ansible/playbooks/manual/push-badges.yml

# Push out any new badge stuff.
#
# Badge artists and badge developers should be pushing stuff to this repo:
#
#   https://pagure.io/fedora-badges.git
#
# This playbook will take any new content from there and push it out onto our
# servers.

- name: get the badges repo happening from the batcave
  hosts: batcave01.phx2.fedoraproject.org
  user: root
  gather_facts: False

  vars_files:
   - /srv/web/infra/ansible/vars/global.yml
   - "/srv/private/ansible/vars.yml"
   - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml

  vars:
   upstream: "https://pagure.io/fedora-badges.git"
   workingdir: /srv/web/infra/badges/

  tasks:
  - name: Make a tmp directory
    tempfile:
      state: directory
      suffix: _badges_tempdir
    register: tmp

  - set_fact:
      tempdir: tmp.path

  - name: clone the local bare repo
    git: dest={{tempdir}} repo=/git/badges remote=origin update=yes

  - name: add pagure as a second remote
    command: git remote add pagure {{upstream}} chdir={{tempdir}}

  - name: pull down changes from pagure
    command: git pull pagure master chdir={{tempdir}}

  - name: push pagure changes back to the lockbox bare repo
    command: git push origin master chdir={{tempdir}}

  - name: clean up that temporary {{tempdir}} dir
    file: dest={{tempdir}} state=absent

  - name: and pull those commits from the bare repo to the working dir
    command: git pull origin master chdir={{workingdir}}

  handlers:
  - import_tasks: "{{ handlers_path }}/restart_services.yml"

- name: copy new badge art over to the badges web nodes
  hosts: badges-web:badges-web-stg
  user: root
  gather_facts: False

  vars_files:
   - /srv/web/infra/ansible/vars/global.yml
   - "/srv/private/ansible/vars.yml"
   - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml

  roles:
   - badges/frontend

  handlers:
  - import_tasks: "{{ handlers_path }}/restart_services.yml"

- name: copy any new badges rules over to the badges backend and restart it
  hosts: badges-backend:badges-backend-stg
  user: root
  gather_facts: False

  vars_files:
   - /srv/web/infra/ansible/vars/global.yml
   - "/srv/private/ansible/vars.yml"
   - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml

  roles:
   - badges/backend

  handlers:
  - import_tasks: "{{ handlers_path }}/restart_services.yml"
Add a playbook for pushing out new badge content. 2014-10-03 13:14:38 +00:00			`# Push out any new badge stuff.`
			`#`
			`# Badge artists and badge developers should be pushing stuff to this repo:`
			`#`
Fedora-Badges renamed to fedora-badges Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr> 2017-11-28 11:55:30 +01:00			`# https://pagure.io/fedora-badges.git`
Add a playbook for pushing out new badge content. 2014-10-03 13:14:38 +00:00			`#`
			`# This playbook will take any new content from there and push it out onto our`
			`# servers.`

Remove mentions of lockbox01. 2015-09-25 18:49:17 +00:00			`- name: get the badges repo happening from the batcave`
			`hosts: batcave01.phx2.fedoraproject.org`
Add a playbook for pushing out new badge content. 2014-10-03 13:14:38 +00:00			`user: root`
			`gather_facts: False`

			`vars_files:`
			`- /srv/web/infra/ansible/vars/global.yml`
New ansible doesn't like expanding {{ private }} in the same list of vars files it's defined in. 2015-01-09 22:59:18 +00:00			`- "/srv/private/ansible/vars.yml"`
Add a playbook for pushing out new badge content. 2014-10-03 13:14:38 +00:00			`- /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml`

			`vars:`
Fedora-Badges renamed to fedora-badges Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr> 2017-11-28 11:55:30 +01:00			`upstream: "https://pagure.io/fedora-badges.git"`
Necessary to force a pull in this repo. 2016-01-15 16:17:42 +00:00			`workingdir: /srv/web/infra/badges/`
Add a playbook for pushing out new badge content. 2014-10-03 13:14:38 +00:00
			`tasks:`
Do not use a predictable directory name This is a potential security issue since /var/tmp is world writable, and so /var/tmp/badges-tempdir could be prefilled with a malicious repo. Malicious meaning: - one that would have open permission (so git pull do not fail) - with a hook triggered on update of the git repo (like pre-rebase) Since the playbook is running as root, this is bad (tm) 2018-07-11 11:23:56 +02:00			`- name: Make a tmp directory`
			`tempfile:`
			`state: directory`
Do not use slashes in suffix Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> 2018-07-25 17:48:11 +00:00			`suffix: _badges_tempdir`
Do not use a predictable directory name This is a potential security issue since /var/tmp is world writable, and so /var/tmp/badges-tempdir could be prefilled with a malicious repo. Malicious meaning: - one that would have open permission (so git pull do not fail) - with a hook triggered on update of the git repo (like pre-rebase) Since the playbook is running as root, this is bad (tm) 2018-07-11 11:23:56 +02:00			`register: tmp`

