mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2025-01-18 08:06:16 +01:00
425052c00f
The make package was missing from the list of packages that are needed for the security tracker.
106 lines
3.2 KiB
YAML
106 lines
3.2 KiB
YAML
---
|
|
- name: run maintenance mode
|
|
include_role:
|
|
name: maintenance
|
|
vars:
|
|
service_name: "security tracker"
|
|
service_domain: "{{ security_tracker_domain }}"
|
|
service_alternate_domains: []
|
|
service_nginx_conf: "{{ security_tracker_nginx_conf }}"
|
|
when: maintenance is defined
|
|
|
|
- name: install packages
|
|
pacman:
|
|
state: present
|
|
name:
|
|
- git
|
|
- make
|
|
- python
|
|
- python-sqlalchemy
|
|
- python-sqlalchemy-continuum
|
|
- python-flask
|
|
- python-flask-sqlalchemy
|
|
- python-flask-wtf
|
|
- python-flask-login
|
|
- python-flask-talisman
|
|
- python-requests
|
|
- python-flask-migrate
|
|
- python-scrypt
|
|
- pyalpm
|
|
- sqlite
|
|
- expac
|
|
- uwsgi-plugin-python
|
|
|
|
- name: make security user
|
|
user: name=security shell=/bin/false home="{{ security_tracker_dir }}" createhome=no
|
|
|
|
- name: fix home permissions
|
|
file: state=directory mode=0750 owner=security group=http path="{{ security_tracker_dir }}"
|
|
|
|
- name: copy security-tracker units
|
|
copy: src="{{ item }}" dest="/etc/systemd/system/{{ item }}" owner=root group=root mode=0644
|
|
with_items:
|
|
- security-tracker-update.timer
|
|
- security-tracker-update.service
|
|
notify:
|
|
- daemon reload
|
|
|
|
- name: disable security-tracker timer
|
|
service: name="security-tracker-update.timer" enabled=no state=stopped
|
|
when: maintenance is defined
|
|
|
|
- name: receive valid signing keys
|
|
become: true
|
|
become_user: security
|
|
command: /usr/bin/gpg --keyserver keys.openpgp.org --recv "{{ item }}"
|
|
with_items:
|
|
- E240B57E2C4630BA768E2F26FC1B547C8D8172C8
|
|
register: gpg
|
|
changed_when: "gpg.rc == 0"
|
|
|
|
- name: clone security-tracker repo
|
|
git: repo=https://github.com/archlinux/arch-security-tracker.git version="{{ security_tracker_version }}" dest="{{ security_tracker_dir }}" force=true verify_commit=true
|
|
become: true
|
|
become_user: security
|
|
register: release
|
|
notify:
|
|
- post security-tracker deploy
|
|
|
|
- name: run initial setup
|
|
become: true
|
|
become_user: security
|
|
command: /usr/bin/make chdir="{{ security_tracker_dir }}" creates=*.db
|
|
|
|
- name: restrict database permissions
|
|
file: mode=0640 owner=security group=security path="{{ security_tracker_dir }}/tracker.db"
|
|
|
|
- name: set up nginx
|
|
template: src=nginx.d.conf.j2 dest="{{ security_tracker_nginx_conf }}" owner=root group=root mode=644
|
|
notify:
|
|
- reload nginx
|
|
when: maintenance is not defined
|
|
tags: ['nginx']
|
|
|
|
- name: make nginx log dir
|
|
file: path=/var/log/nginx/{{ security_tracker_domain }} state=directory owner=root group=root mode=0755
|
|
|
|
- name: configure security-tracker
|
|
template: src=20-user.local.conf.j2 dest={{ security_tracker_dir }}/config/20-user.local.conf owner=security group=security mode=0640
|
|
|
|
- name: deploy security-tracker
|
|
template: src=security-tracker.ini.j2 dest=/etc/uwsgi/vassals/security-tracker.ini owner=security group=http mode=0644
|
|
|
|
- name: deploy new release
|
|
become: true
|
|
become_user: security
|
|
file: path=/etc/uwsgi/vassals/security-tracker.ini state=touch owner=root group=root mode=0644
|
|
when: release.changed
|
|
|
|
- name: start and enable security-tracker timer
|
|
systemd:
|
|
name: security-tracker-update.timer
|
|
enabled: yes
|
|
state: started
|
|
daemon_reload: yes
|
|
when: maintenance is not defined
|