.gitlab-ci.yml

@@ -11,18 +11,16 @@ services:
     alias: docker
 
 stages:
-  - lint
+  - ansible-lint
   - ansible-builder
-  - run-setup
+  - ansible-run-setup
-  - run-setup-digitalocean
+  - ansible-run-kubernetes
-  - run-kubernetes
+  - ansible-patchday
-  - run-management-update
-  - run-patchday
 
-lint-job:
+ansible-lint-job:
-  stage: lint
+  stage: ansible-lint
   script:
-    - echo "Running lint to check for linting violations"
+    - echo "Running ansible-lint to check for linting violations"
     - ansible-lint -c ansible-lint.cfg
   only:
     - branches
@@ -31,19 +29,19 @@ lint-job:
   tags:
     - dind
 
-builder-job:
+ansible-builder-job:
   # A resource group ensures a job is mutually exclusive across different pipelines for the same project.
-  resource_group: dev
+  resource_group: deployment
   stage: ansible-builder
   before_script:
     - cd ansible-builder
   script:
-    - echo "Running ansible-builder to build awx execution environment"
+    - echo "Running ansible-build to build awx execution environment"
     - ansible-builder build -v 3 --tag $AWX_EE_DOCKER_IMAGE_EXTERN:latest
     - docker push $AWX_EE_DOCKER_IMAGE_EXTERN:latest
   only:
     refs:
-      - main
+      - master
     changes:
       - pip-requirements
       - galaxy-requirements.yml
@@ -54,30 +52,22 @@ builder-job:
     - dind
     - harbor # 05.02.22 TODO some runners run into timeouts
 
-##################################################################################
-
-.run-ansible:
-  image: $AWX_EE_DOCKER_IMAGE_EXTERN:latest
-  tags:
-    - dind
-    - harbor # 05.02.22 TODO some runners run into timeouts
-
 ########
-###   http://patorjk.com/software/taag/#p=display&f=Doom&t=setup.yml
+###   https://patorjk.com/software/taag/#p=display&f=Doom&t=ansible%20-%20run
 ###
-###             _                               _ 
+###                    _ _     _                                                       _                               _
-###            | |                             | |
+###                   (_) |   | |                                                     | |                             | |
-###    ___  ___| |_ _   _ _ __  _   _ _ __ ___ | |
+###     __ _ _ __  ___ _| |__ | | ___   ______   _ __ _   _ _ __     ______   ___  ___| |_ _   _ _ __  _   _ _ __ ___ | |
-###   / __|/ _ \ __| | | | '_ \| | | | '_ ` _ \| |
+###    / _` | '_ \/ __| | '_ \| |/ _ \ |______| | '__| | | | '_ \   |______| / __|/ _ \ __| | | | '_ \| | | | '_ ` _ \| |
-###   \__ \  __/ |_| |_| | |_) | |_| | | | | | | |
+###   | (_| | | | \__ \ | |_) | |  __/          | |  | |_| | | | |           \__ \  __/ |_| |_| | |_) | |_| | | | | | | |
-###   |___/\___|\__|\__,_| .__(_)__, |_| |_| |_|_|
+###    \__,_|_| |_|___/_|_.__/|_|\___|          |_|   \__,_|_| |_|           |___/\___|\__|\__,_| .__(_)__, |_| |_| |_|_|
 ###                                                                                             | |     __/ |
 ###                                                                                             |_|    |___/
 
-.run-setup:
+ansible-run-setup-1-dev:
-  extends: .run-ansible
+  image: $AWX_EE_DOCKER_IMAGE_EXTERN:latest
-  stage: run-setup
+  stage: ansible-run-setup
-  script:
+  before_script:
     - 'command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client -y )'
     - eval $(ssh-agent -s)
     - 'echo "$GITLAB_SSH_KEY" | tr -d "\r" | ssh-add -'
@@ -85,76 +75,81 @@ builder-job:
     - chmod 0700 ~/.ssh
     - '[[ -f /.dockerenv ]] && echo -e "Host *\n\tStrictHostKeyChecking no\n\n" >> ~/.ssh/config'
     - ssh-add -L
-    - export HETZNER_LABEL_SELECTOR="stage=${STAGE}"
+  script:
-    - ansible-playbook -i stage-${STAGE}-netgo-hcloud.yml setup.yml --vault-password-file /tmp/vault-pass -t common -u gitlabci
+    - echo "${ANSIBLE_VAULT_PASS_DEV}" > /tmp/vault-pass
+    - STAGE=dev && HETZNER_LABEL_SELECTOR="stage=${STAGE}" && ansible-playbook -i stage-${STAGE}-netgo-hcloud.yml setup.yml --tags common --vault-password-file /tmp/vault-pass -u gitlabci
   after_script:
     - rm /tmp/vault-pass
+  only:
+    - master
+    - schedules
+  tags:
+    - dind
+    - harbor # 05.02.22 TODO some runners run into timeouts
+  resource_group: dev
 
-
+ansible-run-setup-2-qa:
-run-setup-digitalocean:
+  image: $AWX_EE_DOCKER_IMAGE_EXTERN:latest
-  extends: .run-ansible
+  stage: ansible-run-setup
-  stage: run-setup
   before_script:
-    - export STAGE=dev
-    - echo "${ANSIBLE_VAULT_PASS_DEV}" > /tmp/vault-pass
-  script:
     - 'command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client -y )'
     - eval $(ssh-agent -s)
     - 'echo "$GITLAB_SSH_KEY" | tr -d "\r" | ssh-add -'
     - mkdir -p ~/.ssh
     - chmod 0700 ~/.ssh
     - '[[ -f /.dockerenv ]] && echo -e "Host *\n\tStrictHostKeyChecking no\n\n" >> ~/.ssh/config'
-    - ssh-add -L
+  script:
-    - ansible-playbook -i stage-digitalocean setup.yml --vault-password-file /tmp/vault-pass -t common -u gitlabci
+    - echo "${ANSIBLE_VAULT_PASS_QA}" > /tmp/vault-pass
+    - STAGE=qa && HETZNER_LABEL_SELECTOR="stage=${STAGE}" && ansible-playbook -i stage-${STAGE}-netgo-hcloud.yml setup.yml --tags common --vault-password-file /tmp/vault-pass -u gitlabci
   after_script:
     - rm /tmp/vault-pass
-  only:
-    - main
-
-
-run-setup-dev:
-  extends: .run-setup
-  resource_group: dev
-  before_script:
-    - export STAGE=dev
-    - echo "${ANSIBLE_VAULT_PASS_DEV}" > /tmp/vault-pass
-  only:
-    - main
-
-run-setup-qa:
-  extends: .run-setup
-  resource_group: qa
-  before_script:
-    - export STAGE=qa
-    - echo "${ANSIBLE_VAULT_PASS_QA}" > /tmp/vault-pass
   only:
     - qa
+    - schedules
+  tags:
+    - dind
+    - harbor # 05.02.22 TODO some runners run into timeouts
+  resource_group: qa
 
-run-setup-prodnso:
+ansible-run-setup-3-prodnso:
-  extends: .run-setup
+  image: $AWX_EE_DOCKER_IMAGE_EXTERN:latest
-  resource_group: prodnso
+  stage: ansible-run-setup
   before_script:
-    - export STAGE=prodnso
+    - 'command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client -y )'
+    - eval $(ssh-agent -s)
+    - 'echo "$GITLAB_SSH_KEY" | tr -d "\r" | ssh-add -'
+    - mkdir -p ~/.ssh
+    - chmod 0700 ~/.ssh
+    - '[[ -f /.dockerenv ]] && echo -e "Host *\n\tStrictHostKeyChecking no\n\n" >> ~/.ssh/config'
+  script:
     - echo "${ANSIBLE_VAULT_PASS_PRODNSO}" > /tmp/vault-pass
+    - STAGE=prodnso && HETZNER_LABEL_SELECTOR="stage=${STAGE}" && ansible-playbook -i stage-${STAGE}-netgo-hcloud.yml setup.yml --tags common --vault-password-file /tmp/vault-pass -u gitlabci
+  after_script:
+    - rm /tmp/vault-pass
   only:
     - prodnso
+    - schedules
+  tags:
+    - dind
+    - harbor # 05.02.22 TODO some runners run into timeouts
+  resource_group: prodnso
 
 ########
-###   This Page: http://patorjk.com/software/taag/#p=display&f=Doom&t=kubernetes.yml
+###   https://patorjk.com/software/taag/#p=display&f=Doom&t=ansible%20-%20run
 ###
-###    _          _                          _                             _
+###                    _ _     _                                              _          _                          _                             _
-###   | |        | |                        | |                           | |
+###                   (_) |   | |                                            | |        | |                        | |                           | |
-###   | | ___   _| |__   ___ _ __ _ __   ___| |_ ___  ___  _   _ _ __ ___ | |
+###     __ _ _ __  ___ _| |__ | | ___   ______   _ __ _   _ _ __     ______  | | ___   _| |__   ___ _ __ _ __   ___| |_ ___  ___  _   _ _ __ ___ | |
-###   | |/ / | | | '_ \ / _ \ '__| '_ \ / _ \ __/ _ \/ __|| | | | '_ ` _ \| |
+###    / _` | '_ \/ __| | '_ \| |/ _ \ |______| | '__| | | | '_ \   |______| | |/ / | | | '_ \ / _ \ '__| '_ \ / _ \ __/ _ \/ __|| | | | '_ ` _ \| |
-###   |   <| |_| | |_) |  __/ |  | | | |  __/ ||  __/\__ \| |_| | | | | | | |
+###   | (_| | | | \__ \ | |_) | |  __/          | |  | |_| | | | |           |   <| |_| | |_) |  __/ |  | | | |  __/ ||  __/\__ \| |_| | | | | | | |
-###   |_|\_\\__,_|_.__/ \___|_|  |_| |_|\___|\__\___||___(_)__, |_| |_| |_|_|
+###    \__,_|_| |_|___/_|_.__/|_|\___|          |_|   \__,_|_| |_|           |_|\_\\__,_|_.__/ \___|_|  |_| |_|\___|\__\___||___(_)__, |_| |_| |_|_|
 ###                                                                                                                                __/ |
 ###                                                                                                                               |___/
 
-.run-kubernetes:
+ansible-run-kubernetes-1-dev:
-  extends: .run-ansible
+  image: $AWX_EE_DOCKER_IMAGE_EXTERN:latest
-  stage: run-kubernetes
+  stage: ansible-run-kubernetes
-  script:
+  before_script:
     - 'command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client -y )'
     - eval $(ssh-agent -s)
     - 'echo "$GITLAB_SSH_KEY" | tr -d "\r" | ssh-add -'
@@ -162,149 +157,144 @@ run-setup-prodnso:
     - chmod 0700 ~/.ssh
     - '[[ -f /.dockerenv ]] && echo -e "Host *\n\tStrictHostKeyChecking no\n\n" >> ~/.ssh/config'
     - ssh-add -L
-    - export HETZNER_LABEL_SELECTOR="stage=${STAGE}"
+  script:
-    - ansible-playbook -i stage-${STAGE}-netgo-hcloud.yml kubernetes.yml --vault-password-file /tmp/vault-pass -u gitlabci
+    - echo "${ANSIBLE_VAULT_PASS_DEV}" > /tmp/vault-pass
+    - STAGE=dev && HETZNER_LABEL_SELECTOR="stage=${STAGE}" && ansible-playbook -i stage-${STAGE}-netgo-hcloud.yml kubernetes.yml --vault-password-file /tmp/vault-pass -u gitlabci
   after_script:
     - rm /tmp/vault-pass
-
-run-kubernetes-dev:
-  extends: .run-kubernetes
-  resource_group: dev
-  before_script:
-    - export STAGE=dev
-    - echo "${ANSIBLE_VAULT_PASS_DEV}" > /tmp/vault-pass
   only:
-    - main
+    - master
+    - schedules
+  tags:
+    - dind
+    - harbor # 05.02.22 TODO some runners run into timeouts
+  resource_group: dev
 
-run-kubernetes-qa:
+ansible-run-kubernetes-2-qa:
-  extends: .run-kubernetes
+  image: $AWX_EE_DOCKER_IMAGE_EXTERN:latest
-  resource_group: qa
+  stage: ansible-run-kubernetes
   before_script:
-    - export STAGE=qa
+    - 'command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client -y )'
+    - eval $(ssh-agent -s)
+    - 'echo "$GITLAB_SSH_KEY" | tr -d "\r" | ssh-add -'
+    - mkdir -p ~/.ssh
+    - chmod 0700 ~/.ssh
+    - '[[ -f /.dockerenv ]] && echo -e "Host *\n\tStrictHostKeyChecking no\n\n" >> ~/.ssh/config'
+  script:
     - echo "${ANSIBLE_VAULT_PASS_QA}" > /tmp/vault-pass
+    - STAGE=qa && HETZNER_LABEL_SELECTOR="stage=${STAGE}" && ansible-playbook -i stage-${STAGE}-netgo-hcloud.yml kubernetes.yml --vault-password-file /tmp/vault-pass -u gitlabci
+  after_script:
+    - rm /tmp/vault-pass
   only:
     - qa
+    - schedules
+  tags:
+    - dind
+    - harbor # 05.02.22 TODO some runners run into timeouts
+  resource_group: qa
 
-run-kubernetes-prodnso:
+ansible-run-kubernetes-3-prodnso:
-  extends: .run-kubernetes
+  image: $AWX_EE_DOCKER_IMAGE_EXTERN:latest
-  resource_group: prodnso
+  stage: ansible-run-kubernetes
   before_script:
-    - export STAGE=prodnso
+    - 'command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client -y )'
+    - eval $(ssh-agent -s)
+    - 'echo "$GITLAB_SSH_KEY" | tr -d "\r" | ssh-add -'
+    - mkdir -p ~/.ssh
+    - chmod 0700 ~/.ssh
+    - '[[ -f /.dockerenv ]] && echo -e "Host *\n\tStrictHostKeyChecking no\n\n" >> ~/.ssh/config'
+  script:
     - echo "${ANSIBLE_VAULT_PASS_PRODNSO}" > /tmp/vault-pass
+    - STAGE=prodnso && HETZNER_LABEL_SELECTOR="stage=${STAGE}" && ansible-playbook -i stage-${STAGE}-netgo-hcloud.yml kubernetes.yml --vault-password-file /tmp/vault-pass -u gitlabci
+  after_script:
+    - rm /tmp/vault-pass
   only:
     - prodnso
+    - schedules
+  tags:
+    - dind
+    - harbor # 05.02.22 TODO some runners run into timeouts
+  resource_group: prodnso
 
 ########
-###   http://patorjk.com/software/taag/#p=display&f=Doom&t=smardigo.yml
+###   https://patorjk.com/software/taag/#p=display&f=Doom&t=patchday
-###
 ###                _       _         _
-###                               | (_)                           | |
+###               | |     | |       | |
-###    ___ _ __ ___   __ _ _ __ __| |_  __ _  ___  _   _ _ __ ___ | |
+###    _ __   __ _| |_ ___| |__   __| | __ _ _   _
-###   / __| '_ ` _ \ / _` | '__/ _` | |/ _` |/ _ \| | | | '_ ` _ \| |
+###   | '_ \ / _` | __/ __| '_ \ / _` |/ _` | | | |
-###   \__ \ | | | | | (_| | | | (_| | | (_| | (_) | |_| | | | | | | |
+###   | |_) | (_| | || (__| | | | (_| | (_| | |_| |
-###   |___/_| |_| |_|\__,_|_|  \__,_|_|\__, |\___(_)__, |_| |_| |_|_|
+###   | .__/ \__,_|\__\___|_| |_|\__,_|\__,_|\__, |
-###                                     __/ |       __/ |            
+###   | |                                     __/ |
-###                                    |___/       |___/             
+###   |_|                                    |___/
+###
 
-.run-management-update:
+ansible-patchday-1-dev:
-  extends: .run-ansible
+  image: $AWX_EE_DOCKER_IMAGE_EXTERN:latest
-  stage: run-management-update
+  stage: ansible-patchday
-  script:
+  before_script:
     - 'command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client -y )'
     - eval $(ssh-agent -s)
     - 'echo "$GITLAB_SSH_KEY" | tr -d "\r" | ssh-add -'
     - mkdir -p ~/.ssh
     - chmod 0700 ~/.ssh
     - '[[ -f /.dockerenv ]] && echo -e "Host *\n\tStrictHostKeyChecking no\n\n" >> ~/.ssh/config'
-    - ssh-add -L
+  script:
-    - export HETZNER_LABEL_SELECTOR="stage=${STAGE}"
+    - echo "${ANSIBLE_VAULT_PASS_DEV}" > /tmp/vault-pass
-    - ansible-playbook -i stage-$STAGE smardigo.yml --vault-password-file=/tmp/vault-pass -l management -t update_configurations -u gitlabci
+    - STAGE=dev && HETZNER_LABEL_SELECTOR="stage=${STAGE}" && ansible-playbook -i stage-${STAGE}-netgo-hcloud.yml patchday.yml --vault-password-file=/tmp/vault-pass -u gitlabci
   after_script:
     - rm /tmp/vault-pass
+  when: manual
   only:
-    changes:
+    - master
-      - smardigo/**/*
+  tags:
-
+    - dind
-run-management-update-dev:
+    - harbor # 05.02.22 TODO some runners run into timeouts
-  extends: .run-management-update
   resource_group: dev
-  before_script:
-    - export STAGE=dev
-    - echo "${ANSIBLE_VAULT_PASS_DEV}" > /tmp/vault-pass
-  only:
-    - main
-
-run-management-update-qa:
-  extends: .run-management-update
-  resource_group: qa
-  before_script:
-    - export STAGE=qa
-    - echo "${ANSIBLE_VAULT_PASS_QA}" > /tmp/vault-pass
-  only:
-    - qa
 
-run-management-update-prodnso:
+ansible-patchday-2-qa:
-  extends: .run-management-update
+  image: $AWX_EE_DOCKER_IMAGE_EXTERN:latest
-  resource_group: prodnso
+  stage: ansible-patchday
   before_script:
-    - export STAGE=prodnso
-    - echo "${ANSIBLE_VAULT_PASS_PRODNSO}" > /tmp/vault-pass
-  only:
-    - prodnso
-
-########
-###   http://patorjk.com/software/taag/#p=display&f=Doom&t=patchday.yml
-###   
-###                _       _         _                              _ 
-###               | |     | |       | |                            | |
-###    _ __   __ _| |_ ___| |__   __| | __ _ _   _  _   _ _ __ ___ | |
-###   | '_ \ / _` | __/ __| '_ \ / _` |/ _` | | | || | | | '_ ` _ \| |
-###   | |_) | (_| | || (__| | | | (_| | (_| | |_| || |_| | | | | | | |
-###   | .__/ \__,_|\__\___|_| |_|\__,_|\__,_|\__, (_)__, |_| |_| |_|_|
-###   | |                                     __/ |  __/ |            
-###   |_|                                    |___/  |___/             
-
-.run-patchday:
-  extends: .run-ansible
-  stage: run-patchday
-  script:
     - 'command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client -y )'
     - eval $(ssh-agent -s)
     - 'echo "$GITLAB_SSH_KEY" | tr -d "\r" | ssh-add -'
     - mkdir -p ~/.ssh
     - chmod 0700 ~/.ssh
     - '[[ -f /.dockerenv ]] && echo -e "Host *\n\tStrictHostKeyChecking no\n\n" >> ~/.ssh/config'
-    - ssh-add -L
+  script:
-    - export HETZNER_LABEL_SELECTOR="stage=${STAGE}"
+    - echo "${ANSIBLE_VAULT_PASS_QA}" > /tmp/vault-pass
-    - ansible-playbook -i stage-${STAGE}-netgo-hcloud.yml patchday.yml --vault-password-file=/tmp/vault-pass -u gitlabci
+    - STAGE=qa && HETZNER_LABEL_SELECTOR="stage=${STAGE}" && ansible-playbook -i stage-${STAGE}-netgo-hcloud.yml patchday.yml --vault-password-file=/tmp/vault-pass -u gitlabci
   after_script:
     - rm /tmp/vault-pass
-  timeout: 2h
   when: manual
-
-run-patchday-dev:
-  extends: .run-patchday
-  resource_group: dev
-  before_script:
-    - export STAGE=dev
-    - echo "${ANSIBLE_VAULT_PASS_DEV}" > /tmp/vault-pass
-  only:
-    - main
-
-run-patchday-qa:
-  extends: .run-patchday
-  resource_group: qa
-  before_script:
-    - export STAGE=qa
-    - echo "${ANSIBLE_VAULT_PASS_QA}" > /tmp/vault-pass
   only:
     - qa
+    - schedules
+  tags:
+    - dind
+    - harbor # 05.02.22 TODO some runners run into timeouts
+  resource_group: qa
 
-run-patchday-prodnso:
+ansible-patchday-3-prodnso:
-  extends: .run-patchday
+  image: $AWX_EE_DOCKER_IMAGE_EXTERN:latest
-  resource_group: prodnso
+  stage: ansible-patchday
   before_script:
-    - export STAGE=prodnso
+    - 'command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client -y )'
+    - eval $(ssh-agent -s)
+    - 'echo "$GITLAB_SSH_KEY" | tr -d "\r" | ssh-add -'
+    - mkdir -p ~/.ssh
+    - chmod 0700 ~/.ssh
+    - '[[ -f /.dockerenv ]] && echo -e "Host *\n\tStrictHostKeyChecking no\n\n" >> ~/.ssh/config'
+  script:
     - echo "${ANSIBLE_VAULT_PASS_PRODNSO}" > /tmp/vault-pass
+    - STAGE=prodnso && HETZNER_LABEL_SELECTOR="stage=${STAGE}" && ansible-playbook -i stage-${STAGE}-netgo-hcloud.yml patchday.yml --vault-password-file=/tmp/vault-pass -u gitlabci
+  after_script:
+    - rm /tmp/vault-pass
+  when: manual
   only:
     - prodnso
+    - schedules
+  tags:
+    - dind
+    - harbor # 05.02.22 TODO some runners run into timeouts
+  resource_group: prodnso

ansible.cfg

@@ -2,7 +2,7 @@
 pipelining = True
 host_key_checking = False
 inventory_plugins = ./inventory_plugins
-callbacks_enabled = profile_tasks
+callbacks_enabled = timer
 interpreter_python = auto_silent
 log_path=last_ansible_run
 forks = 30

create-database-backup.yml

@@ -54,16 +54,6 @@
       with_items: "{{ cluster_features }}"
       when: item in ['connect', 'management_connect', 'keycloak', 'webdav', 'gitea', 'workflow_index', 'workflow_proxy', 'pdns']
 
-    - name: "Add maria servers to hosts if necessary"
-      add_host:
-        name: "{{ stage }}-maria-01"
-        groups:
-        - "stage_{{ stage }}"
-        - "{{ item }}"
-      changed_when: False
-      with_items: "{{ cluster_features }}"
-      when: item in ['connect_wordpress']
-
 #############################################################
 #   Creating database backups for created inventory
 #############################################################
@@ -72,7 +62,7 @@
   serial: "{{ serial_number | default(1) }}"
   remote_user: root
   vars:
-    database_backup_state: dump
+    postgres_backup_state: dump
     ansible_ssh_host: "{{ stage_server_domain }}"
 
   roles:
@@ -85,12 +75,6 @@
     - role: keycloak_postgres
       when: "'keycloak' in group_names"
 
-#    - role: pdns_admin_postgres
-#      when: "'pdns' in group_names"
-
-#    - role: pdns_postgres
-#      when: "'pdns' in group_names"
-
     - role: webdav_postgres
       when: "'webdav' in group_names"
 
@@ -100,9 +84,6 @@
     - role: workflow_proxy_postgres
       when: "'workflow_proxy' in group_names"
 
-    - role: connect_wordpress_maria
-      when: "'connect_wordpress' in group_names"
-
 #############################################################
 #   Sending smardigo management message to process
 #############################################################

create-database.yml

@@ -58,7 +58,7 @@
         - "{{ item }}"
       changed_when: False
       with_items: "{{ cluster_features }}"
-      when: item in ['confirm', 'connect', 'management_connect', 'keycloak', 'webdav', 'gitea', 'workflow_index', 'workflow_proxy', 'pdns']
+      when: item in ['connect', 'management_connect', 'keycloak', 'webdav', 'gitea', 'workflow_index', 'workflow_proxy', 'pdns']
 
     - name: "Add maria servers to hosts if necessary"
       add_host:
@@ -88,18 +88,9 @@
         - always
 
   roles:
-    - role: confirm_postgres
-      when: "'confirm' in group_names"
-
     - role: connect_postgres
       when: "'connect' in group_names"
 
-    - role: gitea_postgres
-      when: "'gitea' in group_names"
-
-    - role: keycloak_postgres
-      when: "'keycloak' in group_names"
-
     - role: pdns_postgres
       vars:
         initialize: True
@@ -110,6 +101,12 @@
         initialize: True
       when: "'pdns' in group_names"
 
+    - role: gitea_postgres
+      when: "'gitea' in group_names"
+
+    - role: keycloak_postgres
+      when: "'keycloak' in group_names"
+
     - role: webdav_postgres
       when: "'webdav' in group_names"
 

create-kibana-objects.yml

@@ -61,7 +61,7 @@
   vars:
     ansible_connection: local
     ansible_ssh_host: "{{ stage_server_domain }}"
-    kibana_api_endpoint: '{{ shared_service_elastic_stack_kibana_01_hostname }}-kibana.{{ domain }}'
+    api_endpoint: '{{ stage }}-elastic-stack-kibana-01-kibana.{{ domain }}'
     elastic_state: present
     elastic_users:
       - 

create-remote-database-backup.yml

@@ -11,7 +11,6 @@
 # Parameters:
 #   playbook inventory
 #     stage := the name of the stage (e.g. dev, int, qa, prod)
-#     database_engine := the database engine to generate a complete backup for (e.g. postgres, maria)
 #   smardigo message callback
 #     scope_id := (scope id of the management process)
 #     process_instance_id := (process instance id of the management process)
@@ -51,7 +50,7 @@
       changed_when: False
     - name: "Add 'storage' servers to hosts if necessary"
       add_host:
-        name: "{{ stage }}-backup-01"
+        name: "{{ stage }}-fgrz-01"
         groups:
         - "stage_{{ stage }}"
         - storage
@@ -63,11 +62,6 @@
 
 - hosts: "postgres:maria"
   serial: "{{ serial_number | default(1) }}"
-  gather_facts: false
-  vars:
-    ansible_ssh_host: "{{ stage_server_domain }}"
-    current_date_time: '{{ get_current_date_time }}'
-
   tasks:
     - name: "Trigger backup mechanism"
       include_role:
@@ -80,11 +74,8 @@
 
 - hosts: "postgres:maria:storage"
   serial: "{{ serial_number | default(5) }}"
-  gather_facts: false
   vars:
-    ansible_ssh_host: "{{ stage_server_domain }}"
     storageserver_system_user: 'backuphamster'
-
   tasks:
     # I could not get it up and running with <synchronize> module
     # to sync data from remote server A to remote server B
@@ -92,8 +83,7 @@
       become: yes
       become_user: '{{ storageserver_system_user }}'
       vars:
-        # should work with non-fqdn due to existing entry in /etc/hosts
+        database_server_ip: "{{ stage }}-{{ database_engine }}-01.{{ domain }}"
-        database_server_ip: "{{ stage }}-{{ database_engine }}-01"
       shell: '/home/{{ storageserver_system_user }}/pull_remote_backups.sh {{ database_server_ip }} {{ stage }} {{ database_engine }}'
       when:
         - inventory_hostname in groups['storage']
@@ -101,7 +91,7 @@
     - name: "Cleanup remote backup dirs: {{ database_engine }}"
       become: yes
       file:
-        path: '{{ backup_directory }}/{{ database_engine }}/{{ get_current_date }}'
+        path: '{{ backup_directory }}/{{ database_engine }}/{{ ansible_date_time.date }}'
         state: absent
       when:
         - not inventory_hostname in groups['storage']

create-server.yml

@@ -43,7 +43,6 @@
         groups:
         - "stage_{{ stage }}"
         - "{{ cluster_service }}"
-        - hcloud
       with_sequence: start=1 end={{ cluster_size | default(1) }}
       changed_when: False
 
