forked from infra/ansible
migrate openshift-apps to use openshift/app-actions (#3459)
Reviewed-on: infra/ansible#3459
This commit is contained in:
parent
c089fea71e
commit
7b15ebf44a
77 changed files with 354 additions and 1290 deletions
|
|
@ -1,20 +0,0 @@
|
|||
---
|
||||
- name: Make the app be real
|
||||
hosts: localhost
|
||||
connection: local
|
||||
user: root
|
||||
gather_facts: false
|
||||
|
||||
vars_files:
|
||||
- /srv/web/infra/ansible/vars/global.yml
|
||||
- "/srv/private/ansible/vars.yml"
|
||||
- /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
|
||||
|
||||
module_defaults:
|
||||
group/awx.awx.controller:
|
||||
controller_host: awx.fedoraproject.org
|
||||
controller_username: "{{ awx_admin_username }}"
|
||||
controller_password: "{{ awx_admin_password }}"
|
||||
|
||||
roles:
|
||||
- role: awx/controller
|
||||
|
|
@ -115,12 +115,6 @@
|
|||
object_app: bodhi
|
||||
object_template: buildconfig.yml.j2
|
||||
object_objectname: buildconfig.yml
|
||||
- role: openshift/start-build
|
||||
start_build_app: bodhi
|
||||
start_build_buildname: bodhi-base
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
- role: openshift/object
|
||||
object_app: bodhi
|
||||
object_template_fullpath: "{{roles_path}}/bodhi2/base/templates/configmap.yml.j2"
|
||||
|
|
@ -158,24 +152,14 @@
|
|||
- role: openshift/imagestream
|
||||
imagestream_app: bodhi
|
||||
imagestream_imagename: bodhi-critpathcron
|
||||
- role: openshift/rollout
|
||||
rollout_app: bodhi
|
||||
rollout_dname: bodhi-web
|
||||
tags:
|
||||
- never
|
||||
- rollout
|
||||
- role: openshift/rollout
|
||||
rollout_app: bodhi
|
||||
rollout_dname: bodhi-consumer
|
||||
tags:
|
||||
- never
|
||||
- rollout
|
||||
- role: openshift/rollout
|
||||
rollout_app: bodhi
|
||||
rollout_dname: bodhi-celery
|
||||
tags:
|
||||
- never
|
||||
- rollout
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: bodhi
|
||||
app_actions_builds:
|
||||
- bodhi-base
|
||||
app_actions_deployments:
|
||||
- bodhi-web
|
||||
- bodhi-consumer
|
||||
- bodhi-celery
|
||||
|
||||
post_tasks:
|
||||
- name: Scale up pods
|
||||
|
|
|
|||
|
|
@ -83,3 +83,10 @@
|
|||
object_app: bugzilla2fedmsg
|
||||
object_template: deployment.yml.j2
|
||||
object_objectname: deployment.yml
|
||||
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: bugzilla2fedmsg
|
||||
app_actions_builds:
|
||||
- bugzilla2fedmsg-build
|
||||
app_actions_deployments:
|
||||
- bugzilla2fedmsg
|
||||
|
|
|
|||
|
|
@ -169,15 +169,14 @@
|
|||
object_template: container-secrets.yml.j2
|
||||
object_objectname: container-secrets.yml
|
||||
|
||||
- role: openshift/start-build
|
||||
start_build_app: cloud-image-uploader
|
||||
start_build_buildname: cloud-image-uploader-build
|
||||
start_build_objectname: cloud-image-uploader-build
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
|
||||
- role: openshift/object
|
||||
object_app: cloud-image-uploader
|
||||
object_template: deployment.yml.j2
|
||||
object_objectname: deployment.yml
|
||||
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: cloud-image-uploader
|
||||
app_actions_builds:
|
||||
- cloud-image-uploader-build
|
||||
app_actions_deployments:
|
||||
- cloud-image-uploader
|
||||
|
|
|
|||
|
|
@ -36,25 +36,17 @@
|
|||
object_template: buildconfig.yml.j2
|
||||
object_objectname: buildconfig.yml
|
||||
|
||||
- role: openshift/start-build
|
||||
start_build_app: compose-tracker
|
||||
start_build_buildname: compose-tracker-build
|
||||
start_build_objectname: compose-tracker-build
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
|
||||
- role: openshift/object
|
||||
object_app: compose-tracker
|
||||
object_template: deployment.yml.j2
|
||||
object_objectname: deployment.yml
|
||||
|
||||
- role: openshift/rollout
|
||||
rollout_app: compose-tracker
|
||||
rollout_dname: compose-tracker
|
||||
tags:
|
||||
- never
|
||||
- rollout
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: compose-tracker
|
||||
app_actions_builds:
|
||||
- compose-tracker-build
|
||||
app_actions_deployments:
|
||||
- compose-tracker
|
||||
|
||||
###############################################
|
||||
# actions to delete the project from OpenShift
|
||||
|
|
|
|||
|
|
@ -42,11 +42,6 @@
|
|||
object_template: buildconfig.yml.j2
|
||||
object_objectname: buildconfig.yml
|
||||
|
||||
- role: openshift/start-build
|
||||
start_build_app: coreos-cincinnati
|
||||
start_build_buildname: coreos-cincinnati-build
|
||||
start_build_objectname: coreos-cincinnati-build
|
||||
|
||||
- role: openshift/object
|
||||
object_app: coreos-cincinnati
|
||||
object_template: config-stub.yml.j2
|
||||
|
|
@ -57,11 +52,6 @@
|
|||
object_template: deployment.yml.j2
|
||||
object_objectname: deployment.yml
|
||||
|
||||
- role: openshift/rollout
|
||||
rollout_app: coreos-cincinnati
|
||||
rollout_dname: coreos-cincinnati
|
||||
tags: [never, rollout]
|
||||
|
||||
- role: openshift/object
|
||||
object_app: coreos-cincinnati
|
||||
object_template: service.yml.j2
|
||||
|
|
@ -100,6 +90,13 @@
|
|||
route_serviceport: coreos-cincinnati-raw-updates-status
|
||||
route_servicename: coreos-cincinnati
|
||||
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: coreos-cincinnati
|
||||
app_actions_builds:
|
||||
- coreos-cincinnati-build
|
||||
app_actions_deployments:
|
||||
- coreos-cincinnati
|
||||
|
||||
###############################################
|
||||
# actions to delete the project from OpenShift
|
||||
###############################################
|
||||
|
|
|
|||
|
|
@ -50,13 +50,12 @@
|
|||
object_template: buildconfig.yml.j2
|
||||
object_objectname: buildconfig.yml
|
||||
|
||||
- role: openshift/start-build
|
||||
start_build_app: coreos-koji-tagger
|
||||
start_build_buildname: coreos-koji-tagger-build
|
||||
start_build_objectname: coreos-koji-tagger-build
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: coreos-koji-tagger
|
||||
app_actions_builds:
|
||||
- coreos-koji-tagger-build
|
||||
app_actions_deployments:
|
||||
- coreos-koji-tagger
|
||||
|
||||
- role: openshift/object
|
||||
object_app: coreos-koji-tagger
|
||||
|
|
|
|||
|
|
@ -99,16 +99,9 @@
|
|||
object_template: deployment.yml.j2
|
||||
object_objectname: deployment.yml
|
||||
|
||||
# - role: openshift/start-build
|
||||
# start_build_app: datagrepper
|
||||
# start_build_buildname: datagrepper
|
||||
# tags:
|
||||
# - never
|
||||
# - build
|
||||
|
||||
# - role: openshift/rollout
|
||||
# rollout_app: datagrepper
|
||||
# rollout_dname: datagrepper
|
||||
# tags:
|
||||
# - never
|
||||
# - rollout
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: datagrepper
|
||||
app_actions_builds:
|
||||
- datagrepper
|
||||
app_actions_deployments:
|
||||
- datagrepper
|
||||
|
|
|
|||
|
|
@ -87,3 +87,10 @@
|
|||
object_app: datanommer
|
||||
object_template: cron.yml.j2
|
||||
object_objectname: cron.yml
|
||||
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: datanommer
|
||||
app_actions_builds:
|
||||
- datanommer
|
||||
app_actions_deployments:
|
||||
- datanommer
|
||||
|
|
|
|||
|
|
@ -71,16 +71,9 @@
|
|||
object_template: deployment.yml.j2
|
||||
object_objectname: deployment.yml
|
||||
|
||||
# - role: openshift/start-build
|
||||
# start_build_app: discourse2fedmsg
|
||||
# start_build_buildname: discourse2fedmsg
|
||||
# tags:
|
||||
# - never
|
||||
# - build
|
||||
|
||||
# - role: openshift/rollout
|
||||
# rollout_app: discourse2fedmsg
|
||||
# rollout_dname: discourse2fedmsg
|
||||
# tags:
|
||||
# - never
|
||||
# - rollout
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: discourse2fedmsg
|
||||
app_actions_builds:
|
||||
- discourse2fedmsg
|
||||
app_actions_deployments:
|
||||
- discourse2fedmsg
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
---
|
||||
- name: Make the app be real
|
||||
hosts: os_control_stg #:os_control
|
||||
hosts: os_control_stg # :os_control
|
||||
user: root
|
||||
gather_facts: false
|
||||
|
||||
|
|
|
|||
|
|
@ -37,12 +37,10 @@
