# Required vars with defaults
# - openqa_hostname
##      string - hostname of openQA server to run jobs for and query
##               job results from
##      default - localhost
# - external_hostname
##      string - The public hostname of the openQA server (used in
##               links back from ResultsDB and wiki results)
##      default - ansible_nodename
# - openqa_compose_arches
##        string - Comma-separated list of arches to schedule compose
##                 tests for
##        default - x86_64
#
# Optional vars
# - wikitcms_token
##      string - a token file to install for unattended reporting to
##               a wiki using openidc auth. If this and
##               openqa_wikitcms_hostname are set, wiki reporting will
##               be enabled, if unset, it will not. Note you must also
##               set openqa_amqp_wiki_reporter_queue if this is set.
##               You should probably NOT set this unless you are
##               maintaining the Fedora infrastructure deployment.
# - openqa_wikitcms_hostname
##      string - Hostname of a wiki to report results to. If this and
##               wikitcms_token are set, wiki reporting will be
##               enabled. Note you must also set
##               openqa_amqp_wiki_reporter_queue if this is set. You
##               should probably NOT set this unless you are
##               maintaining the Fedora infrastructure deployment.
# - openqa_resultsdb_url
##      string - a ResultsDB API URL to report results to. If set,
##               ResultsDB reporting will be enabled. Note you must
##               also set openqa_amqp_resultsdb_reporter_queue if this
##               is set. You should probably NOT set this unless you
##               are maintaining the Fedora infrastructure deployment.
# - openqa_resultsdb_user
##      string - username for ResultsDB API authentication. If not
##               set, no authentication will be attempted.
# - openqa_resultsdb_password
##      string - password for ResultsDB API authentication. If not
##               set, no authentication will be attempted.
# - deployment_type
##      string - Fedora Infrastructure thing; for this role, the
##               fedora_openqa config file and fedora-messaging config
##               will be set appropriately for infra deployments if
##               this is set, so don't set it for private deployments
# - openqa_update_arches
##        list - List of arches to schedule update tests for. Must be
##               set if openqa_amqp_scheduler_queue is set.
# - openqa_amqp_passive
##        bool - If true, passive_declares will be set true in all the
##               fedora-messaging consumer configuration files. This
##               is needed for private authentication on the Fedora
##               brokers. Role default is false.
# - openqa_amqp_scheduler_url
##      string - AMQP broker URL for fedora-messaging job scheduler.
##               The role default for this is the Fedora production
##               broker with the shared 'fedora' username.
# - openqa_amqp_scheduler_cacert
##      string - CA certificate file to use for authenticating with
##               AMQP broker for fedora-messaging job scheduler.
##               The role default for this is the CA cert file for the
##               Fedora production broker.
# - openqa_amqp_scheduler_cert
##      string - Certificate file to use for authenticating with AMQP
##               broker for fedora-messaging job scheduler. The role
##               default for this is the certificate file for the
##               public 'fedora' account on the Fedora production
##               broker.
# - openqa_amqp_scheduler_key
##      string - Private key file to use for authenticating with AMQP
##               broker for fedora-messaging job scheduler. The role
##               default for this is the key file for the public
##               'fedora' account on the Fedora production broker.
# - openqa_amqp_scheduler_queue
##      string - Message queue name for the fedora-messaging scheduler
##               consumer. If this is set, the scheduler will be
##               enabled. To use the fedora-messaging scheduler with
##               public authentication on the Fedora production AMQP
##               broker (which is what you'd typically want), you only
##               need to set this. This should be a unique and private
##               string; the official recommendation is to use a
##               random UUID generated by uuidgen. If set, you must
##               also set openqa_update_arches.