@@ -53,7 +52,6 @@
 
 - hosts: "stage_{{ stage }}:!{{ stage }}-virtual-host-to-read-groups-vars"
   serial: "{{ serial_number | default(5) }}"
-  remote_user: root
   gather_facts: false
 
   pre_tasks:

elastic-certs.sh

@@ -1,9 +1,3 @@
 #!/bin/bash
 
-if [ "x$1" == "x" ];then
-  echo "Stage as param \$1 is missing. exit"
-  exit 1
-fi
-
-
 docker run -v `pwd`/templates/elastic-certs:/certs -v `pwd`/templates/elastic-certs/$1-instances.yaml:/usr/share/elasticsearch/config/certificates/$1-instances.yml docker.elastic.co/elasticsearch/elasticsearch:7.12.0 /bin/sh "/certs/certutil.sh" $1

export-database.yml

@@ -1,99 +0,0 @@
----
-
-# Parameters:
-#   playbook inventory
-#     stage := the name of the stage (e.g. dev, int, qa, prod)
-#     tenant_id := (unique key for the tenant, e.g. customer)
-#     cluster_name := (business name for the cluster, e.g. product, department )
-#     cluster_size := (WIP node count for the cluster)
-#     cluster_service := (service to setup, e.g. 'connect', ...)
-#     cluster_features := (optional features to use, e.g. ['wordpress', 'resubmission', ...])
-#     database_backup_file := the dump file to export, has to be on the database server under /tmp (e.g. wordpress_portal.sql)
-#     target_database := (optional) the database to export into ( see {{ connect_wordpress_maria_database }})
-#   smardigo message callback
-#     scope_id := (scope id of the management process)
-#     process_instance_id := (process instance id of the management process)
-#     smardigo_management_action := (smardigo management action anme of the management process)
-
-#############################################################
-#   Creating inventory dynamically for given parameters
-#############################################################
-
-- hosts: localhost
-  connection: local
-  gather_facts: false
-
-  pre_tasks:
-    - name: "Check if ansible version is at least 2.10.x"
-      assert:
-        that:
-          - ansible_version.major >= 2
-          - ansible_version.minor >= 10
-        msg: "The ansible version has to be at least ({{ ansible_version.full }})"
-
-#     add virtual server to load stage specific variables as context
-    - name: "Add <{{ stage }}-virtual-host-to-read-groups-vars> to hosts"
-      add_host:
-        name: "{{ stage }}-virtual-host-to-read-groups-vars"
-        groups:
-        - "stage_{{ stage }}"
-      changed_when: False
-
-  tasks:
-    - name: Add maria servers to hosts if necessary
-      add_host:
-        name: "{{ stage }}-maria-01"
-        groups:
-        - "stage_{{ stage }}"
-        - "{{ item }}"
-      changed_when: False
-      with_items: "{{ cluster_features }}"
-      when: item in ['connect_wordpress']
-
-#############################################################
-#   exporting database backups for created inventory
-#############################################################
-
-- hosts: "stage_{{ stage }}:!{{ stage }}-virtual-host-to-read-groups-vars"
-  serial: "{{ serial_number | default(1) }}"
-  remote_user: root
-  vars:
-    ansible_ssh_host: "{{ stage_server_domain }}"
-
-  pre_tasks:
-    - name: "export autodiscover pre-tasks"
-      import_tasks: tasks/autodiscover_pre_tasks.yml
-      become: false
-      tags:
-        - always
-
-  roles:
-    - role: export_maria_database
-      vars:
-        database_backup_file: "{{ stage }}-{{ tenant_id }}-{{ cluster_name }}-wordpress.sql.gz"
-      when:
-        - "'connect_wordpress' in group_names"
-        - "target_database is defined"
-
-    - role: export_maria_database
-      vars:
-        target_database: "{{ connect_wordpress_maria_database }}"
-        database_backup_file: "{{ stage }}-{{ tenant_id }}-{{ cluster_name }}-wordpress.sql.gz"
-      when:
-        - "'connect_wordpress' in group_names"
-
-#############################################################
-#   Sending smardigo management message to process
-#############################################################
-
-- hosts: "{{ stage }}-virtual-host-to-read-groups-vars"
-  serial: "{{ serial_number | default(1) }}"
-  gather_facts: false
-  connection: local
-  run_once: true
-  vars:
-    connect_jwt_username: "{{ management_admin_username }}"
-
-  tasks:
-    - name: "Sending smardigo management message to <{{ smardigo_management_url }}>"
-      include_tasks: tasks/smardigo_management_message.yml

external_monitoring.yml

@@ -46,6 +46,10 @@
     tags:
       - ssh_hardening
 
+  - name: "Install node-exporter via include_role"
+    include_role:
+      name:  cloudalchemy.node-exporter
+
   - name: "Install blackbox-exporter via include_role"
     include_role:
       name: cloudalchemy.blackbox-exporter

galaxy-requirements.yml

@@ -20,8 +20,6 @@ roles:
   version: v3.6.1
   src: https://github.com/Oefenweb/ansible-postfix.git
   scm: git
-- name: geerlingguy.mysql
-  version: 3.3.2
 
 collections:
 - name: hetzner.hcloud

gitlab-mirrors.yml

@@ -1,60 +0,0 @@
----
-# Parameters:
-#   playbook inventory
-#     stage := the name of the stage (e.g. dev, int, qa, prod)
-#   environment variable
-#     GITLAB_API_TOKEN := Access token from gitlab
-
-#############################################################
-#   Creating inventory dynamically for given parameters
-#############################################################
-
-- hosts: localhost
-  gather_facts: false
-  connection: local
-
-  tasks:
-    - name: Add hosts
-      add_host:
-        name: "{{ stage }}-gitlab"
-        groups: "{{ ['stage_' + stage ] }}"
-
-#############################################################
-#   Creating gitlab mirrors for current stage
-#############################################################
-
-- hosts: "stage_{{ stage }}"
-  serial: "{{ serial_number | default(1) }}"
-  gather_facts: false
-  connection: local
-  vars:
-    projects:
-    - id: 1210
-      name: argocd
-    - id: 1216
-      name: operator-awx
-    - id: 1212
-      name: operator-jaeger
-    - id: 1231
-      name: operator-knative
-    - id: 1233
-      name: smardigo-awx
-    - id: 1232
-      name: smardigo-jaeger
-
-  pre_tasks:
-    - name: "Add repository remote mirror to project"
-      delegate_to: 127.0.0.1
-      become: false
-      uri:
-        url: "https://git.dev-at.de/api/v4/projects/{{ item.id }}/remote_mirrors"
-        method: POST
-        body_format: json
-        body:
-          enabled: true
-          only_protected_branches: true
-          url: "https://{{ gitea_admin_username }}:{{ gitea_admin_password }}@{{ shared_service_gitea_hostname }}/argocd/{{ item.name }}.git"
-        headers:
-          PRIVATE-TOKEN: "{{ lookup('env', 'GITLAB_API_TOKEN') }}"
-        status_code: [201]
-      loop: "{{ projects }}"

group_vars/all/connect.yml

@@ -1,4 +0,0 @@
----
-
-connect_client_admin_username: "connect-admin"
-connect_realm_admin_username: "connect-realm-admin"

group_vars/all/firewall.yml

@@ -1,269 +0,0 @@
----
-hcloud_firewall_objects:
-   -
-     name: "{{ stage }}-default"
-     state: present
-     rules:
-     -
-        direction: in
-        protocol: icmp
-        port: ''
-        source_ips: '{{ ip_whitelist }}'
-        destination_ips: []
-        description: ICMP allowed
-     -
-        direction: in
-        protocol: tcp
-        port: '22'
-        source_ips: '{{ ip_whitelist }}'
-        destination_ips: []
-        description: SSH allowed
-     -
-        direction: in
-        protocol: tcp
-        port: '80'
-        source_ips: '{{ ip_whitelist }}'
-        destination_ips: []
-        description: HTTP allowed
-     -
-        direction: in
-        protocol: tcp
-        port: '443'
-        source_ips: '{{ ip_whitelist }}'
-        destination_ips: []
-        description: HTTPS allowed
-     -
-        direction: in
-        protocol: tcp
-        port: 'any'
-        source_ips: '{{ ip_whitelist_admins }}'
-        destination_ips: []
-        description: TCP - allow work from home without VPN
-     -
-        direction: in
-        protocol: udp
-        port: 'any'
-        source_ips: '{{ ip_whitelist_admins }}'
-        destination_ips: []
-        description: UDP - allow work from home without VPN
-     apply_to:
-     -
-       type: label_selector
-       label_selector:
-         selector: 'stage={{ stage }}'
-   -
-     name: "{{ stage }}-monitoring"
-     state: present
-     rules:
-     -
-        direction: in
-        protocol: tcp
-        port: '9080-9085'
-        source_ips: '{{ ip_whitelist }}'
-        destination_ips: []
-        description: 'Server/Service Monitoring'
-     -
-        direction: in
-        protocol: tcp
-        port: '9001'
-        source_ips: '{{ ip_whitelist }}'
-        destination_ips: []
-        description: 'PgAdmin'
-     -
-        direction: in
-        protocol: tcp
-        port: '9187'
-        source_ips: '{{ ip_whitelist }}'
-        destination_ips: []
-        description: 'Postgres-Exporter'
-     apply_to:
-     -
-       type: label_selector
-       label_selector:
-         selector: 'stage={{ stage }}'
-   -
-     name: "{{ stage }}-monitoring-extern-https"
-     state: present
-     rules:
-     -
-        direction: in
-        protocol: tcp
-        port: '443'
-        source_ips:
-         - "{{ lookup('community.general.dig', 'dev-blackbox-01.smardigo.digital' ) }}/32"
-        destination_ips: []
-        description: null
-     apply_to:
-     -
-       type: label_selector
-       label_selector:
-         selector: 'service=connect'
-     -
-       type: label_selector
-       label_selector:
-         selector: 'service=keycloak'
-
-hcloud_firewall_objects_awx:
-   -
-     name: "{{ stage }}-awx-ssh-access-for-k8s-nodes"
-     state: present
-     rules:
-     -
-        direction: in
-        protocol: tcp
-        port: '22'
-        source_ips: "{{ awx_source_ips }}"
-        destination_ips: []
-        description: null
-     apply_to:
-     -
-       type: label_selector
-       label_selector:
-         selector: 'stage={{ stage }}'
-
-hcloud_firewall_objects_backup:
-   -
-     name: "{{ stage }}-backup-ssh-access"
-     state: present
-     rules:
-     -
-        direction: in
-        protocol: tcp
-        port: '22'
-        source_ips:
-          - "{{ offsite_storage_server_ip }}"
-        destination_ips: []
-        description: null
-     apply_to:
-     -
-       type: label_selector
-       label_selector:
-         selector: 'service=backup'
-
-hcloud_firewall_objects_gitea:
-   -
-     name: "{{ stage }}-access-to-gitea"
-     state: present
-     rules:
-     -
-        direction: in
-        protocol: tcp
-        port: '443'
-        source_ips: "{{ ip_whitelist }}"
-        destination_ips: []
-        description: "Allow access for whitelisted ips"
-     -
-        direction: in
-        protocol: tcp
-        port: '443'
-        source_ips: "{{ [shared_service_network] + awx_source_ips }}"
-        destination_ips: []
-        description: "Allow access for kubernetes worker nodes"
-     -
-        direction: in
-        protocol: tcp
-        port: '443'
-        source_ips: "{{ [shared_service_network] + (gitea_https_whitelisted_ips | default([])) }}"
-        destination_ips: []
-        description: "Allow access for custom whitelisted ips"
-     apply_to:
-     -
-       type: label_selector
-       label_selector:
-         selector: 'service=gitea'
-
-hcloud_firewall_objects_keycloak:
-   -
-     name: "{{ stage }}-access-to-keycloak"
-     state: present
-     rules:
-     -
-        direction: in
-        protocol: tcp
-        port: '443'
-        source_ips: "{{ ip_whitelist }}"
-        destination_ips: []
-        description: "Allow access for whitelisted ips"
-     -
-        direction: in
-        protocol: tcp
-        port: '443'
-        source_ips: "{{ [shared_service_network] + awx_source_ips }}"
-        destination_ips: []
-        description: "Allow access for kubernetes worker nodes"
-     -
-        direction: in
-        protocol: tcp
-        port: '443'
-        source_ips: "{{ [shared_service_network] + (keycloak_https_whitelisted_ips | default([])) }}"
-        destination_ips: []
-        description: "Allow access for custom whitelisted ips"
-     apply_to:
-     -
-       type: label_selector
-       label_selector:
-         selector: 'service=keycloak'
-
-hcloud_firewall_objects_kibana:
-   -
-     name: "{{ stage }}-access-to-kibana"
-     state: present
-     rules:
-     -
-        direction: in
-        protocol: tcp
-        port: '443'
-        source_ips: "{{ ip_whitelist }}"
-        destination_ips: []
-        description: "Allow access for whitelisted ips"
-     -
-        direction: in
-        protocol: tcp
-        port: '443'
-        source_ips: "{{ [shared_service_network] + awx_source_ips }}"
-        destination_ips: []
-        description: "Allow access for kubernetes worker nodes"
-     -
-        direction: in
-        protocol: tcp
-        port: '443'
-        source_ips: "{{ [shared_service_network] + (kibana_https_whitelisted_ips | default([])) }}"
-        destination_ips: []
-        description: "Allow access for custom whitelisted ips"
-     apply_to:
-     -
-       type: label_selector
-       label_selector:
-         selector: 'service=kibana'
-
-hcloud_firewall_objects_management:
-   -
-     name: "{{ stage }}-access-to-management"
-     state: present
-     rules:
-     -
-        direction: in
-        protocol: tcp
-        port: '443'
-        source_ips: "{{ ip_whitelist }}"
-        destination_ips: []
-        description: "Allow access for whitelisted ips"
-     -
-        direction: in
-        protocol: tcp
-        port: '443'
-        source_ips: "{{ [shared_service_network] + awx_source_ips }}"
-        destination_ips: []
-        description: "Allow access for kubernetes worker nodes"
-     -
-        direction: in
-        protocol: tcp
-        port: '443'
-        source_ips: "{{ [shared_service_network] + (management_https_whitelisted_ips | default([])) }}"
-        destination_ips: []
-        description: "Allow access for custom whitelisted ips"
-     apply_to:
-     -
-       type: label_selector
-       label_selector:
-         selector: 'service=connect,tenant=management'

group_vars/all/plain.yml

@@ -1,5 +1,4 @@
 ---
-ansible_managed: 'do not edit manually - file powered by ansible'
 
 debug: false
 ssh_macs:
@@ -40,7 +39,6 @@ common_apt_dependencies:
   - zip
   - curl
   - htop
-  - iotop
   - net-tools
   - bash-completion
   - python3-pip
@@ -66,17 +64,14 @@ awx_credential_machine_hetzner_name: hetzner-ansible-ssh
 
 gitlab_ansible_user_name: "gitlabci"
 
-backupuser_user_name: backupuser
-
 # used for root-access by hetzner on server creation (@see cloud console/security/ssh-keys)
 hetzner_ssh_keys:
   - "claus.paetow@netgo.de"
   - "friedrich.goerz@netgo.de"
   - "peter.heise@netgo.de"
   - "sven.ketelsen@netgo.de"
-  - "michael.haehnel@netgo.de"
   - "{{ awx_ansible_user_name }}@netgo.de"
-  - "{{ gitlab_ansible_user_name }}@git.dev-at.de"
+  - "{{ gitlab_ansible_user_name }}@netgo.de"
 
 hetzner_server_labels: "stage={{ stage }}"
 
@@ -104,27 +99,25 @@ sudo_group: "{{ sudo_groups
   | replace('.','-') }}"
 
 # whitelist for outdated user detection - they wont't be deleted at all
-default_users:
+default_plattform_users:
   - 'nobody'
   - 'elastic'
   - 'postgres'
   - 'administrator'
   - '{{ admin_user }}'
+  - '{{ backupuser_username }}'
 
-default_plattform_users:
+smardigo_plattform_users:
   - 'claus.paetow'
   - 'friedrich.goerz'
   - 'peter.heise'
   - 'sven.ketelsen'
-  - 'michael.haehnel'
-  - 'philipp.eichhorn'
   - '{{ awx_ansible_user_name }}'
   - '{{ gitlab_ansible_user_name }}'
 
-smardigo_plattform_users: "{{ default_plattform_users + custom_plattform_users | default([]) }}"
-
 ip_whitelist_admins:
-  - "87.150.33.14/32" # sven
+  - "79.215.10.239/32" # sven
+  - "212.86.56.112/32" # peter
 
 ip_whitelist:
   - "212.121.131.106/32" # netgo berlin
@@ -132,7 +125,9 @@ ip_whitelist:
   - "46.245.219.98/32" # netgo borken
   - "{{ shared_service_network }}"
 
-offsite_storage_server_ip: 142.132.155.83/32
+# for test purpose DEV-361
+# currently (2022.03.18) set to IP of hetzner VM
+gitlab_storage_server: 167.235.18.147/32
 
 docker_owner: "{{ admin_user }}"
 docker_group: "{{ admin_user }}"
@@ -142,13 +137,12 @@ docker_compose_path: "/usr/bin/docker-compose"
 
 service_base_path: '/etc/smardigo'
 
-devops_email_address: "nso.devops@netgo.de"
+gitea_admin_email: "nso.devops@netgo.de"
-gitea_admin_email: '{{ devops_email_address }}'
+lets_encrypt_email: "nso.devops@netgo.de"
-lets_encrypt_email: '{{ devops_email_address }}'
+connect_admin_email: "nso.devops@netgo.de"
-connect_admin_email: '{{ devops_email_address }}'
+keycloak_admin_email: "nso.devops@netgo.de"
-keycloak_admin_email: '{{ devops_email_address }}'
+pgadmin4_admin_email: "nso.devops@netgo.de"
-pgadmin4_admin_email: '{{ devops_email_address }}'
+harbor_oidc_admin_email: "nso.devops@netgo.de"
-harbor_oidc_admin_email: '{{ devops_email_address }}'
 
 http_port: "80"
 https_port: "443"
@@ -203,8 +197,121 @@ blackbox_http_2xx_additional_targets: []
 prometheus_federation_enabled: true
 kubernetes_prometheus_endpoint: "{{ stage }}-kube-prometheus.{{ domain }}"
 
-get_current_date: "{{ lookup('pipe','date +%Y-%m-%d') }}"
+backupuser_username: backupuser
-get_current_date_time: "{{ lookup('pipe','date +%Y-%m-%d_%H:%M') }}"
+backupuser_ssh_pubkey: 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDAFRYAy3PqimYUWcO4Q9pdTvDQTsq7hKjWYoQEsJICnRRv+W+5d2lJvC3gqMpmWy9XxtrYePkVHCgIvfJSas9Jv7n7eeYoeWLWJq0nRSKg6EKFCH9y3v8tGPJQQf7wogOhHwr6m79c+lpNVUsVR+QOf76+47ZuwnuEBzK6xbDkmwyt7SPrJ59IFxOlmtz2HgVlTLczLalMygM4qlXqIt+lwuuFz4CsGcr4TwMKp9Uk6SCP3OV12oLnUUUOA3r72qmE4+JeUN6VNbXoBXEANfXm5kbM8w+dFhulCi1fQZCssB8PStA7Cs0gVqL6DYNUKRZaFL8e77hljGkPlOQDxOsBexPuceSDmmr6s5qT1wA6bnEFoeWbLlxixGlFA+1Q/LqWsYzoOZiTHDoaXvsc4VizlPp4Fn0OgJefPjuzBsWOyf0ob5oucfnmCAvEh/k+ioq0bIQDcliAM1UezitblHQgGHhqnKPMi664i0ULLiExARe4IV3KJiaG++RJyzUL5HNz3Qru+K5/pdj2jffluYTC4w+6ZYfjWEZS/DAumExv9T97kFOsapHCQJwTBa368Ch6uKkPCZO8p/ra3xTIUh/PibHaVCadgX2NR9q6jdiQtmc0SOyNJlMlPZD/Q1NrjXJ18ASny7gCBFItMyMtinVx9xQxQ+PFLB8oNYERw1ejIw== storage-server-smardigo'
+
+current_date_time: "{{ lookup('pipe','date +%Y-%m-%d_%H:%M') }}"
+
+hcloud_firewall_objects:
+   -
+     name: "{{ stage }}-default"
+     state: present
+     rules:
+     -
+        direction: in
+        protocol: icmp
+        port: ''
+        source_ips: '{{ ip_whitelist + ip_whitelist_admins }}'
+        destination_ips: []
+        description: ICMP allowed
+     -
+        direction: in
+        protocol: tcp
+        port: '22'
+        source_ips: '{{ ip_whitelist + ip_whitelist_admins }}'
+        destination_ips: []
+        description: SSH allowed
+     -
+        direction: in
+        protocol: tcp
+        port: '80'
+        source_ips: '{{ ip_whitelist + ip_whitelist_admins }}'
+        destination_ips: []
+        description: HTTP allowed
+     -
+        direction: in
+        protocol: tcp
+        port: '443'
+        source_ips: '{{ ip_whitelist + ip_whitelist_admins }}'
+        destination_ips: []
+        description: HTTPS allowed
+     -
+        direction: in
+        protocol: tcp
+        port: 'any'
+        source_ips: '{{ ip_whitelist_admins }}'
+        destination_ips: []
+        description: TCP - allow work from home without VPN
+     -
+        direction: in
+        protocol: udp
+        port: 'any'
+        source_ips: '{{ ip_whitelist_admins }}'
+        destination_ips: []
+        description: UDP - allow work from home without VPN
+     apply_to:
+     -
+       type: label_selector
+       label_selector:
+         selector: 'stage={{ stage }}'
+   -
+     name: "{{ stage }}-monitoring"
+     state: present
+     rules:
+     -
+        direction: in
+        protocol: tcp
+        port: '9080-9085'
+        source_ips: '{{ ip_whitelist + ip_whitelist_admins }}'
+        destination_ips: []
+        description: 'Server/Service Monitoring'
+     -
+        direction: in
+        protocol: tcp
+        port: '9001'
+        source_ips: '{{ ip_whitelist + ip_whitelist_admins }}'
+        destination_ips: []
+        description: 'PgAdmin'
+     -
+        direction: in
+        protocol: tcp
+        port: '9187'
+        source_ips: '{{ ip_whitelist + ip_whitelist_admins }}'
+        destination_ips: []
+        description: 'Postgres-Exporter'
+     -
+        direction: in
+        protocol: tcp
+        port: '80'
+        source_ips: '{{ ip_whitelist + ip_whitelist_admins }}'
+        destination_ips: []
+        description: 'AWX'
+     apply_to:
+     -
+       type: label_selector
+       label_selector:
+         selector: 'stage={{ stage }}'
+   -
+     name: "{{ stage }}-monitoring-extern-https"
+     state: present
+     rules:
+     -
+        direction: in
+        protocol: tcp
+        port: '443'
+        source_ips:
+         - "{{ lookup('community.general.dig', 'dev-blackbox-01.smardigo.digital' ) }}/32"
+        destination_ips: []
+        description: null
+     apply_to:
+     -
+       type: label_selector
+       label_selector:
+         selector: 'service=connect'
+     -
+       type: label_selector
+       label_selector:
+         selector: 'service=keycloak'
 
 hetzner_authentication_ansible: "{{ hetzner_authentication_ansible_vault }}"
 hetzner_authentication_ccm: "{{ hetzner_authentication_ccm_vault }}"
@@ -214,14 +321,83 @@ k8s_basic_services:
   - kubelet
   - containerd
 
-selfsigned_ca_private_key_passphrase: '{{ selfsigned_ca_private_key_passphrase_vault }}'
+hcloud_firewall_objects_awx:
-  
+   -
-prometheus_alert_diskspaceusage_warning: 85
+     name: "{{ stage }}-awx-ssh-access-for-k8s-nodes"
-prometheus_alert_pg_replication_lag: 120
+     state: present
-
+     rules:
-# hetzner upstream DNSservers
+     -
-upstream_dns_servers:
+        direction: in
-- 185.12.64.1
+        protocol: tcp
-- 185.12.64.2
+        port: '22'
-
+        source_ips: "{{ src_ips }}"
-wordpress_haproxy_admin_password: "{{ wordpress_haproxy_admin_password_vault | default('haproxy-admin') }}"
+        destination_ips: []
+        description: null
+     apply_to:
+     -
+       type: label_selector
+       label_selector:
+         selector: 'stage={{ stage }}'
+   -
+     name: "{{ stage }}-awx-access-SMA-mgmt-instance"
+     state: present
+     rules:
+     -
+        direction: in
+        protocol: tcp
+        port: '443'
+        source_ips: "{{ src_ips }}"
+        destination_ips: []
+        description: null
+     apply_to:
+     -
+       type: label_selector
+       label_selector:
+         selector: 'service=connect,tenant=management'
+   -
+     name: "{{ stage }}-awx-access-443-SMA-peripheral-instances"
+     state: present
+     rules:
+     -
+        direction: in
+        protocol: tcp
+        port: '443'
+        source_ips: "{{ src_ips }}"
+        destination_ips: []
+        description: null
+     apply_to:
+     -
+       type: label_selector
+       label_selector:
+         selector: 'service=gitea'
+     -
+       type: label_selector
+       label_selector:
+         selector: 'service=keycloak'
+     -
+       type: label_selector
+       label_selector:
+         selector: 'service=kibana'
+
+hcloud_firewall_objects_backup:
+   -
+     name: "{{ stage }}-database-backup-ssh-access"
+     state: present
+     rules:
+     -
+        direction: in
+        protocol: tcp
+        port: '22'
+        source_ips:
+          - "{{ gitlab_storage_server }}"
+        destination_ips: []
+        description: null
+     apply_to:
+     -
+       type: label_selector
+       label_selector:
+         selector: 'service=postgres'
+     -
+       type: label_selector
+       label_selector:
+         selector: 'service=maria'

group_vars/bastelserver/plain.yml

@@ -1,11 +1,9 @@
 ---
 #TODO needs to be removed after story DEV-361 is finished
 hetzner_server_type: "{{ hetzner_server_type_bastelserver | default('cx21') }}"
-hetzner_server_labels: "stage={{ stage }} service=backup"
+hetzner_server_labels: "stage={{ stage }} service=bastelserver"
 
 docker_enabled: false
 traefik_enabled: false
 filebeat_enabled: false
-
+node_exporter_enabled: false
-custom_plattform_users:
-  - backuphamster

group_vars/connect/plain.yml

@@ -33,5 +33,10 @@ connect_iam_user_management_url: "{{ http_s }}://{{ shared_service_keycloak_host
 
 connect_mail_properties_simulation: false
 
+connect_loglevel_message_queue: "DEBUG"
+connect_loglevel_document_index: "DEBUG"
+connect_loglevel_workflow_index: "DEBUG"
+connect_loglevel_workflow_analysis: "DEBUG"
+
 connect_csrf_token_name: "21f4d682-dbad-45e5-b3b5-47d274b9772d"
 connect_csrf_token_value: "4d2ef8cc-f7d9-46d4-b4d6-f20f9dc48040"

group_vars/connect_wordpress/plain.yml

@@ -1,6 +1,6 @@
 ---
 
-connect_wordpress_maria_host: "mariaproxy"
+connect_wordpress_maria_host: "{{ shared_service_maria_hostname }}"
 connect_wordpress_maria_database: "{{ stage }}_{{ tenant_id }}_{{ cluster_name }}_connect_wordpress"
 connect_wordpress_maria_username: "{{ connect_wordpress_maria_database }}"
 connect_wordpress_maria_password: "connect-wordpress-maria-admin"
@@ -11,4 +11,4 @@ connect_wordpress_oidc_client_id: "{{ cluster_name }}"
 connect_wordpress_oidc_client_secret: "{{ cluster_name }}"
 
 connect_wordpress_buergerportal_username: "buergerportal"
-connect_wordpress_buergerportal_password: "Buerger?P0rtal."
+connect_wordpress_buergerportal_password: "buergerportal"

group_vars/connect_workflow_heatmap/main.yml

@@ -1,3 +0,0 @@
----
-
-connect_workflow_heatmap_enabled: "true"

group_vars/harbor/plain.yml

@@ -2,71 +2,3 @@
 
 hetzner_server_type: cpx31
 hetzner_server_labels: "stage={{ stage }} service=harbor"
-
-filebeat_inputs:
-- type: log
-  paths:
-    - /var/log/harbor/portal.log
-  fields:
-    harbor: true
-    harbor-component: harbor-portal
-- type: log
-  paths:
-    - /var/log/harbor/exporter.log
-  fields:
-    harbor: true
-    harbor-component: harbor-exporter
-- type: log
-  paths:
-    - /var/log/harbor/redis.log
-  fields:
-    harbor: true
-    harbor-component: redis
-- type: log
-  paths:
-    - /var/log/harbor/registryctl.log
-  fields:
-    harbor: true
-    harbor-component: registryctl
-- type: log
-  paths:
-    - /var/log/harbor/chartmuseum.log
-  fields:
-    harbor: true
-    harbor-component: chartmuseum
-- type: log
-  paths:
-    - /var/log/harbor/trivy-adapter.log
-  fields:
-    harbor: true
-    harbor-component: trivy-adapter
-- type: log
-  paths:
-    - /var/log/harbor/postgresql.log
-  fields:
-    harbor: true
-    harbor-component: harbor-db
-- type: log
-  paths:
-    - /var/log/harbor/jobservice.log
-  fields:
-    harbor: true
-    harbor-component: harbor-jobservice
-- type: log
-  paths:
-    - /var/log/harbor/proxy.log
-  fields:
-    harbor: true
-    harbor-component: nginx
-- type: log
-  paths:
-    - /var/log/harbor/registry.log
-  fields:
-    harbor: true
-    harbor-component: registry
-- type: log
-  paths:
-    - /var/log/harbor/core.log
-  fields:
-    harbor: true
-    harbor-component: harbor-core

group_vars/kube_control_plane/plain.yml

@@ -6,3 +6,4 @@ hetzner_server_labels: "stage={{ stage }} service=kube_control_plane"
 docker_enabled: false
 traefik_enabled: false
 filebeat_enabled: false
+node_exporter_enabled: false

group_vars/kube_node/plain.yml

@@ -6,3 +6,4 @@ hetzner_server_labels: "stage={{ stage }} service=kube_node"
 docker_enabled: false
 traefik_enabled: false
 filebeat_enabled: false
+node_exporter_enabled: false

group_vars/management/plain.yml

@@ -2,15 +2,13 @@
 
 hetzner_server_type: cx21
 
-connect_image_version: "9.0"
+connect_image_version: "latest"
 
-connect_client_admin_username: "{{ management_admin_username }}"
+connect_admin_username: "{{ management_admin_username }}"
-connect_client_admin_password: "{{ management_admin_password }}"
+connect_admin_password: "{{ management_admin_password }}"
 connect_workflow_env: "stage:{{ stage }};smardigoUserToken:{{ smardigo_auth_token_value }}"
 connect_process_search_module: "external"
 connect_oidc_client_secret: "{{ management_oidc_client_secret }}"
-connect_external_task_script_worker_enabled: "true"
-
 spring_profiles_include: "prod,postgres,elastic,swagger"
 
 tenant_id: "{{ management_oidc_realm }}"

group_vars/maria/plain.yml

@@ -7,9 +7,6 @@ mysql_databases: []
 
 mysql_users: []
 
+docker_enabled: false
 traefik_enabled: false
-
+filebeat_enabled: false
-filebeat_maria_enabled: true
-
-custom_plattform_users:
-  - '{{ backupuser_user_name }}'

group_vars/postgres/plain.yml

@@ -5,9 +5,6 @@ hetzner_server_labels: "stage={{ stage }} service=postgres"
 
 postgres_acls: []
 
