libeufin.yml (18057B)
1 --- 2 - name: Configure LibEuFin Nexus for fiat conversion 3 ansible.builtin.command: 4 argv: 5 - taler-harness 6 - config 7 - -c 8 - /etc/libeufin/libeufin-nexus.conf 9 - set 10 - nexus-ebics 11 - "{{ item.key }}" 12 - "{{ item.value }}" 13 loop: 14 - { key: CURRENCY, value: "{{ regional_currency_fiat_currency }}" } 15 - { key: IBAN, value: "{{ regional_currency_fiat_account_iban }}" } 16 - { key: BIC, value: "{{ regional_currency_fiat_account_bic }}" } 17 - { key: NAME, value: "{{ regional_currency_fiat_account_name }}" } 18 when: regional_currency_enable_conversion 19 changed_when: false 20 21 - name: Configure Nexus payment acknowledgement policy 22 ansible.builtin.command: 23 argv: 24 - taler-harness 25 - config 26 - -c 27 - /etc/libeufin/libeufin-nexus.conf 28 - set 29 - nexus-submit 30 - MANUAL_ACK 31 - "{{ 'YES' if regional_currency_conversion_test_mode else 'NO' }}" 32 when: regional_currency_enable_conversion 33 changed_when: false 34 35 - name: Install LibEuFin bank configuration 36 ansible.builtin.template: 37 src: libeufin-bank.conf.j2 38 dest: /etc/libeufin/libeufin-bank.conf 39 owner: root 40 group: libeufin-bank 41 mode: "0640" 42 register: regional_currency_libeufin_bank_config 43 no_log: "{{ regional_currency_enable_telesign }}" 44 45 - name: Set LibEuFin SPA branding 46 ansible.builtin.template: 47 src: libeufin-settings.js.j2 48 dest: /etc/libeufin/settings.js 49 owner: root 50 group: root 51 mode: "0644" 52 53 - name: Install LibEuFin SPA settings 54 ansible.builtin.template: 55 src: libeufin-settings.json.j2 56 dest: /usr/share/libeufin-bank-webui/settings.json 57 owner: root 58 group: root 59 mode: "0644" 60 validate: python3 -m json.tool %s 61 62 - name: Ensure PostgreSQL is running before LibEuFin dbconfig 63 ansible.builtin.service: 64 name: postgresql 65 state: started 66 enabled: true 67 68 - name: Initialize or upgrade the LibEuFin database 69 ansible.builtin.command: libeufin-dbconfig 70 args: 71 chdir: / 72 changed_when: false 73 74 - name: Link Nexus fiat payments to regional-currency cash-in 75 become: true 76 become_user: postgres 77 ansible.builtin.command: 78 argv: 79 - psql 80 - --dbname=libeufin 81 - --set=ON_ERROR_STOP=1 82 - --file=/usr/share/libeufin/sql/libeufin-conversion-setup.sql 83 args: 84 chdir: / 85 when: regional_currency_enable_conversion 86 changed_when: false 87 88 - name: Enable and start LibEuFin bank 89 ansible.builtin.service: 90 name: libeufin-bank 91 enabled: true 92 state: "{{ 'restarted' if regional_currency_libeufin_bank_config.changed else 'started' }}" 93 94 - name: Configure the LibEuFin bank administrator password 95 become: true 96 become_user: libeufin-bank 97 ansible.builtin.command: 98 argv: 99 - libeufin-bank 100 - passwd 101 - admin 102 - "{{ regional_currency_bank_admin_password }}" 103 args: 104 chdir: / 105 register: regional_currency_bank_admin_password_result 106 changed_when: false 107 failed_when: false 108 no_log: true 109 110 - name: Report LibEuFin bank administrator password failure 111 ansible.builtin.fail: 112 msg: >- 113 Unable to configure the LibEuFin bank administrator password: 114 {{ regional_currency_bank_admin_password_result.stderr 115 | default(regional_currency_bank_admin_password_result.stdout, true) 116 | default('no error details returned', true) 117 | replace(regional_currency_bank_admin_password, '<redacted>') }} 118 when: regional_currency_bank_admin_password_result.rc != 0 119 120 - name: Configure the administrator debt limit 121 become: true 122 become_user: libeufin-bank 123 ansible.builtin.command: 124 argv: 125 - libeufin-bank 126 - edit-account 127 - admin 128 - "--debit_threshold={{ regional_currency_currency }}:200000000" 129 args: 130 chdir: / 131 changed_when: false 132 133 - name: Check for the persisted exchange account 134 ansible.builtin.stat: 135 path: "{{ regional_currency_state_directory }}/exchange-payto" 136 register: regional_currency_exchange_payto_file 137 138 - name: Set the expected exchange account payto URI 139 ansible.builtin.set_fact: 140 regional_currency_exchange_payto_candidate: >- 141 payto://x-taler-bank/bank.