majic-ansible-roles Changeset

Changeset - b3e67fd6c0c1

Parent rev.

Child rev.

[Not reviewed]

0 3 0

Branko Majic (branko) - 7 months ago 2023-11-26 15:48:38
branko@majic.rs

MAR-187: Reorder the deprecation tasks for xmpp_server role to make the runs reliable:

- Deprecated apt repository really needs to be removed first in case
it has an unresolvable URL (so the backports repository cache update
would trigger correctly).
- Use the file removal for Prosody repository as well to make sure the
file is dropped.

3 files changed with 68 insertions and 26 deletions:

docs/releasenotes.rst

roles/xmpp_server/molecule/default/prepare.yml

roles/xmpp_server/tasks/main.yml

0 comments (0 inline, 0 general)

docs/releasenotes.rst

➞

Show inline comments

 Release notes
 =============
 x.y.z
 -----
 Minor bug-fixes.
 **Bug fixes:**
 * ``xmpp_server`` role
   * Make sure to take care of deprecation-related package and
     configuration removals prior to running the rest of the tasks to
     avoid errors relaetd to deprecated elements being invalid (like
     repository URLs for Prosody).
 .0.0
 -----
 Dropped support for Debian 9 (Stretch), moved away from using
 non-Debian project repositories (like Prosody ones).
 **Breaking changes:**
 * All roles
   * Dropped support for Debian 9 (Stretch).
 * ``xmpp_server`` role
   * Parameter ``xmpp_prosody_package`` has been dropped.
 **New features/improvements**
 * ``common`` role
   * Added parameters ``pip_check_requirements_in`` and
     ``pip_check_requirements_py3_in`` that can be used for specifying
     input requirements when checking for available package upgrades
     for Python virtual environments that are used for the checks
     themselves. This is particularly helpful in cases where Python
     version gets deprecated and some packages do not correctly declare
     the minimum version required, allowing to be more specific to
     avoid unnecessary warning mails being sent out.
   * Updated default package pins for virtual environments used to
     check for available pip package upgrades.
 * ``mail_server`` role
   * Added parameter ``mail_server_smtp_additional_configuration`` that
     provides ability to include additional configuration directives
     for the SMTP server.
 * ``xmpp_server`` role
   * Drop dependency on the external (Prosody) package
     repository. Install everything using official Debian
     repositories. This should help avoid future issues with Prosody
     project removing older versions of packages or dropping entire
     repository archives for older Debian releases.
   * Prosody package and some of its dependencies are installed from
     Debian backports to get more featureful release installed.

roles/xmpp_server/molecule/default/prepare.yml

➞

Show inline comments

@@ @@ -117,96 +117,104 @@ @@
     # the system to install packages from custom repository location
     # instead.
     - name: Override server IP for Prosody repository via hosts file
       lineinfile:
         path: /etc/hosts
         regexp:
         line: "{{ lookup('dig', 'prosody.repo.majic.rs') }} packages.prosody.im"
         owner: root
         group: root
         mode: 0644
         state: present
       tags:
         - workaround:prosody_repository_override
     - name: Add workaround Prosody repository signing key
       apt_key:
         data: "{{ lookup('file', 'workaround_prosody_repository_signing_key.asc') }}"
         state: present
       tags:
         - workaround:prosody_repository_override
 - hosts: deprecated
   become: true
   tasks:
     - name: Add Prosody repository signing key
       apt_key:
         data: "{{ lookup('file', 'prosody-debian-gpg-key.asc') }}"
         state: present
     - name: Add Prosody repository
       apt_repository:
         repo: "deb http://packages.prosody.im/debian {{ ansible_distribution_release }} main"
         state: present
     - name: Install Prosody (from Prosody repository)
       apt:
         name: prosody-0.11
         state: present
     - name: Set-up directory for storing additional Prosody modules
       file:
         path: "/usr/local/lib/prosody/modules/"
         state: directory
         owner: root
         group: root
         mode: 0755
     - name: Invalidate the Prosody repository URL for testing if the file gets dropped at correct time during initial converge
       copy:
         content: "deb http://invalidname/debian buster main"
         dest: "/etc/apt/sources.list.d/packages_prosody_im_debian.list"
         owner: root
         group: root
         mode: 0644
 - hosts: clients
   become: true
   tasks:
     - name: Install tool for testing TCP connectivity
       apt:
         name: hping3
         state: present
     - name: Deploy CA certificate
       copy:
         src: tests/data/x509/ca/level1.cert.pem
         dest: /usr/local/share/ca-certificates/testca.crt
         owner: root
         group: root
         mode: 0644
       notify:
         - Update CA certificate cache
     - name: Install console-based XMPP client (for interactive testing)
       apt:
         name: mcabber
         state: present
     - name: Install console-based XMPP tool (for non-interactive testing)
       apt:
         name: sendxmpp
         state: present
     - name: Create dedicated group for testing
       group:
         name: user
         state: present
     - name: Create dedicated user for testing
       user:
         name: user
         group: user
         shell: /bin/bash
     - name: Deploy mcabber configuration files
       template:
         src: tests/data/mcabber.cfg.j2
         dest: "~user/{{ item.jid }}.cfg"
         owner: user
         group: user
         mode: 0600
       with_items:

roles/xmpp_server/tasks/main.yml

➞

Show inline comments

 ---
 # Ansible pre-requisites
 # ======================
 - name: Install Python apt bindings
   apt:
     name: python-apt
 - name: Set-up the Debian backports repository
   template:
     src: backports.list.j2
     dest: /etc/apt/sources.list.d/backports.list
     owner: root
     group: root
     mode: 0644
   register: backports_repository_configuration
 - name: Update apt cache if backports repository configuration changed (for immediate use)  # noqa 503
   # [503] Tasks that run when changed should likely be handlers
   #   Since apt_repository module is not reliable (does not deploy
   #   change when changing distro version etc), we have to use
   #   template instead, but this also means we need to trigger the apt
   #   cache reload by hand.
   apt:
     update_cache: true
   when: backports_repository_configuration.changed
 - name: Configure package pins to backports for Prosody
   template:
     src: prosody_backports_pin.j2
     dest: /etc/apt/preferences.d/prosody
     owner: root
     group: root
     mode: 0644
 # Deprecation
 # ===========
-- name: Drop directory for storing custom Prosody modules (deprecation)
 - name: Drop directory for storing custom Prosody modules
   file:
     path: "/usr/local/lib/prosody/"
     state: absent
   notify:
     - Restart Prosody
 - name: Collect information about installed packages
   package_facts:
 - name: Uninstall Prosody from project-provided repository
   apt:
     name: prosody
     state: absent
   when:
     - "ansible_facts.packages['prosody'] is defined"
     - "'nightly' in ansible_facts.packages['prosody'][0].version"
 - name: Uninstall Prosody dependencies from project-provided repository
   apt:
     name:
       - lua-expat
       - lua-filesystem
       - lua-sec
       - lua-socket
     state: absent
   when: >-
     (ansible_facts.packages['lua-expat'] is defined and 'prosody' in ansible_facts.packages['lua-expat'][0].version)
     or (ansible_facts.packages['lua-filesystem'] is defined and 'prosody' in ansible_facts.packages['lua-filesystem'][0].version)
     or (ansible_facts.packages['lua-sec'] is defined and 'prosody' in ansible_facts.packages['lua-sec'][0].version)
     or (ansible_facts.packages['lua-socket'] is defined and 'prosody' in ansible_facts.packages['lua-socket'][0].version)
 - name: Remove Prosody project-provided apt key
   apt_key:
     id: "{{ item }}"
     state: absent
   with_items:
     - "107D65A0A148C237FDF00AB47393D7E674D9DBB5"
     - "44AB6DD06DA46979CFAF997F9B1B82786C8F28BA"
 - name: Remove Prosody project-provided repository
   apt_repository:
     repo: "deb http://packages.prosody.im/debian {{ ansible_distribution_release }} main"
     state: absent
 # Remove the repository configuration file based on path as well, just
 # to be on the safe side (in case the file was manually modified, and
 # did not get detected properly by apt_repository module).
 - name: Remove Prosody project-provided repository (double-tap)
   file:
     path: "/etc/apt/sources.list.d/packages_prosody_im_debian.list"
     state: absent
 # Main implementation
 # ===================
 - name: Set-up the Debian backports repository
   template:
     src: backports.list.j2
     dest: /etc/apt/sources.list.d/backports.list
     owner: root
     group: root
     mode: 0644
   register: backports_repository_configuration
 - name: Update apt cache if backports repository configuration changed (for immediate use)  # noqa 503
   # [503] Tasks that run when changed should likely be handlers
   #   Since apt_repository module is not reliable (does not deploy
   #   change when changing distro version etc), we have to use
   #   template instead, but this also means we need to trigger the apt
   #   cache reload by hand.
   apt:
     update_cache: true
   when: backports_repository_configuration.changed
 - name: Configure package pins to backports for Prosody
   template:
     src: prosody_backports_pin.j2
     dest: /etc/apt/preferences.d/prosody
     owner: root
     group: root
     mode: 0644
 - name: Install additional Prosody dependencies
   apt:
     name:
       - lua-ldap
       - prosody-modules
     state: present
   notify:
     - Restart Prosody
 - name: Install Prosody
   apt:
     name: prosody
     state: present
   notify:
     - Restart Prosody
 - name: Allow Prosody user to traverse the directory with TLS private keys
   user:
     name: prosody
     append: true
     groups: ssl-cert
 - name: Deploy XMPP TLS private key
   copy:
     dest: "/etc/ssl/private/{{ ansible_fqdn }}_xmpp.key"
     content: "{{ xmpp_tls_key }}"
     owner: root
     group: prosody
     mode: 0640
   notify:
     - Restart Prosody
 - name: Deploy XMPP TLS certificate
   copy:
     dest: "/etc/ssl/certs/{{ ansible_fqdn }}_xmpp.pem"
     content: "{{ xmpp_tls_certificate }}"
     owner: root
     group: root
     mode: 0644
   notify:
     - Restart Prosody
 - name: Generate the XMPP server Diffie-Hellman parameter
   openssl_dhparam:
     owner: root
     group: prosody
     mode: 0640
     path: "/etc/ssl/private/{{ ansible_fqdn }}_xmpp.dh.pem"

0 comments (0 inline, 0 general)