Merge branch 't38273-extract-roles-reconfigurations' into 'main'

Extract roles reconfigurations | refs #38273

See merge request sys/ansible-public!62

.ansible-lint-ignore

+# This file contains ignores rule violations for ansible-lint
+playbooks/celerity.yml name[casing]
+playbooks/live/functions/create-live-app.yml name[template]
+playbooks/live/live.yml name[play]
+playbooks/live/subplays/ha-case.yml name[casing]
+playbooks/live/subplays/ha-case.yml name[play]
+playbooks/live/subplays/standard-case.yml name[play]
+playbooks/mediacache.yml name[casing]
+playbooks/mediacache/mediacache.yml name[casing]
+playbooks/mediaimport.yml name[casing]
+playbooks/mediaserver.yml name[casing]
+playbooks/mediavault/deploy.yml name[casing]
+playbooks/mediavault/ressources/add_backup_task.yml name[casing]
+playbooks/mediavault/ressources/add_backup_task.yml name[template]
+playbooks/mediaworker.yml name[casing]
+playbooks/mirismanager.yml name[casing]
+playbooks/monitor/all.yml name[play]
+playbooks/monitor/msmonitor.yml name[casing]
+playbooks/monitor/msmonitor.yml role-name[path]
+playbooks/monitor/munin_node.yml role-name[path]
+playbooks/monitor/munin_server.yml name[casing]
+playbooks/monitor/munin_server.yml role-name[path]
+playbooks/netcapture.yml name[casing]
+playbooks/postgres-ha.yml name[casing]
+playbooks/postgres-maintenance.yml name[play]
+playbooks/postgres-maintenance/fenced_to_standby.yml name[casing]
+playbooks/postgres-maintenance/rephacheck_status.yml name[casing]
+playbooks/postgres-maintenance/restart_repmgrd.yml name[casing]
+playbooks/postgres-maintenance/standby_to_primary.yml name[casing]
+playbooks/postgres.yml name[casing]
+playbooks/site.yml name[casing]
+playbooks/site.yml name[play]
+playbooks/tests/data-partition.yml name[casing]
+playbooks/tests/exec-tester.yml name[casing]
+playbooks/tests/firewall-rules.yml name[casing]
+playbooks/tests/ressources/firewall/listen.yml name[casing]
+playbooks/tests/ressources/firewall/listen.yml name[template]
+roles/celerity/defaults/main.yml var-naming[no-role-prefix]
+roles/celerity/handlers/main.yml name[casing]
+roles/celerity/tasks/configure/celerity-conf.yml name[casing]
+roles/celerity/tasks/install.yml name[casing]
+roles/celerity/vars/main.yml var-naming[no-role-prefix]
+roles/celerity/vars/main.yml yaml[line-length]
+roles/fail2ban/handlers/main.yml name[casing]
+roles/fail2ban/tasks/base.yml name[casing]
+roles/fail2ban/tasks/configure/f2b-configure.yml name[casing]
+roles/fail2ban/tasks/install.yml name[casing]
+roles/haproxy/handlers/main.yml name[casing]
+roles/haproxy/tasks/base.yml name[casing]
+roles/haproxy/tasks/install.yml name[casing]
+roles/haproxy/vars/main.yml var-naming[no-role-prefix]
+roles/letsencrypt/defaults/main.yml yaml[line-length]
+roles/letsencrypt/handlers/main.yml name[casing]
+roles/letsencrypt/tasks/configure/letsencrypt-configure.yml name[casing]
+roles/letsencrypt/tasks/install.yml name[casing]
+roles/live/defaults/main.yml yaml[truthy]
+roles/live/handlers/main.yml name[casing]
+roles/live/tasks/base.yml name[casing]
+roles/live/vars/main.yml var-naming[no-role-prefix]
+roles/lxc/handlers/main.yml name[casing]
+roles/lxc/tasks/base.yml name[casing]
+roles/mediacache/defaults/main.yml var-naming[no-role-prefix]
+roles/mediacache/handlers/main.yml name[casing]
+roles/mediacache/tasks/base.yml name[casing]
+roles/mediacache/tasks/configure/live.yml name[casing]
+roles/mediacache/tasks/configure/local-resolution.yml name[casing]
+roles/mediacache/tasks/configure/nginx-live-upstream.yml name[casing]
