application.yml

---
- name: Initial bootstrap
  hosts: all

  vars:
    app_version: master # f7c5b0b95d443e8934e4ff7d04937fd77ca70001
    disktype: sd
    base_packages:
      - htop
      - aptitude
      - bind9-utils
      - dnsutils
      - apache2
      - composer
      - prometheus
      - python3-pymysql
      - mariadb-client
      - rrdtool
      - rabbitmq-server
      - cron
  tasks:

    - name: Retrieve configuration
      ansible.builtin.git:
        repo: git@github.com:enwikipedia-acc/configuration.git
        dest: /srv/config
        version: main
        recursive: false
        accept_hostkey: true
        force: yes
        key_file: /etc/config_deployment_key

    - name: Configuration key
      community.general.git_config:
        name: core.sshCommand
        repo: /srv/config
        scope: local
        value: 'ssh -i /etc/config_deployment_key'

    - name: Install packages
      apt:
        update_cache: yes
        lock_timeout: 300
        name: "{{ base_packages }}"
      notify: Restart apache2

    - name: Install bullseye packages
      apt:
        update_cache: yes
        lock_timeout: 300
        name: '{{item}}'
      notify: Restart apache2
      loop:
      - libapache2-mod-php7.4
      - php7.4-cli
      - php7.4-curl
      - php7.4-gd
      - php7.4-mbstring
      - php7.4-mysql
      - php7.4-xml
      - nodejs
      when: ansible_facts['distribution_release'] == "bullseye"
    
    - name: Install bookworm packages
      apt:
        update_cache: yes
        lock_timeout: 300
        name: '{{item}}'
      notify: Restart apache2
      loop:
      - libapache2-mod-php8.2
      - php8.2-cli
      - php8.2-curl
      - php8.2-gd
      - php8.2-mbstring
      - php8.2-mysql
      - php8.2-xml
      - npm
      when: ansible_facts['distribution_release'] == "bookworm"


    - name: Enable the Apache2 modules
      community.general.apache2_module:
        state: present
        name: "{{ item }}"
      notify: Restart apache2
      loop:
        - headers
        - proxy
        - proxy_http
        - rewrite

    - name: Remove default vhost
      ansible.builtin.file:
        path: /etc/apache2/sites-enabled/000-default.conf
        state: absent
      notify: Restart apache2

    - name: Deploy Prod vhost
      ansible.builtin.copy:
        src: etc/apache2/sites-enabled/production.conf
        dest: /etc/apache2/sites-enabled/production.conf
        owner: root
        group: root
        mode: '0644'
      notify: Restart apache2

    - name: Deploy Dev vhost
      ansible.builtin.copy:
        src: etc/apache2/sites-enabled/dev.conf
        dest: /etc/apache2/sites-enabled/dev.conf
        owner: root
        group: root
        mode: '0644'
      notify: Restart apache2

    - name: Enable RabbitMQ plugins
      community.rabbitmq.rabbitmq_plugin:
        names: rabbitmq_management,rabbitmq_shovel_management
        state: enabled

    - name: Restore RabbitMQ configuration
      ansible.builtin.shell:
        cmd: rabbitmqctl import_definitions /srv/config/rabbit-config.json

    - name: Remove RabbitMQ guest user
      ansible.builtin.shell:
        cmd: rabbitmqctl delete_user guest
      ignore_errors: true

    - name: Deploy compliance
      ansible.builtin.git:
        repo: https://github.com/enwikipedia-acc/compliance.git
        dest: /srv/compliance
        version: main
        recursive: false
        accept_hostkey: true
        force: yes

    - name: Deploy XFF
      ansible.builtin.git:
        repo: https://github.com/wikimedia/mediawiki-extensions-TrustedXFF.git
        dest: /srv/xff
        version: master
        recursive: false
        accept_hostkey: true
        force: yes

    - name: Git directory configuration
      ansible.builtin.copy:
        content: |
          # MANAGED BY ANSIBLE
          [safe]
              directory = /srv/production
              directory = /srv/dev/rc
              directory = /srv/dev/demo
        dest: /etc/gitconfig

    - name: www-data .npm folder
      ansible.builtin.file:
        path: /var/www/.npm
        state: directory
        owner: www-data
        group: www-data

    - name: Install application
      include_tasks: install-application.yml
      loop:
        - path: /srv/production
          config: /srv/config/application-production.php
        - path: /srv/dev/rc
          config: /srv/config/application-dev-rc.php
        - path: /srv/dev/demo
          config: /srv/config/application-dev-demo.php

    - name: Set up scheduled tasks
      include_tasks: cron.yml



    - name: /etc/prometheus folder
      ansible.builtin.file:
        path: /etc/prometheus
        state: directory
        owner: root
        group: root
        mode: '0755'

    - name: Prometheus configuration
      ansible.builtin.copy:
        content: |
          # MANAGED BY ANSIBLE
          global:
            scrape_interval:     1m
            evaluation_interval: 1m
          rule_files:
          scrape_configs:
            - job_name: 'prometheus'
              metrics_path: '/prometheus/metrics'
              static_configs:
                - targets: ['localhost:9090']
            - job_name: acc
              scheme: https
              tls_config:
                insecure_skip_verify: true
              static_configs:
                - targets: ['accounts-dev.wmflabs.org']
              metrics_path: '/other/prometheus.php'
        dest: /etc/prometheus/prometheus.yml
      notify: Restart prometheus

    - name: Ensure Prometheus path is set correctly
      ansible.builtin.copy:
        dest: /etc/default/prometheus
        owner: root
        group: root
        mode: '0644'
        content: |
          ARGS="--web.external-url=http://localhost:9090/prometheus --storage.tsdb.retention.time=365d "
      notify: Restart prometheus

    - name: Graphs
      become: true
      become_user: www-data
      become_method: sudo
      ansible.builtin.git:
        repo: https://github.com/enwikipedia-acc/rrdtool.git
        dest: "/srv/dev/graph"
        version: "master"
        recursive: false
        accept_hostkey: true
        force: yes

    - name: Deployment script
      become: true
      become_user: www-data
      become_method: sudo
      ansible.builtin.git:
        repo: http://github.com/enwikipedia-acc/deploy
        dest: "/srv/dev/deploy"
        version: "master"
        recursive: false
        accept_hostkey: true
        force: yes

    - name: Deployment script configuration
      ansible.builtin.file:
        path: "/srv/dev/deploy/config.inc.php"
        state: link
        src: "/srv/config/deployment.php"

    - name: Reporting script
      become: true
      become_user: www-data
      become_method: sudo
      ansible.builtin.git:
        repo: http://github.com/enwikipedia-acc/reporting
        dest: "/srv/dev/report"
        version: "main"
        recursive: false
        accept_hostkey: true
        force: yes

    - name: Reporting script configuration
      ansible.builtin.file:
        path: "/srv/dev/report/config.php"
        state: link
        src: "/srv/config/reporting.php"

    - name: Reporting script - Install composer dependencies
      become: true
      become_user: www-data
      become_method: sudo
      ansible.builtin.shell:
        cmd: bash -l -c 'export COMPOSER_HOME=/tmp; composer install'
        chdir: "/srv/dev/report/"

  handlers:
    - name: Restart apache2
      service:
        name: apache2
        state: restarted

    - name: Restart prometheus
      service:
        name: prometheus
        state: restarted