ansible/roles/copr/backend/tasks/main.yml

---
- name: mount fs
  import_tasks: "mount_fs.yml"

- name: setup networking
  import_tasks: "network.yml"
  when: datacenter != 'aws'

- name: create obsrun group for `sign' command
  group: name=obsrun

# pre-create copr user and group with predefined uid and gid
- group: name=copr gid=986
- user: name=copr group=copr uid=989 groups=obsrun

- name: install copr-backend and copr-selinux
  dnf:
    state: present
    name: copr-backend

- name: add additional packages for copr-backend
  dnf:
    state: present
    name:
      - python3-boto  # for aws ansible plugin
      - python3-copr-messaging
      - python3-glanceclient
      - python3-neutronclient
      - python3-keystoneclient
      - python3-dateutil
      - php-cli
      - nfs-utils
      - nagios-plugins-http
  tags:
    - packages

#- name: patch for prunerepo, issue 1090
#  patch: src=patches/prunerepo-dataloss.patch
#         dest=/usr/bin/prunerepo
#  tags: patches

- name: install openstackclient for image preparation
  dnf: state=present name=python3-openstackclient
  when: devel|bool

- name: make copr dirs
  file: state=directory path={{ item }}
  with_items:
  - /var/lib/copr/jobs
  - /var/lib/copr/public_html/results

- name: setup dirs there
  file: state=directory path="/home/copr/{{ item }}" owner=copr group=copr mode=0700
  with_items:
  - cloud
  - .ssh

- name: add copr-buildsys keys to copr user path
  copy: src="{{ item }}" dest=/home/copr/cloud/ owner=copr group=copr mode=0600
  with_fileglob:
   - "{{ private }}/files/openstack/copr-copr/*"

- name: setup privkey for copr user
  copy: src="{{ private }}/files/copr/buildsys.priv" dest=/home/copr/.ssh/id_rsa owner=copr group=copr mode=600

- name: setup copr user ssh config file
  copy: src="ssh_config" dest=/home/copr/.ssh/config  owner=copr group=copr mode=600

- name: check known_hosts file
  command: stat /home/copr/.ssh/known_hosts
  register: hostsstat
  check_mode: no
  changed_when: "1 != 1"
  ignore_errors: yes

- name: create empty known_hosts
  file: state=touch dest=/home/copr/.ssh/known_hosts owner=copr group=copr mode=600
  when: hostsstat.rc == 1

- name: replace bashrc for copr user
  copy: src="copr_bashrc" dest=/home/copr/.bashrc owner=copr group=copr mode=600

- name: auth_key so we can login to localhost as the copr user from the copr user
  authorized_key: user=copr key="{{ item }}"
  no_log: True
  with_file:
  - "provision/files/buildsys.pub"

- name: copy keystonerc
  template: src="keystonerc" dest=/root/ owner=root group=root mode=600
  when: not devel

- name: copy keystonerc for copr
  template: src="keystonerc" dest=/home/copr/cloud/keystonerc_proper_tenant owner=copr group=copr mode=600

- name: copy .boto file
  copy: src="boto" dest=/home/copr/.boto owner=copr group=copr

# setup webserver
- name: install lighttpd.conf
  template: src="lighttpd/lighttpd.conf" dest=/etc/lighttpd/lighttpd.conf owner=root group=root mode=0644
  notify:
  - restart lighttpd
  tags:
  - config
  - lighttpd_config

- name: add gzip content-encoding header by lua script
  template: src="lighttpd/content-encoding-gzip-if-exists.lua" dest=/etc/lighttpd/content-encoding-gzip-if-exists.lua owner=root group=root mode=0644
  notify:
  - restart lighttpd
  tags:
  - config

# TODO: move production to Let's Encrypt as well as devel
- name: install certificates for production
  when: not devel
  import_tasks: "install_certs.yml"

- name: letsencrypt cert
  include_role: name=copr/certbot
  tags:
  - config
  - certbot

- name: allow lighttpd set fds limit
  seboolean: name=httpd_setrlimit state=yes persistent=yes

- name: create directory for compress module of lighttpd
  file: path=/var/cache/lighttpd/compress owner=lighttpd group=lighttpd mode=0644 state=directory