+docker_enabled: false
 traefik_enabled: false
-
+filebeat_enabled: false
-filebeat_postgres_enabled: true
-
-custom_plattform_users:
-  - '{{ backupuser_user_name }}'

group_vars/restore/plain.yml

@@ -1,15 +0,0 @@
----
-
-hetzner_server_type: "{{ hetzner_server_type_restore_database | default('cpx21') }}"
-hetzner_server_labels: "stage={{ stage }} service=restore database_engine={{ database_engine | default('') }} manual=''"
-
-docker_enabled: false
-traefik_enabled: false
-filebeat_enabled: false
-
-custom_plattform_users:
-  - '{{ backupuser_user_name }}'
-
-# postgresql related
-# defining type of server (naster|slave|restore)
-server_type: restore

group_vars/stage_dev/awx.yml

@@ -1,3 +1,3 @@
 ---
 
-awx_hetzner_ansible_revision: "main"
+awx_hetzner_ansible_revision: "master"

group_vars/stage_dev/plain.yml

@@ -58,18 +58,12 @@ shared_service_pg_slave_ip: "{{ stage_server_infos
   | list
   | first
   | default('-') }}"
-shared_service_maria_1st_ip: "{{ stage_server_infos
+shared_service_maria_ip: "{{ stage_server_infos
   | selectattr('name', 'match', stage + '-maria-01' )
   | map(attribute='private_ip')
   | list
   | first
   | default('-') }}"
-shared_service_maria_2nd_ip: "{{ stage_server_infos
-  | selectattr('name', 'match', stage + '-maria-02' )
-  | map(attribute='private_ip')
-  | list
-  | first
-  | default('-') }}"
 shared_service_keycloak_ip: "{{ stage_server_infos
   | selectattr('name', 'match', stage + '-keycloak-01' )
   | map(attribute='private_ip')
@@ -145,14 +139,12 @@ shared_service_management_ip: "{{ stage_server_infos
 
 shared_service_kube_ip: "{{ stage_private_ingress_loadbalancer_ip | default('-') }}"
 
-shared_service_maria_1st_hostname: "{{ stage }}-maria-01"
+shared_service_maria_hostname: "{{ stage }}-maria-01"
-shared_service_maria_2nd_hostname: "{{ stage }}-maria-02"
 shared_service_postgres_01_hostname: "{{ stage }}-postgres-01"
 shared_service_elastic_stack_01_hostname: "{{ stage }}-elastic-stack-elastic-01"
 shared_service_elastic_stack_02_hostname: "{{ stage }}-elastic-stack-elastic-02"
 shared_service_elastic_stack_03_hostname: "{{ stage }}-elastic-stack-elastic-03"
 shared_service_elastic_stack_logstash_01_hostname: "{{ stage }}-elastic-stack-logstash-01"
-shared_service_elastic_stack_kibana_01_hostname: "{{ stage }}-elastic-stack-kibana-01"
 
 kube_master_01_hostname: "{{ stage }}-kube-master-01.{{ domain }}"
 kube_master_02_hostname: "{{ stage }}-kube-master-02.{{ domain }}"
@@ -200,12 +192,8 @@ shared_service_hosts: [
     name: "{{ shared_service_elastic_stack_logstash_01_hostname }}"
   },
   {
-    ip: "{{ shared_service_maria_1st_ip }}",
+    ip: "{{ shared_service_maria_ip }}",
-    name: "{{ shared_service_maria_1st_hostname }}"
+    name: "{{ shared_service_maria_hostname }}"
-  },
-  {
-    ip: "{{ shared_service_maria_2nd_ip }}",
-    name: "{{ shared_service_maria_2nd_hostname }}"
   },
   {
     ip: "{{ shared_service_pg_master_ip }}",
@@ -302,8 +290,9 @@ harbor_oidc_client_secret: "{{ docker_registry_oidc_client_secret_vault }}"
 harbor_oidc_admin_username: "harbor-admin"
 harbor_oidc_admin_password: "harbor-admin"
 
+postgres_listen_addresses: "listen_addresses = 'localhost,{{ stage_server_ip }},{{ stage_private_server_ip }}'"
 
-connect_image_version: "8.6"
+connect_image_version: "8.5.47"
 iam_image_version: "latest"
 
 management_oidc_realm: "management"
@@ -367,9 +356,6 @@ argocd_admin_password: "argocd-admin"
 argo_keycloak_client_secret: "{{ argo_keycloak_client_secret_vault }}"
 argocd_server_admin_password: "{{ argocd_server_admin_password_vault }}"
 
-awx_admin_username: "awx-admin"
-awx_admin_password: "{{ awx_admin_password_vault }}"
-
 netgo_msteams_hook_cd: "{{ netgo_msteams_hook_cd_vault }}"
 netgo_msteams_hook_alerting: "{{ netgo_msteams_hook_alerting_vault }}"
 
@@ -377,7 +363,7 @@ management_oidc_client_secret: "{{ management_oidc_client_secret_vault }}"
 
 # smardigo automation DEV gpg key
 # https://git.dev-at.de/smardigo-hetzner/communication-keys/
-# push mirror: https://{{ stage }}-gitea-01.smardigo.digital/communication-keys.git
+# push mirror: https://dev-gitea-01.smardigo.digital/gitea-admin/communication-keys/
 gpg_key_smardigo_automation__private: '{{ gpg_key_smardigo_automation__private__vault }}'
 
 iam_opentracing_jaeger_enabled: true
@@ -386,5 +372,3 @@ webdav_opentracing_jaeger_enabled: true
 webdav_opentracing_jaeger_http_sender_url: "http://{{ shared_service_kube_jaeger_collector_hostname }}/api/traces"
 connect_opentracing_jaeger_enabled: true
 connect_opentracing_jaeger_http_sender_url: "http://{{ shared_service_kube_jaeger_collector_hostname }}/api/traces"
-
-prometheus_tsdb_rentention_time: '2w'

group_vars/stage_ext/plain.yml

@@ -12,5 +12,3 @@ node_exporter_enabled: false
 shared_service_network: "10.2.0.0/16"
 
 shared_service_hosts: []
-
-traefik_admin_username: "traefik-admin"

group_vars/stage_ext/vault.yml

@@ -1,22 +1,18 @@
 $ANSIBLE_VAULT;1.1;AES256
-38663233373062663161366637373233653833663531383237653432633832363036393236653231
+34376237343736386538353235346231326462313534643130616532633535613331643236353764
-6136663865393830306533376665343733383565366333630a303664306465393566383663323666
+3737383533313861373030313237366131356438393333350a323230316663346634636634353239
-31663735623036363431346561616538623534636334633438366238653936383335303430613932
+61326262653334646539626464646663383164666166306162646166333462383833333832353461
-6461346332313639340a626139353538326461633133396163393464393335373866356133333038
+3437663431653566650a383632653134343238393762333131613633313036636536343831333630
-30656133346362393635663566383938633663303662623136373537353462333239366331376462
+34633361373264376263303364353531636434356263663965626639616666633861636463383637
-64633239373639356463363464376564663162393064623635623033633966653139303766383437
+34333838663834666532366564396566313739386262633335313335386661646166363636323766
-63393832376561646330343637633761653232656238383636333963646332303734303539373730
+35363535353664346463336566663163303333663065613532623265303262396531303831653636
-37613833313332393663656466316639326164306636663861363530636338633337633833343630
+65353565353233626331356666343932333539356331303161303062316433633761623132333033
-36333636633164613130653732616236646663626332613234306530616565626666343335616565
+65376632376266336361363832613064323861393366313763316434316264663562616134353766
-37303464396237323261643236633264633838626236373734396535643466373035346436376133
+62643165633030363237636632386166396538666337616430323534313062333965336233333836
-63623765663134373261343431366261666565303631376533303465383161366135383263326663
+36306637323764333233666239336331373763633737623666393466376163313738393036336232
-35323766306238396430343965653335323437663161326233623066356464316434633234303162
+34613536336336663837353031323665323733313634313731326537333938396361373435366435
-35626634383366303436343038336336333963326530326161336462326535376264343564396231
+32643338346635633962346537393338653464383431396432343932373439386230613537356134
-32323662323839353939653065306261636338643139613933323634666633313636353864396166
+64386165363233636237656364396333336261613037323136363630613533353639646439303337
-35383633353735383430303930303437393563323264656439353730353839616561373639336664
+31626663393335343962663033646135333366623738346436393764353438383264666666653635
-31663237343136353564636366643865363464656534393832383531393532646166643637326337
+64643462656332653361313766656633616134373166333163346131616334343161616235633666
-38306139663863653131386263336138643831303031396537373835613731393834386261356435
+3366
-39333331353635363633396337643234396231323463306465323636343539353232353464333236
-31396139383137666536663365393362393832656336653535626430333033353737633661663366
-65633130663937373861616131353631326135396366623231366131333432326662653365373134
-37303734383038346530393866613965663262373638313536663863356563383732

group_vars/stage_prodnso/keycloak.yml

@@ -1,4 +0,0 @@
-keycloak_https_whitelisted_ips:
-  - 195.200.47.243/32 # DEV-230 - sparda berlin
-  - 195.200.47.244/32 # DEV-230 - sparda berlin
-  - 92.42.192.157/32 # MOB-28 - mobene

group_vars/stage_prodnso/plain.yml

@@ -58,18 +58,12 @@ shared_service_pg_slave_ip: "{{ stage_server_infos
   | list
   | first
   | default('-') }}"
-shared_service_maria_1st_ip: "{{ stage_server_infos
+shared_service_maria_ip: "{{ stage_server_infos
   | selectattr('name', 'match', stage + '-maria-01' )
   | map(attribute='private_ip')
   | list
   | first
   | default('-') }}"
-shared_service_maria_2nd_ip: "{{ stage_server_infos
-  | selectattr('name', 'match', stage + '-maria-02' )
-  | map(attribute='private_ip')
-  | list
-  | first
-  | default('-') }}"
 shared_service_keycloak_ip: "{{ stage_server_infos
   | selectattr('name', 'match', stage + '-keycloak-01' )
   | map(attribute='private_ip')
@@ -145,14 +139,12 @@ shared_service_management_ip: "{{ stage_server_infos
 
 shared_service_kube_ip: "{{ stage_private_ingress_loadbalancer_ip | default('-') }}"
 
-shared_service_maria_1st_hostname: "{{ stage }}-maria-01"
+shared_service_maria_hostname: "{{ stage }}-maria-01"
-shared_service_maria_2nd_hostname: "{{ stage }}-maria-02"
 shared_service_postgres_01_hostname: "{{ stage }}-postgres-01"
 shared_service_elastic_stack_01_hostname: "{{ stage }}-elastic-stack-elastic-01"
 shared_service_elastic_stack_02_hostname: "{{ stage }}-elastic-stack-elastic-02"
 shared_service_elastic_stack_03_hostname: "{{ stage }}-elastic-stack-elastic-03"
 shared_service_elastic_stack_logstash_01_hostname: "{{ stage }}-elastic-stack-logstash-01"
-shared_service_elastic_stack_kibana_01_hostname: "{{ stage }}-elastic-stack-kibana-01"
 
 kube_master_01_hostname: "{{ stage }}-kube-master-01.{{ domain }}"
 kube_master_02_hostname: "{{ stage }}-kube-master-02.{{ domain }}"
@@ -200,12 +192,8 @@ shared_service_hosts: [
     name: "{{ shared_service_elastic_stack_logstash_01_hostname }}"
   },
   {
-    ip: "{{ shared_service_maria_1st_ip }}",
+    ip: "{{ shared_service_maria_ip }}",
-    name: "{{ shared_service_maria_1st_hostname }}"
+    name: "{{ shared_service_maria_hostname }}"
-  },
-  {
-    ip: "{{ shared_service_maria_2nd_ip }}",
-    name: "{{ shared_service_maria_2nd_hostname }}"
   },
   {
     ip: "{{ shared_service_pg_master_ip }}",
@@ -302,8 +290,9 @@ harbor_oidc_client_secret: "{{ docker_registry_oidc_client_secret_vault }}"
 harbor_oidc_admin_username: "harbor-admin"
 harbor_oidc_admin_password: "{{ harbor_oidc_admin_password_vault }}"
 
+postgres_listen_addresses: "listen_addresses = 'localhost,{{ stage_server_ip }},{{ stage_private_server_ip }}'"
 
-connect_image_version: "8.6"
+connect_image_version: "8.5.47"
 iam_image_version: "latest"
 
 management_oidc_realm: "management"
@@ -367,9 +356,6 @@ argocd_admin_password: "{{ argocd_admin_password_vault }}"
 argo_keycloak_client_secret: "{{ argo_keycloak_client_secret_vault }}"
 argocd_server_admin_password: "{{ argocd_server_admin_password_vault }}"
 
-awx_admin_username: "awx-admin"
-awx_admin_password: "{{ awx_admin_password_vault }}"
-
 netgo_msteams_hook_cd: "{{ netgo_msteams_hook_cd_vault }}"
 netgo_msteams_hook_alerting: "{{ netgo_msteams_hook_alerting_vault }}"
 

group_vars/stage_prodwork01/argocd.yml

@@ -1,238 +0,0 @@
-k8s_argocd_with_keycloak: False
-argocd_server_admin_password: "{{ argocd_server_admin_password_vault }}"
-
-k8s_argocd_helm__name: "argo-cd"
-k8s_argocd_helm__release_namespace: "argo-cd"
-
-gpg_key_smardigo_automation__private: '{{ gpg_key_smardigo_automation__private__vault }}'
-
-# https://github.com/argoproj/argo-helm/tree/master/charts/argo-cd
-k8s_argocd_helm__release_values:
-  controller:
-    logLevel: info
-    logFormat: json
-    metrics:
-      enabled: true
-      serviceMonitor:
-        enabled: true
-        namespace: "{{ k8s_argocd_helm__release_namespace }}"
-        additionalLabels:
-          release: prometheus
-  repoServer:
-    logLevel: info
-    logFormat: json
-    metrics:
-      enabled: true
-      serviceMonitor:
-        enabled: true
-        namespace: "{{ k8s_argocd_helm__release_namespace }}"
-        additionalLabels:
-          release: prometheus
-    env:
-      - name: ARGOCD_MAX_CONCURRENT_LOGIN_REQUESTS_COUNT
-        value: "0"
-      - name: ARGOCD_EXEC_TIMEOUT
-        value: "300s"
-      - name: XDG_CONFIG_HOME
-        value: /.config
-      - name: GNUPGHOME
-        value: /home/argocd/.gnupg
-    volumes:
-      - name: custom-tools
-        emptyDir: {}
-      - name: gnupg-home
-        emptyDir: {}
-      - name: sops-gpg
-        secret:
-          secretName: sops-gpg
-    volumeMounts:
-      - mountPath: /home/argocd/.gnupg
-        name: gnupg-home
-        subPath: .gnupg
-      - mountPath: /usr/local/bin/kustomize
-        name: custom-tools
-        subPath: kustomize
-        # Verify this matches a XDG_CONFIG_HOME=/.config env variable
-      - mountPath: /.config/kustomize/plugin/viaduct.ai/v1/ksops/ksops
-        name: custom-tools
-        subPath: ksops
-    initContainers:
-      - name: 1-install-ksops
-        image: viaductoss/ksops:v3.0.1
-        command: ["/bin/sh", "-c"]
-        args:
-          - echo "Installing KSOPS...";
-            mv ksops /custom-tools/;
-            mv $GOPATH/bin/kustomize /custom-tools/;
-            echo "Done.";
-        volumeMounts:
-          - mountPath: /custom-tools
-            name: custom-tools
-      - name: 2-import-gpg-key
-        image: argoproj/argocd:v2.2.5
-        command: ["gpg", "--import","/sops-gpg/gpg_key_smardigo_automation__private"]
-        env:
-          - name: GNUPGHOME
-            value: /gnupg-home/.gnupg
-        volumeMounts:
-          - mountPath: /sops-gpg
-            name: sops-gpg
-          - mountPath: /gnupg-home
-            name: gnupg-home
-  server:
-    logLevel: info
-    logFormat: json
-    config:
-      kustomize.buildOptions: "--enable-alpha-plugins"
-    rbacConfig:
-      policy.default: role:readonly
-      policy.csv: |
-        g, {{ argo_realm_group }}, role:admin
-        g, admin, role:admin
-    metrics:
-      enabled: true
-      serviceMonitor:
-        enabled: true
-        namespace: "{{ k8s_argocd_helm__release_namespace }}"
-        additionalLabels:
-          release: prometheus
-    service:
-      sessionAffinity: ClientIP
-    ingress:
-      enabled: true
-      annotations:
-        cert-manager.io/cluster-issuer: letsencrypt-prod
-        cert-manager.io/issue-temporary-certificate: "true"
-        kubernetes.io/ingress.class: nginx
-        nginx.ingress.kubernetes.io/whitelist-source-range: "{{ ( ip_whitelist + ip_whitelist_admins ) | join(',') }}"
-        nginx.ingress.kubernetes.io/force-ssl-redirect: "false"
-        nginx.ingress.kubernetes.io/ssl-passthrough: "true"
-        nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
-      hosts:
-        - "{{ k8s_argocd_helm__domain }}"
-      tls:
-        - secretName: "{{ stage }}-kube-argocd-cert"
-          hosts:
-            - "{{ k8s_argocd_helm__domain }}"
-    additionalProjects:
-    - name: infrastructure
-      namespace: '{{ k8s_argocd_helm__release_namespace }}'
-      additionalLabels: {}
-      additionalAnnotations: {}
-      description: infrastructure applications
-      sourceRepos:
-      - '*'
-      destinations:
-      - namespace: '*'
-        server: https://kubernetes.default.svc
-      clusterResourceWhitelist:
-      - group: '*'
-        kind: '*'
-      orphanedResources:
-        warn: false
-    - name: bootstrap
-      namespace: '{{ k8s_argocd_helm__release_namespace }}'
-      additionalLabels: {}
-      additionalAnnotations: {}
-      description: application declarations for bootstraping k8s cluster with argo-cd
-      sourceRepos:
-      - '*'
-      destinations:
-      - namespace: '*'
-        server: https://kubernetes.default.svc
-      clusterResourceWhitelist:
-      - group: '*'
-        kind: '*'
-      orphanedResources:
-        warn: false
-    - name: cus-mobene
-      namespace: '{{ k8s_argocd_helm__release_namespace }}'
-      additionalLabels: {}
-      additionalAnnotations: {}
-      description: application declarations for customer mobene
-      sourceRepos:
-      - '*'
-      destinations:
-      # TODO all applications have to be in argo-cd namespace
-      - namespace: 'argo-cd'
-        server: https://kubernetes.default.svc
-      - namespace: 'cus-mobene'
-        server: https://kubernetes.default.svc
-      - namespace: 'cus-mobene-nsodev'
-        server: https://kubernetes.default.svc
-      - namespace: 'cus-mobene-cusqa'
-        server: https://kubernetes.default.svc
-      - namespace: 'cus-mobene-cusprod'
-        server: https://kubernetes.default.svc
-      clusterResourceWhitelist:
-      - group: '*'
-        kind: '*'
-      orphanedResources:
-        warn: false
-    additionalApplications:
-    -
-      name: keycloak
-      namespace: '{{ k8s_argocd_helm__release_namespace }}'
-      destination:
-        namespace: sma-ums
-        server: https://kubernetes.default.svc
-      project: bootstrap
-      source:
-        path: config/kustomize/prodwork01
-        repoURL: https://{{ shared_service_gitea_hostname }}/argocd/k8s_keycloak.git
-        targetRevision: prod
-      syncPolicy:
-        automated:
-          prune: true
-          selfHeal: true
-        syncOptions:
-        - CreateNamespace=true
-    -
-      name: filebeat
-      namespace: '{{ k8s_argocd_helm__release_namespace }}'
-      destination:
-        namespace: kube-system
-        server: https://kubernetes.default.svc
-      project: bootstrap
-      source:
-        path: config/prodwork01
-        repoURL: https://{{ shared_service_gitea_hostname }}/argocd/kube-system-filebeat.git
-        targetRevision: main
-      syncPolicy:
-        automated:
-          prune: true
-          selfHeal: true
-        syncOptions:
-        - CreateNamespace=true
-    -
-      name: cus-mobene
-      namespace: '{{ k8s_argocd_helm__release_namespace }}'
-      destination:
-        namespace: cus-mobene
-        server: https://kubernetes.default.svc
-      project: cus-mobene
-      source:
-        path: config/default
-        repoURL: https://{{ shared_service_gitea_hostname }}/argocd/smardigo-mobene.git
-        targetRevision: main
-      syncPolicy:
-        automated:
-          prune: true
-          selfHeal: true
-        syncOptions:
-        - CreateNamespace=true
-  redis:
-    metrics:
-      enabled: true
-      serviceMonitor:
-        enabled: true
-        namespace: "{{ k8s_argocd_helm__release_namespace }}"
-        additionalLabels:
-          release: "{{ k8s_prometheus_helm__name }}"
-  dex:
-    enabled: false
-  applicationSet:
-    enabled: false
-  configs:
-    secret:
-      argocdServerAdminPassword: '{{ argocd_server_admin_password | password_hash("bcrypt") }}'