{{ regional_currency_domain }}/exchange?receiver-name=Exchange 142 when: not regional_currency_exchange_payto_file.stat.exists 143 144 - name: Check whether the exchange bank account already exists 145 become: true 146 become_user: libeufin-bank 147 ansible.builtin.command: 148 argv: 149 - libeufin-bank 150 - edit-account 151 - exchange 152 - --name 153 - Exchange 154 - --exchange 155 - "true" 156 args: 157 chdir: / 158 register: regional_currency_exchange_account_probe 159 when: not regional_currency_exchange_payto_file.stat.exists 160 changed_when: false 161 failed_when: false 162 163 - name: Generate a password for the exchange bank account 164 ansible.builtin.command: uuidgen 165 register: regional_currency_exchange_bank_password 166 when: 167 - not regional_currency_exchange_payto_file.stat.exists 168 - regional_currency_exchange_account_probe.rc != 0 169 changed_when: false 170 no_log: true 171 172 - name: Create the exchange bank account 173 become: true 174 become_user: libeufin-bank 175 ansible.builtin.command: 176 argv: 177 - libeufin-bank 178 - create-account 179 - --username 180 - exchange 181 - --password 182 - "{{ regional_currency_exchange_bank_password.stdout }}" 183 - --name 184 - Exchange 185 - --exchange 186 - --payto_uri 187 - "{{ regional_currency_exchange_payto_candidate }}" 188 args: 189 chdir: / 190 register: regional_currency_created_exchange_payto 191 when: 192 - not regional_currency_exchange_payto_file.stat.exists 193 - regional_currency_exchange_account_probe.rc != 0 194 changed_when: regional_currency_created_exchange_payto.rc == 0 195 failed_when: false 196 no_log: true 197 198 - name: Report exchange bank account creation failure 199 ansible.builtin.fail: 200 msg: >- 201 Unable to create the LibEuFin exchange account: 202 {{ regional_currency_created_exchange_payto.stderr 203 | default('no error details returned') 204 | replace(regional_currency_exchange_bank_password.stdout, '<redacted>') }} 205 when: 206 - not regional_currency_exchange_payto_file.stat.exists 207 - regional_currency_exchange_account_probe.rc != 0 208 - regional_currency_created_exchange_payto.rc != 0 209 210 - name: Use the newly created exchange account payto URI 211 ansible.builtin.set_fact: 212 regional_currency_exchange_payto_candidate: >- 213 {{ regional_currency_created_exchange_payto.stdout | trim }} 214 when: 215 - not regional_currency_exchange_payto_file.stat.exists 216 - regional_currency_exchange_account_probe.rc != 0 217 218 - name: Persist the exchange account payto URI 219 ansible.builtin.copy: 220 content: "{{ regional_currency_exchange_payto_candidate }}\n" 221 dest: "{{ regional_currency_state_directory }}/exchange-payto" 222 owner: root 223 group: root 224 mode: "0600" 225 when: not regional_currency_exchange_payto_file.stat.exists 226 no_log: true 227 228 - name: Read the exchange account payto URI 229 ansible.builtin.slurp: 230 src: "{{ regional_currency_state_directory }}/exchange-payto" 231 register: regional_currency_exchange_payto_data 232 no_log: true 233 234 - name: Set the exchange account payto URI 235 ansible.builtin.set_fact: 236 regional_currency_exchange_payto_stored: "{{ regional_currency_exchange_payto_data.content | b64decode | trim }}" 237 no_log: true 238 239 - name: Add the receiver name to legacy exchange account payto URIs 240 ansible.builtin.set_fact: 241 regional_currency_exchange_payto: >- 242 {{ regional_currency_exchange_payto_stored 243 if 'receiver-name=' in regional_currency_exchange_payto_stored 244 else regional_currency_exchange_payto_stored 245 ~ ('&' if '?' in regional_currency_exchange_payto_stored else '?') 