From 08d732d8b45e9a8c699304ea83b3a883905fb051 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 20 Mar 2024 17:36:12 +0000 Subject: [PATCH 01/12] Bump ansible from 2.10.7 to 8.5.0 Bumps [ansible](https://github.com/ansible-community/ansible-build-data) from 2.10.7 to 8.5.0. - [Changelog](https://github.com/ansible-community/ansible-build-data/blob/main/docs/release-process.md) - [Commits](https://github.com/ansible-community/ansible-build-data/compare/2.10.7...8.5.0) --- updated-dependencies: - dependency-name: ansible dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 6b934edf..437ab560 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,4 +1,4 @@ -ansible==2.10.7 +ansible==8.5.0 dnspython==2.1.0 passlib==1.7.4 jmespath==0.10.0 From 727c39b0d374231c7dace38d4f90f6c1de300b88 Mon Sep 17 00:00:00 2001 From: Bruce Becker Date: Wed, 20 Mar 2024 18:45:36 +0100 Subject: [PATCH 02/12] chore: add pre-commit hooks Signed-off-by: Bruce Becker --- .pre-commit-config.yaml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 .pre-commit-config.yaml diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 00000000..596c4a4f --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,16 @@ +# See https://pre-commit.com for more information +# See https://pre-commit.com/hooks.html for more hooks +repos: +- repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.5.0 + hooks: + - id: trailing-whitespace + - id: end-of-file-fixer + - id: check-yaml + - id: check-added-large-files + +- repo: https://github.com/python-jsonschema/check-jsonschema + rev: 0.28.0 + hooks: + - id: check-github-workflows + - id: check-dependabot From 236f3415aa0e8077bb528ad98fe4fd785c0e3fcd Mon Sep 17 00:00:00 2001 From: Bruce Becker Date: Wed, 20 Mar 2024 19:10:36 +0100 Subject: [PATCH 03/12] chore: add ansible-lint pre-commit hook Signed-off-by: Bruce Becker --- .pre-commit-config.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 596c4a4f..5275700a 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -9,6 +9,18 @@ repos: - id: check-yaml - id: check-added-large-files +- repo: https://github.com/ansible-community/ansible-lint + rev: v24.2.1 + hooks: + - id: ansible-lint + args: [ + "--exclude", "standalone-runner/", + "--exclude", "examples/", + "--exclude", ".pre-commit-config.yaml", + "--exclude", "roles/" + ] + + - repo: https://github.com/python-jsonschema/check-jsonschema rev: 0.28.0 hooks: From f113320a5ff7c6855caac2822fa988a67696136c Mon Sep 17 00:00:00 2001 From: Bruce Becker Date: Wed, 20 Mar 2024 19:11:30 +0100 Subject: [PATCH 04/12] build(deps): add ansible role declarations WIP #268 Signed-off-by: Bruce Becker --- requirements.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 requirements.yml diff --git a/requirements.yml b/requirements.yml new file mode 100644 index 00000000..b5f2a282 --- /dev/null +++ b/requirements.yml @@ -0,0 +1,10 @@ +- name: ipr-cnrs.nftables + version: v2.2.1 +- name: arillso.logrotate + version: 1.6.1 +- name: geerlingguy.nodejs + version: 7.0.0 +- name: Oefenweb.yarn + version: v1.0.52 +- name: infOpen.openjdk-jdk + version: 0.4.0 From aaa9583dda340e67e22cecdc6fd47314d59c2483 Mon Sep 17 00:00:00 2001 From: Bruce Becker Date: Wed, 20 Mar 2024 19:17:11 +0100 Subject: [PATCH 05/12] chore: only run ansible-lint pre-commit on playbooks Signed-off-by: Bruce Becker --- .pre-commit-config.yaml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 5275700a..a8a5f38e 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -13,11 +13,13 @@ repos: rev: v24.2.1 hooks: - id: ansible-lint + always_run: false + files: ^.*.yml + additional_dependencies: + - ansible-core>=2.16.0 args: [ - "--exclude", "standalone-runner/", - "--exclude", "examples/", "--exclude", ".pre-commit-config.yaml", - "--exclude", "roles/" + "--exclude", "roles/" # Exclude roles for now. ] From 58aef5016b04dfebd2e905fc4e99107d5bef9fa9 Mon Sep 17 00:00:00 2001 From: Bruce Becker Date: Wed, 20 Mar 2024 19:21:45 +0100 Subject: [PATCH 06/12] ci: add ansible lint task Signed-off-by: Bruce Becker --- .github/workflows/lint.yml | 13 +++++++++++++ .pre-commit-config.yaml | 1 + 2 files changed, 14 insertions(+) create mode 100644 .github/workflows/lint.yml diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml new file mode 100644 index 00000000..0d53aefa --- /dev/null +++ b/.github/workflows/lint.yml @@ -0,0 +1,13 @@ +# .github/workflows/ansible-lint.yml +name: ansible-lint +on: + pull_request: + branches: ["main"] +jobs: + build: + name: Ansible Lint + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Run ansible-lint + uses: ansible/ansible-lint@v6.22.2 diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index a8a5f38e..55eceb5b 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -15,6 +15,7 @@ repos: - id: ansible-lint always_run: false files: ^.*.yml + exclude: .github additional_dependencies: - ansible-core>=2.16.0 args: [ From 9de8fd8832b5d7ae39476a1fbd5e58a7cec88985 Mon Sep 17 00:00:00 2001 From: Bruce Becker Date: Wed, 20 Mar 2024 19:54:51 +0100 Subject: [PATCH 07/12] chore(deps): update ansible ecosystem Signed-off-by: Bruce Becker --- requirements.txt | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 437ab560..6e12c515 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,4 +1,7 @@ -ansible==8.5.0 +ansible==9.3.0 +ansible-base==2.10.17 +ansible-core==2.16.4 +ansible-lint==24.2.1 dnspython==2.1.0 passlib==1.7.4 jmespath==0.10.0 From 13c03388d425758beeedb6cdab957c66156355f8 Mon Sep 17 00:00:00 2001 From: Bruce Becker Date: Wed, 20 Mar 2024 19:56:32 +0100 Subject: [PATCH 08/12] style(apiserver): update playbook to pass lint Signed-off-by: Bruce Becker --- apiservers.yml | 102 ++++++++++++++++++++++++++----------------------- 1 file changed, 54 insertions(+), 48 deletions(-) diff --git a/apiservers.yml b/apiservers.yml index f90f145f..090374c9 100644 --- a/apiservers.yml +++ b/apiservers.yml @@ -1,13 +1,13 @@ # file: apiservers.yml # --- - -- hosts: api +- name: Deploy API servers + hosts: api roles: - # ansible-galaxy install geerlingguy.nodejs - - { role: geerlingguy.nodejs, become: yes } - # ansible-galaxy install Oefenweb.yarn - - { role: Oefenweb.yarn, become: yes } + - role: geerlingguy.nodejs + become: true + - role: Oefenweb.yarn + become: true vars: nodejs_version: "10.x" nodejs_npm_global_packages: @@ -25,51 +25,54 @@ gecos: "RCIAM COmanage Registry API Server,,," shell: /bin/bash home: /srv/comanage-registry-simple-membership-api - + tasks: - name: Ensure RCIAM API dependencies are installed - apt: - name: - - git + become: true + ansible.builtin.apt: + name: git state: present - install_recommends: no - update_cache: yes + install_recommends: false + update_cache: true cache_valid_time: 86400 - become: yes + - name: Ensure RCIAM COmanage Registry API group exists - group: + become: true + ansible.builtin.group: name: "{{ rciam_api.user.group }}" - system: yes - become: yes + system: true - name: Ensure RCIAM COmanage Registry API user exists - user: + become: true + ansible.builtin.user: name: "{{ rciam_api.user.name }}" groups: "{{ rciam_api.user.group }}" - comment: "{{ rciam_api.user.gecos }}" + comment: "{{ rciam_api.user.gecos }}" shell: "{{ rciam_api.user.shell }}" home: "{{ rciam_api.user.home }}" - system: yes - create_home: yes + system: true + create_home: true skeleton: "/empty" - become: yes + - name: Ensure RCIAM COmanage Registry API code checkout directory exists - file: + become: true + ansible.builtin.file: path: "{{ rciam_api.path }}" owner: "{{ rciam_api.user.name }}" group: "{{ rciam_api.user.group }}" state: directory - become: yes + mode: "0775" + - name: Ensure RCIAM COmanage Registry API code checkout is up-to-date - git: + become: true + become_user: "{{ rciam_api.user.name }}" + ansible.builtin.git: repo: "{{ rciam_api.repo_url }}" dest: "{{ rciam_api.path }}" version: "{{ rciam_api.repo_version }}" - become: yes - become_user: "{{ rciam_api.user.name }}" notify: Restart RCIAM COmanage Registry API processes # TODO- name: Ensure RCIAM COmanage Registry API current symlink to code checkout directory exists @@ -82,52 +85,55 @@ # become: yes - name: Ensure RCIAM COmanage Registry API is configured - template: + become: true + ansible.builtin.template: src: "{{ playbook_dir }}/templates/comanage-registry-simple-membership-api/settings.js.j2" dest: "{{ rciam_api.path }}/settings.js" owner: "{{ rciam_api.user.name }}" group: "{{ rciam_api.user.group }}" - mode: 0400 - backup: yes - become: yes + mode: "0400" + backup: true notify: Restart RCIAM COmanage Registry API processes - name: Ensure RCIAM COmanage Registry API packages are installed - yarn: - path: "{{ rciam_api.path }}" - production: yes - become: yes + become: true become_user: "{{ rciam_api.user.name }}" + community.general.yarn: + path: "{{ rciam_api.path }}" + production: true handlers: - - name: Delete existing RCIAM COmanage Registry API pm2 processes if running - command: + become: true + become_user: "{{ rciam_api.user.name }}" + ansible.builtin.command: # noqa: no-changed-when cmd: "/usr/local/lib/npm/bin/pm2 delete {{ rciam_api.name }}" chdir: "{{ rciam_api.path }}" - ignore_errors: yes - become: yes - become_user: "{{ rciam_api.user.name }}" + ignore_errors: true # noqa: ignore-errors + # failed_when: # Add acceptable failure conditions listen: Restart RCIAM COmanage Registry API processes - name: Ensure RCIAM COmanage Registry API pm2 processes are running - command: + become: true + become_user: "{{ rciam_api.user.name }}" + ansible.builtin.command: # noqa: no-changed-when cmd: "/usr/local/lib/npm/bin/pm2 start server.js -i 2 --name {{ rciam_api.name }}" chdir: "{{ rciam_api.path }}" - become: yes - become_user: "{{ rciam_api.user.name }}" + # changed_when: # Add acceptable change conditions to ensure idempotency listen: Restart RCIAM COmanage Registry API processes - name: Ensure RCIAM COmanage Registry API init script exists - command: + become: true + ansible.builtin.command: # noqa: no-changed-when cmd: "/usr/local/lib/npm/lib/node_modules/pm2/bin/pm2 startup systemd -u {{ rciam_api.user.name }} --hp {{ rciam_api.user.home }}" - become: yes + # changed_when: # Add acceptable change conditions to ensure idempotency listen: Restart RCIAM COmanage Registry API processes - + - name: Ensure RCIAM COmanage Registry API process list is saved - command: + become: true + become_user: "{{ rciam_api.user.name }}" + ansible.builtin.command: # noqa: no-changed-when cmd: "/usr/local/lib/npm/lib/node_modules/pm2/bin/pm2 save" chdir: "{{ rciam_api.path }}" - become: yes - become_user: "{{ rciam_api.user.name }}" listen: Restart RCIAM COmanage Registry API processes + # changed_when: # Add acceptable change conditions to ensure idempotency From 9d17329809b06f5006f81f164df12d0728903aa5 Mon Sep 17 00:00:00 2001 From: Bruce Becker Date: Thu, 28 Mar 2024 16:03:40 +0100 Subject: [PATCH 09/12] style: Conform to Ansible > 2.10 (#4) style(attrauth): fix lint issues in playbook style(apache): fix ansible-lint issues in defaults and handlers style(apache): fix lint in OS-dependent configuration tasks style(apache): fix linting issues in ssl config tasks style(apache): apply ansible-lint's opinionated fix to role style(apache): align name of handler to respect ansible-lint rules style(apache): apply lint fixes to main tasks style(comange-registry): apply linting rules to defaults style(comange-registry): apply linting rules to configure tasks style(comanage): declare no changes in ad-hoc commands This should be updated when we know how to identify a change in order to ensure idempotency style(comanage): split long install command over several lines style(comanage): apply linting fixes to install tasks style(comanage): explicitly ignore idempotency in cache clear task style(comanage): explicitly ignore idempotency in static files tasks style(php): fix linting errors in role defaults style(php): fix linting errors in role defaults style(php): fix linting errors in role taks and vars style(shibboleth-sp): fix linting errors in role defaults style(shibboleth-sp): fix linting errors in role main tasks style(shibboleth-sp): fix all linting errors in role WIP #270 WIP #267 style(common): apply linting rules to role defaults style(common): apply linting rules to role defaults style(common): fix linting errors in main role tasks style(common): apply linting fixes to role tasks and vars style(ssp): make role defaults pass ansible lint chore(deps): freeze current requirements for dependabot style(ssp): apply style rules to ssp handlers style(ssp): reduce linting warnings in role composer tasks style(ssp): apply linting rules to configure-common tasks style(ssp): ensure configure-saml and shib tasks pass lint style(ssp): ensure authservers playbook passes Ansible lint WIP #270 style(authzkeys): conform to Ansible Lint style style(cache): conform to ansible style guide style(cert2saml): conform to ansible style for ssp module role style(comanage): conform comanage playbook and roles to Ansible style guide style(d4science): conform playbook to Ansible lint style(postgres): conform db playbook and postgres role to ansible lint style(egi-igtf): conform EGI IGTF role and playbook to Ansible Lint refactor(egi-igtf): move task to handler style(deep2saml): conform playbook to Ansible Lint style(federation-registry): conform to ansible lint Some task modules have been changed from postgresql_query to postgresql_script style(fedreg): conform to ansible lint style(firewall): conform to ansible lint style(google2saml): conform to ansible lint chore: ignore editor cruft style(keycloak): conform to Ansible Lint style(keycloak): conform to Ansible Lint style(metrics): conform metrics servers to Ansible Lint style(monservers): conform monservers to Ansible Lint style(oauth2saml): conform to Ansible Lint style(ldap): conform to Ansible Lint style(orcid): conform to Ansible Lint style(rciam-keycloak,nginx,rsyslog,webproxy): conform to Ansible Lint style(oidc): conform to Ansible Lint style(registry-ui): conform to Ansible Lit chore: add detect-secrets pre-commit hook style(saml,oidc): conform to Ansible Lint style(secrets): conform to Ansible Lint style(site): conform to Ansible Lint style(ssp): conform to Ansible Lint fix(apache): fix module name style(utils): conform to Ansible Lint style: conform to Ansible Lint --------- Signed-off-by: Bruce Becker Signed-off-by: Bruce Becker --- .ansible-lint | 9 + .gitignore | 6 +- .pre-commit-config.yaml | 23 +- .secrets.baseline | 479 +++++++++++ ansible.cfg | 8 +- attrauthservers.yml | 8 +- authservers.yml | 6 +- authzkeys.yml | 19 +- cacheservers.yml | 5 +- cert2samlservers.yml | 6 +- cmrolesuiservers.yml | 7 +- .../PLACEHOLDER/secrets_env.yml.PLACEHOLDER | 4 +- d4science2samlservers.yml | 18 +- dbservers.yml | 5 +- deep2samlservers.yml | 16 +- egi-igtf.yml | 7 +- federation-registry.yml | 18 +- fedregagents.yml | 13 +- firewallservers.yml | 7 +- google2samlservers.yml | 22 +- .../example/group_vars/authservers.yml | 47 +- .../example/group_vars/cacheservers.yml | 4 +- keycloakservers.yml | 6 +- logrotateservers.yml | 4 +- metricsservers.yml | 3 +- monservers.yml | 72 +- oauth2samlservers.yml | 16 +- openldapservers.yml | 6 +- orcid2samlservers.yml | 5 +- rciam-keycloak.yml | 12 +- rciam-oidc-client.yml | 3 +- registryservers-roles-ui.yml | 13 +- registryservers.yml | 7 +- requirements.txt | 34 +- roles/apache/defaults/main.yml | 43 +- roles/apache/handlers/main.yml | 7 +- roles/apache/tasks/configure-Debian.yml | 69 +- roles/apache/tasks/configure-RedHat.yml | 71 +- roles/apache/tasks/configure-ssl-cert.yml | 33 +- roles/apache/tasks/install-Debian.yml | 21 +- roles/apache/tasks/install-RedHat.yml | 19 +- roles/apache/tasks/main.yml | 30 +- roles/apache/vars/Debian.yml | 6 +- roles/apache/vars/RedHat.yml | 4 +- roles/cm-role-ui/defaults/main.yml | 12 +- roles/cm-role-ui/tasks/configure-common.yml | 12 +- roles/cm-role-ui/tasks/install-common.yml | 24 +- roles/cm-role-ui/tasks/main.yml | 19 +- .../defaults/main.yml | 8 +- .../tasks/configure.yml | 13 +- .../tasks/install.yml | 31 +- .../comanage-registry-plugins/tasks/main.yml | 23 +- roles/comanage-registry/defaults/main.yml | 198 ++--- roles/comanage-registry/tasks/configure.yml | 126 +-- roles/comanage-registry/tasks/initialize.yml | 18 +- roles/comanage-registry/tasks/install.yml | 44 +- roles/comanage-registry/tasks/main.yml | 51 +- .../comanage-registry/tasks/static_files.yml | 23 +- .../templates/bootstrap.php.j2 | 4 +- roles/comanage-registry/vars/Debian.yml | 4 +- roles/common/defaults/main.yml | 3 +- roles/common/handlers/main.yml | 8 +- roles/common/tasks/configure-Debian.yml | 11 +- roles/common/tasks/configure-common.yml | 7 +- roles/common/tasks/install-Debian.yml | 11 +- roles/common/tasks/main.yml | 21 +- roles/common/vars/Debian.yml | 3 +- roles/dirmngr/tasks/install-Debian.yml | 13 +- roles/dirmngr/tasks/main.yml | 7 +- roles/egi-igtf/handlers/main.yml | 4 + roles/egi-igtf/tasks/configure-Debian.yml | 26 +- roles/egi-igtf/tasks/install-Debian.yml | 24 +- roles/egi-igtf/tasks/main.yml | 12 +- roles/federation-registry/README.md | 32 +- .../federation-registry/defaults/config.json | 5 +- roles/federation-registry/defaults/main.yml | 16 +- .../defaults/setup_tenant.sql | 3 +- .../tasks/configure-ams.yml | 161 ++-- .../tasks/configure-environment.yml | 45 +- roles/federation-registry/tasks/deploy.yml | 377 ++++---- roles/federation-registry/tasks/main.yml | 6 +- roles/federation-registry/tasks/postgres.yml | 31 +- .../templates/ams_authorized_users.j2 | 2 +- .../templates/react-config.j2 | 2 +- roles/fedreg-agent/defaults/main.yml | 6 +- roles/fedreg-agent/handlers/main.yml | 8 + roles/fedreg-agent/tasks/configure-common.yml | 19 +- roles/fedreg-agent/tasks/deploy.yml | 45 +- roles/fedreg-agent/tasks/main.yml | 8 +- roles/fedreg-agent/tasks/services.yml | 59 +- roles/git/tasks/install-Debian.yml | 15 +- roles/git/tasks/main.yml | 10 +- roles/jq/tasks/install-Debian.yml | 16 +- roles/jq/tasks/main.yml | 7 +- roles/keycloak/defaults/main.yml | 48 +- roles/keycloak/handlers/main.yml | 21 +- .../create_update_client_reg_policy.yml | 51 +- .../delete_client_reg_policy.yml | 24 +- .../tasks/blocks/configure_basic_realm.yml | 35 +- .../blocks/configure_client_reg_policies.yml | 17 +- .../blocks/configure_client_scope_mappers.yml | 51 +- .../tasks/blocks/configure_client_scopes.yml | 84 +- .../tasks/blocks/configure_default_idp.yml | 37 +- .../tasks/blocks/configure_event_logging.yml | 54 +- .../blocks/configure_federation_mapper.yml | 54 +- .../tasks/blocks/configure_federations.yml | 53 +- .../tasks/blocks/configure_idp_mappers.yml | 59 +- .../tasks/blocks/configure_saml_idps.yml | 36 +- .../tasks/blocks/configure_social_idps.yml | 32 +- .../keycloak/tasks/blocks/configure_theme.yml | 17 +- .../blocks/helpers/get_client_scopes_list.yml | 5 +- .../blocks/helpers/get_idp_mappers_list.yml | 8 +- .../blocks/helpers/get_realm_idps_list.yml | 7 +- .../tasks/blocks/helpers/get_realm_keys.yml | 7 +- .../tasks/blocks/helpers/get_tokens.yml | 13 +- .../helpers/search_realm_federations.yml | 10 +- .../blocks/helpers/setup_logs_folder.yml | 54 +- .../unassign_default_client_scopes.yml | 24 +- .../unassign_default_default_client_scope.yml | 13 +- ...unassign_default_optional_client_scope.yml | 11 +- .../tasks/blocks/keys/configure_keys.yml | 33 +- .../blocks/keys/create_javakeystores.yml | 31 +- .../add_remove_client_default_roles.yml | 17 +- .../configure_client_default_roles.yml | 26 +- .../blocks/roles_configuration/configure.yml | 10 +- .../configure_default_roles.yml | 20 +- .../configure_role_composites.yml | 16 +- .../roles_configuration/configure_roles.yml | 36 +- roles/keycloak/tasks/configure.yml | 153 ++-- roles/keycloak/tasks/java/Debian-bookworm.yml | 7 +- roles/keycloak/tasks/java/Debian-bullseye.yml | 7 +- roles/keycloak/tasks/java/Debian-buster.yml | 7 +- roles/keycloak/tasks/java/Ubuntu-focal.yml | 7 +- roles/keycloak/tasks/main.yml | 126 +-- roles/keycloak/tasks/quarkus/install.yml | 85 +- .../keycloak/tasks/quarkus/install_plugin.yml | 27 +- roles/keycloak/tasks/wildfly/install.yml | 106 +-- .../keycloak/tasks/wildfly/install_plugin.yml | 39 +- roles/keycloak/vars/keycloak-13.yml | 3 +- roles/keycloak/vars/keycloak-14.yml | 2 +- roles/keycloak/vars/keycloak-15.yml | 3 +- roles/keycloak/vars/keycloak-16.yml | 3 +- roles/keycloak/vars/os/Debian-buster.yml | 4 +- roles/letsencrypt/defaults/main.yml | 8 +- roles/letsencrypt/tasks/install-Debian.yml | 55 +- roles/letsencrypt/tasks/main.yml | 6 +- roles/memcached/defaults/main.yml | 7 +- roles/memcached/handlers/main.yml | 7 +- roles/memcached/tasks/configure-common.yml | 7 +- roles/memcached/tasks/install-Debian.yml | 7 +- roles/memcached/tasks/install-common.yml | 7 +- roles/memcached/tasks/main.yml | 20 +- roles/nginx/defaults/main.yml | 12 +- roles/nginx/handlers/main.yml | 6 +- roles/nginx/tasks/configure-common.yml | 35 +- roles/nginx/tasks/configure-ssl-cert.yml | 24 +- roles/nginx/tasks/install-Debian.yml | 8 +- roles/nginx/tasks/main.yml | 21 +- roles/nginx/templates/vhosts.conf.j2 | 2 +- roles/openldap/defaults/main.yml | 20 +- roles/openldap/handlers/main.yml | 15 +- roles/openldap/tasks/configure.yml | 301 ++++--- roles/openldap/tasks/install-Debian.yml | 53 +- roles/openldap/tasks/main.yml | 17 +- roles/openldap/tasks/populate.yml | 23 +- roles/openldap/vars/Debian.yml | 2 +- roles/php/defaults/main.yml | 7 +- roles/php/handlers/main.yml | 7 +- roles/php/tasks/configure.yml | 13 +- roles/php/tasks/install-Debian.yml | 37 +- roles/php/tasks/install-RedHat.yml | 25 +- roles/php/tasks/main.yml | 22 +- roles/php/vars/Debian-bookworm.yml | 10 +- roles/php/vars/Debian-bullseye.yml | 10 +- roles/php/vars/Debian-buster.yml | 10 +- roles/php/vars/Debian-jessie.yml | 6 +- roles/php/vars/Debian-stretch.yml | 10 +- roles/php/vars/RedHat.yml | 6 +- roles/php/vars/Ubuntu-focal.yml | 10 +- roles/postgresql/defaults/main.yml | 102 +-- roles/postgresql/handlers/main.yml | 12 +- roles/postgresql/tasks/configure-common.yml | 106 ++- .../postgresql/tasks/init-standby-common.yml | 32 +- roles/postgresql/tasks/install-Debian.yml | 19 +- roles/postgresql/tasks/main.yml | 34 +- .../templates/postgresql-11.conf.j2 | 2 +- .../templates/postgresql-12.conf.j2 | 2 +- roles/rciam-metrics/defaults/main.yml | 8 +- roles/rciam-metrics/handlers/main.yml | 10 +- roles/rciam-metrics/tasks/bootstrap.yml | 39 +- roles/rciam-metrics/tasks/configure-local.yml | 12 +- roles/rciam-metrics/tasks/deploy-backend.yml | 64 +- roles/rciam-metrics/tasks/deploy-frontend.yml | 25 +- roles/rciam-metrics/tasks/install-Debian.yml | 11 +- roles/rciam-metrics/tasks/main.yml | 21 +- .../tasks/configure-common.yml | 7 +- .../tasks/install-common-client.yml | 38 +- .../tasks/install-common.yml | 10 +- roles/rciam-oidc-client/tasks/main.yml | 8 +- roles/rciam-probes/defaults/main.yml | 4 +- roles/rciam-probes/handlers/main.yml | 2 - roles/rciam-probes/tasks/configure-RedHat.yml | 31 +- roles/rciam-probes/tasks/install-RedHat.yml | 29 +- roles/rciam-probes/tasks/main.yml | 26 +- roles/rciam-probes/tasks/update-static.yml | 18 +- roles/rciam-probes/vars/RedHat-7.yml | 2 +- roles/rciam-probes/vars/RedHat-8.yml | 8 +- roles/rciam-probes/vars/RedHat.yml | 7 +- roles/rciam-utils/defaults/main.yml | 4 +- roles/rciam-utils/tasks/configure.yml | 51 +- roles/rciam-utils/tasks/install-Debian.yml | 36 +- roles/rciam-utils/tasks/install-common.yml | 26 +- roles/rciam-utils/tasks/main.yml | 15 +- .../rciam-sync-client-names/config.py.j2 | 6 +- roles/rsyslog-pgsql/handlers/main.yml | 4 +- .../rsyslog-pgsql/tasks/configure-common.yml | 20 +- roles/rsyslog-pgsql/tasks/install-Debian.yml | 11 +- roles/rsyslog-pgsql/tasks/main.yml | 20 +- roles/shibboleth-sp/defaults/main.yml | 88 +- roles/shibboleth-sp/files/attribute-map.xml | 16 +- .../shibboleth-sp/files/attribute-policy.xml | 6 +- roles/shibboleth-sp/handlers/main.yml | 6 +- .../shibboleth-sp/tasks/configure-common.yml | 64 +- roles/shibboleth-sp/tasks/install-Debian.yml | 9 +- roles/shibboleth-sp/tasks/install-common.yml | 5 +- roles/shibboleth-sp/tasks/main.yml | 40 +- .../templates/shibboleth2.xml.j2 | 24 +- roles/shibboleth-sp/vars/Debian-buster.yml | 8 +- roles/shibboleth-sp/vars/Debian-jessie.yml | 8 +- roles/shibboleth-sp/vars/Debian-stretch.yml | 8 +- .../defaults/main.yml | 16 +- .../tasks/configure-common.yml | 21 +- .../tasks/install-common.yml | 12 +- .../ssp-module-proxystatistics/tasks/main.yml | 9 +- roles/ssp-modules/defaults/main.yml | 11 +- roles/ssp-modules/handlers/main.yml | 11 +- roles/ssp-modules/tasks/configure-common.yml | 28 +- .../tasks/install-common-Ubuntu.yml | 11 +- roles/ssp-modules/tasks/install-common.yml | 54 +- roles/ssp-modules/tasks/install-db.yml | 11 +- roles/ssp-modules/tasks/main.yml | 25 +- roles/ssp-modules/vars/Debian.yml | 3 +- roles/ssp-modules/vars/RedHat.yml | 2 - roles/ssp-modules/vars/Ubuntu-focal.yml | 3 +- roles/ssp-modules/vars/main.yml | 2 - roles/ssp/defaults/main.yml | 813 +++++++++--------- roles/ssp/handlers/main.yml | 10 +- roles/ssp/tasks/composer.yml | 76 +- roles/ssp/tasks/configure-common.yml | 226 ++--- .../ssp/tasks/configure-saml20-idp-hosted.yml | 16 +- .../ssp/tasks/configure-shib13-idp-hosted.yml | 16 +- roles/ssp/tasks/install-Debian.yml | 30 +- roles/ssp/tasks/install-RedHat.yml | 25 +- roles/ssp/tasks/install-common.yml | 49 +- roles/ssp/tasks/install-release.yml | 36 +- roles/ssp/tasks/install-source.yml | 20 +- roles/ssp/tasks/main.yml | 56 +- roles/ssp/tasks/twig.yml | 51 +- .../config/module_discopower-1.14.php.j2 | 6 +- .../config/module_discopower-1.17.php.j2 | 2 +- .../config/module_discopower-1.18.php.j2 | 2 +- .../config/module_discopower-2.php.j2 | 2 +- roles/ssp/vars/Debian.yml | 9 +- roles/ssp/vars/RedHat.yml | 8 +- roles/ssp/vars/main.yml | 2 +- roles/ssp/vars/ssp-1.yml | 4 +- roles/ssp/vars/ssp-2.yml | 4 +- roles/tomcat/defaults/main.yml | 28 +- roles/tomcat/handlers/main.yml | 6 +- roles/tomcat/tasks/configure-common.yml | 14 +- roles/tomcat/tasks/deploy-webapp.yml | 70 +- roles/tomcat/tasks/install-Debian.yml | 9 +- roles/tomcat/tasks/main.yml | 42 +- roles/tomcat/templates/server-8.5.xml.j2 | 2 +- roles/tomcat/templates/server-8.xml.j2 | 2 +- roles/tomcat/templates/server-9.xml.j2 | 2 +- saml2oidcservers.yml | 7 +- saml2samlservers.yml | 6 +- secrets.yml | 124 +-- site.yml | 10 +- sspservers.yml | 3 +- .../rciam-sync-client-names/config.py.j2 | 4 +- utilservers.yml | 3 +- webproxyservers.yml | 23 +- webservers.yml | 11 +- 285 files changed, 4753 insertions(+), 3742 deletions(-) create mode 100644 .ansible-lint create mode 100644 .secrets.baseline create mode 100644 roles/egi-igtf/handlers/main.yml diff --git a/.ansible-lint b/.ansible-lint new file mode 100644 index 00000000..d7b2f251 --- /dev/null +++ b/.ansible-lint @@ -0,0 +1,9 @@ +exclude_paths: + - .pre-commit-config.yaml + - icingaagents.yml + - roles/common/handlers/main.yml + - authzkeys.yml + - inventories +offline: false +skip_list: + - role-name diff --git a/.gitignore b/.gitignore index c3cb7c0b..d72fc806 100644 --- a/.gitignore +++ b/.gitignore @@ -5,7 +5,8 @@ .LSOverride # Icon must end with two \r -Icon +Icon + # Thumbnails ._* @@ -25,3 +26,6 @@ Network Trash Folder Temporary Items .apdisk # END OSX.gitignore + +# ignore editor cruft +.vscode diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 55eceb5b..6bd8c584 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -8,6 +8,15 @@ repos: - id: end-of-file-fixer - id: check-yaml - id: check-added-large-files + - id: requirements-txt-fixer + +- repo: https://github.com/Yelp/detect-secrets + rev: v1.4.0 + hooks: + - id: detect-secrets + args: + - --baseline + - .secrets.baseline - repo: https://github.com/ansible-community/ansible-lint rev: v24.2.1 @@ -18,11 +27,15 @@ repos: exclude: .github additional_dependencies: - ansible-core>=2.16.0 - args: [ - "--exclude", ".pre-commit-config.yaml", - "--exclude", "roles/" # Exclude roles for now. - ] - + args: + - --exclude + - .pre-commit-config.yaml + - icingaagents.yml + # For some reason noqa is not being picked up on these files + - roles/common/handlers/main.yml + - authzkeys.yml + # ssp-modules is a bad name for a role + - roles/ssp-modules - repo: https://github.com/python-jsonschema/check-jsonschema rev: 0.28.0 diff --git a/.secrets.baseline b/.secrets.baseline new file mode 100644 index 00000000..9e4ba683 --- /dev/null +++ b/.secrets.baseline @@ -0,0 +1,479 @@ +{ + "version": "1.4.0", + "plugins_used": [ + { + "name": "ArtifactoryDetector" + }, + { + "name": "AWSKeyDetector" + }, + { + "name": "AzureStorageKeyDetector" + }, + { + "name": "Base64HighEntropyString", + "limit": 4.5 + }, + { + "name": "BasicAuthDetector" + }, + { + "name": "CloudantDetector" + }, + { + "name": "DiscordBotTokenDetector" + }, + { + "name": "GitHubTokenDetector" + }, + { + "name": "HexHighEntropyString", + "limit": 3.0 + }, + { + "name": "IbmCloudIamDetector" + }, + { + "name": "IbmCosHmacDetector" + }, + { + "name": "JwtTokenDetector" + }, + { + "name": "KeywordDetector", + "keyword_exclude": "" + }, + { + "name": "MailchimpDetector" + }, + { + "name": "NpmDetector" + }, + { + "name": "PrivateKeyDetector" + }, + { + "name": "SendGridDetector" + }, + { + "name": "SlackDetector" + }, + { + "name": "SoftlayerDetector" + }, + { + "name": "SquareOAuthDetector" + }, + { + "name": "StripeDetector" + }, + { + "name": "TwilioKeyDetector" + } + ], + "filters_used": [ + { + "path": "detect_secrets.filters.allowlist.is_line_allowlisted" + }, + { + "path": "detect_secrets.filters.common.is_baseline_file", + "filename": ".secrets.baseline" + }, + { + "path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies", + "min_level": 2 + }, + { + "path": "detect_secrets.filters.heuristic.is_indirect_reference" + }, + { + "path": "detect_secrets.filters.heuristic.is_likely_id_string" + }, + { + "path": "detect_secrets.filters.heuristic.is_lock_file" + }, + { + "path": "detect_secrets.filters.heuristic.is_not_alphanumeric_string" + }, + { + "path": "detect_secrets.filters.heuristic.is_potential_uuid" + }, + { + "path": "detect_secrets.filters.heuristic.is_prefixed_with_dollar_sign" + }, + { + "path": "detect_secrets.filters.heuristic.is_sequential_string" + }, + { + "path": "detect_secrets.filters.heuristic.is_swagger_file" + }, + { + "path": "detect_secrets.filters.heuristic.is_templated_secret" + } + ], + "results": { + "roles/apache/defaults/main.yml": [ + { + "type": "Secret Keyword", + "filename": "roles/apache/defaults/main.yml", + "hashed_secret": "de8aa86286dbb8eb74d2748c7b6d4486d0458203", + "is_verified": false, + "line_number": 19, + "is_secret": false + } + ], + "roles/comanage-registry/defaults/main.yml": [ + { + "type": "Secret Keyword", + "filename": "roles/comanage-registry/defaults/main.yml", + "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8", + "is_verified": false, + "line_number": 45, + "is_secret": true + }, + { + "type": "Secret Keyword", + "filename": "roles/comanage-registry/defaults/main.yml", + "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4", + "is_verified": false, + "line_number": 75, + "is_secret": true + } + ], + "roles/comanage-registry/templates/core.php.j2": [ + { + "type": "Secret Keyword", + "filename": "roles/comanage-registry/templates/core.php.j2", + "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8", + "is_verified": false, + "line_number": 322, + "is_secret": true + } + ], + "roles/federation-registry/defaults/main.yml": [ + { + "type": "Secret Keyword", + "filename": "roles/federation-registry/defaults/main.yml", + "hashed_secret": "011228a1c7888a9c99379c1e6bce9328ca6153ea", + "is_verified": false, + "line_number": 14, + "is_secret": true + }, + { + "type": "Secret Keyword", + "filename": "roles/federation-registry/defaults/main.yml", + "hashed_secret": "fc4ba7249ac2f9430f9f2de2f8bf2c37c5345fa4", + "is_verified": false, + "line_number": 16, + "is_secret": true + }, + { + "type": "Secret Keyword", + "filename": "roles/federation-registry/defaults/main.yml", + "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8", + "is_verified": false, + "line_number": 46, + "is_secret": false + } + ], + "roles/keycloak/templates/13.0.0/standalone-ha.xml.j2": [ + { + "type": "Secret Keyword", + "filename": "roles/keycloak/templates/13.0.0/standalone-ha.xml.j2", + "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8", + "is_verified": false, + "line_number": 47, + "is_secret": true + } + ], + "roles/keycloak/templates/14.0.0/standalone-ha.xml.j2": [ + { + "type": "Secret Keyword", + "filename": "roles/keycloak/templates/14.0.0/standalone-ha.xml.j2", + "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8", + "is_verified": false, + "line_number": 47, + "is_secret": true + } + ], + "roles/keycloak/templates/15.0.2/standalone-ha.xml.j2": [ + { + "type": "Secret Keyword", + "filename": "roles/keycloak/templates/15.0.2/standalone-ha.xml.j2", + "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8", + "is_verified": false, + "line_number": 47, + "is_secret": true + } + ], + "roles/openldap/defaults/main.yml": [ + { + "type": "Secret Keyword", + "filename": "roles/openldap/defaults/main.yml", + "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4", + "is_verified": false, + "line_number": 28, + "is_secret": true + } + ], + "roles/rciam-metrics/defaults/main.yml": [ + { + "type": "Secret Keyword", + "filename": "roles/rciam-metrics/defaults/main.yml", + "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4", + "is_verified": false, + "line_number": 84, + "is_secret": true + }, + { + "type": "Secret Keyword", + "filename": "roles/rciam-metrics/defaults/main.yml", + "hashed_secret": "a0281cd072cea8e80e7866b05dc124815760b6c9", + "is_verified": false, + "line_number": 87, + "is_secret": true + } + ], + "roles/rciam-oidc-client/defaults/main.yml": [ + { + "type": "Secret Keyword", + "filename": "roles/rciam-oidc-client/defaults/main.yml", + "hashed_secret": "ea06090a0b9590add823ade2334090fa216acb2b", + "is_verified": false, + "line_number": 21, + "is_secret": true + }, + { + "type": "Secret Keyword", + "filename": "roles/rciam-oidc-client/defaults/main.yml", + "hashed_secret": "4843cf9994fed3db0cf15d935bbc743937c1e692", + "is_verified": false, + "line_number": 32, + "is_secret": false + }, + { + "type": "Secret Keyword", + "filename": "roles/rciam-oidc-client/defaults/main.yml", + "hashed_secret": "a09c557bb9fb354eabbac43eb4053d31e10412b2", + "is_verified": false, + "line_number": 33, + "is_secret": false + }, + { + "type": "Secret Keyword", + "filename": "roles/rciam-oidc-client/defaults/main.yml", + "hashed_secret": "eca7926596fd7cefdcd6912449bd7e63172fb87e", + "is_verified": false, + "line_number": 34, + "is_secret": false + }, + { + "type": "Secret Keyword", + "filename": "roles/rciam-oidc-client/defaults/main.yml", + "hashed_secret": "97cdbdc7feff827efb082a6b6dd2727237cd49fd", + "is_verified": false, + "line_number": 41, + "is_secret": true + } + ], + "roles/ssp-module-proxystatistics/defaults/main.yml": [ + { + "type": "Secret Keyword", + "filename": "roles/ssp-module-proxystatistics/defaults/main.yml", + "hashed_secret": "e350d5ce0153f3e22d5db21cf2a4eff00f3ee877", + "is_verified": false, + "line_number": 29, + "is_secret": true + } + ], + "roles/ssp-modules/defaults/main.yml": [ + { + "type": "Secret Keyword", + "filename": "roles/ssp-modules/defaults/main.yml", + "hashed_secret": "0936a636d6995e987e4c3fe4afe7af211ff08a70", + "is_verified": false, + "line_number": 59, + "is_secret": true + }, + { + "type": "Secret Keyword", + "filename": "roles/ssp-modules/defaults/main.yml", + "hashed_secret": "0b874f84abac95c4ee5127ce67333745c6c77098", + "is_verified": false, + "line_number": 71, + "is_secret": true + }, + { + "type": "Secret Keyword", + "filename": "roles/ssp-modules/defaults/main.yml", + "hashed_secret": "e350d5ce0153f3e22d5db21cf2a4eff00f3ee877", + "is_verified": false, + "line_number": 136, + "is_secret": true + } + ], + "roles/ssp/defaults/main.yml": [ + { + "type": "Secret Keyword", + "filename": "roles/ssp/defaults/main.yml", + "hashed_secret": "35552f5865f33c688eff5f7e958b7074a3ddf3dc", + "is_verified": false, + "line_number": 79, + "is_secret": true + }, + { + "type": "Secret Keyword", + "filename": "roles/ssp/defaults/main.yml", + "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4", + "is_verified": false, + "line_number": 116, + "is_secret": true + } + ], + "roles/ssp/templates/config/authsources-1.14.php.j2": [ + { + "type": "Secret Keyword", + "filename": "roles/ssp/templates/config/authsources-1.14.php.j2", + "hashed_secret": "6a15c37a5492ec167761a981dc1e4f1fa140747b", + "is_verified": false, + "line_number": 45, + "is_secret": true + } + ], + "roles/ssp/templates/config/authsources-1.17.php.j2": [ + { + "type": "Secret Keyword", + "filename": "roles/ssp/templates/config/authsources-1.17.php.j2", + "hashed_secret": "6a15c37a5492ec167761a981dc1e4f1fa140747b", + "is_verified": false, + "line_number": 45, + "is_secret": false + } + ], + "roles/ssp/templates/config/authsources-1.18.php.j2": [ + { + "type": "Secret Keyword", + "filename": "roles/ssp/templates/config/authsources-1.18.php.j2", + "hashed_secret": "6a15c37a5492ec167761a981dc1e4f1fa140747b", + "is_verified": false, + "line_number": 45, + "is_secret": false + } + ], + "roles/ssp/templates/config/authsources-2.php.j2": [ + { + "type": "Secret Keyword", + "filename": "roles/ssp/templates/config/authsources-2.php.j2", + "hashed_secret": "6a15c37a5492ec167761a981dc1e4f1fa140747b", + "is_verified": false, + "line_number": 45, + "is_secret": false + } + ], + "roles/ssp/templates/config/config-2.php.j2": [ + { + "type": "Secret Keyword", + "filename": "roles/ssp/templates/config/config-2.php.j2", + "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8", + "is_verified": false, + "line_number": 148, + "is_secret": true + } + ], + "roles/ssp/templates/metadata/saml20-idp-hosted-1.14.php.j2": [ + { + "type": "Secret Keyword", + "filename": "roles/ssp/templates/metadata/saml20-idp-hosted-1.14.php.j2", + "hashed_secret": "8b12b590286f9def22f853dd5940480bfd3e619f", + "is_verified": false, + "line_number": 19, + "is_secret": false + } + ], + "roles/ssp/templates/metadata/saml20-idp-hosted-1.17.php.j2": [ + { + "type": "Secret Keyword", + "filename": "roles/ssp/templates/metadata/saml20-idp-hosted-1.17.php.j2", + "hashed_secret": "8b12b590286f9def22f853dd5940480bfd3e619f", + "is_verified": false, + "line_number": 20, + "is_secret": false + } + ], + "roles/ssp/templates/metadata/saml20-idp-hosted-1.18.php.j2": [ + { + "type": "Secret Keyword", + "filename": "roles/ssp/templates/metadata/saml20-idp-hosted-1.18.php.j2", + "hashed_secret": "8b12b590286f9def22f853dd5940480bfd3e619f", + "is_verified": false, + "line_number": 21, + "is_secret": false + } + ], + "roles/ssp/templates/metadata/shib13-idp-hosted-1.14.php.j2": [ + { + "type": "Secret Keyword", + "filename": "roles/ssp/templates/metadata/shib13-idp-hosted-1.14.php.j2", + "hashed_secret": "8b12b590286f9def22f853dd5940480bfd3e619f", + "is_verified": false, + "line_number": 19, + "is_secret": false + } + ], + "roles/ssp/templates/metadata/shib13-idp-hosted-1.17.php.j2": [ + { + "type": "Secret Keyword", + "filename": "roles/ssp/templates/metadata/shib13-idp-hosted-1.17.php.j2", + "hashed_secret": "8b12b590286f9def22f853dd5940480bfd3e619f", + "is_verified": false, + "line_number": 20, + "is_secret": false + } + ], + "roles/ssp/vars/main.yml": [ + { + "type": "Secret Keyword", + "filename": "roles/ssp/vars/main.yml", + "hashed_secret": "8c07302345e837d007eecc23871809d291b9bac1", + "is_verified": false, + "line_number": 3, + "is_secret": true + }, + { + "type": "Secret Keyword", + "filename": "roles/ssp/vars/main.yml", + "hashed_secret": "8152bc582f58c854f580cb101d3182813dec4afe", + "is_verified": false, + "line_number": 4, + "is_secret": true + } + ], + "secrets.yml": [ + { + "type": "Secret Keyword", + "filename": "secrets.yml", + "hashed_secret": "8b16dae36b11d73264c343f2a5d84c8b6d87c99b", + "is_verified": false, + "line_number": 7, + "is_secret": false + }, + { + "type": "Secret Keyword", + "filename": "secrets.yml", + "hashed_secret": "99689e42a4cfd02871e085b5af75fdfe3ac04ccf", + "is_verified": false, + "line_number": 8, + "is_secret": false + }, + { + "type": "Secret Keyword", + "filename": "secrets.yml", + "hashed_secret": "54053db99b49b4cc046f7b4854a80de3d6dfae71", + "is_verified": false, + "line_number": 78, + "is_secret": true + } + ] + }, + "generated_at": "2024-03-28T14:50:35Z" +} diff --git a/ansible.cfg b/ansible.cfg index 4cc0e3e5..42943103 100644 --- a/ansible.cfg +++ b/ansible.cfg @@ -6,7 +6,7 @@ remote_user = root # Alternatively, connect as user with sudo privileges #remote_user = bob #[privilege_escalation] -#become_ask_pass = True +#become_ask_pass = True # The comment inserted into files written by Ansible’s config templating system #ansible_managed = Ansible managed: Modified on %Y-%m-%d %H:%M:%S by {uid} on {host} @@ -16,13 +16,13 @@ stdout_callback = yaml [ssh_connection] # Reduce the number of SSH operations required to execute a module on the remote -# server to improve performance. +# server to improve performance. # Note: When using “sudo:” operations you must first disable ‘requiretty’ in # /etc/sudoers on all managed hosts. # See also http://docs.ansible.com/ansible/intro_configuration.html#pipelining pipelining = True -# Increase the ControlPersist time to encourage performance. A value of 30 -# minutes should be appropriate. +# Increase the ControlPersist time to encourage performance. A value of 30 +# minutes should be appropriate. # See also http://docs.ansible.com/ansible/intro_configuration.html#ssh-args ssh_args = -o ControlMaster=auto -o ControlPersist=1800s diff --git a/attrauthservers.yml b/attrauthservers.yml index 3915054c..dee34936 100644 --- a/attrauthservers.yml +++ b/attrauthservers.yml @@ -1,9 +1,11 @@ +# filename: attrauthservers.yml +# Deploys attribute authority servers --- - -- hosts: attrauth +- name: Deploy Attribute Authority Servers + hosts: attrauth roles: - apache - php - shibboleth-sp - comanage-registry - #- cm-role-ui + # - cm-role-ui diff --git a/authservers.yml b/authservers.yml index fa83360a..343a2c1f 100644 --- a/authservers.yml +++ b/authservers.yml @@ -1,6 +1,8 @@ --- - -- hosts: authservers +# File: authservers.yml +# Deployes authentication servers +- name: Deploy authentication servers + hosts: authservers roles: - common - ssp diff --git a/authzkeys.yml b/authzkeys.yml index fd8f8916..68918514 100644 --- a/authzkeys.yml +++ b/authzkeys.yml @@ -1,7 +1,7 @@ # file: authzkeys.yml # # Playbook for managing SSH authorized keys in ~/.ssh/authorized_keys. -# +# # The `authz_keys_paths` variable needs to be defined to specify the paths # to files containing the public keys. You can include keys based on matching # files or specifying individual paths. @@ -15,26 +15,27 @@ # authz_keys_paths: # - "{{ inventory_dir }}/files/authorized_keys/devs/alice.pub" # - "{{ inventory_dir }}/files/authorized_keys/ops/bob.pub" -# +# # N.B. The playbook will *remove* all other non-specified keys from the # authorized_keys file. Defining authz_keys_paths as an empty list # will result in an *empty* authorized_keys file # --- - -- hosts: all - +- name: Create authorized keys + hosts: all tasks: - - - set_fact: + - name: Set list fact + ansible.builtin.set_fact: authzkeys_list: "{{ lookup('file', item) }}" register: authzkeys with_fileglob: "{{ authz_keys_paths }}" - - set_fact: + - name: Set string fact + ansible.builtin.set_fact: authzkeys_string: "{{ authzkeys.results | map(attribute='ansible_facts.authzkeys_list') | join('\n') }}" - - ansible.posix.authorized_key: + - name: Create key + ansible.posix.authorized_key: # noqa syntax-check[unknown-module] user: "{{ ansible_user }}" key: "{{ authzkeys_string }}" exclusive: true diff --git a/cacheservers.yml b/cacheservers.yml index cfd9dcf5..5781edc2 100644 --- a/cacheservers.yml +++ b/cacheservers.yml @@ -1,5 +1,6 @@ --- - -- hosts: cache +# cacheservers.yml +- name: Provision Cache Servers + hosts: cache roles: - memcached diff --git a/cert2samlservers.yml b/cert2samlservers.yml index 35d12838..6e9b22e5 100644 --- a/cert2samlservers.yml +++ b/cert2samlservers.yml @@ -1,8 +1,8 @@ # file: cert2samlservers.yml -# +# --- - -- hosts: cert2saml +- name: Deploy Certificate to SML servers + hosts: cert2saml roles: - { role: apache, tags: apache } - { role: php, tags: php } diff --git a/cmrolesuiservers.yml b/cmrolesuiservers.yml index 182cd548..4cbe790e 100644 --- a/cmrolesuiservers.yml +++ b/cmrolesuiservers.yml @@ -1,11 +1,10 @@ # file: cmrolesuiservers.yml - --- - -- hosts: registry +- name: Deploy Comanage registry UI + hosts: registry roles: - { role: git, tags: git } - { role: apache, tags: apache } - { role: php, tags: php } - { role: shibboleth-sp, tags: shibboleth-sp } - - { role: cm-role-ui, tags: cm-role-ui } \ No newline at end of file + - { role: cm-role-ui, tags: cm-role-ui } diff --git a/config/PLACEHOLDER/secrets_env.yml.PLACEHOLDER b/config/PLACEHOLDER/secrets_env.yml.PLACEHOLDER index d17addec..d83c816b 100644 --- a/config/PLACEHOLDER/secrets_env.yml.PLACEHOLDER +++ b/config/PLACEHOLDER/secrets_env.yml.PLACEHOLDER @@ -43,7 +43,7 @@ ssp_authsources_saml: ssp_idp_hosts: # The entity ID should be a URI. It can also be specified as `__DYNAMIC:1__`, - # `__DYNAMIC:2__`, ... in which case, the entity ID will be generated + # `__DYNAMIC:2__`, ... in which case, the entity ID will be generated # automatically. - entity_id: "__DYNAMIC:1__" # The hostname for this IdP. One of the IdPs can also have its `host` set @@ -92,5 +92,3 @@ vault_ssp_idp_hosts: - entity_id: "__DYNAMIC:2__" ssl_certificate_key: | idp_key_CHANGEME - - diff --git a/d4science2samlservers.yml b/d4science2samlservers.yml index a28206cd..b567a63d 100644 --- a/d4science2samlservers.yml +++ b/d4science2samlservers.yml @@ -1,22 +1,28 @@ # file: d4science2samlservers.yml -# +# --- - -- hosts: d4science2saml +- name: Deploy D4Science servers + hosts: d4science2saml roles: # - { role: apache, tags: apache } # - { role: php, tags: php } - { role: ssp, tags: ssp } - { role: ssp-modules, tags: ssp-modules } tasks: - - name: Install Keycloak Provicer library v2.2.2 - shell: php composer.phar require stevenmaguire/oauth2-keycloak:v2.2.2 --ignore-platform-reqs --no-interaction --no-scripts --no-update + # Keycloak provider library version should be a variable. + - name: Install Keycloak Provider library v2.2.2 + ansible.builtin.shell: |- + php composer.phar require stevenmaguire/oauth2-keycloak:v2.2.2 \ + --ignore-platform-reqs \ + --no-interaction \ + --no-scripts \ + --no-update args: chdir: "{{ ssp_path }}/" executable: /bin/bash register: composer_results changed_when: composer_results is changed and "Nothing to install, update or remove" not in composer_results.stderr - when: ssp_mods_extra_enabled | selectattr('name','equalto','authoauth2') | list | count > 0 + when: ssp_mods_extra_enabled | selectattr('name', 'equalto', 'authoauth2') | list | count > 0 become: true tags: - install diff --git a/dbservers.yml b/dbservers.yml index f28fd914..5f8f1087 100644 --- a/dbservers.yml +++ b/dbservers.yml @@ -1,5 +1,6 @@ --- - -- hosts: db +# dbservers.yml +- name: Provision Database servers + hosts: db roles: - postgresql diff --git a/deep2samlservers.yml b/deep2samlservers.yml index f3df69b7..a4c5e657 100644 --- a/deep2samlservers.yml +++ b/deep2samlservers.yml @@ -1,8 +1,8 @@ # file: deep2samlservers.yml -# +# --- - -- hosts: deep2saml +- name: Provision Deep2saml servers + hosts: deep2saml roles: # - { role: apache, tags: apache } # - { role: php, tags: php } @@ -10,13 +10,19 @@ - { role: ssp-modules, tags: ssp-modules } tasks: - name: Install SSP mod authoauth2 v3.1.0 - shell: php composer.phar require cirrusidentity/simplesamlphp-module-authoauth2:v3.1.0 --ignore-platform-reqs --no-interaction --no-scripts + ansible.builtin.shell: > + set -o pipefail + php composer.phar \ + require cirrusidentity/simplesamlphp-module-authoauth2:v3.1.0 \ + --ignore-platform-reqs \ + --no-interaction \ + --no-scripts args: chdir: "{{ ssp_path }}/" executable: /bin/bash register: composer_results changed_when: composer_results is changed and "Nothing to install, update or remove" not in composer_results.stderr - when: ssp_mods_extra_enabled | selectattr('name','equalto','authoauth2') | list | count > 0 + when: ssp_mods_extra_enabled | selectattr('name', 'equalto', 'authoauth2') | list | count > 0 become: true tags: - install diff --git a/egi-igtf.yml b/egi-igtf.yml index 64f582ec..aeebaa33 100644 --- a/egi-igtf.yml +++ b/egi-igtf.yml @@ -1,5 +1,6 @@ --- - -- hosts: all +# egi-igtf.yml +- name: Provision EGI-IGTF certs + hosts: all roles: - - egi-igtf + - egi-igtf diff --git a/federation-registry.yml b/federation-registry.yml index 25166652..532d3889 100644 --- a/federation-registry.yml +++ b/federation-registry.yml @@ -1,8 +1,14 @@ --- -- hosts: federation-registry - become: yes +- name: Provision Federation Registry + hosts: federation-registry + become: true roles: - - {role: federation-registry, task: configure-environment} - - {role: federation-registry, task: postgres,tags: ['never','postgres']} - - {role: federation-registry, task: configure-ams} - - {role: federation-registry, task: deploy} + - role: federation-registry + task: configure-environment + - role: federation-registry + task: postgres + tags: ['never', 'postgres'] + - role: federation-registry + task: configure-ams + - role: federation-registry + task: deploy diff --git a/fedregagents.yml b/fedregagents.yml index 49bdf97f..f588d9dd 100644 --- a/fedregagents.yml +++ b/fedregagents.yml @@ -1,16 +1,13 @@ --- - -# This playbook deploy the RCIAM federation registry agent. - - +# This playbook deploys the RCIAM federation registry agent. - name: RCIAM federation registry agent demo hosts: fedreg_agents_demo roles: - - { role: fedreg-agent, tags: agent_demo } - + - role: fedreg-agent + tags: agent_demo - name: RCIAM federation registry agent production hosts: fedreg_agents_prod roles: - - { role: fedreg-agent, tags: agent_prod } - + - role: fedreg-agent + tags: agent_prod diff --git a/firewallservers.yml b/firewallservers.yml index 4f4344a2..2809afb1 100644 --- a/firewallservers.yml +++ b/firewallservers.yml @@ -1,7 +1,8 @@ # file: firewallservers.yml # --- - -- hosts: all +- name: Deploy Firewall + hosts: all roles: - - { role: ipr-cnrs.nftables, become: yes } + - role: ipr-cnrs.nftables + become: true diff --git a/google2samlservers.yml b/google2samlservers.yml index f823060b..69e2fac1 100644 --- a/google2samlservers.yml +++ b/google2samlservers.yml @@ -1,22 +1,30 @@ # file: google2samlservers.yml -# +# --- - -- hosts: google2saml +- name: Provision Google2Samle hosts + hosts: google2saml roles: # - { role: apache, tags: apache } # - { role: php, tags: php } - - { role: ssp, tags: ssp } - - { role: ssp-modules, tags: ssp-modules } + - role: ssp + tags: ssp + - role: ssp-modules + tags: ssp-modules tasks: - name: Install modules using composer - shell: php composer.phar require cirrusidentity/simplesamlphp-module-authoauth2:v3.1.0 league/oauth2-google --ignore-platform-reqs --no-interaction --no-scripts + ansible.builtin.shell: > + php composer.phar + require cirrusidentity/simplesamlphp-module-authoauth2:v3.1.0 + league/oauth2-google + --ignore-platform-reqs + --no-interaction + --no-scripts args: chdir: "{{ ssp_path }}/" executable: /bin/bash register: composer_results changed_when: composer_results is changed and "Nothing to install, update or remove" not in composer_results.stderr - when: ssp_mods_extra_enabled | selectattr('name','equalto','authoauth2') | list | count > 0 + when: ssp_mods_extra_enabled | selectattr('name', 'equalto', 'authoauth2') | list | count > 0 become: true tags: - install diff --git a/inventories/example/group_vars/authservers.yml b/inventories/example/group_vars/authservers.yml index 676c7e1d..f4e6632a 100644 --- a/inventories/example/group_vars/authservers.yml +++ b/inventories/example/group_vars/authservers.yml @@ -16,7 +16,7 @@ ssp_alias: proxy # Select where to store session information: # `phpsession` Uses the built-in session management in PHP (default). -# `memcache` Uses memcached to cache sessions in memory. +# `memcache` Uses memcached to cache sessions in memory. # Sessions can be distributed and replicated among several # memcached servers, enabling both load-balancing and fail-over. # `sql` Stores session information in a SQL database (WIP). @@ -74,7 +74,7 @@ ssp_authsources_saml: # Whether logout requests and logout responses received received by # this SP should be validated. Default is false. redirect_validate: true - # Whether to sign authentication requests sent from this SP. Default is + # Whether to sign authentication requests sent from this SP. Default is # false. sign_authnrequest: true # Whether to sign logout messages sent from this SP. Default is false. @@ -118,7 +118,7 @@ ssp_authsources_saml: attribute_values: - "http://www.geant.net/uri/dataprotection-code-of-conduct/v1" - "http://refeds.org/category/research-and-scholarship" - # Optional list of contacts in addition to the technical contact configured + # Optional list of contacts in addition to the technical contact configured # through config/config.php contacts: # The type of contact. The possible values are `technical`, `support`, @@ -136,7 +136,7 @@ ssp_authsources_saml: #telephone_numbers: "+31(0)12345678" # List of attributes this SP requests from the IdP. This list will be added # to the generated metadata. - # The attributes will be added without a `NameFormat` by default. Use the + # The attributes will be added without a `NameFormat` by default. Use the # name_format option to specify the `NameFormat` for the attributes. attributes: name_format: "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" @@ -153,7 +153,7 @@ ssp_authsources_saml: mail: "urn:oid:0.9.2342.19200300.100.1.3" #eduPersonEntitlement: "urn:oid:1.3.6.1.4.1.5923.1.1.1.7" #eduPersonAssurance: "urn:oid:1.3.6.1.4.1.5923.1.1.1.11" - # The format of the NameID we request from the IdP. Defaults to the + # The format of the NameID we request from the IdP. Defaults to the # transient format if unspecified. #name_id_policy: "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" @@ -165,7 +165,7 @@ ssp_idp_shib13_enabled: false # Hosted IdP metadata ssp_idp_hosts: # The entity ID should be a URI. It can also be specified as `__DYNAMIC:1__`, - # `__DYNAMIC:2__`, ... in which case, the entity ID will be generated + # `__DYNAMIC:2__`, ... in which case, the entity ID will be generated # automatically. - entity_id: "__DYNAMIC:1__" # The hostname for this IdP. One of the IdPs can also have its `host` set @@ -189,7 +189,7 @@ ssp_idp_hosts: redirect_validate: true # The authentication source to be used to authenticate users on this IdP. auth: sso - # Optional list of contacts in addition to the technical contact configured + # Optional list of contacts in addition to the technical contact configured # through config/config.php contacts: # The type of contact. The possible values are `technical`, `support`, @@ -205,20 +205,20 @@ ssp_idp_hosts: email_address: "bob.builder@aai.example.eu" # Optional telephone number of the contact person. #telephone_numbers: "+31(0)12345678" - # A list with scopes for this IdP. The scopes will be added to the + # A list with scopes for this IdP. The scopes will be added to the # generated XML metadata. A scope can either be a domain name or a regular # expression matching a number of domains. scopes: - example.eu # Localised names of the organisation responsible for this IdP. - organization_name: + organization_name: en: Example.eu # Localised user-friendly names of the organisation responsible for this # IdP. - organization_display_name: + organization_display_name: en: Example.eu # Localised URLs of the organisation responsible for this IdP. - organization_url: + organization_url: en: "https://www.example.eu/" # SAML V2.0 Metadata Extensions for Login and Discovery # UIInfo Items @@ -255,7 +255,7 @@ ssp_idp_hosts: privacy_statement_url: en: "https://aai.example.eu/privacy/en" # DiscoHints items - # List of IPv4 and IPv6 addresses in CIDR notation serviced by or + # List of IPv4 and IPv6 addresses in CIDR notation serviced by or # associated with this IdP. #ip_hints: # - "83.212.96.0/19" @@ -286,41 +286,41 @@ ssp_idp_hosts: # from authentication sources. authproc: - "89": - # Maps attribute OIDs to names. + # Maps attribute OIDs to names. class: "core:AttributeMap" oid2name: - "90": # Requires `consent` in `ssp_mods_enabled`. class: "consent:Consent" - # The Consent storage backend. Currently only `consent:Cookie` is + # The Consent storage backend. Currently only `consent:Cookie` is # supported. This option is optional. If omitted, the user is still # asked to consent, but the decision is not saved. store: "consent:Cookie" # Optional flag that indicates whether the values of the attributes # should be used in calculating the unique hashes that identify the - # consent. If includeValues is set and the value of an attribute + # consent. If includeValues is set and the value of an attribute # changes, then the consent becomes invalid. Defaults to false. includeValues: true - # Optional flag that indicates whether the "Remember" consent + # Optional flag that indicates whether the "Remember" consent # checkbox is checkd by default. Defaults to false. #checked: false # Indicates whether the "Yes" or "No" button is in fucus by default. - # This option is optional and can take the value 'yes' or 'no'. + # This option is optional and can take the value 'yes' or 'no'. # If omitted, neither will recive focus. focus: "no" # Optional list of attributes whose values should be hidden. # Default behaviour is that all attribute values are shown. #hiddenAttributes: - "91": - # Maps attribute names to OIDs. + # Maps attribute names to OIDs. # Usually combined with SAML:2.0:attrname-format:uri class: "core:AttributeMap" name2oid: extra_parameters: | 'attributeencodings' => array( // eduPersonTargetedID with oid NameFormat. - 'urn:oid:1.3.6.1.4.1.5923.1.1.1.10' => 'raw', - ), + 'urn:oid:1.3.6.1.4.1.5923.1.1.1.10' => 'raw', + ), # List of SSP modules to enable ssp_mods_enabled: @@ -329,11 +329,11 @@ ssp_mods_enabled: - discopower - consent - smartattributes - - memcacheMonitor + - memcacheMonitor #- authfacebook # Configuration options for automated SAML metadata management. -# Requires `metarefresh` and `cron` modules in `ssp_mods_enabled`. +# Requires `metarefresh` and `cron` modules in `ssp_mods_enabled`. # # Global blacklist: Optional list of entityIDs that should be excluded from ALL # metadata sets. @@ -349,7 +349,7 @@ ssp_mod_metarefresh_sets: sources: # The URL where the metadata will be fetched from. - url: "https://md.aai.example.eu/aggregates/edugain-metadata.xml" - # The fingerprint of the certificate used to sign the metadata. + # The fingerprint of the certificate used to sign the metadata. # You can omit this option if you don't want to validate the signature # on the metadata. #validate_fingerprint: "59:1D:4B:46:70:46:3E:ED:A9:1F:CC:81:6D:C0:AF:2A:09:2A:A8:01" @@ -411,4 +411,3 @@ apache_vhosts_ssl: Require all granted - diff --git a/inventories/example/group_vars/cacheservers.yml b/inventories/example/group_vars/cacheservers.yml index dcff113f..a4426aec 100644 --- a/inventories/example/group_vars/cacheservers.yml +++ b/inventories/example/group_vars/cacheservers.yml @@ -3,12 +3,12 @@ # # See memcached default values in roles/memcached/defaults/main.yml # -# Log verbosity levels: +# Log verbosity levels: # `""` Don't log anything (Default) # `-v` Be verbose during the event loop; print out errors and warnings. # `-vv` Be even more verbose; same as -v but also print client commands and # responses. -# `-vvv` Be extremely verbose; same as -vv but also print internal state +# `-vvv` Be extremely verbose; same as -vv but also print internal state # transitions. #memcached_log_verbosity: "" diff --git a/keycloakservers.yml b/keycloakservers.yml index 69b820b3..ff15b034 100644 --- a/keycloakservers.yml +++ b/keycloakservers.yml @@ -1,7 +1,7 @@ # file: keycloakservers.yml # --- - -- hosts: keycloak +- name: Provision keycloak + hosts: keycloak roles: - - keycloak \ No newline at end of file + - keycloak diff --git a/logrotateservers.yml b/logrotateservers.yml index bc9e4170..43b7cc88 100644 --- a/logrotateservers.yml +++ b/logrotateservers.yml @@ -1,7 +1,7 @@ # file: logrotateservers.yml # --- - -- hosts: all +- name: Deploy logrotate + hosts: all roles: - { role: arillso.logrotate, tags: logrotate } diff --git a/metricsservers.yml b/metricsservers.yml index 919c3de9..ddcf5530 100644 --- a/metricsservers.yml +++ b/metricsservers.yml @@ -2,6 +2,7 @@ # --- -- hosts: rciam-metrics +- name: Deploy Metrics Servers + hosts: rciam-metrics roles: - { role: rciam-metrics, tags: rciam-metrics } diff --git a/monservers.yml b/monservers.yml index c7e0c4de..cd4620de 100644 --- a/monservers.yml +++ b/monservers.yml @@ -1,14 +1,13 @@ # --- -- hosts: monservers - +- name: Deploy monitoring servers + hosts: monservers vars: extra_yum_repositories: - "https://dl.fedoraproject.org/pub/epel/epel-release-latest-{{ ansible_distribution_major_version }}.noarch.rpm" extra_yum_keys: - "/etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-{{ ansible_distribution_major_version }}" - roles: - { role: apache, tags: apache } - { role: php, tags: php } @@ -16,7 +15,7 @@ tasks: - name: Ensure Repositories are installed (RedHat) - yum: + ansible.builtin.yum: name: "{{ item }}" state: present loop: "{{ extra_yum_repositories }}" @@ -27,7 +26,7 @@ - never - name: Import repositories GPG key (RedHat). - rpm_key: + ansible.builtin.rpm_key: key: "{{ item }}" state: present loop: "{{ extra_yum_keys }}" @@ -38,9 +37,9 @@ - never - name: Upgrade all - yum: + ansible.builtin.yum: name: '*' - state: latest + state: latest # noqa package-latest update_cache: true become: true when: ansible_os_family == 'RedHat' @@ -49,7 +48,7 @@ - upgrade - name: Ensure common packages are installed (RedHat) - yum: + ansible.builtin.yum: name: "{{ item }}" state: present update_cache: true @@ -59,36 +58,38 @@ - ca-certificates - vim-enhanced - yum-utils - become: yes + become: true when: ansible_os_family == 'RedHat' tags: - common - never - - name: Configure timezone - timezone: + - name: Configure timezone # noqa syntax-check[unknown-module] + community.general.timezone: name: "{{ timezone }}" - become: yes + become: true notify: restart crond tags: - common - never - name: Register private connection uuid (RedHat) - command: "nmcli -g GENERAL.CON-UUID d show {{item}}" + ansible.builtin.command: "nmcli -g GENERAL.CON-UUID d show {{ item }}" loop: "{{ firewall_private_interfaces | default([]) }}" register: firewall_private_uuids when: ansible_os_family == 'RedHat' + changed_when: false tags: firewall - name: Set zone internal to connections on network managed private interfaces (RedHat) - command: "nmcli connection modify {{ item.stdout }} connection.zone internal" + ansible.builtin.command: "nmcli connection modify {{ item.stdout }} connection.zone internal" loop: "{{ firewall_private_uuids.results }}" + changed_when: false when: ansible_os_family == 'RedHat' tags: firewall - name: Clear firewall state (RedHat) - file: + ansible.builtin.file: path: "{{ item }}" state: absent loop: @@ -103,7 +104,7 @@ notify: restart firewall - name: Add default services to public zone (RedHat) - firewalld: + ansible.posix.firewalld: zone: public service: "{{ item }}" permanent: true @@ -115,35 +116,39 @@ when: ansible_os_family == 'RedHat' notify: restart firewall - - meta: flush_handlers + - name: Flush handlers + ansible.builtin.meta: flush_handlers when: ansible_os_family == 'RedHat' - name: Create firewall new zones (RedHat) - command: firewall-cmd --permanent --new-zone="{{ item }}" + ansible.builtin.command: firewall-cmd --permanent --new-zone="{{ item }}" loop: "{{ firewall_zones | default([]) }}" notify: restart firewall tags: firewall when: ansible_os_family == 'RedHat' - ignore_errors: true + ignore_errors: true # noqa ignore-errors + changed_when: false - name: Create firewall new services (RedHat) - command: firewall-cmd --permanent --new-service="{{item.name}}" + ansible.builtin.command: firewall-cmd --permanent --new-service="{{ item.name }}" loop: "{{ firewall_services | default([]) }}" notify: restart firewall tags: firewall when: ansible_os_family == 'RedHat' - ignore_errors: true + ignore_errors: true # noqa ignore-errors + changed_when: false - name: Add port to services (RedHat) - command: firewall-cmd --permanent --service="{{ item.name }}" --add-port={{ item.port }} + ansible.builtin.command: firewall-cmd --permanent --service="{{ item.name }}" --add-port={{ item.port }} loop: "{{ firewall_services | default([]) }}" notify: restart firewall tags: firewall when: ansible_os_family == 'RedHat' - ignore_errors: true + ignore_errors: true # noqa ignore-errors + changed_when: false - name: Firewall add services to zones (RedHat) - firewalld: + ansible.posix.firewalld: zone: "{{ item.zone }}" service: "{{ item.service }}" permanent: true @@ -154,7 +159,7 @@ notify: restart firewall - name: Add sources to zones (RedHat) - firewalld: + ansible.posix.firewalld: zone: "{{ item.zone }}" source: "{{ item.source }}" permanent: true @@ -165,7 +170,7 @@ notify: restart firewall - name: Add interfaces to zones (RedHat) - firewalld: + ansible.posix.firewalld: zone: "{{ item.zone }}" interface: "{{ item.interface }}" permanent: true @@ -176,16 +181,17 @@ notify: restart firewall handlers: - - name: reload firewall - command: "firewall-cmd --reload" + - name: Reload firewall + ansible.builtin.command: "firewall-cmd --reload" + changed_when: false - - name: restart firewall - service: + - name: Restart firewall + ansible.builtin.service: name: firewalld state: restarted - - name: restart crond - service: + - name: Restart crond + ansible.builtin.service: name: crond state: restarted - become: yes + become: true diff --git a/oauth2samlservers.yml b/oauth2samlservers.yml index ea03cc9e..158b4460 100644 --- a/oauth2samlservers.yml +++ b/oauth2samlservers.yml @@ -1,21 +1,29 @@ # file: oauth2samlservers.yml -# +# --- -- hosts: oauth2saml +- name: Deploy Oauth2Saml + hosts: oauth2saml roles: - { role: ssp, tags: ssp } - { role: ssp-modules, tags: ssp-modules } tasks: - name: Install modules using composer # shell: php composer.phar require oakhope/oauth2-wechat --ignore-platform-reqs --no-interaction --no-scripts - shell: php composer.phar require cirrusidentity/simplesamlphp-module-authoauth2:v3.1.0 league/oauth2-google oakhope/oauth2-wechat --ignore-platform-reqs --no-interaction --no-scripts + ansible.builtin.shell: >- # Better to declare dependencies here + php composer.phar require \ + cirrusidentity/simplesamlphp-module-authoauth2:v3.1.0 \ + league/oauth2-google \ + oakhope/oauth2-wechat \ + --ignore-platform-reqs \ + --no-interaction \ + --no-scripts args: chdir: "{{ ssp_path }}/" executable: /bin/bash register: composer_results changed_when: composer_results is changed and "Nothing to install, update or remove" not in composer_results.stderr - when: ssp_mods_extra_enabled | selectattr('name','equalto','authoauth2') | list | count > 0 + when: ssp_mods_extra_enabled | selectattr('name', 'equalto', 'authoauth2') | list | count > 0 become: true tags: - install diff --git a/openldapservers.yml b/openldapservers.yml index 6b5a75a6..8edcb85d 100644 --- a/openldapservers.yml +++ b/openldapservers.yml @@ -1,3 +1,5 @@ -- hosts: openldap +--- +- name: Deploy openldap + hosts: openldap roles: - - { role: openldap } \ No newline at end of file + - { role: openldap } diff --git a/orcid2samlservers.yml b/orcid2samlservers.yml index d1557d82..e680ff9d 100644 --- a/orcid2samlservers.yml +++ b/orcid2samlservers.yml @@ -1,8 +1,9 @@ # file: orcid2samlservers.yml -# +# --- -- hosts: orcid2saml +- name: Deploy ORCID 2 SAML hosts + hosts: orcid2saml roles: # - { role: apache, tags: apache } # - { role: php, tags: php } diff --git a/rciam-keycloak.yml b/rciam-keycloak.yml index 6e5ca9f5..b09edc48 100644 --- a/rciam-keycloak.yml +++ b/rciam-keycloak.yml @@ -2,10 +2,14 @@ # RCIAM deployment based on Keycloak --- -- import_playbook: firewallservers.yml +- name: Run Firewall Servers + ansible.builtin.import_playbook: firewallservers.yml -- import_playbook: dbservers.yml +- name: Deploy DBN Servers + ansible.builtin.import_playbook: dbservers.yml -- import_playbook: keycloakservers.yml +- name: Deploy Keycloak servers + ansible.builtin.import_playbook: keycloakservers.yml -- import_playbook: webproxyservers.yml +- name: Deploy Web Proxy Servers + ansible.builtin.import_playbook: webproxyservers.yml diff --git a/rciam-oidc-client.yml b/rciam-oidc-client.yml index 5ae5f6f1..e838a3b4 100644 --- a/rciam-oidc-client.yml +++ b/rciam-oidc-client.yml @@ -1,6 +1,7 @@ # file: rciam-oidc-client.yml # --- -- hosts: web +- name: Deploy OIDC client + hosts: web roles: - { role: rciam-oidc-client, tags: rciam-oidc-client } diff --git a/registryservers-roles-ui.yml b/registryservers-roles-ui.yml index f0fb4a48..c5d29c2b 100644 --- a/registryservers-roles-ui.yml +++ b/registryservers-roles-ui.yml @@ -2,9 +2,18 @@ # --- -- hosts: registry +- name: Deploy Regitry Server UI + hosts: registry roles: - { role: cm-role-ui, tags: cm-role-ui } # Deploy CM Roles simple UI -# ansible-playbook -v -u user --ask-become-pass -i inventories/openaire-dev/hosts.ini registryservers-roles-ui.yml --tags "cm-role-ui:configure" --ask-vault-pass --diff --extra-vars "git_user= git_pass=" \ No newline at end of file +# ansible-playbook \ +# -v -u user \ +# --ask-become-pass \ +# -i inventories/openaire-dev/hosts.ini \ +# registryservers-roles-ui.yml \ +# --tags "cm-role-ui:configure" \ +# --ask-vault-pass \ +# --diff \ +# --extra-vars "git_user= git_pass=" diff --git a/registryservers.yml b/registryservers.yml index 2f1b57c9..4e52d236 100644 --- a/registryservers.yml +++ b/registryservers.yml @@ -2,7 +2,8 @@ # --- -- hosts: registry +- name: Deploy Registry Servers + hosts: registry roles: - { role: git, tags: git } - { role: apache, tags: apache } @@ -15,4 +16,6 @@ # Deploy clean COmanage environment # ansible-playbook -v -i inventories/instances/hosts.ini registryservers.yml --tags "comanage-registry" --ask-vault-pass # Deploy changes. -# ansible-playbook -v -i inventories/instances/hosts.ini registryservers.yml --tags [comanage-registry,comanage-registry:install,comanage-registry:config,] --ask-vault-pass +# ansible-playbook -v -i inventories/instances/hosts.ini registryservers.yml \ +# --tags [comanage-registry,comanage-registry:install,comanage-registry:config,] \ +# --ask-vault-pass diff --git a/requirements.txt b/requirements.txt index 6e12c515..648074c3 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,7 +1,39 @@ ansible==9.3.0 ansible-base==2.10.17 +ansible-compat==4.1.11 ansible-core==2.16.4 ansible-lint==24.2.1 +attrs==23.2.0 +black==24.3.0 +bracex==2.4 +cffi==1.16.0 +click==8.1.7 +cryptography==42.0.5 dnspython==2.1.0 -passlib==1.7.4 +filelock==3.13.1 +Jinja2==3.1.3 jmespath==0.10.0 +jsonschema==4.21.1 +jsonschema-specifications==2023.12.1 +markdown-it-py==3.0.0 +MarkupSafe==2.1.5 +mdurl==0.1.2 +mypy-extensions==1.0.0 +packaging==24.0 +passlib==1.7.4 +pathspec==0.12.1 +platformdirs==4.2.0 +pycparser==2.21 +Pygments==2.17.2 +PyYAML==6.0.1 +referencing==0.34.0 +resolvelib==1.0.1 +rich==13.7.1 +rpds-py==0.18.0 +ruamel.yaml==0.18.6 +ruamel.yaml.clib==0.2.8 +subprocess-tee==0.4.1 +tomli==2.0.1 +typing_extensions==4.10.0 +wcmatch==8.5.1 +yamllint==1.35.1 diff --git a/roles/apache/defaults/main.yml b/roles/apache/defaults/main.yml index f90655fe..c1c4d5b5 100644 --- a/roles/apache/defaults/main.yml +++ b/roles/apache/defaults/main.yml @@ -16,15 +16,15 @@ apache_listen_directives: | # Set to one of: Full | OS | Minimal | Minor | Major | Prod # where Full conveys the most information, and Prod the least. -apache_server_tokens: "OS" -# Set to one of: On | Off | EMail +apache_server_tokens: OS +# Set to one of: On | Off | EMail # Set to "EMail" to also include a mailto: link to the ServerAdmin. apache_server_signature: "On" # Set to one of: On | Off | extended apache_trace_enable: "Off" apache_create_vhosts: true -apache_vhosts_filename: "vhosts.conf" +apache_vhosts_filename: vhosts.conf # On RedHat/Centos, a default Welcome Screen is included in Apache's configuration. # Set this to `true` to remove that default; otherwise `false`. apache_remove_default_page: false @@ -34,46 +34,45 @@ apache_remove_default_page: false apache_remove_default_vhost: true apache_vhosts: - # Additional properties: `serveradmin`, `serveralias`, `usecanonicalname`, + # Additional properties: `serveradmin`, `serveralias`, `usecanonicalname`, # `extra_parameters`. - servername: "{{ inventory_hostname }}" - documentroot: "/var/www/html" + documentroot: /var/www/html apache_vhosts_ssl: [] - # Additional properties: `serveradmin`, `serveralias`, `usecanonicalname`, - # `extra_parameters`. - # - servername: "www.example.com" - # documentroot: "/var/www/html" - # certificate_file: "/path/to/certificate.crt" - # certificate_key_file: "/path/to/certificate.key" - # # Optional. - # certificate_chain_file: "/path/to/certificate_chain.crt" +# Additional properties: `serveradmin`, `serveralias`, `usecanonicalname`, +# `extra_parameters`. +# - servername: "www.example.com" +# documentroot: "/var/www/html" +# certificate_file: "/path/to/certificate.crt" +# certificate_key_file: "/path/to/certificate.key" +# # Optional. +# certificate_chain_file: "/path/to/certificate_chain.crt" # Name of the user that should own the file containing the SSL certificate -apache_ssl_certificate_file_owner: "root" +apache_ssl_certificate_file_owner: root # Name of the group that should own the file containing the SSL certificate -apache_ssl_certificate_file_group: "root" +apache_ssl_certificate_file_group: root # Permissions of the file containing the SSL certificate apache_ssl_certificate_file_mode: "0644" # Name of the user that should own the file containing the SSL certificate key -apache_ssl_certificate_key_file_owner: "root" +apache_ssl_certificate_key_file_owner: root # Name of the group that should own the file containing the SSL certificate key -apache_ssl_certificate_key_file_group: "root" +apache_ssl_certificate_key_file_group: root # Permissions of the file containing the SSL certificate key apache_ssl_certificate_key_file_mode: "0600" apache_ignore_missing_ssl_certificate: true -#apache_ssl_protocol: "All -SSLv2 -SSLv3" -#apache_ssl_cipher_suite: "AES256+EECDH:AES256+EDH" +# apache_ssl_protocol: "All -SSLv2 -SSLv3" +# apache_ssl_cipher_suite: "AES256+EECDH:AES256+EDH" # Initial apache state, i.e. `started`, `stopped`, `restarted`, or `reloaded` -apache_state: "started" +apache_state: started -#install additional modules +# install additional modules apache_mods_installed: [] - # Only used on Debian/Ubuntu. apache_mods_enabled: - ssl diff --git a/roles/apache/handlers/main.yml b/roles/apache/handlers/main.yml index fc6b5f67..88812ae5 100644 --- a/roles/apache/handlers/main.yml +++ b/roles/apache/handlers/main.yml @@ -1,7 +1,6 @@ --- - -- name: restart apache - service: +- name: Restart apache + become: true + ansible.builtin.service: name: "{{ apache_service }}" state: restarted - become: yes diff --git a/roles/apache/tasks/configure-Debian.yml b/roles/apache/tasks/configure-Debian.yml index f163a61c..5bbdbd7f 100644 --- a/roles/apache/tasks/configure-Debian.yml +++ b/roles/apache/tasks/configure-Debian.yml @@ -1,78 +1,77 @@ --- - - name: Enable required Apache modules (Debian) - apache2_module: + become: true + community.general.apache2_module: state: present name: "{{ item }}" with_items: "{{ apache_mods_enabled }}" - become: yes notify: - - restart apache + - Restart apache - name: Disable unnecessary Apache modules (Debian) - apache2_module: - state: absent + become: true + community.general.apache2_module: + state: absent name: "{{ item }}" with_items: "{{ apache_mods_disabled }}" - become: yes notify: - - restart apache + - Restart apache - name: Remove default vhost from sites-enabled (Debian) - file: + become: true + ansible.builtin.file: path: "{{ apache_conf_path }}/sites-enabled/{{ apache_default_vhost_filename }}" state: absent - become: yes - notify: restart apache + notify: Restart apache when: apache_remove_default_vhost - name: Configure Apache ports (Debian) - template: - src: "ports.conf.j2" + become: true + ansible.builtin.template: + src: ports.conf.j2 dest: "{{ apache_conf_path }}/ports.conf" owner: root group: root - mode: 0644 - backup: yes - become: yes - notify: restart apache + mode: "0644" + backup: true + notify: Restart apache - name: Configure Apache security settings (Debian) - template: - src: "security.conf.j2" + become: true + ansible.builtin.template: + src: security.conf.j2 dest: "{{ apache_conf_path }}/conf-available/security.conf" owner: root group: root - mode: 0644 - backup: yes - become: yes - notify: restart apache + mode: "0644" + backup: true + notify: Restart apache - name: Enable Apache security configuration (Debian) - file: + become: true + ansible.builtin.file: src: "{{ apache_conf_path }}/conf-available/security.conf" dest: "{{ apache_conf_path }}/conf-enabled/security.conf" state: link - become: yes - notify: restart apache + notify: Restart apache - name: Add Apache vhosts configuration (Debian) - template: - src: "vhosts.conf.j2" + become: true + ansible.builtin.template: + src: vhosts.conf.j2 dest: "{{ apache_conf_path }}/sites-available/{{ apache_vhosts_filename }}" owner: root group: root - mode: 0644 - backup: yes - become: yes - notify: restart apache + mode: "0644" + backup: true + notify: Restart apache when: apache_create_vhosts - name: Enable Apache vhosts configuration (Debian) - file: + become: true + ansible.builtin.file: src: "{{ apache_conf_path }}/sites-available/{{ apache_vhosts_filename }}" dest: "{{ apache_conf_path }}/sites-enabled/{{ apache_vhosts_filename }}" state: link - become: yes - notify: restart apache + notify: Restart apache when: apache_create_vhosts diff --git a/roles/apache/tasks/configure-RedHat.yml b/roles/apache/tasks/configure-RedHat.yml index 2635b762..2a9afe83 100644 --- a/roles/apache/tasks/configure-RedHat.yml +++ b/roles/apache/tasks/configure-RedHat.yml @@ -1,88 +1,87 @@ --- - - name: Ensure sites-available and sites-enabled directories exist (RedHat) - file: + become: true + ansible.builtin.file: path: "{{ item }}" state: directory owner: root group: root + mode: "0775" loop: - "{{ apache_conf_path }}/sites-available" - - "{{ apache_conf_path }}/sites-enabled/" - become: yes + - "{{ apache_conf_path }}/sites-enabled" - name: Append extra parameters into Apache httpd.conf (RedHat) - blockinfile: + become: true + ansible.builtin.blockinfile: path: "{{ apache_conf_path }}/conf/httpd.conf" block: | IncludeOptional sites-enabled/*.conf IncludeOptional conf.d/security.conf owner: root group: root - mode: 0644 - backup: yes - become: yes - notify: restart apache + mode: "0644" + backup: true + notify: Restart apache - name: Configure Apache security settings (RedHat) - template: - src: "security.conf.j2" + become: true + ansible.builtin.template: + src: security.conf.j2 dest: "{{ apache_conf_path }}/conf.d/security.conf" owner: root group: root - mode: 0644 - backup: yes - become: yes - notify: restart apache + mode: "0644" + backup: true + notify: Restart apache # Configure Virtual Host SSL certificates - name: Include vhost SSL certificates configuration - include: configure-ssl-cert.yml + become: true + ansible.builtin.include_tasks: configure-ssl-cert.yml when: apache_create_vhosts and apache_vhosts_ssl is defined and apache_vhosts_ssl|length > 0 - name: Add Apache vhosts configuration (RedHat) - template: - src: "vhosts.conf.j2" + become: true + ansible.builtin.template: + src: vhosts.conf.j2 dest: "{{ apache_conf_path }}/sites-available/{{ apache_vhosts_filename }}" owner: root group: root - mode: 0644 - backup: yes - become: yes - notify: restart apache + mode: "0644" + backup: true + notify: Restart apache when: apache_create_vhosts - name: Enable Apache vhosts configuration (RedHat) - file: + become: true + ansible.builtin.file: src: "{{ apache_conf_path }}/sites-available/{{ apache_vhosts_filename }}" dest: "{{ apache_conf_path }}/sites-enabled/{{ apache_vhosts_filename }}" state: link - become: yes - notify: restart apache + notify: Restart apache when: apache_create_vhosts - name: Disable default welcome page (RedHat) - file: + become: true + ansible.builtin.file: path: "{{ apache_conf_path }}/conf.d/welcome.conf" state: absent - become: yes when: apache_remove_default_page - notify: restart apache + notify: Restart apache - name: Enable required Apache modules (RedHat) - apache2_module: + become: true + community.general.apache2_module: state: present name: "{{ item }}" with_items: "{{ apache_mods_enabled }}" - become: yes - notify: - - restart apache + notify: Restart apache - name: Disable unnecessary Apache modules (RedHat) - apache2_module: + become: true + community.general.apache2_module: state: absent name: "{{ item }}" with_items: "{{ apache_mods_disabled }}" - become: yes - notify: - - restart apache \ No newline at end of file + notify: Restart apache diff --git a/roles/apache/tasks/configure-ssl-cert.yml b/roles/apache/tasks/configure-ssl-cert.yml index 1545e29a..04428f0d 100644 --- a/roles/apache/tasks/configure-ssl-cert.yml +++ b/roles/apache/tasks/configure-ssl-cert.yml @@ -1,54 +1,53 @@ --- - - name: Ensure apache SSL certificate directories exist - file: + become: true + ansible.builtin.file: path: "{{ item.certificate_file | dirname }}" owner: "{{ apache_ssl_certificate_file_owner }}" group: "{{ apache_ssl_certificate_file_group }}" state: directory + mode: "0775" with_items: - "{{ apache_vhosts_ssl }}" when: item.certificate_file is defined and item.certificate is defined - become: yes - name: Ensure apache SSL certificates are copied - copy: + become: true + ansible.builtin.copy: dest: "{{ item.certificate_file }}" content: "{{ item.certificate }}" owner: "{{ apache_ssl_certificate_file_owner }}" group: "{{ apache_ssl_certificate_file_group }}" mode: "{{ apache_ssl_certificate_file_mode }}" - backup: yes + backup: true with_items: - "{{ apache_vhosts_ssl }}" when: item.certificate_file is defined and item.certificate is defined - become: yes - notify: - - restart apache + notify: Restart apache - name: Ensure apache SSL certificate key directories exist - file: + become: true + ansible.builtin.file: path: "{{ item.certificate_key_file | dirname }}" owner: "{{ apache_ssl_certificate_key_file_owner }}" group: "{{ apache_ssl_certificate_key_file_group }}" state: directory + mode: "0775" with_items: - "{{ apache_vhosts_ssl }}" when: item.certificate_key_file is defined and item.certificate_key is defined - become: yes - name: Ensure apache SSL certificate keys are copied - copy: + become: true + ansible.builtin.copy: dest: "{{ item.certificate_key_file }}" - content: '{{ item.certificate_key }}' + content: "{{ item.certificate_key }}" owner: "{{ apache_ssl_certificate_key_file_owner }}" group: "{{ apache_ssl_certificate_key_file_group }}" mode: "{{ apache_ssl_certificate_key_file_mode }}" - backup: yes + backup: true with_items: - "{{ apache_vhosts_ssl }}" when: item.certificate_key_file is defined and item.certificate_key is defined - become: yes - no_log: yes - notify: - - restart apache + no_log: true + notify: Restart apache diff --git a/roles/apache/tasks/install-Debian.yml b/roles/apache/tasks/install-Debian.yml index 6d64e8e8..8b7482b6 100644 --- a/roles/apache/tasks/install-Debian.yml +++ b/roles/apache/tasks/install-Debian.yml @@ -1,19 +1,16 @@ --- - - name: Ensure Apache HTTP server is installed (Debian) - apt: + ansible.builtin.apt: name: apache2 - state: present - install_recommends: no - update_cache: yes + state: present + install_recommends: false + update_cache: true cache_valid_time: 86400 - become: yes + become: true - name: Install Modules for Apache - apt: + ansible.builtin.apt: name: "{{ apache_mods_installed }}" - state: present - become: yes - notify: - - restart apache - \ No newline at end of file + state: present + become: true + notify: Restart apache diff --git a/roles/apache/tasks/install-RedHat.yml b/roles/apache/tasks/install-RedHat.yml index 92df6373..bf10c648 100644 --- a/roles/apache/tasks/install-RedHat.yml +++ b/roles/apache/tasks/install-RedHat.yml @@ -1,20 +1,17 @@ --- - - name: Ensure Apache HTTP server is installed (Redhat) - yum: + ansible.builtin.yum: name: httpd state: present - update_cache: yes - become: yes - notify: - - restart apache + update_cache: true + become: true + notify: Restart apache - name: Ensure Apache ssl module is installed (Redhat) - yum: + ansible.builtin.yum: name: mod_ssl state: present - update_cache: yes - become: yes + update_cache: true + become: true when: apache_vhosts_ssl is defined and apache_vhosts_ssl|length > 0 - notify: - - restart apache \ No newline at end of file + notify: Restart apache diff --git a/roles/apache/tasks/main.yml b/roles/apache/tasks/main.yml index 17746231..7e03f929 100644 --- a/roles/apache/tasks/main.yml +++ b/roles/apache/tasks/main.yml @@ -1,23 +1,33 @@ --- - - name: Include OS-specific variables - include_vars: "{{ ansible_os_family }}.yml" + ansible.builtin.include_vars: "{{ ansible_os_family }}.yml" -# Install OS-specific packages -- include: install-Debian.yml +- name: Ensure Debian Installation + ansible.builtin.include_tasks: install-Debian.yml when: ansible_os_family == 'Debian' -- include: install-RedHat.yml + +- name: Ensure RedHat Installation + ansible.builtin.include_tasks: install-RedHat.yml when: ansible_os_family == 'RedHat' +# Could be refactored as: +# - name: Include install tasks +# ansible.builtin.include_tasks: "install-{{ ansible_os_family }}.yml" + # Apply OS-specific configuration -- include: configure-Debian.yml +- name: Include Debian Configuration Tasks + ansible.builtin.include_tasks: configure-Debian.yml when: ansible_os_family == 'Debian' -- include: configure-RedHat.yml +- name: Include RedHat Configuration tasks + ansible.builtin.include_tasks: configure-RedHat.yml when: ansible_os_family == 'RedHat' +# Could be refactored as: +# - name: Include Configuration tasks +# ansible.builtin.include_tasks: "configure-{{ ansible_os_family }}.yml" - name: Ensure Apache service is at selected state and enabled on boot - service: + become: true + ansible.builtin.service: name: "{{ apache_service }}" state: "{{ apache_state }}" - enabled: yes - become: yes + enabled: true diff --git a/roles/apache/vars/Debian.yml b/roles/apache/vars/Debian.yml index 1e1a1133..b62452b6 100644 --- a/roles/apache/vars/Debian.yml +++ b/roles/apache/vars/Debian.yml @@ -2,7 +2,7 @@ apache_service: apache2 apache_conf_path: /etc/apache2 -apache_user: "www-data" -apache_group: "www-data" +apache_user: www-data +apache_group: www-data -apache_default_vhost_filename: 000-default.conf +apache_default_vhost_filename: "000-default.conf" diff --git a/roles/apache/vars/RedHat.yml b/roles/apache/vars/RedHat.yml index 2dea2476..caeffec5 100644 --- a/roles/apache/vars/RedHat.yml +++ b/roles/apache/vars/RedHat.yml @@ -2,5 +2,5 @@ apache_service: httpd apache_conf_path: /etc/httpd -apache_user: "apache" -apache_group: "apache" +apache_user: apache +apache_group: apache diff --git a/roles/cm-role-ui/defaults/main.yml b/roles/cm-role-ui/defaults/main.yml index 780b48fd..f8b71dc0 100644 --- a/roles/cm-role-ui/defaults/main.yml +++ b/roles/cm-role-ui/defaults/main.yml @@ -6,13 +6,13 @@ roles_repo: "https://github.com/rciam/comanage-registry-roles-portal.git" roles_root_dir: "/srv" roles_path: "{{ roles_root_dir }}/{{ roles_src }}" -#roles_api_base_url: "https://example.org/registry" -#roles_api_username: "api_user" -#roles_api_password: "api_pass" +# roles_api_base_url: "https://example.org/registry" +# roles_api_username: "api_user" +# roles_api_password: "api_pass" roles_db_host: "localhost" -#roles_db_username: "db_user" -#roles_db_password: "db_pass" +# roles_db_username: "db_user" +# roles_db_password: "db_pass" roles_db_name: "registry" roles_uid_key: "eduPersonPrincipalName" @@ -21,7 +21,7 @@ roles_username_key: "displayName" roles_email_host: "localhost" roles_email_port: 25 # leave blank the rest of the email options if not needed -# "", "ssl" or "tls" +# "", "ssl" or "tls" roles_email_security: "" roles_email_username: "" roles_email_password: "" diff --git a/roles/cm-role-ui/tasks/configure-common.yml b/roles/cm-role-ui/tasks/configure-common.yml index 53d36e2a..4069756c 100644 --- a/roles/cm-role-ui/tasks/configure-common.yml +++ b/roles/cm-role-ui/tasks/configure-common.yml @@ -1,14 +1,14 @@ --- - +# cm-role-ui/tasks/configure-common.yml - name: Configure cm-role-ui - template: + ansible.builtin.template: src: configuration.php.j2 dest: "{{ roles_path }}/configuration.php" owner: root group: root - mode: 0644 - backup: yes - force: yes - become: yes + mode: "0644" + backup: true + force: true + become: true tags: - cm-role-ui:configure diff --git a/roles/cm-role-ui/tasks/install-common.yml b/roles/cm-role-ui/tasks/install-common.yml index 47f58194..b78d6f16 100644 --- a/roles/cm-role-ui/tasks/install-common.yml +++ b/roles/cm-role-ui/tasks/install-common.yml @@ -1,34 +1,36 @@ --- - +# cm-role-ui - name: Ensure Roles root directory exists - file: + ansible.builtin.file: path: "{{ roles_root_dir }}" state: directory owner: root group: root - become: yes + mode: "0644" + become: true tags: - cm-role-ui:install - name: Ensure Roles source is cloned under root directory - git: + ansible.builtin.git: repo: "{{ roles_repo }}" dest: "{{ roles_root_dir }}/{{ roles_src }}-{{ roles_version }}" version: "{{ roles_version }}" - accept_hostkey: yes - ignore_errors: yes - become: yes + accept_hostkey: true + # ignore_errors: true + failed_when: false # noqa ignore-errors + become: true tags: - cm-role-ui:install - name: Ensure symbolic link to current Roles installation exists - file: + ansible.builtin.file: src: "{{ roles_root_dir }}/{{ roles_src }}-{{ roles_version }}" dest: "{{ roles_path }}" - force: yes + force: true state: link owner: root group: root - become: yes + become: true tags: - - cm-role-ui:install \ No newline at end of file + - cm-role-ui:install diff --git a/roles/cm-role-ui/tasks/main.yml b/roles/cm-role-ui/tasks/main.yml index 830bdf3e..7f58f4fe 100644 --- a/roles/cm-role-ui/tasks/main.yml +++ b/roles/cm-role-ui/tasks/main.yml @@ -1,16 +1,17 @@ --- +# cm-role-ui/tasks/main.yml -#- name: Include OS-specific variables -# include_vars: "{{ item }}" -# with_first_found: -# - "{{ ansible_distribution }}-{{ ansible_distribution_release}}.yml" -# - "{{ ansible_distribution }}-{{ ansible_distribution_major_version}}.yml" -# - "{{ ansible_distribution }}.yml" -# - "{{ ansible_os_family }}.yml" +# - name: Include OS-specific variables +# include_vars: "{{ item }}" +# with_first_found: +# - "{{ ansible_distribution }}-{{ ansible_distribution_release}}.yml" +# - "{{ ansible_distribution }}-{{ ansible_distribution_major_version}}.yml" +# - "{{ ansible_distribution }}.yml" +# - "{{ ansible_os_family }}.yml" # Run OS-independent installation tasks - name: Include Installation tasks - include_tasks: + ansible.builtin.include_tasks: file: install-common.yml apply: tags: @@ -20,7 +21,7 @@ # Apply OS-independent configuration - name: Include Configure tasks - include_tasks: + ansible.builtin.include_tasks: file: configure-common.yml apply: tags: diff --git a/roles/comanage-registry-plugins/defaults/main.yml b/roles/comanage-registry-plugins/defaults/main.yml index faa96279..c90dec2d 100644 --- a/roles/comanage-registry-plugins/defaults/main.yml +++ b/roles/comanage-registry-plugins/defaults/main.yml @@ -1,14 +1,14 @@ --- comanage_registry_plugins: [] -#comanage_registry_plugins: +# comanage_registry_plugins: # - name: ExamplePluginFolderName # version: master # repository: "https://github.com/project/examplePluginName" # status: init -#comanage_plugins_cron_jobs: +# comanage_plugins_cron_jobs: # - name: "Action Name" # minute: "0" # filename: "PluginName" @@ -16,9 +16,9 @@ comanage_registry_plugins: [] # job: | # cd {{ path_to_registry }}/app && Console/cake PluginName.action -#comanage_symlinks: +# comanage_symlinks: # - target: "/path/to/target" # link: "/path/to/symlink" # Whether to install COmanage plugins cron jobs; Enabled by default -comanage_plugins_cron_jobs_enabled: yes \ No newline at end of file +comanage_plugins_cron_jobs_enabled: true diff --git a/roles/comanage-registry-plugins/tasks/configure.yml b/roles/comanage-registry-plugins/tasks/configure.yml index c4ea5c60..671b0b2f 100644 --- a/roles/comanage-registry-plugins/tasks/configure.yml +++ b/roles/comanage-registry-plugins/tasks/configure.yml @@ -1,11 +1,10 @@ --- - - name: Add ENV vars in cron.d file - cron: + ansible.builtin.cron: name: "{{ item.name }}" job: "{{ item.job }}" user: "{{ item.user }}" - env: yes + env: true cron_file: "{{ item.filename }}" state: present loop: "{{ comanage_plugins_cron_env | default([]) }}" @@ -13,7 +12,7 @@ when: comanage_plugins_cron_env is defined and comanage_plugins_cron_jobs is defined and comanage_plugins_cron_jobs_enabled - name: Ensure COmanage Registry Plugins cron jobs are installed - cron: + ansible.builtin.cron: name: "{{ item.name }}" minute: "{{ item.minute | default(omit) }}" hour: "{{ item.hour | default(omit) }}" @@ -29,13 +28,13 @@ when: comanage_plugins_cron_jobs is defined and comanage_plugins_cron_jobs_enabled - name: Create Symbolic links - file: + ansible.builtin.file: src: "{{ item.target }}" dest: "{{ item.link }}" - force: yes + force: true state: link owner: root group: root loop: "{{ comanage_plugins_symlinks | default([]) }}" become: true - when: comanage_plugins_symlinks is defined \ No newline at end of file + when: comanage_plugins_symlinks is defined diff --git a/roles/comanage-registry-plugins/tasks/install.yml b/roles/comanage-registry-plugins/tasks/install.yml index 10a5b507..cb389642 100644 --- a/roles/comanage-registry-plugins/tasks/install.yml +++ b/roles/comanage-registry-plugins/tasks/install.yml @@ -1,31 +1,40 @@ --- - name: Clear cache of COmanage - command: su {{ comanage_registry_plugins_webuser }} -s /bin/sh -c ./Console/clearcache + ansible.builtin.command: su {{ comanage_registry_plugins_webuser }} -s /bin/sh -c ./Console/clearcache args: chdir: "{{ comanage_path }}/app" - become: yes + changed_when: false + become: true + become_user: "{{ comanage_registry_plugins_webuser }}" - name: Ensure COmanage Registry local/Plugins directory exists - file: + ansible.builtin.file: path: "{{ comanage_path }}/local/Plugin" state: directory owner: root group: root - become: yes + mode: "0644" + become: true -- name: Ensure {{ item.name }} is cloned under local/Plugins directory - git: +- name: "Ensure is cloned under local/Plugins directory - {{ item.name }}" + ansible.builtin.git: repo: "{{ item.repository }}" dest: "{{ comanage_path }}/local/Plugin/{{ item.name }}" version: "{{ item.version }}" - accept_hostkey: yes - become: yes + accept_hostkey: true + become: true - name: Create COmanage Registry Plugins schemata - shell: | - ./Console/cake schema create --file schema.php --path "{{ comanage_path }}/local/Plugin/{{ item.name }}/Config/Schema" -y + ansible.builtin.shell: | + set -o pipefail + ./Console/cake \ + schema create \ + --file schema.php \ + --path "{{ comanage_path }}/local/Plugin/{{ item.name }}/Config/Schema" \ + -y args: chdir: "{{ comanage_path }}/app" executable: /bin/sh when: item.status is defined and item.status == "init" - become: yes + changed_when: false # TODO Define change conditions + become: true diff --git a/roles/comanage-registry-plugins/tasks/main.yml b/roles/comanage-registry-plugins/tasks/main.yml index 3c5b5b5a..ae3b9727 100644 --- a/roles/comanage-registry-plugins/tasks/main.yml +++ b/roles/comanage-registry-plugins/tasks/main.yml @@ -1,36 +1,35 @@ --- - - name: Include OS-specific variables - include_vars: "{{ item }}" + ansible.builtin.include_vars: "{{ item }}" with_first_found: - - "{{ ansible_distribution }}-{{ ansible_distribution_release}}.yml" - - "{{ ansible_distribution }}-{{ ansible_distribution_major_version}}.yml" + - "{{ ansible_distribution }}-{{ ansible_distribution_release }}.yml" + - "{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml" - "{{ ansible_distribution }}.yml" - "{{ ansible_os_family }}.yml" tags: - - always + - always - name: Define COmanage Registry Plugins web user - set_fact: - comanage_registry_plugins_webuser: "{{ comanage_registry_plugins_default_webuser }}" + ansible.builtin.set_fact: + comanage_registry_plugins_webuser: "{{ comanage_registry_plugins_default_webuser }}" when: comanage_registry_plugins_webserver is not defined tags: - - always + - always # Include installation tasks - name: Include Installation tasks - include_tasks: + ansible.builtin.include_tasks: file: install.yml apply: tags: - comanage-registry-plugins:install - loop: "{{ comanage_registry_plugins|flatten(levels=1) }}" + loop: "{{ comanage_registry_plugins | flatten(levels=1) }}" tags: - - comanage-registry-plugins:install + - comanage-registry-plugins:install # Include configuration tasks - name: Include Configure tasks - include_tasks: + ansible.builtin.include_tasks: file: configure.yml apply: tags: diff --git a/roles/comanage-registry/defaults/main.yml b/roles/comanage-registry/defaults/main.yml index bb9dd172..474aa215 100644 --- a/roles/comanage-registry/defaults/main.yml +++ b/roles/comanage-registry/defaults/main.yml @@ -2,150 +2,150 @@ # See https://spaces.internet2.edu/display/COmanage/Organizational+Identity+Pooling comanage_org_identity_pooling: "No" -#comanage_admin: -# given_name: "Pat" -# family_name: "Jones Smith" -# username: "pat.jones.smith@university.edu" +# comanage_admin: +# given_name: "Pat" +# family_name: "Jones Smith" +# username: "pat.jones.smith@university.edu" # Override comanage_version with a tag name. This will result to a new directory name comanage-registry- # COmanage will be checked out under {{ comanage_root_dir }}/comanage-registry-{{ comanage_version }} -comanage_version: "rciam24-3.1.x" -comanage_repo: "https://github.com/rciam/comanage-registry.git" -comanage_root_dir: "/srv/comanage" +comanage_version: rciam24-3.1.x +comanage_repo: https://github.com/rciam/comanage-registry.git +comanage_root_dir: /srv/comanage comanage_path: "{{ comanage_root_dir }}/comanage-registry-current" -comanage_webroot: "/var/www/html/registry" -comanage_temp_dir: "/var/cache/registry" -comanage_app_base: "/registry" +comanage_webroot: /var/www/html/registry +comanage_temp_dir: /var/cache/registry +comanage_app_base: /registry comanage_log_engine: error: # Allowed values for handler: "FileLog" | "SyslogLog" - handler: "FileLog" - size: "10MB" + handler: FileLog + size: 10MB rotate: 10 # prefix: "comanage" debug: - handler: "FileLog" - size: "10MB" + handler: FileLog + size: 10MB rotate: 10 # prefix: "comanage" info: - handler: "FileLog" - size: "10MB" + handler: FileLog + size: 10MB rotate: 10 # prefix: "comanage" comanage_databases: - - instance: "default" + - instance: default # Either "Database/Postgres" or "Database/Mysql" - vendor: "Database/Mysql" - persistent: no - host: "localhost" - user: "user" - password: "password" - name: "database_name" - prefix: "cm_" - #encoding: "utf8" - - instance: "test" - vendor: "Database/Mysql" - persistent: no - host: "localhost" - user: "user" - password: "password" - name: "test_database_name" - prefix: "cm_" - #encoding: "utf8" + vendor: Database/Mysql + persistent: false + host: localhost + user: user + password: password + name: database_name + prefix: cm_ + # encoding: "utf8" + - instance: test + vendor: Database/Mysql + persistent: false + host: localhost + user: user + password: password + name: test_database_name + prefix: cm_ + # encoding: "utf8" comanage_mailers: - - instance: "default" + - instance: default # Transport configuration name - transport: "Mail" + transport: Mail # Email or array of sender - from: "you@localhost" - #charset: "utf-8" - #header_charset: "utf-8" - - instance: "smtp" - transport: "Smtp" + from: you@localhost + # charset: "utf-8" + # header_charset: "utf-8" + - instance: smtp + transport: Smtp from: - site@localhost: "My Site" - host: "localhost" + site@localhost: My Site + host: localhost port: 25 timeout: 30 - username: "user" - password: "secret" - client: null - log: no - #charset: "utf-8" - #header_charset: "utf-8" - - instance: "fast" - from: "you@localhost" - sender: null - to: null - cc: null - bcc: null - reply_to: null + username: user + password: secret + client: + log: false + # charset: "utf-8" + # header_charset: "utf-8" + - instance: fast + from: you@localhost + sender: + to: + cc: + bcc: + reply_to: # Email address(es) to receive the receipt of read - read_receipt: null + read_receipt: # Email address(es) to return in case of error - return_path: null + return_path: messageId: true - subject: null - message: null - headers: null - view_render: null - template: no - layout: no - view_vars: null - attachments: null - email_format: null - transport: "Smtp" - host: "localhost" + subject: + message: + headers: + view_render: + template: false + layout: false + view_vars: + attachments: + email_format: + transport: Smtp + host: localhost port: 25 timeout: 30 - username: "user" - password: "secret" - client: null - log: yes - #charset: "utf-8" - #header_charset: "utf-8" + username: user + password: secret + client: + log: true + # charset: "utf-8" + # header_charset: "utf-8" # Used in login.php and logout.php -comanage_session_name: "CAKEPHP" +comanage_session_name: CAKEPHP comanage_core_session_conf: - defaults: "php" + defaults: php # Ldap Provisioner Entitlements Configuration comanage_ldap_provisioner_entitlements: enable_vo_whitelist: false - vo_whitelist: '' # comma seperated list - vo_roles: '' # comma seperated roles - urn_namespace: '' - urn_authority: '' - vo_group_prefix: '' + vo_whitelist: "" # comma seperated list + vo_roles: "" # comma seperated roles + urn_namespace: "" + urn_authority: "" + vo_group_prefix: "" # Dis/Enable COmanage cache -#comanage_core_cache: true +# comanage_core_cache: true # Dis/Enable COmanage debug mode -#comanage_core_debug: 1 +# comanage_core_debug: 1 -#comanage_logout_location: "/registry.sso/Logout?return=%2Fregistry%2Fpages%2Fpublic%2Floggedout" +# comanage_logout_location: "/registry.sso/Logout?return=%2Fregistry%2Fpages%2Fpublic%2Floggedout" # Used in Controller/AppController.php, View/Layout/default.ctp, View/Layout/lightbox.ctp -#comanage_timezone_cookie_name: "cookie_tz_auto" +# comanage_timezone_cookie_name: "cookie_tz_auto" -#comanage_memcache_hosts: -# - ip: '127.0.0.1' -# port: 11211 -# - ip: '127.0.0.1' -# port: 11212 +# comanage_memcache_hosts: +# - ip: '127.0.0.1' +# port: 11211 +# - ip: '127.0.0.1' +# port: 11212 -#comanage_memcache_options: -# - key: "Memcached::OPT_NO_BLOCK" -# value: true -# - key: "Memcached::OPT_DISTRIBUTION" -# value: true +# comanage_memcache_options: +# - key: "Memcached::OPT_NO_BLOCK" +# value: true +# - key: "Memcached::OPT_DISTRIBUTION" +# value: true # Backup the Comanage directory -#comanage_backup: yes +# comanage_backup: yes # Security.cipherSeed is a random numeric string (digits only) used to encrypt/decrypt strings. # It is read from the file app/Config/security.seed and should be at least 29 @@ -161,7 +161,7 @@ comanage_ldap_provisioner_entitlements: # Salt: cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 40 | head -n 1 | xargs echo -n # comanage_security_salt: "defaultsecretsalt" -#comanage_cron_jobs: +# comanage_cron_jobs: # - name: "Action Name" # minute: "0" # filename: "registry" @@ -170,4 +170,4 @@ comanage_ldap_provisioner_entitlements: # cd {{ path_to_registry }}/app && Console/cake action # Whether to install COmanage cron jobs; Enabled by default -comanage_cron_jobs_enabled: yes \ No newline at end of file +comanage_cron_jobs_enabled: true diff --git a/roles/comanage-registry/tasks/configure.yml b/roles/comanage-registry/tasks/configure.yml index 5af7a99e..fdcfeaae 100644 --- a/roles/comanage-registry/tasks/configure.yml +++ b/roles/comanage-registry/tasks/configure.yml @@ -1,51 +1,51 @@ --- - - name: Configure COmanage Registry database connections - template: - src: "database.php.j2" + ansible.builtin.template: + src: database.php.j2 dest: "{{ comanage_path }}/local/Config/database.php" owner: "{{ comanage_webserver_user }}" group: "{{ comanage_webserver_group }}" - mode: 0600 - backup: yes - become: yes + mode: "0600" + backup: true + become: true tags: - - comanage-registry:config:db + - comanage-registry:config:db - name: Configure COmanage Registry email settings - template: - src: "email.php.j2" + ansible.builtin.template: + src: email.php.j2 dest: "{{ comanage_path }}/local/Config/email.php" owner: "{{ comanage_webserver_user }}" group: "{{ comanage_webserver_group }}" - mode: 0600 - backup: yes - become: yes + mode: "0600" + backup: true + become: true tags: - - comanage-registry:config:email + - comanage-registry:config:email - name: Configure COmanage Registry ldap entitlement settings - template: - src: "ldap.php.j2" + ansible.builtin.template: + src: ldap.php.j2 dest: "{{ comanage_path }}/local/Config/ldap.php" owner: "{{ comanage_webserver_user }}" group: "{{ comanage_webserver_group }}" - mode: 0600 - backup: yes - become: yes + mode: "0600" + backup: true + become: true tags: - - comanage-registry:config:ldap + - comanage-registry:config:ldap # Seed: cat /dev/urandom | tr -dc '0-9' | fold -w 29 | head -n 1 | xargs echo -n # Salt: cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 40 | head -n 1 | xargs echo -n - name: Configure COmanage Registry security.salt and security.seed - template: + ansible.builtin.template: src: "{{ item }}.j2" dest: "{{ comanage_path }}/local/Config/{{ item }}" owner: "{{ comanage_webserver_user }}" group: "{{ comanage_webserver_group }}" - backup: yes - become: yes + mode: "0600" + backup: true + become: true loop: - security.salt - security.seed @@ -53,82 +53,84 @@ - comanage-registry:config:security - name: Configure COmanage Registry app/webroot/.htaccess - blockinfile: + ansible.builtin.blockinfile: dest: "{{ comanage_path }}/app/webroot/.htaccess" - backup: yes + backup: true marker: "# {mark} ANSIBLE MANAGED BLOCK" - insertafter: "EOF" + insertafter: EOF block: "{{ comanage_app_webroot_htaccess }}" when: comanage_app_webroot_htaccess is defined - become: yes + become: true tags: - - comanage-registry:config:webroot + - comanage-registry:config:webroot - name: Configure COmanage Registry auth session name - lineinfile: + ansible.builtin.lineinfile: dest: "{{ item }}" - regexp: "^session_name" - line: 'session_name("{{ comanage_session_name }}");' + regexp: ^session_name + line: session_name("{{ comanage_session_name }}"); with_items: - - "{{ comanage_path }}/app/webroot/auth/login/index.php" - - "{{ comanage_path }}/app/webroot/auth/logout/index.php" - become: yes + - "{{ comanage_path }}/app/webroot/auth/login/index.php" + - "{{ comanage_path }}/app/webroot/auth/logout/index.php" + become: true tags: - - comanage-registry:config:webroot + - comanage-registry:config:webroot - name: Configure COmanage Registry logout location - replace: + ansible.builtin.replace: dest: "{{ comanage_path }}/app/webroot/auth/logout/index.php" - backup: yes - regexp: '\/registry\/users\/logout' + backup: true + regexp: \/registry\/users\/logout replace: "{{ comanage_logout_location }}" when: comanage_logout_location is defined - become: yes + become: true tags: - - comanage-registry:config:webroot + - comanage-registry:config:webroot - name: Configure COmanage Registry timezone cookie name - replace: + ansible.builtin.replace: dest: "{{ item }}" - backup: yes - regexp: "cm_registry_tz_auto" + backup: true + regexp: cm_registry_tz_auto replace: "{{ comanage_timezone_cookie_name }}" with_items: - - "{{ comanage_path }}/app/Controller/AppController.php" - - "{{ comanage_path }}/app/View/Layouts/default.ctp" - - "{{ comanage_path }}/app/View/Layouts/lightbox.ctp" + - "{{ comanage_path }}/app/Controller/AppController.php" + - "{{ comanage_path }}/app/View/Layouts/default.ctp" + - "{{ comanage_path }}/app/View/Layouts/lightbox.ctp" when: comanage_timezone_cookie_name is defined - become: yes + become: true # According to COmanage this is not a mandatory step for the setup - name: Configure COmanage Registry core.php - template: - src: "core.php.j2" + ansible.builtin.template: + src: core.php.j2 dest: "{{ comanage_path }}/app/Config/core.php" owner: root group: root - backup: yes - become: yes + backup: true + mode: "0600" + become: true tags: - - comanage-registry:config:core + - comanage-registry:config:core - name: Configure COmanage Registry bootstrap.php - template: - src: "bootstrap.php.j2" + ansible.builtin.template: + src: bootstrap.php.j2 dest: "{{ comanage_path }}/app/Config/bootstrap.php" owner: root group: root - backup: yes - become: yes + mode: "0600" + backup: true + become: true tags: - - comanage-registry:config:bootstrap + - comanage-registry:config:bootstrap - name: Add ENV vars in cron.d file - cron: + ansible.builtin.cron: name: "{{ item.name }}" job: "{{ item.job }}" user: "{{ item.user }}" - env: yes + env: true cron_file: "{{ item.filename }}" state: present loop: "{{ comanage_cron_env | default([]) }}" @@ -136,7 +138,7 @@ when: comanage_cron_env is defined and comanage_cron_jobs is defined and comanage_cron_jobs_enabled - name: Ensure COmanage Registry cron jobs are installed - cron: + ansible.builtin.cron: name: "{{ item.name }}" minute: "{{ item.minute | default(omit) }}" hour: "{{ item.hour | default(omit) }}" @@ -153,10 +155,10 @@ # Tasks adding/copying/replacing files - name: Update/Copy tasks - include_tasks: + ansible.builtin.include_tasks: file: static_files.yml apply: tags: - - comanage-registry:config:staticfiles + - comanage-registry:config:staticfiles tags: - - comanage-registry:config:staticfiles \ No newline at end of file + - comanage-registry:config:staticfiles diff --git a/roles/comanage-registry/tasks/initialize.yml b/roles/comanage-registry/tasks/initialize.yml index 01728ecf..7e578de6 100644 --- a/roles/comanage-registry/tasks/initialize.yml +++ b/roles/comanage-registry/tasks/initialize.yml @@ -1,18 +1,24 @@ --- - - name: Configure COmanage Registry database schema - shell: Console/cake database + ansible.builtin.command: Console/cake database args: chdir: "{{ comanage_path }}/app" - become: yes + become: true + changed_when: false become_user: "{{ comanage_webserver_user }}" tags: - comanage-registry:init:db - name: Configure COmanage Registry platform admin and org identity pooling - shell: Console/cake setup --admin-given-name "{{ comanage_admin.given_name }}" --admin-family-name "{{ comanage_admin.family_name }}" --admin-username "{{ comanage_admin.username }}" --enable-pooling={{ comanage_org_identity_pooling }} + ansible.builtin.command: |- + Console/cake setup \ + --admin-given-name "{{ comanage_admin.given_name }}" \ + --admin-family-name "{{ comanage_admin.family_name }}" \ + --admin-username "{{ comanage_admin.username }}" \ + --enable-pooling={{ comanage_org_identity_pooling }} + changed_when: false args: chdir: "{{ comanage_path }}/app" - become: yes + become: true tags: - - comanage-registry:init:admin \ No newline at end of file + - comanage-registry:init:admin diff --git a/roles/comanage-registry/tasks/install.yml b/roles/comanage-registry/tasks/install.yml index 025dc481..9e167296 100644 --- a/roles/comanage-registry/tasks/install.yml +++ b/roles/comanage-registry/tasks/install.yml @@ -1,64 +1,64 @@ --- - - name: Ensure COmanage Registry root directory exists - file: + ansible.builtin.file: path: "{{ comanage_root_dir }}" state: directory owner: root group: root - become: yes + mode: "0755" + become: true - name: Ensure COmanage Registry source is cloned under root directory - git: + ansible.builtin.git: repo: "{{ comanage_repo }}" dest: "{{ comanage_root_dir }}/comanage-registry-{{ comanage_version }}" version: "{{ comanage_version }}" - accept_hostkey: yes - ignore_errors: yes - become: yes + accept_hostkey: true + ignore_errors: true # noqa ignore-errors + become: true - name: Ensure symbolic link to current COmanage Registry installation exists - file: + ansible.builtin.file: src: "{{ comanage_root_dir }}/comanage-registry-{{ comanage_version }}" dest: "{{ comanage_path }}" - force: yes + force: true state: link owner: root group: root - become: yes + become: true - name: Ensure COmanage Registry webroot directory exists - file: + ansible.builtin.file: src: "{{ comanage_path }}/app/webroot" dest: "{{ comanage_webroot }}" state: link - force: yes + force: true owner: root group: root - become: yes + become: true - name: Ensure COmanage Registry temp directory tree is initialised - command: "cp -r {{ comanage_path }}/app/tmp.dist {{ comanage_temp_dir }}" + ansible.builtin.command: cp -r {{ comanage_path }}/app/tmp.dist {{ comanage_temp_dir }} args: creates: "{{ comanage_temp_dir }}" - become: yes + become: true - name: Ensure COmanage Registry temp directory exists and is writable by webserver only - file: + ansible.builtin.file: path: "{{ comanage_temp_dir }}" state: directory owner: "{{ comanage_webserver_user }}" group: "{{ comanage_webserver_group }}" - mode: 0700 - recurse: yes - become: yes + mode: "0700" + recurse: true + become: true - name: Ensure link to COmanage Registry temp directory exists - file: + ansible.builtin.file: src: "{{ comanage_temp_dir }}" dest: "{{ comanage_path }}/local/tmp" state: link owner: root group: root - follow: no - become: yes + follow: false + become: true diff --git a/roles/comanage-registry/tasks/main.yml b/roles/comanage-registry/tasks/main.yml index e74a8315..28868d2d 100644 --- a/roles/comanage-registry/tasks/main.yml +++ b/roles/comanage-registry/tasks/main.yml @@ -1,55 +1,54 @@ --- - - name: Include OS-specific variables - include_vars: "{{ item }}" + ansible.builtin.include_vars: "{{ item }}" with_first_found: - - "{{ ansible_distribution }}-{{ ansible_distribution_release}}.yml" - - "{{ ansible_distribution }}-{{ ansible_distribution_major_version}}.yml" + - "{{ ansible_distribution }}-{{ ansible_distribution_release }}.yml" + - "{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml" - "{{ ansible_distribution }}.yml" - "{{ ansible_os_family }}.yml" tags: - - always + - always # Check if COmanage current is available - name: Check if COmanage Current directory is present - stat: + ansible.builtin.stat: path: "{{ comanage_path }}" register: comanage_current_dir tags: - always - name: COmanage Current directory exists? - debug: - msg: "COmanage Current Exists: {{comanage_current_dir.stat.exists}}" + ansible.builtin.debug: + msg: "COmanage Current Exists: {{ comanage_current_dir.stat.exists }}" tags: - always -#Create a task to take backup of the directory first +# Create a task to take backup of the directory first - name: Backup comanage directory - copy: + ansible.builtin.copy: src: "{{ comanage_current_dir.stat.lnk_target }}" dest: "{{ comanage_current_dir.stat.lnk_target }}.{{ ansible_date_time.iso8601 }}" - remote_src: yes - force: yes + remote_src: true + force: true owner: root mode: preserve backup: true - become: yes + become: true when: - comanage_backup is defined - comanage_backup|bool - comanage_current_dir.stat.exists tags: - - always + - always -- name: COmanage clear cache - shell: Console/clearcache +- name: COmanage clear cache # noqa no-changed-when + ansible.builtin.shell: Console/clearcache args: executable: /bin/bash chdir: "{{ comanage_path }}/app" - become: yes + become: true become_user: "{{ comanage_webserver_user }}" - ignore_errors: yes + ignore_errors: true # noqa ignore-errors when: - comanage_current_dir.stat.exists tags: @@ -57,17 +56,17 @@ # Tasks deploying COmanage framework. There is none conditional task. - name: Include OS-independent installation tasks - include_tasks: + ansible.builtin.include_tasks: file: install.yml apply: tags: - - comanage-registry:install + - comanage-registry:install tags: - - comanage-registry:install + - comanage-registry:install - # Tasks required for basic Framework functionality +# Tasks required for basic Framework functionality - name: Include OS-independent initialize tasks - include_tasks: + ansible.builtin.include_tasks: file: initialize.yml apply: tags: @@ -77,10 +76,10 @@ # Tasks that are Deployment Specific - name: Include OS-independent configuration tasks - include_tasks: + ansible.builtin.include_tasks: file: configure.yml apply: tags: - - comanage-registry:config + - comanage-registry:config tags: - - comanage-registry:config + - comanage-registry:config diff --git a/roles/comanage-registry/tasks/static_files.yml b/roles/comanage-registry/tasks/static_files.yml index 5c1f4b41..de658173 100644 --- a/roles/comanage-registry/tasks/static_files.yml +++ b/roles/comanage-registry/tasks/static_files.yml @@ -1,36 +1,35 @@ --- - - name: Register COmanage files to be copied - find: + ansible.builtin.find: paths: "{{ inventory_dir }}/files/comanage-registry" file_type: file - recurse: yes + recurse: true register: comanage_files - ignore_errors: yes + ignore_errors: true delegate_to: 127.0.0.1 vars: ansible_connection: local - name: Display files to be copied - debug: + ansible.builtin.debug: msg: "{{ comanage_path }}/{{ item.path | regex_replace('(.*)[/]files[/]comanage-registry[/](.*)', '\\2') }}" verbosity: 1 loop: "{{ comanage_files.files }}" loop_control: - label: "Copied file {{ item.path }}" + label: Copied file {{ item.path }} when: comanage_files is defined - name: Copy COmanage files - copy: + ansible.builtin.copy: src: "{{ item.path }}" dest: "{{ comanage_path }}/{{ item.path | regex_replace('(.*)[/]files[/]comanage-registry[/](.*)', '\\2') }}" - force: yes + force: true owner: root - mode: 0664 + mode: "0664" backup: true loop: "{{ comanage_files.files }}" loop_control: - label: "Added file {{ comanage_path }}/{{ item.path | regex_replace('(.*)[/]files[/]comanage-registry[/](.*)', '\\2') }}" - become: yes - ignore_errors: yes + label: Added file {{ comanage_path }}/{{ item.path | regex_replace('(.*)[/]files[/]comanage-registry[/](.*)', '\2') }} + become: true + ignore_errors: true # noqa ignore-errors when: comanage_files is defined diff --git a/roles/comanage-registry/templates/bootstrap.php.j2 b/roles/comanage-registry/templates/bootstrap.php.j2 index 90aac8b7..3421b376 100644 --- a/roles/comanage-registry/templates/bootstrap.php.j2 +++ b/roles/comanage-registry/templates/bootstrap.php.j2 @@ -2,7 +2,7 @@ /** * This file is loaded automatically by the app/webroot/index.php file after core.php * - * This file should load/create any application wide configuration settings, such as + * This file should load/create any application wide configuration settings, such as * Caching, Logging, loading additional configuration files. * * You should also use this file to include any files that provide global functions/constants @@ -163,5 +163,3 @@ CakeLog::config('error', array( 'rotate' => {{ comanage_log_engine.error.rotate }}, {% endif %} )); - - diff --git a/roles/comanage-registry/vars/Debian.yml b/roles/comanage-registry/vars/Debian.yml index 3a7bb5ed..dae8a17e 100644 --- a/roles/comanage-registry/vars/Debian.yml +++ b/roles/comanage-registry/vars/Debian.yml @@ -1,4 +1,4 @@ --- -comanage_webserver_user: "www-data" -comanage_webserver_group: "www-data" +comanage_webserver_user: www-data +comanage_webserver_group: www-data diff --git a/roles/common/defaults/main.yml b/roles/common/defaults/main.yml index 53aa9a00..cf182dd6 100644 --- a/roles/common/defaults/main.yml +++ b/roles/common/defaults/main.yml @@ -1,3 +1,2 @@ --- - -common_tz: "Europe/Amsterdam" +common_tz: Europe/Amsterdam diff --git a/roles/common/handlers/main.yml b/roles/common/handlers/main.yml index 66bbab2f..cdc96ea5 100644 --- a/roles/common/handlers/main.yml +++ b/roles/common/handlers/main.yml @@ -1,5 +1,5 @@ --- - -- name: Update timezone - command: "{{ common_set_tz_cmd }}" - become: yes +- name: Update timezone # noqa syntax-check[unknown-module] + community.general.timezone: # noqa syntax-check[unknown-module] + name: "{{ common_tz }}" + become: true diff --git a/roles/common/tasks/configure-Debian.yml b/roles/common/tasks/configure-Debian.yml index e64ecf85..ad1d316d 100644 --- a/roles/common/tasks/configure-Debian.yml +++ b/roles/common/tasks/configure-Debian.yml @@ -1,12 +1,11 @@ --- - - name: Configure timezone - template: + ansible.builtin.template: src: etc/timezone.j2 dest: /etc/timezone owner: root - group: root - mode: 0644 - become: yes + group: root + mode: "0644" + become: true notify: - - Update timezone + - Update timezone diff --git a/roles/common/tasks/configure-common.yml b/roles/common/tasks/configure-common.yml index b06f073e..08f4eee7 100644 --- a/roles/common/tasks/configure-common.yml +++ b/roles/common/tasks/configure-common.yml @@ -1,10 +1,9 @@ --- - - name: Configure Vim system-wide defaults - template: + ansible.builtin.template: src: etc/vim/vimrc.j2 dest: /etc/vim/vimrc owner: root group: root - mode: 0644 - become: yes + mode: "0644" + become: true diff --git a/roles/common/tasks/install-Debian.yml b/roles/common/tasks/install-Debian.yml index 6f68fd64..e00aebe6 100644 --- a/roles/common/tasks/install-Debian.yml +++ b/roles/common/tasks/install-Debian.yml @@ -1,17 +1,16 @@ --- - - name: Update package cache (Debian) - apt: - update_cache: yes + ansible.builtin.apt: + update_cache: true cache_valid_time: 86400 - become: yes + become: true - name: Ensure common packages are installed (Debian) - apt: + ansible.builtin.apt: pkg: - aptitude - ca-certificates - vim-nox state: present - install_recommends: no + install_recommends: false become: true diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml index aff77b66..4af47137 100644 --- a/roles/common/tasks/main.yml +++ b/roles/common/tasks/main.yml @@ -1,22 +1,21 @@ --- - - name: Include OS-specific variables - include_vars: "{{ ansible_os_family }}.yml" + ansible.builtin.include_vars: "{{ ansible_os_family }}.yml" -# Install OS-specific packages -- include: install-Debian.yml +- name: Include Debian-specific tasks + ansible.builtin.include_tasks: install-Debian.yml when: ansible_os_family == 'Debian' -#- include: install-CentOS.yml +# - include: install-CentOS.yml # when: ansible_os_family == 'CentOS' # Run OS-independent installation tasks -#- include: install-common.yml +# - include: install-common.yml -# Apply OS-specific configuration -- include: configure-Debian.yml +- name: Apply OS-specific configuration + ansible.builtin.include_tasks: configure-Debian.yml when: ansible_os_family == 'Debian' -#- include: configure-CentOS.yml +# - include: configure-CentOS.yml # when: ansible_os_family == 'CentOS' -# Apply OS-independent configuration -- include: configure-common.yml +- name: Apply OS-independent configuration + ansible.builtin.include_tasks: configure-common.yml diff --git a/roles/common/vars/Debian.yml b/roles/common/vars/Debian.yml index 7d0c449b..d3c04433 100644 --- a/roles/common/vars/Debian.yml +++ b/roles/common/vars/Debian.yml @@ -1,3 +1,2 @@ --- - -common_set_tz_cmd: "dpkg-reconfigure --frontend noninteractive tzdata" +common_set_tz_cmd: dpkg-reconfigure --frontend noninteractive tzdata diff --git a/roles/dirmngr/tasks/install-Debian.yml b/roles/dirmngr/tasks/install-Debian.yml index 974a99ae..0972c15a 100644 --- a/roles/dirmngr/tasks/install-Debian.yml +++ b/roles/dirmngr/tasks/install-Debian.yml @@ -1,11 +1,16 @@ --- - name: Update package cache (Debian) - apt: update_cache=yes cache_valid_time=86400 - become: yes + ansible.builtin.apt: + update_cache: true + cache_valid_time: 86400 + become: true - name: Ensure dirmngr is installed (Debian) - apt: name={{ item }} state=present install_recommends=no + ansible.builtin.apt: + name: "{{ item }}" + state: present + install_recommends: false with_items: - dirmngr - become: yes + become: true diff --git a/roles/dirmngr/tasks/main.yml b/roles/dirmngr/tasks/main.yml index d4cdedb6..270496d5 100644 --- a/roles/dirmngr/tasks/main.yml +++ b/roles/dirmngr/tasks/main.yml @@ -1,7 +1,6 @@ --- - -# Install OS-specific packages -- include: install-Debian.yml +- name: Install OS-specific packages + ansible.builtin.include_tasks: install-Debian.yml when: ansible_os_family == 'Debian' -#- include: install-RedHat.yml +# - include: install-RedHat.yml # when: ansible_os_family == 'RedHat' diff --git a/roles/egi-igtf/handlers/main.yml b/roles/egi-igtf/handlers/main.yml new file mode 100644 index 00000000..914b3a32 --- /dev/null +++ b/roles/egi-igtf/handlers/main.yml @@ -0,0 +1,4 @@ +- name: Update /etc/ssl/certs and certificates.crt with EGI Trust Anchors (Debian) # noqa no-changed-when + ansible.builtin.command: "/usr/sbin/update-ca-certificates -f" + become: true + listen: Update certs diff --git a/roles/egi-igtf/tasks/configure-Debian.yml b/roles/egi-igtf/tasks/configure-Debian.yml index 967000fe..747a6ae6 100644 --- a/roles/egi-igtf/tasks/configure-Debian.yml +++ b/roles/egi-igtf/tasks/configure-Debian.yml @@ -1,21 +1,25 @@ --- - +# egi-igtf/tasks/configure-Debian.yml - name: Ensure dir for EGI Trust Anchor symlinks exists (Debian) - file: path="/usr/local/share/ca-certificates/egi-igtf" state=directory - become: yes + ansible.builtin.file: + path: /usr/local/share/ca-certificates/egi-igtf + state: directory + mode: "0755" + owner: root + group: root + become: true - name: Register EGI Trust Anchors to symlink (Debian) - shell: "ls /etc/grid-security/certificates/*.0" + ansible.builtin.shell: "ls /etc/grid-security/certificates/*.0" # noqa register: egi_igtf_certs changed_when: false - name: Ensure symlinks to EGI Trust Anchors exist (Debian) - file: path="/usr/local/share/ca-certificates/egi-igtf/{{ item | basename}}.crt" src="{{ item }}" state=link + ansible.builtin.file: + path: "/usr/local/share/ca-certificates/egi-igtf/{{ item | basename }}.crt" + src: "{{ item }}" + state: link with_items: "{{ egi_igtf_certs.stdout_lines }}" register: egi_igtf_cert_symlinks - become: yes - -- name: Update /etc/ssl/certs and certificates.crt with EGI Trust Anchors (Debian) - command: "/usr/sbin/update-ca-certificates -f" - when: egi_igtf_cert_symlinks is changed - become: yes + become: true + notify: Update certs diff --git a/roles/egi-igtf/tasks/install-Debian.yml b/roles/egi-igtf/tasks/install-Debian.yml index fc7ce639..64db212b 100644 --- a/roles/egi-igtf/tasks/install-Debian.yml +++ b/roles/egi-igtf/tasks/install-Debian.yml @@ -1,19 +1,19 @@ --- - name: Ensure EUGridPMA apt key is installed (Debian) - apt_key: + ansible.builtin.apt_key: url: "{{ egi_igtf_repo_key_url }}" - state: present - become: yes + state: present + become: true - name: Ensure EGI Trust Anchor repository is included (Debian) - apt_repository: - repo: "deb {{ egi_igtf_repo_url }} egi-igtf {{ egi_igtf_components }}" - state: present - become: yes + ansible.builtin.apt_repository: + repo: "deb {{ egi_igtf_repo_url }} egi-igtf {{ egi_igtf_components }}" + state: present + become: true - name: Ensure latest versions of EGI Trust Anchors are installed (Debian) - apt: - name: ca-policy-egi-core - state: latest - update_cache: yes - become: yes + ansible.builtin.apt: + name: ca-policy-egi-core # This really needs a version attached to it! + state: present + update_cache: true + become: true diff --git a/roles/egi-igtf/tasks/main.yml b/roles/egi-igtf/tasks/main.yml index 817b6083..59b53fdf 100644 --- a/roles/egi-igtf/tasks/main.yml +++ b/roles/egi-igtf/tasks/main.yml @@ -1,12 +1,12 @@ --- - +# egi-igtf/tasks/main.yml - name: Include OS-specific variables - include_vars: "{{ ansible_os_family }}.yml" + ansible.builtin.include_vars: "{{ ansible_os_family }}.yml" -# Run OS-specific installation tasks -- include: install-Debian.yml +- name: Run OS-specific installation tasks + ansible.builtin.include_tasks: install-Debian.yml when: ansible_os_family == 'Debian' -# Apply OS-specific configuration -- include: configure-Debian.yml +- name: Apply OS-specific configuration + ansible.builtin.include_tasks: configure-Debian.yml when: ansible_os_family == 'Debian' diff --git a/roles/federation-registry/README.md b/roles/federation-registry/README.md index 3f185a1a..6af1d7a3 100644 --- a/roles/federation-registry/README.md +++ b/roles/federation-registry/README.md @@ -1,35 +1,35 @@ ### Description -This role deploys the [Federation Registry](https://github.com/rciam/rciam-federation-registry) project. +This role deploys the [Federation Registry](https://github.com/rciam/rciam-federation-registry) project. ### Task Analysis - **configure-environment** : + **configure-environment** : - Installs necessary packages - Set's up github ssh key to clone repo (Can do it manually beforehand or Change to Https) - -**postgres** : (To run this tast include the postgres tag when running the playbook) -- Runs initialization script that creates the necessary SQL tables + +**postgres** : (To run this tast include the postgres tag when running the playbook) +- Runs initialization script that creates the necessary SQL tables - Runs initialization script for tenants -**configure-ams:** +**configure-ams:** - Creates Deployment Result Topic and Push Subscription in the Ams Messaging Service - -**deploy**: -- Clones Repo -- Runs Express Backend instance with pm2 serving at http://localhost:5000 -- Builds React Frontend -- Runs Ams Agent node.js agent with pm2 + +**deploy**: +- Clones Repo +- Runs Express Backend instance with pm2 serving at http://localhost:5000 +- Builds React Frontend +- Runs Ams Agent node.js agent with pm2 - Activates Push Subscription for Deployment Result Topic ### Configuring the Inventory - **main.yml:** + **main.yml:** - Ams Configuration (federation_registry_ams): - - Set host of the AMS instance + - Set host of the AMS instance - A preconfigured project and an admin user is needed. Set project name and admin_token accordingly - agent_key is the Authorisation Key used for the communitation of the Ams Agent and the Federation Registry Backend - - Folder Paths: + - Folder Paths: - Set deployment Path for each component - Git (federation_registry_git): - Set url for ssh or https @@ -38,6 +38,6 @@ This role deploys the [Federation Registry](https://github.com/rciam/rciam-feder **config.json:** Configure the file based on the tenant information and instance requirements - **hosts.ini:** + **hosts.ini:** - federation-registry: Federation Registry Backend and Frontend gets deployed for hosts in this group - ams-agent: Ams Agent Instance is