Change: support building from non-master branch of ick

8 files changed, 34 insertions, 5 deletions

diff --git a/roles/apt_repository/files/process-incoming b/roles/apt_repository/files/process-incoming
index 1ae7ff7..ebb3952 100644
--- a/roles/apt_repository/files/process-incoming
+++ b/roles/apt_repository/files/process-incoming
@@ -2,5 +2,6 @@
 
 # sleep for a few seconds so that dput has time to chmod the uploaded
 # file.
-sleep 3
-reprepro -b /srv/apt processincoming default
+sleep 10
+reprepro -b /srv/apt processincoming default >> /srv/apt/reprepro.log
+
diff --git a/roles/ick-artifact-store/tasks/main.yml b/roles/ick-artifact-store/tasks/main.yml
index c0d15a9..dd9e858 100644
--- a/roles/ick-artifact-store/tasks/main.yml
+++ b/roles/ick-artifact-store/tasks/main.yml
@@ -2,7 +2,7 @@
   apt:
     name: "{{ item }}"
   with_items:
-    - ick2
+    - "{{ ick_prefix }}ick2"
 
 - name: create config dirs
   file:
diff --git a/roles/ick-controller/tasks/main.yml b/roles/ick-controller/tasks/main.yml
index 8c8cf6f..bbcae08 100644
--- a/roles/ick-controller/tasks/main.yml
+++ b/roles/ick-controller/tasks/main.yml
@@ -2,7 +2,7 @@
   apt:
     name: "{{ item }}"
   with_items:
-    - ick2
+    - "{{ ick_prefix }}ick2"
     - curl
     - psmisc
     - less
diff --git a/roles/ick-worker/defaults/main.yml b/roles/ick-worker/defaults/main.yml
new file mode 100644
index 0000000..32a3e70
--- /dev/null
+++ b/roles/ick-worker/defaults/main.yml
@@ -0,0 +1,7 @@
+# Should worker manager be configured to check the TLS certificate of
+# the APIs it uses? Default to yes, but if installed from CI builds,
+# for testing, Let's Encrypt might not be suitable, due to limits, and
+# it's necessary to use self-signed certificates, and thus it's better
+# to not check certificates in that situation.
+
+verify_tls: yes
diff --git a/roles/ick-worker/tasks/main.yml b/roles/ick-worker/tasks/main.yml
index b9b351d..0e1dec4 100644
--- a/roles/ick-worker/tasks/main.yml
+++ b/roles/ick-worker/tasks/main.yml
@@ -2,7 +2,7 @@
   apt:
     name: "{{ item }}"
   with_items:
-    - ick2
+    - "{{ ick_prefix }}ick2"
     - debootstrap
     - jq
     - less
diff --git a/roles/ick-worker/templates/worker_manager.yaml.j2 b/roles/ick-worker/templates/worker_manager.yaml.j2
index 11c08b2..fd1bec2 100644
--- a/roles/ick-worker/templates/worker_manager.yaml.j2
+++ b/roles/ick-worker/templates/worker_manager.yaml.j2
@@ -7,3 +7,4 @@ config:
   log-max: 10M
   log-keep: 10
   workspace: /var/lib/ick/workspace
+  verify-tls: {{ verify_tls }}
diff --git a/roles/letsencrypt/defaults/main.yml b/roles/letsencrypt/defaults/main.yml
index 5f8c438..ce1a2d3 100644
--- a/roles/letsencrypt/defaults/main.yml
+++ b/roles/letsencrypt/defaults/main.yml
@@ -1,3 +1,6 @@
+# Enable letsencrypt?
+letsencrypt: yes
+
 # Specify a properly configured and functional domain name
 letsencrypt_domain: FIXME
 
diff --git a/roles/letsencrypt/tasks/main.yml b/roles/letsencrypt/tasks/main.yml
index 5606b60..b7d0df0 100644
--- a/roles/letsencrypt/tasks/main.yml
+++ b/roles/letsencrypt/tasks/main.yml
@@ -14,22 +14,36 @@
     owner: root
     group: root
     mode: 0755
+  when: letsencrypt
 
 - name: install certbot
   apt:
     name: certbot
     default_release: stretch-backports
+  when: letsencrypt
 
 - name: install haproxy
   apt:
     name: haproxy
 
+- name: install ssl-cert
+  apt:
+    name: ssl-cert
+  when: not letsencrypt
+
 - name: stop haproxy
   ignore_errors: true
   systemd:
     name: haproxy
     state: stopped
 
+- name: install snakeoil certificate for haproxy
+  shell:  |
+    cat /etc/ssl/certs/ssl-cert-snakeoil.pem \
+        /etc/ssl/private/ssl-cert-snakeoil.key \
+        > /etc/haproxy/haproxy.pem
+  when: not letsencrypt
+
 - name: fetch new certificate
   command: >
     certbot certonly
@@ -38,9 +52,11 @@
     --domain "{{ letsencrypt_domain }}"
     --email "{{ letsencrypt_email }}"
     --agree-tos
+  when: letsencrypt
 
 - name: install new cert for haproxy
   command: /usr/local/sbin/deploy_certs_haproxy
+  when: letsencrypt
 
 - name: start haproxy
   ignore_errors: true
@@ -60,3 +76,4 @@
       --quiet
       --pre-hook "systemctl stop haproxy"
       --post-hook "/usr/local/sbin/deploy_certs_haproxy && systemctl start haproxy"
+  when: letsencrypt