|
|||
object_objectname: buildconfig.yml
|
||||
object_template: buildconfig.yml.j2
|
||||
|
||||
- role: openshift/start-build
|
||||
start_build_app: docsbuilding
|
||||
start_build_buildname: builder-build
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: docsbuilding
|
||||
app_actions_builds:
|
||||
- builder-build
|
||||
|
||||
- role: openshift/object
|
||||
object_app: docsbuilding
|
||||
|
|
|
|||
|
|
@ -80,6 +80,18 @@
|
|||
tags:
|
||||
- deploy-cronjob
|
||||
|
||||
- name: App actions
|
||||
ansible.builtin.include_role:
|
||||
name: openshift/app-actions
|
||||
vars:
|
||||
app_actions_app: docstranslation
|
||||
app_actions_builds:
|
||||
- docstranslation-build
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
- rebuild
|
||||
|
||||
###############################################
|
||||
# actions to delete the project from OpenShift
|
||||
###############################################
|
||||
|
|
|
|||
|
|
@ -26,14 +26,6 @@
|
|||
object_template: buildconfig.yml.j2
|
||||
object_objectname: buildconfig.yml
|
||||
|
||||
- role: openshift/start-build
|
||||
start_build_app: drm-panic-frontend
|
||||
start_build_buildname: drm-panic-frontend-build
|
||||
start_build_objectname: drm-panic-frontend-build
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
|
||||
- role: openshift/object
|
||||
object_app: drm-panic-frontend
|
||||
object_file: service.yml
|
||||
|
|
@ -51,9 +43,9 @@
|
|||
object_file: deployment.yml
|
||||
object_objectname: deployment.yml
|
||||
|
||||
- role: openshift/rollout
|
||||
rollout_app: drm-panic-frontend
|
||||
rollout_dcname: drm-panic-frontend
|
||||
tags:
|
||||
- never
|
||||
- rollout
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: drm-panic-frontend
|
||||
app_actions_builds:
|
||||
- drm-panic-frontend-build
|
||||
app_actions_deployments:
|
||||
- drm-panic-frontend
|
||||
|
|
|
|||
|
|
@ -95,14 +95,6 @@
|
|||
object_template: configmap.yml.j2
|
||||
object_objectname: configmap.yml
|
||||
|
||||
- role: openshift/start-build
|
||||
start_build_app: elections
|
||||
start_build_buildname: elections-build
|
||||
start_build_objectname: elections-build
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
|
||||
- role: openshift/object
|
||||
object_app: elections
|
||||
object_file: service.yml
|
||||
|
|
@ -121,3 +113,10 @@
|
|||
object_app: elections
|
||||
object_file: deployment.yml
|
||||
object_objectname: deployment.yml
|
||||
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: elections
|
||||
app_actions_builds:
|
||||
- elections-build
|
||||
app_actions_deployments:
|
||||
- elections
|
||||
|
|
|
|||
|
|
@ -110,16 +110,9 @@
|
|||
object_template: deployment.yml.j2
|
||||
object_objectname: deployment.yml
|
||||
|
||||
# - role: openshift/start-build
|
||||
# start_build_app: fasjson
|
||||
# start_build_buildname: fasjson
|
||||
# tags:
|
||||
# - never
|
||||
# - build
|
||||
|
||||
# - role: openshift/rollout
|
||||
# rollout_app: noggin
|
||||
# rollout_dname: noggin
|
||||
# tags:
|
||||
# - never
|
||||
# - rollout
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: fasjson
|
||||
app_actions_builds:
|
||||
- fasjson
|
||||
app_actions_deployments:
|
||||
- fasjson
|
||||
|
|
|
|||
|
|
@ -58,14 +58,6 @@
|
|||
object_template: configmap.yml.j2
|
||||
object_objectname: configmap.yml
|
||||
|
||||
- role: openshift/start-build
|
||||
start_build_app: fedocal
|
||||
start_build_buildname: fedocal-build
|
||||
start_build_objectname: fedocal-build
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
|
||||
- role: openshift/object
|
||||
object_app: fedocal
|
||||
object_file: service.yml
|
||||
|
|
@ -88,3 +80,10 @@
|
|||
object_file: cron.yml
|
||||
object_objectname: cron.yml
|
||||
when: env != 'staging'
|
||||
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: fedocal
|
||||
app_actions_builds:
|
||||
- fedocal-build
|
||||
app_actions_deployments:
|
||||
- fedocal
|
||||
|
|
|
|||
|
|
@ -45,6 +45,13 @@
|
|||
object_template: pvc.yml.j2
|
||||
object_objectname: pvc.yml
|
||||
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: fedora-ostree-pruner
|
||||
app_actions_builds:
|
||||
- fedora-ostree-pruner-build
|
||||
app_actions_deployments:
|
||||
- fedora-ostree-pruner
|
||||
|
||||
###############################################
|
||||
# actions to delete the project from OpenShift
|
||||
###############################################
|
||||
|
|
|
|||
|
|
@ -38,14 +38,6 @@
|
|||
object_template: configmap.yml.j2
|
||||
object_objectname: configmap.yml
|
||||
|
||||
- role: openshift/start-build
|
||||
start_build_app: fedora-packages-static
|
||||
start_build_buildname: fedora-packages-static-build
|
||||
start_build_objectname: fedora-packages-static-build
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
|
||||
- role: openshift/object
|
||||
object_app: fedora-packages-static
|
||||
object_file: service.yml
|
||||
|
|
@ -63,6 +55,14 @@
|
|||
object_template: deployment.yml.j2
|
||||
object_objectname: deployment.yml
|
||||
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: fedora-packages-static
|
||||
app_actions_builds:
|
||||
- fedora-packages-static-build
|
||||
app_actions_deployments:
|
||||
- fedora-packages-static
|
||||
- solr
|
||||
|
||||
###############################################
|
||||
# actions to delete the project from OpenShift
|
||||
###############################################
|
||||
|
|
|
|||
|
|
@ -45,14 +45,6 @@
|
|||
object_template: configmap.yml.j2
|
||||
object_objectname: configmap.yml
|
||||
|
||||
- role: openshift/start-build
|
||||
start_build_app: flatpak-indexer
|
||||
# This will trigger the main build via a imageChange trigger
|
||||
start_build_buildname: flatpak-indexer-tardiff-build
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
|
||||
- role: openshift/object
|
||||
object_app: flatpak-indexer
|
||||
object_file: service.yml
|
||||
|
|
@ -62,3 +54,13 @@
|
|||
object_app: flatpak-indexer
|
||||
object_template: deployment.yml.j2
|
||||
object_objectname: deployment.yml
|
||||
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: flatpak-indexer
|
||||
app_actions_builds:
|
||||
- flatpak-indexer-tardiff-build
|
||||
app_actions_deployments:
|
||||
- flatpak-indexer
|
||||
- flatpak-quay-indexer
|
||||
- flatpak-indexer-differ
|
||||
- redis
|
||||
|
|
|
|||
|
|
@ -234,3 +234,25 @@
|
|||
object_app: fmn
|
||||
object_template: cron.yml.j2
|
||||
object_objectname: cron.yml
|
||||
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: fmn
|
||||
app_actions_builds:
|
||||
- python-312-collectd
|
||||
app_actions_deployments:
|
||||
- frontend
|
||||
- api
|
||||
- fmn
|
||||
- sender-email
|
||||
- sender-irc
|
||||
- sender-matrix
|
||||
- redis
|
||||
- collectd
|
||||
# this build and deployment are stg only, hence separated
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: fmn
|
||||
app_actions_builds:
|
||||
- sendria
|
||||
app_actions_deployments:
|
||||
- sendria
|
||||
when: env == "staging"
|
||||
|
|
|
|||
|
|
@ -86,19 +86,11 @@
|
|||
tags:
|
||||
- apply-deploymentconfig
|
||||
|
||||
- role: openshift/rollout
|
||||
rollout_app: greenwave
|
||||
rollout_dname: greenwave-web
|
||||
tags:
|
||||
- never
|
||||
- rollout
|
||||
|
||||
- role: openshift/rollout
|
||||
rollout_app: greenwave
|
||||
rollout_dname: greenwave-fedmsg-consumers
|
||||
tags:
|
||||
- never
|
||||
- rollout
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: greenwave
|
||||
app_actions_deployments:
|
||||
- greenwave-web
|
||||
- greenwave-fedmsg-consumers
|
||||
|
||||
- name: Change the route haproxy default timeout
|
||||
hosts: os_control[0]:os_control_stg[0]
|
||||
|
|
|
|||
|
|
@ -1,3 +1,4 @@
|
|||
---
|
||||
#
|
||||
# Jira Sync
|
||||
# https://github.com/Zlopez/jira_sync
|
||||
|
|
@ -83,16 +84,9 @@
|
|||
object_template: cron.yml.j2
|
||||
object_objectname: cron.yml
|
||||
|
||||
- role: openshift/start-build
|
||||
start_build_app: jira-sync
|
||||