deployed for hosts in this group (maximun of 1 instance) diff --git a/roles/federation-registry/defaults/config.json b/roles/federation-registry/defaults/config.json index ece87fac..2af4e079 100644 --- a/roles/federation-registry/defaults/config.json +++ b/roles/federation-registry/defaults/config.json @@ -14,7 +14,7 @@ "service_integration_notification": { "enabled": false, "email": "ticketing-system@mail.com", - "integration_environments": ["devel"], + "integration_environments": ["devel"], "template": "" }, "restricted_env": ["production"], @@ -155,7 +155,7 @@ "tag":"coc", "error": "The service must comply with this policy" } - + } } }, @@ -170,4 +170,3 @@ "deployment_fields":["service_name","service_description","client_id","allow_introspection","code_challenge_method","device_code_validity_seconds","access_token_validity_seconds","refresh_token_validity_seconds","client_secret","reuse_refresh_token","clear_access_tokens_on_refresh","id_token_timeout_seconds","entity_id","metadata_url","grant_types","scope","contacts","redirect_uris","token_endpoint_auth_method","token_endpoint_auth_signing_alg","jwks","jwks_uri","website_url","aup_uri","policy_uri","country","logo_uri","application_type","requested_attributes","post_logout_redirect_uris"], "multivalue_fields": ["grant_types","scope","contacts","redirect_uris","post_logout_redirect_uris"] } - \ No newline at end of file diff --git a/roles/federation-registry/defaults/main.yml b/roles/federation-registry/defaults/main.yml index b70aac49..f044fa1a 100644 --- a/roles/federation-registry/defaults/main.yml +++ b/roles/federation-registry/defaults/main.yml @@ -6,12 +6,12 @@ federation_registry_known_hosts_path: "~/.ssh/known_hosts" # Ams Configuration federation_registry_ams: # Consumer/Publisher for deployment tasks and deployment results topics - authorized_users : + authorized_users: - username: "ams-user" # Authentication key for the ams agent process - agent_key : "authentication_key_for_ams_agent" + agent_key: "authentication_key_for_ams_agent" # Admin User token for setting the topics, subscriptions and ACL - admin_token : "ams-admin-token" + admin_token: "ams-admin-token" # Consumer/Publisher User Token token: "ams-users-token" # Base Url of the Ams @@ -22,16 +22,16 @@ federation_registry_ams: federation_registry_pm2_conf_path: "/home/debian" federation_registry_react_folder: "federation-registry-frontend" federation_registry_project_path: "/var/www/rciam-federation-registry" -federation_registry_react_path: "{{federation_registry_project_path}}/{{federation_registry_react_folder}}" +federation_registry_react_path: "{{ federation_registry_project_path }}/{{ federation_registry_react_folder }}" federation_registry_express_folder: "federation-registry-backend-api" -federation_registry_express_path: "{{federation_registry_project_path}}/{{federation_registry_express_folder}}" +federation_registry_express_path: "{{ federation_registry_project_path }}/{{ federation_registry_express_folder }}" federation_registry_ams_agent_folder: "federation-registry-backend-ams-agent" -federation_registry_ams_agent_path: "{{federation_registry_project_path}}/{{federation_registry_ams_agent_folder}}" +federation_registry_ams_agent_path: "{{ federation_registry_project_path }}/{{ federation_registry_ams_agent_folder }}" federation_registry_git: git_repo: "https://github.com/rciam/rciam-federation-registry.git" git_branch: "devel" clone_dest: "/var/www/rciam-federation-registry" -federation_registry_deployment_env : "dev/demo/production" +federation_registry_deployment_env: "dev/demo/production" federation_registry_key_title: "env-vm" federation_registry_init_script: "setup_tenant.sql" federation_registry_admin_key: "authentication_for_admin_endpoints" @@ -52,5 +52,3 @@ federation_registry_tenant_config: backend_uri: "https://tenant1/federation-backend/" - name: "tenant2_name" backend_uri: "https://tenant2/federation-backend/" - - diff --git a/roles/federation-registry/defaults/setup_tenant.sql b/roles/federation-registry/defaults/setup_tenant.sql index 506c2833..c59231b3 100644 --- a/roles/federation-registry/defaults/setup_tenant.sql +++ b/roles/federation-registry/defaults/setup_tenant.sql @@ -45,7 +45,7 @@ VALUES(1 , 'get_user'), INSERT INTO tenant_deployer_agents (tenant,integration_environment,type,entity_type,hostname,entity_protocol,deployer_name) -VALUES +VALUES ('tenant_name', 'production', 'keycloak', 'service', 'test_deployer','oidc',null ), ('tenant_name', 'demo', 'keycloak', 'service', 'test_deployer','oidc',null ), ('tenant_name', 'development', 'keycloak', 'service', 'test_deployer','oidc',null ), @@ -54,4 +54,3 @@ VALUES ('tenant_name', 'demo', 'ssp', 'service', 'test_deployer','saml','1' ), ('tenant_name', 'demo', 'ssp', 'service', 'test_deployer','saml','2'), ('tenant_name', 'development', 'ssp', 'service', 'test_deployer','saml',null ); - diff --git a/roles/federation-registry/tasks/configure-ams.yml b/roles/federation-registry/tasks/configure-ams.yml index 9f303557..049f7c35 100644 --- a/roles/federation-registry/tasks/configure-ams.yml +++ b/roles/federation-registry/tasks/configure-ams.yml @@ -1,87 +1,88 @@ --- - - name: Create deployment_response topic - uri: - url: "{{ federation_registry_ams.host }}/projects/{{ federation_registry_ams.project }}/topics/{{ federation_registry_ams.topic }}" - method: PUT - return_content: yes - headers: - x-api-key: "{{ federation_registry_ams.admin_token }}" - register: response - run_once: true - failed_when: response.status != 409 and response.status != 200 +- name: Create deployment_response topic + ansible.builtin.uri: + url: "{{ federation_registry_ams.host }}/projects/{{ federation_registry_ams.project }}/topics/{{ federation_registry_ams.topic }}" + method: PUT + return_content: true + headers: + x-api-key: "{{ federation_registry_ams.admin_token }}" + register: response + run_once: true + failed_when: response.status != 409 and response.status != 200 - - name: Modify acl for topic - run_once: true - uri: - url: "{{ federation_registry_ams.host }}/projects/{{ federation_registry_ams.project }}/topics/{{ federation_registry_ams.topic }}:modifyAcl" - body: "{{lookup('template','ams_authorized_users.j2')}}" - method: POST - return_content: yes - headers: - Content-Type: "application/json" - x-api-key: "{{ federation_registry_ams.admin_token }}" - body_format: json +- name: Modify acl for topic + run_once: true + ansible.builtin.uri: + url: "{{ federation_registry_ams.host }}/projects/{{ federation_registry_ams.project }}/topics/{{ federation_registry_ams.topic }}:modifyAcl" + body: "{{ lookup('template', 'ams_authorized_users.j2') }}" + method: POST + return_content: true + headers: + Content-Type: "application/json" + x-api-key: "{{ federation_registry_ams.admin_token }}" + body_format: json - - name: Delete express push subscription - uri: - url: "{{ federation_registry_ams.host }}/projects/{{ federation_registry_ams.project }}/subscriptions/{{ federation_registry_ams.sub }}" - method: DELETE - return_content: yes - headers: - x-api-key: "{{ federation_registry_ams.admin_token }}" - register: response - run_once: true - failed_when: response.status != 409 and response.status != 200 and response.status != 404 +- name: Delete express push subscription + ansible.builtin.uri: + url: "{{ federation_registry_ams.host }}/projects/{{ federation_registry_ams.project }}/subscriptions/{{ federation_registry_ams.sub }}" + method: DELETE + return_content: true + headers: + x-api-key: "{{ federation_registry_ams.admin_token }}" + register: response + run_once: true + failed_when: response.status != 409 and response.status != 200 and response.status != 404 - - name: Create express push subscription - uri: - url: "{{ federation_registry_ams.host }}/projects/{{ federation_registry_ams.project }}/subscriptions/{{ federation_registry_ams.sub }}" - method: PUT - body: "{{lookup('template','ams_push_body.j2')}}" - headers: - Content-Type: "application/json" - x-api-key: "{{ federation_registry_ams.admin_token }}" - body_format: json - return_content: yes - run_once: true - register: post_ams_push_config_response +- name: Create express push subscription + ansible.builtin.uri: + url: "{{ federation_registry_ams.host }}/projects/{{ federation_registry_ams.project }}/subscriptions/{{ federation_registry_ams.sub }}" + method: PUT + body: "{{ lookup('template', 'ams_push_body.j2') }}" + headers: + Content-Type: "application/json" + x-api-key: "{{ federation_registry_ams.admin_token }}" + body_format: json + return_content: true + run_once: true + register: post_ams_push_config_response - - name: Get express push subscription - uri: - url: "{{ federation_registry_ams.host }}/projects/{{ federation_registry_ams.project }}/subscriptions/{{ federation_registry_ams.sub }}" - method: GET - return_content: yes - headers: - x-api-key: "{{ federation_registry_ams.admin_token }}" - register: get_ams_push_response - ignore_errors: yes - run_once: true - when: "post_ams_push_config_response is defined" +- name: Get express push subscription + ansible.builtin.uri: + url: "{{ federation_registry_ams.host }}/projects/{{ federation_registry_ams.project }}/subscriptions/{{ federation_registry_ams.sub }}" + method: GET + return_content: true + headers: + x-api-key: "{{ federation_registry_ams.admin_token }}" + register: get_ams_push_response + ignore_errors: true + run_once: true + when: "post_ams_push_config_response is defined" - - name: Modify Acl for Push Subscription - uri: - url: "{{ federation_registry_ams.host }}/projects/{{ federation_registry_ams.project }}/subscriptions/{{ federation_registry_ams.sub }}:modifyAcl" - body: "{{lookup('template','ams_authorized_users.j2')}}" - method: POST - headers: - Content-Type: "application/json" - x-api-key: "{{ federation_registry_ams.admin_token }}" - body_format: json - run_once: true +- name: Modify Acl for Push Subscription + ansible.builtin.uri: + url: "{{ federation_registry_ams.host }}/projects/{{ federation_registry_ams.project }}/subscriptions/{{ federation_registry_ams.sub }}:modifyAcl" + body: "{{ lookup('template', 'ams_authorized_users.j2') }}" + method: POST + headers: + Content-Type: "application/json" + x-api-key: "{{ federation_registry_ams.admin_token }}" + body_format: json + run_once: true - - name: Save Ams Facts - run_once: true - set_fact: - ams_auth_key: "{{get_ams_push_response.json.pushConfig.authorizationHeader.value}}" - ams_verif_hash: "{{get_ams_push_response.json.pushConfig.verificationHash}}" - when: - - "get_ams_push_response.json.pushConfig.authorizationHeader.value is defined" - - "get_ams_push_response.json.pushConfig.verificationHash is defined" - - - debug: - var: ams_verif_hash - - name: Save Ams verified - run_once: true - set_fact: - ams_is_verif: "{{get_ams_push_response.json.pushConfig.verified}}" - when: "get_ams_push_response.json.pushConfig.verified is defined" +- name: Save Ams Facts + run_once: true + ansible.builtin.set_fact: + ams_auth_key: "{{ get_ams_push_response.json.pushConfig.authorizationHeader.value }}" + ams_verif_hash: "{{ get_ams_push_response.json.pushConfig.verificationHash }}" + when: + - "get_ams_push_response.json.pushConfig.authorizationHeader.value is defined" + - "get_ams_push_response.json.pushConfig.verificationHash is defined" + +- name: Debug + ansible.builtin.debug: + var: ams_verif_hash +- name: Save Ams verified + run_once: true + ansible.builtin.set_fact: + ams_is_verif: "{{ get_ams_push_response.json.pushConfig.verified }}" + when: "get_ams_push_response.json.pushConfig.verified is defined" diff --git a/roles/federation-registry/tasks/configure-environment.yml b/roles/federation-registry/tasks/configure-environment.yml index 1d7dc293..0a4172de 100644 --- a/roles/federation-registry/tasks/configure-environment.yml +++ b/roles/federation-registry/tasks/configure-environment.yml @@ -1,27 +1,26 @@ --- +- name: Install dependencies + ansible.builtin.apt: + pkg: + - curl + - git + - nginx - - name: Install dependencies - apt: - pkg: - - curl - - git - - nginx - - - name: Add node repository - shell: curl -sL https://deb.nodesource.com/setup_14.x | sudo bash - - args: - warn: no - - - name: Install node and npm - apt: - pkg: - - build-essential - - nodejs - - npm - - - name: Install pm2 - npm: - name: pm2 - global: yes +- name: Add node repository # noqa no-changed-when + ansible.builtin.shell: > + set -o pipefail + curl -sL https://deb.nodesource.com/setup_14.x | sudo bash - + args: + warn: false +- name: Install node and npm + ansible.builtin.apt: + pkg: + - build-essential + - nodejs + - npm +- name: Install pm2 + community.general.npm: + name: pm2 + global: true diff --git a/roles/federation-registry/tasks/deploy.yml b/roles/federation-registry/tasks/deploy.yml index 126342f3..5d68515b 100644 --- a/roles/federation-registry/tasks/deploy.yml +++ b/roles/federation-registry/tasks/deploy.yml @@ -1,169 +1,210 @@ --- - - name: Check if project exists - stat: - path: "{{ federation_registry_git.clone_dest }}" - register: project_stat - - - name: Clean clone directory - file: - state: absent - path: "{{ federation_registry_git.clone_dest }}" - when: project_stat.stat.exists - - - name: Clean Frontend Folder - file: - state: absent - path: "{{federation_registry_project_path}}/{{federation_registry_react_folder}}" - ignore_errors: true - - - name: Clean Backend Folder - file: - state: absent - path: "{{federation_registry_project_path}}/{{federation_registry_express_folder}}" - ignore_errors: true - - - name: Clean Ams Agent Folder - file: - state: absent - path: "{{federation_registry_project_path}}/{{federation_registry_ams_agent_folder}}" - ignore_errors: true - - - name: Clone the repository - git: - repo: "{{federation_registry_git.git_repo}}" - version: "{{federation_registry_git.git_branch}}" - dest: "{{federation_registry_git.clone_dest}}" - force: yes - - - name: Move Federation Backend to /var/www - shell: mv {{federation_registry_git.clone_dest}}/{{federation_registry_express_folder}} {{federation_registry_project_path}} - - - name: Move Ams Agent to /var/www - shell: mv {{federation_registry_git.clone_dest}}/{{federation_registry_ams_agent_folder}} {{federation_registry_project_path}} - - - name: Move Swagger File to /var/www - shell: mv {{federation_registry_git.clone_dest}}/swagger.json {{federation_registry_project_path}} - - - name: Create React Folder - shell: mkdir {{federation_registry_project_path}}/{{federation_registry_react_folder}} - ignore_errors: True - - - name: Load package.json contents to package variable - slurp: - src: "{{federation_registry_git.clone_dest}}/{{federation_registry_react_folder}}/package.json" - register: imported_var - - - name: Append homepage value to package variable - set_fact: - imported_var: "{{ imported_var.content|b64decode|from_json | default([]) | combine({ 'homepage': federation_registry_react_base_url}) }}" - - - name: Write package variable to package.json - copy: - content: "{{ imported_var | to_nice_json }}" - dest: "{{federation_registry_git.clone_dest}}/{{federation_registry_react_folder}}/package.json" - - - name: Install node modules for react - npm: - path: "{{federation_registry_git.clone_dest}}/{{federation_registry_react_folder}}" - - - name: Install node modules for express - npm: - path: "{{federation_registry_express_path}}" - - - name: Install node modules for ams-agent - npm: - path: "{{federation_registry_ams_agent_path}}" - - - name: React config - template: - src: react-config.j2 - dest: "{{federation_registry_git.clone_dest}}/{{federation_registry_react_folder}}/src/config.json" - backup: yes - - - name: Configure express db_config - template: - src: db_config.j2 - dest: "{{federation_registry_express_path}}/db-config/db-config.json" - backup: yes - - - name: Copy Tenant Configuration - copy: - src: "{{ inventory_dir }}/files/config.json" - dest: "{{federation_registry_express_path}}/JavaScript/config.json" - force: yes - owner: root - mode: 0664 - backup: true - - - name: Agent env - template: - src: ams-env.j2 - dest: "{{federation_registry_ams_agent_path}}/.env" - backup: yes - - - name: Agent config - template: - src: ams_authorized_users.j2 - dest: "{{federation_registry_ams_agent_path}}/config.json" - backup: yes - - - name: delete existing pm2 processes if running - command: "pm2 delete all" - ignore_errors: True - - - name: Create pm2 ecosystem - template: - src: pm2_config.j2 - dest: "{{federation_registry_pm2_conf_path}}/ecosystem.config.js" - backup: yes - - - name: react build - shell: "npm run build" - args: - chdir: "{{federation_registry_git.clone_dest}}/{{federation_registry_react_folder}}" - executable: /bin/bash - - - name: Creates federation directory - file: - path: "{{federation_registry_git.clone_dest}}/{{federation_registry_react_folder}}{{federation_registry_react_base_url}}" - state: directory - when: federation_registry_react_base_url != "/" - - - name: Move files from build folder to base folder - shell: mv {{federation_registry_git.clone_dest}}/{{federation_registry_react_folder}}/build/* {{federation_registry_git.clone_dest}}/{{federation_registry_react_folder}}{{federation_registry_react_base_url}} - when: federation_registry_react_base_url != "/" - - - name: Move base folder inside build folder - shell: mv {{federation_registry_git.clone_dest}}/{{federation_registry_react_folder}}{{federation_registry_react_base_url}} {{federation_registry_project_path}}/{{federation_registry_react_folder}}{{federation_registry_react_base_url}} - when: federation_registry_react_base_url != "/" - - - name: Move base folder inside build folder - shell: mv {{federation_registry_git.clone_dest}}/{{federation_registry_react_folder}}/build/* {{federation_registry_project_path}}/{{federation_registry_react_folder}} - when: federation_registry_react_base_url == "/" - - - name: Express env - template: - src: express-env.j2 - dest: "{{federation_registry_express_path}}/JavaScript/.env" - backup: yes - - - name: start Pm2 processes - command: "pm2 start ecosystem.config.js" - - - name: restart Pm2 processes - command: "pm2 restart all" - - - debug: - msg: ams_is_verif - - - name: Verify push endpoint if not verified - run_once: true - uri: - url: "{{ federation_registry_ams.host }}/projects/{{ federation_registry_ams.project }}/subscriptions/{{ federation_registry_ams.sub }}:verifyPushEndpoint?key={{ federation_registry_ams.admin_token }}" - method: POST - return_content: yes - headers: - Content-Type: "application/json" - body_format: json - when: - - "not ams_is_verif" +- name: Check if project exists + ansible.builtin.stat: + path: "{{ federation_registry_git.clone_dest }}" + register: project_stat + +- name: Clean clone directory + ansible.builtin.file: + state: absent + path: "{{ federation_registry_git.clone_dest }}" + when: project_stat.stat.exists + +- name: Clean Frontend Folder + ansible.builtin.file: + state: absent + path: "{{ federation_registry_project_path }}/{{ federation_registry_react_folder }}" + ignore_errors: false + +- name: Clean Backend Folder + ansible.builtin.file: + state: absent + path: "{{ federation_registry_project_path }}/{{ federation_registry_express_folder }}" + ignore_errors: false + +- name: Clean Ams Agent Folder + ansible.builtin.file: + state: absent + path: "{{ federation_registry_project_path }}/{{ federation_registry_ams_agent_folder }}" + ignore_errors: false + +- name: Clone the repository + ansible.builtin.git: + repo: "{{ federation_registry_git.git_repo }}" + version: "{{ federation_registry_git.git_branch }}" + dest: "{{ federation_registry_git.clone_dest }}" + force: true + +- name: Move things to /var/www + ansible.builtin.shell: |- + "mv {{ federation_registry_git.clone_dest }}/{{ item }} \ + {{ federation_registry_project_path }}" + loop: + - "{{ federation_registry_express_folder }}" + - "{{ federation_registry_ams_agent_folder }}" + - swagger.json + +# Refactored by task above +# - name: Move Federation Backend to /var/www # noqa command-instead-of-shell no-changed-when +# ansible.builtin.shell: "mv {{ federation_registry_git.clone_dest }}/{{ federation_registry_express_folder }} {{ federation_registry_project_path }}" +# changed_when: false + +# - name: Move Ams Agent to /var/www # noqa command-instead-of-shell no-changed-when +# ansible.builtin.shell: "mv {{ federation_registry_git.clone_dest }}/{{ federation_registry_ams_agent_folder }} {{ federation_registry_project_path }}" +# changed_when: false + +# - name: Move Swagger File to /var/www # noqa command-instead-of-shell no-changed-when +# ansible.builtin.shell: "mv {{ federation_registry_git.clone_dest }}/swagger.json {{ federation_registry_project_path }}" + +- name: Create React Folder + ansible.bultin.file: + dest: "{{ federation_registry_project_path }}/{{ federation_registry_react_folder }}" + state: directory + mode: "0755" + +- name: Load package.json contents to package variable + ansible.builtin.slurp: + src: "{{ federation_registry_git.clone_dest }}/{{ federation_registry_react_folder }}/package.json" + register: imported_var + +- name: Append homepage value to package variable + ansible.builtin.set_fact: + imported_var: "{{ imported_var.content | b64decode | from_json | default([]) | combine({'homepage': federation_registry_react_base_url}) }}" + +- name: Write package variable to package.json + ansible.builtin.copy: + content: "{{ imported_var | to_nice_json }}" + dest: "{{ federation_registry_git.clone_dest }}/{{ federation_registry_react_folder }}/package.json" + mode: "0644" + +- name: Install node modules for react + community.general.npm: + path: "{{ federation_registry_git.clone_dest }}/{{ federation_registry_react_folder }}" + +- name: Install node modules for express + community.general.npm: + path: "{{ federation_registry_express_path }}" + +- name: Install node modules for ams-agent + community.general.npm: + path: "{{ federation_registry_ams_agent_path }}" + +- name: React config + ansible.builtin.template: + src: react-config.j2 + dest: "{{ federation_registry_git.clone_dest }}/{{ federation_registry_react_folder }}/src/config.json" + backup: true + mode: "0644" + +- name: Configure express db_config + ansible.builtin.template: + src: db_config.j2 + dest: "{{ federation_registry_express_path }}/db-config/db-config.json" + backup: true + mode: "0644" + +- name: Copy Tenant Configuration + ansible.builtin.copy: + src: "{{ inventory_dir }}/files/config.json" + dest: "{{ federation_registry_express_path }}/JavaScript/config.json" + force: true + owner: root + mode: "0664" + backup: true + +- name: Agent env + ansible.builtin.template: + src: ams-env.j2 + dest: "{{ federation_registry_ams_agent_path }}/.env" + backup: true + mode: "0600" + +- name: Agent config + ansible.builtin.template: + src: ams_authorized_users.j2 + dest: "{{ federation_registry_ams_agent_path }}/config.json" + backup: true + mode: "0644" + +- name: Delete existing pm2 processes if running + ansible.builtin.command: "pm2 delete all" + changed_when: false + +- name: Create pm2 ecosystem + ansible.builtin.template: + src: pm2_config.j2 + dest: "{{ federation_registry_pm2_conf_path }}/ecosystem.config.js" + backup: true + mode: "0644" + +- name: React build + ansible.builtin.shell: "npm run build" + args: + chdir: "{{ federation_registry_git.clone_dest }}/{{ federation_registry_react_folder }}" + executable: /bin/bash + changed_when: false + +- name: Creates federation directory + ansible.builtin.file: + path: "{{ federation_registry_git.clone_dest }}/{{ federation_registry_react_folder }}{{ federation_registry_react_base_url }}" + state: directory + mode: "0644" + when: federation_registry_react_base_url != "/" + +# this should be a loop +- name: Move files from build folder to base folder + ansible.builtin.shell: >- + mv {{ federation_registry_git.clone_dest }}/{{ federation_registry_react_folder }}/build/* + {{ federation_registry_git.clone_dest }}/ + {{ federation_registry_react_folder }}{{ federation_registry_react_base_url }} + when: federation_registry_react_base_url != "/" + changed_when: false + +- name: Move base folder inside build folder # noqa command-instead-of-shell + ansible.builtin.shell: >- + mv {{ federation_registry_git.clone_dest }}/ + {{ federation_registry_react_folder }}{{ federation_registry_react_base_url }} + {{ federation_registry_project_path }}/\ + {{ federation_registry_react_folder }}{{ federation_registry_react_base_url }} + when: federation_registry_react_base_url != "/" + changed_when: false + +- name: Move base folder inside build folder + ansible.builtin.shell: >- + mv {{ federation_registry_git.clone_dest }}/{{ federation_registry_react_folder }}/build/* + {{ federation_registry_project_path }}/{{ federation_registry_react_folder }} + when: federation_registry_react_base_url == "/" + changed_when: false + +- name: Template Express env + ansible.builtin.template: + src: express-env.j2 + dest: "{{ federation_registry_express_path }}/JavaScript/.env" + backup: true + mode: "0644" + +- name: Start Pm2 processes + ansible.builtin.command: "pm2 start ecosystem.config.js" + changed_when: false + +- name: Restart Pm2 processes + ansible.builtin.command: "pm2 restart all" + changed_when: false + +- name: Debug + ansible.builtin.debug: + msg: ams_is_verif + +- name: Verify push endpoint if not verified + run_once: true + ansible.builtin.uri: + url: >- + "{{ federation_registry_ams.host }}/projects/ + {{ federation_registry_ams.project }}/subscriptions/{{ federation_registry_ams.sub }}:verifyPushEndpoint?key={{ federation_registry_ams.admin_token }}" + method: POST + return_content: true + headers: + Content-Type: "application/json" + body_format: json + when: + - "not ams_is_verif" diff --git a/roles/federation-registry/tasks/main.yml b/roles/federation-registry/tasks/main.yml index f6ed3892..1d11bffb 100644 --- a/roles/federation-registry/tasks/main.yml +++ b/roles/federation-registry/tasks/main.yml @@ -1,3 +1,5 @@ --- - - include: "{{task}}.yml" - become: yes +# this has got to be the weirdest way I've seen tasks included. +- name: "Include {{ task }}" + ansible.builtin.include_tasks: "{{ task }}.yml" + # become: true diff --git a/roles/federation-registry/tasks/postgres.yml b/roles/federation-registry/tasks/postgres.yml index 654efc7f..993204c4 100644 --- a/roles/federation-registry/tasks/postgres.yml +++ b/roles/federation-registry/tasks/postgres.yml @@ -1,46 +1,49 @@ --- - name: Make sure psycopg2 is installed - command: pip install psycopg2==2.7.5 --ignore-installed + ansible.builtin.pip: + name: psycopg2 + version: 2.7.5 run_once: true - name: Send Create Tables SQL File - copy: + ansible.builtin.copy: src: create_tables.sql - dest: "{{rciam_dbs.federation.script_path}}" + dest: "{{ rciam_dbs.federation.script_path }}" + mode: "0644" run_once: true - name: Create PostgreSQL tables for Federation Registry via SQL scripts run_once: true - postgresql_query: + community.postgresql.postgresql_script: db: "{{ rciam_dbs.federation.name }}" login_user: "{{ rciam_dbs.federation.owner_username }}" login_password: "{{ rciam_dbs.federation.owner_password }}" - path_to_script: "{{ rciam_dbs.federation.script_path }}" + path: "{{ rciam_dbs.federation.script_path }}" login_host: "{{ rciam_dbs.federation.host }}" register: postgresql_result failed_when: "postgresql_result is failed and 'already exists' not in postgresql_result.msg" - name: Send Tenant Initialization Data run_once: true - copy: - src: private_files/{{federation_registry_init_script}} - dest: "{{rciam_dbs.federation.script_path}}" + ansible.builtin.copy: + src: private_files/{{ federation_registry_init_script }} + dest: "{{ rciam_dbs.federation.script_path }}" + mode: "0644" - name: Initialise Tenant Data via SQL scripts run_once: true - postgresql_query: + community.postgresql.postgresql_script: db: "{{ rciam_dbs.federation.name }}" login_user: "{{ rciam_dbs.federation.owner_username }}" login_password: "{{ rciam_dbs.federation.owner_password }}" - path_to_script: "{{ rciam_dbs.federation.script_path }}" - login_host: "{{ rciam_dbs.federation.host }}" - path_to_script: "{{rciam_dbs.federation.script_path}}" login_host: "{{ rciam_dbs.federation.host }}" + path: "{{ rciam_dbs.federation.script_path }}" register: postgresql_result failed_when: "postgresql_result is failed and 'already exists' not in postgresql_result.msg" - name: Delete database configuration file run_once: true - file: - path: "{{rciam_dbs.federation.script_path}}" + ansible.builtin.file: + path: "{{ rciam_dbs.federation.script_path }}" state: absent + mode: "0644" diff --git a/roles/federation-registry/templates/ams_authorized_users.j2 b/roles/federation-registry/templates/ams_authorized_users.j2 index 0b51eb1a..3e8b5cd4 100644 --- a/roles/federation-registry/templates/ams_authorized_users.j2 +++ b/roles/federation-registry/templates/ams_authorized_users.j2 @@ -1,7 +1,7 @@ { "authorized_users": [ {% for user in federation_registry_ams.authorized_users %} - "{{ user.username }}" {% if federation_registry_ams.authorized_users|length != loop.index %} , {% endif %} + "{{ user.username }}" {% if federation_registry_ams.authorized_users|length != loop.index %} , {% endif %} {% endfor %} ] } diff --git a/roles/federation-registry/templates/react-config.j2 b/roles/federation-registry/templates/react-config.j2 index d15dd50f..dc4a790b 100644 --- a/roles/federation-registry/templates/react-config.j2 +++ b/roles/federation-registry/templates/react-config.j2 @@ -1,7 +1,7 @@ { "host": { {% for tenant in federation_registry_tenant_config %} - "{{ tenant.name }}":"{{tenant.backend_uri}}" {% if federation_registry_tenant_config|length != loop.index %} , {% endif %} + "{{ tenant.name }}":"{{tenant.backend_uri}}" {% if federation_registry_tenant_config|length != loop.index %} , {% endif %} {% endfor %} }, "basename": "{{federation_registry_react_base_url}}" diff --git a/roles/fedreg-agent/defaults/main.yml b/roles/fedreg-agent/defaults/main.yml index 743735cc..cca18a98 100644 --- a/roles/fedreg-agent/defaults/main.yml +++ b/roles/fedreg-agent/defaults/main.yml @@ -17,9 +17,9 @@ fedreg_agent_registry_requirements_url: "https://raw.githubusercontent.com/rciam # Service fedreg_agent_services_path: /etc/systemd/system fedreg_agent_log_conf: "{{ fedreg_agent_conf_dir }}/logger.conf" -fedreg_agent_enable_ssp: no -fedreg_agent_enable_mitreid: no -fedreg_agent_enable_keycloak: no +fedreg_agent_enable_ssp: false +fedreg_agent_enable_mitreid: false +fedreg_agent_enable_keycloak: false ## Federation registry agent parameters # fedreg_agent_ams: diff --git a/roles/fedreg-agent/handlers/main.yml b/roles/fedreg-agent/handlers/main.yml index ae97cc84..f0fcd77b 100644 --- a/roles/fedreg-agent/handlers/main.yml +++ b/roles/fedreg-agent/handlers/main.yml @@ -1,2 +1,10 @@ --- # handlers file for fedreg-agent +- name: Reload systemd + ansible.builtin.systemd: + daemon_reload: true + become: true + tags: + - agent + - service + - daemon-reload diff --git a/roles/fedreg-agent/tasks/configure-common.yml b/roles/fedreg-agent/tasks/configure-common.yml index 3f21bb87..841dbdd4 100644 --- a/roles/fedreg-agent/tasks/configure-common.yml +++ b/roles/fedreg-agent/tasks/configure-common.yml @@ -1,35 +1,34 @@ --- # tasks file for fedreg-agent - - name: Install basic common utils - package: + ansible.builtin.package: name: "{{ item }}" - state: latest + state: preset loop: - git - python3-pip - become: yes + become: true tags: - agent - basic_common_utils - name: Upgrade pip3 - pip: + ansible.builtin.pip: name: pip - state: latest + state: present extra_args: --upgrade --user executable: pip3 - become: yes + become: true tags: - agent - python - name: Install Virtualenv via pip3 - pip: + ansible.builtin.pip: name: virtualenv - state: latest + state: present executable: pip3 - become: yes + become: true tags: - agent - python diff --git a/roles/fedreg-agent/tasks/deploy.yml b/roles/fedreg-agent/tasks/deploy.yml index c7469cb7..d2af24f0 100644 --- a/roles/fedreg-agent/tasks/deploy.yml +++ b/roles/fedreg-agent/tasks/deploy.yml @@ -1,70 +1,73 @@ --- # tasks file for fedreg-agent - - name: Download only the requirements.txt from rciam-federation-registry-agent repository - get_url: + ansible.builtin.get_url: url: "{{ fedreg_agent_registry_requirements_url }}" dest: /tmp/requirements_{{ build_branch }}.txt - become: yes + mode: "0644" + become: true tags: - agent - python - requirements - name: Install python requirements - pip: + ansible.builtin.pip: requirements: /tmp/requirements_{{ build_branch }}.txt virtualenv: "{{ fedreg_agent_venv_path }}" virtualenv_python: "{{ fedreg_agent_venv_python }}" - become: yes + become: true tags: - agent - python - requirements +# This should be packaged as a release instead of a branch - name: Install rciam-federation-registry-agent (test.pypi.org) when: build_branch == "devel" - pip: + ansible.builtin.pip: name: rciam-federation-registry-agent virtualenv: "{{ fedreg_agent_venv_path }}" virtualenv_python: "{{ fedreg_agent_venv_python }}" extra_args: -i https://test.pypi.org/simple/ - state: latest - become: yes + state: present + become: true tags: - agent - python - requirements +# This should be packaged as a release instead of a branch - name: Install rciam-federation-registry-agent when: build_branch == "master" - pip: + ansible.builtin.pip: name: rciam-federation-registry-agent virtualenv: "{{ fedreg_agent_venv_path }}" virtualenv_python: "{{ fedreg_agent_venv_python }}" - state: latest - become: yes + state: present + become: true tags: - - agent - - python - - requirements - + - agent + - python + - requirements -- name: "Ensure {{ fedreg_agent_conf_dir }} dir exists" - file: +- name: "Ensure dir exists: {{ fedreg_agent_conf_dir }}" + ansible.builtin.file: path: "{{ fedreg_agent_conf_dir }}" state: directory - become: yes + mode: "0755" + become: true tags: - agent - config - name: Copy logger.conf file - copy: + ansible.builtin.copy: src: logger.conf dest: "{{ fedreg_agent_conf_dir }}/logger.conf" - force: no - become: yes + force: false + mode: "0644" + become: true tags: - agent - config diff --git a/roles/fedreg-agent/tasks/main.yml b/roles/fedreg-agent/tasks/main.yml index 7d351e77..7bd93b88 100644 --- a/roles/fedreg-agent/tasks/main.yml +++ b/roles/fedreg-agent/tasks/main.yml @@ -1,12 +1,10 @@ --- # tasks file for fedreg-agent - - name: Configuration tasks - include: "configure-common.yml" + ansible.builtin.include_tasks: "configure-common.yml" - name: Deploy tasks - include: "deploy.yml" + ansible.builtin.include_tasks: "deploy.yml" - name: Setup services - include: "services.yml" - + ansible.builtin.include_tasks: "services.yml" diff --git a/roles/fedreg-agent/tasks/services.yml b/roles/fedreg-agent/tasks/services.yml index e9cee049..597d9bc2 100644 --- a/roles/fedreg-agent/tasks/services.yml +++ b/roles/fedreg-agent/tasks/services.yml @@ -1,91 +1,90 @@ - name: Create deployer configuration file - template: + ansible.builtin.template: src: deployers.config.json.j2 dest: "{{ fedreg_agent_conf_dir }}/{{ deployers_config_name }}" - backup: yes + backup: true + mode: "0644" when: fedreg_agent_enable_ssp or fedreg_agent_enable_mitreid or fedreg_agent_enable_keycloak - become: yes + become: true tags: - agent - config + notify: Reload systemd - name: Create MITREid deployer service file - template: + ansible.builtin.template: src: deployer_mitreid.service.j2 dest: "{{ fedreg_agent_services_path }}/{{ deployer_mitreid_name }}.service" - backup: yes + backup: true + mode: "0644" register: mitreid_service when: fedreg_agent_enable_mitreid - become: yes + become: true tags: - agent - service + notify: Reload systemd - name: Create Keycloak deployer service file - template: + ansible.builtin.template: src: deployer_keycloak.service.j2 dest: "{{ fedreg_agent_services_path }}/{{ deployer_keycloak_name }}.service" - backup: yes + backup: true + mode: "0644" register: keycloak_service when: fedreg_agent_enable_keycloak - become: yes + become: true tags: - agent - service + notify: Reload systemd - name: Create SSP deployer service file - template: + ansible.builtin.template: src: deployer_ssp.service.j2 dest: "{{ fedreg_agent_services_path }}/{{ deployer_ssp_name }}.service" - backup: yes + backup: true + mode: "0644" register: ssp_service when: fedreg_agent_enable_ssp - become: yes + become: true tags: - agent - service - -- name: Reload systemd - command: systemctl daemon-reload - when: mitreid_service.changed or ssp_service.changed or keycloak_service.changed - become: yes - tags: - - agent - - service - - daemon-reload + notify: Reload systemd - name: MitreId federation registry service enable - service: + ansible.builtin.service: name: '{{ deployer_mitreid_name }}' - enabled: yes + enabled: true state: restarted when: fedreg_agent_enable_mitreid - become: yes + become: true tags: - agent - service - service_enable - name: Keycloak deployer service enable - service: + ansible.builtin.service: name: '{{ deployer_keycloak_name }}' - enabled: yes + enabled: true state: restarted when: fedreg_agent_enable_keycloak - become: yes + become: true tags: - agent - service - service_enable - name: SSP federation registry service enable - service: + ansible.builtin.service: name: '{{ deployer_ssp_name }}' - enabled: yes + enabled: true state: restarted when: fedreg_agent_enable_ssp - become: yes + become: true tags: - agent - service diff --git a/roles/git/tasks/install-Debian.yml b/roles/git/tasks/install-Debian.yml index fed08aa7..442bf7d4 100644 --- a/roles/git/tasks/install-Debian.yml +++ b/roles/git/tasks/install-Debian.yml @@ -1,9 +1,14 @@ --- - +# git/tasks/install-Debian.yml - name: Update package cache (Debian) - apt: update_cache=yes cache_valid_time=86400 - become: yes + ansible.builtin.apt: + update_cache: true + cache_valid_time: 86400 + become: true - name: Ensure latest Git is installed (Debian) - apt: name=git state=present install_recommends=no - become: yes + ansible.builtin.apt: + name: git + state: present + install_recommends: false + become: true diff --git a/roles/git/tasks/main.yml b/roles/git/tasks/main.yml index e6daa2e5..c2640203 100644 --- a/roles/git/tasks/main.yml +++ b/roles/git/tasks/main.yml @@ -1,7 +1,7 @@ --- - -# Install OS-specific packages -- include: install-Debian.yml +# git/tasks/main.yml +- name: Install OS-specific packages + ansible.builtin.include_tasks: install-Debian.yml when: ansible_os_family == 'Debian' -#- include: install-CentOS.yml -# when: ansible_os_family == 'CentOS' +# - include: install-CentOS.yml +# when: ansible_os_family == 'CentOS' diff --git a/roles/jq/tasks/install-Debian.yml b/roles/jq/tasks/install-Debian.yml index a9f22b4a..71887eb2 100644 --- a/roles/jq/tasks/install-Debian.yml +++ b/roles/jq/tasks/install-Debian.yml @@ -1,11 +1,15 @@ --- - - name: Update package cache (Debian) - apt: update_cache=yes cache_valid_time=86400 - become: yes + ansible.builtin.apt: + update_cache: true + cache_valid_time: 86400 + become: true - name: Ensure jq is installed (Debian) - apt: name={{ item }} state=present install_recommends=no + ansible.builtin.apt: + name: "{{ item }}" + state: present + install_recommends: false with_items: - - jq - become: yes + - jq # TODO - define in defaults + become: true diff --git a/roles/jq/tasks/main.yml b/roles/jq/tasks/main.yml index e6daa2e5..0755941b 100644 --- a/roles/jq/tasks/main.yml +++ b/roles/jq/tasks/main.yml @@ -1,7 +1,6 @@ --- - -# Install OS-specific packages -- include: install-Debian.yml +- name: Install OS-specific packages + ansible.builtin.include_tasks: install-Debian.yml when: ansible_os_family == 'Debian' -#- include: install-CentOS.yml +# - include: install-CentOS.yml # when: ansible_os_family == 'CentOS' diff --git a/roles/keycloak/defaults/main.yml b/roles/keycloak/defaults/main.yml index 8623c77e..044761a8 100644 --- a/roles/keycloak/defaults/main.yml +++ b/roles/keycloak/defaults/main.yml @@ -1,5 +1,5 @@ --- -##in format X.Y.Z +## in format X.Y.Z ## make sure the corresponding templates/X.Y.Z folder and vars/keycloak/X.Y.Z.yml exist keycloak_version: "18.0.0" @@ -8,12 +8,13 @@ keycloak_archive_url: "https://github.com/keycloak/keycloak/releases/download/{{ keycloak_service_user: "keycloak" -# Extra run params used in the keycloak systemd service. Multiple `-D` params can be specified. E.g. uncomment the following to enable technology preview features -#keycloak_extra_run_params: "-Dkeycloak.profile=preview" +# Extra run params used in the keycloak systemd service. +# Multiple `-D` params can be specified. +# E.g. uncomment the following to enable technology preview features +# keycloak_extra_run_params: "-Dkeycloak.profile=preview" keycloak_base_url_path: "auth" # The base URL path for frontend and backend requests. Note that this cannot be empty. - keycloak_admin: user: "" pass: "" @@ -38,15 +39,15 @@ keycloak_syslog_identifier: "keycloak" keycloak_logs_folder: "/var/log/keycloak" -keycloak_logs_max_days: 548 # that's ~18 months +keycloak_logs_max_days: 548 # that's ~18 months keycloak_log_level: saml: INFO keycloak_keystores: "/srv/keycloak-keys" -# If the server should expose health check endpoints. Defaults to false -keycloak_health_enabled: no +# If the server should expose health check endpoints. Defaults to false +keycloak_health_enabled: false # Themes to apply to all realms defined under 'keycloak_config.realms'. # You can override theme settings for specific realms by defining @@ -54,11 +55,10 @@ keycloak_health_enabled: no keycloak_themes: login: "rciam" account: "rciam" - #email: "keycloak" # Uncomment and customise if necessary - + # email: "keycloak" # Uncomment and customise if necessary ### plugins ### wayf plugin works ONLY with "stage" branch of keycloak (need to have commit fe055820980dbcb79d5aae2b4dce78b840b912b0) -#keycloak_plugins: +# keycloak_plugins: # wayf: # enabled: true # name: "keycloak-theme-vanilla" #PLEASE, do not change this @@ -106,7 +106,7 @@ keycloak_themes: ### Remaining configuration (enc keys, social IdPs, AUP config, SMTP config, etc) ### you can have more than one realms configured here (if it doesn't exist, it will be created). just copy the format of the master and add it in the list. ### also, you can just comment out any of the {key, aup, smtp} sub trees and let the remaining get configured -#keycloak_config: +# keycloak_config: # realms: # - name: master # defaultIdPAlias: "" #setting this to an IdP's name, will skip the WAYF and redirect to that IdP @@ -142,8 +142,11 @@ keycloak_themes: # eventsExpiration: 47347200 # this is 548 days in seconds # adminEventsDetailsEnabled: false # adminEventsEnabled: true -# eventsListeners: ["jboss-logging"] # optional. if you want you can override with the array with the desired ones. Add "metrics-communication" for metrics plugin -# enabledEventTypes: ["UPDATE_CONSENT_ERROR", "SEND_RESET_PASSWORD", "GRANT_CONSENT",…] # optional. if you want you can override with the array with the desired ones +# eventsListeners: ["jboss-logging"] +# optional. if you want you can override with the array with the desired ones. +# Add "metrics-communication" for metrics plugin +# enabledEventTypes: ["UPDATE_CONSENT_ERROR", "SEND_RESET_PASSWORD", "GRANT_CONSENT",…] +# optional. if you want you can override with the array with the desired ones # client_registration_policies: # create_update: # - name: "Allowed Client Scopes" @@ -189,11 +192,17 @@ keycloak_themes: # - "manage-account-2fa" # remove: # - "view-profile" -# # For key rotation: whenever you need to rotate keys, this should normally be done as follows: -# # Step 1: You need to add new keypairs, so you need to have both the new and the previous keys (4 keypairs) active in the realm. So you rename the placeholders "current" keys (in vault and in this file) as "previous", and you add two new keypairs (sig and enc) which will get the "current" linking in the vault. -# # Step 2: Transition period is over, so you just mark the "previous" keys as (enabled: false) and (active: false). This means that the keys exist in the realm, but they are never used. -# # Step 3: Rotation day has come, so you need to add new keys, thus, perform step 1. -# keys: ### if the (providerId,name) entry already exists in the realm, ansible updates it. If not, it creates the key. So, in any subsequent run, it updates all the config parameters of the key. +# For key rotation: whenever you need to rotate keys, this should normally be done as follows: +# Step 1: You need to add new keypairs, so you need to have both the new and the previous keys (4 keypairs) active in the realm. +# So you rename the placeholders "current" keys (in vault and in this file) as "previous", +# and you add two new keypairs (sig and enc) which will get the "current" linking in the vault. +# Step 2: Transition period is over, so you just mark the "previous" keys as (enabled: false) and (active: false). +# This means that the keys exist in the realm, but they are never used. +# Step 3: Rotation day has come, so you need to add new keys, thus, perform step 1. +# keys: +### if the (providerId,name) entry already exists in the realm, ansible updates it. +# If not, it creates the key. +# So, in any subsequent run, it updates all the config parameters of the key. # - name: "rsa-sig" # providerId: "rsa" #DO NOT CHANGE THIS # config: @@ -722,7 +731,8 @@ keycloak_themes: # disableUserInfo: "" #boolean # hideOnLoginPage: "" #boolean # promotedLoginbutton: "" #boolean -# #Each entry of idp_mappers list is a IdentityProviderMapperRepresentation, see here: https://www.keycloak.org/docs-api/15.0/rest-api/index.html#_identityprovidermapperrepresentation +# Each entry of idp_mappers list is a IdentityProviderMapperRepresentation, +# see here: https://www.keycloak.org/docs-api/15.0/rest-api/index.html#_identityprovidermapperrepresentation # idp_mappers: # - name: # identityProviderAlias: diff --git a/roles/keycloak/handlers/main.yml b/roles/keycloak/handlers/main.yml index dd80e343..6fe04eee 100644 --- a/roles/keycloak/handlers/main.yml +++ b/roles/keycloak/handlers/main.yml @@ -1,32 +1,31 @@ --- - - name: Start keycloak - systemd: + ansible.builtin.systemd: name: keycloak state: started - become: yes + become: true - name: Stop keycloak - systemd: + ansible.builtin.systemd: name: keycloak state: stopped - become: yes + become: true - name: Restart keycloak - systemd: + ansible.builtin.systemd: name: keycloak state: restarted - become: yes + become: true - name: Reload keycloak - systemd: + ansible.builtin.systemd: name: keycloak state: restarted - daemon_reload: yes - become: yes + daemon_reload: true + become: true - name: Clear Keycloak cache ansible.builtin.file: path: "{{ keycloak_home }}/data/tmp/" state: absent - become: yes \ No newline at end of file + become: true diff --git a/roles/keycloak/tasks/blocks/client_registration_policies/create_update_client_reg_policy.yml b/roles/keycloak/tasks/blocks/client_registration_policies/create_update_client_reg_policy.yml index 13975e52..aafd4aa7 100644 --- a/roles/keycloak/tasks/blocks/client_registration_policies/create_update_client_reg_policy.yml +++ b/roles/keycloak/tasks/blocks/client_registration_policies/create_update_client_reg_policy.yml @@ -4,27 +4,50 @@ # current_cli_reg_pol = the current client registration policy (loop item) of the config # found_cli_reg_pols = all the found client registration policies found on the server for the current_realm -- set_fact: +- name: Set reg pool match fact + ansible.builtin.set_fact: cli_reg_pol_match: "{{ found_cli_reg_pols | json_query(query) | first | default({}) }}" vars: - query: '[? (name == `{{ current_cli_reg_pol.name }}` && providerId == `{{ current_cli_reg_pol.providerId }}` && subType == `{{ current_cli_reg_pol.subType }}`) ]' + query: >- + '[? (name == `{{ current_cli_reg_pol.name }}` && + providerId == `{{ current_cli_reg_pol.providerId }}` && + subType == `{{ current_cli_reg_pol.subType }}`) + ]' -- set_fact: +- name: Set reg pool found fact + ansible.builtin.set_fact: cli_reg_pol_isfound: "{{ lookup('dict', cli_reg_pol_match) | length > 0 }}" -- name: "{% if cli_reg_pol_isfound %} Update {% else %} Create {% endif %}client registration policy {{ current_cli_reg_pol.name }} on realm {{ current_realm.name }}" - uri: - url: "{{ keycloak_proxy_host }}/admin/realms/{{ current_realm.name }}/components{% if cli_reg_pol_isfound %}/{{ cli_reg_pol_match.id }}{% endif %}" - method: "{% if cli_reg_pol_isfound %}PUT{% else %}POST{% endif %}" +# This task is very difficult to understand and maintain. +# Propose specific tasks based on the cli_reg_pol_isfound variable +- name: "Update client registration policy {{ current_cli_reg_pol.name }} on realm {{ current_realm.name }}" # noqa name[template] + ansible.builtin.uri: + url: "{{ keycloak_proxy_host }}/admin/realms/{{ current_realm.name }}/components/{{ cli_reg_pol_match.id }}" + method: PUT body_format: json headers: Authorization: "Bearer {{ tokens.json.access_token }}" - body: # if found a match, fuse the existing with the match and overwrite (care, need to append the provided configuration on the existing/found one... not the opposite) - "{%if cli_reg_pol_isfound %}{{ cli_reg_pol_match | combine(current_cli_reg_pol , recursive=True ) }}{% else %}{{ current_cli_reg_pol | combine(realm_parentId , recursive=True ) }}{% endif %}" - status_code: "{% if cli_reg_pol_isfound %}204{% else %}201{% endif %}" + # if found a match, fuse the existing with the match and overwrite + # (care, need to append the provided configuration on the existing/found one... not the opposite) + body: "{{ cli_reg_pol_match | combine(current_cli_reg_pol, recursive=True) }}" + status_code: 204 vars: - realm_parentId: - parentId: "{{ current_realm.name }}" - - + realm_parentId: # noqa var-naming[pattern] + parentId: "{{ current_realm.name }}" # noqa var-naming[pattern] + when: cli_reg_pol_isfound +- name: "Create client registration policy {{ current_cli_reg_pol.name }} on realm {{ current_realm.name }}" # noqa name[template] + ansible.builtin.uri: + url: "{{ keycloak_proxy_host }}/admin/realms/{{ current_realm.name }}/components" + method: POST + body_format: json + headers: + Authorization: "Bearer {{ tokens.json.access_token }}" + # if found a match, fuse the existing with the match and overwrite + # (care, need to append the provided configuration on the existing/found one... not the opposite) + body: "{{ current_cli_reg_pol | combine(realm_parentId, recursive=True) }}" + status_code: 201 + vars: + realm_parentId: # noqa var-naming[pattern] + parentId: "{{ current_realm.name }}" # noqa var-naming[pattern] + when: not cli_reg_pol_isfound diff --git a/roles/keycloak/tasks/blocks/client_registration_policies/delete_client_reg_policy.yml b/roles/keycloak/tasks/blocks/client_registration_policies/delete_client_reg_policy.yml index ab8737a5..db1971df 100644 --- a/roles/keycloak/tasks/blocks/client_registration_policies/delete_client_reg_policy.yml +++ b/roles/keycloak/tasks/blocks/client_registration_policies/delete_client_reg_policy.yml @@ -3,23 +3,27 @@ # current_realm = the current realm (loop item) of the config # del_cli_reg_policy = the current client registration policy (loop item) of the config # found_cli_reg_pols = all the found client registration policies found on the server for the current_realm - - -- set_fact: +- name: Set cli_reg_pol_match fact + ansible.builtin.set_fact: cli_reg_pol_match: "{{ found_cli_reg_pols | json_query(query) | first | default({}) }}" vars: - query: '[? (name == `{{ del_cli_reg_policy.name }}` && providerId == `{{ del_cli_reg_policy.providerId }}` && subType == `{{ del_cli_reg_policy.subType }}`) ]' + query: >- + '[? + (name == `{{ del_cli_reg_policy.name }}` && + providerId == `{{ del_cli_reg_policy.providerId }}` && + subType == `{{ del_cli_reg_policy.subType }}`) ]' -- set_fact: +- name: Set cli_reg_pol_isfound fact + ansible.builtin.set_fact: cli_reg_pol_isfound: "{{ lookup('dict', cli_reg_pol_match) | length > 0 }}" -- name: "Delete client registration policy {{ del_cli_reg_policy.name }} with type {{ del_cli_reg_policy.subtype }} of realm {{ current_realm.name }}" - uri: +- name: Delete client registration policy + # {{ del_cli_reg_policy.name }} with type {{ del_cli_reg_policy.subtype }} of realm {{ current_realm.name }}" + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ current_realm.name }}/components/{{ cli_reg_pol_match.id }}" - method: "DELETE" + method: DELETE body_format: json headers: Authorization: "Bearer {{ tokens.json.access_token }}" - status_code: "204" + status_code: 204 when: cli_reg_pol_isfound - diff --git a/roles/keycloak/tasks/blocks/configure_basic_realm.yml b/roles/keycloak/tasks/blocks/configure_basic_realm.yml index dcfda8e5..b7dd7898 100644 --- a/roles/keycloak/tasks/blocks/configure_basic_realm.yml +++ b/roles/keycloak/tasks/blocks/configure_basic_realm.yml @@ -1,10 +1,9 @@ --- - - name: Acquire tokens - include_tasks: blocks/helpers/get_tokens.yml + ansible.builtin.include_tasks: blocks/helpers/get_tokens.yml -- name: "Check if realm {{ current_realm_item.name }} already exists" - uri: +- name: "Check if realm already exists: {{ current_realm_item.name }}" + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ current_realm_item.name }}" method: GET headers: @@ -12,11 +11,12 @@ status_code: [200, 404] register: "current_realm_search_result" -- set_fact: +- name: Set current_realm_exists fact + ansible.builtin.set_fact: current_realm_exists: "{% if current_realm_search_result.status == 200 %}true{% else %}false{% endif %}" - name: "Initialize realm '{{ current_realm_item.name }}'" - uri: + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms" method: POST body_format: json @@ -27,11 +27,10 @@ id: "{{ current_realm_item.name }}" realm: "{{ current_realm_item.name }}" status_code: 201 - when: current_realm_exists == false - + when: not current_realm_exists -- name: "Get realm {{ current_realm_item.name }} config" - uri: +- name: "Get realm config: {{ current_realm_item.name }}" + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ current_realm_item.name }}" method: GET headers: @@ -40,15 +39,14 @@ register: "current_realm_search_result" -#at this point, we have a realm, either a created or an existing, loaded into the current_realm_search_result variable - -- name: "Fuse realm '{{ current_realm_item.name }}' configurations (existing and ansible's)" - set_fact: - realm_config_to_set: "{{ current_realm_search_result.json | combine(current_realm_item.config | default({}) , recursive=True ) }}" +# at this point, we have a realm, either a created or an existing, loaded into the current_realm_search_result variable +- name: "Fuse realm configurations (existing and ansible's): '{{ current_realm_item.name }}'" + ansible.builtin.set_fact: + realm_config_to_set: "{{ current_realm_search_result.json | combine(current_realm_item.config | default({}), recursive=True) }}" -#now HTTP PUT the information (either the fused or the ansible's original config) to the realm's REST API +# now HTTP PUT the information (either the fused or the ansible's original config) to the realm's REST API - name: "Update realm {{ current_realm_item.name }}" - uri: + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ current_realm_item.name }}" method: "PUT" body_format: json @@ -57,6 +55,3 @@ body: "{{ realm_config_to_set }}" status_code: "204" - - - diff --git a/roles/keycloak/tasks/blocks/configure_client_reg_policies.yml b/roles/keycloak/tasks/blocks/configure_client_reg_policies.yml index 65e10da8..a0752629 100644 --- a/roles/keycloak/tasks/blocks/configure_client_reg_policies.yml +++ b/roles/keycloak/tasks/blocks/configure_client_reg_policies.yml @@ -3,30 +3,31 @@ # current_realm = the current realm (loop item) of the config - name: Acquire tokens - include_tasks: blocks/helpers/get_tokens.yml + ansible.builtin.include_tasks: blocks/helpers/get_tokens.yml - name: "Get all existing client registration policies of realm {{ current_realm.name }}" - uri: - url: "{{ keycloak_proxy_host }}/admin/realms/{{ current_realm.name }}/components?type=org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy" + ansible.builtin.uri: + url: "{{ keycloak_proxy_host }}/admin/realms/{{ current_realm.name }}/components?type=org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy" # noqa yaml[line-length] method: GET headers: Authorization: "Bearer {{ tokens.json.access_token }}" status_code: [200] register: "found_cli_reg_pols" -- set_fact: +- name: Set found_cli_reg_pols fact + ansible.builtin.set_fact: found_cli_reg_pols: "{{ found_cli_reg_pols.json | default([]) }}" -- include_tasks: blocks/client_registration_policies/create_update_client_reg_policy.yml +- name: Include create update client tasks + ansible.builtin.include_tasks: blocks/client_registration_policies/create_update_client_reg_policy.yml with_items: "{{ current_realm.client_registration_policies.create_update | default([]) }}" loop_control: loop_var: current_cli_reg_pol run_once: true -- include_tasks: blocks/client_registration_policies/delete_client_reg_policy.yml +- name: Include client registration tasks + ansible.builtin.include_tasks: blocks/client_registration_policies/delete_client_reg_policy.yml with_items: "{{ current_realm.client_registration_policies.delete | default([]) }}" loop_control: loop_var: del_cli_reg_policy run_once: true - - diff --git a/roles/keycloak/tasks/blocks/configure_client_scope_mappers.yml b/roles/keycloak/tasks/blocks/configure_client_scope_mappers.yml index 5ebfcf65..a70e6210 100644 --- a/roles/keycloak/tasks/blocks/configure_client_scope_mappers.yml +++ b/roles/keycloak/tasks/blocks/configure_client_scope_mappers.yml @@ -2,31 +2,52 @@ # item[0] -> whole realm config (ansible variable) # item[1] -> current client_scope config (loop's item of ansible realm's client_scopes[] config) # mapper -> the current mapper config (loop item of item[1].mappers[] above) -# client_scope_matches -> if the current client_scope of the configuration is found in keycloak, it return a single-element array with a trimmed object client_scope.{id,name, protocolMappers} instance) +# client_scope_matches -> if the current client_scope of the configuration is found in keycloak, +# it return a single-element array with a trimmed object client_scope.{id,name, protocolMappers} instance) -- set_fact: +- name: Set mapper matches + ansible.builtin.set_fact: mapper_matches: "{{ client_scope_matches[0].protocolMappers | json_query(query) | default([]) }}" vars: query: '[?name == `{{ mapper.name }}` ].{id: id, name: name }' -- set_fact: - mapper_exists: "{{mapper_matches | length > 0 }}" +- name: Set existgs fact + ansible.builtin.set_fact: + mapper_exists: "{{ mapper_matches | length > 0 }}" -- set_fact: +- name: Set additional info fact + ansible.builtin.set_fact: additional_info: - id: "{{mapper_matches[0].id}}" + id: "{{ mapper_matches[0].id }}" when: mapper_exists -- set_fact: - body: "{% if mapper_exists %}{{ mapper | combine(additional_info , recursive=True ) }}{% else %}{{ mapper }}{% endif %}" +- name: Set body fact + ansible.builtin.set_fact: + body: |- + "{% if mapper_exists %} + {{ mapper | combine(additional_info, recursive=True) }} + {% else %} + {{ mapper }} + {% endif %}" + # body: "mapper_exists | ternary(mapper | combine(additional_info , recursive=True), mapper)" +- name: "Update client scope mapper {{ mapper.name }}" + ansible.builtin.uri: + url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/client-scopes/{{ client_scope_matches[0].id }}/protocol-mappers/models/{{ body.id }}" # noqa yaml[line-length] + method: PUT + body_format: json + headers: + Authorization: "Bearer {{ tokens.json.access_token }}" + body: "{{ body }}" + status_code: 204 + when: mapper_exists | bool -- name: "{% if mapper_exists %} Update {% else %} Create {% endif %} client scope mapper {{ mapper.name }}" - uri: - url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/client-scopes/{{ client_scope_matches[0].id }}/protocol-mappers/models{% if mapper_exists %}/{{body.id}}{% endif %}" - method: "{% if mapper_exists %}PUT{% else %}POST{% endif %}" +- name: "Create client scope mapper {{ mapper.name }}" + ansible.builtin.uri: + url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/client-scopes/{{ client_scope_matches[0].id }}/protocol-mappers/models" # noqa yaml[line-length] + method: POST body_format: json headers: Authorization: "Bearer {{ tokens.json.access_token }}" - body: - "{{ body }}" - status_code: "{% if mapper_exists %}204{% else %}201{% endif %}" + body: "{{ body }}" + status_code: 201 + when: (not mapper_exists) | bool diff --git a/roles/keycloak/tasks/blocks/configure_client_scopes.yml b/roles/keycloak/tasks/blocks/configure_client_scopes.yml index 2aebd65a..bca6ca0a 100644 --- a/roles/keycloak/tasks/blocks/configure_client_scopes.yml +++ b/roles/keycloak/tasks/blocks/configure_client_scopes.yml @@ -1,82 +1,100 @@ --- - name: Acquire tokens - include_tasks: blocks/helpers/get_tokens.yml + ansible.builtin.include_tasks: blocks/helpers/get_tokens.yml -- name: "Get current client scopes of realm: {{item[0].name}}" - include_tasks: blocks/helpers/get_client_scopes_list.yml +- name: "Get current client scopes of realm: {{ item[0].name }}" + ansible.builtin.include_tasks: blocks/helpers/get_client_scopes_list.yml -- set_fact: - client_scope_exists: "{{client_scope_matches | length > 0 }}" +- name: Set fact + ansible.builtin.set_fact: + client_scope_exists: "{{ client_scope_matches | length > 0 }}" -- set_fact: +- name: Set fact + ansible.builtin.set_fact: additional_info: - id: "{{client_scope_matches[0].id}}" + id: "{{ client_scope_matches[0].id }}" when: client_scope_exists -- set_fact: - body: "{{ item[1] | combine(additional_info , recursive=True ) }}" +- name: Set fact + ansible.builtin.set_fact: + body: "{{ item[1] | combine(additional_info, recursive=True) }}" when: client_scope_exists -- set_fact: +- name: Set fact + ansible.builtin.set_fact: body: "{{ item[1] }}" when: not client_scope_exists -- set_fact: # remove the 'mappers' field from the body (if it exists) - body: '{{ body | dict2items | rejectattr("key", "equalto", "mappers") | list | items2dict }}' +- name: Remove the 'mappers' field from the body (if it exists) + ansible.builtin.set_fact: + body: '{{ body | dict2items | rejectattr("key", "equalto", "mappers") | list | items2dict }}' -- set_fact: # remove the 'set_as' field from the body (if it exists) - body: '{{ body | dict2items | rejectattr("key", "equalto", "set_as") | list | items2dict }}' +- name: Remove the 'set_as' field from the body (if it exists) + ansible.builtin.set_fact: + body: '{{ body | dict2items | rejectattr("key", "equalto", "set_as") | list | items2dict }}' -- name: "{% if client_scope_exists %}Update{% else %}Add{% endif %} client scope: {{ item[1].name }} in realm: {{item[0].name}}" - uri: - url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/client-scopes{% if client_scope_exists %}/{{body.id}}{% endif %}" - method: "{% if client_scope_exists %}PUT{% else %}POST{% endif %}" +- name: "Update client scope: {{ item[1].name }} in realm: {{ item[0].name }}" # noqa name[template] + ansible.builtin.uri: + url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/client-scopes/{{ body.id }}" + method: "PUT" body_format: json headers: Authorization: "Bearer {{ tokens.json.access_token }}" - body: - "{{ body }}" - status_code: "{% if client_scope_exists %}204{% else %}201{% endif %}" + body: "{{ body }}" + status_code: 204 + when: client_scope_exists | bool -- name: "Get again the client_scopes if there was a newly created just before of realm: {{item[0].name}}" - include_tasks: blocks/helpers/get_client_scopes_list.yml +- name: "Add client scope: {{ item[1].name }} in realm: {{ item[0].name }}" # noqa name[template] + ansible.builtin.uri: + url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/client-scopes" + method: POST + body_format: json + headers: + Authorization: "Bearer {{ tokens.json.access_token }}" + body: "{{ body }}" + status_code: 201 + when: (not client_scope_exists) | bool + +- name: "Get again the client_scopes if there was a newly created just before of realm: {{ item[0].name }}" + ansible.builtin.include_tasks: blocks/helpers/get_client_scopes_list.yml when: not client_scope_exists - name: "Clear from all the default client scopes list (if applicable)" - uri: + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/default-{{ client_scope_mode }}-client-scopes/{{ client_scope_matches[0].id }}" method: "DELETE" headers: Authorization: "Bearer {{ tokens.json.access_token }}" - status_code: "204" + status_code: 204 with_items: - optional - default loop_control: loop_var: client_scope_mode - ignore_errors: yes + ignore_errors: true # noqa ignore-errors # set default or optional (if defined) - name: "Configuring default/optional client-scope as '{{ item[1].set_as }}'" - uri: + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/default-{{ item[1].set_as }}-client-scopes/{{ client_scope_matches[0].id }}" - method: "PUT" + method: PUT body_format: json headers: Authorization: "Bearer {{ tokens.json.access_token }}" body: - { realm: "{{ item[0].name }}", clientScopeId: "{{ client_scope_matches[0].id }}" } - status_code: "204" + realm: "{{ item[0].name }}" + clientScopeId: "{{ client_scope_matches[0].id }}" + status_code: 204 when: not item[1].set_as is undefined # now update its mappers -- name: "Setup mappers of the client scope {{ item[1].name }} of the realm: {{item[0].name}}" - include_tasks: blocks/configure_client_scope_mappers.yml +- name: "Setup mappers of the client scope {{ item[1].name }} of the realm: {{ item[0].name }}" # noqa name[template] + ansible.builtin.include_tasks: blocks/configure_client_scope_mappers.yml with_items: "{{ item[1].mappers | default([]) }}" loop_control: loop_var: mapper run_once: true - when: "item[1].mappers | default([]) | length > 0" + when: item[1].mappers | default([]) | length > 0 diff --git a/roles/keycloak/tasks/blocks/configure_default_idp.yml b/roles/keycloak/tasks/blocks/configure_default_idp.yml index 350214f2..fade4fb7 100644 --- a/roles/keycloak/tasks/blocks/configure_default_idp.yml +++ b/roles/keycloak/tasks/blocks/configure_default_idp.yml @@ -1,36 +1,37 @@ --- - -- block: - +- name: Tasks + when: (current_realm.defaultIdPAlias is defined) and (current_realm.defaultIdPAlias | length > 0) + block: - name: Acquire tokens - include_tasks: blocks/helpers/get_tokens.yml - - - name: "Get all executions of the 'browser' authentication flow of the realm {{ current_realm.name }}" + ansible.builtin.include_tasks: blocks/helpers/get_tokens.yml + - ansible.builtin.name: "Get all executions of the 'browser' authentication flow of the realm {{ current_realm.name }}" uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ current_realm.name }}/authentication/flows/browser/executions" method: GET headers: Authorization: "Bearer {{ tokens.json.access_token }}" status_code: 200 - register: "current_realm_browser_executions" + register: current_realm_browser_executions - - set_fact: + - name: Set Fact + ansible.builtin.set_fact: idp_redirector_matches: "{{ current_realm_browser_executions.json | json_query(query) | default([]) }}" vars: query: '[?providerId == `identity-provider-redirector` ]' - - set_fact: + - name: Set fact + ansible.builtin.set_fact: idp_redirector_id: "{{ idp_redirector_matches[0].id }}" when: idp_redirector_matches | length > 0 - - set_fact: + - name: Set Fact + ansible.builtin.set_fact: idp_redirector_config_id: "{{ idp_redirector_matches[0].authenticationConfig }}" when: idp_redirector_id is defined and idp_redirector_matches[0].authenticationConfig is defined - # if idp_redirector_config_id is defined, it's an update, else it is a new one - - name: "Updating default IdP redirector for the realm {{ current_realm.name }} to the IdP {{ current_realm.defaultIdPAlias }}" - uri: + - name: "Updating default IdP redirector for the realm {{ current_realm.name }} to the IdP {{ current_realm.defaultIdPAlias }}" # noqa name[template] + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ current_realm.name }}/authentication/config/{{ idp_redirector_config_id }}" method: PUT body_format: json @@ -38,24 +39,22 @@ Authorization: "Bearer {{ tokens.json.access_token }}" body: id: "{{ idp_redirector_config_id }}" - alias: "idp-redirector" + alias: idp-redirector config: defaultProvider: "{{ current_realm.defaultIdPAlias }}" status_code: 204 when: idp_redirector_id is defined and idp_redirector_config_id is defined - - name: "Setting the IdP {{ current_realm.defaultIdPAlias }} as default IdP redirector for the realm {{ current_realm.name }}" - uri: + - name: "Setting the IdP {{ current_realm.defaultIdPAlias }} as default IdP redirector for the realm {{ current_realm.name }}" # noqa name[template] + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ current_realm.name }}/authentication/executions/{{ idp_redirector_id }}/config" method: POST body_format: json headers: Authorization: "Bearer {{ tokens.json.access_token }}" body: - alias: "idp-redirector" + alias: idp-redirector config: defaultProvider: "{{ current_realm.defaultIdPAlias }}" status_code: 201 when: idp_redirector_id is defined and idp_redirector_config_id is undefined - - when: (current_realm.defaultIdPAlias is defined) and (current_realm.defaultIdPAlias | length > 0) diff --git a/roles/keycloak/tasks/blocks/configure_event_logging.yml b/roles/keycloak/tasks/blocks/configure_event_logging.yml index c521ab24..7484c81c 100644 --- a/roles/keycloak/tasks/blocks/configure_event_logging.yml +++ b/roles/keycloak/tasks/blocks/configure_event_logging.yml @@ -1,32 +1,32 @@ --- # current_realm_item: is the current realm of the looping of the realms in the configuration -- block: - - - name: Acquire tokens - include_tasks: blocks/helpers/get_tokens.yml - - - name: "Get current event logging configuration of realm: {{ current_realm_item.name }}" - uri: - url: "{{ keycloak_proxy_host }}/admin/realms/{{ current_realm_item.name }}/events/config" - method: "GET" - headers: - Authorization: "Bearer {{ tokens.json.access_token }}" - status_code: "200" - register: current_events_logging - - - set_fact: - new_events_logging: "{{ current_events_logging.json | combine(current_realm_item.events_logging , recursive=True ) }}" +# Unnecessary block - use then when in the include_tasks task.