246 ~ 'receiver-name=Exchange' }} 247 no_log: true 248 249 - name: Persist the normalized exchange account payto URI 250 ansible.builtin.copy: 251 content: "{{ regional_currency_exchange_payto }}\n" 252 dest: "{{ regional_currency_state_directory }}/exchange-payto" 253 owner: root 254 group: root 255 mode: "0600" 256 no_log: true 257 258 - name: Check for the persisted exchange wire gateway token 259 ansible.builtin.stat: 260 path: "{{ regional_currency_state_directory }}/exchange-bank-token" 261 register: regional_currency_exchange_bank_token_file 262 263 - name: Create the exchange wire gateway token 264 become: true 265 become_user: libeufin-bank 266 ansible.builtin.command: 267 argv: 268 - libeufin-bank 269 - create-token 270 - -u 271 - exchange 272 - -s 273 - wiregateway 274 - -d 275 - forever 276 args: 277 chdir: / 278 register: regional_currency_created_exchange_bank_token 279 when: not regional_currency_exchange_bank_token_file.stat.exists 280 changed_when: true 281 no_log: true 282 283 - name: Persist the exchange wire gateway token 284 ansible.builtin.copy: 285 content: "{{ regional_currency_created_exchange_bank_token.stdout | trim }}\n" 286 dest: "{{ regional_currency_state_directory }}/exchange-bank-token" 287 owner: root 288 group: root 289 mode: "0600" 290 when: not regional_currency_exchange_bank_token_file.stat.exists 291 no_log: true 292 293 - name: Read the exchange wire gateway token 294 ansible.builtin.slurp: 295 src: "{{ regional_currency_state_directory }}/exchange-bank-token" 296 register: regional_currency_exchange_bank_token_data 297 no_log: true 298 299 - name: Set the exchange wire gateway token 300 ansible.builtin.set_fact: 301 regional_currency_exchange_bank_token: "{{ regional_currency_exchange_bank_token_data.content | b64decode | trim }}" 302 no_log: true 303 304 - name: Wait for the LibEuFin bank API 305 ansible.builtin.uri: 306 url: "{{ regional_currency_protocol }}://bank.{{ regional_currency_domain }}/config" 307 status_code: 200 308 register: regional_currency_bank_ready 309 until: regional_currency_bank_ready.status == 200 310 retries: 10 311 delay: 2 312 313 - name: Probe the LibEuFin conversion configuration 314 ansible.builtin.uri: 315 url: "{{ regional_currency_protocol }}://bank.{{ regional_currency_domain }}/conversion-info/config" 316 register: regional_currency_conversion_config_probe 317 when: regional_currency_enable_conversion 318 changed_when: false 319 failed_when: false 320 321 - name: Restart LibEuFin bank to apply its current configuration 322 ansible.builtin.service: 323 name: libeufin-bank 324 state: restarted 325 when: >- 326 (regional_currency_bank_ready.json.currency | default('')) != regional_currency_currency 327 or 328 (regional_currency_bank_ready.json.allow_conversion | default(false) | bool) 329 != regional_currency_enable_conversion 330 or 331 (regional_currency_enable_conversion and ( 332 (regional_currency_conversion_config_probe.status | default(-1) | int) != 200 333 or 334 (regional_currency_conversion_config_probe.json.regional_currency | default('')) 335 != regional_currency_currency 336 or 337 (regional_currency_conversion_config_probe.json.fiat_currency | default('')) 338 != regional_currency_fiat_currency 339 )) 340 341 - name: Read the effective LibEuFin bank configuration 342 ansible.builtin.uri: 343 url: "{{ regional_currency_protocol }}://bank.