group_vars/stage_prodwork01/mobene.yml

@@ -1,500 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-38393035306261346134383162356566326337666661653966396532303666663037663163396466
-3931326461323966316431316163323061636163653863390a643866376430356463303565366230
-37626438636366626162643833613035373532663530306461383932666638356633613166356363
-3234313739323864610a316136343030343464663066616632633561373730353334383337343439
-33346364376339316535633261323465646661626337383166353936393964333738613736303434
-64316237623236346631623333383835313866323035623364623531306335653334626339366636
-38303535313965613464383534636435646261356231353339653436323639336532383862363162
-35383535633665613464613238653330643666616436643130663666663631313762313733363064
-35316665366136356264666336376361336565313632386663383438626633633763643066636266
-62396435343236373963393565363165353566613830336639366433313635633736366637346236
-30643262656132313130306534366131363138396565366462306236366561346632373837323332
-35653561326530656438633836393133376435643430363633663866633364653034666232663034
-30363862653536306634366237383135636466363231633462363538363465323037333036326335
-66363964326563336135633266333732656130343336306534313334616134346661633133366262
-38326637613730616439316265666335363239616630363234363261636564383539343662393961
-39643338643066663663383736333062363436373962623538356236396364333064336164303033
-33313434643835616362366363346438326533393766393235353835346238316537343666373839
-32616631333236663162323363643333323535386230666166336365343262633362613961653930
-34656330323763373461346464663166343833613066353232633030623130393036383162306562
-66633139303861343965373463303261633633643665636262323461353134643765393930346431
-36353364616533313064613731336438386562626164656263356635303634336434346564626535
-62333132636433396565643836643762663762373637353739333631623434656463643739646633
-31386630663861303934323162363138316266663936386333373730336534653631366261333733
-34373437393964363131653630616330616431643362333431656135386632613034616635663366
-30623536333834353731373831353161343564373239623861656364646238363131386561643031
-32616234616133346637656161326337346163313131323735376362353363353261323239376264
-61626265373766633836643131323135356338353762363039306638346432333162373436343761
-65303437653134626365383562343639343231343265666637343163663232663535346564623661
-34303931343666643966316437306339663466323865386562626266343133356331346665623866
-31653364366662646666316161623237383431326335306661323536663637633938343736346434
-35373738303335376637623466336666346632343938336264663062653833366638303563396166
-33333065643935343964303734303465366465343832316365303231356337306132316563646264
-30363161363739323465646466393435636539663630323634633034336265333064356231356563
-62396236363337633230663634353566653230386366396331343262653762626666363932326333
-34343866353831616232336335663861623864613164333864323938353636366133663365656431
-66373162656434333236376337313830653035663738623564373961636337343637303631643436
-30396138396266663364346337373637623763653539376430613431396535313632313235666339
-39333765326536343034363464366239383935636464373232346239383631353666356533346331
-39663238663431653036656535613131636262663536363332663234363066383262623731386235
-36316133623566633836393630643966343261393532653835386437373937303631643635326337
-31663566316530313238626330383532653334383236346337333534613431646466633832313765
-63613937613537663137663935393337666333346466353466613138333861663064626434643637
-64666361373936393434346463366635613031623263343739303765306539363133353836396435
-64396464303139613736396361343231643937643861663163613736303466306432323762333865
-33383665663037303634376530343630646135623237643865653934313864363936316536303163
-65663964656632333764656464323837623138633964336435663133646234343037313065643531
-35643739653238363064613636373032646337363865306139643437373564303238623431643035
-66303561306333373534303630633461656265333231303731613634613533643264613830343733
-32643564376333363962396436313533666339373662343365653930643131313566623735623863
-33383837316433366562663966353261363639306435313261636165316566393964316438303761
-39386264323562646230616137366164663465363961613863386533376266303538316238373663
-66326438356464633065373139306630626165323664346165326136346335613935393632383164
-64326431656233313036346463303136653237623236383930353033636536653338613033623738
-64366431613363626563376331313736373762373863323563396335336631623732323330656566
-38643636653466616162643264643934373739383263646538323039636537393934626265653930
-39376262653533306163353663303635396666666337663337623039643464383965643234396635
-61613931326633656637363132396563613739323362393538373636373731376231303734633835
-30336538616632333539663932646465633039396133366136323637316163656136646339323266
-65626239666538313231323336386662633134353235663132616265646166666239636338356263
-61303437353930616437633465666534656434303530393766393932353235333532373339373834
-35303631373634636437396633626530316461323863356362356165316533656536623931656563
-61333330623439376137336464333561343961303835323632396265346533336532616135653731
-34396561343562303438376533623738383334646439636634383431316661306435633161666363
-39306336363464646137626165386665633738613932643563656463383031323039396331326266
-66396365346331303436353565616532323637363563653636643934303962386435653533373030
-65323531363830326262376236636236646163656139363430656534336332353262623330643631
-36646539383536393664653932666534653761353966373031656363366138386539326135383234
-32346163366432373163373437323039656161663238326563313530656566343138653238643564
-38396234336332653861623038306663363630623139303736306131643465653237316266336461
-39303932313663383965333434666362373763653637353064316661643939316431386561616238
-64393938306236323736313131616132393631663761623935643065633432306237346261313631
-61656230306236353964363035623961373638333131653562326163303633396539343461383065
-33343237343866393561653834363261353039643032633964373931666461653730613233666334
-30333734383536336635393461626130353735653566633435613332376637383031643935633736
-64353063386230393539643534643932326336343239323564356330323034626233623136383462
-63613066376638643030336463613836313135613732336334613337636161643936333632393065
-65616262343062316465386633636661616331343434386461393936666661636366383663376633
-65636332613937353262653766663239346334666336323164363734653961303262313662336165
-34646162303934643834663261373833666666383031633333613064306466626263646639623132
-39643737343461633536636331393135303132666431396565346530383731643365613461336664
-37373665396532353466663537333833643835383263316430306665323366353830396137343561
-37313032343866633635636135326566666566323436376234336364323330303033323230646635
-38356664316139383233633134396631346232366639316330313436306337306665663534303362
-37356235616465356532383337333530383466346638626563653138626538383761633261363266
-39646264386537656264343766313137313163363732336137313061366336373062333336363062
-35643632343264343530376135346530666531623261393133623435316366313465343561636535
-62646132366139653462656233363834363262646663646463666530383361646461633562616564
-35643632376237656364646662343866663131333266306639623538356361653635316564616239
-64613031353236663136303763653634323562343164353636313938626139366466653665383830
-65376335396531613166303130366437386166363034336337343833643037343835643230636536
-37343330373535633233383139356437383465653561616161653838353364643264643365313964
-34656261663962323639616166623561316130336562323333303665646230653537626435333537
-37393965303265373437623531396534323162633661613132633339316337376234333666363738
-65386632613965343534373733346535303461363130653665396263386337303534643461616465
-34613636366231303930326266663261623161373634306263376332653136636332306532346639
-64626666363634346639653835386366383138396665653234333539323536316664613332323161
-33396463303330333031623938353533373939346535393961366139613634363738366138356437
-30633733623564633134383366323161613064666238316565626362353935643363616338393562
-35383939306666373438663837383137316263313665666637376530383065356638386636343863
-61303635663434393538323639656132623562373062303030303030366636393261333865313636
-39646136313866313830346630643133656561356162616635366236396136373538306335373533
-66393034623535386537626636336531376138326232386238326635326638353734646563376665
-38386534643063313565363364393766383635376132613736323165326131396364346665323765
-61343137663365363365333534623338643263383733636661376632623938636132356231666537
-64353134613862323531353066333635613133656465326230346162303031386561666664343631
-65316531613863363735393664656536623236636465643737323939633839633833393364376138
-63363437653663633135653838323962626361663163326661616439653934666238613930386265
-38383732626333393235623638383764396665653230636431633361663531383561326562313133
-33626338376464636534346166626464363566343936323436333938653335396563363930336533
-61366461656434353532613363303438376639653935373266386465663434346635303563333435
-37656263376435333038333233646638396436663432303563323236393330616131643662653733
-34376639353939393838383435663934333064633132373363373065643939336633633461336631
-37343361306531336362643735343931613865346664323433656631363335643330353437343733
-36383130336233326335366132643534373764353930376530313934356530303632613539326665
-63663330346262376333613431613334656466393436353132373030333636363234363462623866
-33643136633437376364313539373736363962633938306663303564363836373031623133343832
-66636366366632666566353564633838393262353166323464383331366162633561623939373766
-30663034396539333236393130613534336238333761343164636231306661626264316331353432
-32366263363137313961363337626335366265663263303361396336333034346632353136386165
-30336564643335633264383362396230306635336362363464633631386265303562386261353066
-36303634333336373761343963353733633632633962393336306663633862613134396463656237
-64363464383337663133383965316232666561323864386331636232396138656364613062303266
-62303236313863346662336161306264336266636431623238306530636164313866313939346265
-36613564336263313938333030633431663564336438326438643333313865343738303637333436
-33633239346563323764386639313737383736316134643662396433353338663936633931313430
-37363733616534363264333437356635303935643431633335633538623631326465383864303237
-31353663306366653333623566663266663130623130393665363834643561653961346464333264
-61363631636436393236666362613130663037306330636363623436353861316363666364383264
-66383435353239376331393937343235366562343433306666306365646330396133313035323165
-32373831306337373236346361636465356363626138356161366466373734653465663230356532
-31376663313232333662346530396639363334353330333830356235303430646539316366323863
-33336436343066383564376132326531376266373730323535303066633532303663663638396630
-66653235643937383366633764653234353236623133346530326433303534363963356436353565
-35303332316464343866323361316438303538643935373263663131643237396463323137326466
-38313162653863303365363235623537356530393531633862356465326436663763316436313434
-63623763393532653934346264313039366461643238313336613639646665353030313830623435
-35376533613837343032623431343564343564343637343862656137396333356364363435346662
-38396534666663626131633835613637383434616431303833653334386435616463636562366164
-64333166616334336365376666303162386630653233656337336436653365306636656233393037
-38343161376466656563646463363664623363303035613661323361326635393232646430313534
-35303663323662373134633162646436636233333464393639343034616364323862366139303336
-35636533393137333632633262376263616338323638616164313838363865656164663861366431
-65343230343564656533616334656234306432353166323564653131306434376134303632386138
-30336131353437643663633864303439316232373861376565396664636266613966653334343732
-62623861643038623234393431333434363330346536303733643534643666393933353335613664
-37666537633061343035343731336665633330303930326263313231356238313964663134656338
-63653731333861666231666131643031346238373038373833613036623463396362336564633465
-31343565636236613432626237636433633830393934343662303232383431663764356634626230
-37326439646132376230363266633437396161313566316562626332326132323334636339343534
-35303561666239643434366637306165323463653264646462666636323361653635363834663464
-35323961383066376430613130313863303338333562396663623361353235336533313630373535
-65303863613932636164383764366330396431626138323966376234636265663734616336383334
-39376436643362343262616230326366303634626131646564343364386139626463623765653934
-66663930323137663061383539663738646334313138363861396337663366663361323833356231
-39376165333133626337303663303763366331306533666135313134646466343166383435663837
-38626136653430336266343339386238336635656266353866613831376561333832363936653138
-38323131373338313065336166393832343236343135623635353966643733613339323934376638
-30666430383066373930613237313239356564303061313430393032393933343561646635393465
-31353666623236613139346436613238396462636335363434393837303464333166353761333437
-31393438373063336161633032623430663539376334373066626163316635346666636136396264
-64343236343738636137613933373739396636396366626463613530646434646466633830393334
-66633435313732643831356639663961316266636535383735353131653834656433326561383934
-63366639356264626232373634626130613035633432356534316432653262626637636665346639
-30393936623762343663316237613465323565656336363264353363633662363165626539363238
-61313461323835336531316231616135363635303566616663613531623730323933623462333034
-63376435346465616661303662636265346465663065333263373530303234356134643238323864
-65613765323165333062386661303863373437633463353231333061396234623935323135383434
-33383533613530653235343565303562656165663237336162613935633061376236646564306665
-39653030373938653566393933313832343738383232666631613137356165306664383937346261
-62653565386337373966666438303566613065373737383937303031626266643933346335303234
-65363463393562316237663130383665613635393235383830656462353139646332663835313739
-30373535306265623230626137376561623063663037626439363834303531343839376130346233
-31663266666132333366366634333964366563623261633938653564366666326666333565613635
-61613135373466626465646637636666643363613432353165613834626561326433643863383966
-37366633363565656632333262363764363338613063636461663063353634373131636232656339
-37623030656562316464656464343337316138366336376436393830356434333731313366313435
-35366163366161633965363263626362366163396132383939613463373139306634386162366231
-62353563383466363833326264613731376464356336643066616562323732326630396665313364
-31346639333561376564353437323765336132373139663262373263373264633465666631366139
-63376466613466623131393038623039396330313333663939623663313762653561386530303165
-66333565653938353135353530326132643564336532626433633535653039306332633731366635
-63613738353163613535306464303336396165306638366561633833356365363432383163646166
-35613465653535656632666565636433666261313938373537623936336562653732376434636636
-65633761623939666138353964616537363837643263386666613163303039613737633265373265
-36663736636134623431316264383430643331333839306132643631643934303464303762336637
-32393263383833373865323439373837623035393633393131666664323566313633653233343361
-31616466366564303662396561646364313334356136333332343931653132383130333365663762
-38363336346664353766346665343962336139306432616536323336356431356662353164373436
-66613463326639316361336530373337303564313139323061363136353464336665396334646333
-39383937623839643539316139613663373832393139386231333164373961633834623635363735
-64616366303739363366653934396535633361626138383633633862633964306132316333666530
-66623135643033393538626639623737323331363664663563646464326439636335343037653165
-63646261303764396266346362616561393738386136643866316630373538646331643837303930
-31646538313961363064336166396166383938643335653862383166323532353461666461383737
-33653337353637393934333566356261323937336336653830666164373262343065333261313936
-30333362316137613962613666313938653533633833323564366332323866366635616166623762
-66326235313630663162333038623765633235636565303166373337383138666334363334386663
-32326333383132373966663530663130373263343662616237323435343566636230626639366163
-37313237386663653636643031303464386336306439633866306363353739333733663563663937
-64363062396565346230633331333039306466616264306630333032323566366431346632643263
-39323734393031326666313861663439383664343534306639616165313065613163393632323937
-34313939653038316436626139663566643837663838633866616637356231666161393263396161
-39386433313730323237653637623839303732366531383637643832633234313866333633303563
-34336334393630313862623536303035663532343137316266323931353462346634613464343761
-36396166353739313664666535306233623831313630396231396638623838373736623764643939
-32333838386535633039326462386535386637376437653138353834383266313432336332633034
-38633061376439383163356237316639653230323634383238333539396435613661626139643938
-64313132326633303266613138636436616337363263626438343832623064363634646636333131
-37306636333362363230356661363935623032313533313366663764636364363834373236653665
-34396266396334336435336637666631616166646164383032383861383464353531356439646331
-33633365663836663634636666393636373831343831323166316636363365393036396538646533
-66396438613266373266363035363338613130323734336538663564646537626662616135346334
-31656439343133643563653866393033636139623265333435373538373136343264666433623232
-63383738353736383530303561626439633634646239326436613937363038353030343239363062
-63643739626365653832643934623366373936343139363730633434303662316637616165666538
-39633563366365346439353130613937326530626231656638666561613933393338313266343961
-36303033376361663339363430653965623566326632636637373830366663643039363863396164
-61323765353263383862616238376135643235656130666564663065616538636335643939393862
-62363330383632666561333634666437306230333362356438363964376465383335383138656435
-35393139623262346162666364313434633061656539623931636636353364346361396134623737
-37643130663031616637633137373130376139666434316364393132666532666339643439636330
-64626639376338656333623132663335326132303065323865313132363136343434383734356564
-66633137623266633932303730393637613538333932306535623065353034373733346138386338
-31323435613139313162613635303337313732376535376131393735366334656465373831343865
-63626531653130396239636166363763383665353037376236333962306238353531646265373335
-61663439616436316563643533643165656262646162343462353966623734663031623636393235
-35646435633138363131376664373663396239626132343165393061366366343732653734343938
-35643465663835656434633862343861323431323164366665643832326263356334393366303337
-33393136326563353735343336616338343165663532623036656666353432373237356334326339
-35313732313135303963663733313261613236313732353262346266333566306262316437623666
-65306532383565313337386661323332613164313664323639383331663534616130616361633334
-31306432373363643733363038666233366333373432313336316636363966633739373838663537
-64386463626561363563393864613935306434653934386531323330373562616130613263633734
-66663539633732343665373534323438356232356238343434613163383233643163616138663336
-34626531656566383764663262363736306165333536633265353133333363363935353031356262
-63646530316162336232316333636634666165393865353462653338333834383764333539363231
-64623731333063656665623466633834313030333964643138623837666232626365623035346333
-30386233376662306539376631373234323233303633313462343564356430303432333864613731
-33386534633163386330376233313739633336373735383238643834643666633363653063386464
-39373133613633306537636332393236613231363466626662613537386530666665366263333366
-32653266363964643862386634313230323661373366366236376136656231366432623732623965
-63396232663439366261633165383161336431393866363238333137313361613736623936356164
-32623531353062343732356461616138393163306661336165396162636263666638643535306334
-62326130313034366431636130346134343039613637376162306431623163343263333432363561
-62623733386464363736663061653332366434643838363231396535623337663439623265623339
-66643731393137623163633633613431323136373865306537356565616530373366646134363733
-37343339393636386361643230336634636137366130333163663236623063376535326166336135
-64353163633137373761663365613138656638656132376563623334646639316432363765656434
-30353465353537393439353636326537636133653132626537353665356235376533653733363538
-30363636323831346663356161373032613430643833363762373662306334323933323262653539
-66376632313430663365666534383565636663363033373039356430336363323065396664323461
-31616137346530663163613239346363393730663564636261316335333431666664633338356562
-31323431376238326265616265336461323037376636613064343836666262626132373539636539
-31613263653665396161353738393161653163613939613963306234643339373134646565396335
-31336333636639336663663966383662326661303631646165326662383330306430353136383463
-30316634316162663430343037393236656332313134343134383262396265316634396531643738
-30666333383633396361323765323961636565306338653530356237626138663765306466333836
-33653762306163356163613163376164386633306635353439626166363331393535623434326464
-63303130316432363265613031303738643566633230383436313661353565616235323966646635
-37613965353432303966623234643363373135346364623335663633646232366532613135636430
-36346335366635656635336538386238366533656562623732623865383639353737343266363662
-31343038313730643464336239613966333934633936626662316131633738383237346232666635
-32386434343561343864623361616334616463316163333962386237633337346633626163646534
-32613034333433343236626133353265363962613861656532366537613837366332316531303362
-30326639636437376163346664323661656530646238633861666437656366356564666566656235
-62326536393963353733353336613839643431336134636664396462383763363237666533636165
-39363636363736313764633761326165316131303539373536386139383666633338633235623535
-39333731613330343130333663316530396630316339346332313131643531643032633235316638
-31383530366539316634656139303133383036383232323134663963386538636262343939353837
-39393666326264616434623462353561643938333433626531393466663230356531613635653434
-34353533653034343831383030653331326135333634373037353666623031383538376535353762
-38336262303665353038633638306638616364326564333239643437616531363663323235353935
-63373739316264653239326236333562656537376332333135663163636335643835356233636330
-33646330333632633939326534616163386264643630316333623134383736666432653835313965
-61366565373133633039343938306166636264383564353262343066613933363365323233666233
-36313234343865666634656362626466313631663237343463386265333338656531326665653235
-39393264663832363830346434386465636561323935633639383634633161643733663431363637
-36623738336136383365316334313835363333656465353065653131666537623866646336643166
-35373030646165383739326563383236353863376437323335613862626336623230626439613465
-35616633376135316464613765333132623761323161643639333731326535316663346562613733
-37656336383664326338316137333639393061386462646336303936643736663339663932626365
-30396465663938333336363461393636343435336536356664613734633135366666623861643064
-62396666666233366663326161353065636535366561666362653937306538623762353963613634
-65373364666363616263383166366130316339373338313231383637343238313731333735633031
-35646336633464613133613832343339636338376432646336343463323839313336393139636663
-35363931653165316330616336646230646166303966363634636637383736656439323032383132
-36626562363236663431353733626464643230343636326237323038393130613337376264386161
-63393563636532353833366539376539373837386566366261346338393964646264396232386439
-36333436646634666539643036616530613964616238326262383530386430373765363161346461
-64386365376131363139613334356138316533626366666137316166383636623963316662333464
-39613133366232656230623538343163323763333931303133656363666362376239633938663230
-34393032393631313937386336313065656638306237353435336332646163343330326332393136
-30363038386566613938346262656630653365383639343330353762306539636263393137363366
-30393136343032316164663631386163393639353937346637303565643665653038653664346466
-66303762623837336538313130396638333238653737643439383662396239313338386132613835
-38346336316635623030633863633431303462663563306632323930633731623937663761623335
-66353733633236613432353031353462356163343364393563373236386338393736346438383865
-62343735393861393463363064643337326136346664396430313839616438333337616236666136
-37626636346163666639346435373036333962326137646139336530393436633335306235626132
-33313930313531643931333331343664346131663433313834333033396361653064396439346262
-34616635366237376434633937653865616136653463646339646137363365313530663033316464
-37613133383861366164373464326335386432653563663562316635353533626562393532616631
-38666338643135343735346232656561313638656537393231383635343262643530353438376566
-63613062396234313639393863633765393966383838326562643539316336653937643238356633
-61366235313964346262383365313366383564613732383064393665386133323538353032613662
-65376637646263306431376235336163373931336635343633333432383832393932323463366363
-39393830666161613939626237666361323362356332396332393765643964336433356261363930
-34643131316437303634653565386633656362636663336263373362366265646133366561353433
-34616562353030373535326265353537363438353930636135303037333566363030343935303134
-32316231363538633662666337343564373465623739303839373139313734343831333164303439
-39326433643861393330643530636530356531363331663934646332623535393066323639643038
-61623664363966396536643330653636633733333536646666386135663739373538336262666661
-33643161623132623632373363353536303762613361666361303164383363306533323539626239
-66643133343864626634363062373365333238326265376330643932313533666564616266343730
-32646637316364373433373236646334333964353664653133616233663062333864353636633063
-66643464636466333635316635333865643635646331343438623734613865663338316336386536
-37633337313266303461653661356564333861373732613730653036636331303462376363663737
-36633438393034643932626533643330363765336537333562643035333866396539636234386663
-33313632323737313536366133356635323631636131306335616137643435363433653633323264
-39633839376366623466643838393334663565303632343433623562323834326132613665373162
-66313061303465613062353238623962303132636231616530633832303634346335313566363964
-34323866653862306261626531383363313438616265313532613965613139663262336135656631
-32393662323661633233326164363131303163393463366533373334633864633862663463343832
-34316261396533663733346437623837313538653236646162383161346261346563383534356561
-34663336376465303561666232353232333234373163333635376237613234623836323035393461
-36643634303337633033633730396262376164633639353963333034633962636637313538623262
-33613461353331336430376537623839323764633666306236356538326164323737633865613663
-66393132363562653666303134643263653165333939383831336232393838303966613133346135
-30376464373431303963383832663364316130366531373637653834643437313637656662343834
-32623932626164323239313132383562383933353430353330316434643865346662633864363335
-35633163333236343137636534313964666463656663333232303639336163386336633764386431
-61313566303131633162333539376333376563343436323362623661343164346562353234306138
-30343937353331623436356234323430386262636635346131366462363334636661303962646364
-62613066346163363766646531323239636136386664636562393564643261326263386138376661
-62323261393264383136366330353435623139616432333061323430616462313034356232323664
-61623532643330653530323735636532356335303637626139303464663734613233653037343533
-30616237363163613838393262386236323565646636353563373339333534373833613762326132
-34346230303032366339306430346437326536303139396238383165326530613061643563343265
-32326534346631303062313465633232343465393937303262366131633839346465613233333436
-36626663356461326338616637656336383332353665396133383666343664333535653634333037
-36323138613438626530313565313733613166373563386132663639323539393366623338323663
-38636137663732353739393136313338663764313338396634343332306430333831353235626565
-64663938643964623439376261346665653062613735663431653233373037646132636262346561
-37333962323231363466636532303639643031653733663464336433646163316637653430386339
-37373037633564353563633762303263623634376238306361636263373462626431383730626631
-62303438613437336462373437643631373039653534346265326266666632356237306538396634
-30353033393163636239393663303431333335343436323563656239396132626136373961613435
-66633539643638363734616162393934643061323261333962386531323933353463333433643932
-33656563333761653662373335613839356634333532303633386237366234613138623965306335
-38376635633332376137643366356339623561336361656563356265343133343034633536383035
-62653864366330616365623930363666356634333461373235303364326264666362333462626137
-35396436333533343138343239363435613061313065613838383966373939643836653062303965
-66623634316131333735666432343830313937323864663330643436616537623132376162633837
-65626631653962343166303338646138666564653261633631363531353263386337613836363064
-30396635626566623235643063313735656534646533333836633933633235383163313166613635
-38616531376534363562316665643764313830346336613530343632386133343039643064633764
-61336133366232383539653466386665373666356131623165616166393536333935326631343862
-38653938336464376639636664363034646134313762613930666261363332623837366630376230
-32313963373738323639646661306235666437306330633465393234613339313064346661386661
-38613437303936343537613163393837643166343636326335656536396335656564366437623535
-66666332323161373430333735336230396234326230303336366561613965633163336336643266
-66633766353831626439643161393835643636653564613238323333636265643564366237353335
-39656262656237353864653338663334303436323066373839663365626563383066363634396238
-31376662663066303364323639633634633136653134653666623234653239373064653262646130
-34366565366666323037633738303237363465333232346536363466326238373136393363343166
-65626466336639386139323166616336346537353862376536643562636662643531353165386133
-37376332343333326366303761346639393261323534643965376564353032663861353437313330
-63633961653730333863633034613338666335306261333762333132393236353331633338356539
-39306533336265646133373065643238386538313238303830643837386137316461323363666433
-33633562346465373463383264613163643630363862376566613035643961343232333331613938
-34643662353965336364656531303839313266663061356338333963323661376464623134356530
-66383732643265643366623265633331366135623934383133303938373131326163643761336135
-34626466346634666164393038663736616234303362343065636239356531616534636161653364
-62656631666534333739303231633862303330333165353736316366636461623932623138633564
-35626165656234626666666330323837383433613266656236643731386333616636623733613831
-33326262613161356638346664393230353635396234363033656632346434386261346262626335
-61323265303737386563353335633131336230336266353932333761306435616362343335613939
-33373431633261373135356337393838626661656433643338623361643362366561306338343336
-38376466613034366633373233326562373832343232636362313630323861363034393362396165
-31356539656462376530373362333263343561383834643265383261376233323534366133323762
-32383038333038386433366334346431333435643064663566356266623237393533626431623361
-30306534366530363865303039643032353731343334303435363639326632626239633062633562
-38323539633932323332646463396165633333393738663730396237373864396634643035333734
-66366237623330663335653162373634613565633033663566643964373436313533656566313934
-32613736366235396237326233393532653433616563633364656365303364623931613561626238
-37306537373330366231613231353835303834643066666132343332613361656365626432636263
-64636237353766663833366339316631343939626137633138616335633139336438303038306339
-35623666353939316539346333366631626433303332356465656330323964336463373737303638
-34356464303437656364326266623134346237643061623365346361363564366134323164353835
-65396232363931316339393737616264333765323432383833383065333838343331363934666334
-64333164376430343734373362376130613433323465653132313665666365306663323166306239
-31333961613839646466626663356235383361656462393238346566646637323438326335386165
-35363631333332663332363434366530616134663663346537346434343666636336646665663438
-39396235333434613932313539313833333666353366336263653137366363666530303632323865
-61636261353564396230623261613965353530326533336634393338393438343863396266396234
-36653731663035373466346131633038666165616633623566383336366264613061353934653737
-31383734636231633335373465633236373236633133316364656462396566653539656130306133
-33363266653766656530376433393738313331316565653930646266386262383431663236323161
-34666633653064303835313864343736653738356333346164653433613333336434663666656235
-32663131346435383037653335373061633437353464306164623938613737366337373133643336
-33363335356134303561303763323635666637653639636435303162366562326337666139396463
-38623531363136363132613630373036633431393433626432326439376565323634653531383036
-33333030663032306132383661316661633463633163616266343335363061363434376436356339
-36623834613663393566326132336361663330333836613633663239306636613032613039633763
-30303530313539666137396332303437393735333037663461313863666235623039323638396138
-63353264386530646231326530633562353737653762393538363232653439653264363162383362
-61316564353733653463306564333931306462373037346338363863333736363532623932343262
-36653365373438666530313162386338646338633364396636663137336338633735396636633034
-34356638363633343537623565353562643335613361643737356264363535363662373032613865
-65666335343163373134376233316331343336383334613130373739343161663361323039353330
-39663939386431383134383263656434303464313639663438663237666463643063383130616564
-32313266393831396130363664336438623939633261613138626135643739346165363336653637
-30396461643131656135353131636462376365333564386563356230393939316530623134653336
-61306363396334633035383962306262633836336165653639356266323434636634363932336634
-32656462306665393031373539316531353733306134636363383237653261633265363339646631
-61643764643235666339353963623630666339623365363939613639343262306666653033343064
-62383264393762666165333937663164643861303661396264363333376635353834303266313533
-31323132343333303630653033396563303938386332393732323736666337306233653136626662
-63333435616239343662366530353566666231663232626266356536303137303464643464646465
-33363461393064666564323761346334643134643933373739333863373964336536303766663932
-61346132333261343661393138623939626236376230396131626665636562623739356433663165
-38616265316538656363353933383762623761323564376465376533666136363931613035613137
-65373034383236376531616162313566656634323564633639316330373362313034646431323738
-61653331616536623538313830383533643361356435643861383533376436366431313032306664
-36373038336439343666303536336264353838383530663132653434373132333130643035616134
-30383530626337393030613734383231326566646166336166393134333965373563313430326463
-64656239366437323261663563653265343862303462653362313435303263663631333964336534
-63386133386639353666633765636161636538343432633133616162356438656162393565323636
-37633137316239363464353732333765353831646364653466366437323633656262313930626639
-32346536343432343837373635363263313032656333633631613461393366326566386436353837
-62323331396636653432303734643966623162353336346362343862353537613764323265663164
-34303138383237623234353364373030353261663237656431653637653861343532396165366136
-38366138353936306132343765656163663863363561336430373736623538396135313039616538
-62323363336539623433366661393936346161353366366235326635383764333666613135626339
-66643561396663656562336665353135616563393361646332666632616336373061316532616465
-34323966353031613631363734316230633266383638356239383262343136663030623830343263
-62666339626135396338613033343562623737386363333566313466333432626433303339613433
-62393530653536633333326335353831356439386537383039623965336262383431616239623230
-63326430326533643834383233626539396236306339616262383631363765626632396630663763
-38306330323663636136626534643637303066643866393033336436636563613964343835643633
-32353263376333303537616363643630386632646537613063633162663637356131313436613431
-62306133383333666532636437306264363961663261643133386530623564313366363237626137
-33306635386564643562353466343136303130663234653938653539306134336363393430613635
-65346263323734323234653832333066303236396634366361336630306231386431306438333264
-64643030613739626363663064343066363634656233313232383564363166343766313961336635
-61353361653330333239343761663764353731613938643138396337326330303939646233316136
-33623561613366656532353932313835323339373565633864333538333036303566393537366134
-31353737376439386130643066353364356363626566626537343038643465613734326237656535
-66376365656433666164353836393230633864326535363239666530663061306161326361343532
-64633366323539316532633839343066643934613363373530613463656366346138666131333236
-32653636663463633632666234386139633461336539326261626463613633656665653334663162
-36643231613333323232373639623334303033326533313663613739363730353863353934336637
-63326634343332383939356562373636646535666432646664313266353532663637613539643364
-33623463333536613566333136646339663761643066303736643239663439323439626534306439
-32356338363163343463646565613539356562356566383861353033383961613233663635666139
-64333231623030313161393264316462346264613933653737636439376563303765396533383265
-66383631353931383830313234326461383265356561616563643638353332396236343031383234
-31386438666361303932383435643461623734313163633632373937366137333939376133653064
-65336364323264646437363236626233376365306537323766613931616339396665323563343661
-35613337393334363931303537396637316137343137393963653637383763383830323762383062
-39343031303730613035383633323634323833316335653336343165636264363536303462356263
-37646438396232333661626539333738343732396139346334396135396234633161386264303038
-32666636626137313564383635623761363931323261346331636632623731336166646262633666
-32393534383561656438393161326661383939663835633930383635653236636136663665646163
-33393533653363356163373461616135616630653866343139643137363436346138376530363135
-35356536343863643834346666613831653161323039653637626662343433366363393831343038
-33313162643730626539663961636434386533356631643062333434383762653136323266613561
-64626138363466373662386162323865653738393065373063346334393431613132343663303336
-64633461636432303433396562656164313933356261363364656331623038393430376437393236
-63653031336465646536643464326136386666373037633137666539393634383432623631643962
-63323063363537643437643835626562623466373830623136333761636538376235643633333939
-31653963373234343762643234656332623561323334386139383461353461656236346361366565
-39383864396264386639626631613036666632623764646637313563376536313665373330363662
-39356261616632316163636533376637336537643332663336643831623334373731623032613961
-34656236346237353237653737386131343166303030313263366231376366653338663030343235
-38643533613732313562303133616165316431363562643530316635633464663236363339323533
-38316562396533626633636630333365653731626366356335333136396136613232633138393861
-38326436323433363838396363373334333064393731663733353439373662623839616666303833
-32356139383735373832643632383931646261623830636238353963373933643739346463616534
-66656663343962383131646564646163656466356438653732303062343166633463346131313635
-65613232633161313435626466326538333364313764373963353766633839626164396134323938
-35633164666333396536323566663036626134376432656565336237356130643236313133663137
-39633036346433653636656134313036666633393766353662313830663936366534626661356533
-39343832653535653461363839616433376431393833613731353539346464333663373739333663
-34303531303435363966333965373632386362383439303062316539646539396438306630316332
-33613963656364626130633836366331336536323965613266616564376362643033353830646266
-39323963393530663133633238643530356566636564336631306364316431373164306262373132
-63346135386235353962333331396263663637376364343330303163663432643765653966326338
-39613561356663653338653430616564366138383366356435366430316432346533653766383232
-39663638313637323966616664303230303933633937313062613230303930616135323464343536
-32386564363938373630306539323639363833393834313963336630623839383935323733343566
-32656266306134393461303338323361613139373931623039383231633964663863623537656132
-66663062633636616638386337383664636634636161616535356539646236373461323039316238
-37303535656331336662663566653133336465636466613631373364393935363561343937303030
-37343631396539373937336135653066376535356162623261353237626265643035333737326461
-63343130376465353331616164643836353266396265663839353331633830366438373866396334
-62626330656338393035636163616361383432353536623231373031376230663834393036653237
-35383134376361646464373632353664326134366232313539623733373630653334613338336233
-303733343761396532386366313439393063

