June
947d8fd0a0
Deploy the ansible-pull-failure-notify.service using the loop using ansible.builtin.copy as it doesn't have any template logic.
112 lines
2.8 KiB
YAML
112 lines
2.8 KiB
YAML
- name: ensure dependencies are installed
|
|
block:
|
|
- name: ensure apt dependencies are installed
|
|
ansible.builtin.apt:
|
|
name:
|
|
- python3-pip
|
|
- virtualenv
|
|
- git
|
|
state: present
|
|
become: true
|
|
|
|
- name: ensure SOPS is installed
|
|
ansible.builtin.include_role:
|
|
name: community.sops.install
|
|
|
|
# https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html#installing-and-upgrading-ansible-with-pip
|
|
# https://www.redhat.com/en/blog/python-venv-ansible
|
|
- name: ensure Ansible installation exists
|
|
ansible.builtin.pip:
|
|
name:
|
|
- ansible
|
|
- jmespath
|
|
state: present
|
|
virtualenv: /usr/local/lib/ansible_pull_venv
|
|
become: true
|
|
|
|
- name: ensure helper script installations exist
|
|
ansible.builtin.copy:
|
|
src: "{{ item }}.sh"
|
|
dest: "/usr/local/sbin/{{ item }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
become: true
|
|
loop:
|
|
- ansible-pull-successful-run-timestamp-exporter
|
|
- ansible-pull-reboot
|
|
|
|
- name: ensure templated helper script installations exists
|
|
ansible.builtin.template:
|
|
src: "{{ item }}.sh.j2"
|
|
dest: "/usr/local/sbin/{{ item }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
become: true
|
|
loop:
|
|
- ansible-pull-failure-notify
|
|
|
|
- name: ensure secrets directory exists
|
|
ansible.builtin.file:
|
|
path: /etc/ansible_pull_secrets
|
|
state: directory
|
|
mode: "0750"
|
|
owner: root
|
|
group: "{{ ansible_pull__user }}"
|
|
become: true
|
|
|
|
- name: ensure age private key is deployed
|
|
ansible.builtin.copy:
|
|
content: "{{ ansible_pull__age_private_key }}"
|
|
dest: /etc/ansible_pull_secrets/age_private_key
|
|
mode: "0640"
|
|
owner: root
|
|
group: "{{ ansible_pull__user }}"
|
|
become: true
|
|
|
|
- name: ensure templated systemd services exists
|
|
ansible.builtin.template:
|
|
src: "{{ item }}.j2"
|
|
dest: "/etc/systemd/system/{{ item }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
become: true
|
|
loop:
|
|
- ansible-pull.service
|
|
notify:
|
|
- systemd daemon reload
|
|
|
|
- name: ensure systemd services exists
|
|
ansible.builtin.copy:
|
|
src: "{{ item }}"
|
|
dest: "/etc/systemd/system/{{ item }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
become: true
|
|
loop:
|
|
- ansible-pull-failure-notify.service
|
|
- ansible-pull-reboot.service
|
|
- ansible-pull-successful-run-timestamp-exporter.service
|
|
notify:
|
|
- systemd daemon reload
|
|
|
|
- name: ensure systemd timer exists
|
|
ansible.builtin.template:
|
|
src: ansible-pull.timer.j2
|
|
dest: /etc/systemd/system/ansible-pull.timer
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
become: true
|
|
notify:
|
|
- systemd daemon reload
|
|
|
|
- name: ensure systemd timer is started and enabled
|
|
ansible.builtin.systemd_service:
|
|
name: ansible-pull.timer
|
|
state: started
|
|
enabled: true
|
|
become: true
|