`` +- name: Tasks + when: current_realm_item.events_logging is defined + block: + - name: Acquire tokens + ansible.builtin.include_tasks: blocks/helpers/get_tokens.yml - - name: "Update event logging configuration of realm: {{ current_realm_item.name }}" - uri: - url: "{{ keycloak_proxy_host }}/admin/realms/{{ current_realm_item.name }}/events/config" - method: "PUT" - body_format: json - body: - "{{ new_events_logging }}" - headers: - Authorization: "Bearer {{ tokens.json.access_token }}" - status_code: "204" + - name: "Get current event logging configuration of realm: {{ current_realm_item.name }}" + ansible.builtin.uri: + url: "{{ keycloak_proxy_host }}/admin/realms/{{ current_realm_item.name }}/events/config" + method: GET + headers: + Authorization: "Bearer {{ tokens.json.access_token }}" + status_code: 200 + register: current_events_logging - when: current_realm_item.events_logging is defined + - name: Set Fact + ansible.builtin.set_fact: + new_events_logging: "{{ current_events_logging.json | combine(current_realm_item.events_logging, recursive=True) }}" + - name: "Update event logging configuration of realm: {{ current_realm_item.name }}" + ansible.builtin.uri: + url: "{{ keycloak_proxy_host }}/admin/realms/{{ current_realm_item.name }}/events/config" + method: PUT + body_format: json + body: + "{{ new_events_logging }}" + headers: + Authorization: "Bearer {{ tokens.json.access_token }}" + status_code: 204 diff --git a/roles/keycloak/tasks/blocks/configure_federation_mapper.yml b/roles/keycloak/tasks/blocks/configure_federation_mapper.yml index 8c2249f3..8fa69765 100644 --- a/roles/keycloak/tasks/blocks/configure_federation_mapper.yml +++ b/roles/keycloak/tasks/blocks/configure_federation_mapper.yml @@ -2,45 +2,61 @@ # item[0] -> whole realm config (ansible variable) # item[1] -> current federation config (loop's item of ansible realm's federation config) # federation_exists -> boolean flag (it's always true in this file) -# realm_federation_matches -> it's always a single element array (since federation_exists==true) with: [{"alias": "federation_alias", "internalId": "federation_internalId" }] +# realm_federation_matches -> it's always a single element array +# (since federation_exists==true) with: [{"alias": "federation_alias", "internalId": "federation_internalId" }] # existing_mappers_name_id -> contains the current federation mappers id,name pairs i.e. [{id:"mapper_id", name:"mapper_name"}, ...] -# mapper -> contains the new mapper json (from ansible config vars) i.e. {"config":{},"identityProviderMapper":"hardcoded-attribute-idp-mapper","name":"test_mapper2"} +# mapper -> contains the new mapper json (from ansible config vars) +# i.e. {"config":{},"identityProviderMapper":"hardcoded-attribute-idp-mapper","name":"test_mapper2"} -- set_fact: +- name: Set mapper matches fact + ansible.builtin.set_fact: mapper_matches: "{{ existing_mappers_name_id | json_query(query) | default([]) }}" vars: - query: '[?name == `{{ mapper.name }}` ].{id: id, name: name }' + query: '[?name == `{{ mapper.name }}`].{id: id, name: name}' +- name: Set mapper exists fact + ansible.builtin.set_fact: + mapper_exists: "{{ mapper_matches | length > 0 | bool }}" -- set_fact: - mapper_exists: "{{ mapper_matches | length > 0 }}" - -- set_fact: +- name: Set additional info fact + ansible.builtin.set_fact: additional_info: id: "{{ mapper_matches[0].id }}" when: mapper_exists -- set_fact: - body: "{% if mapper_exists %}{{ mapper | combine(additional_info , recursive=True ) }}{% else %}{{ mapper }}{% endif %}" +# Merge this set fact with the previous one. +- name: Set body fact + ansible.builtin.set_fact: + body: "{% if mapper_exists %}{{ mapper | combine(additional_info, recursive=True) }}{% else %}{{ mapper }}{% endif %}" +- name: "Updatefederation mapper {{ mapper.name }}" + ansible.builtin.uri: + url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/{{ keycloak_federation.saml.api_path }}/instances/{{ realm_federation_matches[0].internalId }}/mappers/{{ body.id }}" # noqa yaml[line-length] + method: PUT + body_format: json + headers: + Authorization: "Bearer {{ tokens.json.access_token }}" + body: "{{ body }}" + status_code: 204 + when: mapper_exists | bool -- name: "{% if mapper_exists %} Update {% else %} Create {% endif %} federation mapper {{ mapper.name }}" - uri: - url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/{{ keycloak_federation.saml.api_path }}/instances/{{ realm_federation_matches[0].internalId }}/mappers{% if mapper_exists %}/{{ body.id }}{% endif %}" - method: "{% if mapper_exists %}PUT{% else %}POST{% endif %}" +- name: "Create federation mapper {{ mapper.name }}" + ansible.builtin.uri: + url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/{{ keycloak_federation.saml.api_path }}/instances/{{ realm_federation_matches[0].internalId }}/mappers" # noqa yaml[line-length] + method: POST body_format: json headers: Authorization: "Bearer {{ tokens.json.access_token }}" - body: - "{{ body }}" - status_code: "{% if mapper_exists %}204{% else %}201{% endif %}" + body: "{{ body }}" + status_code: 201 + when: not (mapper_exists | bool) # this is meant to run after a successful first deployment of the federations and the mappers (that's why the "when: mapper_exists") # You should execute it only when you are sure that the federation(s) are fully populated - name: Apply mappers (propagate) to federation IdP(s) - uri: - url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/{{ keycloak_federation.saml.api_path }}/instances/{{ realm_federation_matches[0].internalId }}/mappers/{{ body.id }}/idp/add" + ansible.builtin.uri: + url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/{{ keycloak_federation.saml.api_path }}/instances/{{ realm_federation_matches[0].internalId }}/mappers/{{ body.id }}/idp/add" # noqa yaml[line-length] method: POST headers: Authorization: "Bearer {{ tokens.json.access_token }}" diff --git a/roles/keycloak/tasks/blocks/configure_federations.yml b/roles/keycloak/tasks/blocks/configure_federations.yml index edf0948b..20f1baf2 100644 --- a/roles/keycloak/tasks/blocks/configure_federations.yml +++ b/roles/keycloak/tasks/blocks/configure_federations.yml @@ -1,63 +1,64 @@ --- - name: Acquire tokens - include_tasks: blocks/helpers/get_tokens.yml + ansible.builtin.include_tasks: blocks/helpers/get_tokens.yml -- name: "Initiating federation search in keycloak" - include_tasks: blocks/helpers/search_realm_federations.yml +- name: Initiating federation search in keycloak + ansible.builtin.include_tasks: blocks/helpers/search_realm_federations.yml -- set_fact: +- name: Check if federation exists + ansible.builtin.set_fact: federation_exists: "{{ realm_federation_matches | length > 0 }}" -- set_fact: +- name: Set additional info + ansible.builtin.set_fact: additional_info: internalId: "{{ realm_federation_matches[0].internalId }}" when: federation_exists -- set_fact: - body: "{% if federation_exists %}{{ item[1] | combine(additional_info , recursive=True ) }}{% else %}{{ item[1] }}{% endif %}" - -- set_fact: # remove the 'mappers' field from the body (if it exists) +- name: Set body fact + ansible.builtin.set_fact: + # body: "{% if federation_exists %}{{ item[1] | combine(additional_info, recursive=True) }}{% else %}{{ item[1] }}{% endif %}" + body: "{{ federation_exists | ternary((item[1] | combine(additional_info, recursive=True)), item[1]) }}" +- name: Remove the 'mappers' field from the body (if it exists) + ansible.builtin.set_fact: body: '{{ body | dict2items | rejectattr("key", "equalto", "mappers") | list | items2dict }}' - name: "Configuring federation {{ item[1].alias }}" - uri: + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/{{ keycloak_federation.saml.api_path }}/instances" method: POST body_format: json headers: Authorization: "Bearer {{ tokens.json.access_token }}" - body: - "{{ body }}" + body: "{{ body }}" status_code: 201 - #get once more the federation_matches. now federation_matches should contain exactly one object in the list with the internalId and alias of the current federation -- name: "Initiating federation search in keycloak" - include_tasks: blocks/helpers/search_realm_federations.yml +# get once more the federation_matches. +# now federation_matches should contain exactly one object in the list with the internalId and alias of the current federation +- name: Initiating federation search in keycloak + ansible.builtin.include_tasks: blocks/helpers/search_realm_federations.yml -- name: "Configuring mappers of the federation {{ item[1].alias }} of the realm: {{ item[0].name }}" +- name: "Configuring mappers of the federation {{ item[1].alias }} of the realm: {{ item[0].name }}" # noqa name[template] + when: (realm_federation_matches | length) > 0 block: - - - name: "Get list of federation {{ item[1].alias }} mappers" - uri: - url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/{{ keycloak_federation.saml.api_path }}/instances/{{ realm_federation_matches[0].internalId }}/mappers" + - name: "Get list of federation {{ item[1].alias }} mappers" # noqa name[template] + ansible.builtin.uri: + url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/{{ keycloak_federation.saml.api_path }}/instances/{{ realm_federation_matches[0].internalId }}/mappers" # noqa yaml[line-length] method: GET headers: Authorization: "Bearer {{ tokens.json.access_token }}" status_code: 200 register: existing_mappers - - set_fact: + - name: Set fact + ansible.builtin.set_fact: existing_mappers_name_id: "{{ existing_mappers.json | json_query(query) | default([]) }}" vars: query: '[].{name: name, id: id }' - - name: Setup federation mapper - include_tasks: blocks/configure_federation_mapper.yml + ansible.builtin.include_tasks: blocks/configure_federation_mapper.yml with_items: "{{ item[1].mappers | default([]) }}" loop_control: loop_var: mapper run_once: true - - when: "realm_federation_matches | length > 0" - diff --git a/roles/keycloak/tasks/blocks/configure_idp_mappers.yml b/roles/keycloak/tasks/blocks/configure_idp_mappers.yml index 67425cc2..3577eea0 100644 --- a/roles/keycloak/tasks/blocks/configure_idp_mappers.yml +++ b/roles/keycloak/tasks/blocks/configure_idp_mappers.yml @@ -1,44 +1,49 @@ --- - name: Acquire tokens - include_tasks: blocks/helpers/get_tokens.yml + ansible.builtin.include_tasks: blocks/helpers/get_tokens.yml - name: "Get current mappers of idp: {{ item[0].name }}" - include_tasks: blocks/helpers/get_idp_mappers_list.yml + ansible.builtin.include_tasks: blocks/helpers/get_idp_mappers_list.yml -- set_fact: +- name: Set Fact + ansible.builtin.set_fact: mapper_exists: "{{ idp_mapper_match | length > 0 }}" -- set_fact: +- name: Set Fact + ansible.builtin.set_fact: additional_info: id: "{{ idp_mapper_match[0].id }}" - when: mapper_exists + when: mapper_exists | bool -- set_fact: - body: "{{ item[1] | combine(additional_info , recursive=True ) }}" - when: mapper_exists +- name: Set Fact + ansible.builtin.set_fact: + body: "{{ item[1] | combine(additional_info, recursive=True) }}" + when: mapper_exists | bool -- set_fact: +- name: Set Fact + ansible.builtin.set_fact: body: "{{ item[1] }}" - when: not mapper_exists + when: not (mapper_exists | bool) -- name: "{% if mapper_exists %}Update{% else %}Add{% endif %} idp mapper: {{ item[1].name }} for idp: {{ item[1].identityProviderAlias }}" - uri: - url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/identity-provider/instances/{{ body.identityProviderAlias }}/mappers{% if mapper_exists %}/{{ body.id }}{% endif %}" - method: "{% if mapper_exists %}PUT{% else %}POST{% endif %}" +- name: "Update idp mapper: {{ item[1].name }} for idp: {{ item[1].identityProviderAlias }}" # noqa name[template] + ansible.builtin.uri: + url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/identity-provider/instances/{{ body.identityProviderAlias }}/mappers/{{ body.id }}" + method: PUT body_format: json headers: Authorization: "Bearer {{ tokens.json.access_token }}" - body: - "{{ body }}" - status_code: "{% if mapper_exists %}204{% else %}201{% endif %}" - - - - - - - - - - + body: "{{ body }}" + status_code: 204 + when: mapper_exists | bool + +- name: "Add idp mapper: {{ item[1].name }} for idp: {{ item[1].identityProviderAlias }}" # noqa name[template] + ansible.builtin.uri: + url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/identity-provider/instances/{{ body.identityProviderAlias }}/mappers" + method: POST + body_format: json + headers: + Authorization: "Bearer {{ tokens.json.access_token }}" + body: "{{ body }}" + status_code: 201 + when: not (mapper_exists | bool) diff --git a/roles/keycloak/tasks/blocks/configure_saml_idps.yml b/roles/keycloak/tasks/blocks/configure_saml_idps.yml index 355ff84b..3b1efb12 100644 --- a/roles/keycloak/tasks/blocks/configure_saml_idps.yml +++ b/roles/keycloak/tasks/blocks/configure_saml_idps.yml @@ -1,18 +1,19 @@ --- - name: Acquire tokens - include_tasks: blocks/helpers/get_tokens.yml + ansible.builtin.include_tasks: blocks/helpers/get_tokens.yml - name: "Get current IdPs list of realm: {{ item[0].name }}" - include_tasks: blocks/helpers/get_realm_idps_list.yml + ansible.builtin.include_tasks: blocks/helpers/get_realm_idps_list.yml -- set_fact: - new_idp: "{% if item[1].data.alias not in idps_list %}true{% else %}false{% endif %}" +- name: Set fact + ansible.builtin.set_fact: + new_idp: "({% if item[1].data.alias not in idps_list %}true{% else %}false{% endif %}) | bool" - name: "{% if new_idp %}Installing{% else %}Updating{% endif %} saml IdP: {{ item[1].data.alias }}" block: - name: "Get config from url: {{ item[1].metadataUrl }}" - uri: + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/identity-provider/import-config" method: POST body_format: json @@ -24,13 +25,24 @@ status_code: 200 register: saml_idp_result - - name: "Setup saml IdP {{ item[1].data.alias }}" - uri: - url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/identity-provider/instances{% if new_idp %}{% else %}/{{ item[1].data.alias }}{% endif %}" - method: "{% if new_idp %}POST{% else %}PUT{% endif %}" + - name: "Create saml IdP {{ item[1].data.alias }}" + ansible.builtin.uri: + url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/identity-provider/instances" + method: POST body_format: json headers: Authorization: "Bearer {{ tokens.json.access_token }}" - body: - "{{ { 'config': saml_idp_result.json } | combine( item[1].data, recursive=True ) }}" - status_code: "{% if new_idp %}201{% else %}204{% endif %}" + body: "{{ {'config': saml_idp_result.json} | combine(item[1].data, recursive=True) }}" + status_code: 201 + when: new_idp + + - name: "Update saml IdP {{ item[1].data.alias }}" + ansible.builtin.uri: + url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/identity-provider/instances/{{ item[1].data.alias }}" + method: PUT + body_format: json + headers: + Authorization: "Bearer {{ tokens.json.access_token }}" + body: "{{ {'config': saml_idp_result.json} | combine(item[1].data, recursive=True) }}" + status_code: 204 + when: not new_idp diff --git a/roles/keycloak/tasks/blocks/configure_social_idps.yml b/roles/keycloak/tasks/blocks/configure_social_idps.yml index db6c24f6..9fea8001 100644 --- a/roles/keycloak/tasks/blocks/configure_social_idps.yml +++ b/roles/keycloak/tasks/blocks/configure_social_idps.yml @@ -1,21 +1,33 @@ --- - name: Acquire tokens - include_tasks: blocks/helpers/get_tokens.yml + ansible.builtin.include_tasks: blocks/helpers/get_tokens.yml -- name: "Configuring IdP: {{ item[1].alias }} Get current IdPs list for realm: {{ item[0].name }}" - include_tasks: blocks/helpers/get_realm_idps_list.yml +- name: "Configuring IdP: {{ item[1].alias }} Get current IdPs list for realm: {{ item[0].name }}" # noqa name[template] + ansible.builtin.include_tasks: blocks/helpers/get_realm_idps_list.yml -- set_fact: +- name: Set new idp fact + ansible.builtin.set_fact: new_idp: "{% if item[1].alias not in idps_list %}true{% else %}false{% endif %}" -- name: "{% if new_idp %}Add{% else %}Update{% endif %} idp: {{ item[1].alias }}" - uri: +- name: "Add idp: {{ item[1].alias }}" + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/identity-provider/instances{% if new_idp %}{% else %}/{{ item[1].alias }}{% endif %}" - method: "{% if new_idp %}POST{% else %}PUT{% endif %}" + method: POST body_format: json headers: Authorization: "Bearer {{ tokens.json.access_token }}" - body: - "{{ item[1] }}" - status_code: "{% if new_idp %}201{% else %}204{% endif %}" + body: "{{ item[1] }}" + status_code: 201 + when: new_idp + +- name: "Update idp: {{ item[1].alias }}" + ansible.builtin.uri: + url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/identity-provider/instances{% if new_idp %}{% else %}/{{ item[1].alias }}{% endif %}" + method: PUT + body_format: json + headers: + Authorization: "Bearer {{ tokens.json.access_token }}" + body: "{{ item[1] }}" + status_code: 204 + when: not new_idp diff --git a/roles/keycloak/tasks/blocks/configure_theme.yml b/roles/keycloak/tasks/blocks/configure_theme.yml index 48c50ad6..9212b2b1 100644 --- a/roles/keycloak/tasks/blocks/configure_theme.yml +++ b/roles/keycloak/tasks/blocks/configure_theme.yml @@ -1,15 +1,16 @@ --- - name: Acquire tokens - include_tasks: blocks/helpers/get_tokens.yml + ansible.builtin.include_tasks: blocks/helpers/get_tokens.yml ## we should issue the configuration calls from all host machines locally (and not through the proxy), ## because we want to be absolutely sure that all calls have been executed on all keycloak nodes at least once. -- ansible.builtin.set_fact: +- name: Ensure local host fact + ansible.builtin.set_fact: keycloak_local_host: "http://{{ keycloak_local_address }}:{{ keycloak_bind_port }}/{{ keycloak_base_url_path }}" -- name: "Add {{keycloak_plugins.wayf.theme.name}} theme's terms of use for the realm {{ item.name }}" - uri: +- name: "Add {{ keycloak_plugins.wayf.theme.name }} theme's terms of use for the realm {{ item.name }}" # noqa name[template] + ansible.builtin.uri: url: "{{ keycloak_local_host }}/realms/{{ item.name }}/theme-info/terms-of-use" method: POST body_format: raw @@ -20,8 +21,8 @@ status_code: 201 when: not item.terms is undefined -- name: "Add {{keycloak_plugins.wayf.theme.name}} theme's configuration for the realm {{ item.name }}" - uri: +- name: "Add {{ keycloak_plugins.wayf.theme.name }} theme's configuration for the realm {{ item.name }}" # noqa name[template] + ansible.builtin.uri: url: "{{ keycloak_local_host }}/realms/{{ item.name }}/theme-info/theme-config" method: POST body_format: json @@ -32,7 +33,7 @@ when: not item.config is undefined - name: "Add resource files" - uri: + ansible.builtin.uri: url: "{{ keycloak_local_host }}/realms/{{ item.name }}/theme-info/resource/{{ theme_realm_resource.filename }}" method: POST headers: @@ -46,5 +47,3 @@ loop_control: loop_var: theme_realm_resource with_items: "{{ item.resources | default([]) }}" - - diff --git a/roles/keycloak/tasks/blocks/helpers/get_client_scopes_list.yml b/roles/keycloak/tasks/blocks/helpers/get_client_scopes_list.yml index fd54d353..614eafcc 100644 --- a/roles/keycloak/tasks/blocks/helpers/get_client_scopes_list.yml +++ b/roles/keycloak/tasks/blocks/helpers/get_client_scopes_list.yml @@ -1,6 +1,6 @@ --- - name: "Get list of client scopes" - uri: + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/client-scopes" method: GET headers: @@ -8,7 +8,8 @@ status_code: 200 register: "client_scopes_list" -- set_fact: +- name: Set Fact + ansible.builtin.set_fact: client_scope_matches: "{{ client_scopes_list.json | json_query(query) | default([]) }}" vars: query: '[?name == `{{ item[1].name }}` ]' diff --git a/roles/keycloak/tasks/blocks/helpers/get_idp_mappers_list.yml b/roles/keycloak/tasks/blocks/helpers/get_idp_mappers_list.yml index aca59cba..69e5f5b4 100644 --- a/roles/keycloak/tasks/blocks/helpers/get_idp_mappers_list.yml +++ b/roles/keycloak/tasks/blocks/helpers/get_idp_mappers_list.yml @@ -1,7 +1,6 @@ --- - -- name: "Get list of idp's mappers" - uri: +- name: Get list of idp's mappers + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/identity-provider/instances/{{ item[1].identityProviderAlias }}/mappers" method: GET headers: @@ -9,7 +8,8 @@ status_code: 200 register: "idp_mappers_result" -- set_fact: +- name: Set Fact + ansible.builtin.set_fact: idp_mapper_match: "{{ idp_mappers_result.json | json_query(query) | default([]) }}" vars: query: '[?name == `{{ item[1].name }}` ].{name: name, id: id }' diff --git a/roles/keycloak/tasks/blocks/helpers/get_realm_idps_list.yml b/roles/keycloak/tasks/blocks/helpers/get_realm_idps_list.yml index a712cb74..ba12e58f 100644 --- a/roles/keycloak/tasks/blocks/helpers/get_realm_idps_list.yml +++ b/roles/keycloak/tasks/blocks/helpers/get_realm_idps_list.yml @@ -1,7 +1,7 @@ --- - name: "Get list of idps" - uri: + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/identity-provider/instances" method: GET headers: @@ -9,5 +9,6 @@ status_code: 200 register: "idps_result" -- set_fact: - idps_list: "{{ idps_result.json | json_query('[].alias') }}" \ No newline at end of file +- name: Set fact + ansible.builtin.set_fact: + idps_list: "{{ idps_result.json | json_query('[].alias') }}" diff --git a/roles/keycloak/tasks/blocks/helpers/get_realm_keys.yml b/roles/keycloak/tasks/blocks/helpers/get_realm_keys.yml index bdbfcee1..808e6a6d 100644 --- a/roles/keycloak/tasks/blocks/helpers/get_realm_keys.yml +++ b/roles/keycloak/tasks/blocks/helpers/get_realm_keys.yml @@ -1,6 +1,6 @@ --- - name: "Get list of keys of realm: {{ item[0].name }}" - uri: + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/components?parent={{ item[0].name }}&type=org.keycloak.keys.KeyProvider" method: GET headers: @@ -8,8 +8,9 @@ status_code: 200 register: "keys_result" -- set_fact: - keys_provideridName2id: "{{ keys_provideridName2id | default({}) | combine( { current_key.providerId + ':' + current_key.name : current_key.id } ) }}" +- name: Set Fact + ansible.builtin.set_fact: + keys_providerid_name_2_id: "{{ keys_providerid_name_2_id | default({}) | combine({current_key.providerId + ':' + current_key.name: current_key.id}) }}" loop_control: loop_var: current_key with_items: diff --git a/roles/keycloak/tasks/blocks/helpers/get_tokens.yml b/roles/keycloak/tasks/blocks/helpers/get_tokens.yml index 6e2d025f..deba711a 100644 --- a/roles/keycloak/tasks/blocks/helpers/get_tokens.yml +++ b/roles/keycloak/tasks/blocks/helpers/get_tokens.yml @@ -1,13 +1,12 @@ --- - - name: Acquire tokens - uri: + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/realms/master/protocol/openid-connect/token" method: POST body_format: form-urlencoded body: - client_id: "admin-cli" - username: "{{keycloak_admin.user}}" - password: "{{keycloak_admin.pass}}" - grant_type: "password" - register: "tokens" # token is in "tokens.json.access_token" + client_id: admin-cli + username: "{{ keycloak_admin.user }}" + password: "{{ keycloak_admin.pass }}" + grant_type: password + register: tokens # token is in "tokens.json.access_token" diff --git a/roles/keycloak/tasks/blocks/helpers/search_realm_federations.yml b/roles/keycloak/tasks/blocks/helpers/search_realm_federations.yml index c545bf87..2a22090a 100644 --- a/roles/keycloak/tasks/blocks/helpers/search_realm_federations.yml +++ b/roles/keycloak/tasks/blocks/helpers/search_realm_federations.yml @@ -1,16 +1,16 @@ --- -- name: "Search federation {{ item[1].alias }} in keycloak" - uri: +- name: "Search federation in keycloak - {{ item[1].alias }}" + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}" method: GET headers: Authorization: "Bearer {{ tokens.json.access_token }}" status_code: 200 - register: "realm_result" + register: realm_result -- set_fact: +- name: Set real federation matches + ansible.builtin.set_fact: realm_federation_matches: "{{ realm_result.json[keycloak_federation.saml.representation_entity] | json_query(query) | default([]) }}" vars: query: '[?alias == `{{ item[1].alias }}` ].{alias: alias, internalId: internalId }' - diff --git a/roles/keycloak/tasks/blocks/helpers/setup_logs_folder.yml b/roles/keycloak/tasks/blocks/helpers/setup_logs_folder.yml index 450d4e7b..b41ec150 100644 --- a/roles/keycloak/tasks/blocks/helpers/setup_logs_folder.yml +++ b/roles/keycloak/tasks/blocks/helpers/setup_logs_folder.yml @@ -1,34 +1,30 @@ --- -- block: - ##### Setup logs directory - - name: "Create {{ keycloak_logs_folder }} (if it doesn't exist)" - file: - path: "{{ keycloak_logs_folder }}" - owner: "{{ keycloak_service_user }}" - group: "{{ keycloak_service_user }}" - mode: 0750 - recurse: yes - state: directory - become: yes - - - name: "Move existing logs in default location to new location, if needed (that's for backwards compatibility)" - block: - - - stat: - path: "{{ keycloak_home }}/standalone/log" - register: keycloak_old_logs_folder - - - name: "Copy everything from {{ keycloak_home }}/standalone/log to {{ keycloak_logs_folder }}" - copy: - src: "{{ keycloak_home }}/standalone/log/" - dest: "{{ keycloak_logs_folder }}" +- name: Setup logs directory + ansible.builtin.block: + - name: "Create {{ keycloak_logs_folder }} (if it doesn't exist)" + ansible.builtin.file: + path: "{{ keycloak_logs_folder }}" owner: "{{ keycloak_service_user }}" group: "{{ keycloak_service_user }}" - remote_src: true - mode: 0640 - become: yes - when: keycloak_old_logs_folder.stat.exists - - tags: "keycloak:setup_logs_folder" + mode: "0750" + recurse: true + state: directory + become: true + - name: Move existing logs in default location to new location, if needed (that's for backwards compatibility) + ansible.builtin.block: + - ansible.builtin.stat: + path: "{{ keycloak_home }}/standalone/log" + register: keycloak_old_logs_folder + - name: "Copy everything from {{ keycloak_home }}/standalone/log to {{ keycloak_logs_folder }}" + ansible.builtin.copy: + src: "{{ keycloak_home }}/standalone/log/" + dest: "{{ keycloak_logs_folder }}" + owner: "{{ keycloak_service_user }}" + group: "{{ keycloak_service_user }}" + remote_src: true + mode: "0640" + become: true + when: keycloak_old_logs_folder.stat.exists + tags: keycloak:setup_logs_folder diff --git a/roles/keycloak/tasks/blocks/helpers/unassign_default_client_scopes.yml b/roles/keycloak/tasks/blocks/helpers/unassign_default_client_scopes.yml index 4d36b127..c5a8a2ef 100644 --- a/roles/keycloak/tasks/blocks/helpers/unassign_default_client_scopes.yml +++ b/roles/keycloak/tasks/blocks/helpers/unassign_default_client_scopes.yml @@ -1,9 +1,10 @@ --- - -- include_tasks: blocks/helpers/get_tokens.yml +# this is included below - not idempotent should be a handler with flush +- name: Include get tokens tasks + ansible.builtin.include_tasks: blocks/helpers/get_tokens.yml - name: "Get all default optional client-scopes list" - uri: + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ current_realm.name }}/default-optional-client-scopes" method: "GET" headers: @@ -12,26 +13,25 @@ register: "default_optional_list" - name: "Clear all from the default optional client scopes list" - include_tasks: blocks/helpers/unassign_default_optional_client_scope.yml + ansible.builtin.include_tasks: blocks/helpers/unassign_default_optional_client_scope.yml with_items: "{{ default_optional_list.json | default([]) }}" loop_control: loop_var: current_default_optional +- name: Include get_tokens + ansible.builtin.include_tasks: blocks/helpers/get_tokens.yml -- include_tasks: blocks/helpers/get_tokens.yml - -- name: "Get all default default client-scopes list" - uri: +- name: Get all default default client-scopes list + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ current_realm.name }}/default-default-client-scopes" method: "GET" headers: Authorization: "Bearer {{ tokens.json.access_token }}" - status_code: "200" + status_code: 200 register: "default_default_list" - -- name: "Clear all from the default default client scopes list" - include_tasks: blocks/helpers/unassign_default_default_client_scope.yml +- name: Clear all from the default default client scopes list + ansible.builtin.include_tasks: blocks/helpers/unassign_default_default_client_scope.yml with_items: "{{ default_default_list.json | default([]) }}" loop_control: loop_var: current_default_default diff --git a/roles/keycloak/tasks/blocks/helpers/unassign_default_default_client_scope.yml b/roles/keycloak/tasks/blocks/helpers/unassign_default_default_client_scope.yml index 5414b2b8..10fab4cd 100644 --- a/roles/keycloak/tasks/blocks/helpers/unassign_default_default_client_scope.yml +++ b/roles/keycloak/tasks/blocks/helpers/unassign_default_default_client_scope.yml @@ -1,11 +1,12 @@ --- +# tasks/blocks/helpers/unassign_default_default_client_scope.yml +- name: Include tokens tasks + ansible.builtin.include_tasks: blocks/helpers/get_tokens.yml -- include_tasks: blocks/helpers/get_tokens.yml - -- name: "Clear {{ current_default_default.name }} from the default default client scopes list" - uri: +- name: "Clear from the default client scopes list: {{ current_default_default.name }}" + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ current_realm.name }}/default-default-client-scopes/{{ current_default_default.id }}" - method: "DELETE" + method: DELETE headers: Authorization: "Bearer {{ tokens.json.access_token }}" - status_code: "204" \ No newline at end of file + status_code: 204 diff --git a/roles/keycloak/tasks/blocks/helpers/unassign_default_optional_client_scope.yml b/roles/keycloak/tasks/blocks/helpers/unassign_default_optional_client_scope.yml index b0acdd83..550e4210 100644 --- a/roles/keycloak/tasks/blocks/helpers/unassign_default_optional_client_scope.yml +++ b/roles/keycloak/tasks/blocks/helpers/unassign_default_optional_client_scope.yml @@ -1,11 +1,12 @@ --- -- include_tasks: blocks/helpers/get_tokens.yml +- name: Keycloak | helpers | unassign default | include get tokens + ansible.builtin.include_tasks: blocks/helpers/get_tokens.yml -- name: "Clear {{ current_default_optional.name }} from the default optional client scopes list" - uri: +- name: "Clear {{ current_default_optional.name }} from the default optional client scopes list" # noqa name[template] + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ current_realm.name }}/default-optional-client-scopes/{{ current_default_optional.id }}" - method: "DELETE" + method: DELETE headers: Authorization: "Bearer {{ tokens.json.access_token }}" - status_code: "204" \ No newline at end of file + status_code: 204 diff --git a/roles/keycloak/tasks/blocks/keys/configure_keys.yml b/roles/keycloak/tasks/blocks/keys/configure_keys.yml index 226da57c..02e3f08d 100644 --- a/roles/keycloak/tasks/blocks/keys/configure_keys.yml +++ b/roles/keycloak/tasks/blocks/keys/configure_keys.yml @@ -1,20 +1,22 @@ --- - name: Acquire tokens - include_tasks: blocks/helpers/get_tokens.yml + ansible.builtin.include_tasks: blocks/helpers/get_tokens.yml -- name: "Get current keys list of realm: {{item[0].name}}" - include_tasks: blocks/helpers/get_realm_keys.yml +- name: "Get current keys list of realm: {{ item[0].name }}" + ansible.builtin.include_tasks: blocks/helpers/get_realm_keys.yml -- set_fact: +- name: Keycloak | keys | configure | set fact + ansible.builtin.set_fact: item0: "{{ item[0] }}" item1: "{{ item[1] }}" -- include_tasks: blocks/keys/create_javakeystores.yml +- name: Keycloak | keys | configure | set fact + ansible.builtin.include_tasks: blocks/keys/create_javakeystores.yml when: item1.keystore_config is defined -- name: "Install {{ item1.providerId }} key with name '{{ item1.name }}'" - uri: +- name: "Install {{ item1.providerId }} key with name '{{ item1.name }}'" # noqa name[template] + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ item0.name }}/components" method: POST body_format: json @@ -23,28 +25,27 @@ body: name: "{{ item1.name }}" providerId: "{{ item1.providerId }}" - providerType: org.keycloak.keys.KeyProvider #never change this + providerType: org.keycloak.keys.KeyProvider # never change this parentId: "{{ item0.name }}" config: "{{ item1.config }}" status_code: 201 run_once: true - when: keys_provideridName2id[item1.providerId + ':' + item1.name] is not defined + when: keys_providerid_name_2_id[item1.providerId + ':' + item1.name] is not defined - -- name: "Update {{ item1.providerId }} key with name '{{ item1.name }}'" - uri: - url: "{{ keycloak_proxy_host }}/admin/realms/{{ item0.name }}/components/{{ keys_provideridName2id[item1.providerId + ':' + item1.name] }}" +- name: "Update {{ item1.providerId }} key with name '{{ item1.name }}'" # noqa name[template] + ansible.builtin.uri: + url: "{{ keycloak_proxy_host }}/admin/realms/{{ item0.name }}/components/{{ keys_providerid_name_2_id[item1.providerId + ':' + item1.name] }}" method: PUT body_format: json headers: Authorization: "Bearer {{ tokens.json.access_token }}" body: - id: "{{ keys_provideridName2id[item1.providerId + ':' + item1.name] }}" + id: "{{ keys_providerid_name_2_id[item1.providerId + ':' + item1.name] }}" name: "{{ item1.name }}" providerId: "{{ item1.providerId }}" - providerType: org.keycloak.keys.KeyProvider #never change this + providerType: org.keycloak.keys.KeyProvider # never change this parentId: "{{ item0.name }}" config: "{{ item1.config }}" status_code: 204 run_once: true - when: keys_provideridName2id[item1.providerId + ':' + item1.name] is defined + when: keys_providerid_name_2_id[item1.providerId + ':' + item1.name] is defined diff --git a/roles/keycloak/tasks/blocks/keys/create_javakeystores.yml b/roles/keycloak/tasks/blocks/keys/create_javakeystores.yml index 7a499f56..a31523f6 100644 --- a/roles/keycloak/tasks/blocks/keys/create_javakeystores.yml +++ b/roles/keycloak/tasks/blocks/keys/create_javakeystores.yml @@ -1,17 +1,17 @@ --- - +# tasks/blocks/keys/create_javakeystores.yml - name: Acquire tokens - include_tasks: blocks/helpers/get_tokens.yml + ansible.builtin.include_tasks: blocks/helpers/get_tokens.yml - name: Create the java keystores folder (if it doesn't exist) ansible.builtin.file: path: "{{ keycloak_keystores }}/{{ item[0].name }}" - recurse: yes + recurse: true state: directory - mode: 0500 + mode: "0500" owner: "{{ keycloak_service_user }}" group: "{{ keycloak_service_user }}" - become: yes + become: true run_once: false - name: Create a keystore for the given certificate/private key pair (inline) @@ -22,17 +22,18 @@ private_key_passphrase: "{{ item[1].keystore_config.key_passphrase }}" password: "{{ item[1].keystore_config.keystore_password }}" dest: "{{ keycloak_keystores }}/{{ item[0].name }}/{{ item[1].keystore_config.key_alias }}.jks" - mode: 0400 + mode: "0400" owner: "{{ keycloak_service_user }}" group: "{{ keycloak_service_user }}" - become: yes + become: true run_once: false # Now modify the item[1] to match the expected one # 1) assemble the correct item[1].config (fuse with keystore_config) # 2) remove the item[1].keystore_config -- set_fact: +- name: Keycloak | keys | modify to match the expected + ansible.builtin.set_fact: additional_config: config: keystore: @@ -44,19 +45,23 @@ keyPassword: - "{{ item[1].keystore_config.key_passphrase }}" -- set_fact: # add the correct - item1_fused: "{{ item[1] | combine(additional_config, recursive=True ) }}" +- name: Keycloak | keys | add the correct + ansible.builtin.set_fact: + item1_fused: "{{ item[1] | combine(additional_config, recursive=True) }}" -- set_fact: +- name: Keycloak | keys | + ansible.builtin.set_fact: item1_fused_cleaned: {} -- set_fact: +- name: Keycloak | keys | + ansible.builtin.set_fact: item1_fused_cleaned: "{{ item1_fused_cleaned | combine({keypair.key: keypair.value}) }}" when: keypair.key != "keystore_config" loop_control: loop_var: keypair with_dict: "{{ item1_fused }}" -- set_fact: +- name: Keycloak | keys | + ansible.builtin.set_fact: item0: "{{ item[0] }}" item1: "{{ item1_fused_cleaned }}" diff --git a/roles/keycloak/tasks/blocks/roles_configuration/clients/add_remove_client_default_roles.yml b/roles/keycloak/tasks/blocks/roles_configuration/clients/add_remove_client_default_roles.yml index 9d1a7243..19926217 100644 --- a/roles/keycloak/tasks/blocks/roles_configuration/clients/add_remove_client_default_roles.yml +++ b/roles/keycloak/tasks/blocks/roles_configuration/clients/add_remove_client_default_roles.yml @@ -8,20 +8,21 @@ - name: Acquire tokens - include_tasks: blocks/helpers/get_tokens.yml + ansible.builtin.include_tasks: blocks/helpers/get_tokens.yml -- set_fact: +- name: Keycloak | roles | clients | set fact + ansible.builtin.set_fact: body: "{{ client_roles | json_query(query) | default([]) }}" vars: - query: "{% if client_default_role_mode=='add' %}[?contains(`{{ realm_and_client_roles[1].add | to_json }}`, name)]{% elif client_default_role_mode=='remove' %}[?contains(`{{ realm_and_client_roles[1].remove | to_json }}`, name)]{% endif %}" + query: "{% if client_default_role_mode == 'add' %}[?contains(`{{ realm_and_client_roles[1].add | to_json }}`, name )]{% elif client_default_role_mode == 'remove' %}[?contains(`{{ realm_and_client_roles[1].remove | to_json }}`, name )]{% endif %}" # noqa yaml[line-length] -- name: "{{ client_default_role_mode }} default-roles in realm {{ realm_and_client_roles[0].name }}" - uri: - url: "{{ keycloak_proxy_host }}/admin/realms/{{ realm_and_client_roles[0].name }}/roles/default-roles-{{ realm_and_client_roles[0].name | lower }}/composites" - method: "{% if client_default_role_mode=='add' %}POST{% elif client_default_role_mode=='remove' %}DELETE{% endif %}" +- name: "{{ client_default_role_mode }} default-roles in realm {{ realm_and_client_roles[0].name }}" # noqa name[template] + ansible.builtin.uri: + url: "{{ keycloak_proxy_host }}/admin/realms/{{ realm_and_client_roles[0].name }}/roles/default-roles-{{ realm_and_client_roles[0].name | lower }}/composites" # noqa yaml[line-length] + method: "{% if client_default_role_mode == 'add' %}POST{% elif client_default_role_mode == 'remove' %}DELETE{% endif %}" body_format: json headers: Authorization: "Bearer {{ tokens.json.access_token }}" body: "{{ body }}" - status_code: 204 \ No newline at end of file + status_code: 204 diff --git a/roles/keycloak/tasks/blocks/roles_configuration/clients/configure_client_default_roles.yml b/roles/keycloak/tasks/blocks/roles_configuration/clients/configure_client_default_roles.yml index 3ccf499e..b9f65b2e 100644 --- a/roles/keycloak/tasks/blocks/roles_configuration/clients/configure_client_default_roles.yml +++ b/roles/keycloak/tasks/blocks/roles_configuration/clients/configure_client_default_roles.yml @@ -4,38 +4,40 @@ # realm_and_client_roles[1] : the current element of the client_default_roles list - name: Acquire tokens - include_tasks: blocks/helpers/get_tokens.yml + ansible.builtin.include_tasks: blocks/helpers/get_tokens.yml - name: "Find client {{ realm_and_client_roles[1].name }}" - uri: + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ realm_and_client_roles[0].name }}/clients?clientId={{ realm_and_client_roles[1].name }}&max=20&search=true" - method: "GET" + method: GET headers: Authorization: "Bearer {{ tokens.json.access_token }}" status_code: 200 register: found_clients -- set_fact: +- name: Keycloak | roles | clients | set found_client fact + ansible.builtin.set_fact: found_client: "{{ found_clients.json[0] | default() }}" - name: "Find roles of client {{ found_client.clientId }}" - uri: + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ realm_and_client_roles[0].name }}/clients/{{ found_client.id }}/roles" - method: "GET" + method: GET headers: Authorization: "Bearer {{ tokens.json.access_token }}" status_code: 200 register: client_roles -- set_fact: - client_roles: "{{ client_roles.json| default([]) }}" +- name: Keycloak | roles | clients | set client_roles fact + ansible.builtin.set_fact: + client_roles: "{{ client_roles.json | default([]) }}" -- name: "Call default client roles updater (mode 'add')" - include_tasks: blocks/roles_configuration/clients/add_remove_client_default_roles.yml +- name: Call default client roles updater (mode 'add') + ansible.builtin.include_tasks: blocks/roles_configuration/clients/add_remove_client_default_roles.yml vars: client_default_role_mode: add -- name: "Call default client roles updater (mode 'remove')" - include_tasks: blocks/roles_configuration/clients/add_remove_client_default_roles.yml +- name: Call default client roles updater (mode 'remove') + ansible.builtin.include_tasks: blocks/roles_configuration/clients/add_remove_client_default_roles.yml vars: client_default_role_mode: remove diff --git a/roles/keycloak/tasks/blocks/roles_configuration/configure.yml b/roles/keycloak/tasks/blocks/roles_configuration/configure.yml index 1ef08d0c..13199d28 100644 --- a/roles/keycloak/tasks/blocks/roles_configuration/configure.yml +++ b/roles/keycloak/tasks/blocks/roles_configuration/configure.yml @@ -1,7 +1,7 @@ --- - name: Setup roles - include_tasks: configure_roles.yml + ansible.builtin.include_tasks: configure_roles.yml with_subelements: - "{{ keycloak_config.realms | default([]) }} " - "role_management.roles" @@ -9,7 +9,7 @@ run_once: true - name: Setup default roles (add) - include_tasks: configure_default_roles.yml + ansible.builtin.include_tasks: configure_default_roles.yml with_subelements: - "{{ keycloak_config.realms | default([]) }} " - "role_management.default_roles.add" @@ -19,7 +19,7 @@ run_once: true - name: Setup default roles (remove) - include_tasks: configure_default_roles.yml + ansible.builtin.include_tasks: configure_default_roles.yml with_subelements: - "{{ keycloak_config.realms | default([]) }} " - "role_management.default_roles.remove" @@ -29,7 +29,7 @@ run_once: true - name: Setup composite roles - include_tasks: configure_role_composites.yml + ansible.builtin.include_tasks: configure_role_composites.yml with_subelements: - "{{ keycloak_config.realms | default([]) }} " - "role_management.composite_roles" @@ -37,7 +37,7 @@ run_once: true - name: Setup client default roles - include_tasks: blocks/roles_configuration/clients/configure_client_default_roles.yml + ansible.builtin.include_tasks: blocks/roles_configuration/clients/configure_client_default_roles.yml with_subelements: - "{{ keycloak_config.realms | default([]) }} " - "role_management.client_default_roles" diff --git a/roles/keycloak/tasks/blocks/roles_configuration/configure_default_roles.yml b/roles/keycloak/tasks/blocks/roles_configuration/configure_default_roles.yml index f7a4b823..d438054c 100644 --- a/roles/keycloak/tasks/blocks/roles_configuration/configure_default_roles.yml +++ b/roles/keycloak/tasks/blocks/roles_configuration/configure_default_roles.yml @@ -1,10 +1,10 @@ --- - name: Acquire tokens - include_tasks: blocks/helpers/get_tokens.yml + ansible.builtin.include_tasks: blocks/helpers/get_tokens.yml -- name: "Find full payload of all roles in the '{{ default_role_mode }}' list" - uri: +- name: "Find full payload of all roles in the list '{{ default_role_mode }}'" + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/roles/{{ default_role_name }}" method: "GET" headers: @@ -15,20 +15,20 @@ with_items: "{{ item[1] }}" register: search_results -- set_fact: +- name: Keycloak | roles | set default_roles_list fact + ansible.builtin.set_fact: default_roles_list_complete: "{{ search_results | json_query(query) | default([]) }}" vars: query: 'results[].json' + +# Better to have two separate tasks here. - name: "Edit default-roles in realm {{ item[0].name }}" - uri: + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/roles/default-roles-{{ item[0].name | lower }}/composites" - method: "{% if default_role_mode=='add' %}POST{% elif default_role_mode=='remove' %}DELETE{% endif %}" + method: "{% if default_role_mode == 'add' %}POST{% elif default_role_mode == 'remove' %}DELETE{% endif %}" body_format: json headers: Authorization: "Bearer {{ tokens.json.access_token }}" - body: - "{{ default_roles_list_complete }}" + body: "{{ default_roles_list_complete }}" status_code: 204 - - diff --git a/roles/keycloak/tasks/blocks/roles_configuration/configure_role_composites.yml b/roles/keycloak/tasks/blocks/roles_configuration/configure_role_composites.yml index bcedad79..a0cf2aa6 100644 --- a/roles/keycloak/tasks/blocks/roles_configuration/configure_role_composites.yml +++ b/roles/keycloak/tasks/blocks/roles_configuration/configure_role_composites.yml @@ -1,12 +1,11 @@ --- - - name: Acquire tokens - include_tasks: blocks/helpers/get_tokens.yml + ansible.builtin.include_tasks: blocks/helpers/get_tokens.yml -- name: "Find full payload of all roles in the composite list" - uri: +- name: Find full payload of all roles in the composite list + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/roles/{{ composite_name }}" - method: "GET" + method: GET headers: Authorization: "Bearer {{ tokens.json.access_token }}" status_code: 200 @@ -15,14 +14,15 @@ with_items: "{{ item[1].composites }}" register: search_results -- set_fact: +- name: Keycloak | roles | Set composite_list_complete fact + ansible.builtin.set_fact: composite_list_complete: "{{ search_results | json_query(query) | default([]) }}" vars: query: 'results[].json' -- name: "Add composites of role {{ item[1].name }} in realm {{ item[0].name }}" - uri: +- name: "Add composites of role {{ item[1].name }} in realm {{ item[0].name }}" # noqa name[template] + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/roles/{{ item[1].name }}/composites" method: "POST" body_format: json diff --git a/roles/keycloak/tasks/blocks/roles_configuration/configure_roles.yml b/roles/keycloak/tasks/blocks/roles_configuration/configure_roles.yml index 7eaf6f87..e7263bf0 100644 --- a/roles/keycloak/tasks/blocks/roles_configuration/configure_roles.yml +++ b/roles/keycloak/tasks/blocks/roles_configuration/configure_roles.yml @@ -1,10 +1,9 @@ --- - - name: Acquire tokens - include_tasks: blocks/helpers/get_tokens.yml + ansible.builtin.include_tasks: blocks/helpers/get_tokens.yml -- name: "Get the role {{ item[1].name }} from realm {{ item[0].name }}" - uri: +- name: "Get the role {{ item[1].name }} from realm {{ item[0].name }}" # noqa name[template] + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/roles/{{ item[1].name }}" method: "GET" headers: @@ -12,16 +11,29 @@ status_code: [200, 404] register: realm_role_inquiry -- set_fact: +- name: Keycloak | Roles configuration | set role exists + ansible.builtin.set_fact: current_role_exists: "{% if realm_role_inquiry.status == 200 %}true{% else %}false{% endif %}" -- name: "{% if current_role_exists %}Update{% else %}Update{% endif %} the role {{ item[1].name }} in realm {{ item[0].name }}" - uri: - url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/roles{% if current_role_exists %}/{{ item[1].name }}{% endif %}" - method: "{% if current_role_exists %}PUT{% else %}POST{% endif %}" +# Probably better to define separate tasks and skip based on the fact +- name: Update the role in realm + ansible.builtin.uri: + url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/roles" + method: PUT + body_format: json + headers: + Authorization: "Bearer {{ tokens.json.access_token }}" + body: "{{ item[1] }}" + status_code: 204 + when: (current_role_exists | bool) + +- name: Create role in realm + ansible.builtin.uri: + url: "{{ keycloak_proxy_host }}/admin/realms/{{ item[0].name }}/roles/{{ item[1].name }}" + method: POST body_format: json headers: Authorization: "Bearer {{ tokens.json.access_token }}" - body: - "{{ item[1] }}" - status_code: "{% if current_role_exists %}204{% else %}201{% endif %}" + body: "{{ item[1] }}" + status_code: 201 + when: not (current_role_exists | bool) diff --git a/roles/keycloak/tasks/configure.yml b/roles/keycloak/tasks/configure.yml index 771b86fd..d63139dd 100644 --- a/roles/keycloak/tasks/configure.yml +++ b/roles/keycloak/tasks/configure.yml @@ -1,55 +1,52 @@ --- - # this is an important block! Do not remove - name: Wait for keycloak to initialize block: - - name: Ensure Keycloak service is running - systemd: - name: "keycloak" - state: "started" - become: yes - #wait for port to open - - name: Waiting for service port to be opened... - wait_for: - host: "{{ keycloak_local_address }}" - port: 8080 - delay: 10 - timeout: 180 - #wait for service to respond - - name: Waiting for service to be up and running... - uri: - url: "http://{{ keycloak_local_address }}:8080/{{ keycloak_base_url_path }}" - status_code: "200" - timeout: 600 - + - name: Ensure Keycloak service is running + ansible.builtin.systemd: + name: keycloak + state: started + become: true + - name: Waiting for service port to be opened... + ansible.builtin.wait_for: + host: "{{ keycloak_local_address }}" + port: 8080 + delay: 10 + timeout: 180 + - name: Waiting for service to be up and running... + ansible.builtin.uri: + url: "http://{{ keycloak_local_address }}:8080/{{ keycloak_base_url_path }}" + status_code: 200 + timeout: 600 # configure AUP, realm keys, etc - name: Configure the keycloak (AUP, realm keys, etc) + tags: + - keycloak:config:realm block: - - name: Apply realm.config parameters - include_tasks: blocks/configure_basic_realm.yml + ansible.builtin.include_tasks: blocks/configure_basic_realm.yml with_items: "{{ keycloak_config.realms | default([]) }}" loop_control: loop_var: current_realm_item run_once: true - name: Configure keys - include_tasks: blocks/keys/configure_keys.yml + ansible.builtin.include_tasks: blocks/keys/configure_keys.yml with_subelements: - "{{ keycloak_config.realms | default([]) }} " - - "keys" - - skip_missing: True + - keys + - skip_missing: true - name: Configure events logging - include_tasks: blocks/configure_event_logging.yml + ansible.builtin.include_tasks: blocks/configure_event_logging.yml with_items: "{{ keycloak_config.realms | default([]) }}" loop_control: loop_var: current_realm_item run_once: true - name: Configure AUP (Terms and Conditions) - uri: + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ item.name }}/authentication/required-actions/{{ keycloak_api.terms_and_conditions.endpoint }}" method: PUT body_format: json @@ -71,66 +68,66 @@ run_once: true - name: Setup roles - include_tasks: blocks/roles_configuration/configure.yml + ansible.builtin.include_tasks: blocks/roles_configuration/configure.yml - name: Setup federations - include_tasks: blocks/configure_federations.yml + ansible.builtin.include_tasks: blocks/configure_federations.yml with_subelements: - "{{ keycloak_config.realms | default([]) }} " - "federations" - - skip_missing: True + - skip_missing: true run_once: true - name: Setup social IdPs - include_tasks: blocks/configure_social_idps.yml + ansible.builtin.include_tasks: blocks/configure_social_idps.yml with_subelements: - "{{ keycloak_config.realms | default([]) }} " - "social_idps" - - skip_missing: True + - skip_missing: true run_once: true - name: Setup saml IdPs - include_tasks: blocks/configure_saml_idps.yml + ansible.builtin.include_tasks: blocks/configure_saml_idps.yml with_subelements: - "{{ keycloak_config.realms | default([]) }} " - - "saml_idps" - - skip_missing: True + - saml_idps + - skip_missing: true run_once: true - name: Setup IdP mappers - include_tasks: blocks/configure_idp_mappers.yml + ansible.builtin.include_tasks: blocks/configure_idp_mappers.yml with_subelements: - "{{ keycloak_config.realms | default([]) }} " - - "idp_mappers" - - skip_missing: True + - idp_mappers + - skip_missing: true run_once: true - name: "Check if there is any default IdP (will skip the WAYF and redirect to that one) defined" - include_tasks: blocks/configure_default_idp.yml + ansible.builtin.include_tasks: blocks/configure_default_idp.yml with_items: "{{ keycloak_config.realms | default([]) }}" loop_control: loop_var: current_realm - name: "Configure client scopes (block)" + tags: + - "keycloak:config:realm:client_scopes" block: - name: "Clear all assigned default and optional client scopes" - include_tasks: blocks/helpers/unassign_default_client_scopes.yml + ansible.builtin.include_tasks: blocks/helpers/unassign_default_client_scopes.yml with_items: "{{ keycloak_config.realms | default([]) }}" loop_control: loop_var: current_realm run_once: true - name: "Add new / update existing client scopes" - include_tasks: blocks/configure_client_scopes.yml + ansible.builtin.include_tasks: blocks/configure_client_scopes.yml with_subelements: - - "{{keycloak_config.realms | default([])}} " + - "{{ keycloak_config.realms | default([]) }} " - "client_scopes" - - skip_missing: True + - skip_missing: true run_once: true - tags: - - "keycloak:config:realm:client_scopes" - name: "Configure client registration policies" - include_tasks: blocks/configure_client_reg_policies.yml + ansible.builtin.include_tasks: blocks/configure_client_reg_policies.yml with_items: "{{ keycloak_config.realms | default([]) }}" loop_control: loop_var: current_realm @@ -138,33 +135,36 @@ tags: - "keycloak:config:realm:client_reg_policies" - tags: "keycloak:config:realm" - ### wayf plugin configuration - name: Configure wayf plugin - block: - - name: Acquire tokens - include_tasks: blocks/helpers/get_tokens.yml - - name: "Configure wayf plugin" - include_tasks: blocks/configure_theme.yml - with_items: "{{ keycloak_plugins.wayf.theme.add_to_realms }}" - - when: wayf_enabled == true + when: wayf_enabled | bool vars: wayf_enabled: "{{ keycloak_plugins.wayf.enabled | default(false) }}" tags: - "keycloak:config:plugin" - "keycloak:config:plugin:wayf" + block: + - name: Acquire tokens + ansible.builtin.include_tasks: blocks/helpers/get_tokens.yml + - name: "Configure wayf plugin" + ansible.builtin.include_tasks: blocks/configure_theme.yml + with_items: "{{ keycloak_plugins.wayf.theme.add_to_realms }}" ### advanced group management plugin - name: Configure advanced group management plugin + when: group_enabled | bool + vars: + group_enabled: "{{ keycloak_plugins.group.enabled | default(false) }}" + tags: + - keycloak:config:plugin + - keycloak:config:plugin:group block: - name: Acquire tokens - include_tasks: blocks/helpers/get_tokens.yml + ansible.builtin.include_tasks: blocks/helpers/get_tokens.yml - name: Configure user attribute configuration for advanced group management plugin - uri: + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/realms/{{ item.name }}/agm/admin/member-user-attribute/configuration" - method: "POST" + method: POST body_format: json headers: Authorization: "Bearer {{ tokens.json.access_token }}" @@ -174,26 +174,22 @@ with_items: "{{ keycloak_plugins.group.add_to_realms }}" run_once: true vars: - - body_payload: - userAttribute: "{{ item.member_user_attribute_configuration.userAttribute }}" - urnNamespace: "{{ item.member_user_attribute_configuration.urnNamespace }}" - authority: "{{ item.member_user_attribute_configuration.authority }}" - - when: group_enabled == true - vars: - group_enabled: "{{ keycloak_plugins.group.enabled | default(false) }}" - tags: - - "keycloak:config:plugin" - - "keycloak:config:plugin:group" + body_payload: + userAttribute: "{{ item.member_user_attribute_configuration.userAttribute }}" + urnNamespace: "{{ item.member_user_attribute_configuration.urnNamespace }}" + authority: "{{ item.member_user_attribute_configuration.authority }}" - name: Configure Keycloak themes + tags: + - keycloak:config:realm + - keycloak:config:realm:themes block: - name: Acquire tokens - include_tasks: blocks/helpers/get_tokens.yml + ansible.builtin.include_tasks: blocks/helpers/get_tokens.yml - name: Configure Keycloak themes - uri: + ansible.builtin.uri: url: "{{ keycloak_proxy_host }}/admin/realms/{{ item.name }}" - method: "PUT" + method: PUT body_format: json headers: Authorization: "Bearer {{ tokens.json.access_token }}" @@ -203,10 +199,7 @@ with_items: "{{ keycloak_config.realms | default([]) }}" run_once: true vars: - - body_payload: - loginTheme: "{{ item.themes.login | default(keycloak_themes.login) | default(omit) }}" - accountTheme: "{{ item.themes.account | default(keycloak_themes.account) | default(omit) }}" - emailTheme: "{{ item.themes.email | default(keycloak_themes.email) | default(omit) }}" - tags: - - "keycloak:config:realm" - - "keycloak:config:realm:themes" + body_payload: + loginTheme: "{{ item.themes.login | default(keycloak_themes.login) | default(omit) }}" + accountTheme: "{{ item.themes.account | default(keycloak_themes.account) | default(omit) }}" + emailTheme: "{{ item.themes.email | default(keycloak_themes.email) | default(omit) }}" diff --git a/roles/keycloak/tasks/java/Debian-bookworm.yml b/roles/keycloak/tasks/java/Debian-bookworm.yml index c221e002..4a273c80 100644 --- a/roles/keycloak/tasks/java/Debian-bookworm.yml +++ b/roles/keycloak/tasks/java/Debian-bookworm.yml @@ -1,8 +1,7 @@ --- - - name: Ensure Java 17 is installed - apt: + ansible.builtin.apt: name: openjdk-17-jdk state: present - update_cache: yes - become: yes \ No newline at end of file + update_cache: true + become: true diff --git a/roles/keycloak/tasks/java/Debian-bullseye.yml b/roles/keycloak/tasks/java/Debian-bullseye.yml index 9a2d0c23..cf51bfc5 100644 --- a/roles/keycloak/tasks/java/Debian-bullseye.yml +++ b/roles/keycloak/tasks/java/Debian-bullseye.yml @@ -1,8 +1,7 @@ --- - - name: Ensure Java 11 is installed - apt: + ansible.builtin.apt: name: openjdk-11-jdk state: present - update_cache: yes - become: yes + update_cache: true + become: true diff --git a/roles/keycloak/tasks/java/Debian-buster.yml b/roles/keycloak/tasks/java/Debian-buster.yml index eecb7f68..042c3d06 100644 --- a/roles/keycloak/tasks/java/Debian-buster.yml +++ b/roles/keycloak/tasks/java/Debian-buster.yml @@ -1,9 +1,8 @@ --- - - name: Ensure that the vm has java 11 - apt: + ansible.builtin.apt: name: openjdk-11-jdk state: present - update_cache: yes + update_cache: true cache_valid_time: 86400 - become: yes + become: true diff --git a/roles/keycloak/tasks/java/Ubuntu-focal.yml b/roles/keycloak/tasks/java/Ubuntu-focal.yml index eecb7f68..042c3d06 100644 --- a/roles/keycloak/tasks/java/Ubuntu-focal.yml +++ b/roles/keycloak/tasks/java/Ubuntu-focal.yml @@ -1,9 +1,8 @@ --- - - name: Ensure that the vm has java 11 - apt: + ansible.builtin.apt: name: openjdk-11-jdk state: present - update_cache: yes + update_cache: true cache_valid_time: 86400 - become: yes + become: true diff --git a/roles/keycloak/tasks/main.yml b/roles/keycloak/tasks/main.yml index 40faa2a8..681cb095 100644 --- a/roles/keycloak/tasks/main.yml +++ b/roles/keycloak/tasks/main.yml @@ -1,162 +1,172 @@ --- - ## start the installation of keycloak - name: Include OS-specific variables - include_vars: "{{ item }}" + ansible.builtin.include_vars: "{{ item }}" with_first_found: - "os/{{ ansible_distribution }}-{{ ansible_distribution_release }}.yml" - "os/{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml" - "os/{{ ansible_distribution }}.yml" - "os/{{ ansible_os_family }}.yml" - ignore_errors: yes + ignore_errors: true # noqa ignore-errors tags: - always -- block: +- name: Keycloak | Set vars + tags: + - always + block: - name: Split Keycloak version string into parts - set_fact: + ansible.builtin.set_fact: keycloak_version_parts: "{{ keycloak_version.split('.') }}" - name: Define Keycloak major version number - set_fact: + ansible.builtin.set_fact: keycloak_major_version: "{{ keycloak_version_parts[0] }}" tags: - always - name: Define Keycloak minor version number - set_fact: + ansible.builtin.set_fact: keycloak_minor_version: "{{ keycloak_version_parts[1] }}" tags: - always - name: Define Keycloak patch version number only when specified in version string - set_fact: + ansible.builtin.set_fact: keycloak_patch_version: "{{ keycloak_version_parts[2] | default(omit) }}" - tags: - - always - name: Include keycloak-specific variables - include_vars: "{{ item }}" + ansible.builtin.include_vars: "{{ item }}" with_first_found: - "keycloak-{{ keycloak_major_version }}.