+roles/mediacache/tasks/configure/nginx-vhost.yml name[casing]
+roles/mediacache/tasks/configure/nginx-vod-upstream.yml name[casing]
+roles/mediacache/tasks/configure/vod.yml name[casing]
+roles/mediacache/vars/main.yml var-naming[no-role-prefix]
+roles/mediaimport/handlers/main.yml name[casing]
+roles/mediaimport/tasks/base.yml name[casing]
+roles/mediaimport/tasks/install.yml name[casing]
+roles/mediaimport/vars/main.yml var-naming[no-role-prefix]
+roles/mediaserver/defaults/main.yml var-naming[no-role-prefix]
+roles/mediaserver/defaults/main.yml yaml[line-length]
+roles/mediaserver/handlers/main.yml name[casing]
+roles/mediaserver/tasks/base.yml name[casing]
+roles/mediaserver/tasks/configure/email.yml name[casing]
+roles/mediaserver/tasks/configure/instance.yml name[casing]
+roles/mediaserver/tasks/configure/synchronize.yml name[casing]
+roles/mediaserver/tasks/install.yml name[casing]
+roles/mediaserver/vars/main.yml var-naming[no-role-prefix]
+roles/mediavault/defaults/main.yml var-naming[no-role-prefix]
+roles/mediavault/defaults/main.yml yaml[truthy]
+roles/mediavault/handlers/main.yml name[casing]
+roles/mediavault/tasks/base.yml name[casing]
+roles/mediavault/tasks/configure/mailer.yml name[casing]
+roles/mediavault/tasks/install.yml name[casing]
+roles/mediavault/vars/main.yml var-naming[no-role-prefix]
+roles/mediaworker/defaults/main.yml var-naming[no-role-prefix]
+roles/mediaworker/handlers/main.yml name[casing]
+roles/mediaworker/tasks/configure/celerity-conf.yml name[casing]
+roles/mediaworker/tasks/install.yml name[casing]
+roles/mediaworker/vars/main.yml var-naming[no-role-prefix]
+roles/mediaworker/vars/main.yml yaml[line-length]
+roles/mirismanager/defaults/main.yml var-naming[no-role-prefix]
+roles/mirismanager/handlers/main.yml name[casing]
+roles/mirismanager/tasks/base.yml name[casing]
+roles/mirismanager/tasks/configure/apt-cacher-proxy.yml name[casing]
+roles/mirismanager/tasks/configure/email.yml name[casing]
+roles/mirismanager/tasks/install.yml name[casing]
+roles/mirismanager/vars/main.yml var-naming[no-role-prefix]
+roles/monitor/msmonitor/handlers/main.yml name[casing]
+roles/monitor/msmonitor/tasks/install.yml name[casing]
+roles/monitor/msmonitor/vars/main.yml var-naming[no-role-prefix]
+roles/monitor/munin_node/defaults/main.yml var-naming[no-role-prefix]
+roles/monitor/munin_node/handlers/main.yml name[casing]
+roles/monitor/munin_node/tasks/base.yml name[casing]
+roles/monitor/munin_node/tasks/configure/main-configuration.yml name[casing]
+roles/monitor/munin_node/tasks/install.yml name[casing]
+roles/monitor/munin_node/vars/main.yml var-naming[no-role-prefix]
+roles/monitor/munin_server/defaults/main.yml var-naming[no-role-prefix]
+roles/monitor/munin_server/handlers/main.yml name[casing]
+roles/monitor/munin_server/tasks/base.yml name[casing]
+roles/monitor/munin_server/tasks/configure/main-configuration.yml name[casing]
+roles/monitor/munin_server/tasks/install.yml name[casing]
+roles/monitor/munin_server/vars/main.yml var-naming[no-role-prefix]
+roles/netcapture/defaults/main.yml yaml[truthy]
+roles/netcapture/tasks/configure/main-configure.yml name[casing]
+roles/netcapture/tasks/configure/miris-configure.yml name[casing]
+roles/netcapture/tasks/install.yml name[casing]
+roles/netcapture/vars/main.yml yaml[truthy]
+roles/nftables/tasks/install.yml name[casing]
+roles/nginx/handlers/main.yml name[casing]
+roles/nginx/tasks/base.yml name[casing]
+roles/nginx/tasks/install.yml name[casing]
+roles/postfix/handlers/main.yml name[casing]
+roles/postfix/tasks/configure/aliases.yml name[casing]