start_build_buildname: app
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
|
||||
- role: openshift/rollout
|
||||
rollout_app: jira-sync
|
||||
rollout_dname: app
|
||||
tags:
|
||||
- never
|
||||
- rollout
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: jira-sync
|
||||
app_actions_builds:
|
||||
- app
|
||||
app_actions_deployments:
|
||||
- app
|
||||
|
|
|
|||
|
|
@ -125,10 +125,9 @@
|
|||
route_serviceport: 8080-tcp
|
||||
route_servicename: kanban-web
|
||||
|
||||
- role: openshift/start-build
|
||||
start_build_app: kanban
|
||||
start_build_buildname: kanban-build
|
||||
start_build_objectname: kanban-build
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: kanban
|
||||
app_actions_builds:
|
||||
- kanban-build
|
||||
app_actions_deployments:
|
||||
- kanban-web
|
||||
|
|
|
|||
|
|
@ -111,3 +111,10 @@
|
|||
object_app: kerneltest
|
||||
object_file: deployment.yml
|
||||
object_objectname: deployment.yml
|
||||
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: kerneltest
|
||||
app_actions_builds:
|
||||
- kerneltest-build
|
||||
app_actions_deployments:
|
||||
- kerneltest
|
||||
|
|
|
|||
|
|
@ -100,3 +100,9 @@
|
|||
object_app: keycloak
|
||||
object_template: ipatuura-deployment.yml.j2
|
||||
object_objectname: ipatuura-deployment.yml
|
||||
|
||||
# since keycloak is managed by the operator, there isn't a way to restart it using openshift/app-actions (rollout), hence only restarting ipa-tuura
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: keycloak
|
||||
app_actions_deployments:
|
||||
- ipa-tuura
|
||||
|
|
|
|||
|
|
@ -86,3 +86,26 @@
|
|||
with_items: "{{ koschei_cron_jobs }}"
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
|
||||
- name: App actions
|
||||
ansible.builtin.include_role:
|
||||
name: openshift/app-actions
|
||||
vars:
|
||||
app_actions_app: "{{ app }}"
|
||||
app_actions_deployments:
|
||||
- admin
|
||||
- frontend
|
||||
- polling
|
||||
- scheduler
|
||||
- build-resolver
|
||||
- repo-resolver
|
||||
- watcher
|
||||
- name: App actions (staging only)
|
||||
ansible.builtin.include_role:
|
||||
name: openshift/app-actions
|
||||
vars:
|
||||
app_actions_app: "{{ app }}"
|
||||
app_actions_deployments:
|
||||
- copr-resolver
|
||||
- copr-scheduler
|
||||
when: env == "staging"
|
||||
|
|
|
|||
|
|
@ -27,12 +27,12 @@
|
|||
object_objectname: buildconfig.yml
|
||||
object_template: buildconfig.yml.j2
|
||||
|
||||
- role: openshift/start-build
|
||||
start_build_app: languages
|
||||
start_build_buildname: build-latest
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: languages
|
||||
app_actions_builds:
|
||||
- build-latest
|
||||
app_actions_deployments:
|
||||
- web
|
||||
|
||||
- role: openshift/object
|
||||
object_app: languages
|
||||
|
|
|
|||
|
|
@ -92,14 +92,6 @@
|
|||
secret_file_key: maubot.ca
|
||||
secret_file_privatefile: "rabbitmq/{{env}}/ca-combined.crt"
|
||||
|
||||
- role: openshift/start-build
|
||||
start_build_app: maubot
|
||||
start_build_buildname: maubot-build
|
||||
start_build_objectname: maubot-build
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
|
||||
- role: openshift/object
|
||||
object_app: maubot
|
||||
object_file: service.yml
|
||||
|
|
@ -117,6 +109,12 @@
|
|||
object_template: deployment.yml
|
||||
object_objectname: deployment.yml
|
||||
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: maubot
|
||||
app_actions_builds:
|
||||
- maubot-build
|
||||
app_actions_deployments:
|
||||
- maubot
|
||||
###############################################
|
||||
# actions to delete the project from OpenShift
|
||||
###############################################
|
||||
|
|
|
|||
|
|
@ -61,14 +61,6 @@
|
|||
tags:
|
||||
- cron-job
|
||||
|
||||
- role: openshift/start-build
|
||||
start_build_app: mdapi
|
||||
start_build_buildname: mdapi-build
|
||||
start_build_objectname: mdapi-build
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
|
||||
- role: openshift/object
|
||||
object_app: mdapi
|
||||
object_file: service.yml
|
||||
|
|
@ -86,9 +78,9 @@
|
|||
object_template: deployment.yml.j2
|
||||
object_objectname: deployment.yml
|
||||
|
||||
- role: openshift/rollout
|
||||
rollout_app: mdapi
|
||||
rollout_dname: mdapi
|
||||
tags:
|
||||
- never
|
||||
- rollout
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: mdapi
|
||||
app_actions_builds:
|
||||
- mdapi-build
|
||||
app_actions_deployments:
|
||||
- mdapi
|
||||
|
|
|
|||
|
|
@ -164,16 +164,9 @@
|
|||
object_template: cron-primary-mirror.yml.j2
|
||||
object_objectname: cron-primary-mirror.yml
|
||||
|
||||
- role: openshift/start-build
|
||||
start_build_app: mirrormanager
|
||||
start_build_buildname: mirrormanager2
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
|
||||
- role: openshift/rollout
|
||||
rollout_app: mirrormanager
|
||||
rollout_dname: frontend
|
||||
tags:
|
||||
- never
|
||||
- rollout
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: mirrormanager
|
||||
app_actions_builds:
|
||||
- mirrormanager2
|
||||
app_actions_deployments:
|
||||
- frontend
|
||||
|
|
|
|||
|
|
@ -92,14 +92,15 @@
|
|||
route_annotations:
|
||||
haproxy.router.openshift.io/set-forwarded-headers: append
|
||||
|
||||
- role: openshift/start-build
|
||||
start_build_app: mote
|
||||
start_build_buildname: mote
|
||||
start_build_objectname: mote
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: mote
|
||||
app_actions_builds:
|
||||
- mote
|
||||
app_actions_deployments:
|
||||
- fedmsg
|
||||
- mote
|
||||
- mote-worker
|
||||
- redis
|
||||
#
|
||||
###############################################
|
||||
# actions to delete the project from OpenShift
|
||||
|
|
|
|||
|
|
@ -106,16 +106,9 @@
|
|||
object_template: deployment.yml.j2
|
||||
object_objectname: deployment.yml
|
||||
|
||||
- role: openshift/start-build
|
||||
start_build_app: noggin-centos
|
||||
start_build_buildname: noggin
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
|
||||
- role: openshift/rollout
|
||||
rollout_app: noggin-centos
|
||||
rollout_dname: noggin
|
||||
tags:
|
||||
- never
|
||||
- rollout
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: noggin-centos
|
||||
app_actions_builds:
|
||||
- noggin
|
||||
app_actions_deployments:
|
||||
- noggin
|
||||
|
|
|
|||
|
|
@ -102,16 +102,9 @@
|
|||
object_template: deployment.yml.j2
|
||||
object_objectname: deployment.yml
|
||||
|
||||
- role: openshift/start-build
|
||||
start_build_app: noggin
|
||||
start_build_buildname: noggin
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
|
||||
- role: openshift/rollout
|
||||
rollout_app: noggin
|
||||
rollout_dname: noggin
|
||||
tags:
|
||||
- never
|
||||
- rollout
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: noggin
|
||||
app_actions_builds:
|
||||
- noggin
|
||||
app_actions_deployments:
|
||||
- noggin
|
||||
|
|
|
|||
|
|
@ -67,12 +67,12 @@
|
|||
object_template: deployment.yml.j2
|
||||
object_objectname: deployment.yml
|
||||
|
||||
- role: openshift/start-build
|
||||
start_build_app: openvpn
|
||||
start_build_buildname: openvpn
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: openvpn
|
||||
app_actions_builds:
|
||||
- openvpn
|
||||
app_actions_deployments:
|
||||
- openvpn-client
|
||||
|
||||
###############################################
|
||||
# actions to delete the project from OpenShift
|
||||
|
|
|
|||
|
|
@ -129,10 +129,16 @@
|
|||
route_annotations:
|
||||
haproxy.router.openshift.io/set-forwarded-headers: append
|
||||
|
||||
- role: openshift/start-build
|
||||
start_build_app: oraculum
|
||||
start_build_buildname: packager-dashboard-build
|
||||
start_build_objectname: packager-dashboard-build
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: oraculum
|
||||
app_actions_builds:
|
||||
- packager-dashboard-build
|
||||
- packager-dashboard-frontend-build
|
||||
- packager-dashboard-redis-build
|
||||
app_actions_deployments:
|
||||
- oraculum-api-endpoint
|
||||
- oraculum-worker
|
||||
- oraculum-beat
|