{{ keycloak_minor_version }}.yml" - "keycloak-{{ keycloak_major_version }}.yml" - ignore_errors: yes + ignore_errors: true # noqa ignore-errors tags: - always -### Install Java with OS-specific packages -- include: "java/{{ ansible_distribution }}-{{ ansible_distribution_release }}.yml" +- name: Install Java with OS-specific packages + ansible.builtin.include_tasks: "java/{{ ansible_distribution }}-{{ ansible_distribution_release }}.yml" tags: - always - name: Find local keycloak address - set_fact: - keycloak_local_address: "{% if ansible_facts.default_ipv4.address is defined %}{{ ansible_facts.default_ipv4.address }}{% elif ansible_facts.default_ipv6.address is defined %}{{ ansible_facts.default_ipv6.address }}{% else %}localhost{% endif %}" + ansible.builtin.set_fact: + keycloak_local_address: >- + {% if ansible_facts.default_ipv4.address is defined %} + {{ ansible_facts.default_ipv4.address }} + {% elif ansible_facts.default_ipv6.address is defined %} + {{ ansible_facts.default_ipv6.address }} + {% else %} + localhost + {% endif %} tags: - always ### create keycloak_service_user - name: Create Keycloak service user/group - user: + ansible.builtin.user: name: "{{ keycloak_service_user }}" home: /nonexistent shell: /usr/sbin/nologin - system: yes - create_home: no - become: yes + system: true + create_home: false + become: true tags: - always ### setup the logs folder (also do some actions to preserve backwards compatibility) -- name: "Setup logs folder" - include_tasks: "blocks/helpers/setup_logs_folder.yml" +- name: Setup logs folder + ansible.builtin.include_tasks: "blocks/helpers/setup_logs_folder.yml" tags: "keycloak:install:setup_logs_folder" -#### Extract keycloak from archive -- block: +- name: Extract keycloak from archive + block: - name: "Task block: Download keycloak" + become: true block: - name: Create keycloak temp directory - file: + ansible.builtin.file: path: "/tmp/keycloak-tmp" state: directory + mode: "0755" - name: Download keycloak archive file - get_url: + ansible.builtin.get_url: url: "{{ keycloak_archive_url }}" - dest: "/tmp/keycloak_archive" + dest: /tmp/keycloak_archive timeout: 30 + mode: "0644" - name: Compute sha1 hash of archive - stat: + ansible.builtin.stat: path: "/tmp/keycloak_archive" checksum_algorithm: sha1 register: keycloak_sha1 - name: Create keycloak_home if not exists - file: + ansible.builtin.file: path: "{{ keycloak_home }}" state: directory - - name: create empty file if not exists + mode: "0755" + - name: Create empty file if not exists ansible.builtin.copy: dest: "{{ keycloak_home }}/sha1" content: "" - force: no - - name: Previous sha1 - shell: "cat {{ keycloak_home }}/sha1" + force: false + mode: "0644" + - name: Previous sha1 # noqa command-instead-of-shell + ansible.builtin.shell: "cat {{ keycloak_home }}/sha1" + changed_when: false register: previous_sha1 - - name: "Compare sha1" - set_fact: + - name: Compare sha1 + ansible.builtin.set_fact: is_same_archive: "{{ true if keycloak_sha1.stat.checksum == previous_sha1.stdout else false }}" - become: yes - name: "Task block: Extract keycloak" + become: true + when: not is_same_archive block: - - name: unpack keycloak - unarchive: - src: "/tmp/keycloak_archive" - dest: "/tmp/keycloak-tmp" + - name: Unpack keycloak + ansible.builtin.unarchive: + src: /tmp/keycloak_archive + dest: /tmp/keycloak-tmp owner: "{{ keycloak_service_user }}" group: "{{ keycloak_service_user }}" - remote_src: yes - extra_opts: "--no-same-owner" #since it's run with elevated priviledges, to avoid preserving ownership from the archive + remote_src: true + extra_opts: "--no-same-owner" # since it's run with elevated priviledges, to avoid preserving ownership from the archive - name: Find keycloak extracted folder name - find: + ansible.builtin.find: paths: /tmp/keycloak-tmp - patterns: 'keycloak*' + patterns: "keycloak*" file_type: directory - recurse: no + recurse: false register: find_result - name: Remove any previous installation ansible.builtin.file: path: "{{ keycloak_home }}" state: absent - name: Move extracted keycloak to final keycloak folder - command: "mv {{ find_result.files[0].path }} {{ keycloak_home }}" + ansible.builtin.command: "mv {{ find_result.files[0].path }} {{ keycloak_home }}" args: removes: "{{ find_result.files[0].path }}" creates: "{{ keycloak_home }}" - name: Store previous sha1 - copy: + ansible.builtin.copy: dest: "{{ keycloak_home }}/sha1" content: "{{ keycloak_sha1.stat.checksum }}" - become: yes - when: not is_same_archive - + mode: "0644" always: - name: Delete downloaded archive ansible.builtin.file: - path: "/tmp/keycloak_archive" + path: /tmp/keycloak_archive state: absent - become: yes - tags: "keycloak:install:download_extract" - -- import_tasks: "quarkus/install.yml" +- name: Keycloak | import quarkus install tasks + ansible.builtin.import_tasks: "quarkus/install.yml" when: keycloak_version.split('.')[0] | int >= 18 -- import_tasks: "wildfly/install.yml" +- name: Keycloak | import wildfly install + ansible.builtin.import_tasks: wildfly/install.yml when: keycloak_version.split('.')[0] | int < 18 - ##### configure keycloak - name: Configure various keycloak aspects - import_tasks: "configure.yml" + ansible.builtin.import_tasks: "configure.yml" tags: "keycloak:config" diff --git a/roles/keycloak/tasks/quarkus/install.yml b/roles/keycloak/tasks/quarkus/install.yml index 76c7c3d2..72b5c250 100644 --- a/roles/keycloak/tasks/quarkus/install.yml +++ b/roles/keycloak/tasks/quarkus/install.yml @@ -1,92 +1,89 @@ --- - -##### Set service user as owner of keycloak base dir -- block: +- name: Set service user as owner of keycloak base dir + become: true + tags: "keycloak:install:setup_file_permissions" + block: - name: "Setting everything under keycloak_home dir to belong to user: {{ keycloak_service_user }}" - file: + ansible.builtin.file: dest: "{{ keycloak_home }}" owner: "{{ keycloak_service_user }}" group: "{{ keycloak_service_user }}" - recurse: yes - become: yes - tags: "keycloak:install:setup_file_permissions" + recurse: true ######### Install configuration templates -- block: - +- name: Install configuration templates + tags: "keycloak:install:config" + block: - name: Set the appropriate permissions for the keycloak's config folder - file: + ansible.builtin.file: path: "{{ keycloak_home }}/conf" state: directory - mode: 0700 - become: yes + mode: "0700" + become: true - name: Installing keycloak main configuration (keycloak.conf) - template: - mode: 0600 + ansible.builtin.template: + mode: "0600" owner: "{{ keycloak_service_user }}" group: "{{ keycloak_service_user }}" src: "templates/{{ keycloak_version }}/keycloak.conf.j2" dest: "{{ keycloak_home }}/conf/keycloak.conf" - become: yes + become: true - name: Installing keycloak cache configuration (cache-ispn-jdbc-ping.xml) - template: - mode: 0600 + ansible.builtin.template: + mode: "0600" owner: "{{ keycloak_service_user }}" group: "{{ keycloak_service_user }}" src: "templates/{{ keycloak_version }}/cache-ispn-jdbc-ping.xml.j2" dest: "{{ keycloak_home }}/conf/cache-ispn-jdbc-ping.xml" - become: yes + become: true - name: Installing keycloak quarkus configuration (quarkus.properties) - template: - mode: 0600 + ansible.builtin.template: + mode: "0600" owner: "{{ keycloak_service_user }}" group: "{{ keycloak_service_user }}" src: "templates/{{ keycloak_version }}/quarkus.properties.j2" dest: "{{ keycloak_home }}/conf/quarkus.properties" - become: yes - - tags: "keycloak:install:config" - + become: true #### Setup logcleaner script - name: "Task block: Setup logcleaner script" + become: true + tags: "keycloak:install:setup_logcleaner" block: - name: "Ensure the logs folder exists" - file: + ansible.builtin.file: path: "{{ keycloak_logs_folder }}" state: directory mode: '0755' owner: "{{ keycloak_service_user }}" group: "{{ keycloak_service_user }}" - recurse: yes + recurse: true - name: "Install the logcleaner script template" - template: + ansible.builtin.template: owner: "{{ keycloak_service_user }}" group: "{{ keycloak_service_user }}" - mode: 0644 + mode: "0644" src: templates/logcleaner.sh.j2 dest: "{{ keycloak_home }}/logcleaner.sh" - name: "Create the cronjob" - cron: + ansible.builtin.cron: name: keycloak logcleaner day: "*" hour: "0" minute: "0" user: "{{ keycloak_service_user }}" job: "sh {{ keycloak_home }}/logcleaner.sh {{ keycloak_logs_folder }} {{ keycloak_logs_max_days }}" - become: yes - tags: "keycloak:install:setup_logcleaner" ### install other plugins # would loop over block of tasks within install_plugin.yml, but looping on blocks is not allowed in ansible - name: Install other plugins - include_tasks: "quarkus/install_plugin.yml" + ansible.builtin.include_tasks: quarkus/install_plugin.yml when: keycloak_plugins is defined loop: "{{ lookup('dict', keycloak_plugins, wantlist=True) }}" tags: "keycloak:install:plugins" @@ -94,37 +91,33 @@ #### setup admin user (it's just adding a file with env variables which are picked up by keycloak upon startup) - name: "Set env variables for admin user configuration" - template: + ansible.builtin.template: owner: "{{ keycloak_service_user }}" group: "{{ keycloak_service_user }}" - mode: 0600 + mode: "0600" src: "templates/{{ keycloak_version }}/env.conf.j2" dest: "{{ keycloak_home }}/conf/env.conf" - become: yes + become: true tags: "keycloak:config:setup_admin_user" ############### Setup keycloak as a service - name: "Setup keycloak as a service" - template: + ansible.builtin.template: owner: root group: root - mode: 0644 + mode: "0644" src: templates/keycloak.service.quarkus.j2 dest: /etc/systemd/system/keycloak.service - become: yes + become: true tags: "keycloak:install:systemd_service" - name: "Restart keycloak" - systemd: + ansible.builtin.systemd: name: keycloak state: restarted - daemon_reload: yes - enabled: yes - become: yes + daemon_reload: true + enabled: true + become: true tags: "keycloak:install:restart_sys_service" - - - - diff --git a/roles/keycloak/tasks/quarkus/install_plugin.yml b/roles/keycloak/tasks/quarkus/install_plugin.yml index 247941e3..3587c837 100644 --- a/roles/keycloak/tasks/quarkus/install_plugin.yml +++ b/roles/keycloak/tasks/quarkus/install_plugin.yml @@ -1,20 +1,21 @@ --- - -- block: - - - name: "Installing plugin {{ item.value.name }} with hot deploy" +# keycloak/tasks/quarkus/install_plugin.yml +- name: Why do we have this block? + become: true + when: not item is undefined + tags: "keycloak:install:plugins" + block: + - name: "Installing plugin with hot deploy: {{ item.value.name }}" + when: item.value.hotdeploy is defined block: - name: "Download plugin jar into folder /tmp (for plugin: {{ item.value.name }})" - get_url: + ansible.builtin.get_url: url: "{{ item.value.hotdeploy.jar_url }}" dest: "/tmp/" + mode: "0644" register: download_result - #do not download directly to deployment folder (if it's downloaded slowly or the file is large, the deployment might be broken) + # do not download directly to deployment folder (if it's downloaded slowly or the file is large, the deployment might be broken) - name: "Move into deployment folder (for plugin: {{ item.value.name }})" - command: "mv {{download_result.dest}} {{keycloak_home}}/providers/" - notify: Clear Keycloak cache - when: item.value.hotdeploy is defined - - when: not item is undefined - become: yes - tags: "keycloak:install:plugins" \ No newline at end of file + ansible.builtin.command: "mv {{ download_result.dest }} {{ keycloak_home }}/providers/" + notify: Clear Keycloak cache # This is a really bad idea + changed_when: true # Gonna have to trigger this always diff --git a/roles/keycloak/tasks/wildfly/install.yml b/roles/keycloak/tasks/wildfly/install.yml index 2eafb6a9..5a6098ec 100644 --- a/roles/keycloak/tasks/wildfly/install.yml +++ b/roles/keycloak/tasks/wildfly/install.yml @@ -1,84 +1,90 @@ --- ######## Create postgresql plugin -- name: "Task block: Create postgresql plugin" - block: - - name: create postresql plugin dir with parent directories - file: - path: "{{ keycloak_home }}/modules/system/layers/keycloak/org/postgresql/main" - state: directory - - name: Download postgresql JDBC driver - get_url: - url: "https://jdbc.postgresql.org/download/{{ keycloak_postgresql_jar_name }}" - dest: "{{ keycloak_home }}/modules/system/layers/keycloak/org/postgresql/main" - - name: Installing postgresql plugin - template: - src: templates/module.xml.j2 - dest: "{{ keycloak_home }}/modules/system/layers/keycloak/org/postgresql/main/module.xml" - become: yes +- name: Task block | Create postgresql plugin + become: true tags: "keycloak:install:postgresql_plugin" + block: + - name: Ceate postresql plugin dir with parent directories + ansible.builtin.file: + path: "{{ keycloak_home }}/modules/system/layers/keycloak/org/postgresql/main" + state: directory + mode: "0755" + - name: Download postgresql JDBC driver + ansible.builtin.get_url: + url: "https://jdbc.postgresql.org/download/{{ keycloak_postgresql_jar_name }}" + dest: "{{ keycloak_home }}/modules/system/layers/keycloak/org/postgresql/main" + mode: "0644" + - name: Installing postgresql plugin + ansible.builtin.template: + src: templates/module.xml.j2 + dest: "{{ keycloak_home }}/modules/system/layers/keycloak/org/postgresql/main/module.xml" + mode: "0600" -######## Install template standalone-ha.xml +######## Install template standalone-ha.xml - name: Installing keycloak configuration (standalone-ha.xml) - template: - mode: 0600 + ansible.builtin.template: + mode: "0600" src: "templates/{{ keycloak_version }}/standalone-ha.xml.j2" dest: "{{ keycloak_home }}/standalone/configuration/standalone-ha.xml" - become: yes + become: true tags: "keycloak:install:standaloneha" ##### Set keycloak working dir and logs writable for service user -- name: "Setting standalone folder writable for user: {{ keycloak_service_user }} - where it's internal temporary files are created" - file: +- name: "Setting standalone folder writable for user: where it's internal temporary files are created: {{ keycloak_service_user }}" + ansible.builtin.file: dest: "{{ keycloak_home }}/standalone" owner: "{{ keycloak_service_user }}" group: "{{ keycloak_service_user }}" - recurse: yes - become: yes + recurse: true + become: true tags: "keycloak:install:setup_file_permissions" ############### Setup admin user -- name: "Task block: Setup admin user" - block: - - name: Remove file (delete file if exists) - file: - path: "{{ keycloak_home }}/standalone/configuration/keycloak-add-user.json" - state: absent - - name: Create admin user - shell: "{{ keycloak_home }}/bin/add-user-keycloak.sh -u {{ keycloak_admin.user }} -p {{ keycloak_admin.pass }}" - args: - executable: /bin/bash - become: yes +- name: Task block | Setup admin user" + become: true tags: "keycloak:install:setup_admin" + block: + - name: Remove file (delete file if exists) + ansible.builtin.file: + path: "{{ keycloak_home }}/standalone/configuration/keycloak-add-user.json" + state: absent + - name: Create admin user + ansible.builtin.shell: >- + "{{ keycloak_home }}/bin/add-user-keycloak.sh \ + -u {{ keycloak_admin.user }} \ + -p {{ keycloak_admin.pass }}" + args: + executable: /bin/bash + changed_when: false #### Setup logcleaner script - name: "Task block: Setup logcleaner script" + become: true + tags: "keycloak:install:setup_logcleaner" block: - name: "Install the logcleaner script template" - template: + ansible.builtin.template: owner: "{{ keycloak_service_user }}" group: "{{ keycloak_service_user }}" - mode: 0640 + mode: "0640" src: templates/logcleaner.sh.j2 dest: "{{ keycloak_home }}/logcleaner.sh" - name: "Create the cronjob" - cron: + ansible.builtin.cron: name: keycloak logcleaner day: "*" hour: "0" minute: "0" user: "{{ keycloak_service_user }}" job: "sh {{ keycloak_home }}/logcleaner.sh {{ keycloak_logs_folder }} {{ keycloak_logs_max_days }}" - become: yes - tags: "keycloak:install:setup_logcleaner" - ### install other plugins # would loop over block of tasks within install_plugin.yml, but looping on blocks is not allowed in ansible - name: Install other plugins - include_tasks: "wildfly/install_plugin.yml" + ansible.builtin.include_tasks: "wildfly/install_plugin.yml" when: not keycloak_plugins is undefined loop: "{{ lookup('dict', keycloak_plugins, wantlist=True) }}" tags: "keycloak:install:plugins" @@ -87,24 +93,20 @@ ############### Setup keycloak as a service - name: "Setup keycloak as a service" - template: + ansible.builtin.template: owner: root group: root - mode: 0644 + mode: "0644" src: templates/keycloak.service.wildfly.j2 dest: /etc/systemd/system/keycloak.service - become: yes + become: true tags: "keycloak:install:setup_sys_service" - name: "Restart keycloak" - systemd: + ansible.builtin.systemd: name: keycloak state: restarted - daemon_reload: yes - enabled: yes - become: yes + daemon_reload: true + enabled: true + become: true tags: "keycloak:install:restart_sys_service" - - - - diff --git a/roles/keycloak/tasks/wildfly/install_plugin.yml b/roles/keycloak/tasks/wildfly/install_plugin.yml index 1f315cfd..e7923c33 100644 --- a/roles/keycloak/tasks/wildfly/install_plugin.yml +++ b/roles/keycloak/tasks/wildfly/install_plugin.yml @@ -1,26 +1,32 @@ --- - -- block: - - name: "Installing plugin {{ item.value.name }} as a module" - block: - +# keycloak/tasks/widlfly/install-plugin.yml +- name: Install widlfly plugin + when: not item is undefined + become: true + tags: "keycloak:install:plugins" + ansible.builtin.block: + - name: "Installing plugin as a module: {{ item.value.name }}" + ansible.builtin.block: - name: "Create plugin dir with parent directories (for plugin: {{ item.value.name }})" - file: + ansible.builtin.file: path: "{{ keycloak_home }}/modules/system/layers/keycloak/org/keycloak/{{ item.value.name }}/main" state: directory + mode: "0755" - name: "Download plugin jar (of plugin: {{ item.value.name }})" - get_url: + ansible.builtin.get_url: url: "{{ item.value.module.jar_url }}" dest: "{{ keycloak_home }}/modules/system/layers/keycloak/org/keycloak/{{ item.value.name }}/main/" + mode: "0644" - name: "Install module.xml (for plugin: {{ item.value.name }})" - get_url: + ansible.builtin.get_url: url: "{{ item.value.module.modulexml_url }}" dest: "{{ keycloak_home }}/modules/system/layers/keycloak/org/keycloak/{{ item.value.name }}/main/" + mode: "0644" - name: "Setup keycloak xml providers (for plugin: {{ item.value.name }})" - xml: + community.general.xml: path: "{{ keycloak_home }}/standalone/configuration/standalone-ha.xml" xpath: /srv:server/srv:profile/sub:subsystem/sub:providers input_type: xml @@ -31,7 +37,7 @@ sub: "{{ namespaces.domain_server }}" - name: "Setup keycloak xml theme modules (for plugin: {{ item.value.name }})" - xml: + community.general.xml: path: "{{ keycloak_home }}/standalone/configuration/standalone-ha.xml" xpath: /srv:server/srv:profile/sub:subsystem/sub:theme input_type: xml @@ -41,22 +47,17 @@ srv: "{{ namespaces.domain }}" sub: "{{ namespaces.domain_server }}" when: item.value.theme is defined - when: item.value.module is defined - - name: "Installing plugin {{ item.value.name }} with hot deploy" + - name: "Installing plugin with hot deploy: {{ item.value.name }}" block: - name: "Download plugin jar into folder /tmp (for plugin: {{ item.value.name }})" - get_url: + ansible.builtin.get_url: url: "{{ item.value.hotdeploy.jar_url }}" dest: "/tmp/" register: download_result - #do not download directly to deployment folder (if it's downloaded slowly or the file is large, the deployment might be broken) + # do not download directly to deployment folder (if it's downloaded slowly or the file is large, the deployment might be broken) - name: "Move into deployment folder (for plugin: {{ item.value.name }})" - command: "mv {{download_result.dest}} {{keycloak_home}}/standalone/deployments/" + ansible.builtin.command: "mv {{ download_result.dest }} {{ keycloak_home }}/standalone/deployments/" when: item.value.hotdeploy is defined - - when: not item is undefined - become: yes - tags: "keycloak:install:plugins" \ No newline at end of file diff --git a/roles/keycloak/vars/keycloak-13.yml b/roles/keycloak/vars/keycloak-13.yml index a158abb1..659bff0d 100644 --- a/roles/keycloak/vars/keycloak-13.yml +++ b/roles/keycloak/vars/keycloak-13.yml @@ -1,7 +1,6 @@ # file: keycloak/vars/13.yml # --- - -namespaces: +namespaces: # noqa var-naming[no-role-prefix] domain: "urn:jboss:domain:16.0" domain_server: "urn:jboss:domain:keycloak-server:1.1" diff --git a/roles/keycloak/vars/keycloak-14.yml b/roles/keycloak/vars/keycloak-14.yml index 91898e4d..6deb2d6f 100644 --- a/roles/keycloak/vars/keycloak-14.yml +++ b/roles/keycloak/vars/keycloak-14.yml @@ -2,6 +2,6 @@ # --- -namespaces: +namespaces: # noqa var-naming[no-role-prefix] domain: "urn:jboss:domain:16.0" domain_server: "urn:jboss:domain:keycloak-server:1.1" diff --git a/roles/keycloak/vars/keycloak-15.yml b/roles/keycloak/vars/keycloak-15.yml index 17b6b981..f451a32c 100644 --- a/roles/keycloak/vars/keycloak-15.yml +++ b/roles/keycloak/vars/keycloak-15.yml @@ -1,8 +1,7 @@ # file: keycloak/vars/15.yml # --- - -namespaces: +namespaces: # noqa var-naming[no-role-prefix] domain: "urn:jboss:domain:16.0" domain_server: "urn:jboss:domain:keycloak-server:1.1" diff --git a/roles/keycloak/vars/keycloak-16.yml b/roles/keycloak/vars/keycloak-16.yml index 0bdab65f..40a1c2b4 100644 --- a/roles/keycloak/vars/keycloak-16.yml +++ b/roles/keycloak/vars/keycloak-16.yml @@ -1,8 +1,7 @@ # file: keycloak/vars/16.yml # --- - -namespaces: +namespaces: # noqa var-naming[no-role-prefix] domain: "urn:jboss:domain:19.0" domain_server: "urn:jboss:domain:keycloak-server:1.1" diff --git a/roles/keycloak/vars/os/Debian-buster.yml b/roles/keycloak/vars/os/Debian-buster.yml index 16e57ba5..f67f5985 100644 --- a/roles/keycloak/vars/os/Debian-buster.yml +++ b/roles/keycloak/vars/os/Debian-buster.yml @@ -1,4 +1,4 @@ --- - -#this jar should match with the default version of postgresql of the target machine. i.e. for debian 10, it's the postgresql-42.2.22.jar +# this jar should match with the default version of postgresql of the target machine. +# i.e. for debian 10, it's the postgresql-42.2.22.jar keycloak_postgresql_jar_name: "postgresql-42.2.22.jar" diff --git a/roles/letsencrypt/defaults/main.yml b/roles/letsencrypt/defaults/main.yml index 399fd148..4ccda14c 100644 --- a/roles/letsencrypt/defaults/main.yml +++ b/roles/letsencrypt/defaults/main.yml @@ -1,7 +1,9 @@ --- # this should have value either "snap" or "os_repo" -install_from: "snap" +letsencrypt_install_from: "snap" -# Email address for important account notifications. For example, Let’s Encrypt will automatically send expiry notices to this email address when your certificate is coming up for renewal -#letsencrypt_email: "bob.builder@example.org" +# Email address for important account notifications. +# For example, Let’s Encrypt will automatically send expiry notices +# to this email address when your certificate is coming up for renewal +# letsencrypt_email: "bob.builder@example.org" diff --git a/roles/letsencrypt/tasks/install-Debian.yml b/roles/letsencrypt/tasks/install-Debian.yml index fea74409..5f55ae77 100644 --- a/roles/letsencrypt/tasks/install-Debian.yml +++ b/roles/letsencrypt/tasks/install-Debian.yml @@ -1,43 +1,56 @@ --- - - name: Install certbot from snap + become: true + when: letsencrypt_install_from == "snap" block: - - name: "Required packages" - apt: + - name: Required packages + ansible.builtin.apt: name: - snapd - python-simplejson state: present - name: Ensure versions of certbot from apt are not present - apt: + ansible.builtin.apt: name: - certbot state: absent - - name: snap install core - snap: + - name: Snap install core + community.general.snapsnap: name: core - - name: snap install certbot - snap: + - name: Snap install certbot + community.general.snap: name: certbot - classic: yes + classic: true - name: Prepare certbot folders - shell: "ln -sf /snap/bin/certbot /usr/bin/certbot" - when: {{ install_from }} == "snap" + ansible.builtin.file: + src: /snap/bin/certbot + dest: /usr/bin/certbot + owner: root + group: root + state: link - name: Install certbot from debian repo + become: true + when: letsencrypt_install_from == "os_repo" block: - - name: "Installing certbot from apt" - apt: - name: - - certbot - state: present - when: {{ install_from }} == "os_repo" - - + - name: "Installing certbot from apt" + ansible.builtin.apt: + name: + - certbot + state: present -- name: Run certbot script and create certificates - shell: "certbot certonly --standalone --email {{ letsencrypt_email }} --agree-tos -d {{ inventory_hostname }} --non-interactive" +- name: Run certbot script and create certificates # noqa command-instead-of-shell + become: true + ansible.builtin.shell: >- + certbot + certonly + --standalone + --email "{{ letsencrypt_email }}" + --agree-tos + -d "{{ inventory_hostname }}" + --non-interactive + changed_when: false diff --git a/roles/letsencrypt/tasks/main.yml b/roles/letsencrypt/tasks/main.yml index abf9a163..f5375282 100644 --- a/roles/letsencrypt/tasks/main.yml +++ b/roles/letsencrypt/tasks/main.yml @@ -1,7 +1,5 @@ --- -- name: "Detected Debian - Running debian installation file" - include: install-Debian.yml +- name: Detected Debian - Running debian installation file + ansible.builtin.include_tasks: install-Debian.yml when: ansible_os_family == 'Debian' - become: yes - diff --git a/roles/memcached/defaults/main.yml b/roles/memcached/defaults/main.yml index 0f4b3478..cd67383d 100644 --- a/roles/memcached/defaults/main.yml +++ b/roles/memcached/defaults/main.yml @@ -1,12 +1,11 @@ --- - memcached_log_file: "/var/log/memcached.log" -# Log verbosity levels: +# Log verbosity levels: # `""` Don't log anything (Default) # `-v` Be verbose during the event loop; print out errors and warnings. # `-vv` Be even more verbose; same as -v but also print client commands and # responses. -# `-vvv` Be extremely verbose; same as -vv but also print internal state +# `-vvv` Be extremely verbose; same as -vv but also print internal state # transitions. memcached_log_verbosity: "" @@ -20,7 +19,7 @@ memcached_listen_port_udp: 11211 # IP address to listen on; the default is to listen on all IP addresses. # Binding to an internal or firewalled network interface is suggested. -#memcached_listen_address: 127.0.0.1 +# memcached_listen_address: 127.0.0.1 # Max number of simultaneous connections. memcached_connections_max: 1024 diff --git a/roles/memcached/handlers/main.yml b/roles/memcached/handlers/main.yml index 48d36004..663bb3bb 100644 --- a/roles/memcached/handlers/main.yml +++ b/roles/memcached/handlers/main.yml @@ -1,7 +1,6 @@ --- - - name: Restart memcached - service: - name: memcached + ansible.builtin.service: + name: memcached state: restarted - become: yes + become: true diff --git a/roles/memcached/tasks/configure-common.yml b/roles/memcached/tasks/configure-common.yml index ce376ab3..f13436c9 100644 --- a/roles/memcached/tasks/configure-common.yml +++ b/roles/memcached/tasks/configure-common.yml @@ -1,11 +1,10 @@ --- - - name: Ensure memcached service is configured - template: + ansible.builtin.template: src: memcached-{{ ansible_os_family }}.conf.j2 dest: "{{ memcached_config_file }}" owner: root group: root - mode: 0644 - become: yes + mode: "0644" + become: true notify: Restart memcached diff --git a/roles/memcached/tasks/install-Debian.yml b/roles/memcached/tasks/install-Debian.yml index 3ca5825b..04531ed0 100644 --- a/roles/memcached/tasks/install-Debian.yml +++ b/roles/memcached/tasks/install-Debian.yml @@ -1,7 +1,6 @@ --- - - name: Update package cache (Debian) - apt: - update_cache: yes + ansible.builtin.apt: + update_cache: true cache_valid_time: 86400 - become: yes + become: true diff --git a/roles/memcached/tasks/install-common.yml b/roles/memcached/tasks/install-common.yml index 0dcbec29..2a5250cd 100644 --- a/roles/memcached/tasks/install-common.yml +++ b/roles/memcached/tasks/install-common.yml @@ -1,7 +1,6 @@ --- - - name: Ensure memcached server is installed - package: - name: memcached + ansible.builtin.package: + name: memcached state: present - become: yes + become: true diff --git a/roles/memcached/tasks/main.yml b/roles/memcached/tasks/main.yml index ba2ee25a..bd560e59 100644 --- a/roles/memcached/tasks/main.yml +++ b/roles/memcached/tasks/main.yml @@ -1,21 +1,21 @@ --- - name: Include OS-specific variables - include_vars: "{{ ansible_os_family }}.yml" + ansible.builtin.include_vars: "{{ ansible_os_family }}.yml" -# Run OS-specific installation tasks -- include: install-Debian.yml +- name: OS-specific installation tasks + ansible.builtin.include_tasks: install-Debian.yml when: ansible_os_family == 'Debian' -# Run OS-independent installation tasks -- include: install-common.yml +- name: OS-independent installation tasks + ansible.builtin.include_tasks: install-common.yml -# Apply OS-independent configuration -- include: configure-common.yml +- name: Apply OS-independent configuration + ansible.builtin.include_tasks: configure-common.yml - name: Ensure memcached service is at selected state and enabled on boot - service: + ansible.builtin.service: name: memcached state: started - enabled: yes - become: yes + enabled: true + become: true diff --git a/roles/nginx/defaults/main.yml b/roles/nginx/defaults/main.yml index 92a02a28..1b6e0709 100644 --- a/roles/nginx/defaults/main.yml +++ b/roles/nginx/defaults/main.yml @@ -12,7 +12,7 @@ nginx_remove_default_vhost: false # SSL protocols that should be enabled nginx_ssl_protocols: "TLSv1.3 TLSv1.2" # SSL ciphers that should be enabled -nginx_ssl_ciphers: "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA512:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:ECDH+AESGCM:ECDH+AES256:DH+AESGCM:DH+AES256:RSA+AESGCM:!aNULL:!eNULL:!LOW:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS" +nginx_ssl_ciphers: "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA512:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:ECDH+AESGCM:ECDH+AES256:DH+AESGCM:DH+AES256:RSA+AESGCM:!aNULL:!eNULL:!LOW:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS" # noqa yaml[line-length] # Name servers used to resolve names of upstream servers into addresses nginx_resolver: "8.8.8.8 8.8.4.4 [2001:4860:4860::8888] [2001:4860:4860::8844]" @@ -32,21 +32,21 @@ nginx_ssl_certificate_key_file_group: "root" nginx_ssl_certificate_key_file_mode: "0600" # Uncomment to generate file with custom DH parameters for DHE ciphers -#nginx_dhparam_file: "dhparam.pem" +# nginx_dhparam_file: "dhparam.pem" # Number of bits used for generating DH parameter set nginx_dhparam_size: 2048 nginx_enable_rsyslog_pgsql_logs: false -#nginx_upstream_groups: +# nginx_upstream_groups: # - name: "web_backend" # servers: -# - address: "192.168.0.1" +# - address: "192.168.0.1" # weight: 1 -# - address: "192.168.0.2" +# - address: "192.168.0.2" # weight: 1 -#nginx_vhosts: +# nginx_vhosts: # - server_name: "www.example.org" # listen: # - "443 ssl default_server" diff --git a/roles/nginx/handlers/main.yml b/roles/nginx/handlers/main.yml index 7c2fa2bd..391e14b3 100644 --- a/roles/nginx/handlers/main.yml +++ b/roles/nginx/handlers/main.yml @@ -1,7 +1,7 @@ --- - name: Restart nginx - service: - name: nginx + ansible.builtin.service: + name: nginx state: restarted - become: yes + become: true diff --git a/roles/nginx/tasks/configure-common.yml b/roles/nginx/tasks/configure-common.yml index c5b37225..9c60f675 100644 --- a/roles/nginx/tasks/configure-common.yml +++ b/roles/nginx/tasks/configure-common.yml @@ -1,58 +1,57 @@ # file: nginx/tasks/configure-common.yml # --- - -- name: Ensure file with custom DH parameters for DHE ciphers exists - shell: openssl dhparam -dsaparam -out {{ nginx_dhparam_file }} {{ nginx_dhparam_size }} +- name: Ensure file with custom DH parameters for DHE ciphers exists # noqa command-instead-of-shell + ansible.builtin.shell: openssl dhparam -dsaparam -out {{ nginx_dhparam_file }} {{ nginx_dhparam_size }} args: chdir: "{{ nginx_conf_path }}" creates: "{{ nginx_conf_path }}/{{ nginx_dhparam_file }}" - become: yes + become: true notify: Restart nginx when: nginx_dhparam_file is defined - name: Ensure nginx service is configured - template: + ansible.builtin.template: src: nginx-{{ ansible_os_family }}.conf.j2 dest: "{{ nginx_conf_path }}/nginx.conf" owner: root group: root - mode: 0644 - backup: yes - become: yes + mode: "0644" + backup: true + become: true notify: Restart nginx - name: Disable default nginx Virtual Host configuration - file: + ansible.builtin.file: path: "{{ nginx_conf_path }}/sites-enabled/{{ nginx_default_vhost_filename }}" state: absent - become: yes + become: true notify: Restart nginx when: nginx_remove_default_vhost -# Configure nginx Virtual Host SSL certificates -- include: configure-ssl-cert.yml +- name: Configure nginx Virtual Host SSL certificates + ansible.builtin.include_tasks: configure-ssl-cert.yml when: nginx_vhosts is defined tags: - nginx:config:cert - name: Add nginx Virtual Host configuration - template: + ansible.builtin.template: src: "vhosts.conf.j2" dest: "{{ nginx_conf_path }}/sites-available/{{ nginx_vhosts_filename }}" owner: root group: root - mode: 0644 - backup: yes - become: yes + mode: "0644" + backup: true + become: true notify: Restart nginx when: nginx_create_vhosts - name: Enable nginx Virtual Host configuration - file: + ansible.builtin.file: src: "{{ nginx_conf_path }}/sites-available/{{ nginx_vhosts_filename }}" dest: "{{ nginx_conf_path }}/sites-enabled/{{ nginx_vhosts_filename }}" state: link - become: yes + become: true notify: Restart nginx when: nginx_create_vhosts diff --git a/roles/nginx/tasks/configure-ssl-cert.yml b/roles/nginx/tasks/configure-ssl-cert.yml index 2b03b756..63614738 100644 --- a/roles/nginx/tasks/configure-ssl-cert.yml +++ b/roles/nginx/tasks/configure-ssl-cert.yml @@ -3,54 +3,56 @@ --- - name: Ensure nginx SSL certificate directories exist - file: + ansible.builtin.file: path: "{{ item.certificate_file | dirname }}" owner: "{{ nginx_ssl_certificate_file_owner }}" group: "{{ nginx_ssl_certificate_file_group }}" state: directory + mode: "0755" with_items: - "{{ nginx_vhosts }}" when: item.certificate_file is defined and item.certificate is defined - become: yes + become: true - name: Ensure nginx SSL certificates are copied - copy: + ansible.builtin.copy: dest: "{{ item.certificate_file }}" content: "{{ item.certificate }}" owner: "{{ nginx_ssl_certificate_file_owner }}" group: "{{ nginx_ssl_certificate_file_group }}" mode: "{{ nginx_ssl_certificate_file_mode }}" - backup: yes + backup: true with_items: - "{{ nginx_vhosts }}" when: item.certificate_file is defined and item.certificate is defined - become: yes + become: true notify: - Restart nginx - name: Ensure nginx SSL certificate key directories exist - file: + ansible.builtin.file: path: "{{ item.certificate_key_file | dirname }}" owner: "{{ nginx_ssl_certificate_key_file_owner }}" group: "{{ nginx_ssl_certificate_key_file_group }}" state: directory + mode: "0755" with_items: - "{{ nginx_vhosts }}" when: item.certificate_key_file is defined and item.certificate_key is defined - become: yes + become: true - name: Ensure nginx SSL certificate keys are copied - copy: + ansible.builtin.copy: dest: "{{ item.certificate_key_file }}" content: '{{ item.certificate_key }}' owner: "{{ nginx_ssl_certificate_key_file_owner }}" group: "{{ nginx_ssl_certificate_key_file_group }}" mode: "{{ nginx_ssl_certificate_key_file_mode }}" - backup: yes + backup: true with_items: - "{{ nginx_vhosts }}" when: item.certificate_key_file is defined and item.certificate_key is defined - become: yes - no_log: yes + become: true + no_log: true notify: - Restart nginx diff --git a/roles/nginx/tasks/install-Debian.yml b/roles/nginx/tasks/install-Debian.yml index 0c1e4347..7ae0adb7 100644 --- a/roles/nginx/tasks/install-Debian.yml +++ b/roles/nginx/tasks/install-Debian.yml @@ -1,11 +1,11 @@ --- - name: Ensure nginx server is installed (Debian) - apt: + ansible.builtin.apt: name: - nginx state: present - install_recommends: no - update_cache: yes + install_recommends: false + update_cache: true cache_valid_time: 86400 - become: yes + become: true diff --git a/roles/nginx/tasks/main.yml b/roles/nginx/tasks/main.yml index 0f52adf2..ce3f091d 100644 --- a/roles/nginx/tasks/main.yml +++ b/roles/nginx/tasks/main.yml @@ -1,20 +1,21 @@ --- - name: Include OS-specific variables - include_vars: "{{ ansible_os_family }}.yml" + ansible.builtin.include_vars: "{{ ansible_os_family }}.yml" -# Install OS-specific packages -- include: install-Debian.yml +- name: Install OS-specific packages + ansible.builtin.include_tasks: install-Debian.yml when: ansible_os_family == 'Debian' -#- include: install-CentOS.yml -# when: ansible_os_family == 'CentOS' -# Apply OS-independent configuration -- include: configure-common.yml +# - include: install-CentOS.yml +# when: ansible_os_family == 'CentOS' + +- name: Apply OS-independent configuration + ansible.builtin.include_tasks: configure-common.yml - name: Ensure nginx service is started and enabled on boot - service: + ansible.builtin.service: name: "{{ nginx_service }}" state: started - enabled: yes - become: yes + enabled: true + become: true diff --git a/roles/nginx/templates/vhosts.conf.j2 b/roles/nginx/templates/vhosts.conf.j2 index d185cb65..f98b8a5c 100644 --- a/roles/nginx/templates/vhosts.conf.j2 +++ b/roles/nginx/templates/vhosts.conf.j2 @@ -8,7 +8,7 @@ upstream {{ upstream_group.name }} { {{ upstream_group.load_balancing_method }}; {% endif %} {% for upstream_server in upstream_group.servers %} - server {{ upstream_server.address }} + server {{ upstream_server.address }} weight={{ upstream_server.weight | default(1) }} {% if upstream_server.backup is defined and upstream_server.backup %} backup diff --git a/roles/openldap/defaults/main.yml b/roles/openldap/defaults/main.yml index 31d65b39..b4fb752b 100644 --- a/roles/openldap/defaults/main.yml +++ b/roles/openldap/defaults/main.yml @@ -1,26 +1,26 @@ --- # defaults file for ansible-openldap -openldap_init: false #when enabled it will initialise the LDAP directory. If already installed, the LDAP directory contents will be backed up -#openldap_admin_password: 'secret' -#openldap_admin_password_salt: 'defaultsecretsalt' +openldap_init: false # when enabled it will initialise the LDAP directory. If already installed, the LDAP directory contents will be backed up +# openldap_admin_password: 'secret' +# openldap_admin_password_salt: 'defaultsecretsalt' openldap_admin_user: 'admin' openldap_org: 'example.test' openldap_tld: 'org' openldap_base: 'dc=example,dc=test,dc={{ openldap_tld }}' openldap_uri: 'ldap://example.test.org' openldap_bind_id: 'cn={{ openldap_admin_user }},{{ openldap_base }}' -openldap_organizationalunits: #defines OU's to populate +openldap_organizationalunits: # defines OU's to populate - people - groups -openldap_populate: false #defines if openldap DB should be populated with openldap_organizationalunits, openldap_posixgroups -openldap_schema: false #defines if additional schemas should be added +openldap_populate: false # defines if openldap DB should be populated with openldap_organizationalunits, openldap_posixgroups +openldap_schema: false # defines if additional schemas should be added openldap_acl: false -openldap_posixgroups: #defines groups to create within OU's +openldap_posixgroups: # defines groups to create within OU's - name: admin-CO:COU:example.org:members ou: roles - gidNum: 500 #start group numbers at 500 and up + gidNum: 500 # start group numbers at 500 and up -openldap_adminusers: #defines admin users +openldap_adminusers: # defines admin users - cn: client-example sn: Example displayName: 'Client Example' @@ -37,4 +37,4 @@ openldap_certificate: [] openldap_certificate_key_file: 'cert_key.key' openldap_certificate_key: [] openldap_slapd_services: "ldap://127.0.0.1:389/ ldaps:/// ldapi:///" -pri_domain_name: '{{ openldap_org }}.{{ openldap_tld }}' +openldap_pri_domain_name: '{{ openldap_org }}.{{ openldap_tld }}' diff --git a/roles/openldap/handlers/main.yml b/roles/openldap/handlers/main.yml index 92294dbe..b1708a9f 100644 --- a/roles/openldap/handlers/main.yml +++ b/roles/openldap/handlers/main.yml @@ -1,8 +1,19 @@ --- # handlers file for ansible-openldap - name: Restart slapd - service: + ansible.builtin.service: name: slapd state: restarted - become: yes + become: true +- name: Enable Attribute Options to openLDAP # noqa command-instead-of-shell + ansible.builtin.shell: >- + ldapmodify \ + -Y EXTERNAL \ + -H ldapi:/// \ + -f /etc/ldap/slapd.d/olc_attribute_options.ldif + ignore_errors: true # noqa ignore-errors + changed_when: false + when: olc_attribute_options_file is changed # noqa no-handler + become: true + run_once: true diff --git a/roles/openldap/tasks/configure.yml b/roles/openldap/tasks/configure.yml index 3eeeb035..aa977a46 100644 --- a/roles/openldap/tasks/configure.yml +++ b/roles/openldap/tasks/configure.yml @@ -1,277 +1,328 @@ --- - name: Configure openLDAP file - template: - src: "etc/ldap/ldap.conf.j2" - dest: "/etc/ldap/ldap.conf" + ansible.builtin.template: + src: etc/ldap/ldap.conf.j2 + dest: /etc/ldap/ldap.conf owner: root group: root - mode: 0644 - backup: yes - become: yes + mode: "0644" + backup: true + become: true - name: Enable SSL port for openLDAP - template: - src: 'etc/default/slapd/slapd.j2' - dest: '/etc/default/slapd' + ansible.builtin.template: + src: etc/default/slapd/slapd.j2 + dest: /etc/default/slapd owner: root group: root - backup: yes - become: yes + mode: "0644" + backup: true + become: true - name: Ensure /etc/ldap/certs dir exists - file: + ansible.builtin.file: path: /etc/ldap/certs state: directory owner: openldap group: openldap - become: yes + mode: "0755" + become: true when: openldap_ca_certificate is defined and openldap_ca_certificate|length > 0 - name: Copy certificates config file - template: + ansible.builtin.template: src: "etc/ldap/certs/certs.ldif.j2" dest: "/etc/ldap/slapd.d/certs.ldif" owner: root group: root - mode: 0640 - become: yes + mode: "0640" + become: true when: openldap_ca_certificate is defined and openldap_ca_certificate|length > 0 - name: Ensure /etc/ldap/cacerts dir exists - file: + ansible.builtin.file: path: /etc/ldap/cacerts state: directory owner: openldap group: openldap - become: yes + mode: "0755" + become: true when: openldap_ca_certificate is defined and openldap_ca_certificate|length > 0 - name: Ensure CA certificate is copied - copy: + ansible.builtin.copy: dest: "/etc/ldap/cacerts/{{ openldap_ca_certificate_file }}" content: "{{ openldap_ca_certificate }}" owner: openldap group: openldap mode: '0600' - backup: yes + backup: true when: openldap_ca_certificate_file is defined and openldap_ca_certificate is defined and openldap_ca_certificate|length > 0 - become: yes + become: true - name: Ensure certificate is copied - copy: + ansible.builtin.copy: dest: "/etc/ldap/certs/{{ openldap_certificate_file }}" content: "{{ openldap_certificate }}" owner: openldap group: openldap mode: '0600' - backup: yes + backup: true when: openldap_certificate_file is defined and openldap_certificate is defined and openldap_certificate|length > 0 - become: yes + become: true - name: Ensure certificate key is copied - copy: + ansible.builtin.copy: dest: "/etc/ldap/certs/{{ openldap_certificate_key_file }}" content: "{{ openldap_certificate_key }}" owner: openldap group: openldap - mode: '0600' - backup: yes - when: openldap_certificate_key_file is defined and openldap_certificate_key is defined - and openldap_certificate_key|length > 0 - become: yes - no_log: yes + mode: "0600" + backup: true + when: openldap_certificate_key_file is defined and openldap_certificate_key is defined and openldap_certificate_key|length > 0 + become: true + no_log: true -- name: Add certificate config file to OpenLDAP - shell: 'ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/certs.ldif' - ignore_errors: yes #set to get around erroring out that items already exist +- name: Add certificate config file to OpenLDAP # noqa command-instead-of-shell + ansible.builtin.shell: >- + ldapmodify \ + -Y EXTERNAL \ + -H ldapi:/// \ + -f /etc/ldap/slapd.d/certs.ldif + ignore_errors: true # noqa ignore-errors when: openldap_ca_certificate is defined and openldap_ca_certificate|length > 0 and openldap_certificate is defined and openldap_certificate|length > 0 and openldap_certificate_key is defined and openldap_certificate_key|length > 0 - become: yes + become: true + changed_when: false # TODO define change conditions notify: Restart slapd - name: Copy admin_password to /etc/ldap/slapd.d/.slapdadmin - copy: - content: "{{ openldap_admin_password | password_hash('ldap_salted_sha1', openldap_admin_password_salt) }}" + ansible.builtin.copy: + content: "{{ openldap_admin_password | password_hash('ldap_salted_sha1', openldap_admin_password_salt) }}" dest: "/etc/ldap/slapd.d/.slapdadmin" owner: root group: root - mode: 400 - become: yes + mode: "0400" + become: true register: admin_pass_file - name: Copy the ldif template to set the admin password - template: - src: "etc/ldap/slapd.d/modify_password.ldif.j2" - dest: "/etc/ldap/slapd.d/adminpwd_ldif.tmpl" - become: yes + ansible.builtin.template: + src: etc/ldap/slapd.d/modify_password.ldif.j2 + dest: /etc/ldap/slapd.d/adminpwd_ldif.tmpl + mode: "0644" + become: true when: openldap_admin_password is defined and admin_pass_file is changed -- name: Create the ldif file to set the admin password - shell: export ADMIN_PASS=$( cat /etc/ldap/slapd.d/.slapdadmin ); sed -e "s|@ADMINPWD@|$ADMIN_PASS|" /etc/ldap/slapd.d/adminpwd_ldif.tmpl > /etc/ldap/slapd.d/adminpwd.ldif ; chmod 400 /etc/ldap/slapd.d/adminpwd.ldif +- name: Create the ldif file to set the admin password # noqa command-instead-of-shell + ansible.builtin.shell: >- + set -o pipefail ; \ + export ADMIN_PASS=$( cat /etc/ldap/slapd.d/.slapdadmin ); \ + sed -e "s|@ADMINPWD@|$ADMIN_PASS|" /etc/ldap/slapd.d/adminpwd_ldif.tmpl \ + > /etc/ldap/slapd.d/adminpwd.ldif ; \ + chmod 400 /etc/ldap/slapd.d/adminpwd.ldif when: openldap_admin_password is defined and admin_pass_file is changed - become: yes + changed_when: false # TODO define changed conditions + become: true -- name: Finally set the admin password - shell: ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/adminpwd.ldif +- name: Finally set the admin password # noqa command-instead-of-shell + ansible.builtin.shell: >- + ldapmodify \ + -Q \ + -Y EXTERNAL \ + -H ldapi:/// \ + -f /etc/ldap/slapd.d/adminpwd.ldif when: openldap_admin_password is defined and admin_pass_file is changed - become: yes + become: true + changed_when: false # TODO define change conditions - name: Run replicate tasks - when: "groups['openldap'] | length > 1" + when: (groups['openldap'] | length) > 1 block: - name: Copy config_olc_server_id file - template: - src: "etc/ldap/slapd.d/config_olc_server_id.ldif.j2" - dest: "/etc/ldap/slapd.d/config_olc_server_id.ldif" + ansible.builtin.template: + src: etc/ldap/slapd.d/config_olc_server_id.ldif.j2 + dest: /etc/ldap/slapd.d/config_olc_server_id.ldif owner: root group: root - mode: 0640 - become: yes + mode: "0640" + become: true register: config_olc_server_id_file - name: Copy mod_syncprov file - template: + ansible.builtin.template: src: "etc/ldap/slapd.d/mod_syncprov.ldif.j2" dest: "/etc/ldap/slapd.d/mod_syncprov.ldif" owner: root group: root - mode: 0640 - become: yes + mode: "0640" + become: true register: mod_syncprov_file - name: Copy replicate_configuration file - template: + ansible.builtin.template: src: "etc/ldap/slapd.d/replicate_configuration.ldif.j2" dest: "/etc/ldap/slapd.d/replicate_configuration.ldif" owner: root group: root - mode: 0640 - become: yes + mode: "0640" + become: true register: replicate_configuration_file - name: Copy replicate_database file - template: + ansible.builtin.template: src: "etc/ldap/slapd.d/replicate_database.ldif.j2" dest: "/etc/ldap/slapd.d/replicate_database.ldif" owner: root group: root - mode: 0640 - become: yes + mode: "0640" + become: true register: replicate_database_file run_once: true - name: Copy trigger_replicate file - template: - src: "etc/ldap/slapd.d/trigger_replicate.ldif.j2" - dest: "/etc/ldap/slapd.d/trigger_replicate.ldif" + ansible.builtin.template: + src: etc/ldap/slapd.d/trigger_replicate.ldif.j2 + dest: /etc/ldap/slapd.d/trigger_replicate.ldif owner: root group: root - mode: 0640 - become: yes + mode: "0640" + become: true run_once: true - - name: Add olcServerId to openLDAP - shell: 'ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/config_olc_server_id.ldif' - ignore_errors: yes #set to get around erroring out that items already exist - become: yes - when: config_olc_server_id_file is changed + - name: Add olcServerId to openLDAP # noqa command-instead-of-shell + ansible.builtin.shell: >- + ldapadd -Y EXTERNAL \ + -H ldapi:/// \ + -f /etc/ldap/slapd.d/config_olc_server_id.ldif + ignore_errors: true # noqa ignore-errors + changed_when: false + become: true + when: config_olc_server_id_file is changed # noqa no-handler - - name: Add syncprov module to openLDAP - shell: 'ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/mod_syncprov.ldif' - ignore_errors: yes #set to get around erroring out that items already exist - become: yes - when: mod_syncprov_file is changed + - name: Add syncprov module to openLDAP # noqa command-instead-of-shell + ansible.builtin.shell: >- + ldapadd -Y EXTERNAL \ + -H ldapi:/// \ + -f /etc/ldap/slapd.d/mod_syncprov.ldif + ignore_errors: true # noqa ignore-errors + become: true + changed_when: false + when: mod_syncprov_file is changed # noqa no-handler - - name: Add replicate configuration to openLDAP - shell: 'ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/replicate_configuration.ldif' - ignore_errors: yes #set to get around erroring out that items already exist - become: yes - when: replicate_configuration_file is changed + - name: Add replicate configuration to openLDAP # noqa command-instead-of-shell + ansible.builtin.shell: >- + ldapadd -Y EXTERNAL \ + -H ldapi:/// \ + -f /etc/ldap/slapd.d/replicate_configuration.ldif + ignore_errors: true # noqa ignore-errors + become: true + changed_when: false + when: replicate_configuration_file is changed # noqa no-handler - - name: Add replicate database to openLDAP - shell: 'ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/replicate_database.ldif' - ignore_errors: yes #set to get around erroring out that items already exist - become: yes - when: replicate_database_file is changed + - name: Add replicate database to openLDAP # noqa command-instead-of-shell + ansible.builtin.shell: >- + ldapadd -Y EXTERNAL \ + -H ldapi:/// \ + -f /etc/ldap/slapd.d/replicate_database.ldif + ignore_errors: true # noqa ignore-errors set to get around erroring out that items already exist + become: true + changed_when: false # TODO - define change criteria + when: replicate_database_file is changed # noqa no-handler run_once: true - + - name: Restart slapd - systemd: + ansible.builtin.systemd: name: slapd - enabled: yes - daemon_reload: yes + enabled: true + daemon_reload: true state: restarted - become: yes + become: true - name: Trigger replicate to openLDAP - shell: 'ldapadd -c -x -H ldapi:/// -D {{ openldap_bind_id }} -w "{{ openldap_admin_password }}" -f /etc/ldap/slapd.d/trigger_replicate.ldif' - become: yes + ansible.builtin.shell: >- # noqa command-isntead-of-shell + ldapadd -c -x \ + -H ldapi:/// \ + -D {{ openldap_bind_id }} \ + -w "{{ openldap_admin_password }}" \ + -f /etc/ldap/slapd.d/trigger_replicate.ldif' + become: true run_once: true - name: Copy additional schemas file - template: + ansible.builtin.template: src: "etc/ldap/slapd.d/modify_schemas.ldif.j2" dest: "/etc/ldap/slapd.d/modify_schemas.ldif" owner: root group: root - mode: 0640 - become: yes + mode: "0640" + become: true register: additional_schemas_file run_once: true - name: Copy ACL config file - template: + ansible.builtin.template: src: "etc/ldap/slapd.d/access_control_list.ldif.j2" dest: "/etc/ldap/slapd.d/access_control_list.ldif" owner: root group: root - mode: 0640 - become: yes + mode: "0640" + become: true register: acl_file run_once: true - name: Copy Attribute Options config file - template: + ansible.builtin.template: src: "etc/ldap/slapd.d/olc_attribute_options.ldif.j2" dest: "/etc/ldap/slapd.d/olc_attribute_options.ldif" owner: root group: root - mode: 0640 - become: yes + mode: "0640" + become: true register: olc_attribute_options_file run_once: true + notify: Enable Attribute Options to openLDAP -- name: Add schemas to openLDAP - shell: 'ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/modify_schemas.ldif' - ignore_errors: yes #set to get around erroring out that items already exist - when: > - openldap_schema is defined and - openldap_schema and - additional_schemas_file is changed - become: yes +- name: Add schemas to openLDAP # noqa command-instead-of-shell + ansible.builtin.shell: >- + ldapadd -Y EXTERNAL \ + -H ldapi:/// \ + -f /etc/ldap/slapd.d/modify_schemas.ldif + ignore_errors: true # noqa ignore-errors + changed_when: false + when: + - openldap_schema is defined + - openldap_schema and + - additional_schemas_file is changed + become: true run_once: true -- name: Add ACL to openLDAP - shell: 'ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/access_control_list.ldif' - ignore_errors: yes #set to get around erroring out that items already exist +- name: Add ACL to openLDAP # noqa command-instead-of-shell + ansible.builtin.shell: >- + ldapmodify -Y EXTERNAL \ + -H ldapi:/// \ + -f /etc/ldap/slapd.d/access_control_list.ldif + ignore_errors: true # noqa ignore-errors set to get around erroring out that items already exist when: > openldap_acl is defined and openldap_acl and acl_file is changed - become: yes + become: true run_once: true + changed_when: false -- name: Enable Attribute Options to openLDAP - shell: 'ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/olc_attribute_options.ldif' - ignore_errors: yes #set to get around erroring out that items already exist - when: olc_attribute_options_file is changed - become: yes - run_once: true - - +# TODO Should do a stat - set to get around erroring out that items already exist +# Moved to handler +# - name: Enable Attribute Options to openLDAP +# ansible.builtin.shell: 'ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/olc_attribute_options.ldif' +# ignore_errors: true # noqa ignore-errors +# changed_when: false +# when: olc_attribute_options_file is changed +# become: true +# run_once: true diff --git a/roles/openldap/tasks/install-Debian.yml b/roles/openldap/tasks/install-Debian.yml index 42826b2c..0a65445f 100644 --- a/roles/openldap/tasks/install-Debian.yml +++ b/roles/openldap/tasks/install-Debian.yml @@ -1,14 +1,14 @@ --- - name: "Gather the package facts" - package_facts: + ansible.builtin.package_facts: manager: "auto" - name: "Run Initialise tasks" - when: ('slapd' not in ansible_facts.packages or 'ldap-utils' not in ansible_facts.packages) or openldap_init == true + when: ('slapd' not in ansible_facts.packages or 'ldap-utils' not in ansible_facts.packages) or openldap_init block: # run these tasks only when initialise variable is true or slapd/ldap-utils are not installed - name: Define slapd installation settings - debconf: + ansible.builtin.debconf: name: "slapd" question: "{{ item.question }}" value: "{{ item.value }}" @@ -27,52 +27,57 @@ value: 'true' vtype: 'boolean' - question: "slapd/domain" - value: "{{ pri_domain_name }}" + value: "{{ openbldap_pri_domain_name }}" vtype: 'string' - question: "shared/organization" value: "{{ openldap_org }}" vtype: 'string' - become: yes + become: true - name: Install required packages - apt: + ansible.builtin.apt: name: "{{ openldap_debian_packages }}" state: present - install_recommends: no - update_cache: yes + install_recommends: false + update_cache: true cache_valid_time: 86400 - become: yes + become: true - name: Find /var/backups ending with .ldapdb or matching with slapd-*+* - find: + ansible.builtin.find: paths: /var/backups patterns: "*.ldapdb,slapd-*+*" file_type: directory - become: yes + become: true register: backup_files - name: Ensure /var/backups/openldap dir exists - file: + ansible.builtin.file: path: /var/backups/openldap state: directory owner: openldap group: openldap - become: yes + mode: "0755" + become: true - name: Move Backup Files to another folder - command: mv {{ item.path }} /var/backups/openldap/{{ item.path | replace("/var/backups/","") }}.{{ ansible_date_time.epoch }} + ansible.builtin.command: >- + mv {{ item.path }} \ + /var/backups/openldap/{{ item.path | replace("/var/backups/", "") }}.