+roles/postfix/tasks/configure/mailname.yml name[casing]
+roles/postfix/tasks/configure/postfix_authentication.yml name[casing]
+roles/postfix/tasks/configure/postfix_generic.yml name[casing]
+roles/postfix/tasks/configure/postfix_main.yml name[casing]
+roles/postfix/tasks/configure/postfix_virtual.yml name[casing]
+roles/postfix/tasks/install.yml name[casing]
+roles/postgres-ha role-name
+roles/postgres-ha/handlers/main.yml name[casing]
+roles/postgres-ha/tasks/base.yml name[casing]
+roles/postgres-ha/tasks/base/rephacheck.yml name[casing]
+roles/postgres-ha/tasks/base/rephacheck.yml var-naming[no-role-prefix]
+roles/postgres-ha/tasks/base/repmgr.yml name[casing]
+roles/postgres-ha/tasks/base/swappiness.yml name[casing]
+roles/postgres-ha/tasks/configure.yml name[casing]
+roles/postgres-ha/tasks/configure/postgres-role.yml name[casing]
+roles/postgres-ha/tasks/configure/postgres-role.yml var-naming[no-role-prefix]
+roles/postgres-ha/tasks/configure/register-primary.yml name[casing]
+roles/postgres-ha/tasks/configure/register-standby.yml name[casing]
+roles/postgres-ha/tasks/configure/register-witness.yml name[casing]
+roles/postgres-ha/tasks/configure/ssh-key.yml name[casing]
+roles/postgres-ha/tasks/install.yml name[casing]
+roles/postgres-ha/vars/main.yml yaml[line-length]
+roles/postgres/defaults/main.yml var-naming[no-role-prefix]
+roles/postgres/handlers/main.yml name[casing]
+roles/postgres/tasks/base.yml name[casing]
+roles/postgres/tasks/base/logrotate.yml name[casing]
+roles/postgres/tasks/configure/authentication.yml name[casing]
+roles/postgres/tasks/configure/custom-settings.yml name[casing]
+roles/postgres/tasks/configure/databases.yml name[casing]
+roles/postgres/tasks/configure/users.yml name[casing]
+roles/postgres/tasks/install.yml name[casing]
+roles/postgres/vars/main.yml var-naming[no-role-prefix]
+roles/proxy/tasks/configure/proxy-configure.yml name[casing]
+roles/shared/handlers/celerity.yml name[casing]
+roles/shared/handlers/nftables.yml name[casing]
+roles/shared/tasks/celerity_base_config.yml name[casing]
+roles/shared/tasks/celerity_base_config.yml name[template]
+roles/sysconfig/defaults/main.yml var-naming[no-role-prefix]
+roles/sysconfig/defaults/main.yml yaml[line-length]
+roles/sysconfig/defaults/main.yml yaml[truthy]
+roles/sysconfig/handlers/main.yml name[casing]
+roles/sysconfig/tasks/base/apt_ubicast.yml name[casing]
+roles/sysconfig/tasks/base/apt_ubicast.yml name[template]
+roles/sysconfig/tasks/base/logs.yml name[casing]
+roles/sysconfig/tasks/base/prompt.yml name[casing]
+roles/sysconfig/tasks/base/ssh-client.yml name[casing]
+roles/sysconfig/tasks/base/ssh-server.yml name[casing]
+roles/sysconfig/tasks/base/unattended_upgrades.yml name[casing]
+roles/sysconfig/tasks/configure/locale.yml name[casing]
+roles/sysconfig/tasks/configure/ntp.yml name[casing]
+roles/sysconfig/tasks/configure/proxy.yml name[casing]
+roles/sysconfig/tasks/configure/timezone.yml name[casing]
+roles/sysconfig/tasks/install.yml name[casing]
+roles/sysconfig/vars/main.yml var-naming[no-role-prefix]
+roles/sysuser/defaults/main.yml var-naming[no-role-prefix]
+roles/sysuser/defaults/main.yml yaml[truthy]
+roles/sysuser/tasks/base/sudoers.yml name[casing]
+roles/sysuser/tasks/common/dotfiles.yml name[template]
+roles/sysuser/tasks/configure/create_user.yml name[template]
+roles/sysuser/tasks/install.yml name[casing]
+roles/sysuser/vars/main.yml var-naming[no-role-prefix]
+roles/tester/defaults/main.yml var-naming[no-role-prefix]
+roles/tester/tasks/configure/tester-configure.yml name[casing]
+roles/tester/tasks/install.yml name[casing]

.lint/ansible-lint.conf

@@ -7,11 +7,12 @@ exclude_paths:
   - .cache/
   - ${HOME}/.cache/
 
-skip_list:
-  - role-name                  # Skip role name pattern verification ("-" should not be used)
-  - name[play]                 # Skip the rule dictating that all play should have a name
-  - name[casing]               # Skip the rule dictating that all task name should begin with uppercase
-  - name[template]             # Skip forcing to use jinja var at the end of a task name
-  - var-naming[no-role-prefix] # Skip necessity to prefix role vars with role name
+# Moved into the ".ansible-lint-ignore" file
+#skip_list:
+#  - role-name                  # Skip role name pattern verification ("-" should not be used)
+#  - name[play]                 # Skip the rule dictating that all play should have a name
+#  - name[casing]               # Skip the rule dictating that all task name should begin with uppercase
+#  - name[template]             # Skip forcing to use jinja var at the end of a task name
+#  - var-naming[no-role-prefix] # Skip necessity to prefix role vars with role name
 
 ...

CHANGELOG.md

+# 2024-02-16
+
+* Rework roles in 3 distinct stages. Stages can be used with the ansible tags of the same name.
+  * `install` for package installations,
+  * `base` for basic configuration (without variable),
+  * `configure` for case specific configurations.  
+* Remove some unused variables in roles.
+* Migrate variables from roles `defaults` to `vars`.
+* Add variables to `munin_server` and `munin_node` roles to allow a standalone installation of the roles.
+* Add documentation for ansible `vars` and `default`.
+
 # 2024-02-15
 
 * Remove obsolete `DATA_DIRS` configuration in Nudgis Front configuration template
 * Add `MSCONTROLLER_LOCKS_DIR` configuration in Nudgis Front configuration template (use the `nudgis_front_instances_dir` value as default value)
 
+# 2024-01-24
+
+* Changing the firewall solution from `ferm`/`iptables` to `nftables`.
+
 # 2023-10-23
 
-Remove benchmark solution deployment.
+* Remove benchmark solution deployment.
 
 # 2023-10-20
 
-Avoid multiple `base` role execution.  
+* Avoid multiple `base` role execution.  
 Now you have to create a meta group `[base:children]` containing all defined groups (`mediaserver`, `mirismanager`, ... see example inventories).
 
 # 2023-10-18
 
-Ansible installation documentation has been enhanced.  
+* Ansible installation documentation has been enhanced.  
 Makefile has been removed in favor of the more complete `ansible` and `ansible-playbook` default commands.
 
