application.yml

---
- name: Initial bootstrap
  hosts: all

  vars:
    app_version: master # f7c5b0b95d443e8934e4ff7d04937fd77ca70001
    disktype: sd
    base_packages:
      - htop
      - aptitude
      - bind9-utils
      - dnsutils
      - apache2
      - composer
      - prometheus
      - python3-pymysql
      - mariadb-client
      - rrdtool
      - rabbitmq-server
      - cron
  tasks:

    - name: Retrieve configuration
      ansible.builtin.git:
        repo: git@github.com:stwalkerster/acc-aws-config.git
        dest: /srv/config
        version: main
        recursive: false
        accept_hostkey: true
        force: yes
        key_file: /etc/config_deployment_key

    - name: Configuration key
      community.general.git_config:
        name: core.sshCommand
        repo: /srv/config
        scope: local
        value: 'ssh -i /etc/config_deployment_key'

    - name: Install packages
      apt:
        update_cache: yes
        name: "{{ base_packages }}"
      notify: Restart apache2

    - name: Install bullseye packages
      apt:
        update_cache: yes
        name: '{{item}}'
      notify: Restart apache2
      loop:
      - libapache2-mod-php7.4
      - php7.4-cli
      - php7.4-curl
      - php7.4-gd
      - php7.4-mbstring
      - php7.4-mysql
      - php7.4-xml
      - nodejs
      when: ansible_facts['distribution_release'] == "bullseye"
    
    - name: Install bookworm packages
      apt:
        update_cache: yes
        name: '{{item}}'
      notify: Restart apache2
      loop:
      - libapache2-mod-php8.2
      - php8.2-cli
      - php8.2-curl
      - php8.2-gd
      - php8.2-mbstring
      - php8.2-mysql
      - php8.2-xml
      - npm
      when: ansible_facts['distribution_release'] == "bookworm"


    - name: Enable the Apache2 modules
      community.general.apache2_module:
        state: present
        name: "{{ item }}"
      notify: Restart apache2
      loop:
        - headers
        - proxy
        - proxy_http
        - rewrite

    - name: Remove default vhost
      ansible.builtin.file:
        path: /etc/apache2/sites-enabled/000-default.conf
        state: absent
      notify: Restart apache2

    - name: Deploy Prod vhost
      ansible.builtin.copy:
        src: etc/apache2/sites-enabled/production.conf
        dest: /etc/apache2/sites-enabled/production.conf
        owner: root
        group: root
        mode: '0644'
      notify: Restart apache2

    - name: Deploy Dev vhost
      ansible.builtin.copy:
        src: etc/apache2/sites-enabled/dev.conf
        dest: /etc/apache2/sites-enabled/dev.conf
        owner: root
        group: root
        mode: '0644'
      notify: Restart apache2

    - name: Enable RabbitMQ plugins
      community.rabbitmq.rabbitmq_plugin:
        names: rabbitmq_management,rabbitmq_shovel_management
        state: enabled

    - name: Restore RabbitMQ configuration
      ansible.builtin.shell:
        cmd: rabbitmqctl import_definitions /srv/config/rabbit-config.json

    - name: Remove RabbitMQ guest user
      ansible.builtin.shell:
        cmd: rabbitmqctl delete_user guest
      ignore_errors: true

    - name: Deploy compliance
      ansible.builtin.git:
        repo: https://github.com/enwikipedia-acc/compliance.git
        dest: /srv/compliance
        version: main
        recursive: false
        accept_hostkey: true
        force: yes

    - name: Deploy XFF
      ansible.builtin.git:
        repo: https://github.com/wikimedia/mediawiki-extensions-TrustedXFF.git
        dest: /srv/xff
        version: master
        recursive: false
        accept_hostkey: true
        force: yes

    - name: Git directory configuration
      ansible.builtin.copy:
        content: |
          # MANAGED BY ANSIBLE
          [safe]
              directory = /srv/production
              directory = /srv/dev/rc
              directory = /srv/dev/demo
        dest: /etc/gitconfig

    - name: www-data .npm folder
      ansible.builtin.file:
        path: /var/www/.npm
        state: directory
        owner: www-data
        group: www-data

    - name: Install application
      include_tasks: install-application.yml
      loop:
        - path: /srv/production
          config: /srv/config/application-production.php
        - path: /srv/dev/rc
          config: /srv/config/application-dev-rc.php
        - path: /srv/dev/demo
          config: /srv/config/application-dev-demo.php

    - name: Set up scheduled tasks
      include_tasks: cron.yml

    - name: Prometheus configuration
      ansible.builtin.copy:
        content: |
          # MANAGED BY ANSIBLE
          global:
            scrape_interval:     1m
            evaluation_interval: 1m
          rule_files:
          scrape_configs:
            - job_name: 'prometheus'
              metrics_path: '/prometheus/metrics'
              static_configs:
                - targets: ['localhost:9090']
            - job_name: acc
              scheme: https
              tls_config:
                insecure_skip_verify: true
              static_configs:
                - targets: ['accounts-dev.wmflabs.org']
              metrics_path: '/other/prometheus.php'
        dest: /etc/prometheus/prometheus.yml
      notify: Restart prometheus

    - name: Ensure Prometheus path is set correctly
      ansible.builtin.lineinfile:
        path: /etc/default/prometheus
        regexp: '^ARGS="'
        line: 'ARGS="--web.external-url=http://localhost:9090/prometheus --storage.tsdb.retention.time=365d "'
      notify: Restart prometheus
  handlers:
    - name: Restart apache2
      service:
        name: apache2
        state: restarted

    - name: Restart prometheus
      service:
        name: prometheus
        state: restarted