||||
- oraculum-flower
|
||||
- oraculum-redis
|
||||
- oraculum-frontend
|
||||
|
|
|
|||
|
|
@ -103,3 +103,10 @@
|
|||
- role: rabbit/user
|
||||
user_name: "planet{{ env_suffix }}"
|
||||
user_sent_topics: ^org\.fedoraproject\.{{ env_short }}\.planet\..*
|
||||
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: planet
|
||||
app_actions_builds:
|
||||
- planet
|
||||
app_actions_deployments:
|
||||
- planet
|
||||
|
|
|
|||
|
|
@ -113,30 +113,32 @@
|
|||
object_objectname: imagestream.yml
|
||||
|
||||
tasks:
|
||||
- name: Include openshift/start-build role
|
||||
# doing it like this so it's dynamic and loads from vars/apps/poddlers.yml
|
||||
- name: App actions (build)
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
- rebuild
|
||||
block:
|
||||
# Use a block here to apply the tags to the tasks within the included role
|
||||
# https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_tags.html#tag-inheritance-for-includes-blocks-and-the-apply-keyword
|
||||
- name: Include openshift/start-build role
|
||||
- name: Include openshift/app-actions role
|
||||
ansible.builtin.include_role:
|
||||
name: openshift/start-build
|
||||
name: openshift/app-actions
|
||||
vars:
|
||||
start_build_app: poddlers
|
||||
start_build_buildname: toddlers
|
||||
|
||||
- name: Include openshift/rollout role
|
||||
app_actions_app: poddlers
|
||||
app_actions_builds:
|
||||
- toddlers
|
||||
- name: App actions (deployments)
|
||||
tags:
|
||||
- never
|
||||
- rollout
|
||||
- never
|
||||
- restart
|
||||
- rollout
|
||||
block:
|
||||
# Use a block here too, same reason as above
|
||||
- name: Include openshift/rollout role
|
||||
- name: Include openshift/app-actions role
|
||||
ansible.builtin.include_role:
|
||||
name: openshift/rollout
|
||||
name: openshift/app-actions
|
||||
vars:
|
||||
rollout_app: poddlers
|
||||
rollout_dname: "{{ item.name }}"
|
||||
app_actions_app: poddlers
|
||||
app_actions_deployments:
|
||||
- "{{ item.name }}"
|
||||
loop: "{{ poddlers_toddlers }}"
|
||||
when: "item.replicas | default(1) > 0"
|
||||
|
|
|
|||
|
|
@ -43,12 +43,6 @@
|
|||
object_app: release-monitoring
|
||||
object_template: buildconfig.yml.j2
|
||||
object_objectname: buildconfig.yml
|
||||
- role: openshift/start-build
|
||||
start_build_app: release-monitoring
|
||||
start_build_buildname: release-monitoring-web-build
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
- role: openshift/object
|
||||
object_app: release-monitoring
|
||||
object_template: configmap.yml.j2
|
||||
|
|
@ -65,9 +59,9 @@
|
|||
object_app: release-monitoring
|
||||
object_template: deployment.yml.j2
|
||||
object_objectname: deployment.yml
|
||||
- role: openshift/rollout
|
||||
rollout_app: release-monitoring
|
||||
rollout_dname: release-monitoring-web
|
||||
tags:
|
||||
- never
|
||||
- rollout
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: release-monitoring
|
||||
app_actions_builds:
|
||||
- release-monitoring-web-build
|
||||
app_actions_deployments:
|
||||
- release-monitoring-web
|
||||
|
|
|
|||
|
|
@ -83,3 +83,10 @@
|
|||
object_app: resultsdb-ci-listener
|
||||
object_template: deployment.yml.j2
|
||||
object_objectname: deployment.yml
|
||||
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: resultsdb-ci-listener
|
||||
app_actions_builds:
|
||||
- resultsdb-ci-listener
|
||||
app_actions_deployments:
|
||||
- resultsdb-ci-listener
|
||||
|
|
|
|||
|
|
@ -139,19 +139,8 @@
|
|||
route_servicename: resultsdb-frontend
|
||||
route_path: /
|
||||
|
||||
# rollouts
|
||||
- role: openshift/rollout
|
||||
rollout_app: resultsdb
|
||||
rollout_dname: "resultsdb-api"
|
||||
failed_when: false
|
||||
tags:
|
||||
- never
|
||||
- rollout
|
||||
|
||||
- role: openshift/rollout
|
||||
rollout_app: resultsdb
|
||||
rollout_dname: "resultsdb-frontend"
|
||||
failed_when: false
|
||||
tags:
|
||||
- never
|
||||
- rollout
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: resultsdb
|
||||
app_actions_deployments:
|
||||
- resultsdb-api
|
||||
- resultsdb-frontend
|
||||
|
|
|
|||
|
|
@ -33,15 +33,14 @@
|
|||
object_app: review-stats
|
||||
object_template: pvc.yml.j2
|
||||
object_objectname: pvc.yml
|
||||
- role: openshift/start-build
|
||||
start_build_app: review-stats
|
||||
start_build_buildname: builder-build
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
- role: openshift/object
|
||||
object_app: review-stats
|
||||
object_template: cron.yml.j2
|
||||
object_objectname: cron.yml
|
||||
tags:
|
||||
- deploy-cronjob
|
||||
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: review-stats
|
||||
app_actions_builds:
|
||||
- builder-build
|
||||
|
|
|
|||
|
|
@ -1,68 +0,0 @@
|
|||
---
|
||||
- name: Make the app be real
|
||||
hosts: os_masters[0]:os_masters_stg[0]
|
||||
user: root
|
||||
gather_facts: false
|
||||
|
||||
vars_files:
|
||||
- /srv/web/infra/ansible/vars/global.yml
|
||||
- "/srv/private/ansible/vars.yml"
|
||||
- /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
|
||||
|
||||
vars:
|
||||
|
||||
roles:
|
||||
- role: openshift/project
|
||||
project_app: test-auth
|
||||
project_description: "Authentication testing"
|
||||
project_appowners:
|
||||
- abompard
|
||||
tags:
|
||||
- apply-appowners
|
||||
|
||||
- role: openshift/imagestream
|
||||
imagestream_app: test-auth
|
||||
imagestream_imagename: test-auth
|
||||
|
||||
- role: openshift/object
|
||||
object_app: test-auth
|
||||
object_template: buildconfig.yml
|
||||
object_objectname: buildconfig.yml
|
||||
|
||||
- role: openshift/object
|
||||
object_app: test-auth
|
||||
object_template: configmap.yml
|
||||
object_objectname: configmap.yml
|
||||
|
||||
- role: openshift/object
|
||||
object_app: test-auth
|
||||
object_file: service.yml
|
||||
object_objectname: service.yml
|
||||
|
||||
# - role: openshift/route
|
||||
# route_app: test-auth
|
||||
# route_name: test-auth
|
||||
# route_host: "admin{{ env_suffix }}.fedoraproject.org"
|
||||
# route_path: "/test-auth"
|
||||
# route_serviceport: web
|
||||
# route_servicename: test-auth
|
||||
# route_annotations:
|
||||
# haproxy.router.openshift.io/timeout: 5m
|
||||
- role: openshift/route
|
||||
route_app: test-auth
|
||||
route_name: test-auth
|
||||
route_host: "test-auth.apps.ocp{{ env_suffix }}.fedoraproject.org"
|
||||
route_serviceport: web
|
||||
route_servicename: test-auth
|
||||
route_annotations:
|
||||
haproxy.router.openshift.io/timeout: 5m
|
||||
|
||||
- role: openshift/object
|
||||
object_app: test-auth
|
||||
object_template: secret-webhook.yml
|
||||
object_objectname: secret-webhook.yml
|
||||
|
||||
- role: openshift/object
|
||||
object_app: test-auth
|
||||
object_template: deploymentconfig.yml
|
||||
object_objectname: deploymentconfig.yml
|
||||
|
|
@ -105,10 +105,11 @@
|
|||
route_serviceport: 8080-tcp
|
||||
route_servicename: testdays
|
||||
|
||||
- role: openshift/start-build
|
||||
start_build_app: testdays
|
||||
start_build_buildname: testdays-build
|
||||
start_build_objectname: testdays-build
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: testdays
|
||||
app_actions_builds:
|
||||
- testdays-build
|
||||
- resultsdb-build
|
||||
app_actions_deployments:
|
||||
- testdays
|
||||
- resultsdb
|
||||
|
|
|
|||
|
|
@ -83,22 +83,14 @@
|
|||
object_template: configmap.yml.j2
|
||||
object_objectname: configmap.yml
|
||||
|
||||
- role: openshift/start-build
|
||||
start_build_app: the-new-hotness
|
||||
start_build_buildname: the-new-hotness-build
|
||||
start_build_objectname: the-new-hotness-build
|
||||
tags:
|
||||
- never
|
||||
- build
|
||||
|
||||
- role: openshift/object
|
||||
object_app: the-new-hotness
|
||||
object_template: deployment.yml.j2
|
||||
object_objectname: deployment.yml
|
||||
|
||||
- role: openshift/rollout
|
||||
rollout_app: the-new-hotness
|
||||
rollout_dname: the-new-hotness
|
||||
tags:
|
||||
- never
|
||||
- rollout
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: the-new-hotness
|
||||