# mime default to text/plain and enable dirlisting for indexes
- name: update lighttpd configs
  copy: src="lighttpd/{{ item }}" dest="/etc/lighttpd/conf.d/{{ item }}" owner=root group=root mode=0644
  with_items:
  - dirlisting.conf
  - mime.conf
  notify:
  - restart lighttpd
  tags:
  - config

- name: install custom lighttpd template for directory listings
  template: src="lighttpd/dir-generator.php.j2" dest="/var/lib/copr/public_html/dir-generator.php" owner=copr group=copr mode=0755

- name: install the helper scripts for lighttpd log rotation
  copy:
    src: "{{ item }}"
    dest: /usr/local/bin/{{ item }}
    mode: 0755
    owner: root
    group: root
  with_items:
    - copr-lighty-logger
    - copr-lighty-reopen-logs
  register: logrotate_scripts
  tags: logrotate

- name: fix selinux context on helper scripts
  command: restorecon -irv /usr/local/bin/copr-lighty*
  when: logrotate_scripts.changed
  tags: logrotate

- name: install custom logrotate config for lighttpd
  template: src="logrotate/lighttpd.j2" dest=/etc/logrotate.d/lighttpd owner=root group=root mode=644
  tags: logrotate

- name: start webserver
  service: state=started enabled=yes name=lighttpd

- name: restart node exporter
  service: state=restarted enabled=yes name=node_exporter

# setup dirs for the ansible execution off of provisioning
#- name: dirs from provision
#  file: state=directory path="/home/copr/provision/{{ item }}" owner=copr group=copr
#  with_items:
#  - action_plugins
#  - library
#  tags:
#  - provision_config
#
- name: calculate the maximum resalloc workers per architecture
  set_fact: "max_{{ item }}_workers={{ builders | community.general.json_query('*.'+item+'[0]') | sum() }}"
  with_items:
    - aarch64
    - ppc64le
    - x86_64
    - s390x
  tags:
  - provision_config

- name: calculate max number of workers
  set_fact: "max_workers={{ max_x86_64_workers|int + max_aarch64_workers|int + max_ppc64le_workers|int + max_s390x_workers|int }}"
  tags:
  - provision_config

- name: print max arch workers
  debug: "var=max_{{ item }}_workers"
  with_items:
    - x86_64
    - aarch64
  tags:
  - provision_config

- name: resalloc
  import_tasks: resalloc.yml
  tags:
  - resalloc

- name: put ansible.cfg for all this into /etc/ansible/ on the system
  copy: src="provision/ansible.cfg" dest=/etc/ansible/ansible.cfg
  tags:
  - provision_config

- name: install .ansible.cfg for copr user
  copy: src=ansible.cfg dest=/home/copr/.ansible.cfg
        owner=copr group=copr mode=600
  tags:
  - provision_config

- name: setup provision directory
  include_tasks: setup_provisioning_environment.yml
  vars:
    cloud_vars: true
    provision_directory: /home/copr/provision
    provision_user: copr
  tags:
  - always

- name: copy image preparation scripts
  copy: src="{{ item }}" dest=/usr/local/bin/
        owner=root mode=755
  with_fileglob:
   - copr-builder-image-*.sh
  when: devel|bool
  tags:
  - provision_config

- name: testing fixture
  copy: dest="/home/copr/cloud/ec2rc.variable" content=""
  when: devel|bool

- name: copy copr-be.conf
  template: src="copr-be.conf.j2" dest=/etc/copr/copr-be.conf  owner=root group=copr mode=640
  notify:
  - restart copr-backend
  tags:
  - config
  - copr_infrastructure_password
  - provision_config

- name: create messaging config directory
  file: dest=/etc/copr/msgbuses state=directory owner=copr group=copr mode=0700
  when: copr_messaging
  tags:
  - config

- name: install messaging config
  template: src="fedora-messaging.conf.j2"
            dest=/etc/copr/msgbuses/fedora-messaging.conf
            owner=copr group=copr mode=0600
  when: copr_messaging
  notify:
  - restart copr-backend
  tags:
  - config

- name: copy sign.conf
  template: src=sign.conf dest=/etc/sign.conf  owner=root group=copr mode=640
  tags:
  - config

- name: get owner for results dir
  stat: path=/var/lib/copr/public_html
  check_mode: no
  register: copr_results_dir_st

- name: change owner for results dir if it isn't copr
  shell: "chown -R copr:copr /var/lib/copr/public_html"
  when: '"copr" not in copr_results_dir_st.stat.pw_name'

