SMARCH-46: smardigo self service portal (wip)
Sven Ketelsen
5 years ago
parent
2c9a9029ad
commit
7f7054244b
@ -1,5 +0,0 @@
|
||||
---
|
||||
|
||||
hetzner_server_labels: "stage={{ stage }} service=ansible"
|
||||
|
||||
hetzner_server_type: cx31
|
||||
@ -1,15 +0,0 @@
|
||||
---
|
||||
|
||||
hetzner_server_labels: "stage={{ stage }} service=connect"
|
||||
|
||||
connect_auth_module: oidc
|
||||
connect_oidc_client_id: connect-01
|
||||
connect_oidc_client_secret: 9e234965-1041-4653-8a0e-db964c04bc26
|
||||
connect_oidc_registration_id: connect-01
|
||||
connect_oidc_issuer_uri: https://{{ keycloak_hostname }}/auth/realms/smardigo-01
|
||||
|
||||
connect_password_change_url: https://{{ keycloak_hostname }}/auth/realms/smardigo-01/account/password
|
||||
connect_iam_user_management_url: https://{{ keycloak_hostname }}/auth/admin/smardigo-01/console
|
||||
|
||||
spring_profiles_include_suffix: ",hetzner"
|
||||
ribbon_display_on_active_profiles: "hetzner"
|
||||
@ -1,15 +0,0 @@
|
||||
---
|
||||
|
||||
hetzner_server_labels: "stage={{ stage }} service=connect"
|
||||
|
||||
connect_auth_module: oidc
|
||||
connect_oidc_client_id: connect-02
|
||||
connect_oidc_client_secret: 9e234965-1041-4653-8a0e-db964c04bc26
|
||||
connect_oidc_registration_id: connect-02
|
||||
connect_oidc_issuer_uri: https://{{ keycloak_hostname }}/auth/realms/smardigo-01
|
||||
|
||||
connect_password_change_url: https://{{ keycloak_hostname }}/auth/realms/smardigo-01/account/password
|
||||
connect_iam_user_management_url: https://{{ keycloak_hostname }}/auth/admin/smardigo-01/console
|
||||
|
||||
spring_profiles_include_suffix: ",hetzner"
|
||||
ribbon_display_on_active_profiles: "hetzner"
|
||||
@ -0,0 +1,4 @@
|
||||
---
|
||||
|
||||
hetzner_server_type: cx21
|
||||
hetzner_server_labels: "stage={{ stage }} service=iam"
|
||||
@ -1,17 +1,10 @@
|
||||
---
|
||||
|
||||
hetzner_server_labels: "stage={{ stage }} service=connect"
|
||||
|
||||
hetzner_server_type: cpx21
|
||||
|
||||
connect_auth_module: oidc
|
||||
connect_oidc_client_id: management-smardigo
|
||||
connect_oidc_client_secret: f1f852b4-2e75-889a-2453-3c55d53ce405
|
||||
connect_oidc_registration_id: management-smardigo
|
||||
connect_oidc_issuer_uri: https://{{ keycloak_hostname }}/auth/realms/smardigo
|
||||
|
||||
connect_password_change_url: https://{{ keycloak_hostname }}/auth/realms/smardigo/account/password
|
||||
connect_iam_user_management_url: https://{{ keycloak_hostname }}/auth/admin/smardigo/console
|
||||
connect_oidc_issuer_uri: https://{{ shared_service_keycloak_hostname }}/auth/realms/smardigo
|
||||
|
||||
spring_profiles_include_suffix: ",hetzner"
|
||||
ribbon_display_on_active_profiles: "hetzner"
|
||||
connect_password_change_url: https://{{ shared_service_keycloak_hostname }}/auth/realms/smardigo/account/password
|
||||
connect_iam_user_management_url: https://{{ shared_service_keycloak_hostname }}/auth/admin/smardigo/console
|
||||
|
||||
@ -1,20 +0,0 @@
|
||||
---
|
||||
|
||||
#############################################################################
|
||||
### only for testing purposes -> copy of dynamic_connect
|
||||
#############################################################################
|
||||
|
||||
hetzner_server_type: cx21
|
||||
hetzner_server_labels: "stage={{ stage }} service={{ service }}"
|
||||
|
||||
# TODO create realm/client for tenant and service
|
||||
connect_auth_module: oidc
|
||||
connect_oidc_client_id: connect-01
|
||||
connect_oidc_client_secret: 9e234965-1041-4653-8a0e-db964c04bc26
|
||||
connect_oidc_registration_id: connect-01
|
||||
