Initial commit
This commit is contained in:
commit
5fe082b8f6
33 changed files with 1177 additions and 0 deletions
168
roles/newsreader/tasks/main.yml
Normal file
168
roles/newsreader/tasks/main.yml
Normal file
|
|
@ -0,0 +1,168 @@
|
|||
- include_role:
|
||||
name: common
|
||||
tasks_from: "network.yml"
|
||||
- include_role:
|
||||
name: common
|
||||
tasks_from: "host.yml"
|
||||
- include_role:
|
||||
name: common
|
||||
tasks_from: "sudoers.yml"
|
||||
loop:
|
||||
- {
|
||||
src: "../newsreader/templates/sudoers.j2",
|
||||
dest: "/etc/sudoers.d/30-ansible-extra",
|
||||
}
|
||||
|
||||
- name: install packages
|
||||
apt:
|
||||
name:
|
||||
- memcached
|
||||
- pgbouncer
|
||||
- postfix
|
||||
- python-psycopg2
|
||||
- python3-psycopg2
|
||||
- python3
|
||||
- python3-pip
|
||||
- python3-venv
|
||||
- python3-setuptools
|
||||
- python3-virtualenv
|
||||
- python-pip
|
||||
- python-setuptools
|
||||
- python-virtualenv
|
||||
- rabbitmq-server
|
||||
state: present
|
||||
notify:
|
||||
- restart postfix
|
||||
|
||||
- name: copy firewall templates
|
||||
template:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0600"
|
||||
with_items:
|
||||
- { src: "nftables.j2", dest: "/etc/nftables.conf" }
|
||||
notify: restart nftables
|
||||
|
||||
- name: copy memcached conf
|
||||
template:
|
||||
src: "memcached.j2"
|
||||
dest: "/etc/memcached.conf"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
notify: restart memcached
|
||||
|
||||
- name: add gitlab to known hosts
|
||||
become_user: "{{ app_user }}"
|
||||
known_hosts:
|
||||
name: "{{ gitlab_domain }}"
|
||||
key: "{{ gitlab_host_key }}"
|
||||
|
||||
- name: add gitlab pubkey
|
||||
authorized_key:
|
||||
user: ansible
|
||||
state: present
|
||||
key: "{{ app_deploy_key }}"
|
||||
|
||||
- name: Add newsreader user
|
||||
user:
|
||||
name: "{{ app_user }}"
|
||||
create_home: yes
|
||||
shell: /bin/bash
|
||||
|
||||
- name: create ssh dir
|
||||
file:
|
||||
path: "/home/{{ app_user }}/.ssh"
|
||||
state: directory
|
||||
owner: "{{ app_user }}"
|
||||
group: "{{ app_user }}"
|
||||
mode: 0755
|
||||
|
||||
- name: create rabbitmq service override dir
|
||||
file:
|
||||
path: /etc/systemd/system/rabbitmq-server.service.d/
|
||||
state: directory
|
||||
mode: "0644"
|
||||
|
||||
- name: copy rabbitmq configurations
|
||||
template:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
owner: "{{ item.owner }}"
|
||||
group: "{{ item.group }}"
|
||||
mode: "{{ item.mode }}"
|
||||
loop:
|
||||
- {
|
||||
src: "limits.j2",
|
||||
dest: "/etc/systemd/system/rabbitmq-server.service.d/limits.conf",
|
||||
mode: "0644",
|
||||
group: "root",
|
||||
owner: "root",
|
||||
}
|
||||
- {
|
||||
src: "rabbitmq.conf.j2",
|
||||
dest: "/etc/rabbitmq/rabbitmq-env.conf",
|
||||
mode: "0644",
|
||||
group: "rabbitmq",
|
||||
owner: "rabbitmq",
|
||||
}
|
||||
notify: restart rabbitmq
|
||||
|
||||
- include_role:
|
||||
name: common
|
||||
tasks_from: "ssl.yml"
|
||||
- include_role:
|
||||
name: common
|
||||
tasks_from: "nginx.yml"
|
||||
|
||||
- name: copy nginx config
|
||||
template:
|
||||
src: "nginx.j2"
|
||||
dest: "/etc/nginx/sites-available/newsreader"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
- name: link nginx config
|
||||
file:
|
||||
src: "/etc/nginx/sites-available/newsreader"
|
||||
dest: "/etc/nginx/sites-enabled/newsreader"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0777"
|
||||
state: link
|
||||
|
||||
- name: copy nftables config
|
||||
template:
|
||||
src: "nftables.j2"
|
||||
dest: "/etc/nftables.conf"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0600"
|
||||
notify: restart nftables
|
||||
|
||||
- name: copy pgbouncer config
|
||||
template:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
owner: postgres
|
||||
group: postgres
|
||||
mode: "{{ item.mode }}"
|
||||
loop:
|
||||
- {
|
||||
src: "pgbouncer.j2",
|
||||
dest: "/etc/pgbouncer/pgbouncer.ini",