 # 2023-08-16
 
-Many changes have been made with the arrival of debian 12. 
+* Many changes have been made with the arrival of debian 12.  
 Variables have been completely restructured.
 
 To help you make the transition : 

doc/deploy.md

@@ -17,26 +17,11 @@ To deploy all components, execute:
 ansible-playbook -i inventories/customer playbooks/site.yml 
 ```
 
-If you want to limit and deploy specific part, you can add a `tag`:
+Additionnaly, each role is splitted into 3 tags:
+* "install" to install the application packages required
+* "base" to to the base configuration of the application
+* "configure" to deploy specific configurations for the role
 
-```sh
-ansible-playbook -i inventories/customer -t <tag> playbooks/site.yml 
-```
-
-The avalaible tags are:
-
-| Component     | Tag            |
-|---------------|----------------|
-| mediaserver   | `server`       |
-| mediaworker   | `worker`       |
-| mirismanager  | `manager`      |
-| mediaimport   | `import`       |
-| mediavault    | `vault`        |
-| celerity      | `celerity`     |
-| ...           | ...            |
+You can limit your deployment to this tags by using `--tags <tag_name>` to your ansible command.
 
-
-To view all tags avalaible, run: 
-```
-awk '/tags:/ && !/always/ {print $2}' ./playbooks/site.yml
-```
+To personalise components to install/configure during the deployment, the best method is to duplicate and edit the `site.yml` playbook to suit your needs.

playbooks/base.yml

@@ -3,7 +3,6 @@
 
 - name: BASE
   hosts: base
-  tags: all
   roles:
     - base
 

playbooks/celerity.yml

@@ -3,7 +3,6 @@
 
 - name: CELERITY SERVER
   hosts: celerity
-  tags: celerity
   roles:
     - celerity
   post_tasks:

playbooks/firewall.yml

@@ -3,7 +3,6 @@
 
 - name: FIREWALL
   hosts: firewall
-  tags: firewall
   roles:
     - nftables
 

playbooks/letsencrypt.yml

@@ -3,7 +3,6 @@
 
 - name: Let's encrypt
   hosts: all
-  tags: all
   roles:
     - letsencrypt
 

playbooks/live/functions/create-live-app.yml

@@ -44,7 +44,7 @@
 
     - name: Extracting the application secret
       ansible.builtin.set_fact:
-        live_secret: "{{ ms_live_config.content | b64decode | from_json | json_query('RTMP_APP') }}"
+        live_secret: "{{ (ms_live_config.content | b64decode | from_json).RTMP_APP }}"
       when: ms_conf_live.stat.exists
 
     - name: Declaring the application secret
@@ -97,7 +97,10 @@
       failed_when: false
 
     - name: (Re)create the RTMP app configuration
-      notify: Reload nginx
+      notify:
+        - Reload nginx
+        - Setup munin-node plugins link
+        - Restart munin-node service
       ansible.builtin.command:
         cmd: ubicast-livectl add {{ live_app_name }} {{ hostvars['localhost'].live_app_secret }}
         creates: /etc/nginx/rtmp.d/{{ live_app_name }}.conf
@@ -127,6 +130,18 @@
         name: nginx
         state: reloaded
 
+    - name: Setup munin-node plugins link
+      ansible.builtin.shell:
+        munin-node-configure --shell --remove-also 2>&1 | sh -x  # noqa risky-shell-pipe
+      # sh -x print executed cmd to stderr
+      register: munin_plugin_linked
+      changed_when: munin_plugin_linked.stderr | length > 0
+
+    - name: Restart munin-node service
+      ansible.builtin.service:
+        name: munin-node
+        state: restarted
+