{{ ansible_date_time.epoch }} with_items: "{{ backup_files.files }}" - ignore_errors: true - become: yes + ignore_errors: true # noqa ignore-errors + changed_when: false + become: true - - name: Reconfigure slapd - command: dpkg-reconfigure -f noninteractive slapd - become: yes + - name: Reconfigure slapd # TODO - should be a handler + ansible.builtin.command: dpkg-reconfigure -f noninteractive slapd + changed_when: false + become: true - - name: Restart slapd - systemd: + - name: Restart slapd # TODO - should be a handler + ansible.builtin.systemd: name: slapd - enabled: yes - daemon_reload: yes + enabled: true + daemon_reload: true state: restarted - become: yes + become: true diff --git a/roles/openldap/tasks/main.yml b/roles/openldap/tasks/main.yml index 2a6b776f..681b653d 100644 --- a/roles/openldap/tasks/main.yml +++ b/roles/openldap/tasks/main.yml @@ -1,24 +1,27 @@ --- # tasks file for ansible-openldap - name: Include OS-specific variables - include_vars: "{{ item }}" + ansible.builtin.include_vars: "{{ item }}" with_first_found: - - "{{ ansible_distribution }}-{{ ansible_distribution_release}}.yml" - - "{{ ansible_distribution }}-{{ ansible_distribution_major_version}}.yml" + - "{{ ansible_distribution }}-{{ ansible_distribution_release }}.yml" + - "{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml" - "{{ ansible_distribution }}.yml" - "{{ ansible_os_family }}.yml" -- include: install-Debian.yml - when: ansible_os_family == "Debian" +- name: Install Debian + ansible.builtin.include_tasks: install-Debian.yml + when: ansible_os_family == 'Debian' tags: - install - openldap:install -- include: configure.yml +- name: Configure + ansible.builtin.include_tasks: configure.yml tags: - config - openldap:config -- include: populate.yml +- name: Populate + ansible.builtin.include_tasks: populate.yml tags: - openldap:populate diff --git a/roles/openldap/tasks/populate.yml b/roles/openldap/tasks/populate.yml index dc045db5..0bbd2013 100644 --- a/roles/openldap/tasks/populate.yml +++ b/roles/openldap/tasks/populate.yml @@ -1,21 +1,28 @@ - name: Copy database population config file - template: + ansible.builtin.template: src: "etc/ldap/slapd.d/populate_content.ldif.j2" dest: "/etc/ldap/slapd.d/populate_content.ldif" owner: root group: root - mode: 0640 - become: yes + mode: "0640" + become: true register: populate_content_file run_once: true # This operation may return "FAILED" if an entry already exists but it will continue to add non existing entries -- name: Populate openLDAP with groups and users - shell: "ldapadd -c -x -H ldapi:/// -D {{ openldap_bind_id }} -w '{{ openldap_admin_password }}' -f /etc/ldap/slapd.d/populate_content.ldif" - ignore_errors: yes #set to get around erroring out that items already exist +- name: Populate openLDAP with groups and users # noqa ignore-errors + # Use a different module + ansible.builtin.shell: >- # noqa command-instead-of-shell + ldapadd -c -x \ + -H ldapi:/// \ + -D {{ openldap_bind_id }} \ + -w '{{ openldap_admin_password }}' \ + -f /etc/ldap/slapd.d/populate_content.ldif" + ignore_errors: true # set to get around erroring out that items already exist <- this should be tested + changed_when: false when: > openldap_populate is defined and openldap_populate and populate_content_file is changed - become: yes - run_once: true \ No newline at end of file + become: true + run_once: true diff --git a/roles/openldap/vars/Debian.yml b/roles/openldap/vars/Debian.yml index ab92fb14..a23246c9 100644 --- a/roles/openldap/vars/Debian.yml +++ b/roles/openldap/vars/Debian.yml @@ -1,3 +1,3 @@ openldap_debian_packages: - slapd - - ldap-utils \ No newline at end of file + - ldap-utils diff --git a/roles/php/defaults/main.yml b/roles/php/defaults/main.yml index 6aad55ad..adccc432 100644 --- a/roles/php/defaults/main.yml +++ b/roles/php/defaults/main.yml @@ -1,18 +1,17 @@ --- # Whether to install PHP packages from alternative repository -php_alt_repo: no +php_alt_repo: false # Override default list of PHP packages to install. # See php_default_packages in php/vars/ -#php_packages: +# php_packages: # List of PHP extensions to install php_extensions: [] - # Override default PHP configuration scan directory. # See php_default_conf_scan_dir in php/vars/ -#php_conf_scan_dir: +# php_conf_scan_dir: # List of PHP configuration files to load php_conf_files: [] diff --git a/roles/php/handlers/main.yml b/roles/php/handlers/main.yml index 8578faad..fda70f62 100644 --- a/roles/php/handlers/main.yml +++ b/roles/php/handlers/main.yml @@ -1,7 +1,6 @@ --- - -- name: restart webserver - service: +- name: Restart webserver + ansible.builtin.service: name: "{{ php_webserver }}" state: restarted - become: yes + become: true diff --git a/roles/php/tasks/configure.yml b/roles/php/tasks/configure.yml index 064a723c..f28fd4ae 100644 --- a/roles/php/tasks/configure.yml +++ b/roles/php/tasks/configure.yml @@ -1,13 +1,12 @@ --- - - name: Ensure PHP configuration files exist - copy: + ansible.builtin.copy: src: "{{ item }}" dest: "{{ php_conf_scan_dir }}/" - owner: "root" - group: "root" - mode: 0644 - with_items: "{{ php_conf_files }}" - become: yes + owner: root + group: root + mode: "0644" + with_items: "{{ php_conf_files }}" + become: true notify: - restart webserver diff --git a/roles/php/tasks/install-Debian.yml b/roles/php/tasks/install-Debian.yml index 48571947..bd7875b6 100644 --- a/roles/php/tasks/install-Debian.yml +++ b/roles/php/tasks/install-Debian.yml @@ -1,46 +1,45 @@ --- - - name: Install apt packages required for alternative PHP repo (Debian) - apt: + ansible.builtin.apt: name: "{{ php_apt_packages }}" state: present - update_cache: yes + update_cache: true when: php_alt_repo and php_apt_packages is defined and php_apt_packages|length - become: yes + become: true - name: Install apt key for PHP repo (Debian) - apt_key: - url: '{{ php_apt_key }}' + ansible.builtin.apt_key: + url: "{{ php_apt_key }}" state: present when: php_alt_repo and php_apt_key is defined - become: yes + become: true - name: Add alternative PHP repo (Debian) - apt_repository: + ansible.builtin.apt_repository: repo: "{{ item }}" state: present - update_cache: yes - filename: "php" + update_cache: true + filename: php loop: "{{ php_apt_repositories }}" when: php_alt_repo and php_apt_repositories is defined and php_apt_repositories|length - become: yes + become: true - name: Ensure PHP packages are installed (Debian) - apt: + ansible.builtin.apt: name: "{{ php_packages }}" state: present - update_cache: yes - install_recommends: no - become: yes + update_cache: true + install_recommends: false + become: true notify: - restart webserver - name: Ensure PHP extensions are installed (Debian) - apt: + ansible.builtin.apt: pkg: "{{ php_extensions }}" state: present - update_cache: yes - install_recommends: no - become: yes + update_cache: true + install_recommends: false + become: true notify: - restart webserver diff --git a/roles/php/tasks/install-RedHat.yml b/roles/php/tasks/install-RedHat.yml index 8cad451b..222e0817 100644 --- a/roles/php/tasks/install-RedHat.yml +++ b/roles/php/tasks/install-RedHat.yml @@ -1,7 +1,6 @@ --- - - name: Ensure Repositories are installed (RedHat) - yum: + ansible.builtin.yum: name: "{{ item }}" state: present loop: "{{ php_yum_repositories }}" @@ -9,7 +8,7 @@ become: true - name: Import remi GPG key. - rpm_key: + ansible.builtin.rpm_key: key: "{{ item }}" state: present loop: "{{ php_yum_keys }}" @@ -17,11 +16,11 @@ become: true - name: Ensure PHP packages are installed (RedHat) - yum: - enablerepo: "remi,remi-safe,remi-php{{ php_version }}" + ansible.builtin.yum: + enablerepo: remi,remi-safe,remi-php{{ php_version }} name: "{{ item }}" state: present - update_cache: yes + update_cache: true become: true loop: "{{ php_packages }}" when: php_alt_repo and php_yum_repositories is defined and php_yum_repositories|length @@ -29,10 +28,10 @@ - restart webserver - name: Ensure PHP packages are installed (default repo) (RedHat) - yum: + ansible.builtin.yum: name: "{{ item }}" state: present - update_cache: yes + update_cache: true become: true loop: "{{ php_packages }}" when: not php_alt_repo and php_yum_repositories is not defined @@ -40,11 +39,11 @@ - restart webserver - name: Ensure PHP extensions are installed (RedHat) - yum: - enablerepo: "remi,remi-safe,remi-php{{ php_version }}" + ansible.builtin.yum: + enablerepo: remi,remi-safe,remi-php{{ php_version }} name: "{{ php_extensions }}" state: present - update_cache: yes + update_cache: true become: true loop: "{{ php_extensions | default([]) }}" when: php_alt_repo and php_yum_repositories is defined and php_yum_repositories|length @@ -52,10 +51,10 @@ - restart webserver - name: Ensure PHP extensions are installed (default repo) (RedHat) - yum: + ansible.builtin.yum: name: "{{ php_extensions }}" state: present - update_cache: yes + update_cache: true become: true loop: "{{ php_extensions | default([]) }}" when: not php_alt_repo and php_yum_repositories is not defined diff --git a/roles/php/tasks/main.yml b/roles/php/tasks/main.yml index 13b2337f..7ece0459 100644 --- a/roles/php/tasks/main.yml +++ b/roles/php/tasks/main.yml @@ -1,28 +1,32 @@ --- - - name: Include OS-specific variables - include_vars: "{{ item }}" + ansible.builtin.include_vars: "{{ item }}" with_first_found: - - "{{ ansible_distribution }}-{{ ansible_distribution_release}}.yml" - - "{{ ansible_distribution }}-{{ ansible_distribution_major_version}}.yml" + - "{{ ansible_distribution }}-{{ ansible_distribution_release }}.yml" + - "{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml" - "{{ ansible_distribution }}.yml" - "{{ ansible_os_family }}.yml" - name: Define PHP packages - set_fact: + ansible.builtin.set_fact: php_packages: "{{ php_default_packages | list }}" when: php_packages is not defined - name: Define PHP configuration scan dir - set_fact: + ansible.builtin.set_fact: php_conf_scan_dir: "{{ php_default_conf_scan_dir }}" when: php_conf_scan_dir is not defined # Include OS-specific installation tasks -- include: install-Debian.yml +- name: Include Debian Install Tasks + ansible.builtin.include_tasks: install-Debian.yml when: ansible_os_family == 'Debian' -- include: install-RedHat.yml +- name: Include RedHat Install Tasks + ansible.builtin.include_tasks: install-RedHat.yml when: ansible_os_family == 'RedHat' +# Could be refactored + # Include OS-independent configuration tasks -- include: configure.yml +- name: Include Configure Tasks + ansible.builtin.include_tasks: configure.yml diff --git a/roles/php/vars/Debian-bookworm.yml b/roles/php/vars/Debian-bookworm.yml index 0d0a2e19..84971add 100644 --- a/roles/php/vars/Debian-bookworm.yml +++ b/roles/php/vars/Debian-bookworm.yml @@ -1,17 +1,17 @@ --- -php_webserver: "apache2" +php_webserver: apache2 php_default_packages: - - "libapache2-mod-php8.2" + - libapache2-mod-php8.2 -php_default_conf_scan_dir: "/etc/php/8.2/apache2/conf.d" +php_default_conf_scan_dir: /etc/php/8.2/apache2/conf.d # Only when php_alt_repo is set to true php_apt_repositories: - - "deb https://packages.sury.org/php/ bookworm main" + - deb https://packages.sury.org/php/ bookworm main -php_apt_key: "https://packages.sury.org/php/apt.gpg" +php_apt_key: https://packages.sury.org/php/apt.gpg php_apt_packages: - apt-transport-https diff --git a/roles/php/vars/Debian-bullseye.yml b/roles/php/vars/Debian-bullseye.yml index 886dc438..28206672 100644 --- a/roles/php/vars/Debian-bullseye.yml +++ b/roles/php/vars/Debian-bullseye.yml @@ -1,17 +1,17 @@ --- -php_webserver: "apache2" +php_webserver: apache2 php_default_packages: - - "libapache2-mod-php7.4" + - libapache2-mod-php7.4 -php_default_conf_scan_dir: "/etc/php/7.4/apache2/conf.d" +php_default_conf_scan_dir: /etc/php/7.4/apache2/conf.d # Only when php_alt_repo is set to true php_apt_repositories: - - "deb https://packages.sury.org/php/ bullseye main" + - deb https://packages.sury.org/php/ bullseye main -php_apt_key: "https://packages.sury.org/php/apt.gpg" +php_apt_key: https://packages.sury.org/php/apt.gpg php_apt_packages: - apt-transport-https diff --git a/roles/php/vars/Debian-buster.yml b/roles/php/vars/Debian-buster.yml index f6596041..b1cdeb9f 100644 --- a/roles/php/vars/Debian-buster.yml +++ b/roles/php/vars/Debian-buster.yml @@ -1,17 +1,17 @@ --- -php_webserver: "apache2" +php_webserver: apache2 php_default_packages: - - "libapache2-mod-php7.3" + - libapache2-mod-php7.3 -php_default_conf_scan_dir: "/etc/php/7.3/apache2/conf.d" +php_default_conf_scan_dir: /etc/php/7.3/apache2/conf.d # Only when php_alt_repo is set to true php_apt_repositories: - - "deb https://packages.sury.org/php/ buster main" + - deb https://packages.sury.org/php/ buster main -php_apt_key: "https://packages.sury.org/php/apt.gpg" +php_apt_key: https://packages.sury.org/php/apt.gpg php_apt_packages: - apt-transport-https diff --git a/roles/php/vars/Debian-jessie.yml b/roles/php/vars/Debian-jessie.yml index b0d0c287..bc23037e 100644 --- a/roles/php/vars/Debian-jessie.yml +++ b/roles/php/vars/Debian-jessie.yml @@ -1,8 +1,8 @@ --- -php_webserver: "apache2" +php_webserver: apache2 php_default_packages: - - "libapache2-mod-php5" + - libapache2-mod-php5 -php_default_conf_scan_dir: "/etc/php5/apache2/conf.d" +php_default_conf_scan_dir: /etc/php5/apache2/conf.d diff --git a/roles/php/vars/Debian-stretch.yml b/roles/php/vars/Debian-stretch.yml index 4bc9ea7f..0c8b6b0e 100644 --- a/roles/php/vars/Debian-stretch.yml +++ b/roles/php/vars/Debian-stretch.yml @@ -1,17 +1,17 @@ --- -php_webserver: "apache2" +php_webserver: apache2 php_default_packages: - - "libapache2-mod-php7.0" + - libapache2-mod-php7.0 -php_default_conf_scan_dir: "/etc/php/7.0/apache2/conf.d" +php_default_conf_scan_dir: /etc/php/7.0/apache2/conf.d # Only when php_alt_repo is set to true php_apt_repositories: - - "deb https://packages.sury.org/php/ stretch main" + - deb https://packages.sury.org/php/ stretch main -php_apt_key: "https://packages.sury.org/php/apt.gpg" +php_apt_key: https://packages.sury.org/php/apt.gpg php_apt_packages: - apt-transport-https diff --git a/roles/php/vars/RedHat.yml b/roles/php/vars/RedHat.yml index e31ecad1..5b6e0714 100644 --- a/roles/php/vars/RedHat.yml +++ b/roles/php/vars/RedHat.yml @@ -1,8 +1,8 @@ --- -php_webserver: "httpd" +php_webserver: httpd php_default_packages: - - "php" + - php -php_default_conf_scan_dir: "/etc/php.d" +php_default_conf_scan_dir: /etc/php.d diff --git a/roles/php/vars/Ubuntu-focal.yml b/roles/php/vars/Ubuntu-focal.yml index d2c0b69b..f6a22829 100644 --- a/roles/php/vars/Ubuntu-focal.yml +++ b/roles/php/vars/Ubuntu-focal.yml @@ -1,15 +1,15 @@ --- -php_webserver: "apache2" +php_webserver: apache2 php_default_packages: - - "libapache2-mod-php7.4" + - libapache2-mod-php7.4 -php_default_conf_scan_dir: "/etc/php/7.4/apache2/conf.d" +php_default_conf_scan_dir: /etc/php/7.4/apache2/conf.d # Only when php_alt_repo is set to true php_apt_repositories: - - "ppa:ondrej/php" + - ppa:ondrej/php php_apt_packages: - - "software-properties-common" + - software-properties-common diff --git a/roles/postgresql/defaults/main.yml b/roles/postgresql/defaults/main.yml index c94b71bc..126eaf98 100644 --- a/roles/postgresql/defaults/main.yml +++ b/roles/postgresql/defaults/main.yml @@ -4,47 +4,47 @@ # Override default PostgreSQL version # See postgresql_default_version defined in postgresql/vars/ -#postgresql_version: "11" +# postgresql_version: "11" # Override default PostgreSQL configuration path # See postgresql_default_conf_path in postgresql/vars/ -#postgresql_conf_path: "/etc/postgresql/{{ postgresql_version }}" +# postgresql_conf_path: "/etc/postgresql/{{ postgresql_version }}" # Override default PostgreSQL data path # See postgresql_default_data_path in postgresql/vars/ -#postgresql_data_path: "/var/lib/postgresql/{{ postgresql_version }}" +# postgresql_data_path: "/var/lib/postgresql/{{ postgresql_version }}" # Override default PostgreSQL service name # See postgresql_default_service in postgresql/vars/ -#postgresql_service: "postgresql" +# postgresql_service: "postgresql" # Override default PostgreSQL user # See postgresql_default_user in postgresql/vars/ -#postgresql_user: "postgresql" +# postgresql_user: "postgresql" # Override default PostgreSQL group # See postgresql_default_group in postgresql/vars/ -#postgresql_group: "postgresql" +# postgresql_group: "postgresql" postgresql_clients: # Connection type: # - "local": Unix-domain socket # - "host": plain or SSL-encrypted TCP/IP socket - # - "hostssl": SSL-encrypted TCP/IP socket - # - "hostnossl": plain TCP/IP socket + # - "hostssl": SSL-encrypted TCP/IP socket + # - "hostnossl": plain TCP/IP socket - connection_type: "local" # Database: "all", "sameuser", "samerole", "replication", a database name, - # or a comma-separated list thereof. The "all" keyword does not match + # or a comma-separated list thereof. The "all" keyword does not match # "replication". Access to replication must be enabled in a separate record database: "all" # User: "all", a user name, a group name prefixed with "+", or a # comma-separated list thereof. In both the database and user fields you - # can also write a file name prefixed with "@" to include names from a + # can also write a file name prefixed with "@" to include names from a # separate file. user: "postgres" # Address (for non-"local" connection_type only): the set of hosts the # client matches. It can be a host name, or it is made up of an IP address - # and a CIDR mask that is an integer (between 0 and 32 (IPv4) or 128 + # and a CIDR mask that is an integer (between 0 and 32 (IPv4) or 128 # (IPv6) inclusive) that specifies the number of significant bits in the # mask. A host name that starts with a dot (.) matches a suffix of the # actual host name. Alternatively, you can write an IP address and netmask @@ -52,10 +52,10 @@ postgresql_clients: # CIDR-address, you can write "samehost" to match any of the server's own # IP addresses, or "samenet" to match any address in any subnet that the # server is directly connected to. - #address: - # Method: "trust", "reject", "md5", "password", "gss", "sspi", "ident", + # address: + # Method: "trust", "reject", "md5", "password", "gss", "sspi", "ident", # "peer", "pam", "ldap", "radius" or "cert". Note that # "password" sends - # passwords in clear text; "md5" is preferred since it sends encrypted + # passwords in clear text; "md5" is preferred since it sends encrypted # passwords. method: "peer" - connection_type: "local" @@ -73,22 +73,22 @@ postgresql_clients: address: "::1/128" method: "md5" -#postgresql_replication_user: "repuser" -#postgresql_replication_password: "repuser" +# postgresql_replication_user: "repuser" +# postgresql_replication_password: "repuser" postgresql_users: [] # Username - #- name: "theuser" + # - name: "theuser" # (Optional) Whether the password is stored hashed in the database - #encrypted: yes + # encrypted: yes # (Optional) User password - #password: "thepassword" + # password: "thepassword" # (Optional) Name of database where permissions will be granted - #db: "thedatabase" - # (Optional) Privileges string in the format: + # db: "thedatabase" + # (Optional) Privileges string in the format: # "table:priv1,priv2" - #priv: - # (Optional) Role attributes string in the format: + # priv: + # (Optional) Role attributes string in the format: # "CREATEDB,CREATEROLE,SUPERUSER" # Available options: # - [NO]SUPERUSER @@ -98,40 +98,40 @@ postgresql_users: [] # - [NO]INHERIT # - [NO]LOGIN # - [NO]REPLICATION - #role_attr_flags: + # role_attr_flags: postgresql_databases: [] # Name of the database - #- name: "thedatabase" + # - name: "thedatabase" # (Optional) Name of the role to set as owner of the database - #owner: "theuser" + # owner: "theuser" # (Optional) Encoding of the database - #encoding: "UTF8" + # encoding: "UTF8" # (Optional) Collation order (LC_COLLATE) to use in the database. Must # match collation order of template database unless template0 is used as # template. - #lc_collate: "en_US.UTF-8" + # lc_collate: "en_US.UTF-8" # (Optional) Character classification (LC_CTYPE) to use in the database. # Must match LC_CTYPE of template database unless template0 is used as # template. - #lc_ctype: "en_US.UTF-8" + # lc_ctype: "en_US.UTF-8" # (Optional) Template used to create the database - #template: "thetemplate" + # template: "thetemplate" postgresql_privs: [] - # Name of database to connect to - #- database: "thedatabase" + # Name of database to connect to + # - database: "thedatabase" # Comma separated list of role (user/group) names to set permissions for. # The special value PUBLIC can be provided instead to set permissions for # the implicitly defined PUBLIC group. - #roles: "theuser" + # roles: "theuser" # (Optional) Whether role may grant/revoke the specified privileges/group # memberships to others. Set to no to revoke GRANT OPTION, leave # unspecified to make no changes. grant_option only has an effect if state # is present. - #grant_option: yes + # grant_option: yes # (Optional) Comma separated list of privileges to grant/revoke. - #privs: + # privs: # Type of database object to set privileges on: # - table # - sequence @@ -141,20 +141,20 @@ postgresql_privs: [] # - language # - tablespace # - group - #type: "table" + # type: "table" # (Optional) Comma separated list of database objects to set privileges on. # If type is table or sequence, the special value ALL_IN_SCHEMA can be # provided instead to specify all database objects of type type in the - # schema specified via schema. + # schema specified via schema. # If type is database, this parameter can be omitted, in which case # privileges are set for the database specified via database. # If type is function, colons (":") in object names will be replaced with # commas - #objs: + # objs: # (Optional) Schema that contains the database objects specified via objs. # May only be provided if type is table, sequence or function. Defaults to - # public in these cases. - #schema: public + # public in these cases. + # schema: public # What IP address(es) to listen on postgresql_listen_addresses: "localhost" @@ -166,9 +166,9 @@ postgresql_max_connections: 100 # Min 128kB postgresql_shared_buffers: "128MB" -# Enables/disables the use of huge memory pages for PostgreSQL. -# Valid values are: -# - try (default) +# Enables/disables the use of huge memory pages for PostgreSQL. +# Valid values are: +# - try (default) # - on # - off # The use of huge pages results in smaller page tables and less CPU time spent @@ -176,7 +176,7 @@ postgresql_shared_buffers: "128MB" postgresql_huge_pages_mode: "try" # Number of huge memory pages to be allocated -#postgresql_huge_pages_number: 0 +# postgresql_huge_pages_number: 0 # Min 64kB postgresql_work_mem: "4MB" @@ -204,23 +204,27 @@ postgresql_wal_keep_segments: 0 # Standby server settings (ignored on a master server) -# Master/primary server host +# Master/primary server host postgresql_master_host: "{{ groups['dbmaster'][0] }}" -# Master/primary server port +# Master/primary server port postgresql_master_port: "{{ hostvars[groups['dbmaster'][0]]['postgresql_port'] | default(postgresql_port) }}" - + # "on" allows queries during recovery postgresql_hot_standby_mode: "off" # If set, the PostgreSQL server will try to connect to the master using this # connection string and receive XLOG records continuously. # e.g. 'host={{ postgresql_master_host }} port={{ postgresql_master_port }}' -#postgresql_master_conninfo: "host={{ postgresql_master_host }} port={{ postgresql_master_port }} user={{ postgresql_replication_user }} password={{ postgresql_replication_password }}" +# postgresql_master_conninfo: # This should be done with a join + # "host={{ postgresql_master_host }} + # port={{ postgresql_master_port }} + # user={{ postgresql_replication_user }} + # password={{ postgresql_replication_password }}" # By default, a standby server keeps restoring XLOG records from the primary # indefinitely. If you want to stop the standby mode, finish recovery and open # the system in read/write mode, specify a path to a trigger file. The server # will poll the trigger file path periodically and start as a primary server # when it's found. -#postgresql_trigger_file: "/tmp/postgresql.trigger.5432" +# postgresql_trigger_file: "/tmp/postgresql.trigger.5432" diff --git a/roles/postgresql/handlers/main.yml b/roles/postgresql/handlers/main.yml index 3686ebd8..e30379ad 100644 --- a/roles/postgresql/handlers/main.yml +++ b/roles/postgresql/handlers/main.yml @@ -1,13 +1,13 @@ --- - +# postgresql - name: Reload PostgreSQL - service: + ansible.builtin.service: name: "{{ postgresql_service }}" state: "reloaded" - become: yes + become: true - name: Restart PostgreSQL - service: + ansible.builtin.service: name: "{{ postgresql_service }}" - state: "restarted" - become: yes + state: restarted + become: true diff --git a/roles/postgresql/tasks/configure-common.yml b/roles/postgresql/tasks/configure-common.yml index 79a1ed36..4a261c7a 100644 --- a/roles/postgresql/tasks/configure-common.yml +++ b/roles/postgresql/tasks/configure-common.yml @@ -1,25 +1,24 @@ # file: postgresql/tasks/configure-common.yml # --- - - name: Configure PostgreSQL client authentication - template: + ansible.builtin.template: src: "{{ item.src }}" dest: "{{ item.dest }}" owner: "{{ postgresql_user }}" group: "{{ postgresql_group }}" - mode: 0640 - backup: yes + mode: "0640" + backup: true with_items: - { src: "pg_hba.conf.j2", dest: "{{ postgresql_conf_path }}/main/pg_hba.conf" } - become: yes + become: true notify: - Reload PostgreSQL tags: - - postgresql:pg_hba + - postgresql:pg_hba - name: Create PostgreSQL databases - postgresql_db: + community.postgresql.postgresql_db: state: present name: "{{ item.name }}" encoding: "{{ item.encoding | default(omit) }}" @@ -27,31 +26,33 @@ lc_ctype: "{{ item.lc_ctype | default(omit) }}" template: "{{ item.template | default(omit) }}" with_items: "{{ postgresql_databases }}" - become: yes + become: true become_user: "{{ postgresql_user }}" - name: Configure PostgreSQL users - postgresql_user: + community.postgresql.postgresql_user: state: present name: "{{ item.name }}" - encrypted: "{{ item.encrypted | default(omit) }}" + encrypted: "{{ item.encrypted | default(omit) }}" password: "{{ item.password | default(omit) }}" - db: "{{ item.db | default(omit) }}" + db: "{{ item.db | default(omit) }}" priv: "{{ item.priv | default(omit) }}" role_attr_flags: "{{ item.role_attr_flags | default(omit) }}" + conn_limit: "{{ item.connection_limit }}" # Should force a default here with_items: "{{ postgresql_users }}" - become: yes + become: true become_user: "{{ postgresql_user }}" -- name: Configure connection limit of PostgreSQL users - command: psql -U {{ postgresql_user }} -c 'ALTER ROLE {{ item.name }} WITH CONNECTION LIMIT {{ item.connection_limit }}' - with_items: "{{ postgresql_users }}" - when: "item.connection_limit is defined" - become: yes - become_user: "{{ postgresql_user }}" +# This task deprecated by conn_limit arg in previous task. +# - name: Configure connection limit of PostgreSQL users +# ansible.builtin.command: psql -U {{ postgresql_user }} -c 'ALTER ROLE {{ item.name }} WITH CONNECTION LIMIT {{ item.connection_limit }}' +# with_items: "{{ postgresql_users }}" +# when: "item.connection_limit is defined" +# become: true +# become_user: "{{ postgresql_user }}" - name: Configure privileges of PostgreSQL users - postgresql_privs: + community.postgresql.postgresql_privs: state: present database: "{{ item.database }}" roles: "{{ item.roles }}" @@ -61,20 +62,27 @@ privs: "{{ item.privs | default(omit) }}" schema: "{{ item.schema | default(omit) }}" with_items: "{{ postgresql_privs }}" - when: item.target is not defined - become: yes + when: item.target is not defined + become: true become_user: "{{ postgresql_user }}" # See https://github.com/ansible/ansible-modules-core/issues/4493 -- name: Configure default privileges of PostgreSQL users - command: psql -U {{ postgresql_user }} -c 'ALTER DEFAULT PRIVILEGES FOR USER {{ item.target }} IN SCHEMA {{ item.schema | default("public") }} GRANT {{ item.privs }} ON {{ item.type }} TO {{ item.roles }};' - with_items: "{{ postgresql_privs }}" - when: item.target is defined - become: yes - become_user: "{{ postgresql_user }}" +# The above repo is deprecated, this task is probably obsolete +# - name: Configure default privileges of PostgreSQL users +# ansible.builtin.command: |- + # psql -U {{ postgresql_user }} \ + # -c 'ALTER DEFAULT PRIVILEGES FOR USER {{ item.target }} \ + # IN SCHEMA {{ item.schema | default("public") }} \ + # GRANT {{ item.privs }} \ + # ON {{ item.type }} \ + # TO {{ item.roles }};' +# with_items: "{{ postgresql_privs }}" +# when: item.target is defined +# become: true +# become_user: "{{ postgresql_user }}" - name: Configure PostgreSQL databases - postgresql_db: + community.postgresql.postgresql_db: state: present name: "{{ item.name }}" owner: "{{ item.owner | default(omit) }}" @@ -83,44 +91,48 @@ lc_ctype: "{{ item.lc_ctype | default(omit) }}" template: "{{ item.template | default(omit) }}" with_items: "{{ postgresql_databases }}" - become: yes + become: true become_user: "{{ postgresql_user }}" - name: Configure number of huge memory pages to be allocated - sysctl: + ansible.posix.sysctl: name: vm.nr_hugepages value: "{{ postgresql_huge_pages_number }}" state: present when: postgresql_huge_pages_number is defined - become: yes + become: true - name: Configure PostgreSQL - template: - src: "{{ item.src }}" - dest: "{{ item.dest }}" - owner: "{{ postgresql_user }}" + ansible.builtin.template: + src: "postgresql-{{ postgresql_version }}.conf.j2" + dest: "{{ postgresql_conf_path }}/main/postgresql.conf" + owner: "{{ postgresql_user }}" group: "{{ postgresql_group }}" - mode: 0644 - backup: yes - with_items: - - { src: "postgresql-{{ postgresql_version }}.conf.j2", dest: "{{ postgresql_conf_path }}/main/postgresql.conf" } - become: yes + mode: "0644" + backup: true + # unnecessary loop - disabled + # with_items: + # - src: "postgresql-{{ postgresql_version }}.conf.j2" + # dest: "{{ postgresql_conf_path }}/main/postgresql.conf" + become: true notify: - Restart PostgreSQL -- name: Check if PostreSQL standby server is in recovery - command: psql -U {{ postgresql_user }} -c 'SELECT pg_is_in_recovery();' +# This should be done with an assertion on an output +- name: Check if PostreSQL standby server is in recovery + ansible.builtin.command: psql -U {{ postgresql_user }} -c 'SELECT pg_is_in_recovery();' when: "'dbstandby' in group_names" register: postgresql_is_in_recovery_status - ignore_errors: yes - changed_when: no - become: yes + ignore_errors: true + changed_when: false + become: true become_user: "{{ postgresql_user }}" - name: Register PostgreSQL standby server recovery status - set_fact: + ansible.builtin.set_fact: postgresql_is_in_recovery: "{{ postgresql_is_in_recovery_status is success and postgresql_is_in_recovery_status.stdout_lines[2].find('t') == 1 }}" when: "'dbstandby' in group_names" -- include: init-standby-common.yml +- name: Init Standby + ansible.builtin.include_tasks: init-standby-common.yml when: "'dbstandby' in group_names and not postgresql_is_in_recovery" diff --git a/roles/postgresql/tasks/init-standby-common.yml b/roles/postgresql/tasks/init-standby-common.yml index e0177571..2d7bb318 100644 --- a/roles/postgresql/tasks/init-standby-common.yml +++ b/roles/postgresql/tasks/init-standby-common.yml @@ -1,32 +1,42 @@ --- - name: Stop PostgreSQL - service: + ansible.builtin.service: name: "{{ postgresql_service }}" state: "stopped" - become: yes + become: true - name: Remove PostgreSQL data dir - file: + ansible.builtin.file: path: "{{ postgresql_data_path }}/main" state: absent - become: yes + become: true - name: Take base backup of PostgreSQL database - shell: "{{ item }}" + ansible.builtin.shell: "{{ item }}" # noqa command-instead-of-shell environment: PGPASSWORD: "{{ postgresql_replication_password }}" - become: yes + become: true become_user: "{{ postgresql_user }}" + changed_when: false with_items: - - pg_basebackup -h {{ postgresql_master_host }} -p {{ postgresql_master_port }} -D {{ postgresql_data_path }}/main -U {{ postgresql_replication_user }} -X stream -R + - |- + pg_basebackup \ + -h {{ postgresql_master_host }} \ + -p {{ postgresql_master_port }} \ + -D {{ postgresql_data_path }}/main \ + -U {{ postgresql_replication_user }} \ + -X stream \ + -R - sleep 15 +# sleep should be a wait_for task after this one + - name: Configure PostgreSQL replication - template: - src: recovery.conf.j2 + ansible.builtin.template: + src: recovery.conf.j2 dest: "{{ postgresql_data_path }}/main/recovery.conf" owner: "{{ postgresql_user }}" group: "{{ postgresql_group }}" - mode: 0640 - become: yes + mode: "0640" + become: true when: postgresql_version is version('12', '<') diff --git a/roles/postgresql/tasks/install-Debian.yml b/roles/postgresql/tasks/install-Debian.yml index 30dd2dc7..44c3363b 100644 --- a/roles/postgresql/tasks/install-Debian.yml +++ b/roles/postgresql/tasks/install-Debian.yml @@ -1,25 +1,24 @@ # file: postgresql/tasks/install-Debian.yml # --- - - name: Ensure PostgreSQL is installed (Debian) - apt: + ansible.builtin.apt: name: "postgresql-{{ postgresql_version }}" state: present - install_recommends: no - update_cache: yes + install_recommends: false + update_cache: true cache_valid_time: 86400 - become: yes + become: true -# The postgresql_user module requires psycopg2, a Python PostgreSQL database +# The postgresql_user module requires psycopg2, a Python PostgreSQL database # adapter. We must ensure that psycopg2 is installed on the remote host before # using this module. - name: Ensure PostgreSQL python module is installed (Debian) - apt: + ansible.builtin.apt: name: "{{ postgresql_psycopg2_package }}" state: present - install_recommends: no - update_cache: yes + install_recommends: false + update_cache: true cache_valid_time: 86400 when: postgresql_users | length > 0 - become: yes + become: true diff --git a/roles/postgresql/tasks/main.yml b/roles/postgresql/tasks/main.yml index 493c1281..03d0673c 100644 --- a/roles/postgresql/tasks/main.yml +++ b/roles/postgresql/tasks/main.yml @@ -1,9 +1,8 @@ # file: postgresql/tasks/main.yml # --- - - name: Include OS-specific variables - include_vars: "{{ item }}" + ansible.builtin.include_vars: "{{ item }}" with_first_found: - "{{ ansible_distribution }}-{{ ansible_distribution_release }}.yml" - "{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml" @@ -13,66 +12,67 @@ - always - name: Define PostgreSQL version - set_fact: + ansible.builtin.set_fact: postgresql_version: "{{ postgresql_default_version }}" when: postgresql_version is not defined tags: - always - name: Define PostgreSQL configuration path - set_fact: + ansible.builtin.set_fact: postgresql_conf_path: "{{ postgresql_default_conf_path }}" when: postgresql_conf_path is not defined tags: - always - name: Define PostgreSQL data path - set_fact: + ansible.builtin.set_fact: postgresql_data_path: "{{ postgresql_default_data_path }}" when: postgresql_data_path is not defined tags: - always - name: Define PostgreSQL service name - set_fact: + ansible.builtin.set_fact: postgresql_service: "{{ postgresql_default_service }}" when: postgresql_service is not defined tags: - always - name: Define PostgreSQL user - set_fact: + ansible.builtin.set_fact: postgresql_user: "{{ postgresql_default_user }}" when: postgresql_user is not defined tags: - always - name: Define PostgreSQL group - set_fact: + ansible.builtin.set_fact: postgresql_group: "{{ postgresql_default_group }}" when: postgresql_group is not defined tags: - always - name: Define PostgreSQL python module version - set_fact: + ansible.builtin.set_fact: postgresql_psycopg2_package: "{{ postgresql_default_psycopg2_package }}" when: postgresql_psycopg2_package is not defined tags: - always -# Install OS-specific packages -- include: install-Debian.yml +- name: Install OS-specific packages + ansible.builtin.include_tasks: install-Debian.yml when: ansible_os_family == 'Debian' -#- include: install-CentOS.yml +# - include: install-CentOS.yml # when: ansible_os_family == 'CentOS -# Apply OS-independent configuration -- include: configure-common.yml +# +- name: Apply OS-independent configuration + ansible.builtin.include_tasks: configure-common.yml - name: Ensure PostgreSQL service is started and enabled on boot - service: + ansible.builtin.service: name: "{{ postgresql_service }}" state: "started" - enabled: yes - become: yes + enabled: true + become: true diff --git a/roles/postgresql/templates/postgresql-11.conf.j2 b/roles/postgresql/templates/postgresql-11.conf.j2 index 1764fde0..c0f16512 100644 --- a/roles/postgresql/templates/postgresql-11.conf.j2 +++ b/roles/postgresql/templates/postgresql-11.conf.j2 @@ -122,7 +122,7 @@ huge_pages = {{ postgresql_huge_pages_mode }} # on, off, or try #temp_buffers = 8MB # min 800kB #max_prepared_transactions = 0 # zero disables the feature # (change requires restart) -# Caution: it is not advisable to set max_prepared_transactions nonzero unless| +# Caution: it is not advisable to set max_prepared_transactions nonzero unless| # you actively intend to use prepared transactions. work_mem = {{ postgresql_work_mem }} # min 64kB #maintenance_work_mem = 64MB # min 1MB diff --git a/roles/postgresql/templates/postgresql-12.conf.j2 b/roles/postgresql/templates/postgresql-12.conf.j2 index 7ba45837..54a219f7 100644 --- a/roles/postgresql/templates/postgresql-12.conf.j2 +++ b/roles/postgresql/templates/postgresql-12.conf.j2 @@ -127,7 +127,7 @@ huge_pages = {{ postgresql_huge_pages_mode }} # on, off, or try #temp_buffers = 8MB # min 800kB #max_prepared_transactions = 0 # zero disables the feature # (change requires restart) -# Caution: it is not advisable to set max_prepared_transactions nonzero unless +# Caution: it is not advisable to set max_prepared_transactions nonzero unless # you actively intend to use prepared transactions. work_mem = {{ postgresql_work_mem }} # min 64kB #maintenance_work_mem = 64MB # min 1MB diff --git a/roles/rciam-metrics/defaults/main.yml b/roles/rciam-metrics/defaults/main.yml index 0d4112ae..01a33fa9 100644 --- a/roles/rciam-metrics/defaults/main.yml +++ b/roles/rciam-metrics/defaults/main.yml @@ -1,7 +1,5 @@ # file: group_vars/metrics/main.yml - --- - metrics_path: /srv/rciam-metrics-client/rciam-metrics metrics_repo: https://github.com/rciam/rciam-metrics-dev metrics_release: 1.0.0 @@ -9,7 +7,7 @@ metrics_fast_api_folder_name: app metrics_ip2country_dir: ip2country_directory # Whether to install RCIAM metrics cron job; Enabled by default -metrics_cron_enabled: yes +metrics_cron_enabled: true metrics_api: address: "localhost" @@ -30,7 +28,7 @@ metrics_config: admin: metrics_dev_admin password: "{{ vault_metrics_db_password }}" host: db.rciam.noc.grnet.gr - pool_size : 15 + pool_size: 15 max_overflow: 5 log: level: DEBUG @@ -129,6 +127,6 @@ metrics_user: month: "*" weekday: "*" -#metrics_symlinks: +# metrics_symlinks: # - target: "/path/to/target" # link: "/path/to/symlink" diff --git a/roles/rciam-metrics/handlers/main.yml b/roles/rciam-metrics/handlers/main.yml index 09ca680d..aeb99312 100644 --- a/roles/rciam-metrics/handlers/main.yml +++ b/roles/rciam-metrics/handlers/main.yml @@ -1,10 +1,10 @@ --- # handlers file for rciam-metrics -- name: fastapi.service restart - systemd: +- name: Fastapi.service restart + ansible.builtin.systemd: name: fastapi state: restarted - enabled: yes - daemon_reload: yes - become: yes + enabled: true + daemon_reload: true + become: true diff --git a/roles/rciam-metrics/tasks/bootstrap.yml b/roles/rciam-metrics/tasks/bootstrap.yml index 7a44ab67..58ded1ac 100644 --- a/roles/rciam-metrics/tasks/bootstrap.yml +++ b/roles/rciam-metrics/tasks/bootstrap.yml @@ -1,40 +1,39 @@ # file: tasks/bootstrap.yml --- - - name: Ensure util groups exist - group: + ansible.builtin.group: name: "{{ metrics_user.group }}" - system: yes - become: yes + system: true + become: true - name: Ensure metrics user exists - user: + ansible.builtin.user: name: "{{ metrics_user.name }}" groups: "{{ metrics_user.group }}" - comment: "{{ metrics_user.gecos }}" + comment: "{{ metrics_user.gecos }}" shell: "{{ metrics_user.shell }}" home: "{{ metrics_user.path }}" - system: yes - create_home: yes + system: true + create_home: true skeleton: "/empty" - become: yes + become: true - name: Upgrade pip3 - pip: + ansible.builtin.pip: name: pip - state: latest + state: present virtualenv: "{{ metrics_path }}/.venv" extra_args: --upgrade - become: yes + become: true -- name: fastapi systemd setup - template: - owner: "www-data" - group: "www-data" - mode: 0644 - src: templates/fastapi/fastapi.service.j2 - dest: /etc/systemd/system/fastapi.service +- name: Fastapi systemd setup + ansible.builtin.template: + owner: "www-data" + group: "www-data" + mode: "0644" + src: templates/fastapi/fastapi.service.j2 + dest: /etc/systemd/system/fastapi.service notify: fastapi.service restart - become: yes + become: true tags: - fastapi_service diff --git a/roles/rciam-metrics/tasks/configure-local.yml b/roles/rciam-metrics/tasks/configure-local.yml index 098d0654..70e30e2d 100644 --- a/roles/rciam-metrics/tasks/configure-local.yml +++ b/roles/rciam-metrics/tasks/configure-local.yml @@ -3,12 +3,12 @@ # After creating react configuration, github action will move the file to the react application # before building - name: Create react configuration file locally - template: - src: "react/config.json.j2" + ansible.builtin.template: + src: react/config.json.j2 dest: "{{ inventory_dir }}/files/config.{{ item.tenant }}.json" - mode: 0400 - backup: yes + mode: "0400" + backup: true loop: "{{ metrics_config | default([]) }}" when: item.frontend is defined - no_log: yes - delegate_to: localhost \ No newline at end of file + no_log: true + delegate_to: localhost diff --git a/roles/rciam-metrics/tasks/deploy-backend.yml b/roles/rciam-metrics/tasks/deploy-backend.yml index 8465f385..999cb97f 100644 --- a/roles/rciam-metrics/tasks/deploy-backend.yml +++ b/roles/rciam-metrics/tasks/deploy-backend.yml @@ -2,104 +2,106 @@ --- # This needs the metrics_release, only github actions can know or if you set it manually - name: Download and unarchive latest release zip file - unarchive: + ansible.builtin.unarchive: src: "{{ metrics_repo }}/releases/download/{{ metrics_release }}/backend-release-build.tar.gz" dest: "{{ metrics_path }}" remote_src: true owner: "{{ metrics_user.name }}" group: "{{ metrics_user.name }}" - become: yes + become: true notify: - fastapi.service restart tags: - rciam-metrics:deploy-backend:unarchive - name: Ensure metrics python requirements are installed in virtualenv - pip: + ansible.builtin.pip: requirements: "{{ metrics_path }}/requirements.txt" virtualenv: "{{ metrics_path }}/.venv" virtualenv_command: python3 -m venv state: present - become: yes + become: true notify: - fastapi.service restart tags: - rciam-metrics:deploy-backend:requirements - name: Ensure configurations (fastapi) are configured - template: + ansible.builtin.template: src: "fastapi/config.py.j2" dest: "{{ metrics_path }}/config.{{ item.tenant }}.py" owner: "{{ metrics_user.name }}" group: "{{ metrics_user.group }}" - mode: 0400 - backup: yes + mode: "0400" + backup: true loop: "{{ metrics_config | default([]) }}" - no_log: yes - become: yes + no_log: true + become: true notify: - fastapi.service restart tags: - rciam-metrics:deploy-backend:config - name: Ensure authorizations are configured - template: + ansible.builtin.template: src: "fastapi/authorize.py.j2" dest: "{{ metrics_path }}/authorize.{{ item.tenant }}.py" owner: "{{ metrics_user.name }}" group: "{{ metrics_user.group }}" - mode: 0400 - backup: yes + mode: "0400" + backup: true loop: "{{ metrics_config | default([]) }}" - become: yes + become: true notify: - fastapi.service restart tags: - rciam-metrics:deploy-backend:authorize - name: Ensure ip to country database file(s) are copied - copy: + become: true + ansible.builtin.copy: src: "{{ metrics_ip2country_dir }}/" dest: "{{ metrics_path }}/{{ metrics_fast_api_folder_name }}/ip_databases/" owner: "{{ metrics_user.name }}" group: "{{ metrics_user.group }}" - mode: 0400 - backup: yes - become: yes + mode: "0400" + backup: true notify: - fastapi.service restart tags: - rciam-metrics:deploy-backend:iptocountry - name: Ensure log path exists - file: - path: "{{ metrics_path }}/{{metrics_fast_api_folder_name}}/logs" + ansible.builtin.file: + path: "{{ metrics_path }}/{{ metrics_fast_api_folder_name }}/logs" state: directory owner: "{{ metrics_user.name }}" group: "{{ metrics_user.group }}" - become: yes + mode: "0755" + become: true notify: - fastapi.service restart tags: - rciam-metrics:deploy-backend:logging - name: Ensure log file exists - file: - path: "{{ metrics_path }}/{{metrics_fast_api_folder_name}}/logs/metrics.log" + ansible.builtin.file: + path: "{{ metrics_path }}/{{ metrics_fast_api_folder_name }}/logs/metrics.log" state: touch owner: "{{ metrics_user.name }}" group: "{{ metrics_user.group }}" - become: yes + mode: "0644" + become: true notify: - fastapi.service restart tags: - rciam-metrics:deploy-backend:logging - name: Create Symbolic links - file: + ansible.builtin.file: src: "{{ item.symlink.target }}" dest: "{{ item.symlink.link }}" - force: yes + force: true state: link owner: root group: root @@ -110,11 +112,11 @@ - rciam-metrics:deploy-backend:symlink - name: Add ENV vars in cron.d file - cron: + ansible.builtin.cron: name: "{{ item.name }}" job: "{{ item.job }}" user: "{{ item.user }}" - env: yes + env: true cron_file: "{{ item.filename }}" state: present loop: "{{ metrics_user.cron_env | default([]) }}" @@ -124,10 +126,10 @@ - rciam-metrics:deploy-backend:cron - name: Ensure util cron jobs are installed - cron: + ansible.builtin.cron: name: "{{ metrics_user.name }}" user: "{{ metrics_user.name }}" - cron_file: "{{ metrics_user.name}}" + cron_file: "{{ metrics_user.name }}" job: "{{ metrics_user.cron.job }}" minute: "{{ metrics_user.cron.minute | default(omit) }}" hour: "{{ metrics_user.cron.hour | default(omit) }}" @@ -135,8 +137,6 @@ month: "{{ metrics_user.cron.month | default(omit) }}" backup: true when: metrics_user.cron is defined and metrics_cron_enabled - become: yes + become: true tags: - rciam-metrics:deploy-backend:cron - - diff --git a/roles/rciam-metrics/tasks/deploy-frontend.yml b/roles/rciam-metrics/tasks/deploy-frontend.yml index a318c42a..894a7b6f 100644 --- a/roles/rciam-metrics/tasks/deploy-frontend.yml +++ b/roles/rciam-metrics/tasks/deploy-frontend.yml @@ -1,27 +1,28 @@ --- - name: Ensure release directory exists - file: - path: "{{ metrics_path }}/{{ metrics_react_folder_name }}/{{tenant_environment | replace('.','_')}}/metrics-{{metrics_release}}" + ansible.builtin.file: + path: "{{ metrics_path }}/{{ metrics_react_folder_name }}/{{ tenant_environment | replace('.', '_') }}/metrics-{{ metrics_release }}" state: directory - become: yes + mode: "0755" + become: true # This needs the metrics_release, only github actions can know or if you set it manually # This needs the tenant_environment, only github actions can know or if you set it manually - name: Download and unarchive latest release zip file - unarchive: - src: "{{ metrics_repo }}/releases/download/{{ metrics_release }}/frontend-{{tenant_environment}}-release-build.tar.gz" - dest: "{{ metrics_path }}/{{ metrics_react_folder_name }}/{{tenant_environment | replace('.','_')}}/metrics-{{metrics_release}}" + ansible.builtin.unarchive: + src: "{{ metrics_repo }}/releases/download/{{ metrics_release }}/frontend-{{ tenant_environment }}-release-build.tar.gz" + dest: "{{ metrics_path }}/{{ metrics_react_folder_name }}/{{ tenant_environment | replace('.', '_') }}/metrics-{{ metrics_release }}" remote_src: true owner: "{{ metrics_user.name }}" group: "{{ metrics_user.name }}" - become: yes + become: true - name: Ensure symbolic link to latest metrics package exists - file: - src: "{{ metrics_path }}/{{ metrics_react_folder_name }}/{{tenant_environment | replace('.','_')}}/metrics-{{metrics_release}}" - dest: "{{ metrics_path }}/{{ metrics_react_folder_name }}/{{tenant_environment | replace('.','_')}}/metrics" - force: yes + ansible.builtin.file: + src: "{{ metrics_path }}/{{ metrics_react_folder_name }}/{{ tenant_environment | replace('.', '_') }}/metrics-{{ metrics_release }}" + dest: "{{ metrics_path }}/{{ metrics_react_folder_name }}/{{ tenant_environment | replace('.', '_') }}/metrics" + force: true state: link owner: "{{ metrics_user.name }}" group: "{{ metrics_user.name }}" - become: yes + become: true diff --git a/roles/rciam-metrics/tasks/install-Debian.yml b/roles/rciam-metrics/tasks/install-Debian.yml index 45d12421..47d04a91 100644 --- a/roles/rciam-metrics/tasks/install-Debian.yml +++ b/roles/rciam-metrics/tasks/install-Debian.yml @@ -1,10 +1,9 @@ # file: metrics/tasks/install-Debian.yml # --- - - name: Ensure metrics dependencies are installed - apt: - name: + ansible.builtin.apt: + name: # Should be declared in defaults - git - python3-venv - build-essential @@ -14,7 +13,7 @@ - python3-virtualenv - libpq-dev state: present - install_recommends: no - update_cache: yes + install_recommends: false + update_cache: true cache_valid_time: 86400 - become: yes + become: true diff --git a/roles/rciam-metrics/tasks/main.yml b/roles/rciam-metrics/tasks/main.yml index 3995d27c..259f01b0 100644 --- a/roles/rciam-metrics/tasks/main.yml +++ b/roles/rciam-metrics/tasks/main.yml @@ -1,17 +1,15 @@ --- - -# Include OS-specific installation tasks -- include_tasks: install-Debian.yml +- name: Include OS-specific installation tasks + ansible.builtin.include_tasks: install-Debian.yml when: ansible_os_family == 'Debian' tags: - rciam-metrics:install -# Include OS-independent installation tasks -- import_tasks: bootstrap.yml +- name: Include OS-independent installation tasks + ansible.builtin.import_tasks: bootstrap.yml tags: - rciam-metrics:bootstrap -# Include OS-independent configuration tasks # NOTE: The first time this task has to run manually using the --extra-var parameter # of ansible cmd command # e.g. ansible-playbook -u debian @@ -22,18 +20,19 @@ # --extra-vars metrics_release="metrics-api-deploy_changes-rc-deploy_changes-6335295151" # --diff # --check -- import_tasks: deploy-backend.yml +- name: Include OS-independent configuration tasks + ansible.builtin.import_tasks: deploy-backend.yml tags: - rciam-metrics:deploy-backend - # Include OS-independent configuration tasks # NOTE: Runs through github actions ONLY -- import_tasks: configure-local.yml +- name: Include OS-independent configuration tasks + ansible.builtin.import_tasks: configure-local.yml tags: - rciam-metrics:config-local - # Include OS-independent configuration tasks # NOTE: Runs through github actions ONLY -- import_tasks: deploy-frontend.yml +- name: Include OS-independent configuration tasks + ansible.builtin.import_tasks: deploy-frontend.yml tags: - rciam-metrics:deploy-frontend diff --git a/roles/rciam-oidc-client/tasks/configure-common.yml b/roles/rciam-oidc-client/tasks/configure-common.yml index 837a2d40..a8d7942d 100644 --- a/roles/rciam-oidc-client/tasks/configure-common.yml +++ b/roles/rciam-oidc-client/tasks/configure-common.yml @@ -1,9 +1,10 @@ # file: tasks/configure.yml --- - name: Configure webapp - template: + ansible.builtin.template: src: "{{ item.src_config_path }}" dest: "{{ item.dest_config_path }}" - backup: yes + backup: true + mode: "0644" loop: "{{ rciam_oidc_clients }}" - become: yes + become: true diff --git a/roles/rciam-oidc-client/tasks/install-common-client.yml b/roles/rciam-oidc-client/tasks/install-common-client.yml index 5c340d03..c5d85272 100644 --- a/roles/rciam-oidc-client/tasks/install-common-client.yml +++ b/roles/rciam-oidc-client/tasks/install-common-client.yml @@ -3,46 +3,48 @@ --- - name: Create RCIAM OIDC Client temp directory - file: + ansible.builtin.file: path: "/tmp/{{ item.item.name }}" state: directory - become: yes + mode: "0755" + become: true - name: Download & unarchive RCIAM OIDC Client to temp directory - unarchive: + ansible.builtin.unarchive: src: "{{ item.item.release }}" dest: "/tmp/{{ item.item.name }}" - remote_src: yes - list_files: yes + remote_src: true + list_files: true register: rciam_oidc_client_unarchive - become: yes + become: true - name: Setting RCIAM OIDC Client temp directory - set_fact: + ansible.builtin.set_fact: rciam_oidc_client_tmp_dir: "/tmp/{{ item.item.name }}/{{ rciam_oidc_client_unarchive.files[0].split('/')[0] }}" - name: Backup old version of RCIAM OIDC Client - command: + ansible.builtin.command: cmd: "mv {{ item.item.path }} {{ item.item.path }}.{{ ansible_date_time.iso8601 }}" removes: "{{ item.item.path }}" - become: yes + become: true - name: Move RCIAM OIDC Client from temp directory to target path - command: "mv {{ rciam_oidc_client_tmp_dir }} {{ item.item.path }}" - become: yes + ansible.builtin.command: "mv {{ rciam_oidc_client_tmp_dir }} {{ item.item.path }}" + changed_when: false + become: true - name: Create a file with the version of the RCIAM OIDC Client - copy: + ansible.builtin.copy: content: "" dest: "{{ item.item.path }}/{{ item.item.version }}" - force: no - owner: "root" - group: "root" + force: false + owner: root + group: root mode: "0644" - become: yes + become: true - name: Ensure RCIAM OIDC Client temp directory is absent - file: + ansible.builtin.file: path: "/tmp/{{ item.item.name }}" state: absent - become: yes + become: true diff --git a/roles/rciam-oidc-client/tasks/install-common.yml b/roles/rciam-oidc-client/tasks/install-common.yml index cce56a17..dff42eb7 100644 --- a/roles/rciam-oidc-client/tasks/install-common.yml +++ b/roles/rciam-oidc-client/tasks/install-common.yml @@ -3,18 +3,18 @@ --- - name: Ensure unzip is installed - package: + ansible.builtin.package: name: unzip state: present become: true -- name: Check which RCIAM OIDC Clients need to be installed - stat: - path: "{{ item.path }}/{{ item.version }}" +- name: Check which RCIAM OIDC Clients need to be installed + ansible.builtin.stat: + path: "{{ item.path }}/{{ item.version }}" loop: "{{ rciam_oidc_clients }}" register: rciam_oidc_client_stats - name: Ensure RCIAM OIDC Client is installed - include_tasks: install-common-client.yml + ansible.builtin.include_tasks: install-common-client.yml loop: "{{ rciam_oidc_client_stats.results }}" when: not item.stat.exists diff --git a/roles/rciam-oidc-client/tasks/main.yml b/roles/rciam-oidc-client/tasks/main.yml index ae049d80..6e186782 100644 --- a/roles/rciam-oidc-client/tasks/main.yml +++ b/roles/rciam-oidc-client/tasks/main.yml @@ -1,12 +1,12 @@ # file: rciam-oidc-client/tasks/main.yml # --- -# Include OS-specific installation tasks -- include: install-common.yml +- name: Include OS-specific installation tasks + ansible.builtin.include_tasks: install-common.yml tags: - install -# Include OS-independent configuration tasks -- include: configure-common.yml +- name: Include OS-independent configuration tasks + ansible.builtin.include_tasks: configure-common.yml tags: - config diff --git a/roles/rciam-probes/defaults/main.yml b/roles/rciam-probes/defaults/main.yml index b2b78493..5dfb3272 100644 --- a/roles/rciam-probes/defaults/main.yml +++ b/roles/rciam-probes/defaults/main.yml @@ -4,7 +4,7 @@ timezone: "UTC" nagios_home: "/home/nagios" rciam_probes_log_dir: "/var/log/rciam_probes" -#argo_environment: "devel" +# argo_environment: "devel" repos: - name: "argo-{{ argo_environment }}" @@ -12,4 +12,4 @@ repos: file: "argo" baseurl: "http://rpm-repo.argo.grnet.gr/ARGO/{{ argo_environment }}/centos{{ ansible_distribution_major_version }}/" gpgcheck: 0 - enabled: 1 \ No newline at end of file + enabled: 1 diff --git a/roles/rciam-probes/handlers/main.yml b/roles/rciam-probes/handlers/main.yml index 849169c7..ed97d539 100644 --- a/roles/rciam-probes/handlers/main.yml +++ b/roles/rciam-probes/handlers/main.yml @@ -1,3 +1 @@ --- - - diff --git a/roles/rciam-probes/tasks/configure-RedHat.yml b/roles/rciam-probes/tasks/configure-RedHat.yml index 3f4feb39..9ca4d658 100644 --- a/roles/rciam-probes/tasks/configure-RedHat.yml +++ b/roles/rciam-probes/tasks/configure-RedHat.yml @@ -1,11 +1,11 @@ --- - name: Add ENV vars in cron.d file (REDHAD) - cron: + ansible.builtin.cron: name: "{{ item.name }}" job: "{{ item.job }}" user: "{{ item.user }}" - env: yes + env: true cron_file: "{{ item.filename }}" state: present loop: "{{ cron_env | default([]) }}" @@ -13,7 +13,7 @@ when: cron_env is defined - name: Add cron jobs (RedHat) - cron: + ansible.builtin.cron: name: "{{ item.name }}" minute: "{{ item.minute }}" job: "{{ item.job }}" @@ -25,19 +25,19 @@ when: cron_jobs is defined - name: Set a universal Apache policy (RedHat) - command: "setsebool -P httpd_unified 1" + ansible.builtin.command: "setsebool -P httpd_unified 1" become: true changed_when: false - name: Ensure nagios home directory has search permissions on (RedHat) - file: + ansible.builtin.file: path: "{{ nagios_registered.home }}" state: directory mode: "0701" become: true - name: Ensure html directory exists under nagios home directory (RedHat) - file: + ansible.builtin.file: path: "{{ nagios_registered.home }}/{{ item }}" state: directory owner: nagios @@ -48,7 +48,7 @@ become: true - name: Install policycoreutils-python (RedHat) - yum: + ansible.builtin.yum: name: "{{ item }}" state: present update_cache: true @@ -58,17 +58,18 @@ # semanage fcontext -a -t httpd_sys_content_t "/var/spool/nagios/html(/.*)?" # /etc/selinux/targeted/contexts/files/file_contexts.local - name: Set selinux policy for directories (RedHat) - sefcontext: - target: "{{ item.target }}(/.*)?" - setype: "{{ item.setype }}" - reload: True - state: present + community.general.sefcontext: + target: "{{ item.target }}(/.*)?" + setype: "{{ item.setype }}" + reload: true + state: present become: true with_items: - - { target: "{{ nagios_registered.home }}/html", setype: "httpd_sys_content_t" } + - { target: "{{ nagios_registered.home }}/html", setype: "httpd_sys_content_t" } - name: Apply new SELinux file context to filesystem (RedHat) - command: "restorecon -irv {{ item }}" + ansible.builtin.command: "restorecon -irv {{ item }}" + changed_when: false loop: - "{{ nagios_registered.home }}/html" - become: true \ No newline at end of file + become: true diff --git a/roles/rciam-probes/tasks/install-RedHat.yml b/roles/rciam-probes/tasks/install-RedHat.yml index 5736f6da..17074f8c 100644 --- a/roles/rciam-probes/tasks/install-RedHat.yml +++ b/roles/rciam-probes/tasks/install-RedHat.yml @@ -1,34 +1,34 @@ --- - name: Ensure Repos are installed (RedHat) - yum_repository: + ansible.builtin.yum_repository: name: "{{ item.name }}" description: "{{ item.description }}" file: "{{ item.file }}" baseurl: "{{ item.baseurl }}" - gpgcheck: "{{ item.gpgcheck}}" + gpgcheck: "{{ item.gpgcheck }}" enabled: "{{ item.enabled }}" - loop: "{{ repos | default([])}}" - become: yes + loop: "{{ repos | default([]) }}" + become: true - name: Install dependencies (RedHat) - yum: + ansible.builtin.yum: name: "{{ item }}" state: present - validate_certs: no + validate_certs: false update_cache: true loop: "{{ dependencies | default([]) }}" when: dependencies is defined - name: Ensure nagios group is present (RedHat) - group: + ansible.builtin.group: name: nagios state: present become: true - name: Ensure nagios user is present and member of nagios and apache groups (RedHat) - user: + ansible.builtin.user: name: nagios state: present home: "{{ nagios_home }}" @@ -38,19 +38,19 @@ become: true - name: Echo nagios home directory (RedHat) - debug: + ansible.builtin.debug: var: nagios_registered verbosity: 1 - name: Install rciam_probes (RedHat) - yum: + ansible.builtin.yum: name: rciam_probes - state: latest + state: present update_cache: true become: true - name: Ensure log file owned by nagios user (RedHat) - file: + ansible.builtin.file: dest: "{{ rciam_probes_log_dir }}" state: directory mode: "0744" @@ -59,14 +59,14 @@ become: true - name: Upgrade pip3 (RedHat) - pip: + ansible.builtin.pip: name: pip executable: pip3 extra_args: --upgrade # Ensuring the umask is 0022 (to ensure other users can use it) - name: Install python3 packages (RedHat) - pip: + ansible.builtin.pip: name: "{{ item.name }}" version: "{{ item.version }}" umask: "0022" @@ -74,4 +74,3 @@ loop: "{{ pip_dependencies | default([]) }}" become: true when: pip_dependencies is defined - diff --git a/roles/rciam-probes/tasks/main.yml b/roles/rciam-probes/tasks/main.yml index a0077fd5..0dc49523 100644 --- a/roles/rciam-probes/tasks/main.yml +++ b/roles/rciam-probes/tasks/main.yml @@ -3,34 +3,34 @@ --- - name: Include OS-specific variables - include_vars: "{{ item }}" + ansible.builtin.include_vars: "{{ item }}" with_first_found: - - "{{ ansible_distribution }}-{{ ansible_distribution_release}}.yml" - - "{{ ansible_distribution }}-{{ ansible_distribution_major_version}}.yml" - - "{{ ansible_os_family }}-{{ ansible_distribution_major_version}}.yml" + - "{{ ansible_distribution }}-{{ ansible_distribution_release }}.yml" + - "{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml" + - "{{ ansible_os_family }}-{{ ansible_distribution_major_version }}.yml" - "{{ ansible_distribution }}.yml" - "{{ ansible_os_family }}.yml" tags: - always -# Install OS-specific packages -- include: install-RedHat.yml +- name: Install OS-specific packages + ansible.builtin.include_tasks: install-RedHat.yml when: ansible_os_family == 'RedHat' -#- include: install-Debian.yml +# - include: install-Debian.yml # when: ansible_os_family == 'Debian' -# Configure OS-specific packages -- include: configure-RedHat.yml +- name: Configure RedHat + ansible.builtin.include_tasks: configure-RedHat.yml when: ansible_os_family == 'RedHat' -#- include: configure-Debian.yml +# - include: configure-Debian.yml # when: ansible_os_family == 'Debian' # Tasks adding/copying/replacing files - name: Include OS-independent Update/Copy tasks - include_tasks: + ansible.builtin.include_tasks: file: update-static.yml apply: tags: - - update + - update tags: - - update \ No newline at end of file + - update diff --git a/roles/rciam-probes/tasks/update-static.yml b/roles/rciam-probes/tasks/update-static.yml index 7ef51d5b..1a4bc045 100644 --- a/roles/rciam-probes/tasks/update-static.yml +++ b/roles/rciam-probes/tasks/update-static.yml @@ -1,16 +1,16 @@ --- - name: Register static files to be copied - find: + ansible.builtin.find: paths: "{{ inventory_dir }}/files/monservers" file_type: file - recurse: yes + recurse: true register: static_files - ignore_errors: yes + ignore_errors: true delegate_to: 127.0.0.1 - name: Display files to be copied - debug: + ansible.builtin.debug: msg: "/{{ item.path | regex_replace('(.*)[/]files[/]monservers[/](.*)', '\\2') }}" verbosity: 1 loop: "{{ static_files.files }}" @@ -19,16 +19,16 @@ when: static_files is defined - name: Copy static files - copy: + ansible.builtin.copy: src: "{{ item.path }}" dest: "/{{ item.path | regex_replace('(.*)[/]files[/]monservers[/](.*)', '\\2') }}" - force: yes + force: true owner: root - mode: 0664 + mode: "0664" backup: true loop: "{{ static_files.files }}" loop_control: label: "Added file /{{ item.path | regex_replace('(.*)[/]files[/]monservers[/](.*)', '\\2') }}" - become: yes - ignore_errors: yes + become: true + ignore_errors: true # noqa ignore-errors when: static_files is defined diff --git a/roles/rciam-probes/vars/RedHat-7.yml b/roles/rciam-probes/vars/RedHat-7.yml index b7d11469..7d5ef101 100644 --- a/roles/rciam-probes/vars/RedHat-7.yml +++ b/roles/rciam-probes/vars/RedHat-7.yml @@ -5,4 +5,4 @@ apache_user: "apache" apache_group: "apache" core_utils: - - policycoreutils-python \ No newline at end of file + - policycoreutils-python diff --git a/roles/rciam-probes/vars/RedHat-8.yml b/roles/rciam-probes/vars/RedHat-8.yml index cfdf94bb..a2d79c0f 100644 --- a/roles/rciam-probes/vars/RedHat-8.yml +++ b/roles/rciam-probes/vars/RedHat-8.yml @@ -1,9 +1,9 @@ --- -clean_cache_cmd: "yum clean all" -apache_user: "apache" -apache_group: "apache" +clean_cache_cmd: yum clean all +apache_user: apache +apache_group: apache # https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/considerations_in_adopting_rhel_8/index core_utils: - - policycoreutils-python-utils \ No newline at end of file + - policycoreutils-python-utils diff --git a/roles/rciam-probes/vars/RedHat.yml b/roles/rciam-probes/vars/RedHat.yml index 89d1fbb9..1999494e 100644 --- a/roles/rciam-probes/vars/RedHat.yml +++ b/roles/rciam-probes/vars/RedHat.yml @@ -1,6 +1,5 @@ --- -clean_cache_cmd: "yum clean all" -apache_user: "apache" -apache_group: "apache" - +clean_cache_cmd: yum clean all +apache_user: apache +apache_group: apache diff --git a/roles/rciam-utils/defaults/main.yml b/roles/rciam-utils/defaults/main.yml index 6fec3de7..121b6a0a 100644 --- a/roles/rciam-utils/defaults/main.yml +++ b/roles/rciam-utils/defaults/main.yml @@ -22,7 +22,7 @@ rciam_utils: [] # #month: # Configuration for https://github.com/rciam/rciam-sync-voms.git -#rciam_utils_sync_voms: +# rciam_utils_sync_voms: # vomses_file: # url: "https://{{ rciam_hostname }}/static/diracVOs.json" # # Uncomment the following line to use the specified CA_BUNDLE file or @@ -49,7 +49,7 @@ rciam_utils: [] # level: "DEBUG" # Whether to install RCIAM util cron jobs; Enabled by default -rciam_utils_cron_enabled: yes +rciam_utils_cron_enabled: true rciam_utils_sync_client_names: # Type of OP: "mitreid" or "keycloak". Defaults to "mitreid". diff --git a/roles/rciam-utils/tasks/configure.yml b/roles/rciam-utils/tasks/configure.yml index 63d81b76..6a6d0824 100644 --- a/roles/rciam-utils/tasks/configure.yml +++ b/roles/rciam-utils/tasks/configure.yml @@ -2,86 +2,89 @@ --- - name: Ensure utils are configured - template: + ansible.builtin.template: src: "{{ item.name }}/config.py.j2" dest: "{{ item.path }}/config.py" owner: "{{ item.user.name }}" group: "{{ item.user.group }}" - mode: 0400 - backup: yes + mode: "0400" + backup: true loop: "{{ rciam_utils }}" - become: yes + become: true - name: Ensure util SSL certificate directories exist - file: + ansible.builtin.file: path: "{{ item.ssl.cert.path | dirname }}" owner: "{{ item.ssl.cert.owner }}" group: "{{ item.ssl.cert.group }}" state: directory + mode: "0750" loop: "{{ rciam_utils }}" when: item.ssl is defined - become: yes + become: true - name: Ensure util SSL certificates are copied - copy: + ansible.builtin.copy: dest: "{{ item.ssl.cert.path }}" content: "{{ item.ssl.cert.content }}" owner: "{{ item.ssl.cert.owner }}" group: "{{ item.ssl.cert.group }}" mode: "{{ item.ssl.cert.mode }}" - backup: yes + backup: true loop: "{{ rciam_utils }}" when: item.ssl is defined - become: yes + become: true - name: Ensure util SSL certificate key directories exist - file: + ansible.builtin.file: path: "{{ item.ssl.cert_key.path | dirname }}" owner: "{{ item.ssl.cert_key.owner }}" group: "{{ item.ssl.cert_key.group }}" state: directory + mode: "0750" loop: "{{ rciam_utils }}" when: item.ssl is defined - become: yes + become: true - name: Ensure util SSL certificate keys are copied - copy: + ansible.builtin.copy: dest: "{{ item.ssl.cert_key.path }}" content: "{{ item.ssl.cert_key.content }}" owner: "{{ item.ssl.cert_key.owner }}" group: "{{ item.ssl.cert_key.group }}" mode: "{{ item.ssl.cert_key.mode }}" - backup: yes + backup: true loop: "{{ rciam_utils }}" when: item.ssl is defined - become: yes - no_log: yes + become: true + no_log: true -- name: Ensure tables have been created for rciam-ip2country - shell: "{{ (rciam_utils | selectattr(\"name\", \"equalto\", \"rciam-ip2country\") | map(attribute='path') | list)[0] }}/.venv/bin/python -m Utils.install" +- name: Ensure tables have been created for rciam-ip2country # noqa command-instead-of-shell + ansible.builtin.shell: "{{ (rciam_utils | selectattr(\"name\", \"equalto\", \"rciam-ip2country\") | map(attribute='path') | list)[0] }}/.venv/bin/python -m Utils.install" # noqa yaml[line-length] args: chdir: "{{ (rciam_utils | selectattr(\"name\", \"equalto\", \"rciam-ip2country\") | map(attribute='path') | list)[0] }}" when: rciam_utils | selectattr("name", "equalto", "rciam-ip2country") | list | length == 1 - become: yes + become: true become_user: "{{ (rciam_utils | selectattr(\"name\", \"equalto\", \"rciam-ip2country\") | map(attribute='user.name') | list)[0] }}" + changed_when: false tags: - rciam_utils:config:ip2country:db - name: Ensure database files are copied for rciam-ip2country - copy: + ansible.builtin.copy: src: "{{ rciam_utils_ip2country.database_files_dir }}/{{ rciam_utils_ip2country.db_file_extension }}/" dest: "{{ (rciam_utils | selectattr(\"name\", \"equalto\", \"rciam-ip2country\") | map(attribute='path') | list)[0] }}/databases/" owner: "{{ (rciam_utils | selectattr(\"name\", \"equalto\", \"rciam-ip2country\") | map(attribute='user.name') | list)[0] }}" group: "{{ (rciam_utils | selectattr(\"name\", \"equalto\", \"rciam-ip2country\") | map(attribute='user.group') | list)[0] }}" - mode: 0400 - backup: yes + mode: "0400" + backup: true when: '(rciam_utils_ip2country.database_files_dir is defined) and (rciam_utils | selectattr("name", "equalto", "rciam-ip2country") | list | length == 1)' - become: yes + become: true tags: - rciam_utils:config:ip2country:files - name: Ensure util cron jobs are installed - cron: + ansible.builtin.cron: name: "{{ item.name }}" user: "{{ item.user.name | default('root') }}" cron_file: "{{ item.name }}" @@ -92,4 +95,4 @@ month: "{{ item.cron.month | default(omit) }}" loop: "{{ rciam_utils }}" when: item.cron is defined and rciam_utils_cron_enabled - become: yes + become: true diff --git a/roles/rciam-utils/tasks/install-Debian.yml b/roles/rciam-utils/tasks/install-Debian.yml index 3405de1d..657d3bcb 100644 --- a/roles/rciam-utils/tasks/install-Debian.yml +++ b/roles/rciam-utils/tasks/install-Debian.yml @@ -3,51 +3,51 @@ --- - name: Ensure util dependencies are installed - apt: + ansible.builtin.apt: name: - git - python3-venv state: present - install_recommends: no - update_cache: yes + install_recommends: false + update_cache: true cache_valid_time: 86400 - become: yes + become: true - name: Ensure PPA is installed for MaxMind (required for rciam-ip2country) - apt_repository: + ansible.builtin.apt_repository: repo: 'ppa:maxmind/ppa' state: present - update_cache: yes + update_cache: true codename: trusty - when: + when: - rciam_utils | selectattr("name", "equalto", "rciam-ip2country") | list | length == 1 - rciam_utils_ip2country.db_file_extension is defined and rciam_utils_ip2country.db_file_extension == "dat" - become: yes + become: true - name: Ensure dependencies for rciam-ip2country are installed - apt: + ansible.builtin.apt: name: - build-essential - python3-dev state: present - install_recommends: no - update_cache: yes + install_recommends: false + update_cache: true cache_valid_time: 86400 - when: + when: - rciam_utils | selectattr("name", "equalto", "rciam-ip2country") | list | length == 1 - become: yes + become: true - name: Ensure additional dependencies for rciam-ip2country (legacy version only) are installed - apt: + ansible.builtin.apt: name: - libgeoip1 - libgeoip-dev - geoip-bin state: present - install_recommends: no - update_cache: yes + install_recommends: false + update_cache: true cache_valid_time: 86400 - when: + when: - rciam_utils | selectattr("name", "equalto", "rciam-ip2country") | list | length == 1 - rciam_utils_ip2country.db_file_extension is defined and rciam_utils_ip2country.db_file_extension == "dat" - become: yes + become: true diff --git a/roles/rciam-utils/tasks/install-common.yml b/roles/rciam-utils/tasks/install-common.yml index dd92c2ff..45c5b70e 100644 --- a/roles/rciam-utils/tasks/install-common.yml +++ b/roles/rciam-utils/tasks/install-common.yml @@ -2,40 +2,40 @@ --- - name: Ensure util groups exist - group: + ansible.builtin.group: name: "{{ item.user.group }}" - system: yes + system: true loop: "{{ rciam_utils }}" - become: yes + become: true - name: Ensure util users exist - user: + ansible.builtin.user: name: "{{ item.user.name }}" groups: "{{ item.user.group }}" - comment: "{{ item.user.gecos }}" + comment: "{{ item.user.gecos }}" shell: "{{ item.user.shell }}" home: "{{ item.user.path }}" - system: yes - create_home: yes + system: true + create_home: true skeleton: "/empty" loop: "{{ rciam_utils }}" - become: yes + become: true - name: Ensure util code checkouts are up-to-date - git: + ansible.builtin.git: repo: "{{ item.repo }}" dest: "{{ item.path }}" version: "{{ item.version }}" loop: "{{ rciam_utils }}" - become: yes + become: true become_user: "{{ item.user.name }}" - name: Ensure util python requirements are installed in virtualenvs - pip: + ansible.builtin.pip: requirements: "{{ item.path }}/requirements.txt" virtualenv: "{{ item.path }}/.venv" virtualenv_command: python3 -m venv - state: latest + state: present loop: "{{ rciam_utils }}" - become: yes + become: true become_user: "{{ item.user.name }}" diff --git a/roles/rciam-utils/tasks/main.yml b/roles/rciam-utils/tasks/main.yml index 9f377d85..c94d26da 100644 --- a/roles/rciam-utils/tasks/main.yml +++ b/roles/rciam-utils/tasks/main.yml @@ -1,24 +1,23 @@ # file: tasks/main.yml # --- - -# Include OS-specific installation tasks -- include: install-Debian.yml +- name: Include OS-specific installation tasks + ansible.builtin.include_tasks: install-Debian.yml when: ansible_os_family == 'Debian' -#- include: install-RedHat.yml +# - include: install-RedHat.yml # when: ansible_os_family == 'RedHat' tags: - install - rciam_utils:install -# Include OS-independent installation tasks -- include: install-common.yml +- name: Include OS-independent installation tasks + ansible.builtin.include_tasks: install-common.yml tags: - install - rciam_utils:install -# Include OS-independent configuration tasks -- include: configure.yml +- name: Include OS-independent configuration tasks + ansible.builtin.include_tasks: configure.yml tags: - config - rciam_utils:config diff --git a/roles/rciam-utils/templates/rciam-sync-client-names/config.py.j2 b/roles/rciam-utils/templates/rciam-sync-client-names/config.py.j2 index e3e5fda7..098d5930 100644 --- a/roles/rciam-utils/templates/rciam-sync-client-names/config.py.j2 +++ b/roles/rciam-utils/templates/rciam-sync-client-names/config.py.j2 @@ -1,6 +1,6 @@ # {{ ansible_managed }} -mitreid_config = { +mitreid_config = { {% if rciam_utils_sync_client_names.op == "mitreid" %} "dbname": "{{ rciam_dbs.oidc.name }}", "user": "{{ rciam_dbs.oidc.owner_username }}", @@ -9,7 +9,7 @@ mitreid_config = { {% endif %} } -keycloak_config = { +keycloak_config = { {% if rciam_utils_sync_client_names.op == "keycloak" %} "dbname": "{{ rciam_dbs.keycloak.name }}", "user": "{{ rciam_dbs.keycloak.owner_username }}", @@ -19,7 +19,7 @@ keycloak_config = { {% endif %} } -proxystats_config = { +proxystats_config = { "dbname": "{{ rciam_dbs.proxy.name }}", "user": "{{ rciam_dbs.proxy.owner_username }}", "host": "{{ rciam_dbs.proxy.host }}", diff --git a/roles/rsyslog-pgsql/handlers/main.yml