commit 56ae7516e70029dd8b9abe850c7812ffb15668a1
parent f35b95c1bda06d8a72a19ed9df253f6461e1f131
Author: Florian Dold <dold@taler.net>
Date: Fri, 31 Jul 2026 15:45:52 +0200
fail loudly instead of silently skipping
The database role skipped the restore whenever
roles/database/files/postgres-backup.sql.gz did not resolve (the symlink
dangles until restore.sh has run), so a deploy with
ENABLE_RESTORE_BACKUP set would happily continue onto an empty database.
sshd was restarted on every run instead of only when sshd_config changed;
make it a handler.
The task that clears broken nginx sites ended in a "fail" with
ignore_errors, so it neither failed nor said anything useful; make it a
debug message. The repo pinning task claimed to pin to the lowest
priority, while the file it deploys sets priority 500, the default.
Diffstat:
4 files changed, 26 insertions(+), 10 deletions(-)
diff --git a/roles/common_packages/handlers/main.yml b/roles/common_packages/handlers/main.yml
@@ -0,0 +1,5 @@
+---
+- name: Restart SSH service
+ ansible.builtin.service:
+ name: ssh
+ state: restarted
diff --git a/roles/common_packages/tasks/main.yml b/roles/common_packages/tasks/main.yml
@@ -10,11 +10,7 @@
loop:
- { regexp: '^#?PasswordAuthentication.*', line: 'PasswordAuthentication no' }
- { regexp: '^#?X11Forwarding.*', line: 'X11Forwarding no' }
-
-- name: Restart SSH service
- ansible.builtin.service:
- name: ssh
- state: restarted
+ notify: Restart SSH service
- name: Deploy TSYS signing key
copy:
@@ -48,7 +44,9 @@
signed_by: /etc/apt/keyrings/taler-systems.gpg
when: 'ansible_facts["distribution"] == "Ubuntu"'
-- name: Pin taler repo to lowest priority so they don't auto upgrade
+# The file is a no-op (priority 500 is the default); see the comment in
+# it: we only keep deploying it because it is already on the hosts.
+- name: Deploy the taler repo pinning file
copy:
src: etc/apt/preferences.d/limit-taler-repo
dest: /etc/apt/preferences.d/limit-taler-repo
diff --git a/roles/database/tasks/main.yml b/roles/database/tasks/main.yml
@@ -64,6 +64,18 @@
- versioning_schema_exists | default(false) | bool
- local_backup_exists | bool
+# Without this the deploy would silently continue onto an empty database.
+- name: Fail if a restore was requested but no backup is available
+ fail:
+ msg: >-
+ ENABLE_RESTORE_BACKUP is set but
+ {{ role_path }}/files/postgres-backup.sql.gz does not resolve to a
+ file. Fetch the backup with restore.sh first.
+ when:
+ - ENABLE_RESTORE_BACKUP
+ - not (local_backup_exists | bool)
+ - not (exchange_db_exists | bool)
+
# Note: the postgres-backup.sql.gz is a symbolic link in Git.
# The target of that symbolic link is created via the 'restore.sh' script.
- name: Upload database backup file to server if restoring from backup
diff --git a/roles/webserver/tasks/main.yml b/roles/webserver/tasks/main.yml
@@ -71,10 +71,11 @@
state: absent
with_items: "{{ cleanup.files }}"
ignore_errors: true
- - name: Fail with message
- fail:
- msg: Clearing all enabled sites, as nginx config is broken.
- ignore_errors: true
+ - name: Report that the sites were cleared
+ ansible.builtin.debug:
+ msg: >-
+ Cleared all enabled sites, as the nginx config is broken.
+ They are re-created further down in this play.
- name: Ensure Nginx service is enabled and started
service:
