From 74cb31e24311cd2c0e4a3c795dc9426be512d867 Mon Sep 17 00:00:00 2001 From: Timotej Lazar Date: Tue, 25 Jun 2024 00:52:57 +0200 Subject: [PATCH] netbox: factor out redis role --- roles/netbox/tasks/app.yml | 147 ---------------------------------- roles/netbox/tasks/main.yml | 155 +++++++++++++++++++++++++++++++++--- roles/redis/tasks/main.yml | 9 +++ setup.yml | 1 + 4 files changed, 155 insertions(+), 157 deletions(-) delete mode 100644 roles/netbox/tasks/app.yml create mode 100644 roles/redis/tasks/main.yml diff --git a/roles/netbox/tasks/app.yml b/roles/netbox/tasks/app.yml deleted file mode 100644 index 2a65094..0000000 --- a/roles/netbox/tasks/app.yml +++ /dev/null @@ -1,147 +0,0 @@ -- name: Install dependencies - package: - name: - - git - - python3 - - python3-dev - - py3-pip - - py3-virtualenv - - bash # for upgrade script - - build-base # to build psycopg if not available - - postgresql-dev # likewise - -- name: Checkout repo - become: yes - become_user: '{{ user }}' - git: - repo: https://github.com/netbox-community/netbox.git - dest: '{{ user_info.home }}/app' - version: 'v{{ netbox_version }}' - notify: run migrations - -- name: Copy default config - copy: - dest: '{{ user_info.home }}/app/netbox/netbox/configuration.py' - src: '{{ user_info.home }}/app/netbox/netbox/configuration_example.py' - remote_src: yes - owner: '{{ user_info.uid }}' - group: '{{ user_info.group }}' - force: no - notify: run migrations - -- name: Restrict access to config - file: - path: '{{ user_info.home }}/app/netbox/netbox/configuration.py' - mode: 0600 - -- name: Configure secret key - lineinfile: - path: '{{ user_info.home }}/app/netbox/netbox/configuration.py' - regexp: "^SECRET_KEY = ''" - line: "SECRET_KEY = '{{ lookup('password', '/dev/null', length=50) }}'" - backrefs: yes # don’t set if set already - -- name: Configure base settings and database - lineinfile: - path: '{{ user_info.home }}/app/netbox/netbox/configuration.py' - regexp: '{{ item.key }}' - line: '{{ item.line }}' - loop: - - key: '^ALLOWED_HOSTS = ' - line: "ALLOWED_HOSTS = ['{{ dns_name }}']" - - key: 'USER.*PostgreSQL username' - line: " 'USER': '{{ user }}', # PostgreSQL username" - # XXX unnecessary? - #- key: '(OPTIONS|PASSWORD).*PostgreSQL password' - # line: " 'OPTIONS': { 'passfile': '{{ user_info.home }}/.pgpass' }, # PostgreSQL password" - # not yet compatible, see https://github.com/netbox-community/netbox-topology-views/issues/503 - #- key: '^PLUGINS = ' - # line: "PLUGINS = ['netbox_topology_views']" - notify: run migrations - -- name: Configure OIDC authentication - lineinfile: - path: '{{ user_info.home }}/app/netbox/netbox/configuration.py' - regexp: '{{ item.key }}' - line: '{{ item.line }}' - loop: - - key: "^REMOTE_AUTH_ENABLED =" - line: "REMOTE_AUTH_ENABLED = True" - - key: "^REMOTE_AUTH_BACKEND =" - line: "REMOTE_AUTH_BACKEND = 'social_core.backends.open_id_connect.OpenIdConnectAuth'" - - key: "^SOCIAL_AUTH_OIDC_OIDC_ENDPOINT =" - line: "SOCIAL_AUTH_OIDC_OIDC_ENDPOINT = '{{ lookup('passwordstore', 'vm/'~inventory_hostname, subkey='oidc_endpoint') }}'" - - key: "^SOCIAL_AUTH_OIDC_KEY =" - line: "SOCIAL_AUTH_OIDC_KEY = '{{ lookup('passwordstore', 'vm/'~inventory_hostname, subkey='oidc_client_id') }}'" - - key: "^SOCIAL_AUTH_OIDC_SECRET =" - line: "SOCIAL_AUTH_OIDC_SECRET = '{{ lookup('passwordstore', 'vm/'~inventory_hostname, subkey='oidc_client_secret') }}'" - # TODO the key should really be upn but it doesn’t seem to work - - key: "^SOCIAL_AUTH_OIDC_USERNAME_KEY =" - line: "SOCIAL_AUTH_OIDC_USERNAME_KEY = 'email'" - notify: run migrations - -- name: Set additional requirements - become: yes - become_user: '{{ user }}' - copy: - dest: '{{ user_info.home }}/app/' - src: local_requirements.txt - notify: run migrations - -- meta: flush_handlers - -- name: Create superuser - become: yes - become_user: '{{ user }}' - command: - cmd: '{{ user_info.home }}/app/venv/bin/python {{ user_info.home }}/app/netbox/manage.py shell --interface python' - stdin: | - import sys - from users.models import User - #from django.contrib.auth.models import User - username = '{{ lookup('passwordstore', 'vm/'~inventory_hostname, subkey='admin_user') }}' - if not User.objects.filter(username=username): - User.objects.create_superuser(username, '', # TODO email - '{{ lookup('passwordstore', 'vm/'~inventory_hostname, subkey='admin_pass') }}') - sys.exit(1) - register: result - changed_when: result.rc != 0 - -- name: Set up gunicorn - copy: - dest: /srv/netbox/gunicorn.py - src: /srv/netbox/app/contrib/gunicorn.py - remote_src: yes - force: no - owner: netbox - group: netbox - -- name: Set up cron job - file: - dest: /etc/periodic/daily/netbox-housekeeping.sh - src: /srv/netbox/app/contrib/netbox-housekeeping.sh - state: link - -- name: Install services - template: - dest: '/etc/init.d/{{ item }}' - src: '{{ item }}.initd.j2' - mode: 0755 - loop: - - netbox - - netbox-rq - -- name: Enable services - service: - name: '{{ item }}' - enabled: true - state: started - loop: - - netbox - - netbox-rq - -- name: Set up nginx site - template: - dest: '/etc/nginx/http.d/netbox.conf' - src: 'netbox.conf.j2' - notify: reload nginx diff --git a/roles/netbox/tasks/main.yml b/roles/netbox/tasks/main.yml index 0a96ca7..275a77d 100644 --- a/roles/netbox/tasks/main.yml +++ b/roles/netbox/tasks/main.yml @@ -1,12 +1,14 @@ -- name: Install redis +- name: Install dependencies package: - name: redis - -- name: Enable redis service - service: - name: redis - enabled: true - state: started + name: + - git + - python3 + - python3-dev + - py3-pip + - py3-virtualenv + - bash # for upgrade script + - build-base # to build psycopg if not available + - postgresql-dev # likewise - name: Create group for web service group: @@ -22,5 +24,138 @@ system: yes register: user_info -- name: Set up app - import_tasks: app.yml +- name: Checkout repo + become: yes + become_user: '{{ user }}' + git: + repo: https://github.com/netbox-community/netbox.git + dest: '{{ user_info.home }}/app' + version: 'v{{ netbox_version }}' + notify: run migrations + +- name: Copy default config + copy: + dest: '{{ user_info.home }}/app/netbox/netbox/configuration.py' + src: '{{ user_info.home }}/app/netbox/netbox/configuration_example.py' + remote_src: yes + owner: '{{ user_info.uid }}' + group: '{{ user_info.group }}' + force: no + notify: run migrations + +- name: Restrict access to config + file: + path: '{{ user_info.home }}/app/netbox/netbox/configuration.py' + mode: 0600 + +- name: Configure secret key + lineinfile: + path: '{{ user_info.home }}/app/netbox/netbox/configuration.py' + regexp: "^SECRET_KEY = ''" + line: "SECRET_KEY = '{{ lookup('password', '/dev/null', length=50) }}'" + backrefs: yes # don’t set if set already + +- name: Configure base settings and database + lineinfile: + path: '{{ user_info.home }}/app/netbox/netbox/configuration.py' + regexp: '{{ item.key }}' + line: '{{ item.line }}' + loop: + - key: '^ALLOWED_HOSTS = ' + line: "ALLOWED_HOSTS = ['{{ dns_name }}']" + - key: 'USER.