 - name: MediaServer(s) - "{{ live_app_name }}" live application configuration
   hosts: mediaserver
   gather_facts: false

playbooks/live/live.yml

@@ -3,16 +3,17 @@
 - name: LIVE
   hosts: live
   gather_facts: false
-  tags: live
   roles:
     - live
 
 - import_playbook: subplays/standard-case.yml
   # playbook target mediaserver and live hosts
   when: groups['live'] | d('') | length >= 1 and ( hostvars[groups['live'][0]].live_ha is undefined or hostvars[groups['live'][0]].live_ha == false )
+  tags: configure
 
 - import_playbook: subplays/ha-case.yml
   # playbook target mediaserver and live hosts
   when: groups['live'] | d('') | length >= 1 and ( hostvars[groups['live'][0]].live_ha is defined and hostvars[groups['live'][0]].live_ha == true )
+  tags: configure
 
 ...

playbooks/mediacache.yml

@@ -3,7 +3,6 @@
 
 - name: MEDIACACHE
   hosts: mediacache
-  tags: mediacache
   roles:
     - mediacache
   post_tasks:

playbooks/mediacache/mediacache.yml

@@ -2,13 +2,13 @@
 
 - name: MEDIACACHE
   hosts: mediacache
-  tags: mediacache
   roles:
     - mediacache
   tasks:
     - name: Getting the IP to trust in term of securelink
       ansible.builtin.set_fact:
         securelink_ip: "{{ hostvars[inventory_hostname]['ansible_default_ipv4']['address'] }}"
+      tags: configure
 
     - name: authorize mediacache on mediaserver
       notify: restart nginx on mediaservers
@@ -19,6 +19,7 @@
       delegate_to: "{{ item }}"
       delegate_facts: true
       loop: "{{ groups['mediaserver'] }}"
+      tags: configure
 
   handlers:
     - name: restart nginx on mediaservers

playbooks/mediaimport.yml

@@ -3,7 +3,6 @@
 
 - name: MEDIAIMPORT
   hosts: mediaimport
-  tags: mediaimport
   roles:
     - mediaimport
   post_tasks:

playbooks/mediaserver.yml

@@ -3,7 +3,6 @@
 
 - name: MEDIASERVER
   hosts: mediaserver
-  tags: mediaserver
   roles:
     - mediaserver
   post_tasks:

playbooks/mediaworker.yml

@@ -3,7 +3,6 @@
 
 - name: MEDIAWORKER
   hosts: mediaworker
-  tags: mediaworker
   roles:
     - mediaworker
   post_tasks:

playbooks/mirismanager.yml

@@ -3,7 +3,6 @@
 
 - name: MIRIS MANAGER
   hosts: mirismanager
-  tags: mirismanager
   roles:
     - mirismanager
   post_tasks:

playbooks/netcapture.yml

@@ -3,7 +3,6 @@
 
 - name: NETCAPTURE
   hosts: netcapture
-  tags: netcapture
   roles:
     - netcapture
   post_tasks:

playbooks/postfix.yml

-#!/usr/bin/env ansible-playbook
----
-
-- name: POSTFIX
-  hosts: all
-  tags: all
-  roles:
-    - conf
-    - postfix
-
-...

playbooks/postgres-ha.yml

@@ -3,7 +3,6 @@
 
 - name: POSTGRES HA
   hosts: postgres
-  tags: postgres
   pre_tasks:
     - name: check that repmgr_node_id is set
       ansible.builtin.assert:
@@ -26,7 +25,6 @@
 
 - name: POSTGRES HA CLIENTS
   hosts: mediaserver
-  tags: [postgres, mediaserver]
   # pre_tasks:
   #   - name: check that haproxy is configured
   #     ansible.builtin.assert:

playbooks/postgres-maintenance.yml

@@ -3,10 +3,13 @@
 
 - import_playbook: postgres-maintenance/rephacheck_status.yml
   tags: [always]
+
 - import_playbook: postgres-maintenance/fenced_to_standby.yml
   tags: [never, fenced-to-standby]
+
 - import_playbook: postgres-maintenance/standby_to_primary.yml
   tags: [never, standby-to-primary]
+
 - import_playbook: postgres-maintenance/restart_repmgrd.yml
   tags: [never, restart-repmgrd, standby-to-primary]