group_vars/stage_prodwork01/plain.yml

@@ -1,218 +0,0 @@
----
-
-stage: "prodwork01"
-
-hcloud_firewall_app_specific_stuff: False
-
-# TODO read configuration with hetzner rest api
-shared_service_network: "10.3.0.0/16"
-shared_service_elastic_01: "{{ stage_server_infos
-  | selectattr('name', 'match', stage + '-elastic-stack-elastic-01' )
-  | map(attribute='private_ip')
-  | list
-  | first
-  | default('-') }}"
-shared_service_elastic_02: "{{ stage_server_infos
-  | selectattr('name', 'match', stage + '-elastic-stack-elastic-02' )
-  | map(attribute='private_ip')
-  | list
-  | first
-  | default('-') }}"
-shared_service_elastic_03: "{{ stage_server_infos
-  | selectattr('name', 'match', stage + '-elastic-stack-elastic-03' )
-  | map(attribute='private_ip')
-  | list
-  | first
-  | default('-') }}"
-shared_service_logstash_01: "{{ stage_server_infos
-  | selectattr('name', 'match', stage + '-elastic-stack-logstash-01' )
-  | map(attribute='private_ip')
-  | list
-  | first
-  | default('-') }}"
-shared_service_harbor_ip: 188.34.196.240 #server in prodnso!!!
-shared_service_gitea_ip: 157.90.169.198 #server in prodnso!!!
-shared_service_pdns_ip: "{{ stage_server_infos
-  | selectattr('name', 'match', stage + '-pdns-01' )
-  | map(attribute='private_ip')
-  | list
-  | first
-  | default('-') }}"
-shared_service_mail_ip: "{{ stage_server_infos
-  | selectattr('name', 'match', stage + '-mail-01' )
-  | map(attribute='private_ip')
-  | list
-  | first
-  | default('-') }}"
-shared_service_pg_master_ip: "{{ stage_server_infos
-  | selectattr('name', 'match', stage + '-postgres-01' )
-  | map(attribute='private_ip')
-  | list
-  | first
-  | default('-') }}"
-shared_service_pg_slave_ip: "{{ stage_server_infos
-  | selectattr('name', 'match', stage + '-postgres-02' )
-  | map(attribute='private_ip')
-  | list
-  | first
-  | default('-') }}"
-shared_service_maria_ip: "{{ stage_server_infos
-  | selectattr('name', 'match', stage + '-maria-01' )
-  | map(attribute='private_ip')
-  | list
-  | first
-  | default('-') }}"
-shared_service_kube_cpl_01: "{{ stage_server_infos
-  | selectattr('name', 'match', stage + '-kube-cpl-01' )
-  | map(attribute='private_ip')
-  | list
-  | first
-  | default('-') }}"
-shared_service_kube_cpl_02: "{{ stage_server_infos
-  | selectattr('name', 'match', stage + '-kube-cpl-02' )
-  | map(attribute='private_ip')
-  | list
-  | first
-  | default('-') }}"
-shared_service_kube_cpl_03: "{{ stage_server_infos
-  | selectattr('name', 'match', stage + '-kube-cpl-03' )
-  | map(attribute='private_ip')
-  | list
-  | first
-  | default('-') }}"
-shared_service_kube_node_01: "{{ stage_server_infos
-  | selectattr('name', 'match', stage + '-kube-node-01' )
-  | map(attribute='private_ip')
-  | list
-  | first
-  | default('-') }}"
-shared_service_kube_node_02: "{{ stage_server_infos
-  | selectattr('name', 'match', stage + '-kube-node-02' )
-  | map(attribute='private_ip')
-  | list
-  | first
-  | default('-') }}"
-shared_service_kube_node_03: "{{ stage_server_infos
-  | selectattr('name', 'match', stage + '-kube-node-03' )
-  | map(attribute='private_ip')
-  | list
-  | first
-  | default('-') }}"
-
-shared_service_kube_ip: "{{ stage_private_ingress_loadbalancer_ip | default('-') }}"
-
-shared_service_maria_hostname: "{{ stage }}-maria-01"
-shared_service_postgres_01_hostname: "{{ stage }}-postgres-01"
-shared_service_elastic_stack_01_hostname: "{{ stage }}-elastic-stack-elastic-01"
-shared_service_elastic_stack_02_hostname: "{{ stage }}-elastic-stack-elastic-02"
-shared_service_elastic_stack_03_hostname: "{{ stage }}-elastic-stack-elastic-03"
-shared_service_elastic_stack_logstash_01_hostname: "{{ stage }}-elastic-stack-logstash-01"
-shared_service_elastic_stack_kibana_01_hostname: "{{ stage }}-elastic-stack-kibana-01"
-
-kube_cpl_01_hostname: "{{ stage }}-kube-cpl-01.{{ domain }}"
-kube_cpl_02_hostname: "{{ stage }}-kube-cpl-02.{{ domain }}"
-kube_cpl_03_hostname: "{{ stage }}-kube-cpl-03.{{ domain }}"
-kube_node_01_hostname: "{{ stage }}-kube-node-01.{{ domain }}"
-kube_node_02_hostname: "{{ stage }}-kube-node-02.{{ domain }}"
-kube_node_03_hostname: "{{ stage }}-kube-node-03.{{ domain }}"
-
-shared_service_gitea_hostname: "prodnso-gitea-01.{{ domain }}"
-shared_service_harbor_hostname: "prodnso-harbor-01.{{ domain }}"
-shared_service_kube_prometheus_hostname: "{{ stage }}-kube-prometheus.{{ domain }}"
-shared_service_kube_jaeger_collector_hostname: "{{ stage }}-kube-jaeger-collector.{{ domain }}"
-
-shared_service_hosts: [
-  {
-    ip: "127.0.1.1",
-    name: "{{ inventory_hostname }}"
-  },
-  {
-    ip: "{{ shared_service_elastic_01 }}",
-    name: "{{ shared_service_elastic_stack_01_hostname }}"
-  },
-  {
-    ip: "{{ shared_service_elastic_02 }}",
-    name: "{{ shared_service_elastic_stack_02_hostname }}"
-  },
-  {
-    ip: "{{ shared_service_elastic_03 }}",
-    name: "{{ shared_service_elastic_stack_03_hostname }}"
-  },
-  {
-    ip: "{{ shared_service_logstash_01 }}",
-    name: "{{ shared_service_elastic_stack_logstash_01_hostname }}"
-  },
-  {
-    ip: "{{ shared_service_maria_ip }}",
-    name: "{{ shared_service_maria_hostname }}"
-  },
-  {
-    ip: "{{ shared_service_pg_master_ip }}",
-    name: "{{ shared_service_postgres_01_hostname }}"
-  },
-  {
-    ip: "{{ shared_service_harbor_ip }}",
-    name: "{{ shared_service_harbor_hostname }}"
-  },
-  {
-    ip: "{{ shared_service_kube_cpl_01 }}",
-    name: "{{ kube_cpl_01_hostname }}"
-  },
-  {
-    ip: "{{ shared_service_kube_cpl_02 }}",
-    name: "{{ kube_cpl_02_hostname }}"
-  },
-  {
-    ip: "{{ shared_service_gitea_ip }}",
-    name: "{{ shared_service_gitea_hostname }}"
-  },
-  {
-    ip: "{{ shared_service_kube_cpl_03 }}",
-    name: "{{ kube_cpl_03_hostname }}"
-  },
-  {
-    ip: "{{ shared_service_kube_node_01 }}",
-    name: "{{ kube_node_01_hostname }}"
-  },
-  {
-    ip: "{{ shared_service_kube_node_02 }}",
-    name: "{{ kube_node_02_hostname }}"
-  },
-  {
-    ip: "{{ shared_service_kube_node_03 }}",
-    name: "{{ kube_node_03_hostname }}"
-  },
-]
-
-# TODO read configuration with hetzner rest api
-elastic_stack_network: {
-  prodwork01-elastic-stack-elastic-01: "{{ shared_service_elastic_01 }}",
-  prodwork01-elastic-stack-elastic-02: "{{ shared_service_elastic_02 }}",
-  prodwork01-elastic-stack-elastic-03: "{{ shared_service_elastic_03 }}",
-}
-
-# Note: all dollar signs in the hash need to be doubled for escaping.
-# To create user:password pair, it's possible to use this command:
-# echo $(htpasswd -nb user password) | sed -e s/\\$/\\$\\$/g
-# TODO should be part of the automation (htpasswd -nb traefik-admin traefik-admin)
-traefik_admin_username: "traefik-admin"
-traefik_admin_password: "{{ traefik_admin_password_vault }}"
-
-grafana_admin_username: "grafana-admin"
-grafana_admin_password: "{{ grafana_admin_password_vault }}"
-grafana_user_smardigo_login: "smardigo"
-grafana_user_smardigo_password: "{{ grafana_user_smardigo_password_vault }}"
-harbor_username: "{{ docker_registry_username_vault }}"
-harbor_token: "{{ docker_registry_token_vault }}"
-elastic_admin_username: "{{ elastic_admin_username_vault }}"
-elastic_admin_password: "{{ elastic_admin_password_vault }}"
-
-postgres_replicator_user_password: "{{ postgres_replicator_user_password_vault }}"
-
-mysql_root_username: "{{ mysql_root_username_vault }}"
-mysql_root_password: "{{ mysql_root_password_vault }}"
-
-netgo_msteams_hook_cd: "{{ netgo_msteams_hook_cd_vault }}"
-netgo_msteams_hook_alerting: "{{ netgo_msteams_hook_alerting_vault }}"
-
-kubernetes_with_awx: False

group_vars/stage_prodwork01/vault.yml

@@ -1,467 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-31376136303461393238366661306362376566633162656530663632323931383566356430323862
-6238646639646538623030323539343539373536643932320a386165346361316362386234613435
-37663364393734356361383138393335616134633832376661303961326135363238343437303562
-3138613734323033340a356665333063666231643238316239353436353062633061306634346463
-37373334643530623030303062633862353431666433346266656664306561663565303337663834
-62646331626163643136343066383465393265383634313632306264386334666235336133393731
-35373836633462353964383265363634326264646435383461363362643162356466613331306362
-35333764323363383961373664363566346632653534373763333561633336393830323961666632
-65386536353632373766626434323338356632393635663736623333353033376161373234373664
-30353133366233636439343166323332366561633262383835363663366132633130346331376663
-65343166316464636363343331383734393062653230626435356430356238663634393333383864
-39623831363962363161613834373434386565636137323361643730356164393365376662303764
-38653163303734363333623165383037346466646231633464363131323963363734326162393736
-66343639383161663734613439613736306334623962663765313166383262346661626630313364
-65343865363938613730616336323965653762656636323363316139323466613832373165616136
-64643838633239623762636531666537636435336331376137323562306666313637663461343232
-63656632376237396233363532643334666563326136653435353136653963633761396638633266
-38643262313138663263323164373064636364646431643462303036643033653566663835383435
-34653137323365376466373833663238353537666463623762373837316164633030366138376165
-30336532343961376430326662613434663932633361366434383136623731326366326439323138
-37663630346631663565363831663735366432326335376566383232303562363537376339376262
-62336331653439356537323138323162623230616666343663643961356262663839626266363130
-39356164663733366662393935393164373661333263663933373439353263303036643033313361
-63333862393136633861316662353030353662633638643330343234383565373232633161353561
-64363164633261386239626539363933353332396636613235353533393833626565633739313230
-37363534653363353633653765353263343832633764643937643366326261323063633965353536
-30373137303534633832646166623639656664633032356135336163373134323337343261633965
-39653264653036386463313539363634623531653064306635373432653464306532613165613463
-33623261386439353437636666326430656437346639663236643338393735346261633230376538
-36313637613539326662366236653661623565376137373065353232636563666230363562333365
-38666137613266653461353739376136316430643931333462323432393263666630656236383937
-38363131663062343830363835323033663036356266646534613038303166383534393465653430
-31323161633438663833313737373664643236646635393964393262316331386461333263646330
-38333366373537326264663333633334303935353535663038343938613831653333346365323836
-31356163393432396466323065303337633537633132636438353932303563393063396230393263
-31306335643565343432643961383833333761383731633064613564656364363436633537323938
-61383430393930383438373433383335343266363062616564383865396665626434376337656563
-30353636653330643963613965343237623536346332363533353530353064343065393361393164
-30343435393035353832313638656339613266356464373566613030616539376665636333386261
-32353733376362316134636564373635316462303236346339303637636365346563303437663039
-30383966396262366638393861326166363761643830613861653238373561613866373564353336
-33343564333361643137343262626365366462373666623863303662346165653239323732646130
-37633963343833613135313663643438356132623165373539323166663330303264616466353539
-61386433656663383532386332643131346466623131333739313832646532663961376537393439
-62616536313965623839353331663939393439666235333038653734633535623862623630633935
-30313561633234306234636430303961353930626237353632633233306539383365396266386234
-62653966646235353865393539633130343735303233646137353831633433356165396162633131
-38653231626162623036613861666135643065313333636239376432326430636236616431613566
-61626661663236373636356661623136333939626564636366663532313062613265383432646364
-66313637333338386336363739353235626139386263343265653865663362306330666261656435
-64303966373333313736656565343862666166373465356438666564653666653062636436303164
-34366162333137323437396663643538383730313234303661353239326638396435383864626466
-33373232323662356562316435636339393466633031326463333032363930353065646464613735
-31306132396137363562663736366131653430643431653634363362663266623532626230396562
-38386162383331393462383766633635373038353561303462643133393336313135623232386233
-62613462366462373537333862653963303765303565313663343833653236343933376635663765
-34393238636238356234303237623732616362303032323831366338316462333637366165313435
-65343861343361663864653739386531323639643832316264373139396234636535343866653966
-30643061393437653461613134623833666432303563613738613865383933386138383536353332
-39353431383933356536613639613339666538306632643561373833363437626466613262626361
-64653365666661353632656635336464333433373832653535396633316364363937353134353035
-66303037643532323330303433633730626437316630353637636236663235376636303839346361
-32306538623763393533376566633630663530643965386566653764303638373761666533396563
-62396230396266626131626463313762356333646530396133366538643965633863313766333332
-37363637343335626462333666643362653735336432343635393364613865363663386366623164
-30376430313761623236366336363661656634323430666665653739336138363932393836653762
-38346431656464653161363239323834393338376264373934663261386565353031323966363361
-30363735363132373963643661323030346365333532396665393661323066343563393933643033
-32656230373266366137663239333162323732663163636337353438366438366266613163376335
-35623732303235343365643533393135643132656330366135353063613165666563303839326636
-66353339323133313662393331396536666233643861316634613830346435303237656130373136
-36366137386261306335616338333737663139323061626466326136643239346466393961353331
-61616538656538353539363737333138343361636634303436376536323435353838303830663161
-37346635383061303039656230336336616439633936613135333438353235326666646236393863
-33306637343764643334663962626164393734356265303165623032356133366637373130646136
-63663532613537396265643837616364616530306631333232313466623465653534353831373033
-38633839313863393032646238373162643866303065343236323265336533663732316433666432
-38646535383831306165303435303764343238613230306139373432333534333562383963376238
-62393664393761623839396161313265343630343435636662626563353932393363363733316538
-63666563656462623563393435626165346237356663343132383938626433653063636133396461
-66386331643032626562343366653961656631613433396430323630333239636530303238646464
-64666464323336663732333861666331613037376232333264336230333965376334333665333537
-32653730376561663038396664623237383536636461633032656634383561343438393233643237
-30333536373864663537383932323136363830366638346435653331663836613232363561343630
-61363435383838633861343838333865616330393661313465373737303737313438623334666332
-30363737623362313435383231383333393733333563346166373130633231666130363535393835
-62613337343765396134636462623039396665653936393238333430323136666536313233396462
-65333565616533376161343633343364393538643963343237326232663362383961613466623432
-63363561393132663763373532333761663764313064663838663266396231393365633334356133
-37636230633561333863363765383965616537356437613439643136666363656237333333633962
-35356366656366623164643536363563646535623465636163613264396436613863366663313530
-33336130623032323932613238366166633833623265376234616636356339363938323238616665
-37313361343865333138653035306664383461373834643263643363626630326532303162393230
-34336330306637636637633536333633376361373161383038633661646130303439373565636465
-30333230316166383439653235653464353165616265643961373431623933623432306636313463
-61643937306266626132396164353361336437623434653339663630306135373532343839613661
-38616330363066346135343433643462613931343361633262636539303737353334303536376463
-33373065643231653236333939333564313039316238613831393163636639653237336163353663
-62316634323933343330633436643033616365363230306262653637346538663038643863323562
-30333662326138363934306264313534343732653734313763356438326632383737393662356264
-33343034343335663030313032363533393136336135633863303561656634316437366236616466
-63353062363537356633663033633136383664623161363466653730373631363261313630646336
-66313762306466656230646338383737376461663135366532313533376130613732336535363436
-31636537376661386233316161323031343830623734633163396234643635666434383261623635
-38633264383939303630313235373261626535323261323464633134643135663033643366336639
-30653239366537313564623131313636336535373663643836323461363634306637663539323365
-65393337393435666337646231333437316637643934663337666666393930386333616231646664
-65356338386163626166613632626666343635313062393233633033653966376566336139633937
-30663438633032356463616435663562343865333035396436633034623037653563626536326465
-66303466313536373562303833386334646233313161666637353163383830643636363432633562
-65333337343066393733393631653732613139393031343866306239333661376234623333646233
-31626537356166373938643438653262643236393238303562393538376331613162346235396633
-66623731643261613363363962383563353232373933643339323262626236333439343439633636
-30346562323331633061623035323236383136616635343865656564356463326563653264653734
-33356163613361383835323537326630336630666232353232383334646334333762636231616266
-32633565376466323162393931383236363061306361326663373738373166303239333030326530
-61323331373765363839623261633261656261633563343864613635616537633630663737623762
-64373032613962653763316234396431383131333963306666613336656162343566306163353565
-32643038333033616139303737623337626366323964656261643831313334356332656339396536
-33656563613463383236343037303963343264656234393237336261356638326262616237333866
-30656365333865353032646239393930656564373335623734643961356435333761383566653737
-36616164313635363134666161313832343961366162373933373738316230636539616435353435
-38313962383066376432633235623665376430616364653766646537636336303435313231613631
-38343262333233353363646361306435313030653133653861343765313261313730396564633337
-61663037633737646433386333643362303337303538366137623139313462383736373363316632
-32326364653936643639396636323565313864396163353334616238643964626633386234633662
-32356533373362646632623431393436373630376335373465613232396536376438323039346666
-66346362393234383332633736653466363434343833313764663066633136373238316230613561
-39346461323433623238656263623834306235383761363435663663666266383766333061616262
-66393730616632636531333165383235633132306266363766363534653339393834616639653832
-36613530636430643062303637613339646535373562356437336530393665316130626362366538
-39363730383330613638636437613334323530353037316132336461333039366638626139323363
-38613630663834323163373163633664363633653530663037336565366433396333616363636130
-38646131323061616164626532636266373366366564326639323536643638333764653266383737
-32363636663561343033383865373636643032643938333465393364663962303366343835616330
-36343132303262393233343231356331633762623261386166373632346237396633353430346335
-31663737666164653539386435386335636439373338313262666534333737326535636466646462
-35383838353466303635373730303232623834616462303462396634313734643861376262366463
-37313438663235363439663737373866393764613663643130366531393337383734336638373637
-33666436646161366331656239326535353466316632343331383863623430613063386132636132
-30663036613133346632323233356563626236663435323165616630383330303933633232336231
-62626233363032333465356436303063626535333233336166633334346665393037666533373334
-65333138393961356665363232626632303734626364653633613334663937316639383566346131
-64663937383939623266306338373963363466363337623632336636633134623631636438613935
-35376536313230323263656534376162623063353037633264356162373961623836633634373366
-63313736393466353066333939663936313730636137386562653831373433663236333530663362
-37333634633134666464316336643661643664363631626631623537393033623964613861326330
-36346238313538376565323037383263356630626266643964663161636465343733373837653635
-32616263323361383337313434353530363038303635633763343738623838336637333163366130
-62316362326237383133303862323934396332643864313166383661303862656466383362363133
-63663966653861643266663866383963333663346332356439323030306230633164623863333135
-30356335393033663139633531633937386364353166313963333436656238663431323964323735
-36306533633832393538303363623239316263343031323336313735333133373766313665623261
-61633164326238316536323933396466383165306234646662656661353962653032386339366236
-30616336646262323139396165386336373262633639353130613932656434653632336135373664
-34343036373233353538616562656166333236353133353761313838656461303764396630653765
-35663238623038323931653734663062623434366465306233633435633266383030373434303962
-62326230326539383533343036633366386239623464653338393338666163636630376662313636
-63393763626237313539303563323139343332343933313530376666633238323635366136323265
-39356564643863313765666465343466356165353065393964663238656464613738663931336366
-66353164353836353836363736356663363761366466383538396331346166356466333634353933
-65326539653264376432356261343965313665646166363139373132333334353530653034383530
-32323434316436636461646632623635323735656332346439613533643031326261383535656165
-62386632633438376639623362623532333036333136633332393061633831393564616164386333
-36323036666666303931666137356131353339626234316361373432346661303232396265623336
-36363137613562663865393135643639396361373361393566356336336432666466643831653239
-61363662363733383664666535303430323336313930663361666533353936353337636664356638
-38316438343364626462623237326164333636336333313930626266316132353762653537346537
-38363064316530643839343062333636643830646239616435396433613836613835653537336139
-36363033386662653039393539623436666162613562616531656430386561393731346162396461
-64646534633132656533363734643063653033326563333131373338313833356634656334363266
-62376330336365626137363232336331366161373231373133643335373263616630333465383234
-63663065336165386635363631343666316365643963306531366261626161656331373236636637
-62303032663137363363306564333864316535326564636464396430326439633436356336323665
-62666535626265323833396137633735633631333631633638343433323031343439633734303364
-33646664353733313738366662363132343133643939383733323134363062343237616330323866
-37343932346137663339346334313930663734363539303933356534643437643161303134383163
-31313465396439306130363534303733643834343234643837303462303866616638643937353830
-39346136663166343333316565653039363833386361636465663333636534663066653966303635
-37613931623332393031396538373634656139363666353061336634346134303834376264623530
-31376432346437323566303761333266626264336232636131656133383763366439323064313263
-36363330656537356262353933323733393565336461316230613732336438666432346530323465
-65613036383830616335306163633536306562613637633934353062356165303935653636653762
-36383164643635666563386466663039383339616533643139303664396531373735363661623766
-65323738303430653637303566323335343836333466353930623830346365336565313035383131
-39386633663832316635373066613466633930613034303530313035366237346631393864393132
-62313662633030363235343437353537336432336361376166386435363635396130666639353166
-35386535313066656234316331323731616630636635616561653236646466336165363434346131
-31333632643364663331383336343136366363633537663365386534653463366561313234363636
-30656332663064353937373333626436613934653834643265343431393563363932396538303930
-64653839666137616631656363313464636531383065623566626665656234373534653330613962
-30326138623630396264316634646636343262613638666634333134636638643631313237323964
-63363134363435333662386139653564613761366533323036633462636236376237346663613039
-34303339326136633366306338373362356136613732663666326133343562323638303661666436
-34396561313930363934363936393839383432383538636464303232333266303863633137663235
-63303939333931373934313764363263343431386234323734313563313539616238386434343336
-63303433386337666331643862343563666235636132623033636335613663373363333032636135
-64333664373961346361336163373864316437656163383336326366326565333434386465306565
-39346334656266313735346539613365353565313234333164643732343735613935636137363862
-36303635343966613163373336313238373133396461313962333465623566643237613264633235
-30623161303435323439376638363930376637316631633064366430353231643934623732663236
-63613262333866393137626430386232336230663262356333643861393765623865353136383036
-36626562366134356331643032363633613834316563363163666131666261616165336464396135
-63343066363563623861636462376134623832373230386331376135313463643232306634313038
-63623337333465313264653137643366393934646661393931343966306235323966626235633063
-35616634343433323730386235343863343333646333386664623365633331373832353661396230
-37643333373966353238363631626366316664343030663766663265383262363161613337383537
-34663261313564643763363734343736656466373862366163376138613031656530373134626337
-38633364323330343236303634313139623231396137326534613039393064643565373764626563
-65653830316261663837326363333034343438653965666561386631663066313134326235343239
-38663739356337393664656566346163386533663761666636393235366539363039613333653664
-63306638386561393362373762623637326465303234616238313931353261356366393166376562
-34636466353137353630306433636330316631653237663630666337313266373730636533393036
-32376363333761303238363136323933653432383138303363343732393661616633306463336566
-65316566633630363963353939343261303338363534393537633133333236303837343062346435
-63613566386663383034373766366361336131333364393761623336363132386537383432656335
-66653466343262343266333862303232633661373561613235316136336536353534346461643134
-30623561666438316136313030363433633066393438356461363161346564323738613336643932
-65333162313966643232343163323231313530383533663465633031656464323866306239396661
-36643739386131636633376538623831343538396636626262376564393363326363643133613065
-36636562643139393135303135343737393466333533386333666332363437333933333131636463
-31346638303036326433633539613934633933313232363735313565353462646237626462363636
-31326261336232396539336161663239393034663665396331363636383534353933653033656337
-62643963636439383166333362323965653938346465396430356130333734653537313363303462
-37323961323232303865373332646631323466356632616161326138656664656632333630326535
-64663733323336663531653964303831353264663863616232396337646337346166353238363965
-39346262643333326666323863643033646430373230303535353564626536666634663135653365
-64636233633761373037323431316436383862633062333332343137386330333932633538303732
-33653737643366393561363531626235373761333836663063613063343730323037363839643333
-39613631346364353139323661366538346136333034633165653330616434613736666131626137
-33336332393432616135656134323936373362616331393937376338393037643539663934653361
-61626362623139363532623062343831373932633766303366303738656235653666333431333234
-38343934363037663363326631333230313466306636653432313736363435383963343662323332
-36316637396661653665663535623333326634393966306336393336343536366438386662333431
-64653732616664663566386361373636353865333238313032353533373661623164633530326131
-31366565336435643938393461643431636634303932633831383261306636626234333366366563
-64386636326535393462306639636537306161613530386238316638386263653630396262626165
-61653338616530356534613537636566643265646431303734326334326232363462646631353739
-34343939393662393635346361366166666139333765653866356238633964653739396365613234
-38383666336430383334313265373233646166616230636363626264363961643362383063653132
-66643765623366623438343061346435323936373635633130306535333661396232396434326562
-32383562633533316132346565373832353365306463626362613066653433316133386562373039
-63373432663364653561326332316563323363373937303664343166383263616230623030393362
-32373532656636333061653963383262663339663562393962303336333433373136393564316665
-32306262306330393933626335616263343964633938303238386437366332306166353533363966
-39376663363734373238343363393239666535353963346633656338303336353935363930323333
-65653261363536613436306135313236623537333539616530343639366638356561663364363366
-33626666333164633030353563353836646665633561323038316334343736376137393933623731
-32313237653839616263306232373861643266303364373962636534303065613438313062336466
-34613762363232613962313364616632353233623836363638353464643136356638643330373538
-32366230393131376234383438303938363363333434643534616566353635306265346239323763
-34616339616538336264643765626631313035383839396232663631636634653137396533313933
-30646134303332663135623538663637396133316531306538333465646165396537653133386132
-62613830363163643532373261613134366536636365376238323631346166393437656131366435
-34306263303938643963393961616134376163326639356165343332663835376239643463303032
-39353635333732613964653033643036306166303139383937326361363131333532363532633834
-64336238663932643832383462636130623766363835643834623531323738613863313838316561
-32613664616334373133633037643236663637333565353961393535613636336436643766636533
-38393531653338353563386462306534626238346262643161363934636339396135323937353135
-35613131383564666263363763393339346239636538333464623361666236653235313836373237
-38323038653233646539383562396332363161333263383632336638663766636439643834303132
-63623335313239616138383633323036646131626433646664613762653764373063393531353239
-66313534396333623837323934353830396232663235393866346664393864393535323233623262
-32336661353635326633346236653265366637633335383066316261363032316231643133646563
-36656365353938646234626562303461333166323231333964393262396363323138363464316136
-36643331343432643266313939623838356332313262333530386665323934613131313330656461
-37643961343334386137316563306565376438373165343863346638333531363438623235633861
-38373363353031313937346364326534393031646533333362363633396539643030353862643364
-33626634373435383061396666343337346633393366343331323664393335393431326164326137
-34336361623062653636336566656438353639343334326263393666326133663863323032633061
-61393466383039396364343237383331313138383465343630343766396563316137623662653439
-31376530353532656262316232376564666362353631626339653162616530303561373932366563
-35393465643161323134613237363264353235663066376461343036313131303837313562333332
-34626132363439333963653531336265666435333636366133316261623536343834336136386361
-66353031316437333765633532396233626437633937316430393765646566316164626132613837
-36363037633239643030383163396631343932613834353338643765393364306332656630653364
-33626637653830343866653335626464663135393266646365383562643762643966633631383665
-64383836323765646165363032333466306363636631613266303738663465393837633734373535
-34366439383762386661333730333666343239356135353234376636316465323337306436643335
-38343932303336626439303337646566646534313832353835303164363061366138653633343064
-37326461616630373533376562643038333433643061363432373739343434663461646363633237
-38343431653730613661616365663762316134636237623233643166353763633263393330346461
-36303039313065643438656237396234616435333431316661343539326638633134336666396461
-32306331346236383165383961376166656461653734656231323130626639313164376666306235
-36653263353232666261613735653161366634373766303466333463353462353835646162316365
-63333939636630343332376331303831386562646333323738623037626562373664643631653364
-32656438313231386362643538393134623361636163343763653038626564343431666639373334
-62353436383938633733366635663238356164316563396366323863646565366436303165306534
-66366139306334373238303036353839326436653332313962623439386433383231656263333265
-38613162383830346330323561306535346330653835393536353961303535396361356532303438
-32373331636238326263326366656338666562643839323834353666333363333561643838663266
-33636135653238303535636637333833323461373435373361656132343430623566383534393931
-34393534366331313939633162333662666264306634643066333061653439383961656566653039
-66356138643734346237643139383830653933366334313137656439353765326238343138396435
-61306234353563376335343661363363323239613531643532383530373666346630616131386338
-37663531323536353833383431376336623631323963653065633636613263663238326235636438
-62656563363634616535363761626165383234373431333662393635653831313539613137633666
-32653763356632666462633538353938633261663235313862393239383462646665616165636439
-61326263646136613739626336316531383137313566323730356439653735623336636437393462
-63353930396239663731333463356337353136306630633764316162633764303265643039663963
-35353664613532326466636365643861616437333432326461336365646366633537626132613235
-66366531306364373534393233363632323563316166663933633233353165386430333938386465
-65623038373139353633353034313132306266373962373633646133656462353337383235373433
-36643665366533373635613833383962396136613836623135653331346666353064636438373932
-37313166356436336333323038343734663538313265333030636363356633646433363561663862
-61663635643761613166396331653761386165663038323438313861383637303363366364326630
-39386461393832633338373264346335633266303765336639643833613265636133363739366161
-37366235623637336165636565326232303633653733353635383833363564613238323835313030
-35643566623635616532363130653262653135366566366638653263643464346337356363303738
-36636638643036333135383262373839356331373062623830663835653833343439303937346138
-38616536326564643933363965626335393430633062333830656561633566636432653663663036
-66313837393364316631306334653439633232626330623834313935643366633662316263343033
-36316562323963633463386366616537613734643631323163346536643636333163333430646662
-36633563363338663238613163396338383362633831333439633933363964346138626134353766
-35616434633639333061333364336465336533396636376634303736306535313563616565653135
-62353038616135636139393335333662643765653465393239323231666563653165383039313834
-34313966363162386539316238343632313234313931346335656136623434326132316536373732
-36363261666430336662643665346532323361356134336364663431653666363765346130323430
-61386631343962363935363538346536363837363764663664396163376466303663343137383832
-62353933323261313261376532303837306232336263386162613565313966336564303436313639
-61396133333661626138323232636439616234336434633134316662343334663166353032636463
-63616238356138306164346666346235396533653635653031653964313839353435353963396332
-65323735386461313134363137333732356138643335313737623330366265383861313564373066
-35393966363132346431323963386631623532663338343334383930373433343631323732323031
-33373936336462363933306261646263313165383936643335626362333263383035336636323666
-35323531636635303936376664643730623333633634373931653137616130343462316132326361
-64626664383562386165346235323038613734666235386463653133613836633335613866653532
-33373930356662616434323030636231333966643866653265663265303430643639313330616539
-31323239343938376239303630653636613565336361336332623966623431303231313666656161
-30333233616639336636313436663361306135313132636631663865636663636431663536633732
-61303764663531373261333938343966633162313137386231643937653634616635303562316331
-39643862353965323337313232613030386434383237653061343634333062376166353662336431
-39653730393762613466663466656139346366393137336263646234353337363136346533343638
-63393265363430383431343233366333363433616362653438383663353436356464383632653863
-39623730393331333761386136623866623663333737316331316337353962616533383632366562
-66313566343932363266613466646632316538323766303232343336643036663930346466376633
-32653831623363646539333633346538303131396630396664303134623061363061613538633836
-33613630613335326137306131346135333633353832373238653030353737356164663937336363
-37383864643164353862333437643138383631363238316664643535386238333932353634643933
-64643134366264353734316532396235623139656231356463343765383762373666643464343965
-61363562373930333061363731313066396661643732636462323535383636623337353331393139
-39373561636134373733613733633566643261383934346535376261313662373932393436316266
-33333562313862336537353633663837383762663238613664663034643134653632333065353063
-66633832623335633634326130346634656631626339313936336234393464306462333764326232
-62616363613533323862313363346134323639633066636565623031613939633065316133656437
-36376563653763636566613533346331303366613863666138616335313838656331353134313133
-38393966643637303835353162646131363865396535356461366466616137333162396566303666
-33386431663333356137623337366430356463353866376638376262393738636537353738623130
-31633438313238653035393861653062656539326534343139663461303964623937646435303861
-31656634383934373261306664333465313833616362396635616365343662383261653131373962
-31316662393161323765313336623234653165653133393830363561653539656665653630336538
-66373037376365366134653232386431393334316333376465633462623763383130383931323133
-61613262653434656562346265353663623937386336343337303166386334626561303863376539
-36373636356338326537393935333730366364336239633035633561363563666134633161666430
-66633263643164396566643561626633326532393434643164366465626561636437343861653962
-62656134383038363032346435333762663564666264383866623865303832376136623266663363
-64393931303066663733303161653137386432346562356164306162313266336334613233633965
-30336135303935626434333036343765666433313938643337353138633736373564343261613966
-33336537396633613933663232666663663135393063323136666536383161323061333263396131
-66376362353039613431343366316639323438313866636334633261343630316263313431316664
-31363939393835346437366635383537393438623536396637343930633461326530383462356139
-63306334306637633065613365326139353932636336376534393962323764633931393633376163
-38616131343661323038646538653037386437626539383233663138323262643162633634303930
-66313031663234356539386666336263356366653438653134323334333932623263313632313136
-32613238336137316331363135393339303332636262643561653030333133336265656134323064
-62663761666162616534303333643235363762666539623666323135303639383461633564366432
-34326435653730613462363635313664656139306663633836393264626233623035336164333463
-64363738313761326432353336396633333430303236653930643035336533613532626331373565
-35393361363536316431313661366633396365383134356232383030333538383930373533336137
-35303033386464643061396238363235373634633430346461363331343263323130343637343963
-30393539633261326139383332613036353938613930383162346466393930366331326133373438
-34363436313331366138356239326336663537393139333530613564653936396335393236356439
-61633561353962353665326361643638333134653631383762656561363664303839353266306264
-63306135313030363664373534636464313264623366616465373738323663306666653532613765
-30656533656462346234646462626534306135633036653666633737613532663466383334633063
-32333565636632393930663966613962626237626135303963613434323232386136303635333766
-37313038306439616265363435356362313261663237353934373763376439326364666137623630
-32316563303065613564353636646333313931373263373334383264336239336632653763313833
-63623633323061346131653664343239333061363235313839353762346533393462376139353135
-35333034333364393763336530353532666331346263396334313934353539313333613864646138
-66356439386533613036643830656236636630303336616532633438353734376561326335643366
-66613061396630343264313361333365343638343865666530323761343666363536386364313333
-34663436386363613338656363346665396432666261313066376262346662306135383934633262
-37613232306130323764303331343161616162643466383038303630366637616266376539346361
-32316234386232653365313862353037316331663139643463623561656638336164373964653032
-32316537353831346663613832646662643338653737336439333566656233373166333934643266
-32313939363165356531353861343366626364346436366632666537393538373737316561623331
-37623761363661366339393232643137306438346631386237326437323234316234393634373233
-31366563313036393963316264343061353330623437633131353562623063656230306133336663
-33353161366137373061623232633933373064626335663639663932303730666338393933636636
-38303265323139333263393338316637663138616333363165313166386630346133306138393761
-37353566643338663963663638653831666335343865383965326531343533356534313039306331
-65633166366361373961633131663830643936386539623830316230333661633965336233333537
-65623038336464373334626430623438353034663935623866323539313965373166393739663830
-63646137656135333064343161393734343532393237656164343535656564633335633038383739
-64356432666264353865383633363037376161326464656433383631323761613134356665633138
-37636664623635303661313930363564376132626663316162613339323935633239303530633331
-35343261383430666635626637386135656464653366333631633763666164353665373235373832
-32636336666261616532303530626239313239366333643035326132333966333133306135393439
-61663661366632363431626531363534366236393361343839613962623637316164623639653765
-35353266646339326230366161666431376365383530343039616262633166616631623537396137
-31333665366636333961363962383639333762313066373633306532343066333534376232313263
-30386661633136326332623032623139653562633564616561616636373932386165623461346465
-35646664633131333633643863663066323263393838376434326461373535343337396466646432
-36656630353364643033363962666565393239616461386663643539353336663935633966626263
-64356438626238333937386139386138333739363436313031656165623537653932353037393537
-62303431663735303937656630336630386332616265316532376461376466666663333962323666
-62393365663339353536626662303338653830613537646365613530653066363837623631633731
-30366438333339373534326632373830636363343338643233663934326539343433316134336131
-64323530643737633064663031313765656565613931313166643434353838383134313965666464
-64373665336332353265373261653030373164316233646439336365336136303931643034313738
-35333535613631353935343561313234383763316564656665356162613763376137383533326338
-33336638643062653033633331666263643964313263376363616330363038383530663138653536
-66376335316438353362626436633831666334386230643566393463343164393331336332393738
-66643133626230303831623430663636626132313435636264376465353664626338333466396535
-36643032336431343132313337326165316436363263646465313163356530316136363362306631
-63633564376331343031313730613331393864633634316462626164633839393432383130373430
-30633532666563303039343366346433353738626237666166653930346533306662366365356339
-63306161663262323538633133383664353561343664363731633334356234316132376261643761
-64646332326537383563663039373261313933656539336164643438373763303261326135653463
-64656236623166613132616535306630366261316434303234333139313938316135393766386233
-36313134663764323530333736306465343066383137353835383130303230623037646634616666
-34303438653530386336303237633934383938373333373535356165663566646537656536336466
-66616462333435666536613934363633316664326462623635366531386332366239653963383437
-30633563613262643330323237663664643533623531613665306135363463656163376134376632
-65323263646137623639613861643838346665653139623164386265613165333531373831363631
-65643734396339633264323966356131393166626530646561366138313131666630353739643165
-31333437643461356330653135333036663363313666323736613231393030353834343465366562
-30653565303464316632633237396662323463626463353262343234343730333331333638616663
-63316563613266303762303236386663623166393035333233353666666630366266343466663939
-31393336653133393537336334333163613165376163663931383930336532303030663738666438
-65616330353063656566386634323936343034323938303562366632306338613338636266623732
-65663564343635353635333939646330666565333939336664356464633232393362326631333832
-32313765383963323963306362613036663566363861376232643033366636643566376631353661
-36323865623237303966373732363161323064363662636364366564633235343131623265663035
-38343862613039363936336265383034633138333164613434653766666131623737666536623761
-38613963636162393239323034653561333234643331626163643363316264333365633066333136
-32313635386664343134663632613333643331646131636663643162333231343563316336613332
-36363962343763346161663664663333613636653733623965663662326435393134613364376233
-63306439373536656332313233626637393037323133666138623662353132653166366161373263
-66626131643133373665356361326236656165343339353030656663353230613931366261396363
-61663636323133346362333630666634393530323133346435653735343134373237363034333635
-35303663363837633139633038653932376139396239326134336236653263306662353639326630
-39346637356639303265326234333866356431373439313065366634663963613961353231363138
-39323137653433346638653836393032613263303430653936653330363566623866396634326664
-34353833303566313635346138373365663133363030653861643361363831333633363933663337
-63363165343661363964363263623936393466613465623366313565343464376566356437326463
-33623861616134343835336533383235363139336132663936346537393030653462656461653261
-35306561383433383439393736646531646162313734383630373763383161393463313734346161
-34303961373239623463333933333165336164623964343739623935623832623436383139333137
-34653734663430653062353566663133323634333932353933643262346139376135646162383034
-35613537313861383835373733396637373235366264373766333231616531333733633332396432
-63323462363437313366313632333133656166383238313464636238663638343831383635363764
-32323366396663376635653664623062346535653465646634646432643938383533653039653661
-32303031333332383638353831386362346634613062323530306432353437343634646362623566
-35313934323439393437633834343162616633663733353032396136313766333031643538613439
-63383035626161356232333430643438656433306330303138613833303934393466343666343238
-38343835656265306330366535376430356333636262616535626564363831383034656464393165
-30653635646164653963303930626437633937393838663165303763376632636132373264653935
-34626430313634303534356236316662383539393239346234636537303661633331373734363264
-65386563353737636130343061636364663836663030383838623731396662303663656161376665
-39666336393861383962393064316263666331363234336331633834666230653661306361333663
-32313333356433303939623563396664366536343566343535366161346135356263313932363535
-30306632336239313733313138373839313334663034396438613365653136353534366134393865
-65363533303938636262303166663438643063643062396633663364646437306235366164306332
-3663316534333861663435383939393134643738323661373839

