From 4b1da014588d929d88502a35ffca2130f70418f1 Mon Sep 17 00:00:00 2001 From: Daniil Anfimov Date: Sun, 25 Oct 2026 23:41:00 +0200 Subject: [PATCH 1/2] Add ALTS deployment roles and playbooks Move the ALTS RabbitMQ, scheduler (with Flower) and Celery worker Ansible roles and playbooks here from the alts repository. Roles get an alts_ prefix, role-specific templates move into their roles, and the inventory lives in inventories/alts. TLS certificates and keys are no longer kept in the repository, the deployer puts them into the gitignored playbooks/files/alts/. --- .gitignore | 4 + README.md | 21 +++ inventories/alts/group_vars/celery.yml | 47 +++++ inventories/alts/group_vars/rabbitmq.yml | 19 ++ inventories/alts/group_vars/scheduler.yml | 57 ++++++ inventories/alts/hosts.yml | 29 ++++ playbooks/alts_celery.yml | 17 ++ playbooks/alts_rabbitmq.yml | 6 + playbooks/alts_scheduler.yml | 8 + .../templates/alts_service_config.yaml.j2 | 134 +++++++++++++++ requirements.yml | 1 + roles/alts_base/tasks/main.yml | 36 ++++ roles/alts_celery/defaults/main.yml | 8 + roles/alts_celery/handlers/main.yml | 6 + roles/alts_celery/tasks/main.yml | 119 +++++++++++++ .../templates/alts-celery.service.j2 | 22 +++ .../alts_celery/templates/celery-logrotate.j2 | 8 + .../defaults/main.yml | 3 + .../files/docker-moby.conf | 7 + .../alts_docker_customization/tasks/main.yml | 48 ++++++ .../templates/docker-options.j2 | 7 + roles/alts_flower/defaults/main.yml | 13 ++ roles/alts_flower/tasks/main.yml | 102 +++++++++++ .../alts_flower/templates/alts-flower.env.j2 | 2 + .../templates/alts-flower.service.j2 | 20 +++ .../alts_flower/templates/logrotate-flower.j2 | 11 ++ roles/alts_rabbitmq_server/defaults/main.yml | 4 + roles/alts_rabbitmq_server/handlers/main.yml | 6 + roles/alts_rabbitmq_server/tasks/main.yml | 162 ++++++++++++++++++ roles/alts_scheduler/defaults/main.yml | 9 + roles/alts_scheduler/tasks/main.yml | 136 +++++++++++++++ .../templates/alts-scheduler.service.j2 | 14 ++ roles/alts_terraform/defaults/main.yml | 5 + roles/alts_terraform/tasks/main.yml | 124 ++++++++++++++ roles/alts_terraform/templates/terraformrc.j2 | 2 + 35 files changed, 1217 insertions(+) create mode 100644 inventories/alts/group_vars/celery.yml create mode 100644 inventories/alts/group_vars/rabbitmq.yml create mode 100644 inventories/alts/group_vars/scheduler.yml create mode 100644 inventories/alts/hosts.yml create mode 100644 playbooks/alts_celery.yml create mode 100644 playbooks/alts_rabbitmq.yml create mode 100644 playbooks/alts_scheduler.yml create mode 100644 playbooks/templates/alts_service_config.yaml.j2 create mode 100644 roles/alts_base/tasks/main.yml create mode 100644 roles/alts_celery/defaults/main.yml create mode 100644 roles/alts_celery/handlers/main.yml create mode 100644 roles/alts_celery/tasks/main.yml create mode 100644 roles/alts_celery/templates/alts-celery.service.j2 create mode 100644 roles/alts_celery/templates/celery-logrotate.j2 create mode 100644 roles/alts_docker_customization/defaults/main.yml create mode 100644 roles/alts_docker_customization/files/docker-moby.conf create mode 100644 roles/alts_docker_customization/tasks/main.yml create mode 100644 roles/alts_docker_customization/templates/docker-options.j2 create mode 100644 roles/alts_flower/defaults/main.yml create mode 100644 roles/alts_flower/tasks/main.yml create mode 100644 roles/alts_flower/templates/alts-flower.env.j2 create mode 100644 roles/alts_flower/templates/alts-flower.service.j2 create mode 100644 roles/alts_flower/templates/logrotate-flower.j2 create mode 100644 roles/alts_rabbitmq_server/defaults/main.yml create mode 100644 roles/alts_rabbitmq_server/handlers/main.yml create mode 100644 roles/alts_rabbitmq_server/tasks/main.yml create mode 100644 roles/alts_scheduler/defaults/main.yml create mode 100644 roles/alts_scheduler/tasks/main.yml create mode 100644 roles/alts_scheduler/templates/alts-scheduler.service.j2 create mode 100644 roles/alts_terraform/defaults/main.yml create mode 100644 roles/alts_terraform/tasks/main.yml create mode 100644 roles/alts_terraform/templates/terraformrc.j2 diff --git a/.gitignore b/.gitignore index d2b3edb..626cc88 100644 --- a/.gitignore +++ b/.gitignore @@ -4,4 +4,8 @@ !inventory/group_vars/all.yml.tmpl vars.yml roles/ezamriy.fail2ban +roles/geerlingguy.docker +roles/geerlingguy.redis +# ALTS TLS certificates and keys, provided by the deployer +playbooks/files/alts/ .vscode/* \ No newline at end of file diff --git a/README.md b/README.md index f85fd86..a3ba9e8 100644 --- a/README.md +++ b/README.md @@ -159,6 +159,27 @@ rabbitmq_vhost: pulp_password: ``` +## ALTS (production-like deployment) +Standalone ALTS services (RabbitMQ broker, scheduler with Flower, Celery +workers) are deployed by separate playbooks using the `inventories/alts` +inventory. Copy it, put your hosts into `hosts.yml` and adjust +`group_vars/*.yml` (passwords, JWT secret, Pulp credentials, etc.). + +TLS certificates and keys are not stored in the repository. Put them into +`playbooks/files/alts/` (gitignored): +``` +playbooks/files/alts/celery/{ca_certificate,client_certificate,client_key}.pem +playbooks/files/alts/rabbitmq/{ca_certificate,server_certificate,server_key}.pem +``` + +Then run the playbooks in order: +```bash +ansible-galaxy install -r requirements.yml +ansible-playbook -i inventories/alts playbooks/alts_rabbitmq.yml +ansible-playbook -i inventories/alts playbooks/alts_scheduler.yml -e flower_password= +ansible-playbook -i inventories/alts playbooks/alts_celery.yml +``` + ## Contributing to albs-deploy Any question? Found a bug? File an [issue](https://github.com/AlmaLinux/build-system/issues). Do you want to contribute with source code? diff --git a/inventories/alts/group_vars/celery.yml b/inventories/alts/group_vars/celery.yml new file mode 100644 index 0000000..eb83163 --- /dev/null +++ b/inventories/alts/group_vars/celery.yml @@ -0,0 +1,47 @@ +--- + +broker_type: rabbitmq +logs_uploader_type: pulp +terraform_plugin_cache_dir: /home/{{ test_system_user }}/.terraform.d/plugins-cache +test_system_user: test-system +test_system_vhost: test_system +test_system_password: some-another-secret-password +test_system_config_dir: /home/{{ test_system_user }}/.config/alts + +rabbitmq_host: localhost +rabbitmq_port: 5672 +rabbitmq_ssl_port: 5671 + +celery_ssl: true +celery_ssl_src_certificate: "files/alts/celery/client_certificate.pem" +celery_ssl_src_key: "files/alts/celery/client_key.pem" +celery_src_cacert: "files/alts/celery/ca_certificate.pem" +celery_ssl_dir: "{{ test_system_config_dir }}/ssl" +celery_ssl_certificate: "{{ celery_ssl_dir }}/{{ celery_ssl_src_certificate | basename }}" +celery_ssl_key: "{{ celery_ssl_dir }}/{{ celery_ssl_src_key | basename }}" +celery_cacert: "{{ celery_ssl_dir }}/{{ celery_src_cacert | basename }}" + +result_backend_name: local +celery_result_folder: /srv/celery_results +celery_pool_type: prefork + +worker_prefetch_multiplier: 1 +result_expires: 3600 +tests_exec_timeout: 3600 +broker_pool: 30 + +# Optional overrides for environment provisioning +# cleanup_yum_conf_docs_settings: false +# ignore_ansible_install_errors: true +# docker_image_overrides: +# - dist_name: almalinux +# dist_versions: ['8', '9'] +# platform: linux/386 +# image: quay.io/almalinuxautobot/almalinux + +celery_log_file_dir: /var/log/celery +celery_log_file: "{{ celery_log_file_dir }}/celery.log" +celery_concurrency: 10 +celery_loglevel: INFO +celery_queues: + - "docker-x86_64-0" diff --git a/inventories/alts/group_vars/rabbitmq.yml b/inventories/alts/group_vars/rabbitmq.yml new file mode 100644 index 0000000..5ba5fc4 --- /dev/null +++ b/inventories/alts/group_vars/rabbitmq.yml @@ -0,0 +1,19 @@ +--- + +broker_type: rabbitmq +logs_uploader_type: pulp +rabbitmq_ssl: true +rabbitmq_copy_ssl_files: true +rabbitmq_admin_user: admin +rabbitmq_admin_password: some-secret-password +rabbitmq_ssl_folder: "/etc/rabbitmq/ssl/" +rabbitmq_cacert: "files/alts/rabbitmq/ca_certificate.pem" +rabbitmq_server_key: "files/alts/rabbitmq/server_key.pem" +rabbitmq_server_cert: "files/alts/rabbitmq/server_certificate.pem" +rabbitmq_conf_ssl_options_cacertfile: "{{ rabbitmq_ssl_folder }}/{{ rabbitmq_cacert | basename }}" +rabbitmq_conf_ssl_options_keyfile: "{{ rabbitmq_ssl_folder }}/{{ rabbitmq_server_key | basename }}" +rabbitmq_conf_ssl_options_certfile: "{{ rabbitmq_ssl_folder }}/{{ rabbitmq_server_cert | basename }}" +rabbitmq_ssl_verify: "verify_peer" +rabbitmq_ssl_fail_if_no_peer_cert: true +rabbitmq_test_system_password: some-another-secret-password +rabbitmq_test_system_vhost: /test-system diff --git a/inventories/alts/group_vars/scheduler.yml b/inventories/alts/group_vars/scheduler.yml new file mode 100644 index 0000000..19c0f94 --- /dev/null +++ b/inventories/alts/group_vars/scheduler.yml @@ -0,0 +1,57 @@ +--- + +# Firewall management (set to false for cloud instances using security groups) +manage_firewall: false + +broker_type: rabbitmq +test_system_user: albs +test_system_vhost: alts +test_system_password: some-another-secret-password +test_system_config_dir: ~/.config/alts + +rabbitmq_host: localhost +rabbitmq_port: 5672 +rabbitmq_ssl_port: 5671 + +celery_ssl: true +celery_ssl_src_certificate: "files/alts/celery/client_certificate.pem" +celery_ssl_src_key: "files/alts/celery/client_key.pem" +celery_src_cacert: "files/alts/celery/ca_certificate.pem" +celery_ssl_dir: "{{ test_system_config_dir }}/ssl" +celery_ssl_certificate: "{{ celery_ssl_dir }}/{{ celery_ssl_src_certificate | basename }}" +celery_ssl_key: "{{ celery_ssl_dir }}/{{ celery_ssl_src_key | basename }}" +celery_cacert: "{{ celery_ssl_dir }}/{{ celery_src_cacert | basename }}" + +# Redis configuration for result backend (geerlingguy.redis role variables) +redis_bind_interface: 0.0.0.0 +redis_port: 6379 +# redis_requirepass: "" # Uncomment and set if you need password authentication +# redis_maxmemory: 512mb +# redis_maxmemory_policy: allkeys-lru + +# Celery result backend configuration +result_backend_name: redis +alts_redis_host: localhost +alts_redis_port: 6379 +alts_redis_results_db: 1 + +# Legacy local result backend (not used with Redis) +# result_backend_name: local +# celery_result_folder: /srv/celery_results + +celery_pid_file_dir: /var/run/celery +celery_pid_file: "{{ celery_pid_file_dir }}/worker.pid" +celery_concurrency: 10 +celery_loglevel: INFO +celery_queues: + - "docker-x86_64-0" + +scheduler_working_directory: /srv/alts/scheduler + +# Flower monitoring dashboard (deployed with the scheduler) +flower_port: 5555 +# flower_password: "" # Required, pass via --extra-vars or a vaulted vars file +jwt_secret: very-secret-on5 +broker_pool: 30 +worker_prefetch_multiplier: 1 +result_expires: 3600 diff --git a/inventories/alts/hosts.yml b/inventories/alts/hosts.yml new