connect_oidc_issuer_uri: https://{{ keycloak_hostname }}/auth/realms/smardigo-01
|
||||
connect_password_change_url: https://{{ keycloak_hostname }}/auth/realms/smardigo-01/account/password
|
||||
connect_iam_user_management_url: https://{{ keycloak_hostname }}/auth/admin/smardigo-01/console
|
||||
|
||||
spring_profiles_include_suffix: ",{{ inventory_hostname }}"
|
||||
ribbon_display_on_active_profiles: "{{ inventory_hostname }}"
|
||||
@ -1,20 +0,0 @@
|
||||
---
|
||||
|
||||
#############################################################################
|
||||
### only for testing purposes -> copy of dynamic_connect
|
||||
#############################################################################
|
||||
|
||||
hetzner_server_type: cx21
|
||||
hetzner_server_labels: "stage={{ stage }} service={{ service }}"
|
||||
|
||||
# TODO create realm/client for tenant and service
|
||||
connect_auth_module: oidc
|
||||
connect_oidc_client_id: connect-01
|
||||
connect_oidc_client_secret: 9e234965-1041-4653-8a0e-db964c04bc26
|
||||
connect_oidc_registration_id: connect-01
|
||||
connect_oidc_issuer_uri: https://{{ keycloak_hostname }}/auth/realms/smardigo-01
|
||||
connect_password_change_url: https://{{ keycloak_hostname }}/auth/realms/smardigo-01/account/password
|
||||
connect_iam_user_management_url: https://{{ keycloak_hostname }}/auth/admin/smardigo-01/console
|
||||
|
||||
spring_profiles_include_suffix: ",{{ inventory_hostname }}"
|
||||
ribbon_display_on_active_profiles: "{{ inventory_hostname }}"
|
||||
@ -1,21 +0,0 @@
|
||||
---
|
||||
|
||||
- name: 'apply setup to {{ host | default("all") }}'
|
||||
hosts: '{{ host | default("all") }}'
|
||||
serial: "{{ serial_number | default(1) }}"
|
||||
gather_facts: no
|
||||
become: no
|
||||
|
||||
pre_tasks:
|
||||
- name: "Check if ansible version is at least 2.10.x"
|
||||
assert:
|
||||
that:
|
||||
- ansible_version.major >= 2
|
||||
- ansible_version.minor >= 10
|
||||
msg: "The ansible version has to be at least ({{ ansible_version.full }})"
|
||||
|
||||
roles:
|
||||
- role: hetzner-network
|
||||
vars:
|
||||
hetzner_state: 'started'
|
||||
when: "'hcloud' in group_names"
|
||||
@ -1,5 +0,0 @@
|
||||
{
|
||||
"id": "{{ current_user.userId }}",
|
||||
"firstName": "{{ current_user.firstName | default('null') }}",
|
||||
"lastName": "{{ current_user.lastName | default('null') }}"
|
||||
}
|
||||
@ -1,45 +1,91 @@
|
||||
---
|
||||
|
||||
- name: "Gather current server infos for network <{{ current_network_name }}>"
|
||||
hcloud_server_info:
|
||||
#- name: "Gathering current server infos for network <{{ current_network_name }}>"
|
||||
# hcloud_server_info:
|
||||
# api_token: "{{ hetzner_authentication_token }}"
|
||||
# label_selector: "{{ current_server_label_selector }}"
|
||||
# register: network_hetzner_server_infos
|
||||
# delegate_to: 127.0.0.1
|
||||
# become: false
|
||||
# tags:
|
||||
# - update_networks
|
||||
|
||||
#- name: "Setting current server infos for network <{{ current_network_name }}> as fact: network_hetzner_server_infos_json"
|
||||
# set_fact:
|
||||
# network_hetzner_server_infos_json: "{{ network_hetzner_server_infos.hcloud_server_info }}"
|
||||
# delegate_to: 127.0.0.1
|
||||
# become: false
|
||||
# tags:
|
||||
# - update_networks
|
||||
|
||||
#- name: "Printing current server infos for network <{{ current_network_name }}>"
|
||||
# debug:
|
||||
# var: network_hetzner_server_infos_json
|
||||
# delegate_to: 127.0.0.1
|
||||
# become: false
|
||||
# when:
|
||||
# - debug
|
||||
# tags:
|
||||
# - update_networks
|
||||
|
||||
