Files @ 694893c0259a
Branch filter:

Location: majic-ansible-roles/roles/xmpp_server/tasks/main.yml - annotation

branko
MAR-218: Fix linting errors for unnamed plays:

- All plays should be named at this point.
- Improve naming of some plays.
- Group some of the common tasks together to speed-up the prepare
step.
- Minor refactoring to make the prepare playbooks more consistent
across the roles.
2e1ff733350e
2e1ff733350e
14e9fb107a9a
14e9fb107a9a
14e9fb107a9a
14e9fb107a9a
14e9fb107a9a
14e9fb107a9a
14e9fb107a9a
14e9fb107a9a
14e9fb107a9a
14e9fb107a9a
14e9fb107a9a
14e9fb107a9a
14e9fb107a9a
14e9fb107a9a
14e9fb107a9a
14e9fb107a9a
14e9fb107a9a
14e9fb107a9a
14e9fb107a9a
14e9fb107a9a
14e9fb107a9a
14e9fb107a9a
2d7abfa9286a
e4a0f78340ef
2d7abfa9286a
2d7abfa9286a
2d7abfa9286a
a1b9e125a179
114f02e67a4d
114f02e67a4d
0ad9410c243a
0ad9410c243a
e4a0f78340ef
fb34333e4b48
2ada86e90026
cc7de990e9e4
cc7de990e9e4
0ad9410c243a
284ed92d40bb
e4a0f78340ef
e4a0f78340ef
2ada86e90026
e4a0f78340ef
284ed92d40bb
96e9f230a669
da031f975c67
da031f975c67
da031f975c67
da031f975c67
da031f975c67
e4a0f78340ef
0ad9410c243a
0ad9410c243a
96e9f230a669
96e9f230a669
da031f975c67
da031f975c67
da031f975c67
da031f975c67
da031f975c67
e4a0f78340ef
0ad9410c243a
0ad9410c243a
2e1ff733350e
af834be42e8e
c92d79571cf9
c92d79571cf9
c92d79571cf9
c92d79571cf9
c92d79571cf9
c92d79571cf9
c92d79571cf9
c92d79571cf9
c92d79571cf9
aa2802e42d9d
e4a0f78340ef
e4a0f78340ef
e4a0f78340ef
e4a0f78340ef
e4a0f78340ef
e4a0f78340ef
aa2802e42d9d
91e4754320e6
91e4754320e6
91e4754320e6
91e4754320e6
91e4754320e6
91e4754320e6
91e4754320e6
91e4754320e6
91e4754320e6
91e4754320e6
91e4754320e6
91e4754320e6
91e4754320e6
91e4754320e6
91e4754320e6
91e4754320e6
814be5def61d
814be5def61d
814be5def61d
814be5def61d
814be5def61d
814be5def61d
814be5def61d
814be5def61d
814be5def61d
814be5def61d
2e1ff733350e
da031f975c67
e4a0f78340ef
e4a0f78340ef
da031f975c67
da031f975c67
da031f975c67
2e1ff733350e
2e1ff733350e
2e1ff733350e
2e1ff733350e
e4a0f78340ef
e4a0f78340ef
e4a0f78340ef
aa7b596ef595
eb9a1b525c77
eb9a1b525c77
e4a0f78340ef
e4a0f78340ef
e4a0f78340ef
e4a0f78340ef
e4a0f78340ef
e4a0f78340ef
eb9a1b525c77
dbc3381e1ff3
7387caca37f3
7387caca37f3
3802c52995e5
fcf5abdd3ad5
7387caca37f3
7387caca37f3
---

# Main implementation
# ===================

- name: Set-up the Debian backports repository
  template:
    src: backports.list.j2
    dest: /etc/apt/sources.list.d/backports.list
    owner: root
    group: root
    mode: 0644
  register: backports_repository_configuration

- name: Update apt cache if backports repository configuration changed (for immediate use)  # noqa 503
  # [503] Tasks that run when changed should likely be handlers
  #   Since apt_repository module is not reliable (does not deploy
  #   change when changing distro version etc), we have to use
  #   template instead, but this also means we need to trigger the apt
  #   cache reload by hand.
  apt:
    update_cache: true
  when: backports_repository_configuration.changed

- name: Install additional Prosody dependencies
  apt:
    name:
      - lua-ldap
      - prosody-modules
    state: present
  notify:
    - Restart Prosody

- name: Install Prosody
  apt:
    name: prosody
    state: present
  notify:
    - Restart Prosody

- name: Allow Prosody user to traverse the directory with TLS private keys
  user:
    name: prosody
    append: true
    groups: ssl-cert

- name: Deploy XMPP TLS private key
  copy:
    dest: "/etc/ssl/private/{{ ansible_fqdn }}_xmpp.key"
    content: "{{ xmpp_tls_key }}"
    owner: root
    group: prosody
    mode: 0640
  notify:
    - Restart Prosody

- name: Deploy XMPP TLS certificate
  copy:
    dest: "/etc/ssl/certs/{{ ansible_fqdn }}_xmpp.pem"
    content: "{{ xmpp_tls_certificate }}"
    owner: root
    group: root
    mode: 0644
  notify:
    - Restart Prosody

- name: Generate the XMPP server Diffie-Hellman parameter
  openssl_dhparam:
    owner: root
    group: prosody
    mode: 0640
    path: "/etc/ssl/private/{{ ansible_fqdn }}_xmpp.dh.pem"
    size: 2048
  notify:
    - Restart Prosody

- name: Deploy configuration file for checking certificate validity via cron
  copy:
    content: "/etc/ssl/certs/{{ ansible_fqdn }}_xmpp.pem"
    dest: "/etc/check_certificate/{{ ansible_fqdn }}_xmpp.conf"
    owner: root
    group: root
    mode: 0644

- name: Deploy script for validating Prosody certificate
  copy:
    src: "check_prosody_certificate.sh"
    dest: "/usr/local/bin/check_prosody_certificate.sh"
    owner: root
    group: root
    mode: 0755

- name: Set-up crontab task that runs the Prosody certificate checker script once a day
  copy:
    src: "cron_check_prosody_certificate"
    dest: "/etc/cron.d/check_prosody_certificate"
    owner: root
    group: root
    mode: 0644

- name: Deploy LDAP client configuration (for validating LDAP server certificate)
  copy:
    src: prosody_ldaprc
    dest: "/var/lib/prosody/.ldaprc"
    owner: root
    group: prosody
    mode: 0640
  notify:
    - Restart Prosody

- name: Deploy Prosody configuration file
  template:
    src: "prosody.cfg.lua.j2"
    dest: "/etc/prosody/prosody.cfg.lua"
    owner: root
    group: prosody
    mode: 0640
  notify:
    - Restart Prosody

- name: Enable and start Prosody service
  service:
    name: prosody
    state: started
    enabled: true

- name: Deploy firewall configuration for XMPP server
  copy:
    src: "ferm_xmpp.conf"
    dest: "/etc/ferm/conf.d/30-xmpp.conf"
    owner: root
    group: root
    mode: 0640
  notify:
    - Restart ferm

- name: Explicitly run all handlers
  include_tasks: ../handlers/main.yml
  when: "run_handlers | default(False) | bool()"
  tags:
    - handlers