forked from infra/ansible
127 lines
3.1 KiB
YAML
127 lines
3.1 KiB
YAML
---
|
|
- name: Install packages
|
|
ansible.builtin.package: state=present name={{ item }}
|
|
with_items:
|
|
- fedora-messaging
|
|
- git
|
|
tags:
|
|
- packages
|
|
- mirror_forge_ansible
|
|
|
|
|
|
# Create the user the service will run under
|
|
|
|
- name: Setup forge user
|
|
user:
|
|
name: mirror_forge_ansible
|
|
shell: /sbin/nologin
|
|
comment: "mirror_forge_ansible User"
|
|
tags:
|
|
- mirror_forge_ansible
|
|
- mirror_forge_ansible/user
|
|
|
|
|
|
# Ensure the user can write to where we want to store the mirror
|
|
- name: Give access to mirror_forge_ansible to /srv
|
|
ansible.builtin.command: setfacl -m d:u:mirror_forge_ansible:rwx /srv -m u:mirror_forge_ansible:rwx /srv/
|
|
tags:
|
|
- config
|
|
- mirror_forge_ansible
|
|
|
|
|
|
# configure all the fedora-messaging files
|
|
|
|
- name: Create /etc/pki/fedora-messaging
|
|
ansible.builtin.file:
|
|
dest: /etc/pki/fedora-messaging
|
|
mode: "0775"
|
|
owner: root
|
|
group: root
|
|
state: directory
|
|
tags:
|
|
- config
|
|
- mirror_forge_ansible
|
|
- fedora-messaging
|
|
|
|
- name: Deploy forge/rabbitmq certificate
|
|
ansible.builtin.copy: src={{ item.src }}
|
|
dest=/etc/pki/fedora-messaging/{{ item.dest }}
|
|
owner={{ item.owner }} group={{ item.group}} mode={{ item.mode }}
|
|
with_items:
|
|
- src: "{{private}}/files/rabbitmq/production/pki/issued/mirror_forge_ansible{{env_suffix}}.crt"
|
|
dest: mirror_forge_ansible.crt
|
|
owner: mirror_forge_ansible
|
|
group: mirror_forge_ansible
|
|
mode: "0644"
|
|
- src: "{{private}}/files/rabbitmq/production/pki/private/mirror_forge_ansible{{env_suffix}}.key"
|
|
dest: mirror_forge_ansible.key
|
|
owner: mirror_forge_ansible
|
|
group: mirror_forge_ansible
|
|
mode: "0600"
|
|
- src: "{{private}}/files/rabbitmq/production/ca-combined.crt"
|
|
dest: cacert.pem
|
|
owner: mirror_forge_ansible
|
|
group: mirror_forge_ansible
|
|
mode: "0644"
|
|
tags:
|
|
- forge
|
|
- fedora-messaging
|
|
|
|
- name: Setup mirror_forge_ansible fedora-messaging config
|
|
ansible.builtin.template:
|
|
src: mirror_forge_ansible.cfg
|
|
dest: /etc/fedora-messaging/mirror_forge_ansible.toml
|
|
owner: mirror_forge_ansible
|
|
group: mirror_forge_ansible
|
|
mode: "0640"
|
|
tags:
|
|
- config
|
|
- mirror_forge_ansible
|
|
- fedora-messaging
|
|
|
|
|
|
# Install the script
|
|
|
|
- name: Create /usr/local/libexec/mirror_forge_ansible
|
|
ansible.builtin.file:
|
|
dest: /usr/local/libexec/mirror_forge_ansible
|
|
mode: "0775"
|
|
owner: root
|
|
group: root
|
|
state: directory
|
|
tags:
|
|
- config
|
|
- mirror_forge_ansible
|
|
|
|
- name: Install the consumer
|
|
ansible.builtin.template:
|
|
src: mirror_from_forge_bus.py
|
|
dest: /usr/local/libexec/mirror_forge_ansible/mirror_from_forge_bus.py
|
|
tags:
|
|
- packages
|
|
- mirror_forge_ansible
|
|
|
|
|
|
# Install and start the service
|
|
|
|
- name: Install the dedicated service file for mirror_forge_ansible
|
|
ansible.builtin.template:
|
|
src: mirror_forge_ansible.service
|
|
dest: /etc/systemd/system/mirror_forge_ansible.service
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify:
|
|
- Reload systemd
|
|
tags:
|
|
- config
|
|
- mirror_forge_ansible
|
|
|
|
- name: Enable and started the service
|
|
service:
|
|
name: mirror_forge_ansible.service
|
|
enabled: yes
|
|
state: started
|
|
tags:
|
|
- config
|
|
- mirror_forge_ansible
|