- command: "ls -dZ /var/lib/copr/public_html/"
  register: public_html_ls
  check_mode: no
  changed_when: False

- name: update selinux context for results if root folder does not have proper type
  command: "restorecon -vvRF /var/lib/copr/public_html/"
  when: "public_html_ls is defined and 'copr_data_t' not in  public_html_ls.stdout"

# - name: install cert to access fed-cloud09
#   # TODO: remove this when fed-cloud09 receives external cert
#   import_tasks: install_cloud_cert.yml

- name: enable and run copr-backend services
  service: name="{{ item }}" enabled=yes state=started
  when: not services_disabled|bool
  with_items:
  - redis       # TODO: .service in copr-backend should depend on redis
  - "{{ copr_backend_target }}"

- name: install aws cleaning script
  copy: src="cleanup-vms-aws" dest=/usr/local/bin/ mode=755

- name: install aws cleaning script for resalloc
  copy: src="cleanup-vms-aws-resalloc" dest=/usr/local/bin/ mode=755

- name: access.redhat.com offline token file
  set_fact: "rhn_offline_token_file=/var/lib/resallocserver/.access.redhat.com-copr-team"
  tags:
    - clean_rh_subscriptions

- name: install offline token for copr-team in RHSM
  copy:
    content: "{{ copr_red_hat_subscription_offline_token }}"
    dest: "{{ rhn_offline_token_file }}"
    mode: 0600
    owner: resalloc
    group: resalloc
  tags:
    - clean_rh_subscriptions

- name: install cleanup-unused-vms script
  template:
    src: "{{ item }}"
    dest: /usr/local/bin/{{ item }}
    mode: 0755
  loop:
    - cleanup-unused-vms-from-redis
    - cleanup-unused-redhat-subscriptions
  tags:
    - clean_rh_subscriptions

- name: setup crontab for VMs
  cron: name="cleanup nova VMs periodically"
        job="/usr/bin/cleanup_vm_nova.py"
        minute="*/20"
        user=copr
        state=absent

- name: setup crontab for VMs
  cron: name="cleanup AWS VMs periodically"
        job="/usr/local/bin/cleanup-vms-aws"
        minute="0"
        user=copr
        state=absent

- name: setup crontab for cleaning up redis
  cron: name="prune redis VM db periodically"
        job="/usr/local/bin/cleanup-unused-vms-from-redis &>> /var/log/copr-backend/cleanup-redis-vms.log"
        minute="50"
        user=copr
        state=absent

- name: crontab for cleaning resalloc VMs
  cron: name="cleanup nova VMs periodically"
        job="/usr/local/bin/cleanup-vms-aws-resalloc &>> /var/log/resallocserver/cron-cleanup-vms-aws.log"
        minute="*/10"
        user=resalloc

- name: crontab for cleaning-up unused subscriptions
  cron: name="cleanup unused Red Hat subscribed systems"
        job="/usr/local/bin/cleanup-unused-redhat-subscriptions &>> /var/log/resallocserver/cron-cleanup-rh-subscriptions.log"
        minute="*/30"
        user=resalloc
  tags:
    - clean_rh_subscriptions

- name: setup monitoring
  import_tasks: "monitoring.yml"

# Three tasks for handling our custom selinux module
- name: ensure a directory exists for our custom selinux module
  file: dest=/usr/local/share/copr state=directory

- name: copy over our custom selinux module
  copy: src=selinux/copr_rules.pp dest=/usr/local/share/copr/copr_rules.pp
  register: selinux_module

- name: install our custom selinux module
  command: semodule -i /usr/local/share/copr/copr_rules.pp
  when: selinux_module is changed

- name: disable swap mount in fstab
  mount:
   path: none
   src: /dev/vdb
   fstype: swap
   state: absent

# - name: detect if swap is enabled
#   shell: test -z "$(swapon -s)"
#   register: swap_enabled
#   changed_when: false
#   failed_when: false
# 
# - name: disable swap so that OOM killer can do his job
#   command: swapoff -a
#   when: swap_enabled.rc != 0

- name: setup AWS access
  import_tasks: "aws.yml"
  tags:
  - config
  - aws_config

- name: copr-ping-account
  import_tasks: copr-ping.yml
  tags: copr_ping