|
||||
"mode": "0640",
|
||||
}
|
||||
- {
|
||||
src: "pgbouncer-users.j2",
|
||||
dest: "/etc/pgbouncer/userlist.txt",
|
||||
"mode": "0640",
|
||||
}
|
||||
|
||||
- name: ensure pgbouncer is restarted
|
||||
service: name=pgbouncer state=restarted enabled=yes
|
||||
|
||||
- include_tasks: "project.yml"
|
||||
138
roles/newsreader/tasks/project.yml
Normal file
138
roles/newsreader/tasks/project.yml
Normal file
|
|
@ -0,0 +1,138 @@
|
|||
- name: create sites dir
|
||||
file:
|
||||
path: /srv/sites
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0755
|
||||
|
||||
- name: create project dir
|
||||
file:
|
||||
path: "{{ app_dir }}"
|
||||
state: directory
|
||||
owner: "{{ app_user }}"
|
||||
group: "{{ app_user }}"
|
||||
mode: 0755
|
||||
|
||||
- name: clone project
|
||||
become_user: "{{ app_user }}"
|
||||
git:
|
||||
repo: "https://git.fudiggity.nl/sonny/newsreader.git"
|
||||
dest: "{{ app_dir }}"
|
||||
version: "{{ app_branch }}"
|
||||
update: yes
|
||||
force: yes
|
||||
notify:
|
||||
- install npm packages
|
||||
- build static files
|
||||
- run migrations
|
||||
- collect static files
|
||||
|
||||
- name: include poetry tasks
|
||||
include_role:
|
||||
name: common
|
||||
tasks_from: "poetry.yml"
|
||||
vars:
|
||||
poetry_user: "{{ app_user }}"
|
||||
poetry_dir: "/home/{{ app_user }}/.poetry"
|
||||
|
||||
- name: run poetry tasks
|
||||
block:
|
||||
- name: retrieve user $PATH
|
||||
shell: "echo $PATH"
|
||||
become_user: "{{ app_user }}"
|
||||
register: path_stats
|
||||
|
||||
- name: set poetry user variables
|
||||
set_fact:
|
||||
poetry_user_path: "{{ path_stats.stdout }}"
|
||||
|
||||
- name: set default venv python version
|
||||
become_user: "{{ app_user }}"
|
||||
command: "poetry env use python3.7"
|
||||
args:
|
||||
chdir: "{{ app_dir }}"
|
||||
environment:
|
||||
PATH: "/home/{{ app_user }}/.local/bin:{{ poetry_user_path }}"
|
||||
|
||||
- name: install project dependencies
|
||||
become_user: "{{ app_user }}"
|
||||
command: "poetry install" # noqa 301
|
||||
args:
|
||||
chdir: "{{ app_dir }}"
|
||||
environment:
|
||||
PATH: "/home/{{ app_user }}/.local/bin:{{ poetry_user_path }}"
|
||||
|
||||
- name: setup env file
|
||||
template:
|
||||
src: "env.j2"
|
||||
dest: "{{ app_dir }}/.env"
|
||||
owner: "{{ app_user }}"
|
||||
group: "{{ app_user }}"
|
||||
mode: 0600
|
||||
|
||||
- name: setup gunicorn service
|
||||
template:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "{{ item.mode }}"
|
||||
loop:
|
||||
- {
|
||||
src: "gunicorn-socket.j2",
|
||||
dest: "/etc/systemd/system/gunicorn.socket",
|
||||
"mode": "0644",
|
||||
}
|
||||
- {
|
||||
src: "gunicorn.j2",
|
||||
dest: "/etc/systemd/system/gunicorn.service",
|
||||
"mode": "0644",
|
||||
}
|
||||
notify:
|
||||
- restart gunicorn socket
|
||||
- stop gunicorn service
|
||||
|
||||
- name: create conf dir
|
||||
become_user: "{{ app_user }}"
|
||||
file:
|
||||
path: "/home/{{ app_user }}/.config/conf.d"
|
||||
state: directory
|
||||
owner: "{{ app_user }}"
|
||||
group: "{{ app_user }}"
|
||||
mode: 0750
|
||||
|
||||
- name: create celery run dir
|
||||
file:
|
||||
path: /run/celery
|
||||
state: directory
|
||||
owner: "{{ app_user }}"
|
||||
group: "{{ app_user }}"
|
||||
mode: 0755
|
||||
|
||||
- name: copy celery config
|
||||
template:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
owner: "{{ app_user }}"
|
||||
group: "{{ app_user }}"
|
||||
mode: "{{ item.mode }}"
|
||||
loop:
|
||||
- {
|
||||
src: "celery.j2",
|
||||
dest: "/etc/systemd/system/celery.service",
|
||||
"mode": "0644",
|
||||
}
|
||||
- {
|
||||
src: "celerybeat.j2",
|
||||
dest: "/etc/systemd/system/celerybeat.service",
|
||||
"mode": "0644",
|
||||
}
|
||||
- {
|
||||
src: "celery.env.j2",
|
||||
dest: "/home/newsreader/.config/conf.d/celery",
|
||||
"mode": "0640",
|
||||
}
|
||||
notify:
|
||||
- restart celery
|
||||
- restart celerybeat
|
||||
Reference in a new issue