#- name: "Setting nerwork server names as fact: network_server_names"
|
||||
# set_fact:
|
||||
# network_server_names: "{{ network_hetzner_server_infos_json | json_query(jmesquery) }}"
|
||||
# vars:
|
||||
# jmesquery: '[*].{name: name}'
|
||||
# tags:
|
||||
# - update_networks
|
||||
|
||||
#- name: "Printing nerwork server names"
|
||||
# debug:
|
||||
# var: network_server_names
|
||||
# delegate_to: 127.0.0.1
|
||||
# become: false
|
||||
# when:
|
||||
# - debug
|
||||
# tags:
|
||||
# - update_networks
|
||||
|
||||
- name: "Checking present state for network <{{ current_network_name }}>"
|
||||
hcloud_network:
|
||||
api_token: "{{ hetzner_authentication_token }}"
|
||||
label_selector: "{{ current_server_label_selector }}"
|
||||
register: network_hetzner_server_infos
|
||||
name: "{{ current_network_name }}"
|
||||
labels: "{{ current_network_labels }}"
|
||||
ip_range: 10.0.0.0/16
|
||||
state: present
|
||||
delegate_to: 127.0.0.1
|
||||
become: false
|
||||
tags:
|
||||
- update_networks
|
||||
|
||||
- name: "Set current server infos for network <{{ current_network_name }}> as fact: network_hetzner_server_infos_json"
|
||||
set_fact:
|
||||
network_hetzner_server_infos_json: "{{ network_hetzner_server_infos.hcloud_server_info }}"
|
||||
- name: "Checking present state for subnetwork for <{{ current_network_name }}>"
|
||||
hcloud_subnetwork:
|
||||
api_token: "{{ hetzner_authentication_token }}"
|
||||
network: "{{ current_network_name }}"
|
||||
ip_range: 10.0.0.0/16
|
||||
network_zone: eu-central
|
||||
type: cloud
|
||||
state: present
|
||||
delegate_to: 127.0.0.1
|
||||
become: false
|
||||
tags:
|
||||
- update_networks
|
||||
|
||||
#- name: "Print the gathered infos for network <{{ current_network_name }}>"
|
||||
# debug:
|
||||
# var: network_hetzner_server_infos_json
|
||||
#- name: "Checking present state for network servers"
|
||||
# hcloud_server_network:
|
||||
# api_token: "{{ hetzner_authentication_token }}"
|
||||
# network: "{{ current_network_name }}"
|
||||
# server: "{{ item.name }}"
|
||||
# state: present
|
||||
# with_items: "{{ network_server_names }}"
|
||||
# delegate_to: 127.0.0.1
|
||||
# become: false
|
||||
# tags:
|
||||
# - update_networks
|
||||
|
||||
- name: "Set nerwork server names as fact: network_server_names"
|
||||
set_fact:
|
||||
network_server_names: "{{ network_hetzner_server_infos_json | json_query(jmesquery) }}"
|
||||
vars:
|
||||
jmesquery: '[*].{name: name}'
|
||||
tags:
|
||||
- update_networks
|
||||
|
||||
- name: "Create network <{{ current_network_name }}>"
|
||||
- name: "Checking present state for network servers"
|
||||
hcloud_server_network:
|
||||
api_token: "{{ hetzner_authentication_token }}"
|
||||
network: "{{ current_network_name }}"
|
||||
server: "{{ item.name }}"
|
||||
server: "{{ inventory_hostname }}"
|
||||
state: present
|
||||
with_items: "{{ network_server_names }}"
|
||||
delegate_to: 127.0.0.1
|
||||
become: false
|
||||
tags:
|
||||
- update_networks
|
||||
|
||||
@ -1 +0,0 @@
|
||||
---
|
||||
@ -1,61 +0,0 @@
|
||||
---
|
||||
|
||||
### tags:
|
||||
|
||||
# TODO remove static ip configuration
|
||||
- name: Create a server network and specify the ip address
|
||||
hcloud_server_network:
|
||||
api_token: "{{ hetzner_authentication_token }}"
|
||||
network: dev-elastic-stack
|
||||
server: dev-elastic-stack-01
|
||||
ip: 10.0.0.2
|
||||
state: present
|
||||
delegate_to: 127.0.0.1
|
||||
|
||||
# TODO remove static ip configuration
|
||||
- name: Create a server network and specify the ip address
|
||||
hcloud_server_network:
|
||||
api_token: "{{ hetzner_authentication_token }}"
