exchange.yml (10889B)
1 --- 2 - name: Install offline exchange key configuration 3 ansible.builtin.template: 4 src: exchange-offline.conf.j2 5 dest: /etc/taler-exchange/conf.d/offline-setup.conf 6 owner: root 7 group: root 8 mode: "0644" 9 register: regional_currency_exchange_offline_config 10 11 - name: Install regional-currency exchange maintenance service 12 ansible.builtin.template: 13 src: taler-exchange-offline.service.j2 14 dest: /etc/systemd/system/taler-exchange-offline.service 15 owner: root 16 group: root 17 mode: "0644" 18 register: regional_currency_exchange_maintenance_service 19 notify: Reload systemd 20 21 - name: Install regional-currency exchange maintenance timer 22 ansible.builtin.template: 23 src: taler-exchange-offline.timer.j2 24 dest: /etc/systemd/system/taler-exchange-offline.timer 25 owner: root 26 group: root 27 mode: "0644" 28 notify: Reload systemd 29 30 - name: Create or read the exchange offline master key 31 become: true 32 become_user: taler-exchange-offline 33 ansible.builtin.command: 34 argv: 35 - taler-exchange-offline 36 - -LDEBUG 37 - setup 38 args: 39 chdir: / 40 register: regional_currency_exchange_master_key_command 41 changed_when: false 42 43 - name: Record the exchange master public key for this play 44 ansible.builtin.set_fact: 45 regional_currency_exchange_master_public_key: "{{ regional_currency_exchange_master_key_command.stdout | trim }}" 46 47 - name: Find stale optimized exchange SPA files 48 ansible.builtin.find: 49 paths: 50 - /usr/share/taler-exchange/aml-spa 51 - /usr/share/taler-exchange/kyc-spa 52 patterns: 53 - "*.gz" 54 - "*.zstd" 55 file_type: file 56 register: regional_currency_exchange_optimized_files 57 58 - name: Remove stale optimized exchange SPA files 59 ansible.builtin.file: 60 path: "{{ item.path }}" 61 state: absent 62 loop: "{{ regional_currency_exchange_optimized_files.files }}" 63 loop_control: 64 label: "{{ item.path }}" 65 66 - name: Generate exchange terms of service 67 ansible.builtin.command: 68 argv: 69 - taler-terms-generator 70 - -i 71 - "{{ regional_currency_exchange_terms_file }}" 72 when: regional_currency_enable_exchange_terms 73 changed_when: false 74 75 - name: Generate exchange privacy policy 76 ansible.builtin.command: 77 argv: 78 - taler-terms-generator 79 - -i 80 - "{{ regional_currency_exchange_privacy_file }}" 81 when: regional_currency_enable_exchange_privacy 82 changed_when: false 83 84 - name: Install exchange configuration 85 ansible.builtin.template: 86 src: exchange.conf.j2 87 dest: /etc/taler-exchange/conf.d/setup.conf 88 owner: root 89 group: root 90 mode: "0644" 91 register: regional_currency_exchange_config 92 93 - name: Install exchange database credentials 94 ansible.builtin.template: 95 src: exchange-db.secret.conf.j2 96 dest: /etc/taler-exchange/secrets/exchange-db.secret.conf 97 owner: root 98 group: taler-exchange-db 99 mode: "0440" 100 register: regional_currency_exchange_db_credentials 101 102 - name: Install exchange bank-account credentials 103 ansible.builtin.template: 104 src: exchange-account.secret.conf.j2 105 dest: /etc/taler-exchange/secrets/exchange-accountcredentials-default.secret.conf 106 owner: taler-exchange-wire 107 group: taler-exchange-db 108 mode: "0400" 109 register: regional_currency_exchange_account_credentials 110 no_log: true 111 112 - name: Check for an existing exchange coin configuration 113 ansible.builtin.stat: 114 path: "/etc/taler-exchange/conf.d/{{ regional_currency_currency }}-coins.conf" 115 register: regional_currency_exchange_coin_config_file 116 117 - name: Generate exchange coin configuration 118 ansible.builtin.command: 119 argv: 120 - taler-harness 121 - deployment 