app_actions_builds:
|
||||
- the-new-hotness-build
|
||||
app_actions_deployments:
|
||||
- the-new-hotness
|
||||
|
|
|
|||
|
|
@ -113,9 +113,7 @@
|
|||
object_template: deployment.yml.j2
|
||||
object_objectname: deployment.yml
|
||||
|
||||
- role: openshift/rollout
|
||||
rollout_app: waiverdb
|
||||
rollout_dname: waiverdb-web
|
||||
tags:
|
||||
- never
|
||||
- rollout
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: waiverdb
|
||||
app_actions_deployments:
|
||||
- waiverdb-web
|
||||
|
|
|
|||
|
|
@ -114,16 +114,9 @@
|
|||
object_template: deployment.yml.j2
|
||||
object_objectname: deployment.yml
|
||||
|
||||
# - role: openshift/start-build
|
||||
# start_build_app: webhook2fedmsg
|
||||
# start_build_buildname: webhook2fedmsg
|
||||
# tags:
|
||||
# - never
|
||||
# - build
|
||||
|
||||
# - role: openshift/rollout
|
||||
# rollout_app: webhook2fedmsg
|
||||
# rollout_dname: webhook2fedmsg
|
||||
# tags:
|
||||
# - never
|
||||
# - rollout
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: webhook2fedmsg
|
||||
app_actions_builds:
|
||||
- webhook2fedmsg
|
||||
app_actions_deployments:
|
||||
- webhook2fedmsg
|
||||
|
|
|
|||
|
|
@ -31,10 +31,13 @@
|
|||
object_template: buildconfig.yml.j2
|
||||
object_objectname: buildconfig.yml
|
||||
|
||||
- role: openshift/start-build
|
||||
start_build_app: websites
|
||||
start_build_buildname: websites-build
|
||||
start_build_objectname: websites-build
|
||||
# NOTE: this was the original start-build, without any tags
|
||||
# the current implementation with app-actions requires the build tag
|
||||
|
||||
# - role: openshift/start-build
|
||||
# start_build_app: websites
|
||||
# start_build_buildname: websites-build
|
||||
# start_build_objectname: websites-build
|
||||
|
||||
- role: openshift/object
|
||||
object_app: websites
|
||||
|
|
@ -45,3 +48,10 @@
|
|||
object_app: websites
|
||||
object_template: deployment.yml.j2
|
||||
object_objectname: deployment.yml
|
||||
|
||||
- role: openshift/app-actions
|
||||
app_actions_app: websites
|
||||
app_actions_builds:
|
||||
- websites-build
|
||||
app_actions_deployments:
|
||||
- fedoraproject-push
|
||||
|
|
|
|||
|
|
@ -1,3 +0,0 @@
|
|||
---
|
||||
collections:
|
||||
- awx.awx
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
---
|
||||
- name: Create Fedora Ansible Execution Environment
|
||||
execution_environment:
|
||||
name: Fedora ansible EE
|
||||
image: registry.gitlab.com/darknao/fedora-ansible-ee:latest
|
||||
pull: always
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
---
|
||||
- name: Define batcave01 as execution node
|
||||
instance:
|
||||
hostname: batcave01.vpn.fedoraproject.org
|
||||
node_type: execution
|
||||
|
||||
- name: Create batcave instance group
|
||||
instance_group:
|
||||
name: batcave
|
||||
instances:
|
||||
- batcave01.vpn.fedoraproject.org
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
---
|
||||
- include_tasks: saml2.yml
|
||||
- include_tasks: execution_environment.yml
|
||||
- include_tasks: org.yml
|
||||
- include_tasks: execution_nodes.yml
|
||||
- include_tasks: projects.yml
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
---
|
||||
- name: Create Fedora organization
|
||||
organization:
|
||||
name: Fedora
|
||||
description: Fedora Project Org
|
||||
|
|
@ -1,31 +0,0 @@
|
|||
---
|
||||
- name: Create Fedora Infra project
|
||||
project:
|
||||
name: Fedora Infra
|
||||
description: ""
|
||||
scm_type: git
|
||||
scm_url: https://pagure.io/fedora-infra/ansible.git
|
||||
scm_clean: true
|
||||
organization: Fedora
|
||||
scm_update_on_launch: true
|
||||
default_environment: Fedora ansible EE
|
||||
|
||||
- name: Create Fedora Infra Inventory
|
||||
inventory:
|
||||
name: Fedora Infra
|
||||
description: ""
|
||||
organization: Fedora
|
||||
|
||||
- name: Set up Fedora Infra Inventory source
|
||||
inventory_source:
|
||||
source_project: Fedora Infra
|
||||
inventory: Fedora Infra
|
||||
name: Fedora Infra Git
|
||||
source: scm
|
||||
source_path: inventory
|
||||
update_on_launch: true
|
||||
|
||||
- name: Trigger inventory update
|
||||
inventory_source_update:
|
||||
name: Fedora Infra Git
|
||||
inventory: Fedora Infra
|
||||
|
|
@ -1,50 +0,0 @@
|
|||
---
|
||||
- name: Configure SAML2 authentication
|
||||
settings:
|
||||
settings:
|
||||
SAML_AUTO_CREATE_OBJECTS: true
|
||||
SOCIAL_AUTH_SAML_SP_ENTITY_ID: https://awx.fedoraproject.org/
|
||||
SOCIAL_AUTH_SAML_SP_PUBLIC_CERT:
|
||||
"{{ lookup('file', '{{ private }}/files/awx/{{ env }}/awx-saml.crt') }}"
|
||||
SOCIAL_AUTH_SAML_SP_PRIVATE_KEY:
|
||||
"{{ lookup('file', '{{ private }}/files/awx/{{ env }}/awx-saml.key') }}"
|
||||
SOCIAL_AUTH_SAML_ORG_INFO:
|
||||
en-US:
|
||||
url: https://awx.fedoraproject.org/
|
||||
name: AWX
|
||||
displayname: Ansible AWX
|
||||
SOCIAL_AUTH_SAML_TECHNICAL_CONTACT:
|
||||
emailAddress: infrastructure@lists.fedoraproject.org
|
||||
givenName: Fedora Infrastructure
|
||||
SOCIAL_AUTH_SAML_SUPPORT_CONTACT:
|
||||
emailAddress: infrastructure@lists.fedoraproject.org
|
||||
givenName: Fedora Infrastructure
|
||||
SOCIAL_AUTH_SAML_ENABLED_IDPS:
|
||||
fedora:
|
||||
x509cert:
|
||||
"{{ lookup(
|
||||
'file',
|
||||
'{{ private }}/files/saml2/{{ env }}/keys/idp.crt'
|
||||
)
|
||||
| regex_replace('\n', '')
|
||||
}}"
|
||||
attr_email: "email"
|
||||
attr_first_name: "givenname"
|
||||
attr_last_name: "surname"
|
||||
attr_user_permanent_id: "name_id"
|
||||
attr_username: "name_id"
|
||||
entity_id: "https://id.fedoraproject.org/saml2/metadata"
|
||||
url: "https://id.fedoraproject.org/saml2/SSO/Redirect"
|
||||
SOCIAL_AUTH_SAML_SECURITY_CONFIG:
|
||||
authnRequestsSigned: true
|
||||
SOCIAL_AUTH_SAML_USER_FLAGS_BY_ATTR:
|
||||
is_superuser_attr: groups
|
||||
is_superuser_value:
|
||||
- sysadmin-main
|
||||
SOCIAL_AUTH_SAML_ORGANIZATION_MAP: {}
|
||||
SOCIAL_AUTH_SAML_TEAM_ATTR:
|
||||
saml_attr: groups
|
||||
remove: true
|
||||
team_org_map:
|
||||
- organization: Fedora
|
||||
team: fedora-websites
|
||||
|
|
@ -1,57 +0,0 @@
|
|||
---
|
||||
- name: Create the awx user
|
||||
user:
|
||||
name: awx
|
||||
ansible.builtin.shell: /bin/bash
|
||||
|
||||
- name: Enable Copr repo for Ansible Receptor (Fedora)
|
||||
community.general.copr:
|
||||
name: ansible-awx/receptor
|
||||
when: ansible_distribution == 'Fedora'
|
||||
|
||||
- name: Enable Copr repo for Ansible Receptor (RHEL)
|
||||
community.general.copr:
|
||||
name: ansible-awx/receptor
|
||||
chroot: epel-9-x86_64
|
||||
when:
|
||||
- ansible_distribution == 'RedHat'
|
||||
- ansible_distribution_major_version|int == 9
|
||||
|
||||
- name: Deploy podman
|
||||
include_role:
|
||||
name: awx/podman
|
||||
vars:
|
||||
podman_user: awx
|
||||
podman_group: awx
|
||||
|
||||
- name: Deploy Ansible Receptor
|
||||
include_role:
|
||||
name: awx/receptor
|
||||
vars:
|
||||
receptor_user: awx
|
||||
receptor_group: awx
|
||||
receptor_verify: true
|
||||
receptor_tls: true
|
||||
receptor_mintls13: false
|
||||
receptor_work_commands:
|
||||
ansible-runner:
|
||||
command: ansible-runner
|
||||
params: worker
|
||||
allowruntimeparams: true
|
||||
verifysignature: true
|
||||
custom_worksign_public_keyfile:
|
||||
"{{ private }}/files/awx/{{ inventory_hostname }}/work-public-key.pem"
|
||||
custom_tls_certfile: "{{ private }}/files/awx/{{ inventory_hostname }}/tls/receptor.crt"
|
||||
custom_tls_keyfile: "{{ private }}/files/awx/{{ inventory_hostname }}/tls/receptor.key"
|
||||
custom_ca_certfile: "{{ private }}/files/awx/{{ inventory_hostname }}/tls/ca/receptor-ca.crt"
|
||||
receptor_protocol: 'tcp'
|
||||
receptor_listener: true
|
||||
receptor_port: 27199
|
||||
receptor_dependencies:
|
||||
- python3-pip
|
||||
ansible_host: "{{ inventory_hostname }}"
|
||||
|
||||
- name: Install ansible-runner
|
||||
pip:
|
||||
name: ansible-runner
|
||||
executable: pip3
|
||||
|
|
@ -1,32 +0,0 @@
|
|||
# Ansible Role: Podman
|
||||
|
||||
Installs and configures Podman on RHEL/CentOS/Fedora servers.