|
||||
network: dev-elastic-stack
|
||||
server: dev-elastic-stack-02
|
||||
ip: 10.0.0.3
|
||||
state: present
|
||||
delegate_to: 127.0.0.1
|
||||
|
||||
# TODO remove static ip configuration
|
||||
- name: Create a server network and specify the ip address
|
||||
hcloud_server_network:
|
||||
api_token: "{{ hetzner_authentication_token }}"
|
||||
network: dev-elastic-stack
|
||||
server: dev-elastic-stack-03
|
||||
ip: 10.0.0.4
|
||||
state: present
|
||||
delegate_to: 127.0.0.1
|
||||
|
||||
- name: Create a server network and specify the ip address
|
||||
hcloud_server_network:
|
||||
api_token: "{{ hetzner_authentication_token }}"
|
||||
network: dev-elastic-stack
|
||||
server: "{{ item }}"
|
||||
state: present
|
||||
with_items: "{{ groups['hcloud'] | difference(groups['elastic']) }}"
|
||||
delegate_to: 127.0.0.1
|
||||
|
||||
# TODO remove static ip configuration
|
||||
- name: Create a server network and specify the ip address
|
||||
hcloud_server_network:
|
||||
api_token: "{{ hetzner_authentication_token }}"
|
||||
network: dev-keycloak
|
||||
server: dev-keycloak-01
|
||||
ip: 10.1.0.2
|
||||
state: present
|
||||
delegate_to: 127.0.0.1
|
||||
|
||||
- name: Create a server network and specify the ip address
|
||||
hcloud_server_network:
|
||||
api_token: "{{ hetzner_authentication_token }}"
|
||||
network: dev-keycloak
|
||||
server: "{{ item }}"
|
||||
state: present
|
||||
with_items: "{{ groups['connect'] }}"
|
||||
delegate_to: 127.0.0.1
|
||||
@ -1 +0,0 @@
|
||||
---
|
||||
@ -0,0 +1,5 @@
|
||||
---
|
||||
|
||||
iam_image_name: 'dev-docker-registry-01.smardigo.digital/smardigo/iam-app'
|
||||
|
||||
iam_version: '8.1.0-SNAPSHOT'
|
||||
@ -0,0 +1,123 @@
|
||||
---
|
||||
|
||||
### tags:
|
||||
### create_users
|
||||
### update_deployment
|
||||
|
||||
- name: "Send mattermost messsge"
|
||||
uri:
|
||||
url: "{{ mattermost_hook_smardigo }}"
|
||||
method: POST
|
||||
body: "{{ lookup('template','mattermost-deploy-start.json.j2') }}"
|
||||
body_format: json
|
||||
headers:
|
||||
Content-Type: "application/json"
|
||||
delegate_to: 127.0.0.1
|
||||
become: false
|
||||
when:
|
||||
- send_status_messages
|
||||
|
||||
- name: "Setup DNS configuration for {{ service_name }}"
|
||||
include_role:
|
||||
name: _digitalocean
|
||||
tasks_from: domain
|
||||
vars:
|
||||
record_data: "{{ stage_server_ip }}"
|
||||
record_name: "{{ service_name }}"
|
||||
|
||||
- name: "Setup public DNS configuration for {{ service_name }}"
|
||||
include_role:
|
||||
name: _digitalocean
|
||||
tasks_from: domain
|
||||
vars:
|
||||
record_data: "{{ item.ip }}"
|
||||
record_name: "{{ item.name }}"
|
||||
loop: "{{ iam_public_dns_entries }}"
|
||||
when: iam_public_dns_entries is defined
|
||||
|
||||
- name: "Check docker networks"
|
||||
include_role:
|
||||
name: _docker
|
||||
tasks_from: networks
|
||||
|
||||
- name: "Check if {{ service_name }}/docker-compose.yml exists"
|
||||
stat:
|
||||
path: '{{ service_base_path }}/{{ service_name }}/docker-compose.yml'
|
||||
register: check_docker_compose_file
|
||||
tags:
|
||||
- update_deployment
|
||||
|
||||
- name: "Stop {{ service_name }}"
|
||||
shell: docker-compose down
|
||||
args:
|
||||
chdir: '{{ service_base_path }}/{{ service_name }}'
|
||||
when: check_docker_compose_file.stat.exists
|
||||
ignore_errors: yes
|
||||
tags:
|
||||
- update_deployment
|
||||
|
||||
- name: "Deploy docker templates for {{ service_name }}"
|
||||
include_role:
|
||||
name: _deploy
|
||||
tasks_from: templates
|
||||
vars:
|
||||
current_config: "_docker"
|
||||
current_base_path: "{{ service_base_path }}"
