ansible/roles/copr/backend/tasks/main.yml

---
- name: mount fs
  import_tasks: "mount_fs.yml"

- name: setup networking
  import_tasks: "network.yml"

- name: create obsrun group for `sign' command
  group: name=obsrun

# pre-create copr user and group with predefined uid and gid
- group: name=copr gid=986
- user: name=copr group=copr uid=989 groups=obsrun

- name: install copr-backend and copr-selinux
  dnf:
    state: present
    name: copr-backend

- name: add additional packages for copr-backend
  dnf:
    state: present
    name:
      - python3-copr-messaging
      - python3-glanceclient
      - python3-neutronclient
      - python3-keystoneclient
      - php-cli
      - cronolog
      - nfs-utils

#- name: patch for prunerepo, issue 1090
#  patch: src=patches/prunerepo-dataloss.patch
#         dest=/usr/bin/prunerepo
#  tags: patches

- name: install openstackclient for image preparation
  dnf: state=present name=python3-openstackclient
  when: devel|bool

# disable this in favor of excluding it in /etc/dnf/dnf.conf.
# https://github.com/ansible/ansible/issues/33187
#- name: install python2-novaclient version that actually works with the current OpenStack deployment
#  dnf: state=present name=https://kojipkgs.fedoraproject.org/packages/python-novaclient/3.3.1/3.fc25/noarch/python3-novaclient-3.3.1-3.fc25.noarch.rpm

- name: make copr dirs
  file: state=directory path={{ item }}
  with_items:
  - /var/lib/copr/jobs
  - /var/lib/copr/public_html/results

- name: setup dirs there
  file: state=directory path="/home/copr/{{ item }}" owner=copr group=copr mode=0700
  with_items:
  - cloud
  - .ssh

- name: add copr-buildsys keys to copr user path
  copy: src="{{ item }}" dest=/home/copr/cloud/ owner=copr group=copr mode=0600
  with_fileglob:
   - "{{ private }}/files/openstack/copr-copr/*"

- name: setup privkey for copr user
  copy: src="{{ private }}/files/copr/buildsys.priv" dest=/home/copr/.ssh/id_rsa owner=copr group=copr mode=600

- name: setup copr user ssh config file
  copy: src="ssh_config" dest=/home/copr/.ssh/config  owner=copr group=copr mode=600

- name: check known_hosts file
  command: stat /home/copr/.ssh/known_hosts
  register: hostsstat
  check_mode: no
  changed_when: "1 != 1"
  ignore_errors: yes

- name: create empty known_hosts
  file: state=touch dest=/home/copr/.ssh/known_hosts owner=copr group=copr mode=600
  when: hostsstat.rc == 1

- name: replace bashrc for copr user
  copy: src="copr_bashrc" dest=/home/copr/.bashrc owner=copr group=copr mode=600

- name: auth_key so we can login to localhost as the copr user from the copr user
  authorized_key: user=copr key="{{ item }}"
  no_log: True
  with_file:
  - "provision/files/buildsys.pub"

- name: copy keystonerc
  template: src="keystonerc" dest=/root/ owner=root group=root mode=600
  when: not devel

- name: copy keystonerc for copr
  template: src="keystonerc" dest=/home/copr/cloud/keystonerc_proper_tenant owner=copr group=copr mode=600

- name: copy .boto file
  copy: src="boto" dest=/home/copr/.boto owner=copr group=copr

# setup webserver
- name: add access_log.conf for lighttpd
  copy: src="lighttpd/access_log.conf" dest=/etc/lighttpd/conf.d/access_log.conf owner=root group=root mode=0644
  notify:
  - restart lighttpd
  tags:
  - config

- name: add config for copr-repo path
  copy: src="{{ _lighttpd_conf_src }}" dest=/etc/lighttpd/lighttpd.conf owner=root group=root mode=0644
  notify:
  - restart lighttpd
  tags:
  - config

# TODO: move production to Let's Encrypt as well as devel
- name: install certificates for production
  when: not devel
  import_tasks: "install_certs.yml"

- name: letsencrypt cert
  include_role: name=copr/certbot
  when: devel|bool
  tags:
  - config

- name: allow lighttpd set fds limit
  seboolean: name=httpd_setrlimit state=yes persistent=yes

- name: create directory for compress module of lighttpd
  file: path=/var/cache/lighttpd/compress owner=lighttpd group=lighttpd mode=0644 state=directory

# mime default to text/plain and enable dirlisting for indexes
- name: update lighttpd configs
  copy: src="lighttpd/{{ item }}" dest="/etc/lighttpd/conf.d/{{ item }}" owner=root group=root mode=0644
  with_items:
  - dirlisting.conf
  - mime.conf
  notify:
  - restart lighttpd
  tags:
  - config

- name: provisional copr-backend cron.weekly job
  copy: src="cron.weekly/copr-backend" dest="/etc/cron.weekly/copr-backend" owner=root group=root mode=0644

- name: install custom lighttpd template for directory listings
  template: src="lighttpd/dir-generator.php.j2" dest="/var/lib/copr/public_html/dir-generator.php" owner=copr group=copr mode=0755

- name: install custom logrotate config for lighttpd
  template: src="logrotate/lighttpd.j2" dest=/etc/logrotate.d/lighttpd owner=root group=root mode=644

- name: start webserver
  service: state=started enabled=yes name=lighttpd

# setup dirs for the ansible execution off of provisioning
#- name: dirs from provision
#  file: state=directory path="/home/copr/provision/{{ item }}" owner=copr group=copr
#  with_items:
#  - action_plugins
#  - library
#  tags:
#  - provision_config