|
||||
|
||||
## Role Variables
|
||||
|
||||
Available variables are listed below, along with default values.
|
||||
|
||||
---
|
||||
|
||||
podman_user: 'podman'
|
||||
podman_group: 'podman'
|
||||
|
||||
The user and group under which podman will be configured.
|
||||
|
||||
---
|
||||
|
||||
default_runtime: 'crun'
|
||||
|
||||
The default container runtime to use for Podman.
|
||||
|
||||
---
|
||||
|
||||
default_cgroup_manager: 'cgroupfs'
|
||||
|
||||
The default cgroup manager to use for Podman.
|
||||
|
||||
---
|
||||
|
||||
# License
|
||||
|
||||
Apache 2
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
---
|
||||
podman_user: 'podman'
|
||||
podman_group: 'podman'
|
||||
|
||||
default_runtime: 'crun'
|
||||
default_cgroup_manager: 'cgroupfs'
|
||||
|
||||
_hostname: "{{ routable_hostname | default(ansible_host) }}"
|
||||
|
|
@ -1,48 +0,0 @@
|
|||
---
|
||||
# Variable configuration.
|
||||
- include_tasks: variables.yml
|
||||
|
||||
# Setup/install tasks.
|
||||
- include_tasks: setup-RedHat.yml
|
||||
when: ansible_os_family == 'RedHat'
|
||||
|
||||
- name: Create directory for podman runtime config
|
||||
ansible.builtin.file:
|
||||
path: "~{{ podman_user }}/.config/containers"
|
||||
state: directory
|
||||
mode: "0700"
|
||||
owner: "{{ podman_user }}"
|
||||
group: "{{ podman_group }}"
|
||||
|
||||
- name: Configure podman default runtime
|
||||
ansible.builtin.copy:
|
||||
content: |
|
||||
[engine]
|
||||
runtime = "{{ default_runtime }}"
|
||||
cgroup_manager = "{{ default_cgroup_manager }}"
|
||||
dest: "~{{ podman_user }}/.config/containers/containers.conf"
|
||||
owner: "{{ podman_user }}"
|
||||
group: "{{ podman_group }}"
|
||||
mode: "0600"
|
||||
|
||||
- name: Create empty mounts config file to avoid permissions error message
|
||||
ansible.builtin.copy:
|
||||
content: ""
|
||||
dest: "~{{ podman_user }}/.config/containers/mounts.conf"
|
||||
force: false
|
||||
owner: "{{ podman_user }}"
|
||||
group: "{{ podman_group }}"
|
||||
mode: "0600"
|
||||
|
||||
- name: Ensure registries.conf.d exists
|
||||
ansible.builtin.file:
|
||||
path: /etc/containers/registries.conf.d/
|
||||
state: directory
|
||||
mode: "0755"
|
||||
|
||||
- name: Force fully qualified image names to be provided to podman pull
|
||||
ansible.builtin.copy:
|
||||
content: |
|
||||
unqualified-search-registries = []
|
||||
dest: /etc/containers/registries.conf.d/force-fully-qualified-images.conf
|
||||
mode: "0644"
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
---
|
||||
- name: Install podman packages
|
||||
ansible.builtin.dnf:
|
||||
name: "{{ podman_packages }}"
|
||||
state: present
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
---
|
||||
- name: Include OS-specific variables (RedHat)
|
||||
ansible.builtin.include_vars: "{{ ansible_os_family }}.yml"
|
||||
when:
|
||||
- ansible_os_family == 'RedHat'
|
||||
|
||||
- name: Define podman_packages
|
||||
ansible.builtin.set_fact:
|
||||
podman_packages: "{{ __podman_packages | list }}"
|
||||
when: podman_packages is not defined
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
---
|
||||
__podman_packages:
|
||||
- podman
|
||||
- crun
|
||||
|
|
@ -1,219 +0,0 @@
|
|||
# Ansible Role: Setup
|
||||
|
||||
Installs and configures a Receptor node on RHEL/CentOS/Fedora servers.
|
||||
|
||||
|
||||
## Role Variables
|
||||
|
||||
Available variables are listed below, along with default values.
|
||||
|
||||
---
|
||||
|
||||
receptor_packages:
|
||||
- receptor
|
||||
|
||||
Set the names of the packages needed to install Receptor.
|
||||
|
||||
---
|
||||
|
||||
receptor_dependencies: []
|
||||
|
||||
Specify other packages needed, probably on a per-node-type basis using
|
||||
groupvars or hostvars.
|
||||
|
||||
---
|
||||
|
||||
receptor_user: 'receptor'
|
||||
receptor_group: 'receptor'
|
||||
|
||||
The user and group under which Receptor will run.
|
||||
|
||||
---
|
||||
|
||||
receptor_socket_dir: '/var/run/receptor'
|
||||
|
||||
The directory that Receptor will place its control socket into.
|
||||
|
||||
---
|
||||
|
||||
receptor_control_filename: 'receptor.sock'
|
||||
|
||||
The name of the control socket file.
|
||||
|
||||
---
|
||||
|
||||
receptor_config_path: '/etc/receptor'
|
||||
|
||||
Path to the Receptor config file.
|
||||
|
||||
---
|
||||
|
||||
routable_hostname: # defaults to not set
|
||||
|
||||
Hostvar for the routable address to this node. If this is unset
|
||||
`ansible_host` will be used instead. Must be unique.
|
||||
|
||||
---
|
||||
|
||||
receptor_peers: # defaults to not set
|
||||
|
||||
Hostvar for the Ansible hosts that this node is peering outwards to.
|
||||
This is expected to be a list of dicts.
|
||||
|
||||
In the dicts, the `'host'` key is required, `'port'` and `'protocol'`
|
||||
are optional and will default to the overall defaults for
|
||||
`receptor_port` and `receptor_protocol`.
|
||||
|
||||
---
|
||||
|
||||
receptor_tls: false
|
||||
|
||||
Enables the TLS protocol to be used for communication between nodes.
|
||||
If enabled, appropriate certificates will have to be provided or
|
||||
generated.
|
||||
|
||||
---
|
||||
|
||||
receptor_mintls13: false
|
||||
|
||||
If set to true, this forces the minimum TLS version used to be 1.3.
|
||||
Otherwise, the minimum version will be 1.2. This variable has no
|
||||
effect unless `receptor_tls` is enabled.
|
||||
|
||||
---
|
||||
|
||||
receptor_tls_dir: '/etc/receptor/tls'
|
||||
receptor_tls_ca_dir: '{{ receptor_tls_dir }}/ca'
|
||||
|
||||
Directories on the server where the TLS keys and CA keys would be located.
|
||||
|
||||
---
|
||||
|
||||
receptor_tls_certfile: "{{ receptor_tls_dir }}/{{ receptor_host_identifier }}.crt"
|
||||
receptor_tls_keyfile: "{{ receptor_tls_dir }}/{{ receptor_host_identifier }}.key"
|
||||
|
||||
Path on the server to the public and private TLS key files.
|
||||
|
||||
---
|
||||
|
||||
receptor_ca_certfile: "{{ receptor_tls_ca_dir }}/mesh-CA.crt"
|
||||
receptor_ca_keyfile: "{{ receptor_tls_ca_dir }}/mesh-CA.key"
|
||||
|
||||
Path on the server where the public and private Certificate Authority
|
||||
key files would be located.
|
||||
|
||||
---
|
||||
|
||||
custom_ca_certfile: # defaults to not set
|
||||
custom_ca_keyfile: # defaults to not set
|
||||
|
||||
Path on the local filesystem to user-provided Certificate Authority
|
||||
files.
|
||||
|
||||
---
|
||||
|
||||
custom_tls_certfile: # defaults to not set
|
||||
custom_tls_keyfile: # defaults to not set
|
||||
|
||||
Hostvar that is the path on the local filesystem to user-provided
|
||||
per-node certificate files. If used, both must be provided in
|
||||
combination with a `custom_ca_certfile` that was used to sign them.