file mode 100644 index 0000000..255ac74 --- /dev/null +++ b/inventories/alts/hosts.yml @@ -0,0 +1,29 @@ +--- +all: + children: + rabbitmq: + hosts: + rabbitmq01: + scheduler: + hosts: + scheduler01: + celery: + hosts: + x86_64-node01: + celery_queues: + - "docker-x86_64-0" + aarch64-node01: + terraform_arch: arm + celery_queues: + - "docker-aarch64-0" + build_terraform: true + node_arch: aarch64 + terraform_build_ver: v1.11.4 + docker_build_ver: 3.6.1 + s390x-node01: + celery_queues: + - "docker-s390x-0" + build_terraform: true + node_arch: s390x + terraform_build_ver: v1.11.4 + docker_build_ver: 3.6.1 diff --git a/playbooks/alts_celery.yml b/playbooks/alts_celery.yml new file mode 100644 index 0000000..6332667 --- /dev/null +++ b/playbooks/alts_celery.yml @@ -0,0 +1,17 @@ +--- +- name: Install ALTS Celery worker + hosts: celery + vars: + docker_users: + - "{{ test_system_user }}" + roles: + - alts_base + # TODO: add role for building docker for s390x + - role: geerlingguy.docker + tags: + - install_docker + - alts_docker_customization + - role: alts_terraform + tags: + - terraform + - alts_celery diff --git a/playbooks/alts_rabbitmq.yml b/playbooks/alts_rabbitmq.yml new file mode 100644 index 0000000..40c628d --- /dev/null +++ b/playbooks/alts_rabbitmq.yml @@ -0,0 +1,6 @@ +--- +- name: Install RabbitMQ for ALTS and setup TLS + hosts: rabbitmq + roles: + - alts_base + - alts_rabbitmq_server diff --git a/playbooks/alts_scheduler.yml b/playbooks/alts_scheduler.yml new file mode 100644 index 0000000..79629b7 --- /dev/null +++ b/playbooks/alts_scheduler.yml @@ -0,0 +1,8 @@ +--- +- name: Configure ALTS scheduler + hosts: scheduler + roles: + - alts_base + - geerlingguy.redis + - alts_scheduler + - { role: alts_flower, tags: ["flower-setup"] } diff --git a/playbooks/templates/alts_service_config.yaml.j2 b/playbooks/templates/alts_service_config.yaml.j2 new file mode 100644 index 0000000..3033a61 --- /dev/null +++ b/playbooks/templates/alts_service_config.yaml.j2 @@ -0,0 +1,134 @@ +--- +{% if celery_ssl %} +use_ssl: true +ssl_config: + security_key: {{ celery_ssl_key }} + security_certificate: {{ celery_ssl_certificate }} + broker_ca_certificates: {{ celery_cacert }} +{% endif %} + +broker_config: +{% if broker_type == 'rabbitmq' %} + rabbitmq_host: {{ rabbitmq_host }} + rabbitmq_port: {{ rabbitmq_port }} +{% if celery_ssl %} + use_ssl: true + rabbitmq_ssl_port: {{ rabbitmq_ssl_port }} +{% endif %} + rabbitmq_user: {{ celery_rabbitmq_user | default(test_system_user, true) }} + rabbitmq_password: {{ test_system_password }} + rabbitmq_vhost: {{ test_system_vhost }} +{% elif broker_type == 'redis' and alts_redis_host and alts_redis_port %} + redis_host: "{{ alts_redis_host }}" + redis_port: {{ alts_redis_port }} + redis_db_number: {{ alts_redis_results_db | default(0) }} +{% if redis_requirepass %} + redis_password: "{{ redis_requirepass }}" +{% endif %} +{% endif %} +broker_pool: {{ broker_pool }} + +results_backend_config: +{% if result_backend_name == 'local' and celery_result_folder %} + path: file://{{ celery_result_folder }} +{% elif result_backend_name == 'azure' and azure_connection_str is defined and azureblockblob_container_name is defined %} + azureblockblob_container_name: {{ azureblockblob_container_name }} + azureblockblob_base_path: 'celery_results/' + azure_connection_string: {{ azure_connection_str }} +{% elif result_backend_name == 's3' %} + s3_access_key_id: {{ s3_key_id }} + s3_secret_access_key: {{ s3_access_key }} + s3_bucket: {{ s3_bucket }} + s3_base_path: 'celery_result_backend/' + s3_region: {{ s3_region }} + s3_endpoint_url: +{% elif result_backend_name == 'redis' and alts_redis_host and alts_redis_port %} + redis_host: "{{ alts_redis_host }}" + redis_port: {{ alts_redis_port }} + redis_db_number: {{ alts_redis_results_db | default(1) }} +{% if redis_requirepass %} + redis_password: "{{ redis_requirepass }}" +{% endif %} +{% else %} + result_backend: "{{ result_backend_name }}" +{% endif %} + +task_default_queue: 'default' +task_acks_late: true +task_track_started: true +artifacts_root_directory: 'test_system_artifacts' +worker_prefetch_multiplier: {{ worker_prefetch_multiplier }} +result_expires: {{ result_expires }} +{% if alts_service | default('') == 'scheduler' %} +jwt_secret: "{{ jwt_secret }}" +{% endif %} + +{% if buildsys_url | default('') %} +bs_host: "{{ buildsys_url }}" +{% endif %} +{% if buildsys_api_token | default('') %} +bs_token: "{{ buildsys_api_token }}" +{% endif %} +logs_uploader_config: + pulp_host: {{ pulp_host }} + pulp_user: {{ pulp_user }} + pulp_password: {{ pulp_password }} +{% if alts_rhel_flavors is defined %} +rhel_flavors: {{ alts_rhel_flavors }} +{% endif %} +{% if alts_debian_flavors is defined %} +debian_flavors: {{ alts_debian_flavors }} +{% endif %} +{% if alts_uninstall_excluded_pkgs is defined %} +uninstall_excluded_pkgs: {{ alts_uninstall_excluded_pkgs }} +{% endif %} +enable_integrity_tests: False +{% if deprecated_ansible_virtualenv_directory is defined %} +deprecated_ansible_venv: "{{ deprecated_ansible_virtualenv_directory }}" +{% endif %} +{% if package_proxy is defined %} +package_proxy: "{{ package_proxy }}" +{% endif %} +{% if cleanup_yum_conf_docs_settings is defined %} +cleanup_yum_conf_docs_settings: {{ cleanup_yum_conf_docs_settings | bool }} +{% endif %} +{% if ignore_ansible_install_errors is defined %} +ignore_ansible_install_errors: {{ ignore_ansible_install_errors | bool }} +{% endif %} +{% if docker_image_overrides is defined %} +docker_image_overrides: {{ docker_image_overrides | to_json }} +{% endif %} +{% if worker_type == 'opennebula' %} +tests_base_dir: "{{ opennebula_tests_base_dir }}" +{% if opennebula_rpc_endpoint and opennebula_username and opennebula_password and opennebula_vm_group and opennebula_network %} +opennebula_config: + rpc_endpoint: "{{ opennebula_rpc_endpoint }}" + username: "{{ opennebula_username }}" + password: "{{ opennebula_password }}" + vm_group: "{{ opennebula_vm_group }}" + network: "{{ opennebula_network }}" +{% endif %} +{% endif %} +{% if tests_exec_timeout is defined %} +tests_exec_timeout: {{ tests_exec_timeout }} +{% endif %} +{% if centos_baseurl is defined %} +centos_baseurl: "{{ centos_baseurl }}" +{% endif %} +{% if repositories_reference_directory is defined %} +git_reference_directory: "{{ repositories_reference_directory }}" +{% endif %} +authorize_build_repositories: True +sentry_dsn: "{{ alts_sentry_node_dsn }}" +sentry_environment: "{{ alts_sentry_env }}" +sentry_traces_sample_rate: {{ alts_sentry_traces_rate | float }} +sentry_profiles_sample_rate: {{ alts_sentry_profiles_rate | float }} +{% if epel_mirror_url is defined %} +epel_mirror_url: "{{ epel_mirror_url }}" +{% endif %} +{% if epel_release_urls is defined %} +epel_release_urls: +{% for version, url in epel_release_urls.items() %} + "{{ version }}": "{{ url }}" +{% endfor %} +{% endif %} diff --git a/requirements.yml b/requirements.yml index e13d5b4..0dad480 100644 --- a/requirements.yml +++ b/requirements.yml @@ -3,6 +3,7 @@ roles: - name: ezamriy.fail2ban version: v0.1.0 - name: geerlingguy.docker + - name: geerlingguy.redis collections: - name: community.docker diff --git a/roles/alts_base/tasks/main.yml b/roles/alts_base/tasks/main.yml new file mode 100644 index 0000000..b7beb0e --- /dev/null +++ b/roles/alts_base/tasks/main.yml @@ -0,0 +1,36 @@ +--- + +- name: Install yum-utils + ansible.builtin.dnf: + name: yum-utils + state: present + +- name: Update all packages + ansible.builtin.dnf: + name: "*" + state: latest + skip_broken: true + nobest: true + +- name: Install EPEL repository + ansible.builtin.dnf: + name: epel-release + state: present + +- name: Allow 'wheel' group to have passwordless sudo + ansible.builtin.lineinfile: + dest: /etc/sudoers + state: present + regexp: '^%wheel' + line: '%wheel ALL=(ALL) NOPASSWD: ALL' + validate: 'visudo -cf %s' + +- name: Add "{{ test_system_user }}" user + ansible.builtin.user: + name: "{{ test_system_user }}" + groups: wheel + append: yes + generate_ssh_key: yes + ssh_key_bits: 4096 + ssh_key_file: .ssh/id_rsa + state: present diff --git a/roles/alts_celery/defaults/main.yml b/roles/alts_celery/defaults/main.yml new file mode 100644 index 0000000..595bc58 --- /dev/null +++ b/roles/alts_celery/defaults/main.yml @@ -0,0 +1,8 @@ +--- + +celery_venv_dir: /home/{{ test_system_user }}/.venv-celery +plugin_cache_dir: "$HOME/.terraform.d/plugin-cache" +opennebula_endpoint: +opennebula_user: +opennebula_password: +opennebula_vm_group: \ No newline at end of file diff --git a/roles/alts_celery/handlers/main.yml b/roles/alts_celery/handlers/main.yml new file mode 100644 index 0000000..500f351 --- /dev/null +++ b/roles/alts_celery/handlers/main.yml @@ -0,0 +1,6 @@ +--- + +- name: Reload Celery service file + ansible.builtin.systemd: + service: alts-celery + state: reloaded diff --git a/roles/alts_celery/tasks/main.yml b/roles/alts_celery/tasks/main.yml new file mode 100644 index 0000000..2be159e --- /dev/null +++ b/roles/alts_celery/tasks/main.yml @@ -0,0 +1,119 @@ +--- + +- name: Detect PowerTools (CRB) repository name + set_fact: + powertools_repository_name: powertools + when: "ansible_facts.os_family == 'RedHat' and ansible_facts.distribution_major_version == '8'" + +- name: Detect PowerTools (CRB) repository name + set_fact: + powertools_repository_name: crb + when: "ansible_facts.os_family == 'RedHat' and ansible_facts.distribution_major_version == '9'" + + +- name: Install needed packages + ansible.builtin.dnf: + name: [ + "python3-pip", "python3-virtualenv", "librabbitmq", + "cmake", "libtool", "autoconf", "git", "ansible", "python3-devel", + "rust", "cargo", "openssl-devel" + ] + state: present + enablerepo: + - epel + - "{{ powertools_repository_name }}" + +- name: Configure Celery user + become: yes + become_user: "{{ test_system_user }}" + block: + - name: Clone ALTS repository + ansible.builtin.git: + repo: https://github.com/AlmaLinux/alts + dest: /home/{{ test_system_user }}/alts + force: true + tags: + - update + + - name: Install Celery dependencies + ansible.builtin.pip: + virtualenv: "{{ celery_venv_dir }}" + requirements: /home/{{ test_system_user }}/alts/requirements/celery.txt + tags: + - update + + - name: Create config and SSL folder + ansible.builtin.file: + path: "{{ item }}" + mode: 0755 + state: directory + with_items: + - "{{ test_system_config_dir }}" + - "{{ celery_ssl_dir }}" + + - name: Copy the ssl certificates + ansible.builtin.copy: + src: "{{ item.src }}" + dest: "{{ item.dest }}" + owner: "{{ test_system_user }}" + group: "{{ test_system_user }}" + mode: 0600 + backup: "yes" + with_items: + - { src: "{{ celery_src_cacert }}", dest: "{{ celery_cacert }}" } + - { src: "{{ celery_ssl_src_key }}", dest: "{{ celery_ssl_key }}" } + - { src: "{{ celery_ssl_src_certificate }}", dest: "{{ celery_ssl_certificate }}" } + when: celery_ssl + + - name: Create Celery config + ansible.builtin.template: + src: alts_service_config.yaml.j2 + dest: "{{ test_system_config_dir }}/celery.yaml" + tags: + - celery-config + - update + +- name: Create Celery Systemd service file + ansible.builtin.template: + src: alts-celery.service.j2 + dest: /etc/systemd/system/alts-celery.service + mode: 0644 + tags: + - update + +- name: Create log files directory for Celery service + ansible.builtin.file: + path: "{{ celery_log_file_dir }}" + mode: 0755 + owner: "{{ test_system_user }}" + group: "{{ test_system_user }}" + state: directory + tags: + - update + +- name: Create folder for Celery local results + ansible.builtin.file: + path: "{{ celery_result_folder }}" + mode: 0755 + owner: "{{ test_system_user }}" + group: "{{ test_system_user }}" + state: directory + when: result_backend_name is defined and result_backend_name == 'local' + +- name: Create logrotate config + ansible.builtin.template: + src: celery-logrotate.j2 + dest: /etc/logrotate.d/celery + owner: root + group: root + mode: 0644 + +- name: Enable and start Celery service + ansible.builtin.systemd: + name: alts-celery + masked: no + state: restarted + daemon_reload: yes + enabled: yes + tags: + - update diff --git a/roles/alts_celery/templates/alts-celery.service.j2 b/roles/alts_celery/templates/alts-celery.service.j2 new file mode 100644 index 0000000..eac3a3e --- /dev/null +++ b/roles/alts_celery/templates/alts-celery.service.j2 @@ -0,0 +1,22 @@ +[Unit] +Description=Celery worker for AL test system +After=network.target + +[Service] +User={{ test_system_user }} +Group={{ test_system_user }} +WorkingDirectory=/home/{{ test_system_user }}/alts +Environment=CELERY_CONFIG_PATH={{ test_system_config_dir }}/celery.yaml +ExecStartPre=-/usr/bin/find /tmp -maxdepth 1 -type d -name {{ worker_type }}_test_runner* -exec rm -rf {} + +# Start through /bin/sh like alts-scheduler: under SELinux, systemd may not +# execute binaries labelled as user home content directly +ExecStart=/bin/sh -c 'exec {{ celery_venv_dir }}/bin/celery -A alts.worker.app worker \ + --pool={{ celery_pool_type }} \ + --concurrency={{ celery_concurrency }} \ + -O fair \ + -Q {{ celery_queues|join(",") }} \ + --loglevel={{ celery_loglevel }} \ + --logfile {{ celery_log_file }}' + +[Install] +WantedBy=multi-user.target diff --git a/roles/alts_celery/templates/celery-logrotate.j2 b/roles/alts_celery/templates/celery-logrotate.j2 new file mode 100644 index 0000000..17aefa1 --- /dev/null +++ b/roles/alts_celery/templates/celery-logrotate.j2 @@ -0,0 +1,8 @@ +compress +missingok +notifempty +weekly +copytruncate +{{ celery_log_file }} { + rotate 4 +} diff --git a/roles/alts_docker_customization/defaults/main.yml b/roles/alts_docker_customization/defaults/main.yml new file mode 100644 index 0000000..6663212 --- /dev/null +++ b/roles/alts_docker_customization/defaults/main.yml @@ -0,0 +1,3 @@ +--- + +docker_open_files: 2048 diff --git a/roles/alts_docker_customization/files/docker-moby.conf b/roles/alts_docker_customization/files/docker-moby.conf new file mode 100644 index 0000000..d1f9ac7 --- /dev/null +++ b/roles/alts_docker_customization/files/docker-moby.conf @@ -0,0 +1,7 @@ +[Service] +EnvironmentFile=-/etc/sysconfig/docker +ExecStart= +ExecStart=/usr/bin/dockerd \ + --host=fd:// \ + --exec-opt native.cgroupdriver=systemd \ + $OPTIONS \ No newline at end of file diff --git a/roles/alts_docker_customization/tasks/main.yml b/roles/alts_docker_customization/tasks/main.yml new file mode 100644 index 0000000..414c43f --- /dev/null +++ b/roles/alts_docker_customization/tasks/main.yml @@ -0,0 +1,48 @@ +--- + +- set_fact: + docker_service_state: started + +- set_fact: + docker_proxy_path: "/usr/libexec/docker/docker-proxy" + when: "ansible_distribution == 'Fedora'" + +- set_fact: + docker_proxy_path: "/usr/bin/docker-proxy" + when: "ansible_facts.os_family == 'RedHat'" + +- name: Deploy docker options file + ansible.builtin.template: + src: docker-options.j2 + dest: /etc/sysconfig/docker + mode: 0644 + owner: root + group: root + +- name: Create docker service config directory + ansible.builtin.file: + path: /etc/systemd/system/docker.service.d + state: directory + mode: 0755 + owner: root + group: root + +- name: Deploy custom docker service configuration + ansible.builtin.copy: + src: docker-moby.conf + dest: /etc/systemd/system/docker.service.d/docker-moby.conf + mode: 0644 + owner: root + group: root + register: config_deploy + +- set_fact: + docker_service_state: restarted + when: "config_deploy.changed" + +- name: Restart docker service if needed + ansible.builtin.systemd: + name: docker + state: "{{ docker_service_state }}" + enabled: yes + daemon_reload: yes diff --git a/roles/alts_docker_customization/templates/docker-options.j2 b/roles/alts_docker_customization/templates/docker-options.j2 new file mode 100644 index 0000000..8336678 --- /dev/null +++ b/roles/alts_docker_customization/templates/docker-options.j2 @@ -0,0 +1,7 @@ +# Modify these options if you want to change the way the docker daemon runs +OPTIONS="--log-driver=journald \ + --live-restore \ + --default-ulimit nofile={{ docker_open_files }}:{{ docker_open_files }} \ + --init-path /usr/libexec/docker/docker-init \ + --userland-proxy-path {{ docker_proxy_path }} \ +" \ No newline at end of file diff --git a/roles/alts_flower/defaults/main.yml b/roles/alts_flower/defaults/main.yml new file mode 100644 index 0000000..9f424a1 --- /dev/null +++ b/roles/alts_flower/defaults/main.yml @@ -0,0 +1,13 @@ +--- + +flower_port: 5555 +flower_log_dir: /var/log/alts-flower +flower_venv_dir: /home/{{ test_system_user }}/.venv-flower +flower_version: 2.0.1 +flower_requirements_file: /home/{{ test_system_user }}/alts/requirements/base.txt +# Celery config Flower takes broker settings from (scheduler config by default) +flower_celery_config: "{{ test_system_config_dir }}/scheduler.yaml" +flower_env_file: /etc/sysconfig/alts-flower +flower_user: alts-mon +# Must be set, Flower UI allows revoking tasks and controlling workers +flower_password: "" diff --git a/roles/alts_flower/tasks/main.yml b/roles/alts_flower/tasks/main.yml new file mode 100644 index 0000000..1a3159b --- /dev/null +++ b/roles/alts_flower/tasks/main.yml @@ -0,0 +1,102 @@ +--- + +- name: Ensure Flower password is set + ansible.builtin.assert: + that: + - flower_password | length > 0 + fail_msg: flower_password must be set to enable Flower basic auth + quiet: true + no_log: true + tags: + - update + +- name: Create Flower service log directory + ansible.builtin.file: + path: "{{ flower_log_dir }}" + state: directory + owner: "{{ test_system_user }}" + group: "{{ test_system_user }}" + mode: "0755" + tags: + - update + +# Flower imports the ALTS Celery app, so it needs the ALTS dependencies. +# Flower itself is pinned here rather than in the checkout's requirements, +# so the role works with whatever ALTS revision is deployed +- name: Install ALTS requirements for Flower + become: true + become_user: "{{ test_system_user }}" + ansible.builtin.pip: + virtualenv: "{{ flower_venv_dir }}" + requirements: "{{ flower_requirements_file }}" + register: flower_requirements + tags: + - update + +- name: Install Flower + become: true + become_user: "{{ test_system_user }}" + ansible.builtin.pip: + virtualenv: "{{ flower_venv_dir }}" + name: "flower=={{ flower_version }}" + register: flower_package + tags: + - update + +- name: Create Flower environment file + ansible.builtin.template: + src: alts-flower.env.j2 + dest: "{{ flower_env_file }}" + owner: root + group: root + mode: "0600" + no_log: true + register: flower_env + tags: + - update + +- name: Create Flower Systemd service file + ansible.builtin.template: + src: alts-flower.service.j2 + dest: /etc/systemd/system/alts-flower.service + owner: root + group: root + mode: "0644" + register: flower_unit_file + tags: + - update + +- name: Create logrotate config for Flower + ansible.builtin.template: + src: logrotate-flower.j2 + dest: /etc/logrotate.d/alts-flower + owner: root + group: root + mode: "0644" + tags: + - update + +- name: Add Flower port to firewall + ansible.posix.firewalld: + zone: public + port: "{{ flower_port }}/tcp" + state: enabled + permanent: true + immediate: true + when: manage_firewall | default(true) | bool + +# Flower imports the ALTS Celery app from the checkout made by the +# scheduler role, so it also needs a restart when that code changes +- name: Enable and start Flower service + ansible.builtin.systemd: + name: alts-flower + enabled: true + daemon_reload: true + state: >- + {{ 'restarted' + if flower_requirements.changed or flower_package.changed + or flower_env.changed or flower_unit_file.changed + or (scheduler_code.changed | default(false)) + else 'started' }} + tags: + - update diff --git a/roles/alts_flower/templates/alts-flower.env.j2 b/roles/alts_flower/templates/alts-flower.env.j2 new file mode 100644 index 0000000..3a90f67 --- /dev/null +++ b/roles/alts_flower/templates/alts-flower.env.j2 @@ -0,0 +1,2 @@ +CELERY_CONFIG_PATH={{ flower_celery_config }} +FLOWER_BASIC_AUTH={{ flower_user }}:{{ flower_password }} diff --git a/roles/alts_flower/templates/alts-flower.service.j2 b/roles/alts_flower/templates/alts-flower.service.j2 new file mode 100644 index 0000000..2ca51d1 --- /dev/null +++ b/roles/alts_flower/templates/alts-flower.service.j2 @@ -0,0 +1,20 @@ +[Unit] +Description=Flower monitoring dashboard for AL test system Celery +After=network.target + +[Service] +User={{ test_system_user }} +Group={{ test_system_user }} +WorkingDirectory=/home/{{ test_system_user }}/alts +EnvironmentFile={{ flower_env_file }} +# Start through /bin/sh like alts-scheduler: under SELinux, systemd may not +# execute binaries labelled as user home content directly +ExecStart=/bin/sh -c 'exec {{ flower_venv_dir }}/bin/celery -A alts.worker.app flower \ + --port={{ flower_port }}' +StandardOutput=append:{{ flower_log_dir }}/output.log +StandardError=append:{{ flower_log_dir }}/error.log +Restart=on-failure +RestartSec=5s + +[Install] +WantedBy=multi-user.target diff --git a/roles/alts_flower/templates/logrotate-flower.j2 b/roles/alts_flower/templates/logrotate-flower.j2 new file mode 100644 index 0000000..489fc1a --- /dev/null +++ b/roles/alts_flower/templates/logrotate-flower.j2 @@ -0,0 +1,11 @@ +compress +missingok +notifempty +weekly +copytruncate +{{ flower_log_dir }}/output.log { + rotate 2 +} +{{ flower_log_dir }}/error.log { + rotate 4 +} diff --git a/roles/alts_rabbitmq_server/defaults/main.yml b/roles/alts_rabbitmq_server/defaults/main.yml new file mode 100644 index 0000000..0ee676a --- /dev/null +++ b/roles/alts_rabbitmq_server/defaults/main.yml @@ -0,0 +1,4 @@ +--- + +rabbitmq_port: 5672 +rabbitmq_ssl_port: 5671 diff --git a/roles/alts_rabbitmq_server/handlers/main.yml b/roles/alts_rabbitmq_server/handlers/main.yml new file mode 100644 index 0000000..5b760ef --- /dev/null +++ b/roles/alts_rabbitmq_server/handlers/main.yml @@ -0,0 +1,6 @@ +--- + +- name: restart rabbitmq + service: + name: rabbitmq-server + state: restarted diff --git a/roles/alts_rabbitmq_server/tasks/main.yml b/roles/alts_rabbitmq_server/tasks/main.yml new file mode 100644 index 0000000..b74f0f2 --- /dev/null +++ b/roles/alts_rabbitmq_server/tasks/main.yml @@ -0,0 +1,162 @@ +--- + +- name: Install RabbitMQ repository + block: + - name: Download repository setup script + get_url: + url: https://packagecloud.io/install/repositories/rabbitmq/rabbitmq-server/script.rpm.sh + dest: /tmp/rabbitm-repo-setup.sh + mode: 0755 + + - name: Execute repository setup script + command: /tmp/rabbitm-repo-setup.sh + environment: + os: el + dist: 8 + + - name: Delete setup script + file: + path: /tmp/rabbitm-repo-setup.sh + state: absent + +- name: Add Erlang repository + yum_repository: + name: erlang-latest + file: erlang + description: Erlang repository + baseurl: https://packagecloud.io/rabbitmq/erlang/el/$releasever/$basearch + gpgcheck: yes + state: present + +- name: Add Erlang repository GPG key + rpm_key: + key: https://packagecloud.io/rabbitmq/erlang/gpgkey + state: present + +- name: Install RabbitMQ server + yum: + name: rabbitmq-server + state: present + enablerepo: epel,powertools + +- name: Enable management plugin + rabbitmq_plugin: + names: rabbitmq_management + state: enabled + notify: + - restart rabbitmq + +- name: Flush handlers + meta: flush_handlers + +- name: Add RabbitMQ user + rabbitmq_user: + user: "{{ rabbitmq_admin_user }}" + password: "{{ rabbitmq_admin_password }}" + vhost: / + tags: administrator + configure_priv: .* + read_priv: .* + write_priv: .* + state: present + +- name: Add test system vhost + rabbitmq_vhost: + name: "{{ rabbitmq_test_system_vhost }}" + state: present + +- name: Add RabbitMQ test system user + rabbitmq_user: + user: "{{ test_system_user }}" + password: "{{ rabbitmq_test_system_password }}" + vhost: "{{ rabbitmq_test_system_vhost }}" + tags: test-system + configure_priv: .* + read_priv: .* + write_priv: .* + state: present + +- name: Add AMQP port to firewall + firewalld: + zone: public + port: "{{ item }}" + state: enabled + permanent: yes + immediate: yes + with_items: + - "{{ rabbitmq_port }}/tcp" + - "{{ rabbitmq_port }}/udp" + +- name: Configure SSL + block: + - name: Create SSL folder for rabbitmq + file: + path: "/etc/rabbitmq/ssl/" + owner: "rabbitmq" + group: "rabbitmq" + mode: 0750 + state: "directory" + when: rabbitmq_ssl and rabbitmq_copy_ssl_files + + - name: Copy the ssl certificates + copy: + src: "{{ item.src }}" + dest: "{{ item.dest }}" + owner: "rabbitmq" + group: "rabbitmq" + mode: 0640 + backup: "yes" + with_items: + - { src: "{{ rabbitmq_cacert }}", dest: "{{ rabbitmq_conf_ssl_options_cacertfile }}" } + - { src: "{{ rabbitmq_server_key }}", dest: "{{ rabbitmq_conf_ssl_options_keyfile }}" } + - { src: "{{ rabbitmq_server_cert }}", dest: "{{ rabbitmq_conf_ssl_options_certfile }}" } + + - name: Update configuration file as per parameters + ini_file: + path: /etc/rabbitmq/rabbitmq.conf + section: + option: "{{ item.name }}" + value: "{{ item.value }}" + state: present + with_items: + - { name: listeners.ssl.default, value: "{{ rabbitmq_ssl_port }}" } + - { name: ssl_options.verify, value: "{{ rabbitmq_ssl_verify }}" } + - { name: ssl_options.fail_if_no_peer_cert, value: "{{ rabbitmq_ssl_fail_if_no_peer_cert | to_json }}" } + - { name: ssl_options.cacertfile, value: "{{ rabbitmq_conf_ssl_options_cacertfile }}" } + - { name: ssl_options.certfile, value: "{{ rabbitmq_conf_ssl_options_certfile }}" } + - { name: ssl_options.keyfile, value: "{{ rabbitmq_conf_ssl_options_keyfile }}" } + + notify: + - restart rabbitmq + + - name: Add AMQPS port to firewall + firewalld: + zone: public + port: "{{ item }}" + state: enabled + permanent: yes + immediate: yes + with_items: + - "{{ rabbitmq_ssl_port }}/tcp" + - "{{ rabbitmq_ssl_port }}/udp" + + - name: Flush handlers + meta: flush_handlers + + when: rabbitmq_ssl and rabbitmq_copy_ssl_files + +- name: Enable AMQP/AMQPS services on firewall + firewalld: + zone: public + service: "{{ item }}" + state: enabled + permanent: yes + with_items: + - amqp + - amqps + +- name: Enable and start RabbitMQ service + service: + name: rabbitmq-server + enabled: yes + state: started diff --git a/roles/alts_scheduler/defaults/main.yml b/roles/alts_scheduler/defaults/main.yml new file mode 100644 index 0000000..e57a52c --- /dev/null +++ b/roles/alts_scheduler/defaults/main.yml @@ -0,0 +1,9 @@ +--- + +scheduler_venv_dir: /home/{{ test_system_user }}/.venv-scheduler + +opennebula_endpoint: +opennebula_user: +opennebula_password: +opennebula_vm_group: +scheduler_http_port: 8000 diff --git a/roles/alts_scheduler/tasks/main.yml b/roles/alts_scheduler/tasks/main.yml new file mode 100644 index 0000000..5aeeffc --- /dev/null +++ b/roles/alts_scheduler/tasks/main.yml @@ -0,0 +1,136 @@ +--- + +- name: Install python-pip and python-venv + yum: + name: ["python3-pip", "python3-virtualenv"] + state: present + +- name: Install git + yum: + name: git + state: present + +- name: Add scheduler user + user: + name: "{{ test_system_user }}" + generate_ssh_key: yes + ssh_key_bits: 4096 + ssh_key_file: .ssh/id_rsa + state: present + +- name: Configure scheduler user + become: yes + become_user: "{{ test_system_user }}" + block: + - name: Clone ALTS repository + git: + repo: https://github.com/AlmaLinux/alts + dest: ~/alts + register: scheduler_code + tags: + - update + + - name: Install scheduler dependencies + pip: + virtualenv: "{{ scheduler_venv_dir }}" + requirements: ~/alts/requirements/scheduler.txt + register: scheduler_requirements + tags: + - update + + - name: Create config and SSL folder + file: + path: "{{ item }}" + mode: 0755 + state: directory + with_items: + - "{{ test_system_config_dir }}" + - "{{ celery_ssl_dir }}" + + - name: Copy the ssl certificates + copy: + src: "{{ item.src }}" + dest: "{{ item.dest }}" + owner: "{{ test_system_user }}" + group: "{{ test_system_user }}" + mode: 0600 + backup: "yes" + with_items: + - {src: "{{ celery_src_cacert }}", dest: "{{ celery_cacert }}"} + - {src: "{{ celery_ssl_src_key }}", dest: "{{ celery_ssl_key }}"} + - {src: "{{ celery_ssl_src_certificate }}", dest: "{{ celery_ssl_certificate }}"} + when: celery_ssl + + - name: Create scheduler config + template: + src: alts_service_config.yaml.j2 + dest: "{{ test_system_config_dir }}/scheduler.yaml" + vars: + alts_service: scheduler + register: scheduler_config + tags: + - update + +- name: Create scheduler working directory + file: + path: "{{ scheduler_working_directory }}" + mode: 0755 + owner: "{{ test_system_user }}" + group: "{{ test_system_user }}" + state: directory + when: scheduler_working_directory is defined and scheduler_working_directory + +- name: Install firewalld + yum: + name: ["firewalld", "python3-firewall"] + state: present + when: manage_firewall | default(true) | bool + +- name: Ensure firewalld is running + service: + name: firewalld + state: started + enabled: yes + when: manage_firewall | default(true) | bool + +- name: Enable HTTP/HTTPS services on firewall + firewalld: + zone: public + service: "{{ item }}" + state: enabled + permanent: yes + with_items: + - http + - https + when: manage_firewall | default(true) | bool + +- name: Add scheduler port to firewall + firewalld: + zone: public + port: "{{ scheduler_http_port }}/tcp" + state: enabled + permanent: yes + immediate: yes + when: manage_firewall | default(true) | bool + +- name: Create scheduler Systemd service file + template: + src: alts-scheduler.service.j2 + dest: /etc/systemd/system/alts-scheduler.service + mode: 0644 + register: scheduler_unit_file + tags: + - update + +- name: Enable and start scheduler service + systemd: + name: alts-scheduler + enabled: yes + daemon_reload: yes + state: >- + {{ 'restarted' + if scheduler_code.changed or scheduler_requirements.changed + or scheduler_config.changed or scheduler_unit_file.changed + else 'started' }} + tags: + - update diff --git a/roles/alts_scheduler/templates/alts-scheduler.service.j2 b/roles/alts_scheduler/templates/alts-scheduler.service.j2 new file mode 100644 index 0000000..a885718 --- /dev/null +++ b/roles/alts_scheduler/templates/alts-scheduler.service.j2 @@ -0,0 +1,14 @@ +[Unit] +Description=Scheduler service for AL test system +After=network.target + +[Service] +User={{ test_system_user }} +Group={{ test_system_user }} +Environment=CELERY_CONFIG_PATH={{ test_system_config_dir }}/scheduler.yaml +Environment=SCHEDULER_FILE_PATH={{ test_system_config_dir }}/scheduler.yaml +ExecStart=/bin/sh -c 'source {{ scheduler_venv_dir }}/bin/activate && cd ~/alts && uvicorn --host 0.0.0.0 \ + --port {{ scheduler_http_port }} alts.scheduler.app:app' + +[Install] +WantedBy=multi-user.target diff --git a/roles/alts_terraform/defaults/main.yml b/roles/alts_terraform/defaults/main.yml new file mode 100644 index 0000000..291a8b0 --- /dev/null +++ b/roles/alts_terraform/defaults/main.yml @@ -0,0 +1,5 @@ +--- + +terraform_plugin_cache_dir: /home/{{ test_system_user }}/.terraform.d/plugins-cache +terraform_version: 1.12.1 +terraform_arch: amd64 diff --git a/roles/alts_terraform/tasks/main.yml b/roles/alts_terraform/tasks/main.yml new file mode 100644 index 0000000..49610ea --- /dev/null +++ b/roles/alts_terraform/tasks/main.yml @@ -0,0 +1,124 @@ +--- + +- name: Install unzip package + ansible.builtin.yum: + name: unzip + state: present + when: build_terraform is not defined + +- name: Download Terraform + ansible.builtin.get_url: + url: "https://releases.hashicorp.com/terraform/{{ terraform_version }}/terraform_{{ terraform_version }}_linux_{{ terraform_arch }}.zip" + dest: /tmp/terraform.zip + when: build_terraform is not defined + +- name: Unpack Terraform + ansible.builtin.unarchive: + src: /tmp/terraform.zip + dest: /usr/local/bin + remote_src: yes + when: build_terraform is not defined + +- name: Delete archive + ansible.builtin.file: + path: /tmp/terraform.zip + state: absent + when: build_terraform is not defined + +- name: Install golang + ansible.builtin.yum: + name: golang + state: present + when: build_terraform is defined + tags: + - build-terraform + +- name: Clone terraform repository + ansible.builtin.git: + repo: https://github.com/hashicorp/terraform.git + dest: /tmp/terraform + version: "{{ terraform_build_ver }}" + when: build_terraform is defined + tags: + - build-terraform + +- name: Build terraform + ansible.builtin.shell: | + cd /tmp/terraform + GOBIN="/usr/local/bin/" go