diff options
Diffstat (limited to 'tasks')
| -rw-r--r-- | tasks/apt.yml | 9 | ||||
| -rw-r--r-- | tasks/base.yml | 4 | ||||
| -rw-r--r-- | tasks/httpd.yml | 19 | ||||
| -rw-r--r-- | tasks/mail.yml | 10 | ||||
| -rw-r--r-- | tasks/network.yml | 1 | ||||
| -rw-r--r-- | tasks/webmap.yml | 433 |
6 files changed, 469 insertions, 7 deletions
diff --git a/tasks/apt.yml b/tasks/apt.yml index 1023908..f17a2e4 100644 --- a/tasks/apt.yml +++ b/tasks/apt.yml @@ -5,8 +5,13 @@ - apt - lsb-release -- name: Remove /etc/apt/sources.list - file: path=/etc/apt/sources.list state=absent +# something keeps recreating (without content) it if we delete it, so we +# leave it instead but ensure it's empty instead +- name: Create empty /etc/apt/sources.list + copy: content="" + dest=/etc/apt/sources.list + owner=root group=root + mode=0644 notify: - apt-get update diff --git a/tasks/base.yml b/tasks/base.yml index 623d209..ad8b1f0 100644 --- a/tasks/base.yml +++ b/tasks/base.yml @@ -18,7 +18,6 @@ - dosfstools - eatmydata - acpid - - acl - fdisk - gdisk - genisoimage @@ -106,6 +105,7 @@ apt: pkg={{ packages }} vars: packages: + - acl - bind9-dnsutils - bzip2 - htop @@ -114,10 +114,12 @@ - python3 - less - iproute2 + - jq - git - curl - screen - sudo + - tig - vim-nox - qemu-guest-agent # Useful for `getent passwd dynamic_user` diff --git a/tasks/httpd.yml b/tasks/httpd.yml index 2138d35..2e1fa98 100644 --- a/tasks/httpd.yml +++ b/tasks/httpd.yml @@ -2,6 +2,12 @@ - name: Install nginx apt: pkg=nginx-light +- name: Install nginx modules + apt: pkg={{ packages }} + vars: + packages: + - libnginx-mod-http-brotli-static + - name: Start nginx service: name=nginx enabled=true state=started @@ -29,13 +35,20 @@ mode=0644 notify: Reload nginx -- name: Copy /etc/nginx/sites-enabled/webmap - copy: src=etc/nginx/sites-enabled/webmap - dest=/etc/nginx/sites-enabled/webmap +- name: Copy /etc/nginx/sites-available/webmap + copy: src=etc/nginx/sites-available/webmap + dest=/etc/nginx/sites-available/webmap owner=root group=root mode=0644 notify: Reload nginx +- name: Create /etc/nginx/sites-enabled/webmap + file: src=../sites-available/webmap + dest=/etc/nginx/sites-enabled/webmap + owner=root group=root + state=link force=yes + notify: Reload nginx + - name: Create directory /var/www/webmap file: path=/var/www/webmap state=directory diff --git a/tasks/mail.yml b/tasks/mail.yml index 89d8530..8f58c8a 100644 --- a/tasks/mail.yml +++ b/tasks/mail.yml @@ -13,7 +13,7 @@ notify: - Run newaliases -- name: Configure Postfix +- name: Configure Postfix (main.cf) template: src=etc/postfix/main.cf.j2 dest=/etc/postfix/main.cf owner=root group=root @@ -21,6 +21,14 @@ notify: - Reload Postfix +- name: Configure Postfix (master.cf) + copy: src=etc/postfix/master.cf + dest=/etc/postfix/master.cf + owner=root group=root + mode=0644 + notify: + - Restart Postfix + - name: Start Postfix service: name=postfix.service enabled=true state=started diff --git a/tasks/network.yml b/tasks/network.yml index 1551f82..a02b07c 100644 --- a/tasks/network.yml +++ b/tasks/network.yml @@ -32,6 +32,7 @@ packages: - systemd-resolved - libnss-resolve + - libnss-myhostname - name: Create directory /etc/systemd/resolved.conf.d file: path=/etc/systemd/resolved.conf.d diff --git a/tasks/webmap.yml b/tasks/webmap.yml new file mode 100644 index 0000000..de320d4 --- /dev/null +++ b/tasks/webmap.yml @@ -0,0 +1,433 @@ +- name: Install gdal-bin + apt: pkg=gdal-bin install-recommends=true + +- name: Install unzip and brotli + apt: pkg={{ packages }} + vars: + packages: + - unzip + - brotli + +- name: Install python dependencies + apt: pkg={{ packages }} + vars: + packages: + - python3 + - python3-brotli + - python3-gdal + - python3-requests + - python3-systemd + - python3-tqdm + - python3-urllib3 + - python3-xdg + - python3-yaml + +- name: Create directory /etc/webmap + file: path=/etc/webmap + state=directory + owner=root group=root + mode=0755 + +- name: Copy /etc/webmap/config.yml + copy: src=webmap-tools/config.yml + dest=/etc/webmap/config.yml + owner=root group=root + mode=0644 + +- name: Create directory /usr/local/share/webmap + file: path=/usr/local/share/webmap + state=directory + owner=root group=root + mode=0755 + +- name: Copy /usr/local/share/webmap/*.py modules + copy: src=webmap-tools/{{ item }} + dest=/usr/local/share/webmap/{{ item }} + owner=root group=root + mode=0644 + with_items: + # TODO these should be compiled + - common.py + - common_gdal.py + - import_source.py + - export_mvt.py + - rename_exchange.py + +- name: Copy webmap-update@.target + copy: src=etc/systemd/system/webmap-update@.target + dest=/etc/systemd/system/webmap-update@.target + owner=root group=root + mode=0644 + notify: + - systemctl daemon-reload + +- name: Copy webmap-update@.timer + copy: src=etc/systemd/system/webmap-update@.timer + dest=/etc/systemd/system/webmap-update@.timer + owner=root group=root + mode=0644 + notify: + - systemctl daemon-reload + +- name: Create directory /etc/systemd/system/webmap-update@*.timer.d + file: path=/etc/systemd/system/webmap-update@{{ item }}.timer.d + state=directory + owner=root group=root + mode=0755 + with_items: "{{ webmap_layer_groups_update_calendar.keys() | list }}" + +- name: Copy /etc/systemd/system/webmap-update@*.timer.d/override.conf + template: src=etc/systemd/system/webmap-update@.timer.d/override.conf.j2 + dest=/etc/systemd/system/webmap-update@{{ item }}.timer.d/override.conf + owner=root group=root + mode=0644 + with_items: "{{ webmap_layer_groups_update_calendar.keys() | list }}" + notify: + - systemctl daemon-reload + +- name: Enable webmap-update.timer + service: name=webmap-update@{{ item }}.timer state=started enabled=true + with_items: "{{ webmap_layer_groups }}" + +- meta: flush_handlers + + +- name: Create system group '_webmap' + group: name=_webmap system=true + state=present + +- name: Create system user '_webmap-download' + user: name=_webmap-download system=true + group=_webmap + createhome=false + home=/nonexistent + shell=/usr/sbin/nologin + comment="Webmap update (download)" + password="!" + state=present + +- name: Copy /usr/local/share/webmap/download.py + copy: src=webmap-tools/webmap-download + dest=/usr/local/share/webmap/download.py + owner=root group=root + mode=0755 + +- name: Create /usr/local/bin/webmap-download + file: src=../share/webmap/download.py + dest=/usr/local/bin/webmap-download + owner=root group=root + state=link force=yes + +- name: Create directory /var/cache/webmap + file: path=/var/cache/webmap + state=directory + owner=_webmap-download group=root + mode=0755 + +- name: Create directory /var/cache/webmap/custom + file: path=/var/cache/webmap/custom + state=directory + owner=root group=root + mode=0755 + +- name: Copy custom layers into /var/cache/webmap/custom + copy: src=webmap-tools/layers/custom/ + dest=/var/cache/webmap/custom/ + owner=root group=root + mode=0644 + directory_mode=0755 + +- name: Copy webmap-download@.service + copy: src=etc/systemd/system/webmap-download@.service + dest=/etc/systemd/system/webmap-download@.service + owner=root group=root + mode=0644 + notify: + - systemctl daemon-reload + +- name: Enable webmap-download@.service + service: name=webmap-download@{{ item }}.service enabled=true + with_items: "{{ webmap_layer_groups | difference(webmap_layer_groups_nodownload) }}" + +- name: Disable some webmap-download@.service + service: name=webmap-download@{{ item }}.service enabled=false + with_items: "{{ webmap_layer_groups_nodownload }}" + +- meta: flush_handlers + + +- name: Create system user '_webmap' + user: name=_webmap system=true + group=_webmap + createhome=false + home=/nonexistent + shell=/usr/sbin/nologin + comment="Webmap update (extract/import)" + password="!" + state=present + +- name: Install PostgreSQL and PostGIS + apt: pkg={{ packages }} + vars: + packages: + - postgresql + - postgresql-postgis + - postgis + # for ansible + - python3-psycopg + +- name: Generate sv_SE.UTF-8 locales + locale_gen: name=sv_SE.UTF-8 state=present + # PostgreSQL needs to be restarted to see the new locale + notify: Restart PostgreSQL + +- name: Configure PostgreSQL + copy: src=etc/postgresql/postgresql.conf + dest=/etc/postgresql/{{ postgresql.version }}/{{ postgresql.cluster }}/conf.d/local.conf + owner=postgres group=postgres + mode=0644 + notify: Restart PostgreSQL + +- name: Start PostgreSQL + service: name=postgresql@{{ postgresql.version }}-{{ postgresql.cluster }}.service state=started + +- meta: flush_handlers + +# Usage: \sudo -u postgres psql </usr/local/share/webmap/schema.sql +- name: Copy /usr/local/share/webmap/schema.sql + copy: src=webmap-tools/schema.sql + dest=/usr/local/share/webmap/schema.sql + owner=root group=root + mode=0644 + +- name: Create PostgreSQL database + become: true + # XXX: this creates /var/lib/postgresql/.ansible/tmp + become_user: postgres + community.postgresql.postgresql_db: + name: webmap + comment: Backend PostGIS database for KlimatanalysNorr tooling + encoding: UTF-8 + lc_collate: sv_SE.UTF-8 + lc_ctype: sv_SE.UTF-8 + locale_provider: icu + icu_locale: sv-SE-x-icu + template: template0 + owner: postgres + +- name: Create 'webmap_import' and 'webmap_guest' PostgreSQL users (roles) + become: true + become_user: postgres + community.postgresql.postgresql_user: + login_db: webmap + name: "{{ item }}" + with_items: + - webmap_import + - webmap_guest + +- name: Add a rule for 'webmap_import' user in pg_hba.conf + ansible.builtin.lineinfile: + path: /etc/postgresql/{{ postgresql.version }}/{{ postgresql.cluster }}/pg_hba.conf + regexp: '^local\s+webmap\s' + line: 'local webmap all peer map=pgmap_webmap' + # must come before 'local all all peer', cf. + # https://dba.stackexchange.com/questions/177142/postgresql-cannot-peer-authenticate-using-usermap-provided-user-name-dbuser + insertbefore: '^local\s+all\s+all\s' + create: false + notify: Reload PostgreSQL + +- name: Add a mapping rule for 'webmap_import' user in pg_ident.conf + ansible.builtin.lineinfile: + path: /etc/postgresql/{{ postgresql.version }}/{{ postgresql.cluster }}/pg_ident.conf + regexp: '^pgmap_webmap\s.*\swebmap_import\s*$' + line: 'pgmap_webmap _webmap webmap_import' + create: false + notify: Reload PostgreSQL + +- name: Add a mapping rule for 'webmap_guest' user in pg_ident.conf + ansible.builtin.lineinfile: + path: /etc/postgresql/{{ postgresql.version }}/{{ postgresql.cluster }}/pg_ident.conf + regexp: '^pgmap_webmap\s.*\swebmap_guest\s*$' + line: 'pgmap_webmap /^_?[a-zA-Z][a-zA-Z0-9_\-]*[a-zA-Z0-9]$ webmap_guest' + create: false + notify: Reload PostgreSQL + +- name: Create 'postgis' PostgreSQL schema + become: true + become_user: postgres + community.postgresql.postgresql_schema: + name: postgis + login_db: webmap + owner: postgres + +- name: Install 'postgis' PostgreSQL extension to the webmap database in the postgis schema + become: true + become_user: postgres + community.postgresql.postgresql_ext: + name: postgis + login_db: webmap + schema: postgis + comment: Geographic objects support for PostgreSQL + +- name: GRANT CONNECT ON DATABASE webmap TO webmap_import, webmap_guest + become: true + become_user: postgres + community.postgresql.postgresql_privs: + login_db: webmap + privs: CONNECT + type: database + role: webmap_import,webmap_guest + +- name: GRANT