|
||||
|
||||
---
|
||||
|
||||
receptor_sign: false
|
||||
|
||||
Hostvar designating that this host will sign any work that it sends
|
||||
over the Receptor mesh.
|
||||
|
||||
---
|
||||
|
||||
receptor_verify: false
|
||||
|
||||
Hostvar designating that this host will verify any work that it
|
||||
receives using a public key.
|
||||
|
||||
---
|
||||
|
||||
receptor_worksign_key_dir: "/etc/receptor"
|
||||
receptor_worksign_private_keyfile: "{{ receptor_worksign_key_dir }}/work_private_key.pem"
|
||||
receptor_worksign_public_keyfile: "{{ receptor_worksign_key_dir }}/work_public_key.pem"
|
||||
|
||||
Path on the server to the public and private OpenSSL work signing key files.
|
||||
|
||||
---
|
||||
|
||||
custom_worksign_private_keyfile: # defaults to not set
|
||||
custom_worksign_public_keyfile: # defaults to not set
|
||||
|
||||
Path on the local filesystem to user-provided OpenSSL work signing key
|
||||
files.
|
||||
|
||||
---
|
||||
|
||||
receptor_fd_limit_soft: 4096
|
||||
receptor_fd_limit_hard: 8192
|
||||
|
||||
The file descriptor limits in PAM for Receptor.
|
||||
|
||||
---
|
||||
|
||||
receptor_app_service: # defaults to not set
|
||||
|
||||
Optional variable to tie Receptor together with some other service in systemd.
|
||||
|
||||
---
|
||||
|
||||
receptor_log_level: 'info'
|
||||
|
||||
The level at which Receptor should write logs. Allowable options are 'error', 'warning', 'info', and 'debug'.
|
||||
|
||||
---
|
||||
|
||||
receptor_listener: true
|
||||
|
||||
Hostvar to enable Receptor to listen for incoming remote connections.
|
||||
|
||||
---
|
||||
|
||||
receptor_local_only: false
|
||||
|
||||
Hostvar to make this instance of Receptor listen for local-only
|
||||
connections. If set to true, this will take precedence over the value
|
||||
of `receptor_listener`.
|
||||
|
||||
---
|
||||
|
||||
receptor_protocol: 'tcp'
|
||||
receptor_port: 27199
|
||||
|
||||
Override with hostvars for the protocol this instance of Receptor will
|
||||
use (allowable options are 'tcp', 'udp', and 'ws' for websockets), and
|
||||
the port number it will listen for those connections on.
|
||||
|
||||
---
|
||||
|
||||
receptor_work_commands: # defaults to not set
|
||||
|
||||
The definition of the Receptor work commands. This variable is
|
||||
expected to be a dictionary, with keys the unique worktype name, and
|
||||
values a dict of the rest of the key-value pairs of the work
|
||||
definition. See
|
||||
<https://receptor.readthedocs.io/en/latest/workceptor.html> for more
|
||||
information.
|
||||
|
||||
---
|
||||
|
||||
receptor_kubernetes_commands: # defaults to not set
|
||||
|
||||
The definition of the Receptor work-kubernetes commands. This
|
||||
variable is expected to be a dictionary, with keys the unique worktype
|
||||
name, and values a dict of the rest of the key-value pairs of the work
|
||||
definition. See <https://receptor.readthedocs.io/en/latest/k8s.html>
|
||||
for more information.
|
||||
|
||||
---
|
||||
|
||||
# License
|
||||
|
||||
Apache 2
|
||||
|
|
@ -1,38 +0,0 @@
|
|||
---
|
||||
receptor_user: receptor
|
||||
receptor_group: receptor
|
||||
|
||||
receptor_config_path: '/etc/receptor'
|
||||
receptor_socket_dir: '/var/run/receptor'
|
||||
receptor_control_filename: 'receptor.sock'
|
||||
|
||||
receptor_tls: false
|
||||
receptor_mintls13: false
|
||||
|
||||
receptor_tls_dir: '/etc/receptor/tls'
|
||||
receptor_tls_ca_dir: '{{ receptor_tls_dir }}/ca'
|
||||
receptor_tls_certfile: "{{ receptor_tls_dir }}/{{ receptor_host_identifier }}.crt"
|
||||
receptor_tls_keyfile: "{{ receptor_tls_dir }}/{{ receptor_host_identifier }}.key"
|
||||
receptor_ca_certfile: "{{ receptor_tls_ca_dir }}/mesh-CA.crt"
|
||||
receptor_ca_keyfile: "{{ receptor_tls_ca_dir }}/mesh-CA.key"
|
||||
|
||||
receptor_worksign_key_dir: "/etc/receptor"
|
||||
receptor_worksign_private_keyfile: "{{ receptor_worksign_key_dir }}/work_private_key.pem"
|
||||
receptor_worksign_public_keyfile: "{{ receptor_worksign_key_dir }}/work_public_key.pem"
|
||||
|
||||
receptor_fd_limit_soft: 4096
|
||||
receptor_fd_limit_hard: 8192
|
||||
|
||||
receptor_listener: true
|
||||
receptor_local_only: false
|
||||
|
||||
receptor_protocol: 'tcp'
|
||||
receptor_port: 27199
|
||||
receptor_sign: false
|
||||
receptor_verify: false
|
||||
|
||||
receptor_log_level: 'info'
|
||||
|
||||
_hostname: "{{ routable_hostname | default(ansible_host) }}"
|
||||
receptor_host_identifier:
|
||||
"{{ (_hostname == 'localhost') | ternary('localhost.localdomain', _hostname) }}"
|
||||
|
|
@ -1,41 +0,0 @@
|
|||
---
|
||||
- name: Ensure soft/hard file descriptors limits
|
||||
ansible.builtin.template:
|
||||
src: templates/pam_limits.conf.j2
|
||||
dest: /etc/security/limits.d/receptor.conf
|
||||
mode: '0600'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Ensure systemd override directory exists
|
||||
ansible.builtin.file:
|
||||
dest: /etc/systemd/system/receptor.service.d
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
|
||||
- name: Override receptor's systemd service runuser
|
||||
ansible.builtin.template:
|
||||
src: templates/systemd_receptor_override.conf.j2
|
||||
dest: /etc/systemd/system/receptor.service.d/override.conf
|
||||
mode: '0644'
|
||||
owner: root
|
||||
group: root
|
||||
# notify: Restart Receptor
|
||||
|
||||
- name: Configure the receptor socket directory
|
||||
ansible.builtin.file:
|
||||
path: "{{ receptor_socket_dir }}"
|
||||
state: directory
|
||||
owner: "{{ receptor_user }}"
|
||||
group: "{{ receptor_group }}"
|
||||
mode: '0750'
|
||||
|
||||
- name: Create tmpfiles.d entry for receptor socket directory
|
||||
ansible.builtin.template:
|
||||
src: templates/receptor_tmpd.conf.j2
|
||||
dest: /etc/tmpfiles.d/receptor.conf
|
||||
mode: '0640'
|
||||
owner: root
|
||||
group: root
|
||||
|
|
@ -1,32 +0,0 @@
|
|||
---
|
||||
# Variable configuration.
|
||||
- include_tasks: variables.yml
|
||||
|
||||
# Setup/install tasks.
|
||||
- include_tasks: setup-RedHat.yml
|
||||
when: ansible_os_family == 'RedHat'
|
||||
|
||||
- include_tasks: configure.yml
|
||||
|
||||
- include_tasks: tls.yml
|
||||
when: receptor_tls
|
||||
|
||||
- include_tasks: worksign.yml
|
||||
when: receptor_sign or receptor_verify
|
||||
|
||||
- name: Deploy receptor config
|
||||
ansible.builtin.template:
|
||||
src: templates/receptor.conf.j2
|
||||
dest: "{{ receptor_config_path }}/receptor.conf"
|
||||
mode: '0644'
|
||||
owner: "{{ receptor_user }}"
|
||||
group: "{{ receptor_group }}"
|
||||
# notify:
|
||||
# - "Receptor Reload"
|
||||
|
||||
- name: Start Receptor service
|
||||
ansible.builtin.systemd:
|
||||
name: receptor
|
||||
state: started
|
||||
daemon_reload: true
|
||||
enabled: true
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
---
|
||||
- name: Install receptor packages
|
||||
ansible.builtin.dnf:
|
||||
name: "{{ receptor_packages }}"
|
||||
state: present
|
||||
|
||||
- name: Install dependencies specific to the node type
|
||||
ansible.builtin.dnf:
|
||||
name: "{{ receptor_dependencies | default([]) }}"
|
||||
state: present
|
||||
|
|
@ -1,27 +0,0 @@
|
|||
---
|
||||
- name: Create Receptor cert directories
|
||||
ansible.builtin.file:
|
||||
dest: "{{ item }}"
|
||||
state: directory
|
||||
mode: '0750'
|
||||
owner: "{{ receptor_user }}"
|
||||
group: "{{ receptor_group }}"
|
||||
recurse: true
|
||||
with_items:
|
||||
- "{{ receptor_tls_dir }}"
|
||||
- "{{ receptor_tls_ca_dir }}"
|
||||
|
||||
- name: Process provided TLS files
|
||||
include_tasks: tls_local.yml
|
||||
when: custom_tls_certfile is defined or custom_tls_keyfile is defined
|
||||
|
||||
- name: Set TLS file permissions
|
||||
ansible.builtin.file:
|
||||
dest: "{{ item }}"
|
||||
owner: "{{ receptor_user }}"
|
||||
group: "{{ receptor_group }}"
|
||||
mode: '0640'
|
||||
with_items:
|
||||
- "{{ receptor_tls_certfile }}"
|
||||
- "{{ receptor_tls_keyfile }}"
|
||||
- "{{ receptor_ca_certfile }}"
|
||||
|
|
@ -1,61 +0,0 @@
|
|||
---
|
||||
- name: Ensure both TLS files are provided
|
||||
ansible.builtin.assert:
|
||||
quiet: true
|
||||
that:
|
||||
- custom_tls_certfile | default('') | length
|
||||
- custom_tls_keyfile | default('') | length
|
||||
fail_msg: >
|
||||
"You must provide both 'custom_tls_certfile' and 'custom_tls_keyfile'."
