setup.yml (5780B)
1 --- 2 - name: Deploy gnu Taler 3 hosts: all 4 gather_facts: false 5 any_errors_fatal: true 6 pre_tasks: 7 - name: Gather host facts without logging stored local secrets 8 ansible.builtin.setup: 9 no_log: true 10 11 - name: Validate the external monitoring bundle before stopping applications 12 ansible.builtin.include_role: 13 name: monitoring 14 tasks_from: preflight 15 when: enable_monitoring | default(false) | bool 16 17 - name: Reject the removed in-deployment restore switch 18 ansible.builtin.assert: 19 that: not (enable_restore_backup | default(false) | bool) 20 fail_msg: >- 21 enable_restore_backup is no longer supported. Restore a fresh host 22 with restore before running the normal deployment. 23 quiet: true 24 25 - name: "Fail if the deployment kind is not defined" 26 ansible.builtin.fail: 27 msg: "deployment_kind is not set; it selects the exchange_$KIND role" 28 when: deployment_kind is undefined 29 30 - name: "Check the secrets every deployment needs" 31 ansible.builtin.assert: 32 that: exchange_attribute_encryption_key is defined 33 quiet: true 34 35 - name: Restrict mock MFA to the Rusty staging host 36 ansible.builtin.assert: 37 that: inventory_hostname == 'rusty' 38 fail_msg: >- 39 devtesting_mock_mfa exposes MFA codes and may only be enabled on 40 the Rusty staging host. 41 quiet: true 42 when: devtesting_mock_mfa | bool 43 44 - name: "Check the KYCAID secrets" 45 when: deployment_kind == 'tops' 46 ansible.builtin.assert: 47 that: exchange_kycaid_access_token is defined 48 quiet: true 49 50 - name: "Check the auditor secrets" 51 when: deploy_auditor | bool 52 ansible.builtin.assert: 53 that: auditor_access_token is defined 54 quiet: true 55 56 - name: "Check the challenger secrets" 57 when: deploy_challenger | bool 58 ansible.builtin.assert: 59 that: 60 - sms_challenger_telesign_auth_token is defined 61 - postal_challenger_pingen_client_id is defined 62 - postal_challenger_pingen_client_secret is defined 63 - postal_challenger_pingen_org_id is defined 64 quiet: true 65 66 - name: "Check the EBICS secrets" 67 when: use_ebics | bool or configure_ebics | bool 68 ansible.builtin.assert: 69 that: 70 - libeufin_nexus_ebics_host_base_url is defined 71 - libeufin_nexus_ebics_host_id is defined 72 - libeufin_nexus_ebics_user_id is defined 73 - libeufin_nexus_ebics_partner_id is defined 74 - libeufin_nexus_ebics_system_id is defined 75 quiet: true 76 77 tasks: 78 - name: Deploy with applications stopped until configuration is complete 79 block: 80 - name: Track deployment completion before modifying services 81 ansible.builtin.include_role: 82 name: deployment_state 83 84 - name: Stop existing applications before any package upgrades 85 ansible.builtin.include_role: 86 name: stop_services 87 vars: 88 stop_services_include_merchant: false 89 90 - name: Remember previously active applications 91 ansible.builtin.set_fact: 92 deployment_previously_active_units: "{{ stop_services_active_units }}" 93 94 - name: Configure common_packages 95 ansible.builtin.include_role: 96 name: common_packages 97 98 - name: Configure webserver 99 ansible.builtin.include_role: 100 name: webserver 101 102 - name: Configure monitoring 103 ansible.builtin.include_role: 104 name: monitoring 105 when: enable_monitoring | default(false) | bool 106 107 - name: Configure database 108 ansible.builtin.include_role: 109 name: database 110 111 - name: Configure libeufin-nexus 112 ansible.builtin.include_role: 113 name: libeufin-nexus 114 115 - name: Configure challenger 116 ansible.builtin.include_role: 117 name: challenger 118 when: deploy_challenger | bool 119 vars: 120 postexchange: false 121 122 - name: Configure exchange 123 ansible.builtin.include_role: 124 name: exchange 125 126 - name: Configure challenger after exchange 127 ansible.builtin.include_role: 128 name: challenger 129 when: deploy_challenger | bool 130 vars: 131 postexchange: true 132 133 - name: Configure auditor 134 ansible.builtin.include_role: 135 name: auditor 136 when: deploy_auditor | bool 137 138 - name: Configure devtesting 139 ansible.builtin.include_role: 140 name: devtesting 141 142 - name: Apply pending configuration handlers before starting applications 143 ansible.builtin.meta: flush_handlers 144 145 - name: Start configured applications 146 ansible.builtin.include_role: 147 name: start_services 148 149 - name: Run post-deployment sanity checks 150 ansible.builtin.include_role: 151 name: post_deployment_checks 152 153 - name: Record successful deployment 154 ansible.builtin.include_role: 155 name: deployment_state 156 tasks_from: complete 157 158 rescue: 159 - name: Leave applications stopped after a deployment failure 160 ansible.builtin.include_role: 161 name: stop_services 162 vars: 163 stop_services_include_merchant: false 164 when: not ansible_check_mode 165 166 - name: Report the failed deployment 167 ansible.builtin.fail: 168 msg: >- 169 Deployment failed at {{ ansible_failed_task.name }}. 170 {{ 'Check mode made no service changes.' if ansible_check_mode else 171 'Applications remain stopped; inspect the preceding error and correct it before redeploying.' }}