122 - gen-coin-config 123 - --min-amount 124 - "{{ regional_currency_currency }}:0.01" 125 - --max-amount 126 - "{{ regional_currency_currency }}:100" 127 register: regional_currency_generated_coin_config 128 args: 129 creates: "/etc/taler-exchange/conf.d/{{ regional_currency_currency }}-coins.conf" 130 when: not regional_currency_exchange_coin_config_file.stat.exists 131 132 - name: Install exchange coin configuration 133 ansible.builtin.copy: 134 content: >- 135 {{ regional_currency_generated_coin_config.stdout 136 | replace('FEE_DEPOSIT = ' ~ regional_currency_currency ~ ':0.01', 'FEE_DEPOSIT = ' ~ regional_currency_currency ~ ':0') 137 | regex_replace('(?m)^DURATION_WITHDRAW\\s*=.*$', 'DURATION_WITHDRAW = ' ~ regional_currency_coin_withdraw_duration) 138 | regex_replace('(?i)coin-', 'coin_') }} 139 dest: "/etc/taler-exchange/conf.d/{{ regional_currency_currency }}-coins.conf" 140 owner: root 141 group: root 142 mode: "0644" 143 register: regional_currency_exchange_coin_config 144 when: not regional_currency_exchange_coin_config_file.stat.exists 145 146 - name: Read the installed exchange coin configuration checksum 147 ansible.builtin.stat: 148 path: "/etc/taler-exchange/conf.d/{{ regional_currency_currency }}-coins.conf" 149 checksum_algorithm: sha256 150 register: regional_currency_exchange_coin_config_current 151 152 - name: Initialize or upgrade the exchange database 153 ansible.builtin.command: taler-exchange-dbconfig 154 args: 155 chdir: / 156 changed_when: false 157 158 - name: Enable and start the exchange 159 ansible.builtin.service: 160 name: taler-exchange.target 161 enabled: true 162 state: >- 163 {{ 'restarted' 164 if regional_currency_exchange_offline_config.changed 165 or regional_currency_exchange_config.changed 166 or regional_currency_exchange_db_credentials.changed 167 or regional_currency_exchange_account_credentials.changed 168 or (regional_currency_exchange_coin_config.changed | default(false)) 169 else 'started' }} 170 171 - name: Wait for the exchange configuration endpoint 172 ansible.builtin.uri: 173 url: "{{ regional_currency_exchange_base_url }}config" 174 status_code: 200 175 timeout: 5 176 register: regional_currency_exchange_config_ready 177 until: regional_currency_exchange_config_ready.status == 200 178 retries: 60 179 delay: 2 180 181 - name: Wait for exchange management keys 182 ansible.builtin.uri: 183 url: "{{ regional_currency_exchange_base_url }}management/keys" 184 status_code: 200 185 timeout: 5 186 register: regional_currency_exchange_management_ready 187 until: regional_currency_exchange_management_ready.status == 200 188 retries: 60 189 delay: 2 190 191 - name: Check whether initial offline exchange setup is complete 192 ansible.builtin.stat: 193 path: "{{ regional_currency_state_directory }}/exchange-account-setup" 194 register: regional_currency_exchange_account_setup 195 196 - name: Enable the exchange bank account 197 become: true 198 become_user: taler-exchange-offline 199 ansible.builtin.command: 200 argv: 201 - taler-exchange-offline 202 - enable-account 203 - "{{ regional_currency_exchange_payto }}" 204 - display-hint 205 - "0" 206 - "{{ regional_currency_currency }} Exchange" 207 - upload 208 args: 209 chdir: / 210 when: not regional_currency_exchange_account_setup.stat.exists 211 changed_when: true 212 213 - name: Mark initial exchange account setup complete 214 ansible.builtin.file: 215 path: "{{ regional_currency_state_directory }}/exchange-account-setup" 216 state: touch 217 owner: root 218 group: root 219 mode: "0600" 220 modification_time: preserve 221 access_time: preserve 222 when: not regional_currency_exchange_account_setup.stat.exists 223 224 - name: Check whether the fiat conversion account is configured 225 ansible.builtin.stat: 226 path: "{{ regional_currency_state_directory }}/conversion-account-setup" 227 register: regional_currency_conversion_account_setup 228 when: regional_currency_enable_conversion 229 230 - name: Enable the fiat conversion account 231 become: true 232 become_user: taler-exchange-offline 233 ansible.builtin.command: 234 argv: 235 - taler-exchange-offline 236 - enable-account 237 - >- 238 payto://iban/{{ regional_currency_fiat_account_bic }}/{{ regional_currency_fiat_account_iban 239 }}?receiver-name={{ regional_currency_fiat_account_name | urlencode }} 240 - display-hint 241 - "10" 242 - "{{ regional_currency_fiat_bank_name }}" 243 - conversion-url 244 - "{{ regional_currency_protocol }}://bank.{{ regional_currency_domain }}/conversion-info/" 245 - debit-restriction 246 - deny 247 - upload 248 args: 249 chdir: / 250 when: 251 - regional_currency_enable_conversion 252 - not regional_currency_conversion_account_setup.stat.exists 253 changed_when: true 254 255 - name: Mark fiat conversion account setup complete 256 ansible.builtin.file: 257 path: "{{ regional_currency_state_directory }}/conversion-account-setup" 258 state: touch 259 owner: root 260 group: root 261 mode: "0600" 262 modification_time: preserve 263 access_time: preserve 264 when: 265 - regional_currency_enable_conversion 266 - not regional_currency_conversion_account_setup.stat.exists 267 268 - name: Check whether this coin configuration has been signed 269 ansible.builtin.stat: 270 path: "{{ regional_currency_state_directory }}/exchange-signed-coin-config" 271 register: regional_currency_exchange_signed_coin_config_file 272 273 - name: Read the signed coin configuration checksum 274 ansible.builtin.slurp: 275 src: "{{ regional_currency_state_directory }}/exchange-signed-coin-config" 276 register: regional_currency_exchange_signed_coin_config_data 277 when: regional_currency_exchange_signed_coin_config_file.stat.exists 278 279 - name: Decide whether exchange maintenance must run now 280 ansible.builtin.set_fact: 281 regional_currency_exchange_maintenance_required: >- 282 {{ regional_currency_exchange_maintenance_service.changed 283 or not regional_currency_exchange_signed_coin_config_file.stat.exists 284 or ( 285 regional_currency_exchange_signed_coin_config_file.stat.exists 286 and (regional_currency_exchange_signed_coin_config_data.content | b64decode | trim) 287 != regional_currency_exchange_coin_config_current.stat.checksum 288 ) }} 289 290 - name: Activate the regional-currency systemd units 291 ansible.builtin.meta: flush_handlers 292 293 - name: Sign exchange keys and provision current and future fees 294 ansible.builtin.systemd_service: 295 name: taler-exchange-offline.service 296 state: started 297 when: regional_currency_exchange_maintenance_required 298 299 - name: Record the signed coin configuration checksum 300 ansible.builtin.copy: 301 content: "{{ regional_currency_exchange_coin_config_current.stat.checksum }}\n" 302 dest: "{{ regional_currency_state_directory }}/exchange-signed-coin-config" 303 owner: root 304 group: root 305 mode: "0600" 306 when: regional_currency_exchange_maintenance_required 307 308 - name: Enable the online signing timer 309 ansible.builtin.systemd_service: 310 name: taler-exchange-offline.timer 311 enabled: true 312 state: started 313 314 - name: Wait for public exchange keys 315 ansible.builtin.uri: 316 url: "{{ regional_currency_exchange_base_url }}keys" 317 status_code: 200 318 timeout: 5 319 register: regional_currency_exchange_keys_ready 320 until: regional_currency_exchange_keys_ready.status == 200 321 retries: 10 322 delay: 2