ansible-taler-exchange

Ansible playbook to deploy a production Taler Exchange
Log | Files | Refs | README | LICENSE

systemd_container.yml (3697B)

      1 ---
      2 # Rootless podman + package units:
      3 # 1) sandbox → CAP_SYS_ADMIN / 217 USER
      4 # 2) socket activation → ignores SERVE=tcp PORT=9011
      5 # Fix: drop sandbox, mask .socket, install TCP-only httpd unit override.
      6 
      7 - name: Ensure runtime dirs for exchange
      8   ansible.builtin.file:
      9     path: "{{ item.path }}"
     10     state: directory
     11     mode: "0755"
     12     owner: "{{ item.owner }}"
     13     group: "{{ item.group }}"
     14   loop:
     15     - { path: /run/taler-exchange, owner: root, group: root }
     16     - { path: /run/taler-exchange/httpd, owner: taler-exchange-httpd, group: taler-exchange-secmod }
     17     - { path: /run/taler-exchange/secmod-rsa, owner: taler-exchange-secmod-rsa, group: taler-exchange-secmod }
     18     - { path: /run/taler-exchange/secmod-cs, owner: taler-exchange-secmod-cs, group: taler-exchange-secmod }
     19     - { path: /run/taler-exchange/secmod-eddsa, owner: taler-exchange-secmod-eddsa, group: taler-exchange-secmod }
     20   failed_when: false
     21 
     22 - name: Ensure drop-in directories for helper units
     23   ansible.builtin.file:
     24     path: "/etc/systemd/system/{{ item }}.service.d"
     25     state: directory
     26     mode: "0755"
     27   loop:
     28     - taler-exchange-secmod-rsa
     29     - taler-exchange-secmod-cs
     30     - taler-exchange-secmod-eddsa
     31     - taler-exchange-aggregator
     32     - taler-exchange-closer
     33     - taler-exchange-wirewatch
     34     - taler-exchange-transfer
     35     - taler-exchange-expire
     36 
     37 - name: Install container-friendly drop-ins for helper units
     38   ansible.builtin.copy:
     39     dest: "/etc/systemd/system/{{ item }}.service.d/container.conf"
     40     owner: root
     41     group: root
     42     mode: "0644"
     43     content: |
     44       [Service]
     45       PrivateTmp=no
     46       PrivateDevices=no
     47       ProtectSystem=no
     48       ProtectHome=no
     49       ProtectKernelTunables=no
     50       ProtectControlGroups=no
     51       ProtectKernelModules=no
     52       ProtectHostname=no
     53       ProtectClock=no
     54       RestrictNamespaces=no
     55       NoNewPrivileges=no
     56       AmbientCapabilities=
     57       CapabilityBoundingSet=
     58   loop:
     59     - taler-exchange-secmod-rsa
     60     - taler-exchange-secmod-cs
     61     - taler-exchange-secmod-eddsa
     62     - taler-exchange-aggregator
     63     - taler-exchange-closer
     64     - taler-exchange-wirewatch
     65     - taler-exchange-transfer
     66     - taler-exchange-expire
     67 
     68 - name: Mask package socket unit (forces TCP SERVE, not unix sock)
     69   ansible.builtin.systemd:
     70     name: taler-exchange-httpd.socket
     71     masked: true
     72     state: stopped
     73     enabled: false
     74   failed_when: false
     75 
     76 - name: Install TCP-only httpd unit override (no socket Requires)
     77   ansible.builtin.copy:
     78     dest: /etc/systemd/system/taler-exchange-httpd.service
     79     owner: root
     80     group: root
     81     mode: "0644"
     82     content: |
     83       [Unit]
     84       Description=GNU Taler payment system exchange REST API (container TCP)
     85       AssertPathExists=/etc/taler-exchange/taler-exchange.conf
     86       Requires=taler-exchange-secmod-cs.service taler-exchange-secmod-rsa.service taler-exchange-secmod-eddsa.service
     87       After=postgresql.service network.target taler-exchange-secmod-cs.service taler-exchange-secmod-rsa.service taler-exchange-secmod-eddsa.service
     88       PartOf=taler-exchange.target
     89 
     90       [Service]
     91       User=taler-exchange-httpd
     92       Type=simple
     93       EnvironmentFile=-/etc/taler-exchange/taler-exchange.env
     94       Restart=always
     95       RestartMode=direct
     96       RestartSec=1ms
     97       StartLimitBurst=5
     98       StartLimitInterval=5s
     99       ExecStart=/usr/bin/taler-exchange-httpd -c /etc/taler-exchange/taler-exchange.conf -L INFO
    100       StandardOutput=journal
    101       StandardError=journal
    102       PrivateTmp=no
    103       PrivateDevices=no
    104       ProtectSystem=no
    105       Slice=taler-exchange.slice
    106 
    107       [Install]
    108       WantedBy=multi-user.target
    109 
    110 - name: Reload systemd after unit changes
    111   ansible.builtin.systemd:
    112     daemon_reload: true