b/roles/rsyslog-pgsql/handlers/main.yml index e17f0c55..753f9f9c 100644 --- a/roles/rsyslog-pgsql/handlers/main.yml +++ b/roles/rsyslog-pgsql/handlers/main.yml @@ -1,6 +1,6 @@ --- - name: Restart rsyslog - service: + ansible.builtin.service: name: rsyslog state: restarted - become: yes + become: true diff --git a/roles/rsyslog-pgsql/tasks/configure-common.yml b/roles/rsyslog-pgsql/tasks/configure-common.yml index e4e1caae..a87c6216 100644 --- a/roles/rsyslog-pgsql/tasks/configure-common.yml +++ b/roles/rsyslog-pgsql/tasks/configure-common.yml @@ -1,10 +1,10 @@ --- - name: Remove pgsql.conf file if exists - file: + ansible.builtin.file: path: "{{ rsyslogd_path }}/pgsql.conf" state: absent - become: yes - when: rsyslog_pgsql_enable_logs == true + become: true + when: rsyslog_pgsql_enable_logs - name: Ensure /dev/xconsole exists ansible.builtin.file: @@ -13,17 +13,17 @@ owner: syslog group: adm mode: u=rw,g=rw,o=r - when: rsyslog_pgsql_enable_logs == true - become: yes + when: rsyslog_pgsql_enable_logs + become: true - name: Ensure rsyslog for nginx logs is configured - template: + ansible.builtin.template: src: rsyslogd-nginx-{{ ansible_os_family }}.conf.j2 dest: "{{ rsyslogd_path }}/51-nginx.conf" owner: root group: root - mode: 0644 - backup: yes - become: yes + mode: "0644" + backup: true + become: true notify: Restart rsyslog - when: rsyslog_pgsql_enable_logs == true + when: rsyslog_pgsql_enable_logs diff --git a/roles/rsyslog-pgsql/tasks/install-Debian.yml b/roles/rsyslog-pgsql/tasks/install-Debian.yml index 9eff3c04..d061a11c 100644 --- a/roles/rsyslog-pgsql/tasks/install-Debian.yml +++ b/roles/rsyslog-pgsql/tasks/install-Debian.yml @@ -1,8 +1,11 @@ --- - name: Ensure rsyslog & rsyslog-pgsql is installed (Debian) - apt: name={{item}} state=present install_recommends=no - loop: + ansible.builtin.apt: + name: "{{ item }}" + state: present + install_recommends: false + loop: # TODO - define in defaults - rsyslog - rsyslog-pgsql - become: yes - when: rsyslog_pgsql_enable_logs == true + become: true + when: rsyslog_pgsql_enable_logs diff --git a/roles/rsyslog-pgsql/tasks/main.yml b/roles/rsyslog-pgsql/tasks/main.yml index 5b3a3726..40d6c944 100644 --- a/roles/rsyslog-pgsql/tasks/main.yml +++ b/roles/rsyslog-pgsql/tasks/main.yml @@ -1,19 +1,19 @@ --- - name: Include OS-specific variables - include_vars: "{{ ansible_os_family }}.yml" + ansible.builtin.include_vars: "{{ ansible_os_family }}.yml" -# Install OS-specific packages -- include: install-Debian.yml +- name: Install OS-specific packages + ansible.builtin.include_tasks: install-Debian.yml when: ansible_os_family == 'Debian' -#- include: install-CentOS.yml -# when: ansible_os_family == 'CentOS' +# - include: install-CentOS.yml +# when: ansible_os_family == 'CentOS' -# Apply OS-independent configuration -- include: configure-common.yml +- name: Apply OS-independent configuration + ansible.builtin.include_tasks: configure-common.yml - name: Ensure rsyslog service is started and enabled on boot - service: + ansible.builtin.service: name: "{{ rsyslog_service }}" state: started - enabled: yes - become: yes + enabled: true + become: true diff --git a/roles/shibboleth-sp/defaults/main.yml b/roles/shibboleth-sp/defaults/main.yml index 46a34777..9173a863 100644 --- a/roles/shibboleth-sp/defaults/main.yml +++ b/roles/shibboleth-sp/defaults/main.yml @@ -2,42 +2,42 @@ # Set to yes/true to generate self-signed SSL certificate for signing requests/ # response received from/sent to the IdP, as well as for receiving encrypted # responses. -shibboleth_sp_ssl_cert_generate: no +shibboleth_sp_ssl_cert_generate: false # SSL certificate subject (ignored when shibboleth_sp_ssl_cert_generate is set # to no) -#shibboleth_sp_ssl_cert_subj: "/C=/ST=/L=/O=/CN=sp.example.org" +# shibboleth_sp_ssl_cert_subj: "/C=/ST=/L=/O=/CN=sp.example.org" # SSL certificate (ignored when shibboleth_sp_ssl_cert_generate is set to yes) -#shibboleth_sp_ssl_cert: | -# -----BEGIN CERTIFICATE----- -# ... -# -----END CERTIFICATE----- +# shibboleth_sp_ssl_cert: | +# -----BEGIN CERTIFICATE----- +# ... +# -----END CERTIFICATE----- # SSL certificate key (ignored when shibboleth_sp_ssl_cert_generate is set to # yes) -#shibboleth_sp_ssl_cert_key: | -# -----BEGIN PRIVATE KEY----- -# ... -# -----END PRIVATE KEY----- +# shibboleth_sp_ssl_cert_key: | +# -----BEGIN PRIVATE KEY----- +# ... +# -----END PRIVATE KEY----- # ApplicationDefaults # The SAML entityID of this SP -shibboleth_sp_entity_id: "https://sp.example.org/shibboleth" +shibboleth_sp_entity_id: https://sp.example.org/shibboleth # One or more attributes used for the primary identifier of the browser user # passed through the REMOTE_USER server variable. -# Set to null to disable setting the variable. -shibboleth_sp_remote_user: "eppn persistent-id targeted-id" +# Set to null to disable setting the variable. +shibboleth_sp_remote_user: eppn persistent-id targeted-id # Where the SP redirects the client to when there is nothing else that can be # done with a request and can be set to a standard home page or index page. -#shibboleth_sp_home_url: "/" +# shibboleth_sp_home_url: "/" shibboleth_sp_session: # The base location on the server that dispatches requests to the handlers # configured inside the element. The location is specified as a # relative or absolute URL. The default is "/Shibboleth.sso" on v2.4+, # required otherwise. -# handler_url: "/Shibboleth.sso" + # handler_url: "/Shibboleth.sso" # When handlerSSL is set to true, only web requests over SSL/TLS will be # processed by handlers. Other requests may be blocked, or possibly ignored # (and usually result in a 404 error) depending on the web server, but will @@ -62,7 +62,7 @@ shibboleth_sp_session: # this limits the amount of time between the act of authentication and the # attempt to access the SP. This can be useful to ensure that the SAML 2.0 # ForceAuthn flag was honored. -# max_time_since_authn: + # max_time_since_authn: # The IdP will place the IP address of the user agent it authenticated into # the assertions it issues. When true, the SP will check this address # against the address of the client presenting an assertion before creating @@ -75,21 +75,21 @@ shibboleth_sp_session: # associated with this session come from the same address. This can help # protect against cookie theft and is less likely than the checkAddress # setting to block legitimate access. Default is true. -# consistent_address: "true" + # consistent_address: "true" # Meta-properties like path or the secure and HttpOnly flags to attach to # the cookies. Defautls to "; path=/; HttpOnly". If set to a custom string, # the string is appended to the cookie values maintained by the SP. A common # value for SSL-only use is "; path=/; secure; HttpOnly". As of v2.5, this # property can be set to a pair of built-in values, "http" and "https", # which expand to the default and SSL-only properties respectively. - cookie_props: "http" + cookie_props: http # Cookie lifetime in seconds. If set, cookies used for session management # will be created with the designated lifetime. When omitted, which is the # default, such cookies are in-memory only and do not persist across browser # restarts (assuming various session restore features aren't in use). Note # that this will not affect "transitory" cookies used for maintaining state # across redirects. -# cookie_lifetime: + # cookie_lifetime: # Controls how information associated with requests for authentication, # primarily the original resource accessed, is preserved for the completion # of the authentication process. If not specified, the resource URL is @@ -100,41 +100,41 @@ shibboleth_sp_session: # element, typically "ss:mem". As of v2.5, the "cookie" # option can include a ":n" suffix, where n specifies the number of cookies # to permit before purging old ones, defaulting to 25. - relay_state: "ss:mem" + relay_state: ss:mem # V3.2+: One of "none", "exact", "host", "allow", "exact+allow", "host+allow" # Earlier: One of "none", "exact", "host", "whitelist", "exact+whitelist", # "host+whitelist". # "none" is the default and does no limiting # N.B. Consider carefully before using this option as it can allow malicious # use of your SP as an open redirect - #redirect_limit: "none" + # redirect_limit: "none" # SSO settings. To allow for >1 IdP, remove entity_id property and adjust # discovery_url to point to discovery service. shibboleth_sp_sso: - protocols: "SAML2 SAML1" - entity_id: "https://idp.example.org/idp/shibboleth" - discovery_protocol: "SAMLDS" - discovery_url: "https://ds.example.org/DS/WAYF" + protocols: SAML2 SAML1 + entity_id: https://idp.example.org/idp/shibboleth + discovery_protocol: SAMLDS + discovery_url: https://ds.example.org/DS/WAYF shibboleth_sp_logout: - protocols: "SAML2 Local" + protocols: SAML2 Local # See https://wiki.shibboleth.net/confluence/display/SP3/Handler shibboleth_sp_handlers: - - type: "MetadataGenerator" - location: "/Metadata" + - type: MetadataGenerator + location: /Metadata signing: "false" - - type: "Status" - location: "/Status" - acl: "127.0.0.1 ::1" - - type: "Session" - location: "/Session" + - type: Status + location: /Status + acl: 127.0.0.1 ::1 + - type: Session + location: /Session show_attributes: "false" - - type: "DiscoveryFeed" - location: "/DiscoFeed" + - type: DiscoveryFeed + location: /DiscoFeed -shibboleth_sp_supportcontact_email: "root@localhost" +shibboleth_sp_supportcontact_email: root@localhost # TODO Add support for metadata filters shibboleth_sp_metadata_providers: [] @@ -142,18 +142,18 @@ shibboleth_sp_metadata_providers: [] # uri: "http://federation.org/federation-metadata.xml" # backing_file_path: "federation-metadata.xml" # reload_interval: 7200 -# - type: "XML" +# - type: "XML" # file: "partner-metadata.xml" shibboleth_sp_attribute_extractors: - - type: "XML" + - type: XML params: validate: "true" reloadChanges: "false" - path: "attribute-map.xml" + path: attribute-map.xml shibboleth_sp_attribute_resolvers: - - type: "Query" + - type: Query subject_match: "true" # The default settings can be overridden by creating ApplicationOverride @@ -188,14 +188,14 @@ shibboleth_sp_overrides: [] # name: "Local" # handlers: # - handler: -# type: "MetadataGenerator" +# type: "MetadataGenerator" # location: "/Metadata" # signing: "false" # - handler: # type: "Status" # location: "/Status" # acl: "127.0.0.1 ::1" -# - handler: +# - handler: # type: "Session" # location: "/Session" # show_attributes: "true" @@ -211,7 +211,7 @@ shibboleth_sp_ext_libraries: [] # fatal: "false" # Path to file containing attribute mappings -shibboleth_sp_attribute_map_file: "attribute-map.xml" +shibboleth_sp_attribute_map_file: attribute-map.xml # Path to file containing attribute policies -shibboleth_sp_attribute_policy_file: "attribute-policy.xml" +shibboleth_sp_attribute_policy_file: attribute-policy.xml diff --git a/roles/shibboleth-sp/files/attribute-map.xml b/roles/shibboleth-sp/files/attribute-map.xml index ccb3b375..5d15065a 100644 --- a/roles/shibboleth-sp/files/attribute-map.xml +++ b/roles/shibboleth-sp/files/attribute-map.xml @@ -8,13 +8,13 @@ th a few exceptions for newer attributes where the name is the same for both versions. You will usually want to uncomment or map the names for both SAML versions as a unit. --> - + - + @@ -37,12 +37,12 @@ th a - + - + @@ -52,7 +52,7 @@ th a - + - + - + - + diff --git a/roles/shibboleth-sp/files/attribute-policy.xml b/roles/shibboleth-sp/files/attribute-policy.xml index a2d1742e..7e855b83 100644 --- a/roles/shibboleth-sp/files/attribute-policy.xml +++ b/roles/shibboleth-sp/files/attribute-policy.xml @@ -16,7 +16,7 @@ - + @@ -106,10 +106,10 @@ Note that while we default checkAddress to "false", this has a negative impact on the security of your site. Stealing sessions via cookie theft is much easier with this disabled. --> - - {{ shibboleth_sp_logout.protocols }} - + {% for handler in shibboleth_sp_handlers | default([]) %} - + {% for metadata in shibboleth_sp_metadata_providers %} - =') %} url="{{ metadata.uri }}" @@ -187,7 +187,7 @@ {% endif %} {% endif %} {% if metadata.backing_file_path is defined %} - backingFilePath="{{ metadata.backing_file_path }}" + backingFilePath="{{ metadata.backing_file_path }}" {% endif %} {% if metadata.reload_interval is defined %} reloadInterval="{{ metadata.reload_interval }}" @@ -208,7 +208,7 @@ {% endfor %} {% for resolver in shibboleth_sp_attribute_resolvers %} - - + diff --git a/roles/shibboleth-sp/vars/Debian-buster.yml b/roles/shibboleth-sp/vars/Debian-buster.yml index 2bf78f4a..080b33eb 100644 --- a/roles/shibboleth-sp/vars/Debian-buster.yml +++ b/roles/shibboleth-sp/vars/Debian-buster.yml @@ -3,7 +3,7 @@ --- shibboleth_sp_default_version: "3.0" -shibboleth_sp_default_service: "shibd" -shibboleth_sp_default_conf_path: "/etc/shibboleth" -shibboleth_sp_default_user: "_shibd" -shibboleth_sp_default_group: "_shibd" +shibboleth_sp_default_service: shibd +shibboleth_sp_default_conf_path: /etc/shibboleth +shibboleth_sp_default_user: _shibd +shibboleth_sp_default_group: _shibd diff --git a/roles/shibboleth-sp/vars/Debian-jessie.yml b/roles/shibboleth-sp/vars/Debian-jessie.yml index 98c38454..3ef4e035 100644 --- a/roles/shibboleth-sp/vars/Debian-jessie.yml +++ b/roles/shibboleth-sp/vars/Debian-jessie.yml @@ -3,7 +3,7 @@ --- shibboleth_sp_default_version: "2.5" -shibboleth_sp_default_service: "shibd" -shibboleth_sp_default_conf_path: "/etc/shibboleth" -shibboleth_sp_default_user: "_shibd" -shibboleth_sp_default_group: "_shibd" +shibboleth_sp_default_service: shibd +shibboleth_sp_default_conf_path: /etc/shibboleth +shibboleth_sp_default_user: _shibd +shibboleth_sp_default_group: _shibd diff --git a/roles/shibboleth-sp/vars/Debian-stretch.yml b/roles/shibboleth-sp/vars/Debian-stretch.yml index deafcfd5..69a26d78 100644 --- a/roles/shibboleth-sp/vars/Debian-stretch.yml +++ b/roles/shibboleth-sp/vars/Debian-stretch.yml @@ -3,7 +3,7 @@ --- shibboleth_sp_default_version: "2.6" -shibboleth_sp_default_service: "shibd" -shibboleth_sp_default_conf_path: "/etc/shibboleth" -shibboleth_sp_default_user: "_shibd" -shibboleth_sp_default_group: "_shibd" +shibboleth_sp_default_service: shibd +shibboleth_sp_default_conf_path: /etc/shibboleth +shibboleth_sp_default_user: _shibd +shibboleth_sp_default_group: _shibd diff --git a/roles/ssp-module-proxystatistics/defaults/main.yml b/roles/ssp-module-proxystatistics/defaults/main.yml index 5a170668..11640db5 100644 --- a/roles/ssp-module-proxystatistics/defaults/main.yml +++ b/roles/ssp-module-proxystatistics/defaults/main.yml @@ -12,15 +12,15 @@ ssp_module_proxystatistics_mode: "PROXY" # REQUIRED FOR "IDP" MODE # EntityId of IdP -#ssp_module_proxystatistics_idp_entity_id: "https://idp.example.org" +# ssp_module_proxystatistics_idp_entity_id: "https://idp.example.org" # Name of IdP -#ssp_module_proxystatistics_idp_entity_name: "IDP NAME" +# ssp_module_proxystatistics_idp_entity_name: "IDP NAME" # REQUIRED FOR "SP" MODE # EntityId of SP -#ssp_module_proxystatistics_sp_entity_id: "https://sp.example.org" +# ssp_module_proxystatistics_sp_entity_id: "https://sp.example.org" # Name of SP -#ssp_module_proxystatistics_sp_entity_name: "SP NAME" +# ssp_module_proxystatistics_sp_entity_name: "SP NAME" ssp_module_proxystatistics_db: name: "STATS" @@ -28,9 +28,9 @@ ssp_module_proxystatistics_db: username: "stats" password: "stats" prefix: "" - persistent: no - #slaves: - # - dsn: "mysql:host=slavedbhost;port=3306;dbname=STATS;charset=utf8" + persistent: false + # slaves: + # - dsn: "mysql:host=slavedbhost;port=3306;dbname=STATS;charset=utf8" # username: "stats" # password: "stats" # persistent: no @@ -48,5 +48,5 @@ ssp_module_proxystatistics_table_name: ssp_module_proxystatistics_oidc_issuer: "http://example.org/openidconnect/sp" # Ignore from statistics calculations the list of identifiers below. -#ssp_module_proxystatistics_user_id_blacklist: +# ssp_module_proxystatistics_user_id_blacklist: # - xxxxxx@example.org diff --git a/roles/ssp-module-proxystatistics/tasks/configure-common.yml b/roles/ssp-module-proxystatistics/tasks/configure-common.yml index 9108edab..4de00688 100644 --- a/roles/ssp-module-proxystatistics/tasks/configure-common.yml +++ b/roles/ssp-module-proxystatistics/tasks/configure-common.yml @@ -1,19 +1,20 @@ --- - name: Configure SSP proxystatistics module - template: + ansible.builtin.template: src: "config/module_statisticsproxy-{{ ssp_module_proxystatistics_version }}.php.j2" dest: "{{ ssp_path }}/config/module_statisticsproxy.php" - backup: yes - force: yes - become: yes + backup: true + force: true + mode: "0644" + become: true -- name: Enable SSP proxystatistics module - copy: +- name: Enable SSP proxystatistics module + ansible.builtin.copy: content: "" dest: "{{ ssp_module_proxystatistics_path }}/enable" - force: no - owner: "root" - group: "root" + force: false + owner: root + group: root mode: "0644" - become: yes + become: true diff --git a/roles/ssp-module-proxystatistics/tasks/install-common.yml b/roles/ssp-module-proxystatistics/tasks/install-common.yml index d2cb3105..c75aeea2 100644 --- a/roles/ssp-module-proxystatistics/tasks/install-common.yml +++ b/roles/ssp-module-proxystatistics/tasks/install-common.yml @@ -1,16 +1,16 @@ --- - name: Checkout SSP proxystatistics module source - git: + ansible.builtin.git: repo: "{{ ssp_module_proxystatistics_repo_url }}" dest: "{{ ssp_module_proxystatistics_path }}" version: "{{ ssp_module_proxystatistics_repo_version }}" - accept_hostkey: yes - force: no - update: yes - become: yes + accept_hostkey: true + force: false + update: true + become: true -#- name: Create SSP proxystatistics statistics table +# - name: Create SSP proxystatistics statistics table # postgresql_table: # db: "ssp_module_proxystatistics_db.name" # name: "{{ ssp_module_proxystatistics_table_name.statistics }}" diff --git a/roles/ssp-module-proxystatistics/tasks/main.yml b/roles/ssp-module-proxystatistics/tasks/main.yml index 7a606c93..45821db2 100644 --- a/roles/ssp-module-proxystatistics/tasks/main.yml +++ b/roles/ssp-module-proxystatistics/tasks/main.yml @@ -1,6 +1,5 @@ --- -# Run OS-independent installation tasks -- include: install-common.yml - -# Apply OS-independent configuration -- include: configure-common.yml +- name: Run OS-independent installation tasks + ansible.builtin.include_tasks: install-common.yml +- name: Apply OS-independent configuration + ansible.builtin.include_tasks: configure-common.yml diff --git a/roles/ssp-modules/defaults/main.yml b/roles/ssp-modules/defaults/main.yml index fe289c1e..d17de6d3 100644 --- a/roles/ssp-modules/defaults/main.yml +++ b/roles/ssp-modules/defaults/main.yml @@ -1,14 +1,13 @@ --- - +# ssp-modules/defaults/main.yml ssp_mods_extra_enabled: [] ssp_modules_db: [] - # Examples of use cases: ## Modules -#ssp_mods_extra_enabled: +# ssp_mods_extra_enabled: # - name: "module1" # path: "{{ ssp_path }}/modules/module1_directory" # repo_url: "https://github.com/example/module1.git" @@ -53,7 +52,7 @@ ssp_mods_extra_files: [] # dest_path: "{{ ssp_path }}/modules/theme/dictionaries/default.definition.json" ## Database -#ssp_modules_db: +# ssp_modules_db: # - db_host: "127.0.0.1" or "{{ lookup('dig', groups['dbmaster'][0]) }}" # db_name: database_name or "{{ rciam_dbs.proxy.name }}" # db_username: database_username or "{{ rciam_dbs.proxy.owner_username }}" @@ -138,7 +137,7 @@ ssp_mods_extra_files: [] # prefix: "" # persistent: no # #slaves: -# # - dsn: "mysql:host=slavedbhost;port=3306;dbname=STATS;charset=utf8" +# # - dsn: "mysql:host=slavedbhost;port=3306;dbname=STATS;charset=utf8" # # username: "stats" # # password: "stats" # # persistent: no @@ -202,4 +201,4 @@ ssp_mods_extra_files: [] # Required # ssp_module_rciammetrics_ams_base_url: 'https://example.com/' # Optional -# ssp_module_rciammetrics_ams_datatype: 'login|registration|membership' \ No newline at end of file +# ssp_module_rciammetrics_ams_datatype: 'login|registration|membership' diff --git a/roles/ssp-modules/handlers/main.yml b/roles/ssp-modules/handlers/main.yml index c11453f3..edc894c3 100644 --- a/roles/ssp-modules/handlers/main.yml +++ b/roles/ssp-modules/handlers/main.yml @@ -1,10 +1,7 @@ --- - - -- name: restart webserver - service: +# ssp-modules/handlers/main.yml +- name: Restart webserver + ansible.builtin.service: name: "{{ ssp_webserver }}" state: restarted - become: yes - - + become: true diff --git a/roles/ssp-modules/tasks/configure-common.yml b/roles/ssp-modules/tasks/configure-common.yml index daac1778..e8e4387a 100644 --- a/roles/ssp-modules/tasks/configure-common.yml +++ b/roles/ssp-modules/tasks/configure-common.yml @@ -1,47 +1,47 @@ # file: ssp-modules/tasks/configure-common.php # --- - - - name: Configure SSP modules - template: + ansible.builtin.template: src: "{{ item.src_config_path }}" dest: "{{ item.dest_config_path }}" - backup: yes - force: yes - become: yes + backup: true + force: true + mode: "0644" + become: true with_items: "{{ ssp_mods_extra_enabled }}" when: item.src_config_path is defined and item.dest_config_path is defined - name: Enable SSP modules - copy: + ansible.builtin.copy: content: "" dest: "{{ item.path }}/enable" - force: no + force: false owner: "root" group: "root" mode: "0644" - become: yes + become: true with_items: "{{ ssp_mods_extra_enabled }}" - when: "{{ ssp_major_version|float < 2}}" + when: ssp_major_version | float < 2 tags: - ssp-modules:config:enable - name: Ensure SSP module extra files are copied - copy: + ansible.builtin.copy: src: "{{ item.src_path }}" dest: "{{ item.dest_path }}" - backup: yes + backup: true + mode: "0644" with_items: "{{ ssp_mods_extra_files }}" when: item.src_path is defined and item.dest_path is defined - become: yes + become: true tags: - ssp-modules:config:files - name: About Themes - debug: + ansible.builtin.debug: msg: - The role also installs Themes, but doesn't produce the CSS files. - To produce them, you must install `sass` and follow the installation instructions for each theme. diff --git a/roles/ssp-modules/tasks/install-common-Ubuntu.yml b/roles/ssp-modules/tasks/install-common-Ubuntu.yml index a176c9b8..1d87f488 100644 --- a/roles/ssp-modules/tasks/install-common-Ubuntu.yml +++ b/roles/ssp-modules/tasks/install-common-Ubuntu.yml @@ -1,17 +1,16 @@ --- - - name: Define PostgreSQL python module version (Ubuntu) - set_fact: + ansible.builtin.set_fact: postgresql_psycopg2_package: "{{ postgresql_default_psycopg2_package }}" when: postgresql_psycopg2_package is not defined tags: - always - name: Ensure PostgreSQL python module is installed (Ubuntu) - apt: + ansible.builtin.apt: name: "{{ postgresql_psycopg2_package }}" state: present - install_recommends: no - update_cache: yes + install_recommends: false + update_cache: true cache_valid_time: 86400 - become: yes \ No newline at end of file + become: true diff --git a/roles/ssp-modules/tasks/install-common.yml b/roles/ssp-modules/tasks/install-common.yml index c6aa7e23..5c9bfbf1 100644 --- a/roles/ssp-modules/tasks/install-common.yml +++ b/roles/ssp-modules/tasks/install-common.yml @@ -1,22 +1,21 @@ --- - - +# ssp-modules/tasks/install-common.yml - name: Install unzip - package: + ansible.builtin.package: name: unzip - state: latest - become: yes + state: present + become: true - name: Checkout SSP modules source - git: + ansible.builtin.git: repo: "{{ item.repo_url }}" dest: "{{ item.path }}" version: "{{ item.version }}" - accept_hostkey: yes - force: no - update: yes - become: yes + accept_hostkey: true + force: false + update: true + become: true with_items: "{{ ssp_mods_extra_enabled }}" when: item.repo_url is defined tags: @@ -24,43 +23,45 @@ - name: Download & unarchive to /tmp/ ( zip only ) - unarchive: + ansible.builtin.unarchive: src: "{{ item.zip_url }}" dest: "/tmp/" creates: "{{ item.path }}/{{ item.version }}" - remote_src: yes - become: yes + remote_src: true + become: true with_items: "{{ ssp_mods_extra_enabled }}" when: item.zip_url is defined register: zip_downloaded tags: - ssp-modules:install:zip +# This is a series of very sus actions. # We need to create the directory if it does not exists - name: Ensure Theme Directory exists ( zip only ) [1/5] - file: + ansible.builtin.file: path: "{{ item.path }}" state: directory owner: root group: root - become: yes + mode: "0750" + become: true with_items: "{{ ssp_mods_extra_enabled }}" when: item.zip_url is defined register: directory_created tags: - ssp-modules:install:zip -- name: Backup old version (zip only) [2/5] - command: "mv {{ item.path }} {{ item.path }}.{{ ansible_date_time.iso8601 }}" - become: yes +- name: Backup old version (zip only) [2/5] # noqa no-changed-when + ansible.builtin.command: "mv {{ item.path }} {{ item.path }}.{{ ansible_date_time.iso8601 }}" + become: true with_items: "{{ ssp_mods_extra_enabled }}" when: zip_downloaded.changed and item.zip_url is defined and item.fullname is defined tags: - ssp-modules:install:zip -- name: Move unarchived module files from /tmp/ to module directory (zip only) [3/5] - command: "mv /tmp/{{ item.fullname }} {{ item.path }}" - become: yes +- name: Move unarchived module files from /tmp/ to module directory (zip only) [3/5] # noqa no-changed-when + ansible.builtin.command: "mv /tmp/{{ item.fullname }} {{ item.path }}" + become: true with_items: "{{ ssp_mods_extra_enabled }}" when: - zip_downloaded.changed or directory_created.changed @@ -70,14 +71,14 @@ - ssp-modules:install:zip - name: Set a version file in module directory (zip only) [4/5] - copy: + ansible.builtin.copy: content: "" dest: "{{ item.path }}/{{ item.version }}" - force: no + force: false owner: "root" group: "root" mode: "0644" - become: yes + become: true with_items: "{{ ssp_mods_extra_enabled }}" when: - zip_downloaded.changed or directory_created.changed @@ -87,10 +88,11 @@ - ssp-modules:install:zip - name: Remove unused directories from /tmp/ (zip only) [5/5] - file: + ansible.builtin.file: path: "/tmp/{{ item.fullname }}" state: absent - become: yes + mode: "0644" + become: true with_items: "{{ ssp_mods_extra_enabled }}" when: - zip_downloaded.changed or directory_created.changed diff --git a/roles/ssp-modules/tasks/install-db.yml b/roles/ssp-modules/tasks/install-db.yml index 1630f8d3..2970a601 100644 --- a/roles/ssp-modules/tasks/install-db.yml +++ b/roles/ssp-modules/tasks/install-db.yml @@ -1,15 +1,14 @@ --- - - +# ssp-modules/tasks/install-db.yml - name: Create PostgreSQL tables for SSP modules via SQL scripts - postgresql_query: + community.postgresql.postgresql_script: db: "{{ item.db_name }}" login_user: "{{ item.db_username }}" login_password: "{{ item.db_password }}" - path_to_script: "{{ item.db_script_path }}" + path: "{{ item.db_script_path }}" login_host: "{{ item.db_host }}" - #positional_args: - #- 1 + # positional_args: + # - 1 register: postgresql_result failed_when: "postgresql_result is failed and 'already exists' not in postgresql_result.msg" with_items: "{{ ssp_modules_db }}" diff --git a/roles/ssp-modules/tasks/main.yml b/roles/ssp-modules/tasks/main.yml index 50f1f83f..1f3b4547 100644 --- a/roles/ssp-modules/tasks/main.yml +++ b/roles/ssp-modules/tasks/main.yml @@ -1,18 +1,17 @@ --- - - +# ssp-modules/tasks/main.yml - name: Include OS-specific variables - include_vars: "{{ item }}" + ansible.builtin.include_vars: "{{ item }}" with_first_found: - - "{{ ansible_distribution }}-{{ ansible_distribution_release}}.yml" - - "{{ ansible_distribution }}-{{ ansible_distribution_major_version}}.yml" + - "{{ ansible_distribution }}-{{ ansible_distribution_release }}.yml" + - "{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml" - "{{ ansible_distribution }}.yml" - "{{ ansible_os_family }}.yml" tags: - always -# Install OS-specific packages -- include: install-common-Ubuntu.yml +- name: Install OS-specific packages + ansible.builtin.include_tasks: install-common-Ubuntu.yml when: ansible_os_family == 'Debian' and ansible_distribution == 'Ubuntu' and ansible_distribution_release == 'focal' tags: - install @@ -20,22 +19,22 @@ - ssp:install:mods - ssp-modules:install -# Run OS-independent installation tasks -- include: install-common.yml +- name: Run OS-independent installation tasks + ansible.builtin.include_tasks: install-common.yml tags: - install - ssp:install - ssp:install:mods - ssp-modules:install -# Run OS-independent installation tasks -- include: install-db.yml +- name: Run OS-independent installation tasks + ansible.builtin.include_tasks: install-db.yml tags: - never - ssp-modules:install:db -# Apply OS-independent configuration -- include: configure-common.yml +- name: Apply OS-independent configuration + ansible.builtin.include_tasks: configure-common.yml tags: - config - ssp:config diff --git a/roles/ssp-modules/vars/Debian.yml b/roles/ssp-modules/vars/Debian.yml index 61844771..4e10d47e 100644 --- a/roles/ssp-modules/vars/Debian.yml +++ b/roles/ssp-modules/vars/Debian.yml @@ -1,6 +1,5 @@ --- - +# ssp-modules/vars/Debian.yml ssp_default_webserver: "apache2" ssp_default_webuser: "www-data" ssp_default_webgroup: "www-data" - diff --git a/roles/ssp-modules/vars/RedHat.yml b/roles/ssp-modules/vars/RedHat.yml index 005c5582..14609c5d 100644 --- a/roles/ssp-modules/vars/RedHat.yml +++ b/roles/ssp-modules/vars/RedHat.yml @@ -1,6 +1,4 @@ --- - ssp_default_webserver: "httpd" ssp_default_webuser: "apache" ssp_default_webgroup: "apache" - diff --git a/roles/ssp-modules/vars/Ubuntu-focal.yml b/roles/ssp-modules/vars/Ubuntu-focal.yml index 377b555b..84bab750 100644 --- a/roles/ssp-modules/vars/Ubuntu-focal.yml +++ b/roles/ssp-modules/vars/Ubuntu-focal.yml @@ -1,3 +1,2 @@ --- - -postgresql_default_psycopg2_package: "python3-psycopg2" \ No newline at end of file +postgresql_default_psycopg2_package: "python3-psycopg2" diff --git a/roles/ssp-modules/vars/main.yml b/roles/ssp-modules/vars/main.yml index 849169c7..ed97d539 100644 --- a/roles/ssp-modules/vars/main.yml +++ b/roles/ssp-modules/vars/main.yml @@ -1,3 +1 @@ --- - - diff --git a/roles/ssp/defaults/main.yml b/roles/ssp/defaults/main.yml index 45278d19..cf5b40ae 100644 --- a/roles/ssp/defaults/main.yml +++ b/roles/ssp/defaults/main.yml @@ -2,18 +2,18 @@ # --- -ssp_version: "2.1.1" +ssp_version: 2.1.1 -ssp_repo_url: "https://github.com/simplesamlphp/simplesamlphp.git" -ssp_repo_version: "simplesamlphp-{{ ssp_version }}" +ssp_repo_url: https://github.com/simplesamlphp/simplesamlphp.git +ssp_repo_version: simplesamlphp-{{ ssp_version }} # Uncomment in order to install using the release # ssp_release_url: "https://github.com/simplesamlphp/simplesamlphp/releases/download/v{{ ssp_version }}/{{ ssp_repo_version }}-full.tar.gz" -ssp_path: "/var/simplesamlphp" +ssp_path: /var/simplesamlphp # The base path of the URLs to the content of the SimpleSAMPphp www folder. -ssp_baseurlpath: "simplesaml" -# Specify base URL path with the external scheme (protocol) and FQDN if your +ssp_baseurlpath: simplesaml +# Specify base URL path with the external scheme (protocol) and FQDN if your # SimpleSAMLphp installation is hosted behind a reverse proxy. -#ssp_external_baseurlpath: "https://example.com/simplesaml" +# ssp_external_baseurlpath: "https://example.com/simplesaml" ssp_configdir: "{{ ssp_path }}/config/" ssp_certdir: "{{ ssp_path }}/cert/" @@ -26,13 +26,13 @@ ssp_metadatadir: "{{ ssp_path }}/metadata/" ssp_www_path: "{{ ssp_path }}/../simplesaml-current" # Enable the installation of the composer -#ssp_composer_install: True +# ssp_composer_install: True -ssp_composer_executable: "/usr/local/bin/composer" -ssp_composer_install_directory: "/tmp/composer" +ssp_composer_executable: /usr/local/bin/composer +ssp_composer_install_directory: /tmp/composer # Enable the installation of nodejs and twig -#ssp_twig_install: True +# ssp_twig_install: True # Security configuration options @@ -41,12 +41,12 @@ ssp_composer_install_directory: "/tmp/composer" # The value can be any valid string of any length. # A possible way to generate a random salt is by running the following command: # LC_CTYPE=C tr -c -d '0123456789abcdefghijklmnopqrstuvwxyz' /dev/null;echo -#ssp_secretsalt: "defaultsecretsalt" +# ssp_secretsalt: "defaultsecretsalt" # Password giving access to the installation page of SimpleSAMLphp with # metadata listing and diagnostics pages. # This password must be kept secret, and modified from the default value 123. -#ssp_adminpassword: "123" +# ssp_adminpassword: "123" # Secret salt used to generate a secure hash of the ssp_adminpassword. # A possible way to generate a random salt is by running the following command: @@ -55,13 +55,12 @@ ssp_composer_install_directory: "/tmp/composer" # ssp_adminpassword_salt: "defaultsecretsalt" # Whether to require administrator password to access the web interface -ssp_admin_protectindexpage: no +ssp_admin_protectindexpage: false # Whether to require administrator password to access the metadata pages -ssp_admin_protectmetadata: no +ssp_admin_protectmetadata: false - -ssp_theme: "default" +ssp_theme: default # Set this option to true to activate the new UI based on Twig templates. # When this option is activated the index file redirects to the login page # where the a list of authentication sources (excluded admin) is displayed. @@ -71,58 +70,57 @@ ssp_twig_template: false # Set this option if a custom theme controller is required by the Theme # ssp_theme_controller_class: "" -ssp_session_cookie_name: "SimpleSAMLSessionID" +ssp_session_cookie_name: SimpleSAMLSessionID ssp_session_cookie_secure: false # Set the SameSite attribute in the cookie to support RFC6265bis. # You can set this to 'None', 'Lax', or 'Strict'. # If set to null, no SameSite attribute will be sent. -ssp_session_cookie_samesite: null -ssp_authtoken_cookiename: "SimpleSAMLAuthToken" +ssp_session_cookie_samesite: +ssp_authtoken_cookiename: SimpleSAMLAuthToken -ssp_tempdir: "/tmp/simplesaml" +ssp_tempdir: /tmp/simplesaml # Select where to store session information: # `phpsession` Uses the built-in session management in PHP (default). -# `memcache` Uses memcached to cache sessions in memory. +# `memcache` Uses memcached to cache sessions in memory. # Sessions can be distributed and replicated among several # memcached servers, enabling both load-balancing and fail-over. # `sql` Stores session information in a SQL database (WIP). -#ssp_store_type: "phpsession" +# ssp_store_type: "phpsession" # One or more memcached server groups for storing session information when # ssp_store_type is set to `memcache`. Every session data item will be mirrored # in every server group. Each server group is a list of servers. The data items # will be load-balanced between all servers in each server group. -#ssp_memcache_store_servers: -# - # Group A -# - "memcached1.acme.com" -# - "memcached2.acme.com" -# - # Group B -# - "memcached3.acme.com" -# - "memcached4.acme.com" +# ssp_memcache_store_servers: +# - # Group A +# - "memcached1.acme.com" +# - "memcached2.acme.com" +# - # Group B +# - "memcached3.acme.com" +# - "memcached4.acme.com" ssp_memcache_store_servers: - - - - "localhost" + - - localhost # Alternatively, define ssp_memcache_store_servers_group to dynamically build # the memcache server group configuration from the host group # See templates/config/config-x.y.php.j2 -#ssp_memcache_store_servers_group: "cache" +# ssp_memcache_store_servers_group: "cache" ssp_memcache_store_prefix: "" # Database configuration is optional. If you are not using core functionality # or modules that require a database, you can skip this configuration ssp_database: - dsn: "mysql:host=localhost;dbname=saml" - username: "simplesamlphp" - password: "secret" + dsn: mysql:host=localhost;dbname=saml + username: simplesamlphp + password: secret prefix: "" - persistent: no + persistent: false ssp_database_slaves: [] # - dsn: "mysql:host=myslave;dbname=saml" # username: "simplesamlphp" -# password: "secret" +# password: "secret" # persistent: no ssp_debug_saml: false @@ -137,14 +135,14 @@ ssp_showerrors: false ssp_errorreporting: true # Let SSP figure out timezone based on the host machine -ssp_timezone: 'null' +ssp_timezone: "null" # otherwise set it explicitly, e.g.: -#ssp_timezone: "'Europe/Athens'" +# ssp_timezone: "'Europe/Athens'" # The process name that should be used when logging to syslog -ssp_logging_processname: "simplesamlphp" +ssp_logging_processname: simplesamlphp # The name of the logfile when using the file handler for logging -ssp_logging_logfile: "simplesamlphp.log" +ssp_logging_logfile: simplesamlphp.log # Available log levels are: # ERR No statistics, only errors # WARNING No statistics, only warnings/errors @@ -156,53 +154,53 @@ ssp_logging_level: NOTICE ssp_logging_handler: syslog ssp_language_available: - - "en" + - en - "no" - - "nn" - - "se" - - "da" - - "de" - - "sv" - - "fi" - - "es" - - "ca" - - "fr" - - "it" - - "nl" - - "lb" - - "cs" - - "sl" - - "lt" - - "hr" - - "hu" - - "pl" - - "pt" - - "pt-br" - - "tr" - - "ja" - - "zh" - - "zh-tw" - - "ru" - - "et" - - "he" - - "id" - - "sr" - - "lv" - - "ro" - - "eu" - - "el" - - "af" - - "zu" - - "xh" + - nn + - se + - da + - de + - sv + - fi + - es + - ca + - fr + - it + - nl + - lb + - cs + - sl + - lt + - hr + - hu + - pl + - pt + - pt-br + - tr + - ja + - zh + - zh-tw + - ru + - et + - he + - id + - sr + - lv + - ro + - eu + - el + - af + - zu + - xh ssp_language_rtl: - - "ar" - - "dv" - - "fa" - - "ur" - - "he" + - ar + - dv + - fa + - ur + - he -ssp_language_default: "en" +ssp_language_default: en # Array of domains that are allowed when generating links or redirects # to URLs. SimpleSAMLphp will use this option to determine whether to @@ -218,7 +216,6 @@ ssp_language_default: "en" # Set to NULL to disable checking of URLs. # ssp_trusted_url_domains: null ssp_trusted_url_domains: [] - # Enable regular expression matching of ssp_trusted_url_domains. # Set to true to treat the values in ssp_trusted_url_domains as regular # expressions. Set to false to do exact string matching. @@ -233,31 +230,31 @@ ssp_trusted_url_domains: [] ssp_authproc_idp: - "30": # Adopts language from attribute to use in UI - class: "core:LanguageAdaptor" + class: core:LanguageAdaptor - "45": # Add a realm attribute from edupersonprincipalname - class: "core:StatisticsWithAttribute" - attributename: "realm" - type: "saml20-idp-SSO" + class: core:StatisticsWithAttribute + attributename: realm + type: saml20-idp-SSO - "50": - # Filter attributes by checking the 'attributes' parameter in metadata - # on IdP hosted and SP remote. - class: "core:AttributeLimit" + # Filter attributes by checking the 'attributes' parameter in metadata + # on IdP hosted and SP remote. + class: core:AttributeLimit - "99": - # If language is set in Consent module it will be added as an attribute. - class: "core:LanguageAdaptor" + # If language is set in Consent module it will be added as an attribute. + class: core:LanguageAdaptor # Authentication processing filters that will be executed for all SPs. # See https://simplesamlphp.org/docs/stable/simplesamlphp-authproc # The filters can be specified with PHP syntax using `ssp_authproc_sp_raw` or # alternatively, with YAML syntax using `ssp_authproc_sp`. -ssp_authproc_sp: +ssp_authproc_sp: - "90": # Adopts language from attribute to use in UI - class: "core:LanguageAdaptor" + class: core:LanguageAdaptor # This will be added before the config[] in SimpleSAMLphp authentication sources -#ssp_authsources_preamble: | +# ssp_authsources_preamble: | # function foo() { # // Do something # } @@ -273,341 +270,339 @@ ssp_authsources_saml: # this SP should contact. When NULL the user will be shown a list of # available IdPs. # idp_function: "findIdP()" - #disco_url: "/{{ ssp_alias }}/module.php/discopower/disco.php" + # disco_url: "/{{ ssp_alias }}/module.php/discopower/disco.php" # Set to true to generate self-signed SSL certificate for signing requests/ # response received from/sent to the IdP, as well as for receiving encrypted # responses. - ssl_certificate_generate: yes + ssl_certificate_generate: true # SSL certificate options (ignored when `ssl_certificate_generate` is set # to false): # SSL certificate Common Name (CN) - #ssl_certificate_cn: sp.example.com + # ssl_certificate_cn: sp.example.com # Alternatively, you can generate the certificate as follows: # openssl req -newkey rsa:2048 -new -x509 -days 3652 -subj "/CN=sp.example.com" -nodes -out sp-default-sp.crt -keyout sp-default-sp.key # SSL certificate - #ssl_certificate: | - # -----BEGIN CERTIFICATE----- - # ... - # -----END CERTIFICATE----- + # ssl_certificate: | + # -----BEGIN CERTIFICATE----- + # ... + # -----END CERTIFICATE----- # SSL certificate private key - #ssl_certificate_key: | - # -----BEGIN PRIVATE KEY----- - # ... - # -----END PRIVATE KEY----- + # ssl_certificate_key: | + # -----BEGIN PRIVATE KEY----- + # ... + # -----END PRIVATE KEY----- # Algorithm to use when signing any message generated by this SP: # - http://www.w3.org/2000/09/xmldsig#rsa-sha1 (default) # - http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 # - http://www.w3.org/2001/04/xmldsig-more#rsa-sha384 # - http://www.w3.org/2001/04/xmldsig-more#rsa-sha512 # Note: the use of SHA1 is deprecated and will be disallowed in the future. - #sign_algorithm: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" + # sign_algorithm: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" # Whether authentication requests, logout requests and logout responses # sent from this SP should be signed. Default is false. - #redirect_sign: true + # redirect_sign: true # Whether logout requests and logout responses received received by # this SP should be validated. Default is false. - #redirect_validate: true - # Whether to sign authentication requests sent from this SP. Default is + # redirect_validate: true + # Whether to sign authentication requests sent from this SP. Default is # false. - #sign_authnrequest: true + # sign_authnrequest: true # Whether to sign logout messages sent from this SP. Default is false. - #sign_logout: true + # sign_logout: true # SAML V2.0 Metadata Extensions for Login and Discovery # UIInfo Items # Localised list of names for this entity - #display_name: - # en: Example SP + # display_name: + # en: Example SP # Localised list of descriptions for this entity - #description: - # en: This is an SP used as an example + # description: + # en: This is an SP used as an example # Optional list of logos for this SP # - use a transparent background where appropriate # - use PNG or GIF (less preferred) images # - use HTTPS URLs in order to avoid mixed-content warnings within browsersk - #logos: - #- url: "https://example.com/logo-80x60.png" - # The rendered height of the logo measured in pixels. - #height: 60 - # The rendered width of the logo measured in pixels. - #width: 80 - # Optional language code for localised logos. - #lang: en - #- url: "https://example.com/logo-50x50.png" - # The rendered height of the logo measured in pixels. - #height: 50 - # The rendered width of the logo measured in pixels. - #width: 50 - # Optional language code for localised logos. - #lang: en + # logos: + # - url: "https://example.com/logo-80x60.png" + # The rendered height of the logo measured in pixels. + # height: 60 + # The rendered width of the logo measured in pixels. + # width: 80 + # Optional language code for localised logos. + # lang: en + # - url: "https://example.com/logo-50x50.png" + # height: 50 + # width: 50 + # lang: en # Localised list of URLs where more information about the entity is located - #information_url: + # information_url: # en: "http://sp.example.com/info/en" # Localised list of URLs where the entity's privacy statement is located - #privacy_statement_url: + # privacy_statement_url: # en: "http://sp.example.com/privacy/en" - #entity_attributes: - #- attribute_name: "http://macedir.org/entity-category" - # attribute_values: - # - "http://www.geant.net/uri/dataprotection-code-of-conduct/v1" - # Optional list of contacts in addition to the technical contact configured + # entity_attributes: + # - attribute_name: "http://macedir.org/entity-category" + # attribute_values: + # - "http://www.geant.net/uri/dataprotection-code-of-conduct/v1" + # Optional list of contacts in addition to the technical contact configured # through config/config.php - #contacts: - # The type of contact. The possible values are `technical`, `support`, - # `administrative`, `billing`, and `other`. - #- contact_type: "technical" - # Optional name of the company for the contact person. - #company: "ACME" - # Optional given (first) name of the contact person. - #given_name: "Jane" - # Optional surname of the contact person. - #sur_name: "Doe" - # Optional `mailto:` URI representing e-mail address of contact person. - #email_address: "mailto:jane.doe@acme.example.com" - # Optional telephone number of the contact person. - #telephone_numbers: "+31(0)12345678" - # To support a trust framework that requires extra attributes on the - # contact person element in your metadata (e.g. SIRTFI), you can specify - # an array of attributes on a contact - #- contact_type: "other" - # Optional given (first) name of the contact person. - #given_name: "Security Response Team" - # Optional `mailto:` URI representing e-mail address of contact person. - #email_address: "mailto:security@example.com" - #attributes: - # "xmlns:remd": "http://refeds.org/metadata" - # "remd:contactType": "http://refeds.org/metadata/contactType/security" + # contacts: + # The type of contact. The possible values are `technical`, `support`, + # `administrative`, `billing`, and `other`. + # - contact_type: "technical" + # Optional name of the company for the contact person. + # company: "ACME" + # Optional given (first) name of the contact person. + # given_name: "Jane" + # Optional surname of the contact person. + # sur_name: "Doe" + # Optional `mailto:` URI representing e-mail address of contact person. + # email_address: "mailto:jane.doe@acme.example.com" + # Optional telephone number of the contact person. + # telephone_numbers: "+31(0)12345678" + # To support a trust framework that requires extra attributes on the + # contact person element in your metadata (e.g. SIRTFI), you can specify + # an array of attributes on a contact + # - contact_type: "other" + # Optional given (first) name of the contact person. + # given_name: "Security Response Team" + # Optional `mailto:` URI representing e-mail address of contact person. + # email_address: "mailto:security@example.com" + # attributes: + # "xmlns:remd": "http://refeds.org/metadata" + # "remd:contactType": "http://refeds.org/metadata/contactType/security" # Localised names of the organisation responsible for this SP. - #organization_name: - # en: ACME + # organization_name: + # en: ACME # Localised user-friendly names of the organisation responsible for this # SP. - #organization_display_name: + # organization_display_name: # en: ACME # Localised URLs of the organisation responsible for this SP. - #organization_url: - # en: "https://www.acme.example.com/en" + # organization_url: + # en: "https://www.acme.example.com/en" # List of attributes this SP requests from the IdP. This list will be added # to the generated metadata. - # The attributes will be added without a `NameFormat` by default. Use the + # The attributes will be added without a `NameFormat` by default. Use the # name_format option to specify the `NameFormat` for the attributes. - #attributes: - #name_format: "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" - #required: - # uid: "urn:oid:0.9.2342.19200300.100.1.1" - #optional: - # eduPersonPrincipalName: "urn:oid:1.3.6.1.4.1.5923.1.1.1.6" - # eduPersonTargetedID: "urn:oid:1.3.6.1.4.1.5923.1.1.1.10" - # commonName: "urn:oid:2.5.4.3" - # givenName: "urn:oid:2.5.4.42" - # sn: "urn:oid:2.5.4.4" - # displayName: "urn:oid:2.16.840.1.113730.3.1.241" - # mail: "urn:oid:0.9.2342.19200300.100.1.3" - # The format of the NameID we request from the IdP. Defaults to the + # attributes: + # name_format: "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" + # required: + # uid: "urn:oid:0.9.2342.19200300.100.1.1" + # optional: + # eduPersonPrincipalName: "urn:oid:1.3.6.1.4.1.5923.1.1.1.6" + # eduPersonTargetedID: "urn:oid:1.3.6.1.4.1.5923.1.1.1.10" + # commonName: "urn:oid:2.5.4.3" + # givenName: "urn:oid:2.5.4.42" + # sn: "urn:oid:2.5.4.4" + # displayName: "urn:oid:2.16.840.1.113730.3.1.241" + # mail: "urn:oid:0.9.2342.19200300.100.1.3" + # The format of the NameID we request from the IdP. Defaults to the # transient format if unspecified. - #name_id_policy: "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" + # name_id_policy: "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" # List of supported ACS bindings. If unspecified, all will be added. # Possible values: # - urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST # - urn:oasis:names:tc:SAML:1.0:profiles:browser-post # - urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact # - urn:oasis:names:tc:SAML:1.0:profiles:artifact-01 - # - urn:oasis:names:tc:SAML:2.0:profiles:holder-of-key:SSO:browser - #acs_bindings: + # - urn:oasis:names:tc:SAML:2.0:profiles:holder-of-key:SSO:browser + # acs_bindings: # Optional list of processing filters to run after SP authentication. See # https://simplesamlphp.org/docs/stable/simplesamlphp-authproc # The filters can be specified with PHP syntax using `authproc_raw` or # alternatively, with YAML syntax using `authproc`. See examples below: - #authproc_raw: |- + # authproc_raw: |- # // Add the persistent NameID to the eduPersonTargetedID attribute # 60 => [ # 'class' => 'saml:PersistentNameID2TargetedID', # 'attribute' => 'eduPersonTargetedID', // The default # 'nameId' => true, // The default # ], - #authproc: - # - "60": - # class: "saml:PersistentNameID2TargetedID" - # attribute: "eduPersonTargetedID" - # nameId: no - -# Requires `authfacebook` module in `ssp_mods_enabled`. -#ssp_authsources_facebook: -# - name: facebook - # Register your Facebook application at http://www.facebook.com/developers - # App ID or API key (requests with App ID should be faster; https://github.com/facebook/php-sdk/issues/214) - #api_key: "123456789012345" - #secret: "1ab23456cdef78g90123h4ij56k789l0" - # Optional list of additional permissions to request from user. - # See https://developers.facebook.com/docs/facebook-login/permissions - #req_perms: "email" - # Optional list of user profile fields to request. - # When empty, only the app-specific user id and name will be returned - # See https://developers.facebook.com/docs/graph-api/reference/v2.6/user for the full list - #user_fields: "email,birthday,third_party_id,name,first_name,last_name" - -# Requires `authlinkedin` and `oauth` modules in `ssp_mods_enabled`. -#ssp_authsources_linkedin: -# - name: "linkedin" - #key: "xxxxxxxxxxxxxx" - #secret: "xxxxxxxxxxxxxxxx" - # See https://developer.linkedin.com/docs/fields/basic-profile for the full list - #user_fields: "id,formatted-name,first-name,last-name,email-address" - -# Requires `authlinkedin` and `oauth` module in `ssp_mods_enabled`. -#ssp_authsources_facebook: -# - name: facebook - # Register your Facebook application at http://www.facebook.com/developers - # App ID or API key (requests with App ID should be faster; https://github.com/facebook/php-sdk/issues/214) - #api_key: "123456789012345" - #secret: "1ab23456cdef78g90123h4ij56k789l0" - # Optional list of additional permissions to request from user. - # See https://developers.facebook.com/docs/facebook-login/permissions - #req_perms: "email" - # Optional list of user profile fields to request. - # When empty, only the app-specific user id and name will be returned - # See https://developers.facebook.com/docs/graph-api/reference/v2.6/user for the full list - #user_fields: "email,birthday,third_party_id,name,first_name,last_name" - -# IdP configuration -# Enable SAML 2.0 IdP functionality -ssp_idp_saml20_enabled: false -# Enable Shibboleth 1.3 IdP (SAML 1.1) functionality -ssp_idp_shib13_enabled: false -# Hosted IdP metadata -ssp_idp_hosts: [] - # The entity ID should be a URI. It can also be specified as `__DYNAMIC:1__`, - # `__DYNAMIC:2__`, ... in which case, the entity ID will be generated - # automatically. - # As of SimplesamlPHP version 2.x __DYNAMIC:.. is not supported. Thus we need to provide - # the entity ID ourselves, e.g. "https://rciam.example.org/saml-idp" - # or "urn:x-rciam:example-idp" (see https://simplesamlphp.org/docs/stable/simplesamlphp-reference-idp-hosted) - #- entity_id: "__DYNAMIC:1__" + # authproc: + # - "60": + # class: "saml:PersistentNameID2TargetedID" + # attribute: "eduPersonTargetedID" + # nameId: no + + # Requires `authfacebook` module in `ssp_mods_enabled`. + # ssp_authsources_facebook: + # - name: facebook + # Register your Facebook application at http://www.facebook.com/developers + # App ID or API key (requests with App ID should be faster; https://github.com/facebook/php-sdk/issues/214) + # api_key: "123456789012345" + # secret: "1ab23456cdef78g90123h4ij56k789l0" + # Optional list of additional permissions to request from user. + # See https://developers.facebook.com/docs/facebook-login/permissions + # req_perms: "email" + # Optional list of user profile fields to request. + # When empty, only the app-specific user id and name will be returned + # See https://developers.facebook.com/docs/graph-api/reference/v2.6/user + # for the full list + # user_fields: "email,birthday,third_party_id,name,first_name,last_name" + + # Requires `authlinkedin` and `oauth` modules in `ssp_mods_enabled`. + # ssp_authsources_linkedin: + # - name: "linkedin" + # key: "xxxxxxxxxxxxxx" + # secret: "xxxxxxxxxxxxxxxx" + # See https://developer.linkedin.com/docs/fields/basic-profile for the full list + # user_fields: "id,formatted-name,first-name,last-name,email-address" + + # Requires `authlinkedin` and `oauth` module in `ssp_mods_enabled`. + # ssp_authsources_facebook: + # - name: facebook + # Register your Facebook application at http://www.facebook.com/developers + # App ID or API key (requests with App ID should be faster; https://github.com/facebook/php-sdk/issues/214) + # api_key: "123456789012345" + # secret: "1ab23456cdef78g90123h4ij56k789l0" + # Optional list of additional permissions to request from user. + # See https://developers.facebook.com/docs/facebook-login/permissions + # req_perms: "email" + # Optional list of user profile fields to request. + # When empty, only the app-specific user id and name will be returned + # See https://developers.facebook.com/docs/graph-api/reference/v2.6/user for the full list + # user_fields: "email,birthday,third_party_id,name,first_name,last_name" + + # IdP configuration + # Enable SAML 2.0 IdP functionality + ssp_idp_saml20_enabled: false + # Enable Shibboleth 1.3 IdP (SAML 1.1) functionality + ssp_idp_shib13_enabled: false + # Hosted IdP metadata + ssp_idp_hosts: [] + # The entity ID should be a URI. It can also be specified as `__DYNAMIC:1__`, + # `__DYNAMIC:2__`, ... in which case, the entity ID will be generated + # automatically. + # As of SimplesamlPHP version 2.x __DYNAMIC:.. is not supported. Thus we need to provide + # the entity ID ourselves, e.g. "https://rciam.example.org/saml-idp" + # or "urn:x-rciam:example-idp" (see https://simplesamlphp.org/docs/stable/simplesamlphp-reference-idp-hosted) + # - entity_id: "__DYNAMIC:1__" # The hostname for this IdP. One of the IdPs can also have its `host` set # to `__DEFAULT__`, and that IdP will be used when no other entries in the # metadata matches. - #host: "__DEFAULT__" + # host: "__DEFAULT__" # Set to true to generate self-signed SSL certificate which should be # used by this IdP, in PEM format - #ssl_certificate_generate: yes + # ssl_certificate_generate: yes # SSL certificate options (ignored when `ssl_certificate_generate` is set # to false): # SSL certificate Common Name (CN) - #ssl_certificate_cn: idp.example.com + # ssl_certificate_cn: idp.example.com # Alternatively, you can generate the certificate as follows: # openssl req -newkey rsa:2048 -new -x509 -days 3652 -subj "/CN=idp.example.com" -nodes -out idp-__DYNAMIC:1__.crt -keyout idp-__DYNAMIC:1__.key # SSL certificate - #ssl_certificate: | - # -----BEGIN CERTIFICATE----- - # ... - # -----END CERTIFICATE----- + # ssl_certificate: | + # -----BEGIN CERTIFICATE----- + # ... + # -----END CERTIFICATE----- # SSL certificate private key - #ssl_certificate_key: | - # -----BEGIN PRIVATE KEY----- - # ... - # -----END PRIVATE KEY----- + # ssl_certificate_key: | + # -----BEGIN PRIVATE KEY----- + # ... + # -----END PRIVATE KEY----- # Algorithm to use when signing any message generated by this IdP: # - http://www.w3.org/2000/09/xmldsig#rsa-sha1 (default) # - http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 # - http://www.w3.org/2001/04/xmldsig-more#rsa-sha384 # - http://www.w3.org/2001/04/xmldsig-more#rsa-sha512 # Note: the use of SHA1 is deprecated and will be disallowed in the future. - #sign_algorithm: "http://www.w3.org/2000/09/xmldsig#rsa-sha256" + # sign_algorithm: "http://www.w3.org/2000/09/xmldsig#rsa-sha256" # Whether logout requests and logout responses sent from this IdP should be # signed. Default is false. - #redirect_sign: true + # redirect_sign: true # Whether authentication requests, logout requests and logout responses # received/sent from this IdP should be validated. Default is false. - #redirect_validate: true + # redirect_validate: true # The authentication source to be used to authenticate users on this IdP. - #auth: default-sp - #contacts: - # The type of contact. The possible values are `technical`, `support`, - # `administrative`, `billing`, and `other`. - #- contact_type: "technical" - # Optional name of the company for the contact person. - #company: "ACME" - # Optional given (first) name of the contact person. - #given_name: "Jane" - # Optional surname of the contact person. - #sur_name: "Doe" - # Optional `mailto:` URI representing e-mail address of contact person. - #email_address: "mailto:jane.doe@acme.example.com" - # Optional telephone number of the contact person. - #telephone_numbers: "+31(0)12345678" - # A list with scopes for this IdP. The scopes will be added to the + # auth: default-sp + # contacts: + # The type of contact. The possible values are `technical`, `support`, + # `administrative`, `billing`, and `other`. + # - contact_type: "technical" + # Optional name of the company for the contact person. + # company: "ACME" + # Optional given (first) name of the contact person. + # given_name: "Jane" + # Optional surname of the contact person. + # sur_name: "Doe" + # Optional `mailto:` URI representing e-mail address of contact person. + # email_address: "mailto:jane.doe@acme.example.com" + # Optional telephone number of the contact person. + # telephone_numbers: "+31(0)12345678" + # A list with scopes for this IdP. The scopes will be added to the # generated XML metadata. A scope can either be a domain name or a regular # expression matching a number of domains. - #scopes: - # - domain1.example.com - # - domain2.example.com + # scopes: + # - domain1.example.com + # - domain2.example.com # Localised names of the organisation responsible for this IdP. - #organization_name: - # en: ACME + # organization_name: + # en: ACME # Localised user-friendly names of the organisation responsible for this # IdP. - #organization_display_name: - # en: ACME + # organization_display_name: + # en: ACME # Localised URLs of the organisation responsible for this IdP. - #organization_url: - # en: "https://www.acme.example.com/en" + # organization_url: + # en: "https://www.acme.example.com/en" # SAML V2.0 Metadata Extensions for Login and Discovery # UIInfo Items # Localised list of names for this entity - #display_name: - # en: Example IdP + # display_name: + # en: Example IdP # Localised list of descriptions for this entity - #description: - # en: This is an IdP used as an example + # description: + # en: This is an IdP used as an example # Localised list of URLs where more information about the entity is located # Optional list of logos for this IdP # - use a transparent background where appropriate # - use PNG or GIF (less preferred) images # - use HTTPS URLs in order to avoid mixed-content warnings within browsers - #logos: - #- url: "https://example.com/logo-80x60.png" - # The rendered height of the logo measured in pixels. - #height: 60 - # The rendered width of the logo measured in pixels. - #width: 80 - # Optional language code for localised logos. - #lang: en - #- url: "https://example.com/logo-50x50.png" - # The rendered height of the logo measured in pixels. - #height: 50 - # The rendered width of the logo measured in pixels. - #width: 50 - # Optional language code for localised logos. - #lang: en - #information_url: - # en: "https://idp1.example.com/info/en" + # logos: + # - url: "https://example.com/logo-80x60.png" + # The rendered height of the logo measured in pixels. + # height: 60 + # The rendered width of the logo measured in pixels. + # width: 80 + # Optional language code for localised logos. + # lang: en + # - url: "https://example.com/logo-50x50.png" + # The rendered height of the logo measured in pixels. + # height: 50 + # The rendered width of the logo measured in pixels. + # width: 50 + # Optional language code for localised logos. + # lang: en + # information_url: + # en: "https://idp1.example.com/info/en" # Localised list of URLs where the entity's privacy statement is located - #privacy_statement_url: - # en: "https://idp1.example.com/privacy/en" + # privacy_statement_url: + # en: "https://idp1.example.com/privacy/en" # DiscoHints items - # List of IPv4 and IPv6 addresses in CIDR notation serviced by or + # List of IPv4 and IPv6 addresses in CIDR notation serviced by or # associated with this IdP. - #ip_hints: - # - "130.59.0.0/16" - # - "2001:620::0/96" + # ip_hints: + # - "130.59.0.0/16" + # - "2001:620::0/96" # List of domain names serviced by or associated with this IdP. - #domain_hints: - # - "example.com" - # - "www.example.com" + # domain_hints: + # - "example.com" + # - "www.example.com" # List of geographic coordinates serviced by or associated with this IdP. # Coordinates are given in the geo URI scheme (RFC5870). - #geolocation_hints: - # - "geo:47.37328,8.531126" - # - "geo:19.34343,12.342514" - #entity_attributes: - #- attribute_name: "http://macedir.org/entity-category" - # attribute_values: - # - "http://www.geant.net/uri/dataprotection-code-of-conduct/v1" + # geolocation_hints: + # - "geo:47.37328,8.531126" + # - "geo:19.34343,12.342514" + # entity_attributes: + # - attribute_name: "http://macedir.org/entity-category" + # attribute_values: + # - "http://www.geant.net/uri/dataprotection-code-of-conduct/v1" # SAML2-specific options # The value to set in the Format field of attribute statements. - #attributes_name_format: "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" + # attributes_name_format: "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" # The format of the NameID supported by this IdP. Defaults to the transient # format if unspecified. - #name_id_format: "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" + # name_id_format: "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" # Override the default URL for the SingleSignOnService for this IdP. # This is an absolute URL. The default value is: # /module.php/saml/idp/singleSignOnService @@ -615,7 +610,7 @@ ssp_idp_hosts: [] # in the messages sent to others. You must also configure your webserver # to deliver this URL to the correct PHP page. # Uncomment the following for backwards compatibility with SSP v1.x - #sso_service: "https://{{ rciam_hostname }}/{{ ssp_baseurlpath }}/saml2/idp/SSOService.php" + # sso_service: "https://{{ rciam_hostname }}/{{ ssp_baseurlpath }}/saml2/idp/SSOService.php" # Override the default URL for the SingleLogoutService for this IdP. # This is an absolute URL. The default value is: # /module.php/saml/idp/singleLogout @@ -623,12 +618,12 @@ ssp_idp_hosts: [] # in the messages sent to others. You must also configure your webserver # to deliver this URL to the correct PHP page. # Uncomment the following for backwards compatibility with SSP v1.x - #slo_service: "https://{{ rciam_hostname }}/{{ ssp_baseurlpath }}/saml2/idp/SingleLogoutService.php" + # slo_service: "https://{{ rciam_hostname }}/{{ ssp_baseurlpath }}/saml2/idp/SingleLogoutService.php" # Optional list of processing filters to run for this IdP. See # https://simplesamlphp.org/docs/stable/simplesamlphp-authproc # The filters can be specified with PHP syntax using `authproc_raw` or # alternatively, with YAML syntax using `authproc`. See examples below: - #authproc_raw: |- + # authproc_raw: |- # 80 => array( # // Maps attribute OIDs to names. # // Usually combined with SAML:2.0:attrname-format:uri @@ -645,36 +640,36 @@ ssp_idp_hosts: [] # 'hiddenAttributes' => array( # ), # ), - #authproc: - # - "80": - # Maps attribute OIDs to names. - # Usually combined with SAML:2.0:attrname-format:uri - #class: "core:AttributeMap" - #oid2name: - # - "90": - # Requires `consent` in `ssp_mods_enabled`. - #class: "consent:Consent" - # The Consent storage backend. Currently only `consent:Cookie` is - # supported. This option is optional. If omitted, the user is still - # asked to consent, but the decision is not saved. - #store: "consent:Cookie" - # Optional flag that indicates whether the values of the attributes - # should be used in calculating the unique hashes that identify the - # consent. If includeValues is set and the value of an attribute - # changes, then the consent becomes invalid. Defaults to false. - #includeValues: false - # Optional flag that indicates whether the "Remember" consent - # checkbox is checkd by default. Defaults to false. - #checked: false - # Indicates whether the "Yes" or "No" button is in fucus by default. - # This option is optional and can take the value 'yes' or 'no'. - # If omitted, neither will recive focus. - #focus: "yes" | "no" - # Optional list of attributes whose values should be hidden. - # Default behaviour is that all attribute values are shown. - #hiddenAttributes: - #- entity_id: "__DYNAMIC:2__" - # host: "idp2.example.com" + # authproc: + # - "80": + # Maps attribute OIDs to names. + # Usually combined with SAML:2.0:attrname-format:uri + # class: "core:AttributeMap" + # oid2name: + # - "90": + # Requires `consent` in `ssp_mods_enabled`. + # class: "consent:Consent" + # The Consent storage backend. Currently only `consent:Cookie` is + # supported. This option is optional. If omitted, the user is still + # asked to consent, but the decision is not saved. + # store: "consent:Cookie" + # Optional flag that indicates whether the values of the attributes + # should be used in calculating the unique hashes that identify the + # consent. If includeValues is set and the value of an attribute + # changes, then the consent becomes invalid. Defaults to false. + # includeValues: false + # Optional flag that indicates whether the "Remember" consent + # checkbox is checkd by default. Defaults to false. + # checked: false + # Indicates whether the "Yes" or "No" button is in fucus by default. + # This option is optional and can take the value 'yes' or 'no'. + # If omitted, neither will recive focus. + # focus: "yes" | "no" + # Optional list of attributes whose values should be hidden. + # Default behaviour is that all attribute values are shown. + # hiddenAttributes: + # - entity_id: "__DYNAMIC:2__" + # host: "idp2.example.com" ## Extra SSP files to copy, e.g. dictionaries, attribute maps, certificates, etc ssp_extra_files: [] @@ -717,30 +712,28 @@ ssp_mods_enabled: # List of SSP modules to disable # Deprecated for SSP v2.0 ssp_mods_disabled: [] - # - admin - # - authorize - # - consent - # - core - # - discopower - # - exampleattributeserver - # - expirycheck - # - ldap - # - memcookie - # - multiauth - # - portal - # - saml - # - sanitycheck - - +# - admin +# - authorize +# - consent +# - core +# - discopower +# - exampleattributeserver +# - expirycheck +# - ldap +# - memcookie +# - multiauth +# - portal +# - saml +# - sanitycheck # Configuration options for automated SAML metadata management. -# Requires `metarefresh` and `cron` modules in `ssp_mods_enabled`. +# Requires `metarefresh` and `cron` modules in `ssp_mods_enabled`. # # Options applicable to SSP version < 2 # # Cron module URL -ssp_mod_cron_url: "https://localhost/{{ ssp_baseurlpath }}/module.php/cron/cron.php" +ssp_mod_cron_url: https://localhost/{{ ssp_baseurlpath }}/module.php/cron/cron.php # # Options applicable to SSP version >= 2 @@ -748,7 +741,7 @@ ssp_mod_cron_url: "https://localhost/{{ ssp_baseurlpath }}/module.php/cron/cron. # Maximum amount of memory each metarefresh cron tag may consume # (see http://php.net/memory-limit) -ssp_mod_cron_job_memory_limit: "768M" +ssp_mod_cron_job_memory_limit: 768M # # Common options for all SSP versions @@ -759,91 +752,89 @@ ssp_mod_cron_job_memory_limit: "768M" ssp_mod_cron_job_max_execution_time: 90 # Secret key used to restrict access to your cron. -#ssp_mod_cron_secret: "secret" +# ssp_mod_cron_secret: "secret" ssp_mod_cron_entries: - - name: "SSP metarefresh [daily]" - tag: "daily" - file: "simplesamlphp" + - name: SSP metarefresh [daily] + tag: daily + file: simplesamlphp user: "{{ ssp_webuser }}" minute: "30" hour: "3" - - name: "SSP metarefresh [hourly]" - tag: "hourly" - file: "simplesamlphp" + - name: SSP metarefresh [hourly] + tag: hourly + file: simplesamlphp user: "{{ ssp_webuser }}" minute: "15" # Cron job variables ssp_mod_cron_vars: - - name: "MAILTO" - value: "na@example.org" - file: "simplesamlphp" - + - name: MAILTO + value: na@example.org + file: simplesamlphp # Global blacklist: Optional list of entityIDs that should be excluded from ALL # metadata sets. -#ssp_mod_metarefresh_blacklist: -# - "https://my.own.domain.com/ssp/saml2/idp/metadata.php" +# ssp_mod_metarefresh_blacklist: +# - "https://my.own.domain.com/ssp/saml2/idp/metadata.php" # -#ssp_mod_metarefresh_sets: - #- name: reep +# ssp_mod_metarefresh_sets: +# - name: reep # Can be `hourly` or `daily` - #cron: hourly + # cron: hourly # A list of one or more sources that will be included in this metadata set. # The filters can be specified with PHP syntax using `sources_raw` or # alternatively, with YAML syntax using `sources`. See examples below: - #sources_raw: include 'path-to-file.php' - #sources: - # The source URL where the metadata will be fetched from. - #- url: "https://reep.refeds.org/entity/69/latest_metadata/" - # The fingerprint of the certificate used to sign the metadata. + # sources_raw: include 'path-to-file.php' + # sources: + # The source URL where the metadata will be fetched from. + # - url: "https://reep.refeds.org/entity/69/latest_metadata/" + # The fingerprint of the certificate used to sign the metadata. # You can omit this option if you don't want to validate the signature # on the metadata. - #validate_fingerprint: "59:1D:4B:46:70:46:3E:ED:A9:1F:CC:81:6D:C0:AF:2A:09:2A:A8:01" + # validate_fingerprint: "59:1D:4B:46:70:46:3E:ED:A9:1F:CC:81:6D:C0:AF:2A:09:2A:A8:01" # Optional list of tags/labels for the entities in the metadata. - #tags: + # tags: # - tag1 # - tag2 # Optional list of processing filters to run for this entity. See # https://simplesamlphp.org/docs/stable/simplesamlphp-authproc # The filters can be specified with PHP syntax using `authproc_raw` or # alternatively, with YAML syntax using `authproc`. See examples below: - #authproc_raw: |- + # authproc_raw: |- # 50 => [ # 'class' => 'core:ExampleFilter', # ], - #authproc: + # authproc: # - "50": # class: "core:ExampleFilter" - #extra_parameters: |- + # extra_parameters: |- # 'foo' => 'bar', # Optional list of entityIDs that should be excluded from this src. - #blacklist: + # blacklist: # - "https://black.example.com/idp" # - "https://black.example.com/sp" # Optional list of entityIDs that should be included from this src. - #whitelist: + # whitelist: # - "https://white.example.com/idp" # - "https://white.example.com/sp" # Maximum cache time in days - #expire_after: 7 + # expire_after: 7 # Output directory is relative to {{ ssp_path }}/metadata/ - #output_dir: metarefresh-aarc + # output_dir: metarefresh-aarc # Can be `flatfile` or `serialize` - #output_format: serialize - + # output_format: serialize # Configuration options for the discopower module that provides a more # user-friendly IdP discovery service compared to the default. # Requires `discopower` module in `ssp_mods_enabled`. # # List of tags (mapped to tabs) that should be listed in a specific order. -#ssp_mod_discopower_taborder: +# ssp_mod_discopower_taborder: # - tag1 # - tag2 # Filter list of IdPs by matching the beginning of search keywords -#ssp_mod_discopower_suggest: false +# ssp_mod_discopower_suggest: false # List of tab/tag translations to add -#ssp_mod_discopower_dictionaries: +# ssp_mod_discopower_dictionaries: # - tag1: # en: "Tab One" # - tag2: diff --git a/roles/ssp/handlers/main.yml b/roles/ssp/handlers/main.yml index c46a3249..a2babca4 100644 --- a/roles/ssp/handlers/main.yml +++ b/roles/ssp/handlers/main.yml @@ -1,10 +1,6 @@ --- - -- name: restart webserver - service: +- name: Restart webserver + ansible.builtin.service: name: "{{ ssp_webserver }}" state: restarted - become: yes - - - + become: true diff --git a/roles/ssp/tasks/composer.yml b/roles/ssp/tasks/composer.yml index c1921e87..106bf41a 100644 --- a/roles/ssp/tasks/composer.yml +++ b/roles/ssp/tasks/composer.yml @@ -1,77 +1,91 @@ --- - - name: Create installation directory for composer - file: + ansible.builtin.file: state: directory - path: '{{ ssp_composer_install_directory }}' - become: yes + path: "{{ ssp_composer_install_directory }}" + mode: "0644" + become: true tags: - ssp:install - ssp:install:composer -- name: check if exist composer executable exists - stat: +- name: Check if exist composer executable exists + ansible.builtin.stat: path: "{{ ssp_composer_executable }}" register: composer_exists - become: yes + become: true tags: - ssp:install - ssp:install:composer -- name: Download composer +# Use uri here +- name: Download composer # noqa command-instead-of-module no-changed-when ansible.builtin.command: curl -sS https://getcomposer.org/installer -o composer-setup.php args: - chdir: '{{ ssp_composer_install_directory }}' - when: composer_exists.stat.exists == False - become: yes + chdir: "{{ ssp_composer_install_directory }}" + when: not composer_exists.stat.exists + become: true tags: - ssp:install - ssp:install:composer + creates: "{{ ssp_composer_install_directory }}/composer-setup.php" -- name: Generate composer hash +# Use uri here +- name: Generate composer hash # noqa command-instead-of-module ansible.builtin.command: curl -sS https://composer.github.io/installer.sig register: composerhash - when: composer_exists.stat.exists == False - become: yes + when: not composer_exists.stat.exists + become: true tags: - ssp:install - ssp:install:composer + changed_when: false # noqa no-changed-when - name: Print composer hash ansible.builtin.debug: msg: "Composer hash is: {{ composerhash.stdout }}" when: composerhash.stdout is defined - become: yes + become: true tags: - ssp:install - ssp:install:composer -- name: Verify composer - command: php -r "if (hash_file('SHA384', 'composer-setup.php') === '{{ composerhash.stdout }}') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;" +- name: Verify composer # noqa command-instead-of-module + ansible.builtin.command: |- + php -r \ + "if (hash_file('SHA384', 'composer-setup.php') === '{{ composerhash.stdout }}') \ + { echo 'Installer verified'; } \ + else \ + { echo 'Installer corrupt'; unlink('composer-setup.php'); } \ + echo PHP_EOL;" args: - chdir: '{{ ssp_composer_install_directory }}' - when: composer_exists.stat.exists == False - become: yes + chdir: "{{ ssp_composer_install_directory }}" + when: not composer_exists.stat.exists + become: true tags: - ssp:install - ssp:install:composer + changed_when: false + failed_when: false1 -- name: Composer setup +# Use community.general.composer here +- name: Composer setup # noqa no-changed-when ansible.builtin.command: php composer-setup.php args: - chdir: '{{ ssp_composer_install_directory }}' - when: composer_exists.stat.exists == False - become: yes + chdir: "{{ ssp_composer_install_directory }}" + when: not composer_exists.stat.exists + become: true tags: - ssp:install - ssp:install:composer + changed_when: false -- name: Move Composer globally - ansible.builtin.command: "mv composer.phar {{ ssp_composer_executable }}" +- name: Move Composer globally # noqa no-changed-when + ansible.builtin.command: mv composer.phar {{ ssp_composer_executable }} args: - chdir: '{{ ssp_composer_install_directory }}' - become: yes - when: composer_exists.stat.exists == False + chdir: "{{ ssp_composer_install_directory }}" + become: true + when: not composer_exists.stat.exists tags: - ssp:install - ssp:install:composer @@ -79,8 +93,8 @@ - name: Set permissions on Composer ansible.builtin.file: path: "{{ ssp_composer_executable }}" - mode: "a+x" - become: yes + mode: a+x + become: true tags: - ssp:install - ssp:install:composer diff --git a/roles/ssp/tasks/configure-common.yml b/roles/ssp/tasks/configure-common.yml index 008cce99..a324bda9 100644 --- a/roles/ssp/tasks/configure-common.yml +++ b/roles/ssp/tasks/configure-common.yml @@ -1,258 +1,279 @@ # file: ssp/tasks/configure-common.php # --- - - - name: Configure SSP - template: + ansible.builtin.template: src: "{{ item }}" dest: "{{ ssp_configdir }}/config.php" - backup: yes - force: yes + backup: true + force: true + mode: "0644" with_first_found: - - "config/config-{{ ssp_major_version }}.{{ ssp_minor_version }}.php.j2" - - "config/config-{{ ssp_major_version }}.php.j2" - - "config/config.php.j2" - become: yes + - config/config-{{ ssp_major_version }}.{{ ssp_minor_version }}.php.j2 + - config/config-{{ ssp_major_version }}.php.j2 + - config/config.php.j2 + become: true tags: - ssp:config:config - name: Generate self-signed SP certificates - command: openssl req -newkey rsa:2048 -new -x509 -days 3652 -subj "/CN={{ item.ssl_certificate_cn }}" -nodes -out sp-{{ item.name }}.crt -keyout sp-{{ item.name }}.key + ansible.builtin.command: |- + openssl req -newkey rsa:2048 \ + -new -x509 \ + -days 3652 \ + -subj "/CN={{ item.ssl_certificate_cn }}" \ + -nodes -out sp-{{ item.name }}.crt \ + -keyout sp-{{ item.name }}.key args: chdir: "{{ ssp_certdir }}" creates: "{{ ssp_certdir }}/sp-{{ item.name }}.key" with_items: "{{ ssp_authsources_saml }}" - when: item.ssl_certificate_generate | default(True) | bool == True - become: yes + when: item.ssl_certificate_generate | default(True) | bool + become: true tags: - ssp:config:authsources - name: Copy SP SSL certificate (.crt) - copy: - content: '{{ item.ssl_certificate }}' + ansible.builtin.copy: + content: "{{ item.ssl_certificate }}" dest: "{{ ssp_certdir }}/sp-{{ item.name }}.crt" owner: "{{ ssp_webuser }}" group: "{{ ssp_webgroup }}" mode: "0644" with_items: "{{ ssp_authsources_saml }}" - when: item.ssl_certificate_generate | default(True) | bool == False - become: yes + when: not (item.ssl_certificate_generate | default(True) | bool) + become: true tags: - ssp:config:authsources - name: Copy SP SSL certificate (.key) - copy: - content: '{{ item.ssl_certificate_key }}' + ansible.builtin.copy: + content: "{{ item.ssl_certificate_key }}" dest: "{{ ssp_certdir }}/sp-{{ item.name }}.key" owner: "{{ ssp_webuser }}" group: "{{ ssp_webgroup }}" mode: "0600" with_items: "{{ ssp_authsources_saml }}" - when: item.ssl_certificate_generate | default(True) | bool == False - become: yes - no_log: yes + when: not (item.ssl_certificate_generate | default(True) | bool) + become: true + no_log: true tags: - ssp:config:authsources - name: Ensure SP certificate keys are installed - file: + ansible.builtin.file: state: file path: "{{ ssp_certdir }}/sp-{{ item.name }}.key" owner: "{{ ssp_webuser }}" group: "{{ ssp_webgroup }}" mode: "0600" with_items: "{{ ssp_authsources_saml }}" - when: item.ssl_certificate_generate | default(True) | bool == False or item.ssl_certificate_key is defined - become: yes + when: not (item.ssl_certificate_generate | default(True) | bool) or item.ssl_certificate_key is defined + become: true tags: - ssp:config:authsources - name: Ensure SP certificates are installed - file: + ansible.builtin.file: state: file path: "{{ ssp_certdir }}/sp-{{ item.name }}.crt" owner: "{{ ssp_webuser }}" group: "{{ ssp_webgroup }}" mode: "0644" with_items: "{{ ssp_authsources_saml }}" - when: item.ssl_certificate_generate | default(True) | bool == False or item.ssl_certificate is defined - become: yes + when: not (item.ssl_certificate_generate | default(True) | bool) or item.ssl_certificate is defined + become: true tags: - ssp:config:authsources - name: Configure SSP authN sources - template: + ansible.builtin.template: src: "{{ item }}" dest: "{{ ssp_configdir }}/authsources.php" - backup: yes - force: yes + backup: true + force: true + mode: "0600" with_first_found: - - "config/authsources-{{ ssp_major_version }}.{{ ssp_minor_version }}.php.j2" - - "config/authsources-{{ ssp_major_version }}.php.j2" - - "config/authsources.php.j2" - become: yes + - config/authsources-{{ ssp_major_version }}.{{ ssp_minor_version }}.php.j2 + - config/authsources-{{ ssp_major_version }}.php.j2 + - config/authsources.php.j2 + become: true tags: - ssp:config:authsources +# Use community.crypto modules here - name: Generate self-signed IdP certificates - command: openssl req -newkey rsa:2048 -new -x509 -days 3652 -subj "/CN={{ item.ssl_certificate_cn }}" -nodes -out idp-{{ item.entity_id }}.crt -keyout idp-{{ item.entity_id }}.key + ansible.builtin.command: |- + openssl req -newkey rsa:2048 \ + -new -x509 -days 3652 \ + -subj "/CN={{ item.ssl_certificate_cn }}" \ + -nodes -out idp-{{ item.entity_id }}.crt \ + -keyout idp-{{ item.entity_id }}.key args: chdir: "{{ ssp_certdir }}" creates: "{{ ssp_certdir }}/idp-{{ item.entity_id }}.key" with_items: "{{ ssp_idp_hosts }}" when: (ssp_idp_saml20_enabled or ssp_idp_shib13_enabled) and item.ssl_certificate_generate | default(True) - become: yes + become: true tags: - ssp:config:saml20-idp-hosted - ssp:config:shib13-idp-hosted - name: Copy IdP certificate (.crt) - copy: - content: '{{ item.ssl_certificate }}' - dest: "{{ ssp_certdir }}idp-{{ item.entity_id | replace('https://','') | replace('/','_') | replace('.','_')}}.crt" + ansible.builtin.copy: + content: "{{ item.ssl_certificate }}" + dest: "{{ ssp_certdir }}idp-{{ item.entity_id | replace('https://', '') | replace('/', '_') | replace('.', '_') }}.crt" owner: "{{ ssp_webuser }}" group: "{{ ssp_webgroup }}" mode: "0644" with_items: "{{ ssp_idp_hosts }}" - when: item.ssl_certificate_generate | default(True) | bool == False and item.ssl_certificate is defined - become: yes - no_log: yes + when: not (item.ssl_certificate_generate | default(True) | bool) and item.ssl_certificate is defined + become: true + no_log: true tags: - ssp:config:saml20-idp-hosted - ssp:config:shib13-idp-hosted - name: Copy IdP certificate (.key) - copy: - content: '{{ item.ssl_certificate_key }}' - dest: "{{ ssp_certdir }}/idp-{{ item.entity_id | replace('https://','') | replace('/','_') | replace('.','_')}}.key" + ansible.builtin.copy: + content: "{{ item.ssl_certificate_key }}" + dest: "{{ ssp_certdir }}/idp-{{ item.entity_id | replace('https://', '') | replace('/', '_') | replace('.', '_') }}.key" owner: "{{ ssp_webuser }}" group: "{{ ssp_webgroup }}" mode: "0600" with_items: "{{ ssp_idp_hosts }}" - when: item.ssl_certificate_generate | default(True) | bool == False and item.ssl_certificate_key is defined - become: yes - no_log: yes + when: not (item.ssl_certificate_generate | default(True) | bool) and item.ssl_certificate_key is defined + become: true + no_log: true tags: - ssp:config:saml20-idp-hosted - ssp:config:shib13-idp-hosted - name: Ensure IdP certificate keys are installed - file: + ansible.builtin.file: state: file - path: "{{ ssp_certdir }}/idp-{{ item.entity_id | replace('https://','') | replace('/','_') | replace('.','_')}}.key" + path: "{{ ssp_certdir }}/idp-{{ item.entity_id | replace('https://', '') | replace('/', '_') | replace('.', '_') }}.key" owner: "{{ ssp_webuser }}" group: "{{ ssp_webgroup }}" mode: "0600" with_items: "{{ ssp_idp_hosts }}" when: ssp_idp_saml20_enabled or ssp_idp_shib13_enabled - become: yes + become: true tags: - ssp:config:saml20-idp-hosted - ssp:config:shib13-idp-hosted - name: Ensure IdP certificates are installed - file: + ansible.builtin.file: state: file - path: "{{ ssp_certdir }}/idp-{{ item.entity_id | replace('https://','') | replace('/','_') | replace('.','_')}}.crt" + path: "{{ ssp_certdir }}/idp-{{ item.entity_id | replace('https://', '') | replace('/', '_') | replace('.', '_') }}.crt" owner: "{{ ssp_webuser }}" group: "{{ ssp_webgroup }}" mode: "0644" with_items: "{{ ssp_idp_hosts }}" when: ssp_idp_saml20_enabled or ssp_idp_shib13_enabled - become: yes + become: true tags: - ssp:config:saml20-idp-hosted - ssp:config:shib13-idp-hosted - name: Configure SSP hosted SAML 2.0 IdP metadata - include_tasks: configure-saml20-idp-hosted.yml + ansible.builtin.include_tasks: configure-saml20-idp-hosted.yml when: ssp_idp_saml20_enabled tags: - ssp:config:saml20-idp-hosted - name: Configure SSP hosted SAML 1.1 IdP metadata - include_tasks: configure-shib13-idp-hosted.yml + ansible.builtin.include_tasks: configure-shib13-idp-hosted.yml when: ssp_idp_shib13_enabled tags: - ssp:config:shib13-idp-hosted - name: Ensure SSP extra files are copied - copy: + ansible.builtin.copy: src: "{{ item.src_path }}" dest: "{{ item.dest_path }}" - backup: yes + backup: true + mode: "0600" with_items: "{{ ssp_extra_files }}" when: item.src_path is defined and item.dest_path is defined - become: yes + become: true tags: - ssp:config:files +# No command - should be empty file with file module - name: Enable required SSP modules - command: touch "{{ ssp_path }}/modules/{{ item }}/enable" + ansible.builtin.command: touch "{{ ssp_path }}/modules/{{ item }}/enable" args: creates: "{{ ssp_path }}/modules/{{ item }}/enable" with_items: "{{ ssp_mods_enabled }}" - when: "{{ ssp_major_version|float < 2}}" - become: yes + when: ssp_major_version | float < 2 + become: true tags: - ssp:config:mods - name: Disable unnecessary SSP modules - command: touch "{{ ssp_path }}/modules/{{ item }}/disable" + ansible.builtin.command: touch "{{ ssp_path }}/modules/{{ item }}/disable" args: creates: "{{ ssp_path }}/modules/{{ item }}/disable" with_items: "{{ ssp_mods_disabled }}" - when: "{{ ssp_major_version|float < 2}}" - become: yes + when: ssp_major_version | float < 2 + become: true tags: - ssp:config:mods - name: Ensure required SSP metarefresh module dirs exist - file: path={{ ssp_metadatadir }}/{{ item.output_dir }} state=directory owner={{ssp_webuser }} group={{ ssp_webgroup }} + ansible.builtin.file: + path: "{{ ssp_metadatadir }}" + state: directory + owner: "{{ ssp_webuser }}" + group: "{{ ssp_webgroup }}" + mode: "0755" with_items: "{{ ssp_mod_metarefresh_sets }}" when: "'metarefresh' in ssp_mods_enabled" - become: yes + become: true tags: - ssp:config:mods - ssp:config:mods:metarefresh - name: Configure SSP metarefresh module - template: + ansible.builtin.template: src: "{{ item }}" dest: "{{ ssp_configdir }}/{{ ssp_mod_metarefresh.template.dest }}" - backup: yes - force: yes + backup: true + force: true + mode: "0644" with_first_found: - "{{ ssp_mod_metarefresh.template.src }}-{{ ssp_major_version }}.{{ ssp_minor_version }}.php.j2" - "{{ ssp_mod_metarefresh.template.src }}-{{ ssp_major_version }}.php.j2" - "{{ ssp_mod_metarefresh.template.src }}.php.j2" when: "'metarefresh' in ssp_mods_enabled" register: ssp_mod_metarefresh_config - become: yes + become: true tags: - ssp:config:mods - ssp:config:mods:metarefresh - name: Configure SSP cron module - template: + ansible.builtin.template: src: "{{ item }}" dest: "{{ ssp_configdir }}/module_cron.php" - backup: yes - force: yes + backup: true + force: true + mode: "0644" with_first_found: - - "config/module_cron-{{ ssp_major_version }}.{{ ssp_minor_version }}.php.j2" - - "config/module_cron-{{ ssp_major_version }}.php.j2" - - "config/module_cron.php.j2" + - config/module_cron-{{ ssp_major_version }}.{{ ssp_minor_version }}.php.j2 + - config/module_cron-{{ ssp_major_version }}.php.j2 + - config/module_cron.php.j2 when: "'cron' in ssp_mods_enabled" - become: yes + become: true tags: - ssp:config:mods - ssp:config:mods:cron - ssp:config:mods:metarefresh - name: Configure SSP cron jobs - cron: + ansible.builtin.cron: name: "{{ item.name }}" user: "{{ item.user | default('root') }}" cron_file: "{{ item.file }}" @@ -260,9 +281,14 @@ job: > {% if ssp_major_version | int < 2 %} # Set maximum time for preventing curl job from hanging - curl -k --silent -m {{ ssp_mod_cron_job_max_execution_time }} {{ ssp_mod_cron_url }}?key={{ ssp_mod_cron_secret }}&tag={{ item.tag }} + curl -k --silent -m {{ ssp_mod_cron_job_max_execution_time }} \ + {{ ssp_mod_cron_url }}?key={{ ssp_mod_cron_secret }}&\ + tag={{ item.tag }} {% else %} - php -d max_execution_time={{ ssp_mod_cron_job_max_execution_time }} -d memory_limit={{ ssp_mod_cron_job_memory_limit }} {{ ssp_path }}/modules/cron/bin/cron.php -t {{ item.tag }} + php -d max_execution_time={{ ssp_mod_cron_job_max_execution_time }} \ + -d memory_limit={{ ssp_mod_cron_job_memory_limit }} \ + {{ ssp_path }}/modules/cron/bin/cron.php \ + -t {{ item.tag }} {% endif %} minute: "{{ item.minute | default(omit) }}" hour: "{{ item.hour | default(omit) }}" @@ -270,55 +296,55 @@ month: "{{ item.month | default(omit) }}" with_items: "{{ ssp_mod_cron_entries }}" when: "'cron' in ssp_mods_enabled" - become: yes + become: true tags: - ssp:config:mods - ssp:config:mods:cron - ssp:config:mods:metarefresh - name: Configure SSP cron job variables - cronvar: + community.general.cronvar: name: "{{ item.name }}" value: "{{ item.value }}" cron_file: "{{ item.file }}" with_items: "{{ ssp_mod_cron_vars }}" when: "'cron' in ssp_mods_enabled" - become: yes + become: true tags: - ssp:config:mods - ssp:config:mods:cron - ssp:config:mods:metarefresh - name: Configure SSP discopower module - template: + ansible.builtin.template: src: "{{ item }}" dest: "{{ ssp_configdir }}/module_discopower.php" - backup: yes - force: yes + backup: true + force: true + mode: "0644" with_first_found: - - "config/module_discopower-{{ ssp_major_version }}.{{ ssp_minor_version }}.php.j2" - - "config/module_discopower-{{ ssp_major_version }}.php.j2" - - "config/module_discopower.php.j2" + - config/module_discopower-{{ ssp_major_version }}.{{ ssp_minor_version }}.php.j2 + - config/module_discopower-{{ ssp_major_version }}.php.j2 + - config/module_discopower.php.j2 when: "'discopower' in ssp_mods_enabled" - become: yes + become: true tags: - ssp:config:mods - ssp:config:mods:discopower - name: Update SSP discopower module dictionary definitions - template: + ansible.builtin.template: src: "{{ item }}" dest: "{{ ssp_path }}/modules/discopower/dictionaries/tabs.definition.json" - backup: yes - force: yes + backup: true + force: true + mode: "0644" with_first_found: - - "modules/discopower/dictionaries/tabs.definition-{{ ssp_major_version }}.{{ ssp_minor_version }}.json.j2" - - "modules/discopower/dictionaries/tabs.definition-{{ ssp_major_version }}.json.j2" - - "modules/discopower/dictionaries/tabs.definition.json.j2" + - modules/discopower/dictionaries/tabs.definition-{{ ssp_major_version }}.{{ ssp_minor_version }}.json.j2 + - modules/discopower/dictionaries/tabs.definition-{{ ssp_major_version }}.json.j2 + - modules/discopower/dictionaries/tabs.definition.json.j2 when: "'discopower' in ssp_mods_enabled and ssp_mod_discopower_dictionaries is defined" - become: yes + become: true tags: - ssp:config:mods - ssp:config:mods:discopower - - diff --git a/roles/ssp/tasks/configure-saml20-idp-hosted.yml b/roles/ssp/tasks/configure-saml20-idp-hosted.yml index 351df897..0504579f 100644 --- a/roles/ssp/tasks/configure-saml20-idp-hosted.yml +++ b/roles/ssp/tasks/configure-saml20-idp-hosted.yml @@ -1,15 +1,15 @@ --- - - name: Configure SSP hosted SAML 2.0 IdP metadata - template: + ansible.builtin.template: src: "{{ item }}" dest: "{{ ssp_metadatadir }}/saml20-idp-hosted.php" - backup: yes - force: yes + backup: true + force: true + mode: "0600" with_first_found: - - "metadata/saml20-idp-hosted-{{ ssp_major_version }}.{{ ssp_minor_version }}.php.j2" - - "metadata/saml20-idp-hosted-{{ ssp_major_version }}.php.j2" - - "metadata/saml20-idp-hosted.php.j2" - become: yes + - metadata/saml20-idp-hosted-{{ ssp_major_version }}.{{ ssp_minor_version }}.php.j2 + - metadata/saml20-idp-hosted-{{ ssp_major_version }}.php.j2 + - metadata/saml20-idp-hosted.php.j2 + become: true tags: - ssp:config:saml20-idp-hosted diff --git a/roles/ssp/tasks/configure-shib13-idp-hosted.yml b/roles/ssp/tasks/configure-shib13-idp-hosted.yml index 65d8de14..305cdcf7 100644 --- a/roles/ssp/tasks/configure-shib13-idp-hosted.yml +++ b/roles/ssp/tasks/configure-shib13-idp-hosted.yml @@ -1,15 +1,15 @@ --- - - name: Configure SSP hosted SAML 1.1 IdP metadata - template: + ansible.builtin.template: src: "{{ item }}" dest: "{{ ssp_metadatadir }}/shib13-idp-hosted.php" - backup: yes - force: yes + backup: true + force: true + mode: "0600" with_first_found: - - "metadata/shib13-idp-hosted-{{ ssp_major_version }}.{{ ssp_minor_version }}.php.j2" - - "metadata/shib13-idp-hosted-{{ ssp_major_version }}.php.j2" - - "metadata/shib13-idp-hosted.php.j2" - become: yes + - metadata/shib13-idp-hosted-{{ ssp_major_version }}.{{ ssp_minor_version }}.php.j2 + - metadata/shib13-idp-hosted-{{ ssp_major_version }}.php.j2 + - metadata/shib13-idp-hosted.php.j2 + become: true tags: - ssp:config:shib13-idp-hosted diff --git a/roles/ssp/tasks/install-Debian.yml b/roles/ssp/tasks/install-Debian.yml index 9c06cb38..e0eaa5d4 100644 --- a/roles/ssp/tasks/install-Debian.yml +++ b/roles/ssp/tasks/install-Debian.yml @@ -1,25 +1,29 @@ --- - - name: Update package cache (Debian) - apt: update_cache=yes cache_valid_time=86400 - become: yes + ansible.builtin.apt: + update_cache: "yes" + cache_valid_time: "86400" + become: true - name: Ensure latest CA certificates are installed (Debian) - apt: pkg=ca-certificates state=latest install_recommends=no + ansible.builtin.apt: + pkg: ca-certificates + state: present + install_recommends: "no" become: true - name: Ensure SSP cron module dependencies are installed (Debian) - apt: + ansible.builtin.apt: pkg: "{{ ssp_mod_cron_deps }}" state: present - install_recommends: no + install_recommends: false when: "'cron' in ssp_mods_enabled" become: true -#- name: Ensure memcached dependencies are installed (Debian) -# apt: pkg={{ item }} state=present install_recommends=no -# with_items: "{{ ssp_memcache_deps }}" -# when: "ssp_store_type is defined and ssp_store_type == 'memcache'" -# become: true -# notify: -# - restart webserver +# - name: Ensure memcached dependencies are installed (Debian) +# apt: pkg={{ item }} state=present install_recommends=no +# with_items: "{{ ssp_memcache_deps }}" +# when: "ssp_store_type is defined and ssp_store_type == 'memcache'" +# become: true +# notify: +# - restart webserver diff --git a/roles/ssp/tasks/install-RedHat.yml b/roles/ssp/tasks/install-RedHat.yml index 4cd74b65..d0650879 100644 --- a/roles/ssp/tasks/install-RedHat.yml +++ b/roles/ssp/tasks/install-RedHat.yml @@ -1,24 +1,23 @@ --- - - name: Ensure latest CA certificates are installed (RedHat) - yum: + ansible.builtin.yum: name: ca-certificates - state: latest + state: present become: true - name: Ensure SSP cron module dependencies are installed (RedHat) - yum: + ansible.builtin.yum: name: "{{ ssp_mod_cron_deps }}" state: present when: "'cron' in ssp_mods_enabled" become: true -#- name: Ensure memcached dependencies are installed (RedHat) -# yum: -# name: "{{ item }}" -# state: present -# with_items: "{{ ssp_memcache_deps }}" -# when: "ssp_store_type is defined and ssp_store_type == 'memcache'" -# become: true -# notify: -# - restart webserver +# - name: Ensure memcached dependencies are installed (RedHat) +# yum: +# name: "{{ item }}" +# state: present +# with_items: "{{ ssp_memcache_deps }}" +# when: "ssp_store_type is defined and ssp_store_type == 'memcache'" +# become: true +# notify: +# - restart webserver diff --git a/roles/ssp/tasks/install-common.yml b/roles/ssp/tasks/install-common.yml index f17dc7ed..78f30cfd 100644 --- a/roles/ssp/tasks/install-common.yml +++ b/roles/ssp/tasks/install-common.yml @@ -1,59 +1,72 @@ --- - -- include_tasks: install-release.yml +- name: Include Release Tasks + ansible.builtin.include_tasks: install-release.yml when: ssp_release_url is defined tags: - ssp:install -- include_tasks: install-source.yml +- name: Include source install tasks + ansible.builtin.include_tasks: install-source.yml when: ssp_release_url is not defined tags: - ssp:install - name: Update symbolic link to SSP - file: + ansible.builtin.file: src: "{{ ssp_path }}/{{ 'public' if ssp_major_version == '2' else 'www' }}/" dest: "{{ ssp_www_path }}" state: link - become: yes + become: true tags: - ssp:install -- include_tasks: twig.yml - when: (ssp_twig_install is defined) and (ssp_twig_install|bool == True) +- name: Include Twig tasks + ansible.builtin.include_tasks: twig.yml + when: (ssp_twig_install is defined) and (ssp_twig_install | bool) - name: Ensure SSP config dir exists - file: path={{ ssp_configdir }} state=directory - become: yes + ansible.builtin.file: + path: "{{ ssp_configdir }}" + state: directory + mode: "0750" + become: true tags: - ssp:install - name: Ensure SSP logging dir exists - file: + ansible.builtin.file: state: directory path: "{{ ssp_loggingdir }}" owner: "{{ ssp_webuser }}" group: "{{ ssp_webgroup }}" mode: "0750" - become: yes + become: true tags: - ssp:install - name: Ensure SSP data dir exists - file: path={{ ssp_datadir }} state=directory - become: yes + ansible.builtin.file: + path: "{{ ssp_datadir }}" + state: directory + mode: "0750" + become: true tags: - ssp:install - name: Ensure SSP metadata dir exists - file: path={{ ssp_metadatadir }} state=directory - become: yes + ansible.builtin.file: + path: "{{ ssp_metadatadir }}" + state: directory + mode: "0750" + become: true tags: - ssp:install - name: Ensure SSP cert dir exists - file: path={{ ssp_certdir }} state=directory - become: yes + ansible.builtin.file: + path: "{{ ssp_certdir }}" + state: directory + mode: "0750" + become: true tags: - ssp:install - diff --git a/roles/ssp/tasks/install-release.yml b/roles/ssp/tasks/install-release.yml index 26b21eac..a8e092bd 100644 --- a/roles/ssp/tasks/install-release.yml +++ b/roles/ssp/tasks/install-release.yml @@ -1,47 +1,47 @@ --- - - name: Check if SSP path exists - stat: + ansible.builtin.stat: path: "{{ ssp_path }}" register: release_downloaded tags: - ssp:install:release -- block: - +- name: SSP Install + when: not release_downloaded.stat.exists + become: true + tags: + - ssp:install:release + block: - name: Create temp SSP installation directory - tempfile: + ansible.builtin.tempfile: state: directory register: ssp_basepath - name: Download and unarchive SSP release into temp installation directory - unarchive: + ansible.builtin.unarchive: src: "{{ ssp_release_url }}" dest: "{{ ssp_basepath.path }}/" - owner: "root" - group: "root" + owner: root + group: root list_files: true remote_src: true - name: Ensure SSP path exists - file: + ansible.builtin.file: path: "{{ ssp_path }}" state: directory - owner: "root" - group: "root" + owner: root + group: root + mode: "0750" - name: Copy release to SSP path - copy: + ansible.builtin.copy: src: "{{ ssp_basepath.path }}/{{ ssp_repo_version }}/" dest: "{{ ssp_path }}" remote_src: true + mode: "0600" - name: Remove temp SSP installation directory - file: + ansible.builtin.file: path: "{{ ssp_basepath.path }}" state: absent - - when: release_downloaded.stat.exists == False - become: yes - tags: - - ssp:install:release \ No newline at end of file diff --git a/roles/ssp/tasks/install-source.yml b/roles/ssp/tasks/install-source.yml index 69eec8d1..5ffb59cf 100644 --- a/roles/ssp/tasks/install-source.yml +++ b/roles/ssp/tasks/install-source.yml @@ -1,23 +1,23 @@ --- - - name: Checkout SSP source - git: + ansible.builtin.git: repo: "{{ ssp_repo_url }}" dest: "{{ ssp_path }}" version: "{{ ssp_repo_version }}" - accept_hostkey: yes - force: no - update: no - become: yes + accept_hostkey: true + force: false + update: false + become: true when: ssp_release_file is not defined tags: - ssp:install:source -- include_tasks: composer.yml - when: (ssp_composer_install is defined) and (ssp_composer_install|bool == True) +- name: Include composer tasks + ansible.builtin.include_tasks: composer.yml + when: (ssp_composer_install is defined) and (ssp_composer_install | bool) - name: Install/Update SimplesamlPHP - composer: + community.general.composer: command: update working_dir: "{{ ssp_path }}" composer_executable: "{{ ssp_composer_executable }}" @@ -25,4 +25,4 @@ no_scripts: true become: true tags: - - ssp:install:source \ No newline at end of file + - ssp:install:source diff --git a/roles/ssp/tasks/main.yml b/roles/ssp/tasks/main.yml index ae60ccc2..727711aa 100644 --- a/roles/ssp/tasks/main.yml +++ b/roles/ssp/tasks/main.yml @@ -1,94 +1,96 @@ --- - name: Include OS-specific variables - include_vars: "{{ item }}" + ansible.builtin.include_vars: "{{ item }}" with_first_found: - - "{{ ansible_distribution }}-{{ ansible_distribution_release}}.yml" - - "{{ ansible_distribution }}-{{ ansible_distribution_major_version}}.yml" + - "{{ ansible_distribution }}-{{ ansible_distribution_release }}.yml" + - "{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml" - "{{ ansible_distribution }}.yml" - "{{ ansible_os_family }}.yml" tags: - always -- block: +- name: Set SSP facts + tags: + - always + block: - name: Split SSP version string into parts - set_fact: + ansible.builtin.set_fact: ssp_version_parts: "{{ ssp_version.split('.') }}" - name: Define SSP major version number - set_fact: + ansible.builtin.set_fact: ssp_major_version: "{{ ssp_version_parts[0] }}" tags: - always - name: Define SSP minor version number - set_fact: + ansible.builtin.set_fact: ssp_minor_version: "{{ ssp_version_parts[1] }}" tags: - always - name: Define SSP patch version number only when specified in version string - set_fact: + ansible.builtin.set_fact: ssp_patch_version: "{{ ssp_version_parts[2] | default(omit) }}" - tags: - - always - name: Include SSP-specific variables - include_vars: "{{ item }}" + ansible.builtin.include_vars: "{{ item }}" with_first_found: - - "ssp-{{ ssp_major_version }}.{{ ssp_minor_version }}.yml" - - "ssp-{{ ssp_major_version }}.yml" - ignore_errors: yes + - ssp-{{ ssp_major_version }}.{{ ssp_minor_version }}.yml + - ssp-{{ ssp_major_version }}.yml + failed_when: false # noqa ignore-errors tags: - always - name: Define SSP web server - set_fact: + ansible.builtin.set_fact: ssp_webserver: "{{ ssp_default_webserver }}" when: ssp_webserver is not defined tags: - always - name: Define SSP web user - set_fact: + ansible.builtin.set_fact: ssp_webuser: "{{ ssp_default_webuser }}" when: ssp_webuser is not defined tags: - always - name: Define SSP web group - set_fact: + ansible.builtin.set_fact: ssp_webgroup: "{{ ssp_default_webgroup }}" when: ssp_webgroup is not defined tags: - always - name: Define SSP cron module dependencies - set_fact: + ansible.builtin.set_fact: ssp_mod_cron_deps: "{{ ssp_default_mod_cron_deps | list }}" when: ssp_mod_cron_deps is not defined tags: - always - - name: Define SSP path - set_fact: + ansible.builtin.set_fact: ssp_path: "{{ ssp_path }}-{{ ssp_version_suffix }}" when: ssp_version_suffix is defined and ssp_version_suffix != "" tags: - always -# Install OS-specific packages -- include: install-Debian.yml +- name: Install Debian packages + ansible.builtin.include_tasks: install-Debian.yml when: ansible_os_family == 'Debian' -- include: install-RedHat.yml + +- name: Install Redhat packages + ansible.builtin.include_tasks: install-RedHat.yml when: ansible_os_family == 'RedHat' -# Run OS-independent installation tasks -- include: install-common.yml +- name: Run OS-independent installation tasks + ansible.builtin.include_tasks: install-common.yml tags: - install - ssp:install -# Apply OS-independent configuration -- include: configure-common.yml +- name: Apply OS-independent configuration + ansible.builtin.include_tasks: configure-common.yml tags: - config - ssp:config diff --git a/roles/ssp/tasks/twig.yml b/roles/ssp/tasks/twig.yml index 4fa11d9a..4ce481cc 100644 --- a/roles/ssp/tasks/twig.yml +++ b/roles/ssp/tasks/twig.yml @@ -1,85 +1,92 @@ --- - ## Node Version Manager (nvm) | Installing and Updating ### http://nvm.sh ### https://github.com/nvm-sh/nvm#installing-and-updating ### https://github.com/nvm-sh/nvm#ansible -- name: Install Node Version Manager (nvm) - shell: "curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.37.2/install.sh | bash" +- name: Install Node Version Manager (nvm) # noqa command-instead-of-module + ansible.builtin.shell: + executable: /bin/bash + cmd: | + set -o pipefaile + curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.37.2/install.sh | bash args: creates: "{{ ansible_env.HOME }}/.nvm/nvm.sh" - when: ssp_twig_template | default(False) | bool == True + when: ssp_twig_template | default(False) | bool tags: - ssp:install - ssp:install:install_nvm - ssp:install:ssp_twig_template - name: Install Node.js v14.15.1 - shell: "source {{ ansible_env.HOME }}/.nvm/nvm.sh && nvm install v14.15.1" + ansible.builtin.shell: source {{ ansible_env.HOME }}/.nvm/nvm.sh && nvm install v14.15.1 args: executable: /bin/bash register: v14 changed_when: v14 is changed and "is already installed" not in v14.stderr - when: ssp_twig_template | default(False) | bool == True + when: ssp_twig_template | default(False) | bool tags: - ssp:install - ssp:install:install_nvm - install_node_14 - ssp:install:ssp_twig_template -- name: npm install - shell: "source {{ ansible_env.HOME }}/.nvm/nvm.sh && nvm use v14.15.1 && npm install --unsafe-perm=true --allow-root" +- name: Npm install + ansible.builtin.shell: source {{ ansible_env.HOME }}/.nvm/nvm.sh && nvm use v14.15.1 && npm install --unsafe-perm=true --allow-root args: chdir: "{{ ssp_path }}/" executable: /bin/bash register: npm_install_results changed_when: npm_install_results is changed and "added" in npm_install_results.stdout - when: ssp_twig_template | default(False) | bool == True + when: ssp_twig_template | default(False) | bool become: true tags: - ssp:install - ssp:install:ssp_twig_template -- name: npm audit fix - shell: "source {{ ansible_env.HOME }}/.nvm/nvm.sh && nvm use v14.15.1 && npm audit fix" +- name: Npm audit fix + ansible.builtin.shell: source {{ ansible_env.HOME }}/.nvm/nvm.sh && nvm use v14.15.1 && npm audit fix args: chdir: "{{ ssp_path }}/" executable: /bin/bash - when: ssp_twig_template | default(False) | bool == True + when: ssp_twig_template | default(False) | bool become: true tags: - ssp:install - ssp:install:ssp_twig_template + changed_when: false -- name: npm run build (1/3) - shell: "source {{ ansible_env.HOME }}/.nvm/nvm.sh && nvm use v14.15.1 && node scripts/install.js" +- name: Npm run build (1/3) + ansible.builtin.shell: source {{ ansible_env.HOME }}/.nvm/nvm.sh && nvm use v14.15.1 && node scripts/install.js args: chdir: "{{ ssp_path }}/node_modules/node-sass/" executable: /bin/bash - when: ssp_twig_template | default(False) | bool == True + when: ssp_twig_template | default(False) | bool become: true tags: - ssp:install - ssp:install:ssp_twig_template + changed_when: false -- name: npm run build (2/3) - shell: "source {{ ansible_env.HOME }}/.nvm/nvm.sh && nvm use v14.15.1 && node scripts/build.js" +- name: Npm run build (2/3) + ansible.builtin.shell: source {{ ansible_env.HOME }}/.nvm/nvm.sh && nvm use v14.15.1 && node scripts/build.js args: chdir: "{{ ssp_path }}/node_modules/node-sass/" executable: /bin/bash - when: ssp_twig_template | default(False) | bool == True + when: ssp_twig_template | default(False) | bool become: true tags: - ssp:install - ssp:install:ssp_twig_template + changed_when: false -- name: npm run build (3/3) - shell: "source {{ ansible_env.HOME }}/.nvm/nvm.sh && nvm use v14.15.1 && npm run build" +- name: Npm run build (3/3) + ansible.builtin.shell: source {{ ansible_env.HOME }}/.nvm/nvm.sh && nvm use v14.15.1 && npm run build args: chdir: "{{ ssp_path }}/" executable: /bin/bash - when: ssp_twig_template | default(False) | bool == True + when: ssp_twig_template | default(False) | bool become: true tags: - ssp:install - - ssp:install:ssp_twig_template \ No newline at end of file + - ssp:install:ssp_twig_template + changed_when: false diff --git a/roles/ssp/templates/config/module_discopower-1.14.php.j2 b/roles/ssp/templates/config/module_discopower-1.14.php.j2 index 6e91dba2..6581e1af 100644 --- a/roles/ssp/templates/config/module_discopower-1.14.php.j2 +++ b/roles/ssp/templates/config/module_discopower-1.14.php.j2 @@ -1,5 +1,5 @@ 'suggest', + 'score' => 'suggest', {% endif %} /* * The domain to use for common domain cookie support. @@ -49,4 +49,4 @@ $config = array ( ); -?> \ No newline at end of file +?> diff --git a/roles/ssp/templates/config/module_discopower-1.17.php.j2 b/roles/ssp/templates/config/module_discopower-1.17.php.j2 index 5d583c49..f26281da 100644 --- a/roles/ssp/templates/config/module_discopower-1.17.php.j2 +++ b/roles/ssp/templates/config/module_discopower-1.17.php.j2 @@ -1,6 +1,6 @@ - + "{{ inventory_dir }}/files/get_gh_asset_id.sh \ + {{ webapp_github_repo }} \ + {{ webapp_github_repo_token }} \ + {{ webapp_github_release_version }} \ + {{ webapp_github_release_file }}" register: github_asset_id -- name: Ensure WAR file is downloaded - command: wget -q --auth-no-challenge --header="Accept:application/octet-stream" "https://{{ webapp_github_repo_token }}:@api.github.com/repos/{{ webapp_github_repo }}/releases/assets/{{ github_asset_id.stdout }}" -O "{{ webapp_file }}_{{ webapp_github_release_version }}" - args: - chdir: "{{ webapp_download_path }}/" - creates: "{{ webapp_file }}_{{ webapp_github_release_version }}" +# Replaced by get_url below +# - name: Ensure WAR file is downloaded +# ansible.builtin.command: wget \ + # -q --auth-no-challenge \ + # --header="Accept:application/octet-stream" \ + # "https://{{ webapp_github_repo_token }}:@api.github.com/repos/{{ webapp_github_repo }}/releases/assets/{{ github_asset_id.stdout }}" \ + # -O "{{ webapp_file }}_{{ webapp_github_release_version }}" +# args: +# chdir: "{{ webapp_download_path }}/" +# creates: "{{ webapp_file }}_{{ webapp_github_release_version }}" +# become: true + +- name: Ensure WAR file + ansible.builtin.get_url: + url: "https://api.github.com/repos/{{ webapp_github_repo }}/releases/assets/{{ github_asset_id.stdout }}" + dest: "{{ webapp_download_path }}/{{ webapp_file }}_{{ webapp_github_release_version }}" + headers: + Accept: application/octet-stream + Authorization: "Bearer {{ webapp_github_repo_token }}" + mode: "0644" become: true - name: Check that WAR file has been deployed - stat: + ansible.builtin.stat: path: "{{ webapp_path }}/{{ webapp_file }}" register: webapp_file_status become: true - name: Deploy WAR file when WAR file has not been deployed - copy: + ansible.builtin.copy: src: "{{ webapp_download_path }}/{{ webapp_file }}_{{ webapp_github_release_version }}" dest: "{{ webapp_path }}/{{ webapp_file }}" remote_src: true - when: webapp_file_status.stat.exists == False + mode: "0644" + when: not webapp_file_status.stat.exists become: true - name: Calculate checksum of deployed WAR file - stat: + ansible.builtin.stat: path: "{{ webapp_path }}/{{ webapp_file }}" checksum_algorithm: sha256 get_checksum: true register: webapp_file_checksum_old - when: webapp_file_status.stat.exists == True + when: webapp_file_status.stat.exists become: true - name: Calculate checksum of downloaded WAR file - stat: + ansible.builtin.stat: path: "{{ webapp_download_path }}/{{ webapp_file }}_{{ webapp_github_release_version }}" checksum_algorithm: sha256 get_checksum: true register: webapp_file_checksum_new - when: webapp_file_status.stat.exists == True + when: webapp_file_status.stat.exists become: true - name: Ensure Tomcat is stopped - service: + ansible.builtin.service: name: "{{ tomcat_service }}" - state: "stopped" - when: webapp_file_status.stat.exists == True and webapp_file_checksum_old.stat.checksum != webapp_file_checksum_new.stat.checksum + state: stopped + when: webapp_file_status.stat.exists and webapp_file_checksum_old.stat.checksum != webapp_file_checksum_new.stat.checksum become: true - name: Ensure previous WAR file is deleted - file: + ansible.builtin.file: path: "{{ webapp_path }}/{{ webapp_file }}" state: absent - when: webapp_file_status.stat.exists == True and webapp_file_checksum_old.stat.checksum != webapp_file_checksum_new.stat.checksum + when: webapp_file_status.stat.exists and webapp_file_checksum_old.stat.checksum != webapp_file_checksum_new.stat.checksum become: true - name: Ensure previous WAR directory is deleted - file: + ansible.builtin.file: path: "{{ webapp_path }}/{{ webapp_context_path }}" state: absent - when: webapp_file_status.stat.exists == True and webapp_file_checksum_old.stat.checksum != webapp_file_checksum_new.stat.checksum + when: webapp_file_status.stat.exists and webapp_file_checksum_old.stat.checksum != webapp_file_checksum_new.stat.checksum become: true - name: Deploy new version of WAR file - copy: + ansible.builtin.copy: src: "{{ webapp_download_path }}/{{ webapp_file }}_{{ webapp_github_release_version }}" dest: "{{ webapp_path }}/{{ webapp_file }}" + mode: "0644" remote_src: true - when: webapp_file_status.stat.exists == True and webapp_file_checksum_old.stat.checksum != webapp_file_checksum_new.stat.checksum + when: webapp_file_status.stat.exists and webapp_file_checksum_old.stat.checksum != webapp_file_checksum_new.stat.checksum become: true - name: Ensure Tomcat is started - service: + ansible.builtin.service: name: "{{ tomcat_service }}" state: "started" - when: webapp_file_status.stat.exists == True and webapp_file_checksum_old.stat.checksum != webapp_file_checksum_new.stat.checksum + when: webapp_file_status.stat.exists and webapp_file_checksum_old.stat.checksum != webapp_file_checksum_new.stat.checksum become: true diff --git a/roles/tomcat/tasks/install-Debian.yml b/roles/tomcat/tasks/install-Debian.yml index a3c460fb..0a8b97f5 100644 --- a/roles/tomcat/tasks/install-Debian.yml +++ b/roles/tomcat/tasks/install-Debian.yml @@ -1,12 +1,11 @@ # file: tomcat/tasks/install-Debian.yml # --- - - name: Ensure Tomcat is installed (Debian) - apt: + ansible.builtin.apt: name: "{{ tomcat_package }}" state: present - update_cache: yes + update_cache: true cache_valid_time: 86400 - install_recommends: no - become: yes + install_recommends: false + become: true diff --git a/roles/tomcat/tasks/main.yml b/roles/tomcat/tasks/main.yml index b0899cdd..ef8ab3ac 100644 --- a/roles/tomcat/tasks/main.yml +++ b/roles/tomcat/tasks/main.yml @@ -1,70 +1,70 @@ # file: tomcat/tasks/main.yml # --- - - name: Include OS-specific variables - include_vars: "{{ item }}" + ansible.builtin.include_vars: "{{ item }}" with_first_found: - - "{{ ansible_distribution }}-{{ ansible_distribution_release}}.yml" - - "{{ ansible_distribution }}-{{ ansible_distribution_major_version}}.yml" + - "{{ ansible_distribution }}-{{ ansible_distribution_release }}.yml" + - "{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml" - "{{ ansible_distribution }}.yml" - "{{ ansible_os_family }}.yml" tags: - always - name: Define tomcat version - set_fact: + ansible.builtin.set_fact: tomcat_version: "{{ tomcat_default_version }}" when: tomcat_version is not defined tags: - always - name: Define tomcat package name - set_fact: + ansible.builtin.set_fact: tomcat_package: "{{ tomcat_default_package }}" when: tomcat_package is not defined tags: - always - name: Define tomcat service name - set_fact: + ansible.builtin.set_fact: tomcat_service: "{{ tomcat_default_service }}" when: tomcat_service is not defined tags: - always - name: Define tomcat configuration path - set_fact: + ansible.builtin.set_fact: tomcat_conf_path: "{{ tomcat_default_conf_path }}" when: tomcat_conf_path is not defined tags: - always - name: Define tomcat JAVA_HOME - set_fact: + ansible.builtin.set_fact: tomcat_java_home: "{{ tomcat_default_java_home }}" when: tomcat_java_home is not defined tags: - always -# Install OS-specific packages -- include: install-Debian.yml +- name: Install OS-specific packages + ansible.builtin.include_tasks: install-Debian.yml when: ansible_os_family == 'Debian' -#- include: install-CentOS.yml -# when: ansible_os_family == 'CentOS' -# Apply OS-independent configuration -- include: configure-common.yml +# - include: install-CentOS.yml +# when: ansible_os_family == 'CentOS' + +- name: Apply OS-independent configuration + ansible.builtin.include_tasks: configure-common.yml -# Deploy .war file -- include: deploy-webapp.yml +- name: Deploy .war file + ansible.builtin.include_tasks: deploy-webapp.yml tags: - never - tomcat:deploy - name: Ensure Tomcat service is started and enabled on boot - service: + ansible.builtin.service: name: "{{ tomcat_service }}" - state: "started" - enabled: yes - become: yes + state: started + enabled: true + become: true diff --git a/roles/tomcat/templates/server-8.5.xml.j2 b/roles/tomcat/templates/server-8.5.xml.j2 index 0a753779..9399d055 100644 --- a/roles/tomcat/templates/server-8.5.xml.j2 +++ b/roles/tomcat/templates/server-8.5.xml.j2 @@ -72,7 +72,7 @@ Define a non-SSL HTTP/1.1 Connector on port 8080 --> {% for connector in tomcat_connectors %} - {% for connector in tomcat_connectors %} - {% for connector in tomcat_connectors %} - - + cp -p config/PLACEHOLDER/secrets_env.yml.PLACEHOLDER + "{{ path_of_secrets_generator_file }}/{{ secrets_generator_file }}" + when: not secrets_file.stat.exists + changed_when: false # TODO determine change conditions + + - name: "Set permissions of {{ path_of_secrets_generator_file }}/{{ secrets_generator_file }}" # noqa name[template] + ansible.builtin.file: path: "{{ path_of_secrets_generator_file }}/{{ secrets_generator_file }}" state: file - mode: 0600 - when: secrets_file.stat.exists == False - + mode: "0600" + when: not secrets_file.stat.exists - name: Generate self-signed SP certificates - command : "openssl req -newkey rsa:2048 -new -x509 -days 3652 -subj \"/CN={{ rciam_hostname }}\" -nodes -out sp-{{ item.name }}.crt -keyout sp-{{ item.name }}.key" + ansible.builtin.command: >- + openssl req \ + -newkey rsa:2048 \ + -new -x509 \ + -days 3652 \ + -subj "/CN={{ rciam_hostname }}" \ + -nodes \ + -out "sp-{{ item.name }}.crt" \ + -keyout "sp-{{ item.name }}.key" args: chdir: config/PLACEHOLDER/ no_log: true register: new_sp_certificate with_items: "{{ ssp_authsources_saml }}" - when: secrets_file.stat.exists == False + when: not secrets_file.stat.exists + changed_when: false + # TODO - use community.pki - name: Generate self-signed IdP certificates - command : "openssl req -newkey rsa:2048 -new -x509 -days 3652 -subj \"/CN={{ rciam_hostname }}\" -nodes -out idp-{{ item.entity_id }}.crt -keyout idp-{{ item.entity_id }}.key" + ansible.builtin.command: >- + openssl req \ + -newkey rsa:2048 \ + -new -x509 \ + -days 3652 \ + -subj \"/CN={{ rciam_hostname }}\" \ + -nodes \ + -out "idp-{{ item.entity_id }}.crt" \ + -keyout "idp-{{ item.entity_id }}.key" args: chdir: config/PLACEHOLDER/ no_log: true register: new_sp_certificate with_items: "{{ ssp_idp_hosts }}" - when: secrets_file.stat.exists == False - - + when: not secrets_file.stat.exists + changed_when: false - name: Fill in random genarated passwords & salts - lineinfile: + ansible.builtin.lineinfile: dest: "{{ path_of_secrets_generator_file }}/{{ secrets_generator_file }}" regexp: "{{ item.regex }}" line: "{{ item.replace_with }}" state: present no_log: true loop: - - { regex: '^ssp_secretsalt: CHANGEME', replace_with: "ssp_secretsalt: \"{{ lookup('password', '/dev/null length=33 chars=ascii_lowercase,digits') }}\"" } - - { regex: '^ssp_adminpassword: CHANGEME', replace_with: "ssp_adminpassword: \"{{ lookup('password', '/dev/null length=15 chars=ascii_lowercase,digits') }}\"" } - - { regex: '^ssp_adminpassword_salt: CHANGEME', replace_with: "ssp_adminpassword_salt: \"{{ lookup('password', '/dev/null length=15 chars=ascii_lowercase,digits') }}\"" } - - { regex: '^ssp_mod_cron_secret: CHANGEME', replace_with: "ssp_mod_cron_secret: \"{{ lookup('password', '/dev/null length=33 chars=ascii_lowercase,digits') }}\"" } - when: secrets_file.stat.exists == False - + - regex: "^ssp_secretsalt: CHANGEME" + replace_with: 'ssp_secretsalt: "{{ lookup(''password'', ''/dev/null length=33 chars=ascii_lowercase,digits'') }}"' + - regex: "^ssp_adminpassword: CHANGEME" + replace_with: 'ssp_adminpassword: "{{ lookup(''password'', ''/dev/null length=15 chars=ascii_lowercase,digits'') }}"' + - regex: "^ssp_adminpassword_salt: CHANGEME" + replace_with: 'ssp_adminpassword_salt: "{{ lookup(''password'', ''/dev/null length=15 chars=ascii_lowercase,digits'') }}"' + - regex: "^ssp_mod_cron_secret: CHANGEME" + replace_with: 'ssp_mod_cron_secret: "{{ lookup(''password'', ''/dev/null length=33 chars=ascii_lowercase,digits'') }}"' + when: not secrets_file.stat.exists - name: Fill in certificate cn - replace: + ansible.builtin.replace: path: "{{ path_of_secrets_generator_file }}/{{ secrets_generator_file }}" regexp: "ssl_certificate_cn: CHANGEME" replace: "ssl_certificate_cn: {{ rciam_hostname }}" - when: secrets_file.stat.exists == False - + when: not secrets_file.stat.exists - name: Fill in SP self-signed certificates - lineinfile: + ansible.builtin.lineinfile: dest: "{{ path_of_secrets_generator_file }}/{{ secrets_generator_file }}" regexp: "{{ item.ssl_certificate }}" line: " {{ lookup('file', 'config/PLACEHOLDER/sp-{{ item.name }}.crt') | indent(width=6) }}" state: present with_items: "{{ ssp_authsources_saml }}" - when: secrets_file.stat.exists == False + when: not secrets_file.stat.exists - name: Fill in IdP self-signed certificates - lineinfile: + ansible.builtin.lineinfile: dest: "{{ path_of_secrets_generator_file }}/{{ secrets_generator_file }}" regexp: "{{ item.ssl_certificate }}" line: " {{ lookup('file', 'config/PLACEHOLDER/idp-{{ item.entity_id }}.crt') | indent(width=6) }}" state: present with_items: "{{ ssp_idp_hosts }}" - when: secrets_file.stat.exists == False - + when: not secrets_file.stat.exists - name: Fill in SP self-signed certificate keys - lineinfile: + ansible.builtin.lineinfile: dest: "{{ path_of_secrets_generator_file }}/{{ secrets_generator_file }}" regexp: "{{ item.ssl_certificate_key }}" line: " {{ lookup('file', 'config/PLACEHOLDER/sp-{{ item.name }}.key') | indent(width=6) }}" state: present no_log: true with_items: "{{ vault_ssp_authsources_saml }}" - when: secrets_file.stat.exists == False + when: not secrets_file.stat.exists - name: Fill in IdP self-signed certificate keys - lineinfile: + ansible.builtin.lineinfile: dest: "{{ path_of_secrets_generator_file }}/{{ secrets_generator_file }}" regexp: "{{ item.ssl_certificate_key }}" line: " {{ lookup('file', 'config/PLACEHOLDER/idp-{{ item.entity_id }}.key') | indent(width=6) }}" state: present no_log: true with_items: "{{ vault_ssp_idp_hosts }}" - when: secrets_file.stat.exists == False - + when: not secrets_file.stat.exists - name: Delete SP certificates - file: + ansible.builtin.file: path: "config/PLACEHOLDER/sp-{{ item.name }}.crt" state: absent with_items: "{{ ssp_authsources_saml }}" - when: secrets_file.stat.exists == False + when: not secrets_file.stat.exists - name: Delete SP certificate keys - file: + ansible.builtin.file: path: "config/PLACEHOLDER/sp-{{ item.name }}.key" state: absent with_items: "{{ ssp_authsources_saml }}" - when: secrets_file.stat.exists == False + when: not secrets_file.stat.exists - name: Delete IdP certificates - file: + ansible.builtin.file: path: "config/PLACEHOLDER/idp-{{ item.entity_id }}.crt" state: absent with_items: "{{ ssp_idp_hosts }}" - when: secrets_file.stat.exists == False + when: not secrets_file.stat.exists - name: Delete IdP certificate keys - file: + ansible.builtin.file: path: "config/PLACEHOLDER/idp-{{ item.entity_id }}.key" state: absent with_items: "{{ ssp_idp_hosts }}" - when: secrets_file.stat.exists == False - + when: not secrets_file.stat.exists diff --git a/site.yml b/site.yml index a4df2eee..79b78fa9 100644 --- a/site.yml +++ b/site.yml @@ -1,7 +1,9 @@ --- +- name: Deploy Cache Servers + ansible.builtin.import_playbook: cacheservers.yml -- import_playbook: cacheservers.yml +- name: Deploy Auth Servers + ansible.builtin.import_playbook: authservers.yml -- import_playbook: authservers.yml - -- import_playbook: webproxyservers.yml +- name: Deploy Web Proxy servers + ansible.builtin.import_playbook: webproxyservers.yml diff --git a/sspservers.yml b/sspservers.yml index 1f7d67e0..03634ac8 100644 --- a/sspservers.yml +++ b/sspservers.yml @@ -2,7 +2,8 @@ # --- -- hosts: ssp +- name: Deploy SSP + hosts: ssp roles: - { role: apache, tags: apache } - { role: php, tags: php } diff --git a/templates/rciam-sync-client-names/config.py.j2 b/templates/rciam-sync-client-names/config.py.j2 index 6d325ee7..e336d3fc 100644 --- a/templates/rciam-sync-client-names/config.py.j2 +++ b/templates/rciam-sync-client-names/config.py.j2 @@ -1,13 +1,13 @@ # {{ ansible_managed }} -mitreid_config = { +mitreid_config = { "dbname": "{{ rciam_dbs.oidc.name }}", "user": "{{ rciam_dbs.oidc.owner_username }}", "host": "{{ lookup('dig', groups['dbmaster'][0]) }}", "password": "{{ rciam_dbs.oidc.owner_password }}" } -proxystats_config = { +proxystats_config = { "dbname": "{{ rciam_dbs.proxy.name }}", "user": "{{ rciam_dbs.proxy.owner_username }}", "host": "{{ rciam_dbs.proxy.host | default(lookup('dig', groups['dbmaster'][0])) }}", diff --git a/utilservers.yml b/utilservers.yml index 3655b626..a7ab64ec 100644 --- a/utilservers.yml +++ b/utilservers.yml @@ -2,6 +2,7 @@ # --- -- hosts: util +- name: Configure Util machines + hosts: util roles: - { role: rciam-utils } diff --git a/webproxyservers.yml b/webproxyservers.yml index 7bfa1786..784c66cb 100644 --- a/webproxyservers.yml +++ b/webproxyservers.yml @@ -2,42 +2,43 @@ # --- -- hosts: webproxy +- name: Deploy Web Proxy + hosts: webproxy roles: - { role: rsyslog-pgsql, tags: [rsyslog-pgsql, nginx] } - { role: nginx, tags: nginx } tasks: - name: Set Maintenance Locations - set_fact: + ansible.builtin.set_fact: maintenance_locations: "['roles','registry','oidc','proxy']" tags: - nginx:maintenance_on - nginx:maintenance_off - never - name: Enter Maintenance Mode - copy: + ansible.builtin.copy: content: "" dest: "/var/www/html/{{ item }}.maintenance.enable" - force: no + force: false owner: root - mode: 0644 + mode: "0644" loop: "{{ maintenance | default(maintenance_locations) | default([]) }}" loop_control: label: "Add control file for Maintenance Mode {{ item }}" - become: yes - ignore_errors: yes + become: true + ignore_errors: true # noqa ignore-errors tags: - nginx:maintenance_on - never - name: Exit Maintenance Mode - file: + ansible.builtin.file: path: "/var/www/html/{{ item }}.maintenance.enable" state: absent loop: "{{ maintenance_locations | default([]) }}" loop_control: label: "Removing control file for Maintenance Mode {{ item }}" - become: yes - ignore_errors: yes + become: true + ignore_errors: true # noqa ignore-errors tags: - nginx:maintenance_off - - never \ No newline at end of file + - never diff --git a/webservers.yml b/webservers.yml index 710ab479..c3936773 100644 --- a/webservers.yml +++ b/webservers.yml @@ -2,21 +2,22 @@ # --- -- hosts: web +- name: Deploy Web Servers + hosts: web roles: - { role: apache, tags: apache } - { role: php, tags: php } tasks: - name: Ensure static files for each Virtual Host are copied - copy: + ansible.builtin.copy: src: "{{ inventory_dir }}/files/web/vhosts/{{ item.servername | urlsplit('hostname') }}/" dest: "{{ item.documentroot }}/" owner: root group: root - mode: 0644 + mode: "0644" loop: "{{ apache_vhosts | default([]) }}" loop_control: label: "Copying static files for Virtual Host {{ item.servername | urlsplit('hostname') }}" - ignore_errors: yes - become: yes + ignore_errors: true # noqa ignore-errors + become: true tags: web:static From 736f38053968f963d026b6c56a16da5bf4820c90 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 6 May 2024 10:36:12 +0200 Subject: [PATCH 10/12] Bump dnspython from 2.1.0 to 2.6.1 (#6) Bumps [dnspython](https://github.com/rthalley/dnspython) from 2.1.0 to 2.6.1. - [Release notes](https://github.com/rthalley/dnspython/releases) - [Changelog](https://github.com/rthalley/dnspython/blob/main/doc/whatsnew.rst) - [Commits](https://github.com/rthalley/dnspython/compare/v2.1.0...v2.6.1) --- updated-dependencies: - dependency-name: dnspython dependency-type: direct:production ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 648074c3..e50a6259 100644 --- a/requirements.txt +++ b/requirements.txt @@ -9,7 +9,7 @@ bracex==2.4 cffi==1.16.0 click==8.1.7 cryptography==42.0.5 -dnspython==2.1.0 +dnspython==2.6.1 filelock==3.13.1 Jinja2==3.1.3 jmespath==0.10.0 From bcdd4f025097bf2e22f667bf3eb54d41689fdd5b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 7 May 2024 08:57:26 +0200 Subject: [PATCH 11/12] Bump jinja2 from 3.1.3 to 3.1.4 (#7) Bumps [jinja2](https://github.com/pallets/jinja) from 3.1.3 to 3.1.4. - [Release notes](https://github.com/pallets/jinja/releases) - [Changelog](https://github.com/pallets/jinja/blob/main/CHANGES.rst) - [Commits](https://github.com/pallets/jinja/compare/3.1.3...3.1.4) --- updated-dependencies: - dependency-name: jinja2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index e50a6259..0bea430d 100644 --- a/requirements.txt +++ b/requirements.txt @@ -11,7 +11,7 @@ click==8.1.7 cryptography==42.0.5 dnspython==2.6.1 filelock==3.13.1 -Jinja2==3.1.3 +Jinja2==3.1.4 jmespath==0.10.0 jsonschema==4.21.1 jsonschema-specifications==2023.12.1 From 27ceb31c689ce42d3ab743d3028c89ca8d57cbdc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 15 Sep 2024 08:21:07 +0200 Subject: [PATCH 12/12] Bump cryptography from 42.0.5 to 43.0.1 (#8) Bumps [cryptography](https://github.com/pyca/cryptography) from 42.0.5 to 43.0.1. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](https://github.com/pyca/cryptography/compare/42.0.5...43.0.1) --- updated-dependencies: - dependency-name: cryptography dependency-type: direct:production ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 0bea430d..96b8c3f1 100644 --- a/requirements.txt +++ b/requirements.txt @@ -8,7 +8,7 @@ black==24.3.0 bracex==2.4 cffi==1.16.0 click==8.1.7 -cryptography==42.0.5 +cryptography==43.0.1 dnspython==2.6.1 filelock==3.13.1 Jinja2==3.1.4