# - openqa_amqp_scheduler_routing_keys
##        list - List of routing key names for the fedora-messaging
##               scheduler to subscribe to. The role default for this
##               is the appropriate keys for the Fedora production
##               broker.
# - openqa_amqp_reporter_url
##      string - AMQP broker URL for fedora-messaging result reporters.
##               The role default for this is the Fedora production
##               broker with the shared 'fedora' username.
# - openqa_amqp_reporter_cacert
##      string - CA certificate file to use for authenticating with
##               AMQP broker for fedora-messaging result reporters.
##               The role default for this is the CA cert file for the
##               Fedora production broker.
# - openqa_amqp_reporter_cert
##      string - Certificate file to use for authenticating with AMQP
##               broker for fedora-messaging result reporters. The role
##               default for this is the certificate file for the
##               public 'fedora' account on the Fedora production
##               broker.
# - openqa_amqp_reporter_key
##      string - Private key file to use for authenticating with AMQP
##               broker for fedora-messaging result reporters. The role
##               default for this is the key file for the public
##               'fedora' account on the Fedora production broker.
# - openqa_amqp_resultsdb_reporter_queue
##      string - Message queue name for the fedora-messaging ResultsDB
##               reporter consumer. If this is set, the ResultsDB
##               reporter will be enabled. You **SHOULD NOT** enable
##               this reporter unless you have a private ResultsDB
##               instance to send results to; only the official Fedora
##               infra deployments should report to Fedora ResultsDB.
##               To use the fedora-messaging scheduler with public
##               authentication on the Fedora production AMQP broker,
##               you only need to set this; openqa_resultsdb_url must
##               also be set correctly. This should be a unique and
##               private string; the official recommendation is to use
##               a random UUID generated by uuidgen.
# - openqa_amqp_resultsdb_reporter_routing_keys
##        list - List of routing key names for the fedora-messaging
##               ResultsDB reporter to subscribe to. The role default
##               for this is the appropriate keys for the Fedora
##               production broker.
# - openqa_amqp_wiki_reporter_queue
##      string - Message queue name for the fedora-messaging Wiki
##               reporter consumer. If this is set, the Wiki reporter
##               will be enabled. You **SHOULD NOT** enable this
##               reporter unless you have a private mediawiki instance
##               to send results to; only the official Fedora infra
##               deployments should report to the Fedora wikis. To use
##               the fedora-messaging scheduler with public
##               authentication on the Fedora production AMQP broker,
##               you only need to set this; openqa_wikitcms_hostname
##               must also be set correctly. This should be a unique
##               and private string; the official recommendation is to
##               use a random UUID generated by uuidgen.
# - openqa_amqp_wiki_reporter_routing_keys
##        list - List of routing key names for the fedora-messaging
##               wiki reporter to subscribe to. The role default
##               for this is the appropriate keys for the Fedora
##               production broker.
# - openqa_amqp_mailto
##        list - List of email addresses to email errors to. If set,
##               the email log handler will be configured.
# - openqa_amqp_mailfrom
##      string - From email address for error report emails. Defaults
##               to "root@{{ external_hostname }}".
# - openqa_amqp_smtp
##      string - Hostname of SMTP server to use for sending error
##               emails. Defaults to 'localhost'.
#
# NOTE: There are still currently a couple of assumptions that the
# openQA server boxes will always act as their own dispatchers, but
# there is no longer any fundamental reason why this must be the case,
# as we now use the openQA asset downloading capability so that the
# scheduler is no longer responsible for downloading assets.

# just keeping this around for convenience as we often need it
#- name: Install required packages (testing)
#  dnf:
#    name: ['python2-fedfind', 'python2-wikitcms']
#    state: present
#    enablerepo: "updates-testing"
#  tags:
#  - packages

# fedora_openqa requires most of these, including the resultsdb and
# wikitcms bits even when reporting is disabled; the consumer module
# always imports the report module which imports those
- name: Install required packages
  package:
    name: ['fedora-messaging', 'python3-fedfind', 'python3-wikitcms', 'python3-openqa_client',
           'python3-requests', 'python3-resultsdb_api', 'python3-resultsdb_conventions-fedora',
           'python3-setuptools', 'python3-six', 'python3-pip']
    state: present
  tags:
  - packages

- name: Install required packages (wiki oidc auth)
  package:
    name: python3-openidc-client
    state: present
  when: "wikitcms_token is defined"
  tags:
  - packages

- name: Check tools directory exists with correct ownership
  file: path=/root/fedora_openqa state=directory owner=root group=root

# we don't want to run the checkout if the tests are on a non-standard
# branch, as that usually means we're messing around on staging and
# don't want the checkout reset to HEAD.
- name: Check if tests are checked out and on a non-standard branch
  command: "git status" # noqa 303
  args:
    chdir: /root/fedora_openqa
  register: toolsbranch
  failed_when: "1 != 1"
  changed_when: "1 != 1"
  check_mode: no

- name: Check out fedora_openqa (scheduler / reporter tool)
  git:
    repo: https://pagure.io/fedora-qa/fedora_openqa.git # noqa 401
    dest: /root/fedora_openqa
  register: gittools
  # case of the 'n' seems inconstant, so intentionally omitted
  when: "(toolsbranch.stderr.find('ot a git repository') != -1) or (toolsbranch.stdout.find('On branch main') != -1)"

- name: Check if fedora_openqa is installed for current Python
  command: "pip show fedora_openqa"
  register: insttools
  changed_when: "1 != 1"
  failed_when: "1 != 1"
  check_mode: no

- name: Install fedora_openqa
  command: "python3 setup.py install"
  args:
    chdir: /root/fedora_openqa
  when: "gittools is changed or insttools.rc != 0"
  notify:
  - restart openqa consumers

# FIXME: we should probably have the fedora-messaging consumers run as
# someone other than root and then we'd need another token file for
# them, as we used to have for the fedmsg user. But for now they run
# as root and use this one.
- name: openQA client config
  template: src=client.conf.j2 dest=/etc/openqa/client.conf owner=root group=root mode=0640
  tags:
  - config

- name: Create fedora_openqa config directory
  file: path=/etc/fedora-openqa state=directory owner=root group=root mode=0755

- name: Write schedule.conf
  template: src=schedule.conf.j2 dest=/etc/fedora-openqa/schedule.conf owner=root group=root mode=0600
  notify:
  - restart openqa consumers
  tags:
  - config

- name: Remove old wikitcms credentials file
  file: path=/etc/fedora/credentials state=absent
  tags:
  - config

# FIXME: we should probably have the fedora-messaging consumers run as
# someone other than root and then we'd need another token file for
# them, as we used to have for the fedmsg user. But for now they run
# as root and use this one.
- name: Create /root/.openidc (wiki access token file location)
  file: path=/root/.openidc state=directory owner=root group=root mode=0700

- name: Write wikitcms token file for root
  copy: src={{ wikitcms_token }} dest=/root/.openidc/oidc_wikitcms.json owner=root group=root mode=0600
  when: "wikitcms_token is defined"
  tags:
  - config

- name: Create /etc/pki/fedora-messaging
  file:
    dest: /etc/pki/fedora-messaging
    mode: 0775
    owner: root
    group: root
    state: directory
  when: "deployment_type is defined"
  tags:
  - config

- name: Deploy the Fedora infra fedora-messaging cert
  copy:
    src: "{{ private }}/files/rabbitmq/{{ openqa_env }}/pki/issued/openqa{{ openqa_env_suffix }}.crt"
    dest: /etc/pki/fedora-messaging/openqa{{ openqa_env_suffix }}-cert.pem
    mode: 0644
    owner: root
    group: root
  when: "deployment_type is defined"
  tags:
  - config

- name: Deploy the Fedora infra fedora-messaging key
  copy:
    src: "{{ private }}/files/rabbitmq/{{ openqa_env }}/pki/private/openqa{{ openqa_env_suffix }}.key"
    dest: /etc/pki/fedora-messaging/openqa{{ openqa_env_suffix }}-key.pem
    mode: 0640
    owner: root
    group: geekotest
  when: "deployment_type is defined"
  tags:
  - config