|
||||
current_destination: "{{ service_name }}"
|
||||
current_owner: "{{ docker_owner }}"
|
||||
current_group: "{{ docker_group }}"
|
||||
current_docker: "{{ iam_docker }}"
|
||||
|
||||
- name: "Deploy service templates for {{ service_name }}"
|
||||
include_role:
|
||||
name: _deploy
|
||||
tasks_from: templates
|
||||
vars:
|
||||
current_config: "iam"
|
||||
current_base_path: "{{ service_base_path }}"
|
||||
current_destination: "{{ service_name }}"
|
||||
current_owner: "{{ docker_owner }}"
|
||||
current_group: "{{ docker_group }}"
|
||||
|
||||
- name: "Update {{ service_name }}"
|
||||
shell: docker-compose pull
|
||||
args:
|
||||
chdir: '{{ service_base_path }}/{{ service_name }}'
|
||||
tags:
|
||||
- update_deployment
|
||||
|
||||
- name: "Start {{ service_name }}"
|
||||
shell: docker-compose up -d
|
||||
args:
|
||||
chdir: '{{ service_base_path }}/{{ service_name }}'
|
||||
tags:
|
||||
- update_deployment
|
||||
|
||||
- name: "Update landing page for {{ service_name }}"
|
||||
include_role:
|
||||
name: _deploy
|
||||
tasks_from: caddy_landing_page
|
||||
vars:
|
||||
current_services: [
|
||||
{
|
||||
current_name: "{{ service_name }}",
|
||||
current_url: "{{ http_s }}://{{ iam_id }}.{{ domain }}",
|
||||
current_version: "{{ iam_version }}",
|
||||
current_date: "{{ ansible_date_time.iso8601 }}",
|
||||
},
|
||||
]
|
||||
tags:
|
||||
- update_deployment
|
||||
|
||||
- name: "Send mattermost messsge"
|
||||
uri:
|
||||
url: "{{ mattermost_hook_smardigo }}"
|
||||
method: POST
|
||||
body: "{{ lookup('template','mattermost-deploy-end.json.j2') }}"
|
||||
body_format: json
|
||||
headers:
|
||||
Content-Type: "application/json"
|
||||
delegate_to: 127.0.0.1
|
||||
become: false
|
||||
when:
|
||||
- send_status_messages
|
||||
@ -0,0 +1,53 @@
|
||||
---
|
||||
|
||||
- name: "Reading users of realm {{ current_realm_name }}"
|
||||
uri:
|
||||
url: "{{ keycloak_server_url }}/auth/admin/realms/{{ current_realm_name }}/users"
|
||||
method: GET
|
||||
headers:
|
||||
Authorization: "Bearer {{ access_token}} "
|
||||
status_code: [200]
|
||||
register: realm_users
|
||||
delegate_to: 127.0.0.1
|
||||
|
||||
- name: "Printing realm users"
|
||||
debug:
|
||||
msg: "{{ realm_users }}"
|
||||
delegate_to: 127.0.0.1
|
||||
when:
|
||||
- debug
|
||||
|
||||
- name: "Saving users of realm {{ current_realm_name }} as variable (fact)"
|
||||
set_fact:
|
||||
realm_users_json: "{{ realm_users.json }}"
|
||||
delegate_to: 127.0.0.1
|
||||
|
||||
- name: "Reading user ids of realm {{ current_realm_name }}"
|
||||
set_fact:
|
||||
realm_user_usernames: "{{ realm_users_json | json_query(jmesquery) }}"
|
||||
vars:
|
||||
jmesquery: '[*].username'
|
||||
delegate_to: 127.0.0.1
|
||||
|
||||
- name: "Printing usernames of realm {{ current_realm_name }}"
|
||||
debug:
|
||||
msg: "{{ realm_user_usernames }}"
|
||||
delegate_to: 127.0.0.1
|
||||
when:
|
||||
- debug
|
||||
|
||||
- name: "Creating users for realm {{ current_realm_name }}"
|
||||
uri:
|
||||
url: "{{ keycloak_server_url }}/auth/admin/realms/{{ current_realm_name }}/users"
|
||||
method: POST
|
||||
body_format: json
|
||||
body: "{{ lookup('template','keycloak-realm-create-user.json.j2') }}"
|
||||
headers:
|
||||
Content-Type: "application/json"
|
||||
Authorization: "Bearer {{ access_token }}"
|
||||
status_code: [201]
|
||||
with_items: "{{ current_realm_users }}"
|
||||
when: current_realm_user.username not in realm_user_usernames
|
||||
loop_control:
|
||||
loop_var: current_realm_user
|
||||
delegate_to: 127.0.0.1
|
||||
Loading…
Reference in New Issue