group_vars/stage_qa/plain.yml

@@ -58,18 +58,12 @@ shared_service_pg_slave_ip: "{{ stage_server_infos
   | list
   | first
   | default('-') }}"
-shared_service_maria_1st_ip: "{{ stage_server_infos
+shared_service_maria_ip: "{{ stage_server_infos
   | selectattr('name', 'match', stage + '-maria-01' )
   | map(attribute='private_ip')
   | list
   | first
   | default('-') }}"
-shared_service_maria_2nd_ip: "{{ stage_server_infos
-  | selectattr('name', 'match', stage + '-maria-02' )
-  | map(attribute='private_ip')
-  | list
-  | first
-  | default('-') }}"
 shared_service_keycloak_ip: "{{ stage_server_infos
   | selectattr('name', 'match', stage + '-keycloak-01' )
   | map(attribute='private_ip')
@@ -145,14 +139,12 @@ shared_service_management_ip: "{{ stage_server_infos
 
 shared_service_kube_ip: "{{ stage_private_ingress_loadbalancer_ip | default('-') }}"
 
-shared_service_maria_1st_hostname: "{{ stage }}-maria-01"
+shared_service_maria_hostname: "{{ stage }}-maria-01"
-shared_service_maria_2nd_hostname: "{{ stage }}-maria-02"
 shared_service_postgres_01_hostname: "{{ stage }}-postgres-01"
 shared_service_elastic_stack_01_hostname: "{{ stage }}-elastic-stack-elastic-01"
 shared_service_elastic_stack_02_hostname: "{{ stage }}-elastic-stack-elastic-02"
 shared_service_elastic_stack_03_hostname: "{{ stage }}-elastic-stack-elastic-03"
 shared_service_elastic_stack_logstash_01_hostname: "{{ stage }}-elastic-stack-logstash-01"
-shared_service_elastic_stack_kibana_01_hostname: "{{ stage }}-elastic-stack-kibana-01"
 
 kube_master_01_hostname: "{{ stage }}-kube-master-01.{{ domain }}"
 kube_master_02_hostname: "{{ stage }}-kube-master-02.{{ domain }}"
@@ -200,12 +192,8 @@ shared_service_hosts: [
     name: "{{ shared_service_elastic_stack_logstash_01_hostname }}"
   },
   {
-    ip: "{{ shared_service_maria_1st_ip }}",
+    ip: "{{ shared_service_maria_ip }}",
-    name: "{{ shared_service_maria_1st_hostname }}"
+    name: "{{ shared_service_maria_hostname }}"
-  },
-  {
-    ip: "{{ shared_service_maria_2nd_ip }}",
-    name: "{{ shared_service_maria_2nd_hostname }}"
   },
   {
     ip: "{{ shared_service_pg_master_ip }}",
@@ -302,8 +290,9 @@ harbor_oidc_client_secret: "{{ docker_registry_oidc_client_secret_vault }}"
 harbor_oidc_admin_username: "harbor-admin"
 harbor_oidc_admin_password: "{{ harbor_oidc_admin_password_vault }}"
 
+postgres_listen_addresses: "listen_addresses = 'localhost,{{ stage_server_ip }},{{ stage_private_server_ip }}'"
 
-connect_image_version: "8.6"
+connect_image_version: "8.5.47"
 iam_image_version: "latest"
 
 management_oidc_realm: "management"
@@ -367,9 +356,6 @@ argocd_admin_password: "{{ argocd_admin_password_vault }}"
 argo_keycloak_client_secret: "{{ argo_keycloak_client_secret_vault }}"
 argocd_server_admin_password: "{{ argocd_server_admin_password_vault }}"
 
-awx_admin_username: "awx-admin"
-awx_admin_password: "{{ awx_admin_password_vault }}"
-
 netgo_msteams_hook_cd: "{{ netgo_msteams_hook_cd_vault }}"
 netgo_msteams_hook_alerting: "{{ netgo_msteams_hook_alerting_vault }}"
 

hcloud_firewall.yml

@@ -47,6 +47,11 @@
       loop: "{{ hcloud_firewall_objects }}"
       loop_control:
         loop_var: firewall_object
+
+# set ENVvar awx_related=True to trigger playbook part
+#
+# needs to be implemented via switch due to potentially missing nodes at first time
+# when playbook was executed
 #
     - name: "Generate awx-related hcloud firewall rules"
       block:
@@ -71,59 +76,21 @@
           name: hcloud
           tasks_from: configure-firewall2
         vars:
-          awx_source_ips: '{{ k8s_worker_node_ips }}'
+          src_ips: '{{ k8s_worker_node_ips }}'
         loop: "{{ hcloud_firewall_objects_awx }}"
         loop_control:
           loop_var: firewall_object
+      when:
+        - awx_related is defined
+        - awx_related
 
-      - name: "Setup hcloud firewalls for database backup..."
+    - name: "Setup hcloud firewalls for database backup stuff..."
       include_role:
         name: hcloud
         tasks_from: configure-firewall2
-        vars:
-          awx_source_ips: '{{ k8s_worker_node_ips }}'
       loop: "{{ hcloud_firewall_objects_backup }}"
       loop_control:
         loop_var: firewall_object
-  
+      when:
-      - name: "Setup hcloud firewalls for gitea..."
+          - backup_related is defined
-        include_role:
+          - backup_related
-          name: hcloud
-          tasks_from: configure-firewall2
-        vars:
-          awx_source_ips: '{{ k8s_worker_node_ips }}'
-        loop: "{{ hcloud_firewall_objects_gitea }}"
-        loop_control:
-          loop_var: firewall_object
-  
-      - name: "Setup hcloud firewalls for keycloak..."
-        include_role:
-          name: hcloud
-          tasks_from: configure-firewall2
-        vars:
-          awx_source_ips: '{{ k8s_worker_node_ips }}'
-        loop: "{{ hcloud_firewall_objects_keycloak }}"
-        loop_control:
-          loop_var: firewall_object
-  
-      - name: "Setup hcloud firewalls for kibana..."
-        include_role:
-          name: hcloud
-          tasks_from: configure-firewall2
-        vars:
-          awx_source_ips: '{{ k8s_worker_node_ips }}'
-        loop: "{{ hcloud_firewall_objects_kibana }}"
-        loop_control:
-          loop_var: firewall_object
-  
-      - name: "Setup hcloud firewalls for management..."
-        include_role:
-          name: hcloud
-          tasks_from: configure-firewall2
-        vars:
-          awx_source_ips: '{{ k8s_worker_node_ips }}'
-        loop: "{{ hcloud_firewall_objects_management }}"
-        loop_control:
-          loop_var: firewall_object
-      # end of BLOCK
-      when: hcloud_firewall_app_specific_stuff | default(True)

host_vars/dev-blackbox-01.yml

@@ -1,7 +0,0 @@
----
-docker_enabled: false
-traefik_enabled: false
-filebeat_enabled: false
-metricbeat_enabled: false
-
-monitor_port_system: 9100

host_vars/ext-bdev-demo01-01.yml

@@ -2,4 +2,4 @@
 
 hetzner_server_labels: "stage={{ stage }} service=connect tenant=bdev"
 
-hetzner_server_type: cpx21
+hetzner_server_type: cx31

host_vars/ext-bdev-mpmexec-01.yml

@@ -1,5 +0,0 @@
----
-
-hetzner_server_labels: "stage={{ stage }} service=connect tenant=bdev"
-
-hetzner_server_type: cpx21

host_vars/prodnso-mobene-cusprod-01/plain.yml

@@ -1,14 +0,0 @@
----
-
-wordpress_image_version: latest
-
-connect_mail_protocol: "smtp"
-connect_mail_host: "smtp.office365.com"
-connect_mail_port: "587"
-connect_mail_user: "{{ connect_mail_user_vault }}"
-connect_mail_password: "{{ connect_mail_password_vault }}"
-connect_mail_properties_sender: "Info@egeld24.de"
-connect_mail_properties_sender_alias: "noreply"
-connect_mail_properties_smtp_auth: "true"
-connect_mail_properties_smtp_starttls_enable: "true"
-connect_mail_properties_smtp_starttls_required: "true"

host_vars/prodnso-mobene-cusprod-01/vault.yml

@@ -1,10 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-63313634313235623162373139646237316436336364376237333463303339636135303036323135
-3339326265343539663634353235306436383963666162370a313862376337663239663162396163
-38636336646465636339353032636161613034363434346436326364653165323632303666323464
-3162336233343635380a626664376232653734316334383561333963343266616163356430653361
-32353934613365303464653938626536656337363039326237633835643662653032363633653263
-62333935353365653039383638353266633632656638346332633563323566306532336538336462
-62386634323937626662313964313933616336323935616231623637363663626231356533303063
-30326266363334643431336233376462303637303863656138333763633361346335643533336134
-36363231376638376433353061343334356238313464343266396537663630363430

host_vars/prodnso-mobene-cusqa-01/plain.yml

@@ -1,14 +0,0 @@
----
-
-wordpress_image_version: latest
-
-connect_mail_protocol: "smtp"
-connect_mail_host: "smtp.office365.com"
-connect_mail_port: "587"
-connect_mail_user: "{{ connect_mail_user_vault }}"
-connect_mail_password: "{{ connect_mail_password_vault }}"
-connect_mail_properties_sender: "Info@egeld24.de"
-connect_mail_properties_sender_alias: "noreply"
-connect_mail_properties_smtp_auth: "true"
-connect_mail_properties_smtp_starttls_enable: "true"
-connect_mail_properties_smtp_starttls_required: "true"

host_vars/prodnso-mobene-cusqa-01/vault.yml

@@ -1,10 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-34656337303930343532386532646463353864653937633637303733346462666333303034323037
-6633333162376661313838366334313034336162623164630a336132396361353431386135303439
-38383366616163363865366137316238666638383263326430653236383532303232636531323431
-3563623830303665610a356336363438373938373863663738633661616366323334323661346666
-61343632663635376264356263346430383236663363373331613639323065396533613635386531
-30646135333638343461386436663763393663313266363434623837373562636166393033396163
-65356633383732313034363965353162323230353263373537656539336364383935633436633334
-64633461336431353532323939303761653534313134326335363732623032306161653437353330
-38306561643033373033313963336164383235653639386261646134353237313639

host_vars/prodnso-mobene-nsodev-01.yml

@@ -1,3 +0,0 @@
----
-
-wordpress_image_version: latest

host_vars/prodnso-postgres-01.yml

@@ -1,4 +1,3 @@
 ---
 
-hetzner_server_type: cpx21
 server_type: "master"

host_vars/prodnso-postgres-02.yml

@@ -1,4 +1,3 @@
 ---
 
-hetzner_server_type: cpx21
 server_type: "slave"

host_vars/prodnso-prometheus-01.yml

@@ -1,3 +0,0 @@
----
-
-hetzner_server_type: cpx21

host_vars/prodwork01-postgres-01.yml

@@ -1,4 +0,0 @@
----
-
-hetzner_server_type: cpx21
-server_type: "master"

host_vars/prodwork01-postgres-02.yml

@@ -1,4 +0,0 @@
----
-
-hetzner_server_type: cpx21
-server_type: "slave"

kubernetes.yml

@@ -28,7 +28,5 @@
     - { role: kubernetes/cert_manager }
     - { role: kubernetes/external_dns }
     - { role: kubernetes/ingress_controller }
-    - role: kubernetes/argocd
+    - { role: kubernetes/argocd }
-      when: kubernetes_with_argocd | default(True)
+    - { role: kubernetes/awx }
-    - role: kubernetes/awx
-      when: kubernetes_with_awx | default(True)

mobene.yml

@@ -1,128 +0,0 @@
----
-
-# creates kubernetes namespace with secrets for usage with mobene
-# Parameters:
-#   secrets for mobene/namespaces read from group_vars
-
-- name: 'apply mobene setup to {{ host | default("kube_control_plane") }}'
-  hosts: '{{ host | default("kube_control_plane") }}'
-  serial: "{{ serial_number | default(10) }}"
-
-  pre_tasks:
-    - name: "Check if ansible version is at least 2.10.x"
-      assert:
-        that:
-          - ansible_version.major >= 2
-          - ansible_version.minor >= 10
-        msg: "The ansible version has to be at least ({{ ansible_version.full }})"
-      tags:
-        - always
-
-    - name: "Import autodiscover pre-tasks"
-      import_tasks: tasks/autodiscover_pre_tasks.yml
-      tags:
-        - always
-
-  roles:
-    - role: kubernetes/namespace
-      vars:
-        k8s_namespace: cus-mobene-nsodev
-        k8s_secrets:
-          - name: connect-secrets
-            data:
-              JWT_SECRET: "{{ mobene.nsodev.connect.secrets.JWT_SECRET | string | b64encode }}"
-              ADMIN_PASSWORD: "{{ mobene.nsodev.connect.secrets.ADMIN_PASSWORD | string | b64encode }}"
-              ELASTIC_USERNAME: "{{ mobene.nsodev.connect.secrets.ELASTIC_USERNAME | string | b64encode }}"
-              ELASTIC_PASSWORD: "{{ mobene.nsodev.connect.secrets.ELASTIC_PASSWORD | string | b64encode }}"
-              DATASOURCE_USERNAME: "{{ mobene.nsodev.connect.secrets.DATASOURCE_USERNAME | string | b64encode }}"
-              DATASOURCE_PASSWORD: "{{ mobene.nsodev.connect.secrets.DATASOURCE_PASSWORD | string | b64encode }}"
-              MAIL_USER: "{{ mobene.nsodev.connect.secrets.MAIL_USER | string | b64encode }}"
-              MAIL_PASSWORD: "{{ mobene.nsodev.connect.secrets.MAIL_PASSWORD | string | b64encode }}"
-              OIDC_CLIENT_SECRET: "{{ mobene.nsodev.connect.secrets.OIDC_CLIENT_SECRET | string | b64encode }}"
-          - name: iam-secrets
-            data:
-              JWT_SECRET: "{{ mobene.nsodev.iam.secrets.JWT_SECRET | string | b64encode }}"
-              KEYCLOAK_ADMIN_PASSWORD: "{{ mobene.nsodev.iam.secrets.KEYCLOAK_ADMIN_PASSWORD | string | b64encode }}"
-              KEYCLOAK_ADMIN_USERNAME: "{{ mobene.nsodev.iam.secrets.KEYCLOAK_ADMIN_USERNAME | string | b64encode }}"
-          - name: sepa-exporter-secrets
-            data:
-              SMA_DOCUMENT_AUTH_TOKEN: "{{ mobene.nsodev.sepaExporter.secrets.SMA_DOCUMENT_AUTH_TOKEN | string | b64encode }}"
-              SMA_WORKFLOW_AUTH_TOKEN: "{{ mobene.nsodev.sepaExporter.secrets.SMA_WORKFLOW_AUTH_TOKEN | string | b64encode }}"
-          - name: uba-exporter-secrets
-            data:
-              SMA_DOCUMENT_AUTH_TOKEN: "{{ mobene.nsodev.ubaExporter.secrets.SMA_DOCUMENT_AUTH_TOKEN | string | b64encode }}"
-              SMA_WORKFLOW_AUTH_TOKEN: "{{ mobene.nsodev.ubaExporter.secrets.SMA_WORKFLOW_AUTH_TOKEN | string | b64encode }}"
-          - name: wordpress-secrets
-            data:
-              SMA_WORKFLOW_AUTH_TOKEN: "{{ mobene.nsodev.wordpress.secrets.SMA_WORKFLOW_AUTH_TOKEN | string | b64encode }}"
-          - name: elastic-client-cert
-            data:
-              ca.crt: "{{ mobene.nsodev.elastic.secrets.caCrt | string | b64encode }}"
-    - role: kubernetes/namespace
-      vars:
-        k8s_namespace: cus-mobene-cusqa
-        k8s_secrets:
-          - name: connect-secrets
-            data:
-              JWT_SECRET: "{{ mobene.cusqa.connect.secrets.JWT_SECRET | string | b64encode }}"
-              ADMIN_PASSWORD: "{{ mobene.cusqa.connect.secrets.ADMIN_PASSWORD | string | b64encode }}"
-              ELASTIC_USERNAME: "{{ mobene.cusqa.connect.secrets.ELASTIC_USERNAME | string | b64encode }}"
-              ELASTIC_PASSWORD: "{{ mobene.cusqa.connect.secrets.ELASTIC_PASSWORD | string | b64encode }}"
-              DATASOURCE_USERNAME: "{{ mobene.cusqa.connect.secrets.DATASOURCE_USERNAME | string | b64encode }}"
-              DATASOURCE_PASSWORD: "{{ mobene.cusqa.connect.secrets.DATASOURCE_PASSWORD | string | b64encode }}"
-              MAIL_USER: "{{ mobene.cusqa.connect.secrets.MAIL_USER | string | b64encode }}"
-              MAIL_PASSWORD: "{{ mobene.cusqa.connect.secrets.MAIL_USER | string | b64encode }}"
-              OIDC_CLIENT_SECRET: "{{ mobene.cusqa.connect.secrets.OIDC_CLIENT_SECRET | string | b64encode }}"
-          - name: iam-secrets
-            data:
-              JWT_SECRET: "{{ mobene.cusqa.iam.secrets.JWT_SECRET | string | b64encode }}"
-              KEYCLOAK_ADMIN_PASSWORD: "{{ mobene.cusqa.iam.secrets.KEYCLOAK_ADMIN_PASSWORD | string | b64encode }}"
-              KEYCLOAK_ADMIN_USERNAME: "{{ mobene.cusqa.iam.secrets.KEYCLOAK_ADMIN_USERNAME | string | b64encode }}"
-          - name: sepa-exporter-secrets
-            data:
-              SMA_DOCUMENT_AUTH_TOKEN: "{{ mobene.cusqa.sepaExporter.secrets.SMA_DOCUMENT_AUTH_TOKEN | string | b64encode }}"
-              SMA_WORKFLOW_AUTH_TOKEN: "{{ mobene.cusqa.sepaExporter.secrets.SMA_WORKFLOW_AUTH_TOKEN | string | b64encode }}"
-          - name: uba-exporter-secrets
-            data:
-              SMA_DOCUMENT_AUTH_TOKEN: "{{ mobene.cusqa.ubaExporter.secrets.SMA_DOCUMENT_AUTH_TOKEN | string | b64encode }}"
-              SMA_WORKFLOW_AUTH_TOKEN: "{{ mobene.cusqa.ubaExporter.secrets.SMA_WORKFLOW_AUTH_TOKEN | string | b64encode }}"
-          - name: wordpress-secrets
-            data:
-              SMA_WORKFLOW_AUTH_TOKEN: "{{ mobene.cusqa.wordpress.secrets.SMA_WORKFLOW_AUTH_TOKEN | string | b64encode }}"
-          - name: elastic-client-cert
-            data:
-              ca.crt: "{{ mobene.cusqa.elastic.secrets.caCrt | string | b64encode }}"
-    - role: kubernetes/namespace
-      vars:
-        k8s_namespace: cus-mobene-cusprod
-        k8s_secrets:
-          - name: connect-secrets
-            data:
-              JWT_SECRET: "{{ mobene.cusprod.connect.secrets.JWT_SECRET | string | b64encode }}"
-              ADMIN_PASSWORD: "{{ mobene.cusprod.connect.secrets.ADMIN_PASSWORD | string | b64encode }}"
-              ELASTIC_USERNAME: "{{ mobene.cusprod.connect.secrets.ELASTIC_USERNAME | string | b64encode }}"
-              ELASTIC_PASSWORD: "{{ mobene.cusprod.connect.secrets.ELASTIC_PASSWORD | string | b64encode }}"
-              DATASOURCE_USERNAME: "{{ mobene.cusprod.connect.secrets.DATASOURCE_USERNAME | string | b64encode }}"
-              DATASOURCE_PASSWORD: "{{ mobene.cusprod.connect.secrets.DATASOURCE_PASSWORD | string | b64encode }}"
-              MAIL_USER: "{{ mobene.cusprod.connect.secrets.MAIL_USER | string | b64encode }}"
-              MAIL_PASSWORD: "{{ mobene.cusprod.connect.secrets.MAIL_USER | string | b64encode }}"
-              OIDC_CLIENT_SECRET: "{{ mobene.cusprod.connect.secrets.OIDC_CLIENT_SECRET | string | b64encode }}"
-          - name: iam-secrets
-            data:
-              JWT_SECRET: "{{ mobene.cusprod.iam.secrets.JWT_SECRET | string | b64encode }}"
-              KEYCLOAK_ADMIN_PASSWORD: "{{ mobene.cusprod.iam.secrets.KEYCLOAK_ADMIN_PASSWORD | string | b64encode }}"
-              KEYCLOAK_ADMIN_USERNAME: "{{ mobene.cusprod.iam.secrets.KEYCLOAK_ADMIN_USERNAME | string | b64encode }}"
-          - name: sepa-exporter-secrets
-            data:
-              SMA_DOCUMENT_AUTH_TOKEN: "{{ mobene.cusprod.sepaExporter.secrets.SMA_DOCUMENT_AUTH_TOKEN | string | b64encode }}"
-              SMA_WORKFLOW_AUTH_TOKEN: "{{ mobene.cusprod.sepaExporter.secrets.SMA_WORKFLOW_AUTH_TOKEN | string | b64encode }}"
-          - name: uba-exporter-secrets
-            data:
-              SMA_DOCUMENT_AUTH_TOKEN: "{{ mobene.cusprod.ubaExporter.secrets.SMA_DOCUMENT_AUTH_TOKEN | string | b64encode }}"
-              SMA_WORKFLOW_AUTH_TOKEN: "{{ mobene.cusprod.ubaExporter.secrets.SMA_WORKFLOW_AUTH_TOKEN | string | b64encode }}"
-          - name: wordpress-secrets
-            data:
-              SMA_WORKFLOW_AUTH_TOKEN: "{{ mobene.cusprod.wordpress.secrets.SMA_WORKFLOW_AUTH_TOKEN | string | b64encode }}"
-          - name: elastic-client-cert
-            data:
-              ca.crt: "{{ mobene.cusprod.elastic.secrets.caCrt | string | b64encode }}"

patchday.yml

@@ -102,55 +102,33 @@
         name: postgresql
         state: started
 
-    # wait_for cannot be used anymore due to enabled SSL encryption for postgres connections in DEV-382
     - name: "Smardigo Patchday: check if postgres is listing on net internal ip address"
-      become: no
+      ansible.builtin.wait_for:
-      community.postgresql.postgresql_ping:
+        delay: 15
+        timeout: 180
         port: 5432
-        ssl_mode: require
+        host: '{{ stage_server_ip }}'
-        login_host: '{{ stage_private_server_ip }}'
       register: check_postgres
-      ignore_errors: yes
 
