commit dcd1e73e7863952f1ce9216c178b90a7b2b2ac9a
parent 40bde7b5d415ecbb656b652fe6a6bb305906090c
Author: Florian Dold <dold@taler.net>
Date: Fri, 31 Jul 2026 16:19:57 +0200
check the actual secrets instead of the HAVE_SECRETS sentinel
Diffstat:
6 files changed, 51 insertions(+), 11 deletions(-)
diff --git a/inventories/group_vars/all/defaults.yml b/inventories/group_vars/all/defaults.yml
@@ -25,6 +25,10 @@ dangerously_enable_devtesting: false
# and key setup isn't attempted.
configure_ebics: false
+# Use EBICS to talk to the bank. When false, the manual import/export
+# path with its two technical users is set up instead.
+use_ebics: false
+
# Clicksend defaults that should be overridden by the host config.
sms_challenger_clicksend_username: anonymous
sms_challenger_clicksend_api_key: anonymous
diff --git a/inventories/host_vars/fdold-acai-tops/test-secrets.yml b/inventories/host_vars/fdold-acai-tops/test-secrets.yml
@@ -1,6 +1,5 @@
---
# We're the secrets file!
-HAVE_SECRETS: true
# Symmetric encryption secret for KYC attribute encryption.
EXCHANGE_ATTRIBUTE_ENCRYPTION_KEY: SECRET2
# EBICS access details
diff --git a/inventories/host_vars/podman-localhost/test-secrets.yml b/inventories/host_vars/podman-localhost/test-secrets.yml
@@ -1,6 +1,5 @@
---
# We are the secrets file!
-HAVE_SECRETS: true
# Symmetric encryption secret for KYC attribute encryption.
EXCHANGE_ATTRIBUTE_ENCRYPTION_KEY: SECRET2
# EBICS access details
diff --git a/inventories/host_vars/rusty/vars.yml b/inventories/host_vars/rusty/vars.yml
@@ -88,8 +88,6 @@ devtesting_ssh_keys:
# YOU MAY ONLY edit the vault.yml file via
# $ ansible-vault edit inventories/host_vars/rusty/vault.yml
# to decrease the likelihood of unencrypted secrets ending up in git.
-HAVE_SECRETS: true
-
# Symmetric encryption secret for KYC attribute encryption.
EXCHANGE_ATTRIBUTE_ENCRYPTION_KEY: "{{ vault_exchange_attribute_encryption_key }}"
# EBICS access details
diff --git a/inventories/host_vars/spec/vars.yml b/inventories/host_vars/spec/vars.yml
@@ -73,8 +73,6 @@ EXCHANGE_SANCTION_HELPER: taler-exchange-helper-sanctions-dummy
# YOU MAY ONLY edit the vault.yml file via
# $ ansible-vault edit inventories/host_vars/spec/vault.yml
# to decrease the likelihood of unencrypted secrets ending up in git.
-HAVE_SECRETS: true
-
# Symmetric encryption secret for KYC attribute encryption.
EXCHANGE_ATTRIBUTE_ENCRYPTION_KEY: "{{ vault_exchange_attribute_encryption_key }}"
# EBICS access details
diff --git a/playbooks/setup.yml b/playbooks/setup.yml
@@ -3,15 +3,57 @@
hosts: all
any_errors_fatal: true
pre_tasks:
- - name: "Fail if secrets are not defined"
- ansible.builtin.fail:
- msg: "Secrets are not defined (HAVE_SECRETS not set)"
- when: HAVE_SECRETS is undefined
-
- name: "Fail if the deployment kind is not defined"
ansible.builtin.fail:
msg: "DEPLOYMENT_KIND is not set; it selects the exchange_$KIND role"
when: DEPLOYMENT_KIND is undefined
+
+ - name: "Check the secrets every deployment needs"
+ ansible.builtin.assert:
+ that: EXCHANGE_ATTRIBUTE_ENCRYPTION_KEY is defined
+ quiet: true
+
+ - name: "Check the KYCAID secrets"
+ when: DEPLOYMENT_KIND == 'tops'
+ ansible.builtin.assert:
+ that: EXCHANGE_KYCAID_ACCESS_TOKEN is defined
+ quiet: true
+
+ - name: "Check the auditor secrets"
+ when: deploy_auditor | bool
+ ansible.builtin.assert:
+ that: AUDITOR_ACCESS_TOKEN is defined
+ quiet: true
+
+ - name: "Check the monitoring secrets"
+ when: deploy_monitoring | bool
+ ansible.builtin.assert:
+ that:
+ - LOKI_ACCESS_TOKEN is defined
+ - PROMETHEUS_ACCESS_TOKEN is defined
+ quiet: true
+
+ - name: "Check the challenger secrets"
+ when: deploy_challenger | bool
+ ansible.builtin.assert:
+ that:
+ - SMS_CHALLENGER_TELESIGN_AUTH_TOKEN is defined
+ - POSTAL_CHALLENGER_PINGEN_CLIENT_ID is defined
+ - POSTAL_CHALLENGER_PINGEN_CLIENT_SECRET is defined
+ - POSTAL_CHALLENGER_PINGEN_ORG_ID is defined
+ quiet: true
+
+ - name: "Check the EBICS secrets"
+ when: use_ebics | bool or configure_ebics | bool
+ ansible.builtin.assert:
+ that:
+ - LIBEUFIN_NEXUS_EBICS_HOST_BASE_URL is defined
+ - LIBEUFIN_NEXUS_EBICS_HOST_ID is defined
+ - LIBEUFIN_NEXUS_EBICS_USER_ID is defined
+ - LIBEUFIN_NEXUS_EBICS_PARTNER_ID is defined
+ - LIBEUFIN_NEXUS_EBICS_SYSTEM_ID is defined
+ quiet: true
+
roles:
- role: common_packages
- role: webserver