{{ regional_currency_domain }}/config" 344 status_code: 200 345 register: regional_currency_effective_bank_config 346 until: regional_currency_effective_bank_config.status == 200 347 retries: 10 348 delay: 2 349 350 - name: Verify the effective LibEuFin bank configuration 351 ansible.builtin.assert: 352 that: 353 - regional_currency_effective_bank_config.json.currency == regional_currency_currency 354 - >- 355 (regional_currency_effective_bank_config.json.allow_conversion | bool) 356 == regional_currency_enable_conversion 357 fail_msg: >- 358 The running LibEuFin bank reports currency 359 {{ regional_currency_effective_bank_config.json.currency | default('unknown') }} and 360 conversion={{ regional_currency_effective_bank_config.json.allow_conversion | default('unknown') }}, 361 but the inventory configures currency {{ regional_currency_currency }} and 362 conversion={{ regional_currency_enable_conversion }}. 363 quiet: true 364 365 - name: Read the effective LibEuFin conversion configuration 366 ansible.builtin.uri: 367 url: "{{ regional_currency_protocol }}://bank.{{ regional_currency_domain }}/conversion-info/config" 368 status_code: 200 369 register: regional_currency_conversion_config 370 when: regional_currency_enable_conversion 371 372 - name: Verify the LibEuFin conversion currencies 373 ansible.builtin.assert: 374 that: 375 - regional_currency_conversion_config.json.regional_currency == regional_currency_currency 376 - regional_currency_conversion_config.json.fiat_currency == regional_currency_fiat_currency 377 fail_msg: >- 378 The running LibEuFin bank reports conversion from 379 {{ regional_currency_conversion_config.json.fiat_currency | default('unknown') }} to 380 {{ regional_currency_conversion_config.json.regional_currency | default('unknown') }}, 381 but the inventory configures conversion from {{ regional_currency_fiat_currency }} to 382 {{ regional_currency_currency }}. 383 quiet: true 384 when: regional_currency_enable_conversion 385 386 - name: Check whether the initial conversion rate has been configured 387 ansible.builtin.stat: 388 path: "{{ regional_currency_state_directory }}/conversion-rate-setup" 389 register: regional_currency_conversion_rate_setup 390 when: regional_currency_enable_conversion 391 392 - name: Create a temporary administrator token for conversion setup 393 become: true 394 become_user: libeufin-bank 395 ansible.builtin.command: 396 argv: 397 - libeufin-bank 398 - create-token 399 - -u 400 - admin 401 - -s 402 - readwrite 403 args: 404 chdir: / 405 register: regional_currency_bank_admin_token 406 when: 407 - regional_currency_enable_conversion 408 - not regional_currency_conversion_rate_setup.stat.exists 409 changed_when: false 410 no_log: true 411 412 - name: Configure the initial one-to-one conversion rate 413 ansible.builtin.uri: 414 url: "{{ regional_currency_protocol }}://bank.{{ regional_currency_domain }}/conversion-info/conversion-rate" 415 method: POST 416 headers: 417 Authorization: "Bearer {{ regional_currency_bank_admin_token.stdout | trim }}" 418 body_format: json 419 body: 420 cashin_ratio: "1" 421 cashin_fee: "{{ regional_currency_currency }}:0" 422 cashin_tiny_amount: "{{ regional_currency_currency }}:0.01" 423 cashin_rounding_mode: nearest 424 cashin_min_amount: "{{ regional_currency_fiat_currency }}:0" 425 cashout_ratio: "1" 426 cashout_fee: "{{ regional_currency_fiat_currency }}:0" 427 cashout_tiny_amount: "{{ regional_currency_fiat_currency }}:0.01" 428 cashout_rounding_mode: nearest 429 cashout_min_amount: "{{ regional_currency_currency }}:0" 430 return_content: true 431 status_code: [200, 204] 432 register: regional_currency_conversion_rate_response 433 when: 434 - regional_currency_enable_conversion 435 - not regional_currency_conversion_rate_setup.stat.exists 436 failed_when: false 437 no_log: true 438 439 - name: Report initial conversion rate configuration failure 440 ansible.builtin.fail: 441 msg: >- 442 LibEuFin rejected the initial conversion rate request 443 (HTTP {{ regional_currency_conversion_rate_response.status | default('unknown') }}): 444 {{ regional_currency_conversion_rate_response.json.hint 445 | default(regional_currency_conversion_rate_response.json.detail, true) 446 | default(regional_currency_conversion_rate_response.content, true) 447 | default(regional_currency_conversion_rate_response.msg, true) 448 | default('no response details', true) }} 449 when: 450 - regional_currency_enable_conversion 451 - not regional_currency_conversion_rate_setup.stat.exists 452 - (regional_currency_conversion_rate_response.status | default(-1) | int) not in [200, 204] 453 454 - name: Mark the initial conversion rate configured 455 ansible.builtin.file: 456 path: "{{ regional_currency_state_directory }}/conversion-rate-setup" 457 state: touch 458 owner: root 459 group: root 460 mode: "0600" 461 modification_time: preserve 462 access_time: preserve 463 when: 464 - regional_currency_enable_conversion 465 - not regional_currency_conversion_rate_setup.stat.exists 466 467 - name: Validate EBICS transaction fetching before enabling Nexus 468 become: true 469 become_user: libeufin-nexus 470 ansible.builtin.command: 471 argv: 472 - libeufin-nexus 473 - ebics-fetch 474 - -c 475 - /etc/libeufin/libeufin-nexus.conf 476 - --transient 477 args: 478 chdir: / 479 changed_when: false 480 when: 481 - regional_currency_enable_nexus_services 482 - not regional_currency_nexus_was_active 483 484 - name: Validate EBICS payment submission before enabling Nexus 485 become: true 486 become_user: libeufin-nexus 487 ansible.builtin.command: 488 argv: 489 - libeufin-nexus 490 - ebics-submit 491 - -c 492 - /etc/libeufin/libeufin-nexus.conf 493 - --transient 494 args: 495 chdir: / 496 changed_when: false 497 when: 498 - regional_currency_enable_nexus_services 499 - not regional_currency_nexus_was_active 500 501 - name: Enable and start LibEuFin Nexus 502 ansible.builtin.service: 503 name: libeufin-nexus.target 504 enabled: true 505 state: started 506 when: regional_currency_enable_nexus_services 507 508 - name: Keep LibEuFin Nexus disabled until EBICS enrollment is complete 509 ansible.builtin.service: 510 name: libeufin-nexus.target 511 enabled: false 512 state: stopped 513 when: not regional_currency_enable_nexus_services 514 515 - name: Stop LibEuFin Nexus workers when Nexus is disabled 516 ansible.builtin.service: 517 name: "{{ item }}" 518 state: stopped 519 loop: 520 - libeufin-nexus-ebics-fetch.service 521 - libeufin-nexus-ebics-submit.service 522 when: not regional_currency_enable_nexus_services 523 524 - name: Refresh service state after stopping LibEuFin Nexus workers 525 ansible.builtin.service_facts: 526 when: not regional_currency_enable_nexus_services 527 528 - name: Clear LibEuFin Nexus worker failure states when Nexus is disabled 529 ansible.builtin.command: 530 argv: 531 - systemctl 532 - reset-failed 533 - "{{ item }}" 534 loop: 535 - libeufin-nexus-ebics-fetch.service 536 - libeufin-nexus-ebics-submit.service 537 when: 538 - not regional_currency_enable_nexus_services 539 - item in ansible_facts.services 540 - ansible_facts.services[item].state == "failed" 541 changed_when: false