-    - name: "Smardigo Patchday: error-handling - ensure postgres started and check listing on net internal ip address"
+    - name: "Smardigo Patchday: restart postgres and check listing on net internal ip address again"
       block:
 
-      - name: "Smardigo Patchday: error-handling - ensure service(s) started"
+      - name: "Smardigo Patchday: stop service(s)"
         ansible.builtin.systemd:
           name: postgresql
-          state: started
+          state: restarted
 
-      - name: "Smardigo Patchday: error-handling - check if postgres is listing on net internal ip address"
+      - name: "Smardigo Patchday: check if postgres is listing on net internal ip address"
-        become: no
+        ansible.builtin.wait_for:
-        community.postgresql.postgresql_ping:
+          delay: 15
+          timeout: 180
           port: 5432
-          ssl_mode: require
+          host: '{{ stage_server_ip }}'
-          login_host: '{{ stage_private_server_ip }}'
+          register: check_postgres
-        register: check_postgres_again
+        failed_when: check_postgres_again.failed
-        retries: 5
-        failed_when: not check_postgres_again.is_available
-
-      rescue:
-        - name: "Smardigo Patchday: error-handling - send mail to DEVOPS-DL"
-          delegate_to: '{{ stage }}-mail-01'
-          community.general.mail:
-            host: localhost
-            port: 25
-            to: '{{ devops_email_address }}'
-            subject: "patchday( {{ lookup('pipe','date +%Y-%m-%d_%H:%M') }} ) problem report for {{ inventory_hostname }}"
-            body: |
-              Dear Sir or Madam,
-
-              I have to inform you that {{ inventory_hostname }} isn'n listening on {{ stage_private_server_ip }} anymore.
-
-              Plz check what happened/ fix it little padawan ;)
-
-              kind regards,
-
-              your automation-bofh
 
       when:
-        - not check_postgres.is_available
+        - check_postgres.failed
 
 - hosts: all,!elastic,!postgres,!k8s_cluster
   serial: 10

provisioning.yml

@@ -2,7 +2,7 @@
 
 - name: 'apply setup to {{ host | default("all") }}'
   hosts: '{{ host | default("all") }}'
-  serial: "{{ serial_number | default(5) }}"
+  serial: "{{ serial_number | default(1) }}"
   gather_facts: no
   become: no
 

remove-database.yml

@@ -84,27 +84,18 @@
     - role: connect_postgres
       when: "'connect' in group_names"
 
-    - role: gitea_postgres
+    - role: pdns_admin_postgres
-      when: "'gitea' in group_names"
+      when: "'pdns' in group_names"
+
+    - role: pdns_postgres
+      when: "'pdns' in group_names"
 
     - role: keycloak_postgres
       when: "'keycloak' in group_names"
 
-#    - role: pdns_admin_postgres
-#      when: "'pdns' in group_names"
-
-#    - role: pdns_postgres
-#      when: "'pdns' in group_names"
-
     - role: webdav_postgres
       when: "'webdav' in group_names"
 
-    - role: workflow_index_postgres
-      when: "'workflow_index' in group_names"
-
-    - role: workflow_proxy_postgres
-      when: "'workflow_proxy' in group_names"
-
     - role: connect_wordpress_maria
       when: "'connect_wordpress' in group_names"
 

restore-database-backup.yml

@@ -61,7 +61,7 @@
   serial: "{{ serial_number | default(1) }}"
   remote_user: root
   vars:
-    database_backup_state: restore
+    postgres_backup_state: restore
     ansible_ssh_host: "{{ stage_server_domain }}"
 
   roles:

restore-remote-database-backup.yml

@@ -1,251 +0,0 @@
----
-
-# restores remote database backup
-#   - postgres
-#     - executed on stage specific server: {{ stage }}-restore-postgres-01
-#     - restores a server from full-backup
-#   - mariadb
-#     - executed on stage specific server: {{ stage }}-restore-maria-01
-#     - restores a server from full-backup
-
-# Parameters:
-#   playbook inventory
-#     stage := the name of the stage (e.g. dev, int, qa, prod)
-#     database_engine := the database engine to restore a backup for (e.g. postgres, maria)
-#   smardigo message callback
-#     scope_id := (scope id of the management process)
-#     process_instance_id := (process instance id of the management process)
-#     smardigo_management_action := (smardigo management action anme of the management process)
-
-#############################################################
-#   Creating inventory dynamically for given parameters
-#############################################################
-
-- hosts: localhost
-  connection: local
-  gather_facts: false
-
-  pre_tasks:
-    - name: "Check if ansible version is at least 2.10.x"
-      assert:
-        that:
-          - ansible_version.major >= 2
-          - ansible_version.minor >= 10
-        msg: "The ansible version has to be at least ({{ ansible_version.full }})"
-
-#     add virtual server to load stage specific variables as context
-    - name: "Add <{{ stage }}-virtual-host-to-read-groups-vars> to hosts"
-      add_host:
-        name: "{{ stage }}-virtual-host-to-read-groups-vars"
-        groups:
-        - "stage_{{ stage }}"
-      changed_when: False
-
-  tasks:
-    - name: "Add {{ database_engine }} servers to hosts if necessary"
-      add_host:
-        name: "{{ stage }}-restore-{{ database_engine }}-01"
-        groups:
-        - "stage_{{ stage }}"
-        - 'restore'
-      changed_when: False
-    - name: "Add 'backup' servers to hosts if necessary"
-      add_host:
-        name: "{{ stage }}-backup-01"
-        groups:
-        - "stage_{{ stage }}"
-        - backup
-      changed_when: False
-
-#############################################################
-#   Create restore server(s)
-#############################################################
-
-- hosts: "restore"
-  serial: "{{ serial_number | default(1) }}"
-  gather_facts: false
-  remote_user: root
-
-  roles:
-    - role: hcloud
-      vars:
-        sma_digitalocean_ttl: 60 # set it to 60sec to reduce DNS caching problems with internal IT in case of debugging ansible problems ;)
-
-#############################################################
-#   Provisioning server(s) for created inventory
-#############################################################
-
-- hosts: "restore"
-  serial: "{{ serial_number | default(1) }}"
-  remote_user: root
-  vars:
-    ansible_ssh_host: "{{ stage_server_domain }}"
-
-  pre_tasks:
-    - name: "Import autodiscover pre-tasks"
-      import_tasks: tasks/autodiscover_pre_tasks.yml
-      become: false
-      tags:
-        - always
-
-  roles:
-    - role: common
-
-    - role: filebeat
-      when: filebeat_enabled | default(True)
-
-    - role: node_exporter
-      when: node_exporter_enabled | default(True)
-
-    - role: restore_{{ database_engine }}
-
-#############################################################
-#   add restore specific firewall rule
-#############################################################
-
-- hosts: "{{ stage }}-virtual-host-to-read-groups-vars"
-  serial: "{{ serial_number | default(1) }}"
-  gather_facts: false
-  connection: local
-  vars:
-    hcloud_firewall_objects_backup:
-       -
-         name: "{{ stage }}-restore-ssh-access"
-         state: present
-         rules:
-         -
-            direction: in
-            protocol: tcp
-            port: '22'
-            source_ips:
-              - "{{ lookup('community.general.dig', groups['backup'][0] + '.' + domain ) }}/32"
-            destination_ips: []
-            description: null
-         apply_to:
-         -
-           type: label_selector
-           label_selector:
-             selector: 'service=restore'
-
-  tasks:
-    - name: "Add hcloud firewall rule(s)"
-      include_role:
-        name: hcloud
-        tasks_from: configure-firewall2
-      loop: "{{ hcloud_firewall_objects_backup }}"
-      loop_control:
-        loop_var: firewall_object
-
-#############################################################
-#   Syncing backups from backup server to restore server
-#############################################################
-
-- hosts: "backup"
-  serial: "{{ serial_number | default(5) }}"
-  gather_facts: false
-  vars:
-    backupserver_system_user: 'backuphamster'
-    ansible_ssh_host: "{{ stage_server_domain }}"
-  tasks:
-    # I could not get it up and running with <synchronize> module
-    # to sync data from remote server A to remote server B
-    - name: "Syncing remote backups"
-      become: yes
-      become_user: '{{ backupserver_system_user }}'
-      vars:
-        database_server_ip: "{{ groups['restore'][0] }}.{{ domain }}"
-      shell: '/home/{{ backupserver_system_user }}/push_backups_to_restore_server.sh {{ database_server_ip }} {{ stage }} {{ database_engine }}'
-
-#############################################################
-#   Restoring from backup
-#############################################################
-
-- hosts: "restore"
-  serial: "{{ serial_number | default(1) }}"
-  gather_facts: false
-  vars:
-    ansible_ssh_host: "{{ stage_server_domain }}"
-  tasks:
-    - name: "Triggering restore"
-      become: yes
-      shell: '/root/restore.sh {{ stage }}'
-
-    - name: "Check for test data on postgres"
-      block:
-
-      - name: "Querying postgres ..."
-        become: yes
-        become_user: postgres
-        community.postgresql.postgresql_query:
-          db: dummytestdb
-          query: SELECT movie FROM movie_quotes WHERE quote = %(quote_val)s
-          named_args:
-            quote_val: 'Shall we play'
-        register: query_output
-
-      - assert:
-          that:
-          - 'query_output.query_all_results | first | selectattr("movie","match","wargames") | length == 1'
-
-      when:
-        - database_engine == 'postgres'
-
-    - name: "Check for test data on mariadb"
-      block:
-
-      - name: "Querying mariadb ..."
-        become: yes
-        become_user: root
-        community.mysql.mysql_query:
-          login_unix_socket: /run/mysqld/mysqld.sock
-          login_db: dummytestdb
-          query: SELECT movie FROM movie_quotes WHERE quote = %s
-          positional_args:
-            - 'Shall we play'
-        register: query_output
-
-      - assert:
-          that:
-          - 'query_output.query_result | first | selectattr("movie","match","wargames") | length == 1'
-
-      when:
-        - database_engine == 'maria'
-
-#############################################################
-#   Deleting servers/domains for created inventory
-#############################################################
-
-- hosts: "restore"
-  serial: "{{ serial_number | default(5) }}"
-  gather_facts: false
-
-  tasks:
-    - name: "Delete server <{{ inventory_hostname }}>"
-      include_role:
-        name: hcloud
-        tasks_from: _set_server_state
-      vars:
-        - server_state: "absent"
-
-    - name: "Delete DNS entry <{{ inventory_hostname }}> for <{{ domain }}>"
-      include_role:
-        name: sma_digitalocean
-        tasks_from: _remove_dns
-      vars:
-        record_to_remove: '{{ inventory_hostname }}'
-
-#############################################################
-#   Sending smardigo management message to process
-#############################################################
-
-- hosts: "{{ stage }}-virtual-host-to-read-groups-vars"
-  serial: "{{ serial_number | default(1) }}"
-  gather_facts: false
-  connection: local
-  run_once: true
-  vars:
-    connect_jwt_username: "{{ management_admin_username }}"
-
-  tasks:
-    - name: "Sending smardigo management message to <{{ smardigo_management_url }}>"
-      include_tasks: tasks/smardigo_management_message.yml

roles/backup/files/push_backups_to_restore_server.sh

@@ -1,32 +0,0 @@
-#!/bin/bash
-#
-#
-#
-
-REMOTE_SYSTEM_USER=backupuser
-DATABASE_SERVER_IP=$1
-STAGE=$2
-DATABASE_ENGINE=$3
-
-# currently it defaults to todays date
-DATE=$(date +%F)
-
-LOCAL_BACKUP_DIR="${HOME}/backups/${STAGE}/${DATABASE_ENGINE}"
-BACKUP_FILE_FOR_TRANSFER=$(find "${LOCAL_BACKUP_DIR}/${DATE}/" -name *.gz.gpg | tail -n 1)
-
-REMOTE_BACKUP_DIR="/home/${REMOTE_SYSTEM_USER}/backups/${STAGE}/${DATABASE_ENGINE}"
-DEST_DIR="${REMOTE_BACKUP_DIR}/${DATE}/"
-
-# avoid "REMOTE HOST IDENTIFICATION HAS CHANGED" - errors due to dynamic created server on restore process
-ssh-keygen -f "/home/backuphamster/.ssh/known_hosts" -R ${DATABASE_SERVER_IP}
-
-SSH_OPTIONS='-o StrictHostKeyChecking=no'
-
-# needed due to unknown rsync option --mkpath in rsync version 3.1.3
-ssh ${SSH_OPTIONS} ${REMOTE_SYSTEM_USER}@${DATABASE_SERVER_IP} "mkdir -p ${DEST_DIR}"
-
-rsync -v -e "ssh ${SSH_OPTIONS}" $BACKUP_FILE_FOR_TRANSFER ${REMOTE_SYSTEM_USER}@${DATABASE_SERVER_IP}:${DEST_DIR}
-
-BKP_FILE_TRANSFERRED=$(echo $BACKUP_FILE_FOR_TRANSFER | awk -F / '{ print $NF}')
-
-ssh ${SSH_OPTIONS} ${REMOTE_SYSTEM_USER}@${DATABASE_SERVER_IP} "test -f ${DEST_DIR}${BKP_FILE_TRANSFERRED}"

roles/common/tasks/main.yml

@@ -23,8 +23,6 @@
       {% for host in shared_service_hosts %}
       {{ host.ip }} {{ host.name }}
       {% endfor %}
-  when:
-    - "'hcloud' in group_names"
   tags:
     - update_etc_hosts
 
@@ -61,7 +59,7 @@
 - name: "Remove outdated users"
   user: name={{ item }} state=absent remove=yes
   with_items: "{{ current_users.stdout_lines }}"
-  when: not ((item in default_users) or (item in smardigo_plattform_users))
+  when: not ((item in default_plattform_users) or (item in smardigo_plattform_users))
   tags:
     - users
 
@@ -99,13 +97,24 @@
   tags:
     - users
 
-- name: "Update available package list"
+- name: "Create stuff for backups on database servers"
-  apt:
+  block:
-    update_cache: yes
+  - name: "Create system user for remote_backup"
+    become: yes
+    ansible.builtin.user:
+      name: '{{ backupuser_username }}'
+      comment: "user for backup"
+      shell: /bin/bash
+
+  - name: "Add SSH pub key to auth_keys"
+    authorized_key:
+      user: '{{ backupuser_username }}'
+      key: '{{ backupuser_ssh_pubkey }}'
+  when:
+    - inventory_hostname in groups['postgres'] or
+      inventory_hostname in groups['maria']
   tags:
-    - install
+    - users
-    - upgrade
-  when: ansible_distribution == "Ubuntu"
 
 - name: "Ensure docker configuration directory exists"
   file:
@@ -270,13 +279,3 @@
     state: present
   tags:
     - config
-
-- name: "configure ssh_hardening"
-  include_role:
-    # include role from collection called 'devsec'
-    name: devsec.hardening.ssh_hardening
-    apply:
-      tags:
-        - ssh_hardening
-  tags:
-    - ssh_hardening

roles/confirm_postgres/defaults/main.yml

@@ -1,8 +0,0 @@
----
-confirm_postgres_database: '{{ stage }}_{{ tenant_id }}_{{ cluster_name }}_confirm'
-confirm_postgres_password: 'confirm-postgres-admin'
-
-postgres_acls:
-  - name: "{{ confirm_postgres_database }}"
-    password: "{{ confirm_postgres_password }}"
-    trusted_cidr_entry: "{{ shared_service_network }}"

roles/confirm_postgres/tasks/main.yml

@@ -1,18 +0,0 @@
----
-
-### tags:
-
-- name: "Updating <confirm> database on {{ inventory_hostname }}"
-  include_role:
-    name: postgres
-    tasks_from: _update_database_state
-  when:
-  - database_backup_state is not defined
-
-- name: "Creating/Restoring <confirm> database backup on {{ inventory_hostname }}"
-  include_role:
-    name: postgres
-    tasks_from: _create_database_backup.yml
-  when:
-  - database_backup_state is defined
-  - database_backup_state in ['dump', 'restore']

roles/connect/defaults/main.yml

@@ -2,6 +2,10 @@
 
 connect_image_name: "{{ shared_service_harbor_hostname }}/smardigo/connect-whitelabel-app"
 
+# TODO inject by management portal
+connect_admin_username: "connect-admin"
+connect_admin_password: "connect-admin"
+
 connect_mail_host: "{{ shared_service_mail_hostname }}"
 connect_mail_properties_base_url: "{{ http_s }}://{{ connect_base_url }}"
 connect_mail_properties_base_url_extern: "{{ http_s }}://{{ connect_base_url }}"

roles/connect/tasks/connections.yml

@@ -2,6 +2,7 @@
 
 ### tags:
 ###   update_connections
+###   update_configuration
 
 - name: "Checking connect is running on <{{ connect_base_url }}>"
   delegate_to: 127.0.0.1
@@ -18,6 +19,7 @@
   until: connect_profile_info.status in [200]
   tags:
     - update_connections
+    - update_configuration
 
 - name: "Reading connections from <{{ connect_base_url }}>"
   delegate_to: 127.0.0.1
@@ -31,6 +33,7 @@
   register: connect_connections_result
   tags:
     - update_connections
+    - update_configuration
 
 - name: "Reading connection ids from <{{ connect_base_url }}>"
   set_fact:  
@@ -39,6 +42,7 @@
     querystr: "[[*].id]"
   tags:
     - update_connections
+    - update_configuration
 
 - name: "Printing connection ids for <{{ connect_base_url }}>"
   debug:
@@ -47,6 +51,7 @@
    - debug
   tags:
     - update_connections
+    - update_configuration
 
 - name: "Creating/Updating connections on <{{ connect_base_url }}>"
   delegate_to: 127.0.0.1
@@ -65,3 +70,4 @@
   changed_when: true
   tags:
     - update_connections
+    - update_configuration

roles/connect/tasks/main.yml

@@ -66,14 +66,6 @@
   tags:
     - update_certs
 
-- name: "Restart {{ connect_id }}"
-  community.docker.docker_compose:
-    project_src: '{{ service_base_path }}/{{ connect_id }}'
-    restarted: yes
-    build: no
-  tags:
-    - update_certs
-
 - name: "Update {{ connect_id }}"
   community.docker.docker_compose:
     project_src: '{{ service_base_path }}/{{ connect_id }}'
@@ -81,3 +73,10 @@
     pull: yes
   tags:
     - update_deployment
+
+- name: "Configure connect connections"
+  include_tasks: connections.yml
+  when:
+    smardigo_auth_token_value is defined
+  tags:
+    - always

roles/connect/vars/main.yml

@@ -20,8 +20,8 @@ connect_labels: [
 connect_environment: [
   "TENANT_ID: \"{{ connect_client_id }}\"",
 
-  "ADMIN_LOGIN: \"{{ connect_client_admin_username }}\"",
+  "ADMIN_LOGIN: \"{{ connect_admin_username }}\"",
-  "ADMIN_PASSWORD: \"{{ connect_client_admin_password }}\"",
+  "ADMIN_PASSWORD: \"{{ connect_admin_password }}\"",
   "SMA_JWT_ENABLED: \"{{ connect_jwt_enabled | default('false') }}\"",
   "SMA_JWT_SECRET: \"{{ connect_jwt_secret | default('') }}\"",
   "SMA_CSRF_TOKEN_NAME: \"{{ connect_csrf_token_name | default('') }}\"",
@@ -29,7 +29,7 @@ connect_environment: [
   "SPRING_PROFILES_INCLUDE: \"{{ spring_profiles_include | default('swagger') }}\"",
   "RIBBON_DISPLAY_ON_ACTIVE_PROFILES: \"{{ ribbon_display_on_active_profiles | default('dev') }}\"",
 
-  "DATASOURCE_URL: \"jdbc:postgresql://{{ connect_postgres_host }}:{{ service_port_postgres }}/{{ connect_postgres_database }}?sslmode=require\"",
+  "DATASOURCE_URL: \"jdbc:postgresql://{{ connect_postgres_host }}:{{ service_port_postgres }}/{{ connect_postgres_database }}\"",
   "DATASOURCE_USERNAME: \"{{ connect_postgres_username }}\"",
   "DATASOURCE_PASSWORD: \"{{ connect_postgres_password }}\"",
   "FILE_WHITELIST_URL: \"{{ connect_whitelist_url | default('') }}\"",
@@ -44,9 +44,6 @@ connect_environment: [
   "MAIL_PROPERTIES_BASE_URL_EXTERN: \"{{ connect_mail_properties_base_url_extern }}\"",
   "MAIL_PROPERTIES_SENDER: \"{{ connect_mail_properties_sender | default('noreply-connect@netgo.de') }}\"",
   "MAIL_PROPERTIES_SENDER_ALIAS: \"{{ connect_mail_properties_sender_alias | default('noreply-connect') }}\"",
-  "MAIL_PROPERTIES_SMTP_AUTH: \"{{ connect_mail_properties_smtp_auth | default('false') }}\"",
-  "MAIL_PROPERTIES_SMTP_STARTTLS_ENABLE: \"{{ connect_mail_properties_smtp_starttls_enable | default('false') }}\"",
-  "MAIL_PROPERTIES_SMTP_STARTTLS_REQUIRED: \"{{ connect_mail_properties_smtp_starttls_required | default('false') }}\"",
 
   "AUTH_MODULE: \"{{ connect_auth_module | default('preauth') }}\"",
   "OIDC_CLIENT_ID: \"{{ connect_oidc_client_id | default('oidc_config_not_found') }}\"",
@@ -102,10 +99,6 @@ connect_environment: [
   "OPENTRACING_JAEGER_LOG_SPANS: \"{{ connect_opentracing_jaeger_log_spans | default(false) }}\"",
   "OPENTRACING_JAEGER_SERVICE_NAME: \"{{ connect_opentracing_jaeger_service_name | default(connect_id) }}\"",
   "OPENTRACING_JAEGER_HTTP_SENDER_URL: \"{{ connect_opentracing_jaeger_http_sender_url | default() }}\"",
-
-  "CONFIG_DELETE_SCOPE_ENABLED: \"{{ connect_config_delete_scope_enabled | default(false) }}\"",
-  "CONFIG_LOCAL_IMPORT_ENABLED: \"{{ connect_config_local_import_enabled | default(false) }}\"",
-  "SMA_WORKFLOW_HEATMAP_ENABLED: \"{{ connect_workflow_heatmap_enabled | default(false) }}\"",
 ]
 
 connect_docker: {

roles/connect_postgres/tasks/main.yml

@@ -1,18 +1,19 @@
 ---
 
 ### tags:
+###     - remove-data
 
-- name: "Updating <connect> database on {{ inventory_hostname }}"
+- name: "Setup postgres for {{ inventory_hostname }}"
   include_role:
     name: postgres
-    tasks_from: _update_database_state
+    tasks_from: _postgres-acls
   when:
-  - database_backup_state is not defined
+  - postgres_backup_state is not defined
 
-- name: "Creating/Restoring <connect> database backup on {{ inventory_hostname }}"
+- name: "Creating/restoring postgres backup"
   include_role:
     name: postgres
     tasks_from: _create_database_backup.yml
   when:
-  - database_backup_state is defined
+  - postgres_backup_state is defined
-  - database_backup_state in ['dump', 'restore']
+  - postgres_backup_state in ['dump', 'restore']

roles/connect_realm/defaults/main.yml

@@ -1,6 +1,10 @@
 ---
 
+# TODO inject by management portal
+connect_client_admin_username: "connect-admin"
 connect_client_admin_password: "C0nnect-Admin!"
+# TODO inject by management portal
+connect_realm_admin_username: "connect-realm-admin"
 connect_realm_admin_password: "C0nnect-Realm-Admin!"
 
 current_realm_clients: [
@@ -40,9 +44,6 @@ current_realm_users: >-
   [{{ current_realm_users_base }}]
   {%- endif -%}
 
-current_realm_admin_users: [
+current_realm_admin_user:
-  {
+  username: "{{ connect_realm_admin_username }}"
-    "username": "{{ connect_realm_admin_username }}",
+  password: "{{ connect_realm_admin_password }}"
-    "password": "{{ connect_realm_admin_password }}",
-  }
-]

roles/connect_realm/tasks/main.yml

@@ -17,7 +17,7 @@
     name: keycloak
     tasks_from: _create_realm_users
 
-- name: "Create realm admin users"
+- name: "Create realm admin"
   include_role:
     name: keycloak
     tasks_from: _create_realm_admin

roles/connect_wordpress/tasks/main.yml

@@ -6,7 +6,7 @@
 - name: "Creating smardigo user token"
   smardigo_user_token:
     secret:  "{{ connect_jwt_secret }}"
-    user_id: "{{ connect_client_admin_username }}"
+    user_id: "{{ connect_admin_username }}"
   register: smardigo_user_token_result
   delegate_to: 127.0.0.1
   become: false

roles/connect_wordpress/vars/main.yml

@@ -27,23 +27,6 @@ wordpress_docker: {
     },
   ],
   services: [
-    {
-      name: "mariaproxy",
-      image_name: "haproxytech/haproxy-alpine",
-      image_version: "2.2.24",
-      ports: [
-        {
-          "external": "16666",
-          "internal": "6666",
-        },
-      ],
-      volumes: [
-        '"./config/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro"',
-      ],
-      networks: [
-        '"back-tier"',
-      ],
-    },
     {
       name: "{{ wordpress_id }}",
       image_name: "{{ wordpress_image_name }}",
@@ -59,7 +42,6 @@ wordpress_docker: {
         "WORDPRESS_CONFIG_EXTRA: |",
         "  define( 'WP_HOME', 'https://{{ wordpress_base_url }}' );",
         "  define( 'WP_SITEURL', 'https://{{ wordpress_base_url }}' );",
-        "  define( 'MYSQL_CLIENT_FLAGS', MYSQLI_CLIENT_SSL | MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT );",
         "AUTH_API: \"https://{{ shared_service_keycloak_hostname }}\"",
         "RESOURCE_API: \"https://{{ connect_base_url }}\"",
         "REALM_ID: \"{{ current_realm_name }}\"",

roles/connect_wordpress_maria/tasks/main.yml

@@ -2,17 +2,7 @@
 
 ### tags:
 
-- name: "Updating <wordpress> database on {{ inventory_hostname }}"
+- name: "Setup maria for {{ inventory_hostname }}"
   include_role:
     name: maria
-    tasks_from: _update_database_state
+    tasks_from: _create-database
-  when:
-  - database_backup_state is not defined
-
-- name: "Creating/Restoring <wordpress> database backup on {{ inventory_hostname }}"
-  include_role:
-    name: maria
-    tasks_from: _create_database_backup.yml
-  when:
-  - database_backup_state is defined
-  - database_backup_state in ['dump', 'restore']

roles/elastic/tasks/main.yaml

@@ -64,19 +64,12 @@
     - update_certs
     - update_config
 
-- name: "Restart {{ elastic_id }}"
-  community.docker.docker_compose:
-    project_src: '{{ service_base_path }}/{{ elastic_id }}'
-    restarted: yes
-    build: no
-  tags:
-    - update_certs
-
 - name: "Update {{ elastic_id }}"
   community.docker.docker_compose:
     project_src: '{{ service_base_path }}/{{ elastic_id }}'
     state: present
     pull: yes
   tags:
+    - update_certs
     - update_config
     - update_deployment

roles/export_maria_database/defaults/main.yml

@@ -1,3 +0,0 @@
----
-
-upload_directory: "{{ backup_directory }}"

roles/export_maria_database/tasks/main.yml

@@ -1,11 +0,0 @@
----
-
-### tags:
-
-- name: "Export database  <{{ target_database }}> to <{{ upload_directory }}/{{ database_backup_file }}>"
-  community.mysql.mysql_db:
-    name: "{{ target_database }}"
-    state: dump
-    target: "/{{ upload_directory }}/{{ database_backup_file }}"
-    config_file: "/etc/mysql/mariadb.conf.d/50-client.cnf"
-    login_password: "{{ mysql_root_password }}"

roles/gitea/vars/main.yml

@@ -31,7 +31,6 @@ gitea_environment: [
   "GITEA__database__NAME: \"{{ gitea_postgres_database }}\"",
   "GITEA__database__USER: \"{{ gitea_postgres_database }}\"",
   "GITEA__database__PASSWD: \"{{ gitea_postgres_password }}\"",
-  "GITEA__database__SSL_MODE: \"require\"",
 
   "GITEA__server__DOMAIN: \"{{ stage_server_domain }}\"",
   "GITEA__server__SSH_DOMAIN: \"{{ stage_server_domain }}\"",

roles/gitea_postgres/tasks/main.yml

@@ -1,18 +1,19 @@
 ---
 
 ### tags:
+###     - remove-data
 
-- name: "Updating <gitea> database on {{ inventory_hostname }}"
+- name: "Setup postgres for {{ inventory_hostname }}"
   include_role:
     name: postgres
-    tasks_from: _update_database_state
+    tasks_from: _postgres-acls
   when:
-  - database_backup_state is not defined
+  - postgres_backup_state is not defined
 
-- name: "Creating/Restoring <gitea> database backup on {{ inventory_hostname }}"
+- name: "Creating/restoring postgres backup"
   include_role:
     name: postgres
     tasks_from: _create_database_backup.yml
   when:
-  - database_backup_state is defined
+  - postgres_backup_state is defined
-  - database_backup_state in ['dump', 'restore']
+  - postgres_backup_state in ['dump', 'restore']

roles/harbor/tasks/install.yml

@@ -162,4 +162,3 @@
   systemd:
     name: harbor
     state: started
-    enabled: yes

roles/hcloud/defaults/main.yml

@@ -1,5 +1,3 @@
 ---
 
 server_state: "present"
-max_retries: 15
-retry_delay: 60

roles/hcloud/tasks/_set_server_state.yml

@@ -1,11 +1,6 @@
 ---
-- name: "Block to handle hetzner server state in case of problems"
-  block:
-  - name: "Increment the retry count"
-    set_fact:
-      retry_count: "{{ retry_count | default(0) | int + 1 }}"
 