- name: resalloc
  import_tasks: resalloc.yml
  tags:
  - resalloc

- name: put ansible.cfg for all this into /etc/ansible/ on the system
  copy: src="provision/ansible.cfg" dest=/etc/ansible/ansible.cfg
  tags:
  - provision_config

- name: install .ansible.cfg for copr user
  copy: src=ansible.cfg dest=/home/copr/.ansible.cfg
        owner=copr group=copr mode=600
  tags:
  - provision_config

- name: put provisioning files
  synchronize: src="provision/" dest="/home/copr/provision/"
  tags:
  - provision_config

- name: "put provisioning files [remove mock config leftovers]"
  synchronize: src="provision/files/mock/" dest="/home/copr/provision/files/mock/"
               delete=yes
  tags:
  - provision_config

- name: put some files into the provision subdir
  template:
    src: "provision/{{ item }}"
    dest: "/home/copr/provision/{{ item }}"
  with_items:
  - vars.yml
  - nova_cloud_vars.yml
  - aws_cloud_vars.yml
  tags:
  - provision_config

- name: put copr-rpmbuild configuration file into the provision subdir
  template: src="provision/copr-rpmbuild/main.ini.j2" dest="/home/copr/provision/files/main.ini" owner=copr group=copr
  tags:
  - provision_config

- name: put rpkg configuration file into the provision subdir
  template: src="provision/rpkg.conf.j2" dest="/home/copr/provision/files/rpkg.conf" owner=copr group=copr
  tags:
  - provision_config

- name: copy image preparation scripts
  copy: src="{{ item }}" dest=/usr/local/bin/
        owner=root mode=755
  with_fileglob:
   - copr-builder-image-*.sh
  when: devel|bool
  tags:
  - provision_config

- name: testing fixture
  copy: dest="/home/copr/cloud/ec2rc.variable" content=""
  when: devel|bool

- name: copy copr-be.conf
  template: src="copr-be.conf.j2" dest=/etc/copr/copr-be.conf  owner=root group=copr mode=640
  notify:
  - restart copr-backend
  tags:
  - config
  - copr_infrastructure_password

- name: create messaging config directory
  file: dest=/etc/copr/msgbuses state=directory owner=copr group=copr mode=0700
  tags:
  - config

- name: install messaging config
  template: src="fedora-messaging.conf.j2"
            dest=/etc/copr/msgbuses/fedora-messaging.conf
            owner=copr group=copr mode=0600
  notify:
  - restart copr-backend
  tags:
  - config

- name: copy sign.conf
  template: src=sign.conf dest=/etc/sign.conf  owner=root group=copr mode=640
  tags:
  - config

- name: get owner for results dir
  stat: path=/var/lib/copr/public_html
  check_mode: no
  register: copr_results_dir_st

- name: change owner for results dir if it isn't copr
  shell: "chown -R copr:copr /var/lib/copr/public_html"
  when: '"copr" not in copr_results_dir_st.stat.pw_name'

- command: "ls -dZ /var/lib/copr/public_html/"
  register: public_html_ls
  check_mode: no
  changed_when: False

- name: update selinux context for results if root folder does not have proper type
  command: "restorecon -vvRF /var/lib/copr/public_html/"
  when: "public_html_ls is defined and 'copr_data_t' not in  public_html_ls.stdout"

- name: install cert to access fed-cloud09
  # TODO: remove this when fed-cloud09 receives external cert
  import_tasks: install_cloud_cert.yml

- name: enable and run copr-backend services
  service: name="{{ item }}" enabled=yes state=started
  with_items:
  - redis       # TODO: .service in copr-backend should depend on redis
  - copr-backend

- name: install aws cleaning script
  copy: src="cleanup-vms-aws" dest=/usr/local/bin/ mode=755

- name: install cleanup-unused-vms script
  template: src="cleanup-unused-vms-from-redis" dest=/usr/local/bin/cleanup-unused-vms-from-redis mode=755
  tags:
  - cleanup_scripts

- name: setup crontab for VMs
  cron: name="cleanup nova VMs periodically"
        job="/usr/bin/cleanup_vm_nova.py"
        minute="*/20"
        user=copr

- name: setup crontab for VMs
  cron: name="cleanup AWS VMs periodically"
        job="/usr/local/bin/cleanup-vms-aws"
        minute="0"
        user=copr

- name: setup crontab for cleaning up redis
  cron: name="prune redis VM db periodically"
        job="/usr/local/bin/cleanup-unused-vms-from-redis &>> /var/log/copr-backend/cleanup-redis-vms.log"
        minute="50"
        user=copr

- name: setup monitoring
  import_tasks: "monitoring.yml"

# Three tasks for handling our custom selinux module
- name: ensure a directory exists for our custom selinux module
  file: dest=/usr/local/share/copr state=directory

- name: copy over our custom selinux module
  copy: src=selinux/copr_rules.pp dest=/usr/local/share/copr/copr_rules.pp
  register: selinux_module

- name: install our custom selinux module
  command: semodule -i /usr/local/share/copr/copr_rules.pp
  when: selinux_module is changed

- name: disable swap mount in fstab
  mount:
   path: none
   src: /dev/vdb
   fstype: swap
   state: absent

# - name: detect if swap is enabled
#   shell: test -z "$(swapon -s)"
#   register: swap_enabled
#   changed_when: false
#   failed_when: false
# 
# - name: disable swap so that OOM killer can do his job
#   command: swapoff -a
#   when: swap_enabled.rc != 0

- name: setup AWS access
  import_tasks: "aws.yml"
  tags:
  - config
  - aws_config