*PostgreSQL username' + line: " 'USER': '{{ user }}', # PostgreSQL username" + # XXX unnecessary? + #- key: '(OPTIONS|PASSWORD).*PostgreSQL password' + # line: " 'OPTIONS': { 'passfile': '{{ user_info.home }}/.pgpass' }, # PostgreSQL password" + # not yet compatible, see https://github.com/netbox-community/netbox-topology-views/issues/503 + #- key: '^PLUGINS = ' + # line: "PLUGINS = ['netbox_topology_views']" + notify: run migrations + +- name: Configure OIDC authentication + lineinfile: + path: '{{ user_info.home }}/app/netbox/netbox/configuration.py' + regexp: '{{ item.key }}' + line: '{{ item.line }}' + loop: + - key: "^REMOTE_AUTH_ENABLED =" + line: "REMOTE_AUTH_ENABLED = True" + - key: "^REMOTE_AUTH_BACKEND =" + line: "REMOTE_AUTH_BACKEND = 'social_core.backends.open_id_connect.OpenIdConnectAuth'" + - key: "^SOCIAL_AUTH_OIDC_OIDC_ENDPOINT =" + line: "SOCIAL_AUTH_OIDC_OIDC_ENDPOINT = '{{ lookup('passwordstore', 'vm/'~inventory_hostname, subkey='oidc_endpoint') }}'" + - key: "^SOCIAL_AUTH_OIDC_KEY =" + line: "SOCIAL_AUTH_OIDC_KEY = '{{ lookup('passwordstore', 'vm/'~inventory_hostname, subkey='oidc_client_id') }}'" + - key: "^SOCIAL_AUTH_OIDC_SECRET =" + line: "SOCIAL_AUTH_OIDC_SECRET = '{{ lookup('passwordstore', 'vm/'~inventory_hostname, subkey='oidc_client_secret') }}'" + # TODO the key should really be upn but it doesn’t seem to work + - key: "^SOCIAL_AUTH_OIDC_USERNAME_KEY =" + line: "SOCIAL_AUTH_OIDC_USERNAME_KEY = 'email'" + notify: run migrations + +- name: Set additional requirements + become: yes + become_user: '{{ user }}' + copy: + dest: '{{ user_info.home }}/app/' + src: local_requirements.txt + notify: run migrations + +- meta: flush_handlers + +- name: Create superuser + become: yes + become_user: '{{ user }}' + command: + cmd: '{{ user_info.home }}/app/venv/bin/python {{ user_info.home }}/app/netbox/manage.py shell --interface python' + stdin: | + import sys + from users.models import User + #from django.contrib.auth.models import User + username = '{{ lookup('passwordstore', 'vm/'~inventory_hostname, subkey='admin_user') }}' + if not User.objects.filter(username=username): + User.objects.create_superuser(username, '', # TODO email + '{{ lookup('passwordstore', 'vm/'~inventory_hostname, subkey='admin_pass') }}') + sys.exit(1) + register: result + changed_when: result.rc != 0 + +- name: Set up gunicorn + copy: + dest: /srv/netbox/gunicorn.py + src: /srv/netbox/app/contrib/gunicorn.py + remote_src: yes + force: no + owner: netbox + group: netbox + +- name: Set up cron job + file: + dest: /etc/periodic/daily/netbox-housekeeping.sh + src: /srv/netbox/app/contrib/netbox-housekeeping.sh + state: link + +- name: Install services + template: + dest: '/etc/init.d/{{ item }}' + src: '{{ item }}.initd.j2' + mode: 0755 + loop: + - netbox + - netbox-rq + +- name: Enable services + service: + name: '{{ item }}' + enabled: true + state: started + loop: + - netbox + - netbox-rq + +- name: Set up nginx site + template: + dest: '/etc/nginx/http.d/netbox.conf' + src: 'netbox.conf.j2' + notify: reload nginx diff --git a/roles/redis/tasks/main.yml b/roles/redis/tasks/main.yml new file mode 100644 index 0000000..83ba893 --- /dev/null +++ b/roles/redis/tasks/main.yml @@ -0,0 +1,9 @@ +- name: Install redis + package: + name: redis + +- name: Enable redis service + service: + name: redis + enabled: true + state: started diff --git a/setup.yml b/setup.yml index 6225f38..c250bf7 100644 --- a/setup.yml +++ b/setup.yml @@ -25,6 +25,7 @@ roles: - alpine - postgres + - redis - nginx - netbox vars: