ansible-taler-exchange

Ansible playbook to deploy a production Taler Exchange
Log | Files | Refs | README | LICENSE

main.yml (3223B)

      1 ---
      2 # Role: Install dependencies
      3 
      4 - name: Disable password authentication and X11 forwarding in SSH
      5   ansible.builtin.lineinfile:
      6     path: /etc/ssh/sshd_config
      7     regexp: "{{ item.regexp }}"
      8     line: "{{ item.line }}"
      9     state: present
     10   loop:
     11     - { regexp: '^#?PasswordAuthentication.*', line: 'PasswordAuthentication no' }
     12     - { regexp: '^#?X11Forwarding.*', line: 'X11Forwarding no' }
     13   notify: Restart SSH service
     14 
     15 - name: Deploy TSYS signing key
     16   copy:
     17     src: etc/apt/keyrings/taler-systems.gpg
     18     dest: /etc/apt/keyrings/taler-systems.gpg
     19     owner: root
     20     group: root
     21     mode: "0644"
     22 
     23 - name: Add GNU Taler repo (Debian)
     24   deb822_repository:
     25     name: Taler
     26     types: deb
     27     uris: https://deb.taler.net/apt/debian
     28     suites: "{{ taler_repo_suites }}"
     29     components:
     30       - main
     31     architectures: amd64
     32     signed_by: /etc/apt/keyrings/taler-systems.gpg
     33   when: 'ansible_facts["distribution"] == "Debian"'
     34 
     35 - name: Add GNU Taler repo (Ubuntu)
     36   deb822_repository:
     37     name: Taler
     38     types: deb
     39     uris: https://deb.taler.net/apt/ubuntu
     40     suites: "{{ taler_repo_suites }}"
     41     components:
     42       - main
     43     architectures: amd64
     44     signed_by: /etc/apt/keyrings/taler-systems.gpg
     45   when: 'ansible_facts["distribution"] == "Ubuntu"'
     46 
     47 # The file is a no-op (priority 500 is the default); see the comment in
     48 # it: we only keep deploying it because it is already on the hosts.
     49 - name: Deploy the taler repo pinning file
     50   copy:
     51     src: etc/apt/preferences.d/limit-taler-repo
     52     dest: /etc/apt/preferences.d/limit-taler-repo
     53     owner: root
     54     group: root
     55     mode: "0644"
     56 
     57 - name: Deploy current base distro
     58   apt:
     59     state: latest
     60     update_cache: true
     61     autoclean: true
     62     autoremove: true
     63     upgrade: safe
     64   when: ansible_facts["os_family"] == 'Debian'
     65 
     66 - name: Install packages required by Ansible
     67   apt:
     68     name:
     69       - python3-debian
     70       - python3-psycopg2
     71     state: latest
     72   when: ansible_facts["os_family"] == 'Debian'
     73 
     74 - name: Install Taler dependencies on Debian/Ubuntu
     75   apt:
     76     name:
     77       - curl
     78       - jq
     79       - sudo
     80       - uuid-runtime
     81       - wget
     82       - openssl
     83       - libgnunet
     84     state: latest
     85   when: ansible_facts["os_family"] == 'Debian'
     86 
     87 - name: Install robocop if sanction lists are in use
     88   apt:
     89     name:
     90       - robocop
     91     state: latest
     92   when:
     93     - sanction_list is defined
     94     - ansible_facts["os_family"] == 'Debian'
     95 
     96 - name: Install setup-secret-fact helper
     97   ansible.builtin.copy:
     98     src: setup-secret-fact
     99     dest: /bin/setup-secret-fact
    100     owner: root
    101     group: root
    102     mode: "0744"
    103 
    104 - name: Install setup-challenger-client-id-fact helper
    105   ansible.builtin.copy:
    106     src: setup-challenger-client-id-fact
    107     dest: /bin/setup-challenger-client-id-fact
    108     owner: root
    109     group: root
    110     mode: "0744"
    111 
    112 - name: Generate dhparam.pem
    113   command: openssl dhparam -out dhparam.pem 4096
    114   args:
    115     chdir: /etc/ssl/private/
    116     creates: /etc/ssl/private/dhparam.pem
    117   when: not (use_pregenerated_dhparam | default(False))
    118 
    119 - name: Deploy pregenerated dhparam.pem
    120   copy:
    121     src: dhparam_pregenerated.pem
    122     dest: /etc/ssl/private/dhparam.pem
    123     owner: root
    124     group: root
    125     mode: "0644"
    126   when: (use_pregenerated_dhparam | default(False))