 159 state: absent 160 loop: "{{ regional_currency_exchange_reset_online_paths.results }}" 161 loop_control: 162 label: "{{ item.item.section }} {{ item.item.option }}" 163 164 - name: Delete generated exchange configuration 165 ansible.builtin.file: 166 path: "{{ item }}" 167 state: absent 168 loop: 169 - /etc/taler-exchange/conf.d/setup.conf 170 - "/etc/taler-exchange/conf.d/{{ regional_currency_currency }}-coins.conf" 171 - /etc/taler-merchant/conf.d/setup.conf 172 173 - name: Delete exchange provisioning markers 174 ansible.builtin.file: 175 path: "{{ item }}" 176 state: absent 177 loop: 178 - "{{ regional_currency_state_directory }}/exchange-account-setup" 179 - "{{ regional_currency_state_directory }}/conversion-account-setup" 180 - "{{ regional_currency_state_directory }}/exchange-signed-coin-config" 181 - /var/lib/taler-exchange-offline-maintenance/fee-year