- name: Deploy the Fedora infra fedora-messaging prod cert on stg (for scheduler)
  copy:
    src: "{{ private }}/files/rabbitmq/production/pki/issued/openqa.crt"
    dest: /etc/pki/fedora-messaging/openqa-cert.pem
    mode: 0644
    owner: root
    group: root
  when: "deployment_type is defined and deployment_type == 'stg'"
  tags:
  - config

- name: Deploy the Fedora infra fedora-messaging prod key on stg (for scheduler)
  copy:
    src: "{{ private }}/files/rabbitmq/production/pki/private/openqa.key"
    dest: /etc/pki/fedora-messaging/openqa-key.pem
    mode: 0640
    owner: root
    group: geekotest
  when: "deployment_type is defined and deployment_type == 'stg'"
  tags:
  - config

- name: Configure fedora-messaging scheduler
  template: src=fedora_openqa_scheduler.toml.j2 dest=/etc/fedora-messaging/fedora_openqa_scheduler.toml owner=root group=root mode=0640
  notify:
  - restart openqa scheduler consumer
  when: "openqa_amqp_scheduler_queue is defined and openqa_amqp_scheduler_queue"
  tags:
  - config

- name: Configure fedora-messaging wiki reporter
  template: src=fedora_openqa_wiki_reporter.toml.j2 dest=/etc/fedora-messaging/fedora_openqa_wiki_reporter.toml owner=root group=root mode=0640
  notify:
  - restart openqa wiki consumer
  when: "openqa_amqp_wiki_reporter_queue is defined and openqa_amqp_wiki_reporter_queue"
  tags:
  - config

- name: Configure fedora-messaging ResultsDB reporter
  template: src=fedora_openqa_resultsdb_reporter.toml.j2 dest=/etc/fedora-messaging/fedora_openqa_resultsdb_reporter.toml owner=root group=root mode=0640
  notify:
  - restart openqa resultsdb consumer
  when: "openqa_amqp_resultsdb_reporter_queue is defined and openqa_amqp_resultsdb_reporter_queue"
  tags:
  - config

- name: Enable and start fedora-messaging scheduler service
  service: name=fm-consumer@fedora_openqa_scheduler enabled=yes state=started
  when: "openqa_amqp_scheduler_queue is defined and openqa_amqp_scheduler_queue"

- name: Enable and start fedora-messaging wiki reporter service
  service: name=fm-consumer@fedora_openqa_wiki_reporter enabled=yes state=started
  when: "openqa_amqp_wiki_reporter_queue is defined and openqa_amqp_wiki_reporter_queue"

- name: Enable and start fedora-messaging ResultsDB reporter service
  service: name=fm-consumer@fedora_openqa_resultsdb_reporter enabled=yes state=started
  when: "openqa_amqp_resultsdb_reporter_queue is defined and openqa_amqp_resultsdb_reporter_queue"

- name: Create directory for consumer service config drop-in
  file: path=/etc/systemd/system/fm-consumer@.service.d state=directory owner=root group=root mode=0755

# This slows restarts of fm-consumer@ to every 60 seconds, instead of
# near-instantly; this avoids huge floods of errors when resultsdb
# or the wiki go down for a bit
- name: Consumer service config drop-in to slow down restarts
  copy: src=fmconsumer.restartsec.conf dest=/etc/systemd/system/fm-consumer@.service.d/10-restartsec.conf owner=root group=root mode=0644

- name: Set up cron job to schedule live-respins jobs
  copy: src=schedule-live-respins.cron dest=/etc/cron.hourly/schedule-live-respins owner=root group=root mode=0755
  tags:
  - config

# This is to deal with an annoying bug in fedora-messaging: sometimes
# consumers seem to get stuck allegedly running fine but not parsing
# any messages. So we'll restart all running consumers every day just
# to kick any that are in this state. Strictly speaking this shouldn't
# really be tied to the dispatcher role, but separating it out would
# be a pain, it's easier just to stuff it here
- name: Set up cron job to restart all running fm-consumer services
  copy: src=restart-consumers.cron dest=/etc/cron.daily/restart-consumers owner=root group=root mode=0755
  tags:
  - config
