Initial commit

tasks/docker.yml

@@ -0,0 +1,42 @@
+- name: add docker gpg key
+  apt_key:
+    id: '0EBFCD88'
+    url: 'https://download.docker.com/linux/debian/gpg'
+    validate_certs: true
+    state: present
+
+- name: add docker repo
+  apt_repository:
+    repo: 'deb https://download.docker.com/linux/debian buster stable'
+    validate_certs: true
+    state: present
+
+- name: install docker
+  apt:
+    name:
+      - docker-ce
+      - docker-ce-cli
+      - containerd.io
+    state: present
+
+- name: check docker-compose existence
+  stat:
+    path: '/usr/local/bin/docker-compose'
+  register: docker_compose_stat
+
+- name: download docker-compose
+  get_url:
+    url: 'https://github.com/docker/compose/releases/download/1.26.0/docker-compose-Linux-x86_64'
+    dest: '/usr/local/bin/docker-compose'
+    mode: '0755'
+  when: docker_compose_stat.stat.isfile is not defined
+
+- name: add sentry user
+  user:
+    name: sentry
+    create_home: true
+    shell: '/bin/bash'
+    groups:
+      - sudo
+      - docker
+    append: true

tasks/main.yml

@@ -0,0 +1,93 @@
+- name: copy firewall templates
+  template:
+    src: '{{ item.src }}'
+    dest: '{{ item.dest }}'
+    owner: root
+    group: root
+    mode: '0600'
+  loop:
+    - { src: 'templates/nftables.j2', dest: '/etc/nftables.conf' }
+  notify: restart nftables
+
+- name: create sites directory
+  file:
+    path: '/srv/sites'
+    state: directory
+    owner: root
+    group: root
+    mode: 0755
+
+- name: create sentry dir
+  file:
+    path: '{{ app_dir }}'
+    state: directory
+    owner: '{{ app_user }}'
+    group: '{{ app_user }}'
+    mode: 0755
+
+- name: clone project
+  become_user: '{{ app_user }}'
+  become: true
+  git:
+    repo: '{{ app_repository }}'
+    dest: '{{ app_dir }}'
+    version: '{{ app_branch }}'
+    update: true
+
+- name: copy over sentry configurations
+  template:
+    src: '{{ item.src }}'
+    dest: '{{ item.dest }}'
+    owner: '{{ app_user }}'
+    group: '{{ app_user }}'
+    mode: '0644'
+  loop:
+    - { src: 'templates/sentry.conf.j2', dest: '{{ app_dir }}/sentry/sentry.conf.py' }
+    - { src: 'templates/sentry.config.j2', dest: '{{ app_dir }}/sentry/config.yml' }
+
+- name: ensure sentry is stopped
+  systemd:
+    name: sentry
+    state: stopped
+
+# can be ran multiple times to upgrade sentry
+- name: run sentry installer
+  command: './install.sh' # noqa 301
+  args:
+    chdir: '{{ app_dir }}'
+  environment:
+    SENTRY_IMAGE: 'getsentry/sentry:{{ app_branch }}'
+
+- name: copy sentry systemd service
+  template:
+    src: '{{ item.src }}'
+    dest: '{{ item.dest }}'
+    owner: '{{ app_user }}'
+    group: '{{ app_user }}'
+    mode: '0644'
+  loop:
+    - { src: 'templates/sentry.systemd.j2', dest: '/etc/systemd/system/sentry.service' }
+  notify: restart sentry
+
+- name: copy nginx sentry config
+  template:
+    src: 'templates/nginx.j2'
+    dest: '/etc/nginx/sites-available/{{ app_name }}'
+    owner: root
+    group: root
+    mode: '0644'
+
+- name: link nginx config
+  file:
+    src: '/etc/nginx/sites-available/{{ app_name }}'
+    dest: '/etc/nginx/sites-enabled/{{ app_name }}'
+    owner: root
+    group: root
+    mode: '0777'
+    state: link
+
+- name: ensure nginx is restarted
+  systemd:
+    name: nginx
+    state: restarted
+    enabled: true