summaryrefslogtreecommitdiff
path: root/roles/deployer/tasks/main.yml
blob: 79492f3441726e573437aa8d3c2d4e8263fba3d7 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
- name: "install deployer dependencies and useful tools"
  apt:
    name:
      - screen
      - git
      - haproxy
      - psmisc
      - python3
      - python3-bottle
      - python3-jwt
      - python3-crypto
    state: present

- name: "install deployer source"
  git:
    repo: git://git.liw.fi/wmf-ci-arch
    dest: /srv/wmf-ci-arch

- name: "create user for deployer"
  user:
    name: _wmf
    comment: "WMF CI"

- name: "install key for checking incoming access tokens"
  copy:
    src: token.pub
    dest: /etc/wmf_ci_token.pub
    owner: root
    group: root
    mode: '0644'

- name: "create ~_wmf/.ssh"
  file:
    state: directory
    dest: /home/_wmf/.ssh
    owner: _wmf
    group: _wmf
    mode: '0700'

- name: "install SSH public key for _wmf"
  copy:
    content: |
      {{ deployer_ssh_pub }}
    dest: /home/_wmf/.ssh/deployer.pub
    owner: _wmf
    group: _wmf
    mode: '0644'

- name: "install SSH private key for _wmf"
  copy:
    content: |
      {{ deployer_ssh }}
    dest: /home/_wmf/.ssh/deployer
    owner: _wmf
    group: _wmf
    mode: '0600'

# FIXME: This is clearly not OK for production.
- name: "configure ssh to not check for new host keys"
  copy:
    src: ssh_config
    dest: /home/_wmf/.ssh/config
    owner: _wmf
    group: _wmf
    mode: '0644'

- name: "install API access token for artifact store"
  copy:
    content: "{{ artifact_download_token }}"
    dest: /etc/wmf_artifact_download_token
    owner: _wmf
    group: _wmf
    mode: '0600'

- name: "install deployer.service"
  copy:
    src: deployer.service
    dest: /lib/systemd/system/deployer.service

- name: "enable and (re)start deployer"
  systemd:
    name: deployer.service
    daemon_reload: yes
    enabled: yes
    state: restarted