			`- set_fact:`
			`tempdir: tmp.path`

Add a playbook for pushing out new badge content. 2014-10-03 13:14:38 +00:00			`- name: clone the local bare repo`
			`git: dest={{tempdir}} repo=/git/badges remote=origin update=yes`

More changes to update manual/push-badges.yml for pagure 2017-03-23 16:19:30 +00:00			`- name: add pagure as a second remote`
			`command: git remote add pagure {{upstream}} chdir={{tempdir}}`
Add a playbook for pushing out new badge content. 2014-10-03 13:14:38 +00:00
More changes to update manual/push-badges.yml for pagure 2017-03-23 16:19:30 +00:00			`- name: pull down changes from pagure`
			`command: git pull pagure master chdir={{tempdir}}`
Add a playbook for pushing out new badge content. 2014-10-03 13:14:38 +00:00
More changes to update manual/push-badges.yml for pagure 2017-03-23 16:19:30 +00:00			`- name: push pagure changes back to the lockbox bare repo`
Add a playbook for pushing out new badge content. 2014-10-03 13:14:38 +00:00			`command: git push origin master chdir={{tempdir}}`

			`- name: clean up that temporary {{tempdir}} dir`
			`file: dest={{tempdir}} state=absent`

Necessary to force a pull in this repo. 2016-01-15 16:17:42 +00:00			`- name: and pull those commits from the bare repo to the working dir`
			`command: git pull origin master chdir={{workingdir}}`

Add forgotten handlers. 2015-01-06 16:30:46 +00:00			`handlers:`
switch all the include tasks to import tasks 2017-10-17 17:37:03 +00:00			`- import_tasks: "{{ handlers_path }}/restart_services.yml"`
Add forgotten handlers. 2015-01-06 16:30:46 +00:00
Add a playbook for pushing out new badge content. 2014-10-03 13:14:38 +00:00			`- name: copy new badge art over to the badges web nodes`
semi colin is no longer used for host/group seperator. Only use : 2016-11-04 18:27:42 +00:00			`hosts: badges-web:badges-web-stg`
Add a playbook for pushing out new badge content. 2014-10-03 13:14:38 +00:00			`user: root`
			`gather_facts: False`

			`vars_files:`
			`- /srv/web/infra/ansible/vars/global.yml`
New ansible doesn't like expanding {{ private }} in the same list of vars files it's defined in. 2015-01-09 22:59:18 +00:00			`- "/srv/private/ansible/vars.yml"`
Add a playbook for pushing out new badge content. 2014-10-03 13:14:38 +00:00			`- /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml`

			`roles:`
			`- badges/frontend`

Add forgotten handlers. 2015-01-06 16:30:46 +00:00			`handlers:`
switch all the include tasks to import tasks 2017-10-17 17:37:03 +00:00			`- import_tasks: "{{ handlers_path }}/restart_services.yml"`
Add forgotten handlers. 2015-01-06 16:30:46 +00:00
Add a playbook for pushing out new badge content. 2014-10-03 13:14:38 +00:00			`- name: copy any new badges rules over to the badges backend and restart it`
semi colin is no longer used for host/group seperator. Only use : 2016-11-04 18:27:42 +00:00			`hosts: badges-backend:badges-backend-stg`
Add a playbook for pushing out new badge content. 2014-10-03 13:14:38 +00:00			`user: root`
			`gather_facts: False`

			`vars_files:`
			`- /srv/web/infra/ansible/vars/global.yml`
New ansible doesn't like expanding {{ private }} in the same list of vars files it's defined in. 2015-01-09 22:59:18 +00:00			`- "/srv/private/ansible/vars.yml"`
Add a playbook for pushing out new badge content. 2014-10-03 13:14:38 +00:00			`- /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml`

			`roles:`
			`- badges/backend`
Add forgotten handlers. 2015-01-06 16:30:46 +00:00
			`handlers:`
switch all the include tasks to import tasks 2017-10-17 17:37:03 +00:00			`- import_tasks: "{{ handlers_path }}/restart_services.yml"`