|
||||
|
||||
- name: Ensure CA certfile is provided
|
||||
ansible.builtin.assert:
|
||||
quiet: true
|
||||
that:
|
||||
- custom_ca_certfile | default('') | length
|
||||
fail_msg: >
|
||||
"You must provide the public CA file when providing custom TLS certificates."
|
||||
|
||||
- name: Check TLS private key modulus
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
ansible.builtin.command: openssl rsa -modulus -noout -in "{{ custom_tls_keyfile }}"
|
||||
register: _tls_keyfile_modulus
|
||||
changed_when: false
|
||||
|
||||
- name: Check TLS x509 key modulus
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
ansible.builtin.command: openssl x509 -modulus -noout -in "{{ custom_tls_certfile }}"
|
||||
register: _tls_certfile_modulus
|
||||
changed_when: false
|
||||
|
||||
- name: Ensure TLS pair matches
|
||||
ansible.builtin.assert:
|
||||
quiet: true
|
||||
that:
|
||||
- _tls_keyfile_modulus.stdout == _tls_certfile_modulus.stdout
|
||||
fail_msg: >
|
||||
"TLS !modulus! for {{ custom_tls_keyfile }} and {{ custom_tls_certfile }} doesn't match."
|
||||
success_msg: "TLS !modulus! for {{ custom_tls_keyfile }} and {{ custom_tls_certfile }} matches."
|
||||
|
||||
- name: Ensure x509 certificate was signed by the expected Certificate Authority
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
ansible.builtin.command:
|
||||
openssl verify -CAfile "{{ custom_ca_certfile }}" "{{ custom_tls_certfile }}"
|
||||
changed_when: false
|
||||
|
||||
- name: Upload TLS files
|
||||
become: true
|
||||
become_user: "{{ receptor_user }}"
|
||||
ansible.builtin.copy:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
owner: "{{ receptor_user }}"
|
||||
group: "{{ receptor_group }}"
|
||||
mode: '0640'
|
||||
with_items:
|
||||
- {src: '{{ custom_tls_certfile }}', dest: '{{ receptor_tls_certfile }}'}
|
||||
- {src: '{{ custom_tls_keyfile }}', dest: '{{ receptor_tls_keyfile }}'}
|
||||
- {src: '{{ custom_ca_certfile }}', dest: '{{ receptor_ca_certfile }}'}
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
---
|
||||
- name: Include OS-specific variables (RedHat)
|
||||
ansible.builtin.include_vars: "{{ ansible_os_family }}.yml"
|
||||
when:
|
||||
- ansible_os_family == 'RedHat'
|
||||
|
||||
- name: Define receptor_packages
|
||||
ansible.builtin.set_fact:
|
||||
receptor_packages: "{{ __receptor_packages | list }}"
|
||||
when: receptor_packages is not defined
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
---
|
||||
- include_tasks: worksign_local.yml
|
||||
when: custom_worksign_private_keyfile is defined or custom_worksign_public_keyfile is defined
|
||||
|
|
@ -1,18 +0,0 @@
|
|||
---
|
||||
- name: Distribute private work signing key
|
||||
ansible.builtin.copy:
|
||||
src: "{{ custom_worksign_private_keyfile }}"
|
||||
dest: "{{ receptor_worksign_private_keyfile }}"
|
||||
owner: "{{ receptor_user }}"
|
||||
group: "{{ receptor_group }}"
|
||||
mode: '0640'
|
||||
when: receptor_sign
|
||||
|
||||
- name: Distribute public work signing key
|
||||
ansible.builtin.copy:
|
||||
src: "{{ custom_worksign_public_keyfile }}"
|
||||
dest: "{{ receptor_worksign_public_keyfile }}"
|
||||
owner: "{{ receptor_user }}"
|
||||
group: "{{ receptor_group }}"
|
||||
mode: '0640'
|
||||
when: receptor_verify
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
# Receptor limits
|
||||
{{ receptor_user }} soft nofile {{ receptor_fd_limit_soft }}
|
||||
{{ receptor_user }} hard nofile {{ receptor_fd_limit_hard }}
|
||||
|
|
@ -1,83 +0,0 @@
|
|||
---
|
||||
- node:
|
||||
id: {{ receptor_host_identifier }}
|
||||
|
||||
{% if receptor_sign %}
|
||||
- work-signing:
|
||||
privatekey: {{ receptor_worksign_private_keyfile }}
|
||||
tokenexpiration: 1m
|
||||
{% endif %}
|
||||
|
||||
{% if receptor_verify %}
|
||||
- work-verification:
|
||||
publickey: {{ receptor_worksign_public_keyfile }}
|
||||
{% endif %}
|
||||
|
||||
- log-level: {{ receptor_log_level }}
|
||||
|
||||
- control-service:
|
||||
service: control
|
||||
filename: {{ receptor_socket_dir }}/{{ receptor_control_filename }}
|
||||
permissions: 0660
|
||||
{% if receptor_tls -%}
|
||||
tls: tls_server
|
||||
{%- endif %}
|
||||
|
||||
{% if receptor_tls -%}
|
||||
- tls-server:
|
||||
name: tls_server
|
||||
cert: {{ receptor_tls_certfile }}
|
||||
key: {{ receptor_tls_keyfile }}
|
||||
clientcas: {{ receptor_ca_certfile }}
|
||||
requireclientcert: true
|
||||
mintls13: {{ receptor_mintls13 | bool }}
|
||||
|
||||
- tls-client:
|
||||
name: tls_client
|
||||
cert: {{ receptor_tls_certfile }}
|
||||
key: {{ receptor_tls_keyfile }}
|
||||
rootcas: {{ receptor_ca_certfile }}
|
||||
insecureskipverify: false
|
||||
mintls13: {{ receptor_mintls13 | bool }}
|
||||
{%- endif %}
|
||||
|
||||
{% if receptor_local_only %}
|
||||
- local-only
|
||||
{% elif receptor_listener %}
|
||||
- {{ receptor_protocol }}-listener:
|
||||
port: {{ receptor_port }}
|
||||
{% if receptor_tls -%}
|
||||
tls: tls_server
|
||||
{%- endif %}
|
||||
{% endif %}
|
||||
|
||||
{% if receptor_peers | default([]) %}
|
||||
{% for peer in receptor_peers %}
|
||||
- {{ peer['protocol'] }}-peer:
|
||||
address: {{ peer['address'] | default(peer['host']) }}:{{ peer['port'] }}
|
||||
redial: true
|
||||
{% if receptor_tls -%}
|
||||
tls: tls_client
|
||||
{%- endif %}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
{% if receptor_work_commands is defined -%}
|
||||
{% for command, config in receptor_work_commands.items() %}
|
||||
- work-command:
|
||||
worktype: {{ command }}
|
||||
{% for key, value in config.items() %}
|
||||
{{ key }}: {{ value }}
|
||||
{% endfor %}
|
||||
{% endfor %}
|
||||
{%- endif %}
|
||||
|
||||
{%- if receptor_kubernetes_commands is defined %}
|
||||
{% for command, config in receptor_kubernetes_commands.items() %}
|
||||
- work-kubernetes:
|
||||
worktype: {{ command }}
|
||||
{% for key, value in config.items() %}
|
||||
{{ key }}: {{ value }}
|
||||
{% endfor %}
|
||||
{% endfor %}
|
||||
{% endif -%}
|
||||
|
|
@ -1 +0,0 @@
|
|||
D {{ receptor_socket_dir }} 0750 {{ receptor_user }} {{ receptor_group }} -
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
[Service]
|
||||
User={{ receptor_user }}
|
||||
Group={{ receptor_group }}
|
||||
{% if receptor_app_service is defined %}
|
||||
[Unit]
|
||||
PartOf={{ receptor_app_service }}
|
||||
{% endif %}
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
---
|
||||
__receptor_packages:
|
||||
- receptor
|
||||
Loading…
Add table
Add a link
Reference in a new issue