install . + when: build_terraform is defined + tags: + - build-terraform + +- name: Verify terraform installation + ansible.builtin.command: terraform version + +- name: Remove terraform git directory + ansible.builtin.file: + path: /tmp/terraform + state: absent + when: build_terraform is defined + tags: + - build-terraform + +- name: Clone docker provider + ansible.builtin.git: + repo: https://github.com/kreuzwerker/terraform-provider-docker.git + dest: /tmp/docker-provider + version: v"{{ docker_build_ver }}" + when: build_terraform is defined + tags: + - build-terraform + +- name: Prepare dir for docker provider + ansible.builtin.file: + path: /home/{{ test_system_user }}/.terraform.d/plugins-cache/registry.terraform.io/kreuzwerker/docker/{{ docker_build_ver }}/linux_{{ node_arch }}/ + state: directory + mode: 0755 + owner: "{{ test_system_user }}" + group: "{{ test_system_user }}" + when: build_terraform is defined + tags: + - build-terraform + +- name: Build docker provider + ansible.builtin.shell: | + cd /tmp/docker-provider + go build -o /home/{{ test_system_user }}/.terraform.d/plugins-cache/registry.terraform.io/kreuzwerker/docker/{{ docker_build_ver }}/linux_{{ node_arch }}/terraform-provider-docker_{{ docker_build_ver }} + when: build_terraform is defined + tags: + - build-terraform + +- name: Change provider ownership and permissions + ansible.builtin.file: + path: /home/{{ test_system_user }}/.terraform.d/plugins-cache/registry.terraform.io/kreuzwerker/docker/{{ docker_build_ver }}/linux_{{ node_arch }}/terraform-provider-docker_{{ docker_build_ver }} + mode: 0755 + owner: "{{ test_system_user }}" + group: "{{ test_system_user }}" + when: build_terraform is defined + tags: + - build-terraform + +- name: Remove docker provider git directory + ansible.builtin.file: + path: /tmp/docker-provider + state: absent + when: build_terraform is defined + tags: + - build-terraform + +- name: Add Terraform plugin cache directory + ansible.builtin.file: + path: "{{ terraform_plugin_cache_dir }}" + owner: "{{ test_system_user }}" + group: "{{ test_system_user }}" + mode: 0755 + state: directory + +- name: Create Terraform configuration file + ansible.builtin.template: + src: terraformrc.j2 + dest: /home/{{ test_system_user }}/.terraformrc + owner: "{{ test_system_user }}" + group: "{{ test_system_user }}" + mode: 0644 diff --git a/roles/alts_terraform/templates/terraformrc.j2 b/roles/alts_terraform/templates/terraformrc.j2 new file mode 100644 index 0000000..35cee18 --- /dev/null +++ b/roles/alts_terraform/templates/terraformrc.j2 @@ -0,0 +1,2 @@ +plugin_cache_dir = "{{ terraform_plugin_cache_dir }}" +plugin_cache_may_break_dependency_lock_file = true \ No newline at end of file From 8cac5e253db86af7cd778acd2fc31355e983e0ee Mon Sep 17 00:00:00 2001 From: Daniil Anfimov Date: Sun, 25 Oct 2026 23:45:27 +0200 Subject: [PATCH 2/2] Add vault-encrypted ALTS TLS certificates Copy the Ansible Vault encrypted RabbitMQ and Celery certificates and keys from the alts repository unchanged, so ALTS can be deployed from this repository with the vault password. --- .gitignore | 2 - README.md | 17 ++-- .../files/alts/celery/ca_certificate.pem | 66 ++++++++++++++ .../files/alts/celery/client_certificate.pem | 65 ++++++++++++++ playbooks/files/alts/celery/client_key.pem | 90 +++++++++++++++++++ .../files/alts/rabbitmq/ca_certificate.pem | 66 ++++++++++++++ .../alts/rabbitmq/server_certificate.pem | 70 +++++++++++++++ playbooks/files/alts/rabbitmq/server_key.pem | 90 +++++++++++++++++++ 8 files changed, 453 insertions(+), 13 deletions(-) create mode 100644 playbooks/files/alts/celery/ca_certificate.pem create mode 100644 playbooks/files/alts/celery/client_certificate.pem create mode 100644 playbooks/files/alts/celery/client_key.pem create mode 100644 playbooks/files/alts/rabbitmq/ca_certificate.pem create mode 100644 playbooks/files/alts/rabbitmq/server_certificate.pem create mode 100644 playbooks/files/alts/rabbitmq/server_key.pem diff --git a/.gitignore b/.gitignore index 626cc88..3fe20bd 100644 --- a/.gitignore +++ b/.gitignore @@ -6,6 +6,4 @@ vars.yml roles/ezamriy.fail2ban roles/geerlingguy.docker roles/geerlingguy.redis -# ALTS TLS certificates and keys, provided by the deployer -playbooks/files/alts/ .vscode/* \ No newline at end of file diff --git a/README.md b/README.md index a3ba9e8..11782f4 100644 --- a/README.md +++ b/README.md @@ -165,19 +165,14 @@ workers) are deployed by separate playbooks using the `inventories/alts` inventory. Copy it, put your hosts into `hosts.yml` and adjust `group_vars/*.yml` (passwords, JWT secret, Pulp credentials, etc.). -TLS certificates and keys are not stored in the repository. Put them into -`playbooks/files/alts/` (gitignored): -``` -playbooks/files/alts/celery/{ca_certificate,client_certificate,client_key}.pem -playbooks/files/alts/rabbitmq/{ca_certificate,server_certificate,server_key}.pem -``` - -Then run the playbooks in order: +TLS certificates and keys for RabbitMQ and Celery are stored encrypted +with Ansible Vault in `playbooks/files/alts/{celery,rabbitmq}/`, so the +playbooks need the vault password: ```bash ansible-galaxy install -r requirements.yml -ansible-playbook -i inventories/alts playbooks/alts_rabbitmq.yml -ansible-playbook -i inventories/alts playbooks/alts_scheduler.yml -e flower_password= -ansible-playbook -i inventories/alts playbooks/alts_celery.yml +ansible-playbook -i inventories/alts --ask-vault-pass playbooks/alts_rabbitmq.yml +ansible-playbook -i inventories/alts --ask-vault-pass playbooks/alts_scheduler.yml -e flower_password= +ansible-playbook -i inventories/alts --ask-vault-pass playbooks/alts_celery.yml ``` ## Contributing to albs-deploy diff --git a/playbooks/files/alts/celery/ca_certificate.pem b/playbooks/files/alts/celery/ca_certificate.pem new file mode 100644 index 0000000..48efdd0 --- /dev/null +++ b/playbooks/files/alts/celery/ca_certificate.pem @@ -0,0 +1,66 @@ +$ANSIBLE_VAULT;1.1;AES256 +30613663326363633063656562663732383763633563356364666436306261653935626163363365 +3238366436326361396337373463343435636264626366370a306165376661386161333961663739 +62363262373262316262393531646364303438636330336461653131326165373034393131363564 +6661656137636661650a343233373037653139373635356630626561663136653835323261643533 +32633937336232623239663537613737626237373963656433306461363362396164376234616431 +66313265653631313836353337336232316661323761666465663733366239373333623931316436 +32323339323264346633613137366136333832636638653464363134663439333738333464333532 +35353438376432363132613230643130353465363236613531666538653135373562303733313463 +35346564306363383862613361656432336632653234626364623133346439333635376166333434 +36373931336633616631393363656235353539393831373761666262666462636139366632616236 +32346562623037376138313737613232303261633066376265353664323062616263326263316161 +65306531313236383661316337353333313239626535396332326165303965663933326339656431 +61623533393365643436363162353136333732323763643331303161313735336337636365643431 +34626436343665326563303666613265353935323262363232316233346664663265653437653966 +65366566386436383237363033663339386636373938343232336166356565396564613832663133 +65636336383535663334373831356162316134393439366563373232333663336239623366363038 +64386132616164323662386436336264666363363463626530646630336137333763383763303238 +62623837396561366139343763636437343762323034326139623438336263313636353465326265 +61363130373366356231323738353333636137616137303339363832353332383932343364356664 +66346366366362393439303564653730393964663330313762613337616361616431366435303138 +63313437303837653034653234393864653731396631643961346666616536373533633231616533 +63656663373037323330616266343131613133376432343535613136623634313737353032636163 +35373663346536613362643838386262643934353638303762303862363436633530373238626264 +38616334363766373065613834303161623338613334353766353836616230613235613065656435 +61383330613836326665393934323039323764656237373464333838326161383863623064626637 +37366230303731306636313936343165623664613331343133663263663938643964396663356665 +36666631616161393639326463316166316136376231383332353861636539633965303364346666 +34373238356664306332303235316134333262333931663335356466663431373337393239656164 +38333062313036336334636563346633323234316230336464366538373638663834363065356133 +62303564613438663265623135336266323666633265653035653634313733646235346362376432 +32643335316461313762323734363737303936373735633437366162366532656435393633323934 +61373736316563326163303330323733336532306366613835653236643533353463386362323531 +30643339636566363564386466303336363132376534376662333437396232613864353262633966 +33613463353036356664306439316565316131336334306533613661373265363332653034626366 +30656232666432386639313338643834653262653663663532353836376633303935626239633364 +35376436623838353733336630653130393161366639626331653061306264613762656366656233 +61323361313565333530616662656632353430393062646361386564393664633461356438316336 +38333565646161663637323461313336386139333561333838666161336566323034633365343033 +33363439633331383035373034353966636662626661636432613030376435333239666666356263 +37353961656365353030323330376564633433613664346132353965663932333039363436626635 +32393461646562333633323664663937363630306139303638333866393464613162303639666565 +65366463656463323632373065626138323831613564343034363534626266343337383261666638 +35343532373136366566306532366531633562356565366235306635646535313662393765623936 +66346663353032316466333061623535393163663134396564663835316133356636613330386235 +32613562333134653233623938636138616332663264363165626433343633333365313235363662 +64393663383630353038386336316130333265663066383063313636613663653136313264373164 +34653766666536613266613666366136373137356338313135323964333631376632363336343363 +65373235333232663031613639366235343962376137326332376361333264333839653733333631 +36373138343735373239643437313430326665633966346566623930646334326238306136623461 +33303161353037343835666662396634323337316362393139363636303435366465626430613165 +31333739633330346136633965623065396137633733316330393566643363313061663037636234 +33306134316462343062373564303039343463653639323436306331343866646262613361353537 +31386463393561303864316231626234376465313663346566656361303862663439383536346339 +30386462613066666438373163393731303039663233313363646530363064613965356434646637 +33356236323634303735636136383130363566666363633864383437393436633633316364663161 +38613932333363633162383133626639316133386638666563656166653430353539353961363666 +63643462616330633435636236393132636238636662326639366630613439336437623232663964 +39663131343032373430326234303361373965393637346137356632616434346339623962373036 +64623834323765343966656636623635366430323938363334343933643835373264393038366564 +37326563303534663531303038366165633034333765366234663163636365333832643938633961 +66313764383065626231643164633232616564373564346536306661393136313462353535626263 +63633338316534346564613330666461366434343330353632383936616166373932336365643430 +36316361383663663131636537346633393066616638396232613963663634343361643465653136 +32333930313762653363366230333136643538356362653336376263646636326631363139333239 +3731 diff --git a/playbooks/files/alts/celery/client_certificate.pem b/playbooks/files/alts/celery/client_certificate.pem new file mode 100644 index 0000000..dac2382 --- /dev/null +++ b/playbooks/files/alts/celery/client_certificate.pem @@ -0,0 +1,65 @@ +$ANSIBLE_VAULT;1.1;AES256 +65613762663337663661643562316666656564336438663061303234636363326532303334333835 +3536393861383930636231636262343639646663366161370a383366396335393165346265386432 +65316233313638396466373261323334303439313865636263373461333234613632613461383135 +3238643636643731640a386535663136323761646566666432656434346435646132626635323239 +63366234636435386338333335306633373034363337326564363435643464636131663362643862 +66383466323138353634326538306536303635653230623936363835616464303338353537366161 +64613833356334633935326262623938633433383234393465653362616665323561643337303735 +65333961316233373739383364306133376432396439393935623363346233396361316563633231 +62343635393465343536636334653636656134636362653536353339613162333131636438346465 +39376663313832306138383934623838333062356264643764653638653437626262336531363962 +64656539393539643532616262383230383839353938663833366364646162633133313861633539 +30663137353565323231623630363639376561636366633363623731373933333462393963333232 +32666466323163643063373633313134386336383032353434613163316531626531666665323861 +62323734623139326130343936636234663463613931363439646332323732623437313761313933 +64316266323264383365616438393766313038343963643363306532663535616462313763623361 +38393138363962646331356333383165343739323064646235646535306235663538363938663663 +31363338376135316137343738323339313638313831303832393639636661623833393331386136 +61316532303361643263616132646565366438636639326339353031383037323333643066343833 +39306364306133663465313230626164333831636335363630633437636535623336623334653534 +66363337393839373934393866316366633762303637613263396465323737633964383538313765 +39633132303638626336653939333261366534656332373662306532333736613438313662396163 +65633431626136623838616165313936633264376639336366396362393035376335626330376162 +39343732343839303361653939373463303839663465386366363062636264393235333762353738 +39653439633533393138616437613034666463636433326337343661616536643664373837646636 +30306134326336373661306562376437613433656437626563666134663339353133626430623337 +30633364326134343462333063653965313136303765656338313964333863663166326361363430 +30333838656431356464316663303236393462303066306436313732326366643031343064323466 +34373563303737303863646465373436383239643564323935663235633635383333633662323035 +61333033323237653538643664373162663033646538373930353163336465333761613830626534 +36373732663264663531313337383931313833646163393931323731653362386264366661663835 +66343634333039303365383338643763323735353634663362633631343239373866373336366366 +36326364663763356338343465393665326265306162646638353536663864383934623632626439 +30653634663661386632303632646163373036323462393339666663336633383136616165663739 +39623164313733396337626266663462366337636537343134356134663461313265643033313963 +32326464383136356130623739656237353666633935363930316563383566396237383630393366 +66333935643761333337353132353537663063333836613136643635646261343932643134363638 +34643266333837613930366535633433363931363137656630393862653763303331373764653039 +36373537663536333230393031623261356134313665373732303661623664613661656631663530 +63623139366135343563623732636635636561616535313934646662633062626531646364303164 +65393161396264353132613436636265373330376463646562656539326431663833396265386137 +62336166636165303566613837653166383834343235373466656136623134646665333230353537 +37666663366235653665666338313236353562323161613231303364343931336139393737393836 +31313735653339356339646236336234613762396365613939373930326532623263363234316535 +38393264353233663066326535663235336133396433373931303963643131643063343064363765 +65633164303062343765343966333433393661656264363732623938626464663837336165643662 +33636132653266656665363333366637363961616232643466663330393632643063643065303830 +61333731626636383362376261636664303534393834326263373330303636396338333262306636 +38653132623566323132306163666666383765383831343132373135646131633633353736396539 +64366161326462366136316165616138353561363764306466613431666439613964393936386538 +31633965643465646137313365396438616433373135613339386330393138626165333736646235 +35663563353733646339653635323730353439366138666438353265316230633264393233373661 +38643766323731643336363663316439383032373662353236646137613739306264343565643135 +62366132303335613231653034663062316133326632356439303265386461633061656463363233 +36303436306436653763396562633265666465646364323764323565396638396562623066366133 +36623263326530663638393530633633373835626531346365343939303936326363383563313138 +62356435626537353839633563623633666433383061626433303932633536346563376164646638 +35313235363436303339336362396361373330353031396333636130376435623130663333353637 +30373938316539326133373733313363663338393735323839663738393039353135303237383165 +62366633646163373032373364613362323239616535393464373937306662333534373536303330 +32343763393066383462653036636533663131356464666130336333643032666465323862306438 +36343030373533326466393339316433306466366161663633303262393431353430636665663362 +32656430373032623837393732326331366464376634333138643766363233633162336339643535 +31303935613463373530383965633137633434643237646335643465373132633862303864356263 +35353435663061316133 diff --git a/playbooks/files/alts/celery/client_key.pem b/playbooks/files/alts/celery/client_key.pem new file mode 100644 index 0000000..accadca --- /dev/null +++ b/playbooks/files/alts/celery/client_key.pem @@ -0,0 +1,90 @@ +$ANSIBLE_VAULT;1.1;AES256 +62303366646235303233383931633537666364623763636235643935393733356363653165616139 +3734326662653333333338363135636538646262396438360a333262343864663933343332343561 +36623335666130623339316262343865383562646537376265633733326265613130376463316236 +6530373766306232310a356361616131396332656237373332383234363163343663616635356663 +64656632656138376161386235386337316535353731373136646464656262663538663164393133 +66376632343138613231343835353066663333623736353733323239363665313461633831343565 +31663237326539393735303833643433623339313439323236323738386565623962356665303839 +61366133313862383763333433633937393966326466666361393361386666653930313562333737 +61373331303431336634303466346363343337663764656362626462656335643131613233386233 +64646432373438653538663031636531326464613461373638363332346139346565303737343131 +62383463336663633236313731663664383936316136306139303335383264373161393364323363 +39316435613531366333323633356631653266393330316233653035393336633830623965653863 +38353861626462633965316437353763653233623663333231323031343964663830343936666564 +32633235393164323930646231353066393362326433643139336561643361326430663738646562 +34306332336636303663633766396566343466323263613430356164626163656234323030326536 +34633232643464613634343932623239653331623834326138323636336464303339613037623835 +35343365623635666334373737393330326339303232643033313235646561656430663331386533 +37633563393661366562316666343835636434306162633134633763383338346236313534353865 +31616530353434336666346238386138333438383866353938393033346162633733616565646438 +39656239373166376565313363653836323437346437626131326137656162383462323138306534 +31326430623966396530666639386535656362663562373662643961363438353534613130623034 +61313633663333383438646162333537336132353739653332306137633939376438643461613464 +37653033373936376635623161366331316432346261383731343235383630666436363436306565 +31626563613766343031643039383035636661323738313665613332383764323032303966333639 +37323035613662623735303664613637623137373466646331316331386532653765373932663562 +62653434303636306131303261643135366132636331316365626266306361363963313537613935 +38326263643736326533346238363237393034313439663536343764326166386439663263616339 +32616333323062393934306466373766386361373766343463353135626463393238613939323866 +64303536316435616632333839323730656162336566366265346461346637346639633530363663 +31646435633536633836663434343534353239373136656639383630313064643030663532313233 +32326466303664613535323832666566323562343238613537383862366663343362326331393937 +37616662313865323931373334303832656435663538646338663961343564333236316430613036 +31363638393134646234373836663336646539653463383661363335313336616634636232373831 +38383661643538393136353466663464356337613631346364643066353832653332623166366565 +36393337643635656637383766663864663934353833353235306532303962623639323233333861 +36643638666166613936353362336538663762386365616563336661636234363531323636353731 +63623238633535383564373862303965313161373135643761306237326532646233623031393333 +32626332663738633030663937333965653833343434663032386632306564643266386563353030 +33653336373636646661323464353966356637303236376133363064353537653061336161303534 +32623336373362333537326639306163353934333663333666346339643662633432656635636134 +61356537383737646230383466316465356339393634353365663033626562353330613034386331 +31663139356533376433396632353734303963636465333536353232646564663732663132333130 +39303962613437656434626132653131313335326162316230343566373737343138373237623961 +65303632656335636539396237306435613864626466656330343335396133663962383862646638 +65336665306136383638633765303961353435316637626561333631323863363166393961393431 +35353561343638363761656333353364363633333362393339666262396331356539343631363032 +32363436616133333066326330636435636466663030666464376638303063633937643730393431 +61353265653237613265393164646139356637393730373239323265643966303665343966343238 +34636563666232656230376636393764373739303038346264613931643231646334303335336339 +39643236613637663334643234636332643634323439313261653134373139306130373437363730 +34646663303136636338643865623231386438346266643165613963373066363330663933383361 +32656630346166333332646530326236323435356664343838383735633963666338333261336239 +31643339643266653539323230386233386261643137346330613439323262373639396261323965 +35613866383934313032346361316335356531373238353839653466313438363030366434303439 +64303632383462663532663164663131633034646137336263633738653436343337333736613731 +64633836323934663361353438633838626362666339366333616338356130653366383161353737 +34633734643866343863366463343339323064343235306137316434666531393230643338656661 +61656464623437373264373162303939363738363538393731313934343536303833623436376130 +37333364303634663439353231323163393730336262343336613339623435393130373738313638 +65666334303465306234396337346331666536323962376633363364313331643865333666653232 +36636563633636633261626430636438306363626633303661366436393761643864323333623634 +64663235633333346633336637666366373165616234653137306536613866323438663662306466 +65323930373838313466663863306134623833656134396434343464366362366438633630666664 +62616336646463373862646239303938623131306634313039626231313864393764363461336535 +62646463373265393138623363316239346364323261366534656433343937613134653438303539 +36643866653563313165383034626636386164633461346332373566313839383633356464313932 +63323530343865613366336330366632643964613033616462356531626635343261383066333361 +35623133343431393766376165333262313139636432383436633861646163613938636636636263 +37376338663339336264633733373565313237646335616566613138323432356264333738313337 +66333137653537376463343264636538366234636133333931303337316634356338616633616261 +61336562616136313336663035376665666464363164396262323134333031663561393434326535 +62393238613132613035336134306663353135393366626236653461623861366466346231316338 +30343037303338323936356664323265326138376266313263323334353431353235616636646133 +39376661336261356639306662306435666232656563396261666638353231633865616139396462 +32343637336262346530313431663164643832343364346465313635616563616362366138396433 +39313264363561376663623762363733356332613161613865383261353532653664383532313933 +36386232353339363261356561373434333764633836353861356131383166626337376630323566 +64393863333037393635316238653534653936663139333162393633316366346466306337386338 +32393261323431323335303464373432346235336139303665616464616339343132343561376139 +35653934663064323533666135623537613434623836326463333531393433366561663133656532 +61383162353630663862333334376535613831346666356161633635323638623535616335393730 +39626536366164663864333832353339396665636237643964353538396336643665303639303038 +62336134613564373665333663396361653431306237303065393331316434393161663631653035 +34303061636535363231636163376338313866393864636161343333306539313365313737653137 +31386264633734383565333434316334313263373338316562653530653539343263376335323230 +64316264653131653730356232333336363863306263646630636431643566623033363138353365 +38353536376334346334333930313665633966613435326563333934373365303661633337373137 +66346163396532346436616662313366626532303132306635393039333435656134326231343431 +31386330356266366532393235646333613663333734303862663236636162613232 diff --git a/playbooks/files/alts/rabbitmq/ca_certificate.pem b/playbooks/files/alts/rabbitmq/ca_certificate.pem new file mode 100644 index 0000000..5373457 --- /dev/null +++ b/playbooks/files/alts/rabbitmq/ca_certificate.pem @@ -0,0 +1,66 @@ +$ANSIBLE_VAULT;1.1;AES256 +35663365646632333631636534386163386134316265626430343961306633346637633233366165 +3161353735326164313332353164643839376135346161360a383661383534323861393963623931 +34633962643563393836663761626239306465383230326237613430653665663263353030623738 +6638353834333763360a396665313136393935646461353861326465363164366463646533623066 +36616235636636346238353736613435323936303435626335646265353634303737336332643830 +65636330363236616637346434376565313433373033343134613562326331346133653034326665 +34383939373565623763363137643766343434643738346236656234663431336531313865623863 +34353938636339663962343662626336643736363063613537613732663634366339656162363835 +63366661326363346239373432333238636363313132386331366665376632633232623439626331 +62326666326635393330356338373636383630376238303761323336363032653461373163353738 +66323336313735373364646233343161303662623830623839316132626464356461626531376665 +34353338663735626534313966306563623337623437333363326233393462643232313432363161 +61323936663030613566646561313133323565353239353463303765383832623263323630386536 +66613735626630656131663661663536326137363533313362386664326164343232363561303637 +66616335643636646562653433386131623466656232303935656562393035353536336664653334 +31363936656561636365383537626239373135363362363662303431613565323761363866663864 +61666263336239656665386133333831393139613461303462336562316362633465376661303662 +38313536343731626162613231303661366561346536616132333264363862616332363636623162 +37666363373535623732646532633533393333666464623634326434613566383161373432333938 +35653730356536313435623865326165353731656464626166326139373866643936393833626633 +35363762343038326364313735306632386539386435663033386532306364343731393533613532 +66393730363634623532666461303262336633656632653732373237656262656138323164656538 +62623466616435333164393934623965623266323538396632343965666264316438356237663330 +35653663656534633361333564346536306139623634386461636534663333373562383836663133 +35323432616239323665346666666536396365336331343536656331343932396366303031376439 +64343966313738306364366164623061306662323637396630346361613462346331656535353331 +63393031366330316330373930373333653739373264663063666165656161356437346361626439 +63373839323961653639396331316439326638633734366434303066313633393335323431346462 +34386237376364353936326433396138653436343237643334333063333264643937623136323165 +66336265663738613566353364323932393437303230343838356239373463643533626430643138 +64373138653438646332363836663033343337633261393238666135396164623263316666306438 +30313334386261363465326434393436313638636664343633666261343336616336323433343038 +38663438633964373637316139616535363338653133373236303862656263336339396430303964 +36356261353334623630353436633235653237386132623133353839313936333963383731326662 +34386239623962616339366633663134643961356239313566396162623833323632313132643932 +39366339373632613435623139653431393261373736623938613265636465646139633336316539 +33646435346536326165626437616131323331663262613961313637313735303962333338386239 +66306665613661653132613261623939346531393764376263663665663265383934653666633262 +36373332633032646365353334343238386635366336396332356666316264333739366237616335 +65373735633437626564373432323863623638646365393634343362336532653736383531386230 +31643032623664643761373939333839393237306531356664613238306233643439393037653032 +62386335303061653530616565323038666562303431373034623230333261333635323962623536 +39623834663736653738636265363937343233323236623430396432643938356531633731316630 +65666464323864633262623836653866623461613661623063633735306139323638633533373737 +66373339653963616461633364653933333431343439353165343833323561376261653032353636 +66663861336461623566373464343231313633333838366462323865626338393762643761343364 +65323736616234323632623138646566373138653135376138323062646233653332303934656461 +31616635386364356263653365333235393962633764326633623237613763663966663339306435 +61643835343038653062623635633336363362353839303439323136316365346638396564666536 +65663633363830306431626433376436636331393134336130323266313965376231386633373631 +66393434306636333636306239363666363938326339313762313732613038333735623437316537 +39353638656632376662373964643132653136633163356434383531626238356233313637333830 +66636361363437616534396661643434323762623966393035626334373161353266323232366263 +39376138336561336435353533663232383632356538636538363932646164313236373035396136 +36643565646133333335303735636631323634333232373466393537636132336431643036666461 +38623366663664653737303831396534383637663730313632366661666532383237643566653639 +61376664373562333738343830383862343864343532363835313562643266373936393331633835 +31663932376232663062336265643763353931346534663061656533303964393434656365393161 +31303361633933316537633562613736373635363164333132336163366232646330653335316433 +62373263306366373031653532353637393063353439376530613130376636343238626365366330 +34663662616164663034656536366263366664353662313433336164323864366330303837313863 +32653132616566336533626239303432373961623861636334383437623637386165623637386266 +34366335626265636661333139373462653766356264636236343535353134306364313637343137 +38363835396633313862626235663332396130386164383264393938656332653263383638623362 +3434 diff --git a/playbooks/files/alts/rabbitmq/server_certificate.pem b/playbooks/files/alts/rabbitmq/server_certificate.pem new file mode 100644 index 0000000..3556014 --- /dev/null +++ b/playbooks/files/alts/rabbitmq/server_certificate.pem @@ -0,0 +1,70 @@ +$ANSIBLE_VAULT;1.1;AES256 +61303835643464306130613138343537363639636439613362343837613136343934353133313338 +3936636461313237363166346337633061346133366565360a653034633234633931613535316361 +61396661653461343637396434623463623535653761643033393030316138346531653335316536 +6230396131346232650a343331353666333632303438366334313739346236346536633463356562 +62653133666262303134373363376432373162323835346561336364616631623035323037383765 +32653837643966333636633562306663656637366465316336626135356538326464373166306230 +66623265323262653833313762393435303833663931653630616461626364363734653130383262 +30356130313464663461643139383831663334313662366564316636366431616161306334396231 +36653163303266643038316231323565363764333465396530653165376530653362666333303638 +37643133316135353930333833333034396333343137326533343331316666343439383639306662 +33373731656437306462643966353130383264396632613039656131653663386265663165636462 +39623938353163326564663539663038613764626230646532656366663937326536333030646535 +30623739346337346665356563313462323662393163353566386635613136386336336539653664 +65386237623166616265383961353265343631643533386138653730303361333765613664633132 +38356337643235633761363430373630623438343137643634653338393463306131626533323261 +35333631343266623436636235323236613536346262373161656639633136336631373231626131 +39386237646461373538633835653732326164376135616630626437366335316265393136656531 +36376530663733336361643537626538626338363265383733353339306438626430373662616264 +61643533383165663130666536313333656135303031336338383330623334626166393835376635 +61666131306634393933376561326334643561316539353534313132313839353531366539366364 +35646239353863393863636166613463373838643733366263393635616165313732376634346238 +33393936643362333039313233396131666363616231623261646639323630316561663363623039 +30303362313264313161666662633533333537376330313865643863316632396232633136393566 +33363432333737343364336233623663363463356335633862313138303539636239643565613264 +33613435343338623833663230323134363636373766373931313031346134383732333039656466 +64336237663635303163386438393637633633363237396137393539653330383238653732353231 +34373732636438323233323135653537383666623733376131306130333437313837353837333264 +32313563633865376164623035636536376130343966316134353037633263636335353966343338 +30633836646130396433383737356231633864333438616331333730313766323431333732623538 +33326431656164343933643238633930333738393237333731636366633963366332613333663564 +31356535396463316436646333346466373932636133396535613930623738346336613065333930 +64306533643131306465613335313064346263643439623064303738303733303030363763356132 +65356663623139663033666165663335333966323230356364303866303263396237313638636132 +30643031396165396335646330626232663233626462613431316238343737653263326464353862 +65396666353437333534346634343232393136383833666666636362376533623936623166393235 +62613735373963343665353830306131386466353964393538343735383036363630353631613236 +61616630346264333665653933316437376130326535383636396464313738633230653663366435 +31666239336163356161656365643964646236393165316365306434666233646263653630383837 +31326235663032333339363735363631656439393237393435656561663436643737313935643266 +65636336646465663665613235363965396661336462343933656432393338343762326662343663 +30313431643232383334376166313561633065313966636539626466633230346566616532613566 +61663831646232306332376464653438323032323633396633316535333835386465356138643435 +61346364386462343761653835653963633633383237323736376236303263366134343435666439 +33633230633434356138656239353430336238663863363536356135653963313866633266316236 +33623239663165643333373738306539316132613137613637323239643538623938663634333461 +38643838313463643732333438303962353661653335343835613335373230303864326464643462 +30656163396437386566346164643730636532636539383737336330643337383533313562366338 +39343663343630623233333565393235626433373938616533646233623066363931306564386233 +63326466396335663961386431393763633730333338616635343036663533323338336561613164 +30636531373665656665326462376537303838306565393635336333356336343564313164666638 +32623861663634373630366364613730636235653832346631313161303931646638323261633463 +61666130313564666238643738393631306166656531306637313566333661346466653461306263 +62613632303832656439323132373633396130633236383230626237636461353635333130383939 +63383636366263343635393932303238313130393732353936393763323232346633366537623465 +32353262346335313539336563303931366166353133653435613939306432316161333734303166 +38303336343332303038323164373764616665633234353434363739346139373737343936333333 +62306330396636396334623137646335393432383633343630346361346638323563633762616337 +66656565383262646262333032323561393235373830356330353536353139333864333039636164 +65366636326563613732613962373763363861653263336639643464626434313561623834336636 +66643063366466353461653365636662306133306131346233653563396533306531643564373530 +61616630373036386366373461356238323864643933316234623037316330383463356262343262 +32393931353937613136396165343538376534396661343737643531323635386138386339643163 +64366462323865616537656536633831343431353832373232303033643136323835626464396462 +35346233633664656337363165326638626633393135643531666437393939383835663363663531 +62643532326434396363396537353538393937396663326131346363383461386232343464386335 +30663166666238613333306636306564306666343234663538303031356636333034393237386334 +62363466616162663535386534623962363563643230663861643237656366396135373962343836 +62663838323032316164363363303733316234303130656661633435323163323065306236373438 +3062 diff --git a/playbooks/files/alts/rabbitmq/server_key.pem b/playbooks/files/alts/rabbitmq/server_key.pem new file mode 100644 index 0000000..3750064 --- /dev/null +++ b/playbooks/files/alts/rabbitmq/server_key.pem @@ -0,0 +1,90 @@ +$ANSIBLE_VAULT;1.1;AES256 +64663165363261333061303533653835643863623261646462383434313563653565363661623261 +3531313135343264616537316266336566313337633763650a353531373530303937663962373832 +36336337613065323239323334633263633134313339666662396263656339333266623030303233 +3638393132653131610a653732343432316237306236306463613639303839393930356366303132 +64336539313834383134346631303561303231383332333031616233346537623730336461333732 +37303138663235616532333963333737353235326632633839333831303562323161666234383738 +37363032333865363537636263643863326162373530643134323633626263313164666433333566 +30616463323062333762376562356330326165396236313161346639336230336233613232633465 +65663863343561616563323736363030643062393838623332343431623231653931316362323866 +39346234623132623034363734333836303633623762656263623666623866363564626430313239 +63616231336433396161313062313665356433623634373561626637343732343432306366366436 +38346161303433333330386530653731343039646637316663333663343231616134633666336239 +66636432393334346461323038656234353664383162366530303136373535616435313362636266 +33626365646636656635366132646163333839653964346630356162393232386462376235646136 +33366431636238386332336536316639396266643465663463373935383936633034363234663637 +62356137656336373563373665393631343334353833643931633230363366666433613732346265 +62383462323636646539323665313063633331666262666534633334623231616133616636323331 +31623661613935656436313463313539643032653336363631643430626233343931623663613232 +66613263663630363162383236626531396533306563633862313561363039343730303962393533 +31363939326336623934633661313264316138383162363037373937656637363239396537643831 +30326434343830373436386661313866643338363862336565643638376639396234616631616535 +63333638653534306431646234363830623730303438393066353431376239376636626635653138 +33616161653730343033623166663963316666613961393664373031656338656531376239396330 +39623863333132323938623237343230326265633937306561356537646135656561383638346238 +65336262333835623834373334323634663736656338313266383932623530333761363962633361 +66653137616462373662633337303135646563313537383730653634306631306537653130396538 +62323966323932373761383738316332383733383637646434353935386566363665323135303831 +39323335663734363034393933313761613134616163376466323833666232313135626539656333 +32616665616634643239323131366134306232653734373264366462383731613766633136353734 +61623738613837643638643165656531383436633463326362663130373735353732353164376338 +62633334303663623434643730643836643164376534383933383230623733393837346364323861 +66303133633434303862336161643462313363306338396266353134376531383531666637663230 +62383165653736363664613539623037616562633136366466386530646136613061393132373832 +62383261376333623930663639366166306534343237386232356561646137323666306339323234 +35643462623539643532363830333238373138383434376433646234646631656266643663653665 +37383535383935343063633434613363376465353166326639316239616630613334316263316466 +31376561643432346363613535353232366435303033346232343331353931306661636538616462 +31613436343730383431393466326230613131663766303638353433373535386565653865633233 +35333066633961343738663664333762353938323436663335616464396530623337323163643432 +39393464313565363739363738643037326261306163613931353161623761343461356637363539 +33393664363239336161636362656334636136323762316139373030343136353165623837333463 +35366631353064613065363038393138363362356264366536663438396134653133343934323564 +35383461323830336431343164643730303636636163623861623438393235663166626563353138 +66616139613333626563363162616233386163363139303730633131623038623063626330323634 +64356530353538333563306633353163373330313635363130383435656566643935383835656331 +33363263663439656234656435653632623863323638383663373931326137636463383361366235 +65356565343631613263346338373464646431343939653661653731303330626464663433323562 +33363265613365313131653637643331353536326266643964326534626331323764643762333737 +32363036373935303838306136666237643164386431343530366664383664633936613735653365 +64356166323264303330343737643238643730646634306462383665356237616636666537623031 +35353330366338323166336232366233663732373330343738323139303164656562316466313631 +33313036366131316638613935343936643462643361303863363637303137363234343066653439 +37306133333863336266626337326266633738623664313364623836633335353430396538623130 +63613634373037396361306539393765363438656663383530303365356265326134363132646330 +38663565393434636432363063616130363039643638623333396434386530613935333934376539 +30353263303761343166663862323830313338656332376431383839376133326362303938303439 +39626138343661343436363338666538393635356461653361616338376333666530366233393263 +65646439316639303534643535633232356337653134313038653462633830306537663064343238 +62353334343135646565346330616533313832346635633534623762326137393237613563613562 +31326539366562643165313539396433656238306231623865336137666633656266623661313336 +38343537323431656531626333363834326135306264323163336233343861303864343561623163 +38643731643633363461323634356235633730306331666333613865633633396533616364666332 +31363531623435366663306664636130363131343363343934666366346639636337353432653864 +66306539336331323930363465633838393432656464313434376464333034343363343131386534 +64303733666262323362353463633266333165333636333334616632623934343838626430633136 +30343464666235643461393735616431646431653566633233373365366165353765643536303731 +62636232383161663063343463633231643132613431343664303162663534646233373064633037 +36393461663361656665316562393236306163643735363232323865346361393062346236306331 +66383134663163353865623037663864306238376333373931373766323366653266326431616436 +61643232303766333633383365353433633231396537626630666161613831363931366533393034 +30393961333636616434616438613566323737313166356235393933333534613037316135393266 +66313364303731623633306365393562383435303038333735633137656436333130353565623836 +38316339666138353938633838303531653535333664356235333934393265633565353562323461 +31363538313965386430633433376637343865333035356431373565653834316638393534393330 +31663666646332396266666563383233646562613161356135386666663364306466373036663336 +37613430313835323261613638653139396163343033363332613562306439663936643564333164 +37386230323033393437613839353364376263633439633762326238386638396537333933396630 +36646163313836656130303837613438323438326462633639346230613063363633613531346236 +66656134376131303835316137636331626637306131616131376232663037333161303763613038 +35613261363762346339336465316231336135613137363239386330626234393861633863376264 +36386665333865336135393036613637396565353935626238396534393830623935343239663464 +32396530326235643837636636303138313234366337353764333665366635366537373634636665 +34313030343238323439326362613266313166336163663866626536656463386331626532373561 +61613762346431663465356133346430643766303162343733333461383239343734326530376132 +31663261653865666461306462663238626432353566653931643335643838363438386166303636 +65656331613562333762633437303063373439393435303536373137376236363639303031356565 +35663134323631656630313734313531336235653031323964333537393138356536616164373532 +34366637633563303931316239653364643634616536333862316534623266646163643132636431 +36376436323165386635383832323562343033383962303637376565336163636366