USAGE ON SCHEMA postgis TO webmap_import, webmap_guest + become: true + become_user: postgres + community.postgresql.postgresql_privs: + login_db: webmap + privs: USAGE + type: schema + obj: postgis + role: webmap_import,webmap_guest + +# webmap-import should TRUNCATE existing output layers +- name: REVOKE CREATE ON SCHEMA postgis FROM webmap_import + become: true + become_user: postgres + community.postgresql.postgresql_privs: + login_db: webmap + privs: CREATE + type: schema + obj: postgis + role: webmap_import + state: absent + +- name: GRANT SELECT ON TABLES IN SCHEMA postgis TO webmap_guest + become: true + become_user: postgres + community.postgresql.postgresql_privs: + login_db: webmap + privs: SELECT + type: table + obj: ALL_IN_SCHEMA + schema: postgis + role: webmap_guest + +- name: GRANT USAGE, SELECT ON SEQUENCES IN SCHEMA postgis TO webmap_guest + become: true + become_user: postgres + community.postgresql.postgresql_privs: + login_db: webmap + privs: USAGE,SELECT + type: sequence + obj: ALL_IN_SCHEMA + schema: postgis + role: webmap_guest + +- name: Copy /usr/local/share/webmap/import.py + copy: src=webmap-tools/webmap-import + dest=/usr/local/share/webmap/import.py + owner=root group=root + mode=0755 + +- name: Create /usr/local/bin/webmap-import + file: src=../share/webmap/import.py + dest=/usr/local/bin/webmap-import + owner=root group=root + state=link force=yes + +- name: Copy webmap-import@.service + copy: src=etc/systemd/system/webmap-import@.service + dest=/etc/systemd/system/webmap-import@.service + owner=root group=root + mode=0644 + notify: + - systemctl daemon-reload + +- name: Enable webmap-import@.service + service: name=webmap-import@{{ item }}.service enabled=true + with_items: "{{ webmap_layer_groups }}" + + +- name: Build administrative-codes.json* + become: false + local_action: + module: community.general.make + chdir: ./webmap-tools/administrative-codes + target: all + +- name: Create directory /var/www/webmap/data + file: path=/var/www/webmap/data + state=directory + owner=root group=root + mode=0755 + +- name: Copy /var/www/webmap/data/administrative-codes.json* + copy: src=./webmap-tools/administrative-codes/{{ item }} + dest=/var/www/webmap/data/{{ item }} + owner=root group=root + mode=0644 + with_items: + - administrative-codes.json + - administrative-codes.json.br + +- meta: flush_handlers + + +- name: Create directory /var/www/webmap/tiles + file: path=/var/www/webmap/tiles + state=directory + owner=_webmap group=root + mode=0755 + + +- name: Copy /etc/tmpfiles.d/webmap.conf + copy: src=etc/tmpfiles.d/webmap.conf + dest=/etc/tmpfiles.d/webmap.conf + owner=root group=root + mode=0644 + notify: + - systemd-tmpfiles --create + +- meta: flush_handlers + + +- name: Install Python/WSGI dependencies + apt: pkg={{ packages }} + vars: + packages: + - uwsgi-core + - uwsgi-plugin-python3 + # TODO[trixie]: install python3-psycopg-c instead + - python3-psycopg + +- name: Copy webmap-cgi.socket + copy: src=etc/systemd/system/webmap-cgi.socket + dest=/etc/systemd/system/webmap-cgi.socket + owner=root group=root + mode=0644 + notify: + - systemctl daemon-reload + +- name: Copy webmap-cgi.service + copy: src=etc/systemd/system/webmap-cgi.service + dest=/etc/systemd/system/webmap-cgi.service + owner=root group=root + mode=0644 + notify: + - systemctl daemon-reload + - Stop webmap-cgi.service + +- name: Copy /usr/libexec/webmap-cgi + copy: src=./webmap-tools/webmap-cgi + dest=/usr/libexec/webmap-cgi + owner=root group=root + mode=0755 + notify: + - Stop webmap-cgi.service + +- meta: flush_handlers + +- name: Enable webmap-cgi.socket + service: name=webmap-cgi.socket state=started enabled=true + +- name: Disable webmap-cgi.service + service: name=webmap-cgi.service enabled=false |