ansible/playbooks/openshift-apps/badges.yml

#
# Badges (fedbadges & Tahrir)
#

---
- name: Setup the database
  hosts: db01.iad2.fedoraproject.org:db01.stg.iad2.fedoraproject.org
  gather_facts: no
  become: yes
  become_user: postgres
  vars_files:
    - /srv/web/infra/ansible/vars/global.yml
    - /srv/private/ansible/vars.yml
    - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
    - /srv/web/infra/ansible/vars/apps/badges.yml

  tasks:
    - name: DB user
      community.postgresql.postgresql_user:
        name: "{{ tahrirDBUser }}"
        password: "{{ (env == 'production') | ternary(tahrirDBPassword, tahrirstgDBPassword) }}"
    - name: Database creation
      community.postgresql.postgresql_db:
        name: "{{ badges_db_name }}"
        owner: "{{ tahrirDBUser }}"
        encoding: UTF-8

- name: Give access to the datanommer DB
  hosts: datanommer_dbserver:datanommer_dbserver_stg
  gather_facts: no
  become: yes
  become_user: postgres
  vars_files:
    - /srv/web/infra/ansible/vars/global.yml
    - /srv/private/ansible/vars.yml
    - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
    - /srv/web/infra/ansible/vars/apps/badges.yml

  tasks:
    - name: DB user
      community.postgresql.postgresql_user:
        name: "{{ tahrirDBUser }}"
        password: "{{ (env == 'production') | ternary(tahrirDBPassword, tahrirstgDBPassword) }}"
    - name: Grant the db user read only access to datanommer2
      community.postgresql.postgresql_privs:
        database: datanommer2
        privs: SELECT
        objs: ALL_IN_SCHEMA
        roles: "{{ tahrirDBUser }}"

- name: Make the app be real
  hosts: os_control_stg:os_control
  user: root
  gather_facts: false

  vars_files:
    - /srv/web/infra/ansible/vars/global.yml
    - /srv/private/ansible/vars.yml
    - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
    - /srv/web/infra/ansible/vars/apps/badges.yml

  roles:
    - role: rabbit/user
      user_name: "tahrir{{ env_suffix }}"
      user_sent_topics: ^org\.fedoraproject\.{{ env_short }}\.badges\..*
      tags:
        - config
        - fedora-messaging
        - rabbitmq_cluster
    - role: rabbit/queue
      queue_username: "fedbadges{{ env_suffix }}"
      queue_name: "fedbadges{{ env_suffix }}"
      queue_routing_keys:
      # The badges queue is subscribed to everything
        - "#"
      queue_thresholds:
        warning: 20000
        critical: 25000
      # It sends a message when a badge is awarded
      user_sent_topics: ^org\.fedoraproject\.{{ env_short }}\.badges\..*
      tags:
        - config
        - fedora-messaging
        - rabbitmq_cluster

    - role: openshift/project
      project_app: badges
      project_description: "Badges"
      project_appowners:
        - abompard
        - nphilipp
        - ryanlerch
      tags:
        - apply-appowners

    - role: openshift/object
      object_app: badges
      object_file: imagestream.yml
      object_objectname: imagestream.yml

    - role: openshift/object
      object_app: badges
      object_template: buildconfig.yml.j2
      object_objectname: buildconfig.yml

    - role: openshift/object
      object_app: badges
      object_template: secrets.yml.j2
      object_objectname: secrets.yml

    - role: openshift/object
      object_app: badges
      object_template: configmap.yml.j2
      object_objectname: configmap.yml

    - role: openshift/object
      object_app: badges
      object_file: service.yml
      object_objectname: service.yml

    - role: openshift/object
      object_app: badges
      object_file: storage.yml
      object_objectname: storage.yml

    # Routes
    - role: openshift/route
      route_app: badges
      route_name: frontend
      route_host: "badges{{ env_suffix }}.fedoraproject.org"
      route_servicename: frontend
      route_serviceport: web
      route_annotations:
        haproxy.router.openshift.io/timeout: 5m
    - role: openshift/route
      route_app: badges
      route_name: frontend-openshift
      route_host: "badges.apps.ocp{{ env_suffix }}.fedoraproject.org"
      route_servicename: frontend
      route_serviceport: web
      route_annotations:
        haproxy.router.openshift.io/timeout: 5m

    # Fedora Messaging
    - role: openshift/secret-file
      secret_file_app: badges
      secret_file_secret_name: fedora-messaging-ca
      secret_file_key: cacert.pem
      secret_file_privatefile: "rabbitmq/{{env}}/ca-combined.crt"
    - role: openshift/secret-file
      secret_file_app: badges
      secret_file_secret_name: fedora-messaging-crt
      secret_file_key: fedbadges-cert.pem
      secret_file_privatefile: "rabbitmq/{{env}}/pki/issued/fedbadges{{env_suffix}}.crt"
    - role: openshift/secret-file
      secret_file_app: badges
      secret_file_secret_name: fedora-messaging-key
      secret_file_key: fedbadges-key.pem
      secret_file_privatefile: "rabbitmq/{{env}}/pki/private/fedbadges{{env_suffix}}.key"

    - role: openshift/secret-file
      secret_file_app: badges
      secret_file_secret_name: tahrir-fedora-messaging-crt
      secret_file_key: tahrir-cert.pem
      secret_file_privatefile: "rabbitmq/{{env}}/pki/issued/tahrir{{env_suffix}}.crt"
    - role: openshift/secret-file
      secret_file_app: badges
      secret_file_secret_name: tahrir-fedora-messaging-key
      secret_file_key: tahrir-key.pem
      secret_file_privatefile: "rabbitmq/{{env}}/pki/private/tahrir{{env_suffix}}.key"

    # FASJSON access
    - role: openshift/ipa-client
      ipa_client_app: badges
    - role: openshift/keytab
      keytab_app: badges
      keytab_key: fedbadges.keytab
      keytab_secret_name: fedbadges-keytab
      keytab_service: fedbadges

    # Deployment config
    - role: openshift/object
      object_app: badges
      object_template: deploymentconfig.yml.j2
      object_objectname: deploymentconfig.yml

    # Cron jobs
    - role: openshift/object
      object_app: badges
      object_template: cron-award.yml.j2
      object_objectname: cron-award.yml
    - role: openshift/object
      object_app: badges
      object_template: cron-update-rules.yml.j2
      object_objectname: cron-update-rules.yml

    - role: openshift/start-build
      start_build_app: badges
      start_build_buildname: "{{ dcname }}"
      loop:
      - fedbadges
      - tahrir
      loop_control:
        loop_var: dcname
      tags:
      - never
      - build

    - role: openshift/rollout
      rollout_app: badges
      rollout_dcname: "{{ dcname }}"
      loop:
      - fedbadges
      - tahrir
      loop_control:
        loop_var: dcname
      tags:
      - never
      - rollout