-  - name: "Checking state for server <{{ inventory_hostname }}> is <{{ server_state }}>"
+- name: "Checking state for server <{{ inventory_hostname }}> is <{{ server_state }}>"
   hetzner.hcloud.hcloud_server:
     api_token: "{{ hetzner_authentication_ansible }}"
     name: "{{ inventory_hostname }}"
@@ -17,45 +12,3 @@
     state: "{{ server_state }}"
   delegate_to: 127.0.0.1
   become: false
-    async: 300
-    poll: 5
-    register: hcloud_response
-    ignore_errors: yes
-
-  - name: "Block - DEBUG: hcloud_response"
-    debug:
-      msg: '{{ hcloud_response.msg }}'
-    when:
-      - hcloud_response.msg is defined
-
-  - name: "Ensure Server is STARTED when server_state=present"
-    hetzner.hcloud.hcloud_server:
-      api_token: "{{ hetzner_authentication_ansible }}"
-      name: "{{ inventory_hostname }}"
-      state: "started"
-    delegate_to: 127.0.0.1
-    become: false
-    async: 150
-    poll: 15
-    register: hcloud_response
-    when:
-      - server_state == 'present'
-
-  rescue:
-    - name: "RESCUE - fail: Maximum retries reached"
-      fail:
-        msg: "max_retries of {{ max_retries }} reached. Plz check."
-      when: retry_count | int == max_retries | int
-
-    - name: "RESCUE-fail DEBUG: hcloud_response"
-      debug:
-        msg: '{{ hcloud_response.msg }}'
-
-    - name: "RESCUE: wait_for {{ retry_delay }} sec. between retries"
-      wait_for:
-        timeout: "{{ retry_delay }}"
-      delegate_to: localhost
-      become: false
-
-    - name: "Include _set_server one time again => increase retry_count"
-      include_tasks: _set_server_state.yml

roles/import_maria_database/tasks/main.yml

@@ -6,7 +6,7 @@
   community.mysql.mysql_db:
     name: "{{ target_database }}"
     state: absent
-    login_unix_socket: /var/run/mysqld/mysqld.sock
+    config_file: "/etc/mysql/mariadb.conf.d/50-client.cnf"
     login_password: "{{ mysql_root_password }}"
 
 - name: "Import database from <{{ upload_directory }}/{{ database_backup_file }}> to <{{ target_database }}>"
@@ -14,5 +14,5 @@
     name: "{{ target_database }}"
     state: import
     target: "/{{ upload_directory }}/{{ database_backup_file }}"
-    login_unix_socket: /var/run/mysqld/mysqld.sock
+    config_file: "/etc/mysql/mariadb.conf.d/50-client.cnf"
     login_password: "{{ mysql_root_password }}"

roles/import_maria_database/vars/main.yml

@@ -0,0 +1,2 @@
+---
+

roles/keycloak/tasks/_create_realm_admin.yml

@@ -58,7 +58,7 @@
       Content-Type: "application/json"
       Authorization: "Bearer {{ access_token }}"
     status_code: [201]
-  loop: "{{ current_realm_admin_users }}"
+  loop: "[{{ current_realm_admin_user }}]"
   loop_control:
     loop_var: current_realm_user
   when: current_realm_user.username not in realm_user_usernames

roles/keycloak/vars/main.yml

@@ -37,7 +37,7 @@ keycloak_docker: {
         "DB_USER: \"{{ keycloak_postgres_username }}\"",
         "DB_PASSWORD: \"{{ keycloak_postgres_password }}\"",
         "DB_ADDR: \"{{ keycloak_postgres_host }}\"",
-        "JDBC_PARAMS: \"sslmode=require\"",
+
         "JAVA_OPTS_APPEND: \"-Dkeycloak.profile.feature.docker=enabled\"",
       ],
       networks: [

roles/keycloak_postgres/tasks/main.yml

@@ -1,18 +1,19 @@
 ---
 
 ### tags:
+###     - remove-data
 
-- name: "Updating <keycloak> database on {{ inventory_hostname }}"
+- name: "Setup postgres for {{ inventory_hostname }}"
   include_role:
     name: postgres
-    tasks_from: _update_database_state
+    tasks_from: _postgres-acls
   when:
-  - database_backup_state is not defined
+  - database_create
 
-- name: "Creating/Restoring <keycloak> database backup on {{ inventory_hostname }}"
+- name: "Creating/restoring postgres backup"
   include_role:
     name: postgres
     tasks_from: _create_database_backup.yml
   when:
-  - database_backup_state is defined
+  - postgres_backup_state is defined
-  - database_backup_state in ['dump', 'restore']
+  - postgres_backup_state in ['dump', 'restore']

roles/kibana/defaults/main.yaml

@@ -6,128 +6,3 @@ kibana_image_version: "7.16.1"
 kibana_advanced_settings:
   changes:
     truncate:maxHeight: 0
-
-prometheus_es_exporter__username: '{{ stage }}-prometheus-es-exporter'
-prometheus_es_exporter__password: '{{ prometheus_es_exporter__password_vault }}'
-prometheus_es_exporter__email: 'nso.devops@netgo.de'
-
-kibana_api_endpoint: '{{ shared_service_elastic_stack_kibana_01_hostname }}-kibana.{{ domain }}'
-kibana_technical_users:
-  -
-    elastic_users:
-      -
-        username: '{{ prometheus_es_exporter__username }}'
-        roles:
-        - '{{ prometheus_es_exporter__username }}'
-        full_name: ''
-        password: '{{ prometheus_es_exporter__password }}'
-        email: '{{ prometheus_es_exporter__email }}'
-        enabled: true
-        elastic_state: present
-    elastic_roles:
-      -
-        elastic_state: present
-        name: '{{ prometheus_es_exporter__username }}'
-        elasticsearch:
-          cluster: []
-          indices:
-          - names:
-            - '{{ stage }}-*'
-            privileges:
-            - read
-            - read_cross_cluster
-            - view_index_metadata
-            allow_restricted_indices: false
-          run_as: []
-        kibana:
-        - base: []
-          feature:
-            advancedSettings:
-            - all
-            dashboard:
-            - all
-            discover:
-            - all
-            indexPatterns:
-            - all
-            savedObjectsManagement:
-            - all
-            visualize:
-            - all
-          spaces:
-          - '{{ prometheus_es_exporter__username }}'
-    elastic_spaces:
-      -
-        elastic_state: present
-        id: &es_space_name '{{ prometheus_es_exporter__username }}'
-        name: '{{ prometheus_es_exporter__username }}'
-        description: ''
-        disabledFeatures:
-          - canvas
-          - maps
-          - ml
-          - visualize
-          - enterpriseSearch
-          - logs
-          - infrastructure
-          - apm
-          - uptime
-          - observabilityCases
-          - siem
-          - monitoring
-          - fleet
-          - stackAlerts
-          - actions
-          - osquery
-          - savedObjectsTagging
-    elastic_index_patterns:
-      -
-        attributes:
-          fieldAttrs: '{}'
-          fields: "[]"
-          runtimeFieldMap: "{}"
-          timeFieldName: "@timestamp"
-          title: '{{ stage }}-management-*-connect-*'
-          typeMeta: "{}"
-        references: []
-        elastic_state: present
-      -
-        attributes:
-          fieldAttrs: '{}'
-          fields: "[]"
-          runtimeFieldMap: "{}"
-          timeFieldName: "@timestamp"
-          title: 'uncategorized-*'
-          typeMeta: "{}"
-        references: []
-        elastic_state: present
-      -
-        attributes:
-          fieldAttrs: '{}'
-          fields: "[]"
-          runtimeFieldMap: "{}"
-          timeFieldName: "@timestamp"
-          title: '{{ stage }}-*-authlog-*'
-          typeMeta: "{}"
-        references: []
-        elastic_state: present
-      -
-        attributes:
-          fieldAttrs: '{}'
-          fields: "[]"
-          runtimeFieldMap: "{}"
-          timeFieldName: "@timestamp"
-          title: '{{ stage }}-*-syslog-*'
-          typeMeta: "{}"
-        references: []
-        elastic_state: present
-      -
-        attributes:
-          fieldAttrs: '{}'
-          fields: "[]"
-          runtimeFieldMap: "{}"
-          timeFieldName: "@timestamp"
-          title: '{{ stage }}-monitoring-*'
-          typeMeta: "{}"
-        references: []
-        elastic_state: present

roles/kibana/tasks/_configure_dashboards.yml

@@ -10,7 +10,7 @@
 - name: "Dashboards: Get all searches in elasticsearch"
   delegate_to: localhost
   uri:
-    url: "https://{{ kibana_api_endpoint }}{{ api_path }}/_find?per_page=10000&type={{ es_object_type }}"
+    url: "https://{{ api_endpoint }}{{ api_path }}/_find?per_page=10000&type={{ es_object_type }}"
     method: GET
     status_code: [200]
     user: "{{ elastic_admin_username }}"
@@ -47,7 +47,7 @@
   - name: "Dashboards: Get all searches in elasticsearch"
     delegate_to: localhost
     uri:
-      url: "https://{{ kibana_api_endpoint }}/s/{{ es_space }}/api/saved_objects/_find?per_page=10000&type=search"
+      url: "https://{{ api_endpoint }}/s/{{ es_space }}/api/saved_objects/_find?per_page=10000&type=search"
       method: GET
       status_code: [200]
       user: "{{ elastic_admin_username }}"
@@ -121,7 +121,7 @@
 - name: "Create {{ es_object_type }} <<{{ elastic_dashboard.attributes.title }}>>"
   delegate_to: localhost
   uri:
-    url: "https://{{ kibana_api_endpoint }}{{ api_path }}/{{ es_object_type }}"
+    url: "https://{{ api_endpoint }}{{ api_path }}/{{ es_object_type }}"
     method: POST
     status_code: [200]
     user: "{{ elastic_admin_username }}"
@@ -140,7 +140,7 @@
 - name: "Update {{ es_object_type }} <<{{ elastic_dashboard.attributes.title }}>>"
   delegate_to: localhost
   uri:
-    url: 'https://{{ kibana_api_endpoint }}{{ api_path }}/{{ es_object_type }}/{{ lookup_dashboard_object[0]["id"] }}'
+    url: 'https://{{ api_endpoint }}{{ api_path }}/{{ es_object_type }}/{{ lookup_dashboard_object[0]["id"] }}'
     method: PUT
     status_code: [200]
     user: "{{ elastic_admin_username }}"
@@ -159,7 +159,7 @@
 - name: "DELETE {{ es_object_type }} <<{{ elastic_dashboard.attributes.title }}>>"
   delegate_to: localhost
   uri:
-    url: 'https://{{ kibana_api_endpoint }}{{ api_path }}/{{ es_object_type }}/{{ lookup_dashboard_object[0]["id"] }}'
+    url: 'https://{{ api_endpoint }}{{ api_path }}/{{ es_object_type }}/{{ lookup_dashboard_object[0]["id"] }}'
     method: DELETE
     status_code: [200]
     user: "{{ elastic_admin_username }}"

roles/kibana/tasks/_configure_indexpattern.yml

@@ -3,53 +3,45 @@
   set_fact:
     api_path: '/s/{{ es_space }}/api/saved_objects'
     es_object_type: 'index-pattern'
-    index_pattern_exists: False
+    indexpattern_exists: False
-    elastic_index_pattern_cleaned: {}
+    elastic_indexpattern_cleaned: {}
 
-- name: "Get all index patterns in elasticsearch"
+- name: "Get all indexpatterns in elasticsearch"
   delegate_to: localhost
   uri:
-    url: "https://{{ kibana_api_endpoint }}{{ api_path }}/_find?per_page=10000&type={{ es_object_type }}"
+    url: "https://{{ api_endpoint }}{{ api_path }}/_find?per_page=10000&type=index-pattern"
     method: GET
     status_code: [200]
     user: "{{ elastic_admin_username }}" 
     password: "{{ elastic_admin_password }}"
     force_basic_auth: yes
-  register: all_index_patterns
+  register: all_indexpatterns
   become: false
 
-- name: "Lookup index pattern <{{ elastic_index_pattern.attributes.title }}>"
+- name: "Lookup index pattern object if exists"
   set_fact:
-    lookup_indexpattern_object: '{{ all_index_patterns.json | community.general.json_query(querystr1) | first | community.general.json_query(indexpattern_query) }}'
+    lookup_indexpattern_object: '{{ all_indexpatterns.json | community.general.json_query(querystr1) | first | community.general.json_query(indexpattern_query) }}'
   vars:
     querystr1: "[saved_objects[*]]"
-    indexpattern_query: "[?attributes.title=='{{ elastic_index_pattern.attributes.title }}']"
+    indexpattern_query: "[?attributes.title=='{{ elastic_indexpattern.attributes.title }}']"
 
 - name: "Set switch VAR"
   set_fact:
-    index_pattern_exists: True 
+    indexpattern_exists: True 
   when:
     - lookup_indexpattern_object | length > 0
 
 - name: "Drop not needed key from dict"
   set_fact:
-    elastic_index_pattern_cleaned: "{{ elastic_index_pattern_cleaned | combine({item.key: item.value}) }}"
+    elastic_indexpattern_cleaned: "{{ elastic_indexpattern_cleaned | combine({item.key: item.value}) }}"
-  with_dict: '{{ elastic_index_pattern }}'
+  with_dict: '{{ elastic_indexpattern }}'
   when:
     - item.key not in ['elastic_state']
 
-- name: "Create <{{ es_object_type }}> <{{ elastic_index_pattern.attributes.title }}>"
+- name: "Create {{ es_object_type }} <<{{ elastic_indexpattern.attributes.title }}>>"
-  debug:
-    msg: "{{ elastic_index_pattern_cleaned }}"
-  become: false
-  when:
-    - not index_pattern_exists
-    - elastic_index_pattern.elastic_state == 'present'
-
-- name: "Create <{{ es_object_type }}> <{{ elastic_index_pattern.attributes.title }}>"
   delegate_to: localhost
   uri:
-    url: "https://{{ kibana_api_endpoint }}{{ api_path }}/{{ es_object_type }}"
+    url: "https://{{ api_endpoint }}{{ api_path }}/{{ es_object_type }}"
     method: POST
     status_code: [200]
     user: "{{ elastic_admin_username }}" 
@@ -59,16 +51,16 @@
       Content-Type: application/json
       kbn-xsrf: true
     body_format: json
-    body: '{{ elastic_index_pattern_cleaned | to_json }}'
+    body: '{{ elastic_indexpattern_cleaned | to_json }}'
   become: false
   when:
-    - not index_pattern_exists
+    - not indexpattern_exists
-    - elastic_index_pattern.elastic_state == 'present'
+    - elastic_indexpattern.elastic_state == 'present'
 
-- name: "Update {{ es_object_type }} <<{{ elastic_index_pattern.attributes.title }}>>"
+- name: "Update {{ es_object_type }} <<{{ elastic_indexpattern.attributes.title }}>>"
   delegate_to: localhost
   uri:
-    url: 'https://{{ kibana_api_endpoint }}{{ api_path }}/{{ es_object_type }}/{{ lookup_indexpattern_object[0]["id"] }}'
+    url: 'https://{{ api_endpoint }}{{ api_path }}/{{ es_object_type }}/{{ lookup_indexpattern_object[0]["id"] }}'
     method: PUT
     status_code: [200]
     user: "{{ elastic_admin_username }}" 
@@ -78,16 +70,16 @@
       Content-Type: application/json
       kbn-xsrf: true
     body_format: json
-    body: '{{ elastic_index_pattern_cleaned | to_json }}'
+    body: '{{ elastic_indexpattern_cleaned | to_json }}'
   become: false
   when:
-    - index_pattern_exists
+    - indexpattern_exists
-    - elastic_index_pattern.elastic_state == 'present'
+    - elastic_indexpattern.elastic_state == 'present'
 
-- name: "DELETE {{ es_object_type }} <<{{ elastic_index_pattern.attributes.title }}>>"
+- name: "DELETE {{ es_object_type }} <<{{ elastic_indexpattern.attributes.title }}>>"
   delegate_to: localhost
   uri:
-    url: 'https://{{ kibana_api_endpoint }}{{ api_path }}/{{ es_object_type }}/{{ lookup_indexpattern_object[0]["id"] }}'
+    url: 'https://{{ api_endpoint }}{{ api_path }}/{{ es_object_type }}/{{ lookup_indexpattern_object[0]["id"] }}'
     method: DELETE
     status_code: [200]
     user: "{{ elastic_admin_username }}" 
@@ -98,5 +90,5 @@
       kbn-xsrf: true
   become: false
   when:
-    - index_pattern_exists
+    - indexpattern_exists
-    - elastic_index_pattern.elastic_state == 'absent'
+    - elastic_indexpattern.elastic_state == 'absent'

roles/kibana/tasks/_configure_roles.yml

@@ -8,7 +8,7 @@
 - name: "Get all roles in elasticsearch"
   delegate_to: localhost
   uri:
-    url: "https://{{ kibana_api_endpoint }}{{ api_path }}"
+    url: "https://{{ api_endpoint }}{{ api_path }}"
     method: GET
     status_code: [200]
     user: "{{ elastic_admin_username }}" 
@@ -39,7 +39,7 @@
 - name: "Create role <<{{ elastic_role.name }}>>"
   delegate_to: localhost
   uri:
-    url: "https://{{ kibana_api_endpoint }}{{ api_path }}/{{ elastic_role.name }}"
+    url: "https://{{ api_endpoint }}{{ api_path }}/{{ elastic_role.name }}"
     method: PUT
     status_code: [204]
     user: "{{ elastic_admin_username }}" 
@@ -58,7 +58,7 @@
 - name: "Update role <<{{ elastic_role.name }}>>"
   delegate_to: localhost
   uri:
-    url: "https://{{ kibana_api_endpoint }}{{ api_path }}/{{ elastic_role.name }}"
+    url: "https://{{ api_endpoint }}{{ api_path }}/{{ elastic_role.name }}"
     method: PUT
     status_code: [204]
     user: "{{ elastic_admin_username }}" 
@@ -77,7 +77,7 @@
 - name: "DELETE role <<{{ elastic_role.name }}>>"
   delegate_to: localhost
   uri:
-    url: "https://{{ kibana_api_endpoint }}{{ api_path }}/{{ elastic_role.name }}"
+    url: "https://{{ api_endpoint }}{{ api_path }}/{{ elastic_role.name }}"
     method: DELETE
     status_code: [204]
     user: "{{ elastic_admin_username }}" 

roles/kibana/tasks/_configure_searches.yml

@@ -10,7 +10,7 @@
 - name: "Get all searches in elasticsearch"
   delegate_to: localhost
   uri:
-    url: "https://{{ kibana_api_endpoint }}{{ api_path }}/_find?per_page=10000&type=search"
+    url: "https://{{ api_endpoint }}{{ api_path }}/_find?per_page=10000&type=search"
     method: GET
     status_code: [200]
     user: "{{ elastic_admin_username }}" 
@@ -46,7 +46,7 @@
   - name: "Get all indexpatterns in elasticsearch"
     delegate_to: localhost
     uri:
-      url: "https://{{ kibana_api_endpoint }}/s/{{ es_space }}/api/saved_objects/_find?per_page=10000&type=index-pattern"
+      url: "https://{{ api_endpoint }}/s/{{ es_space }}/api/saved_objects/_find?per_page=10000&type=index-pattern"
       method: GET
       status_code: [200]
       user: "{{ elastic_admin_username }}" 
@@ -109,7 +109,7 @@
 - name: "Create {{ es_object_type }} <<{{ elastic_search.attributes.title }}>>"
   delegate_to: localhost
   uri:
-    url: "https://{{ kibana_api_endpoint }}{{ api_path }}/{{ es_object_type }}"
+    url: "https://{{ api_endpoint }}{{ api_path }}/{{ es_object_type }}"
     method: POST
     status_code: [200]
     user: "{{ elastic_admin_username }}" 
@@ -128,7 +128,7 @@
 - name: "Update {{ es_object_type }} <<{{ elastic_search.attributes.title }}>>"
   delegate_to: localhost
   uri:
-    url: 'https://{{ kibana_api_endpoint }}{{ api_path }}/{{ es_object_type }}/{{ lookup_search_object[0]["id"] }}'
+    url: 'https://{{ api_endpoint }}{{ api_path }}/{{ es_object_type }}/{{ lookup_search_object[0]["id"] }}'
     method: PUT
     status_code: [200]
     user: "{{ elastic_admin_username }}" 
@@ -147,7 +147,7 @@
 - name: "DELETE {{ es_object_type }} <<{{ elastic_search.attributes.title }}>>"
   delegate_to: localhost
   uri:
-    url: 'https://{{ kibana_api_endpoint }}{{ api_path }}/{{ es_object_type }}/{{ lookup_search_object[0]["id"] }}'
+    url: 'https://{{ api_endpoint }}{{ api_path }}/{{ es_object_type }}/{{ lookup_search_object[0]["id"] }}'
     method: DELETE
     status_code: [200]
     user: "{{ elastic_admin_username }}" 

roles/kibana/tasks/_configure_spaces.yml

@@ -8,16 +8,13 @@
 - name: "Get all spaces in elasticsearch"
   delegate_to: localhost
   uri:
-    url: "https://{{ kibana_api_endpoint }}{{ api_path }}"
+    url: "https://{{ api_endpoint }}{{ api_path }}"
     method: GET
     status_code: [200]
     user: "{{ elastic_admin_username }}"
     password: "{{ elastic_admin_password }}"
     force_basic_auth: yes
-  retries: 5
-  delay: 15
   register: all_spaces
-  until: all_spaces.status in [200]
   become: false
 
 - name: "Lookup space object if exists"
@@ -46,7 +43,7 @@
 - name: "Create space <<{{ elastic_space.name }}>>"
   delegate_to: localhost
   uri:
-    url: "https://{{ kibana_api_endpoint }}{{ api_path }}"
+    url: "https://{{ api_endpoint }}{{ api_path }}"
     method: POST
     status_code: [200]
     user: "{{ elastic_admin_username }}"
@@ -65,7 +62,7 @@
 - name: "Update space <<{{ elastic_space.name }}>>"
   delegate_to: localhost
   uri:
-    url: "https://{{ kibana_api_endpoint }}{{ api_path }}/{{ elastic_space.name }}"
+    url: "https://{{ api_endpoint }}{{ api_path }}/{{ elastic_space.name }}"
     method: PUT
     status_code: [200]
     user: "{{ elastic_admin_username }}"
@@ -84,7 +81,7 @@
 - name: "Update space advanced settings <<{{ elastic_space.name }}>>"
   delegate_to: localhost
   uri:
-    url: "https://{{ kibana_api_endpoint }}/s/{{ elastic_space.name }}/api/kibana/settings"
+    url: "https://{{ api_endpoint }}/s/{{ elastic_space.name }}/api/kibana/settings"
     method: POST
     status_code: [200]
     user: "{{ elastic_admin_username }}"
@@ -103,7 +100,7 @@
 - name: "DELETE space <<{{ elastic_space.name }}>>"
   delegate_to: localhost
   uri:
-    url: "https://{{ kibana_api_endpoint }}{{ api_path }}/{{ elastic_space.name }}"
+    url: "https://{{ api_endpoint }}{{ api_path }}/{{ elastic_space.name }}"
     method: DELETE
     status_code: [204]
     user: "{{ elastic_admin_username }}"

roles/kibana/tasks/_configure_users.yml

@@ -9,7 +9,7 @@
 - name: "Get all users in elasticsearch"
   delegate_to: localhost
   uri:
-    url: "https://{{ kibana_api_endpoint }}{{ api_path }}"
+    url: "https://{{ api_endpoint }}{{ api_path }}"
     method: GET
     status_code: [200]
     user: "{{ elastic_admin_username }}" 
@@ -48,7 +48,7 @@
 - name: "Create user <<{{ elastic_user.username }}>>"
   delegate_to: localhost
   uri:
-    url: "https://{{ kibana_api_endpoint }}{{ api_path }}/{{ elastic_user.username }}"
+    url: "https://{{ api_endpoint }}{{ api_path }}/{{ elastic_user.username }}"
     method: POST
     status_code: [200]
     user: "{{ elastic_admin_username }}" 
@@ -67,7 +67,7 @@
 - name: "Update user <<{{ elastic_user.username }}>>"
   delegate_to: localhost
   uri:
-    url: "https://{{ kibana_api_endpoint }}{{ api_path }}/{{ elastic_user.username }}"
+    url: "https://{{ api_endpoint }}{{ api_path }}/{{ elastic_user.username }}"
     method: POST
     status_code: [200]
     user: "{{ elastic_admin_username }}" 
@@ -86,7 +86,7 @@
 - name: "DELETE user << elastic_user.username >>"
   delegate_to: localhost
   uri:
-    url: "https://{{ kibana_api_endpoint }}{{ api_path }}/{{ elastic_user.username }}"
+    url: "https://{{ api_endpoint }}{{ api_path }}/{{ elastic_user.username }}"
     method: DELETE
     status_code: [204]
     user: "{{ elastic_admin_username }}" 

roles/kibana/tasks/_import_savedobjects.yml

@@ -1,5 +1,5 @@
 ---
-- name: "Importing kibana objects to <{{ kibana_api_endpoint }}>"
+- name: "Importing kibana objects to <{{ api_endpoint }}>"
   include_tasks: import_service_ojects.yml
   loop: "{{ es_index_pattern_services }}"
   loop_control:
@@ -9,7 +9,7 @@
 - name: "Setting default index pattern"
   delegate_to: localhost
   uri:
-    url: "https://{{ kibana_api_endpoint }}/s/{{ stage }}-{{ tenant_id }}/api/kibana/settings"
+    url: "https://{{ api_endpoint }}/s/{{ stage }}-{{ tenant_id }}/api/kibana/settings"
     method: POST
     status_code: [200]
     user: "{{ elastic_admin_username }}"

roles/kibana/tasks/add_technical_users.yml

@@ -1,34 +0,0 @@
----
-- name: "Do some stuff in elastic with spaces ... "
-  include_role:
-    name: kibana
-    tasks_from: _configure_spaces.yml
-  loop: "{{ technical_user.elastic_spaces }}"
-  loop_control:
-    loop_var: elastic_space
-
-- name: "Do some stuff in elastic with roles ..."
-  include_role:
-    name: kibana
-    tasks_from: _configure_roles.yml
-  loop: "{{ technical_user.elastic_roles }}"
-  loop_control:
-    loop_var: elastic_role
-
-- name: "Do some stuff in elastic with users ..."
-  include_role:
-    name: kibana
-    tasks_from: _configure_users.yml
-  loop: "{{ technical_user.elastic_users }}"
-  loop_control:
-    loop_var: elastic_user
-
-- name: "Do some stuff in elastic with index pattern ..."
-  vars:
-    es_space: "default"
-  include_role:
-    name: kibana
-    tasks_from: _configure_indexpattern.yml
-  loop: "{{ technical_user.elastic_index_patterns }}"
-  loop_control:
-    loop_var: elastic_index_pattern

roles/kibana/tasks/import_service_ojects.yml

@@ -32,7 +32,7 @@
 - name: "Importing service objects to kibana"
   delegate_to: localhost
   uri:
-    url: "https://{{ kibana_api_endpoint }}{{ api_path }}/_import?overwrite=true"
+    url: "https://{{ api_endpoint }}{{ api_path }}/_import?overwrite=true"
     method: POST
     status_code: [200]
     user: "{{ elastic_admin_username }}" 

roles/kibana/tasks/main.yaml

@@ -72,31 +72,12 @@
     - update_certs
     - update_config
 
-- name: "Restart {{ kibana_id }}"
-  community.docker.docker_compose:
-    project_src: '{{ service_base_path }}/{{ kibana_id }}'
-    restarted: yes
-    build: no
-  tags:
-    - update_certs
-
 - name: "Start {{ kibana_id }}"
   community.docker.docker_compose:
     project_src: '{{ service_base_path }}/{{ kibana_id }}'
     state: present
     pull: true
   tags:
+    - update_certs
     - update_config
     - update_deployment
-
-- name: "Create ES objects for technical users"
-  include_tasks: add_technical_users.yml
-  loop: '{{ kibana_technical_users }}'
-  loop_control:
-    loop_var: technical_user
-  args:
-    apply:
-      tags:
-        - kibana-technical-users
-  tags:
-    - kibana-technical-users

roles/kubernetes/argocd/defaults/main.yml

@@ -2,8 +2,6 @@
 k8s_argocd_helm__name: "argo-cd"
 k8s_argocd_helm__release_namespace: "argo-cd"
 
-k8s_argocd_with_keycloak: True
-
 argo_realm_name: &argoname 'argocd'
 argo_realm_display_name: *argoname
 
@@ -43,8 +41,6 @@ k8s_argocd_helm__release_values:
         hostnames:
           - "{{ shared_service_gitea_hostname }}"
   controller:
-    logLevel: info
-    logFormat: json
     metrics:
       enabled: true
       serviceMonitor:
@@ -53,8 +49,6 @@ k8s_argocd_helm__release_values:
         additionalLabels:
           release: "{{ k8s_prometheus_helm__name }}"
   repoServer:
-    logLevel: info
-    logFormat: json
     metrics:
       enabled: true
       serviceMonitor:
@@ -114,8 +108,6 @@ k8s_argocd_helm__release_values:
           - mountPath: /gnupg-home
             name: gnupg-home
   server:
-    logLevel: info
-    logFormat: json
     config:
       oidc.config: |
         name: Keycloak
@@ -156,11 +148,11 @@ k8s_argocd_helm__release_values:
           hosts:
             - "{{ k8s_argocd_helm__domain }}"
     additionalProjects:
-    - name: bootstrap
+    - name: infrastructure
       namespace: '{{ k8s_argocd_helm__release_namespace }}'
       additionalLabels: {}
       additionalAnnotations: {}
-      description: application declarations for bootstraping k8s cluster with argo-cd
+      description: apps needed for maintaining stuff
       sourceRepos:
       - '*'
       destinations:
@@ -171,54 +163,77 @@ k8s_argocd_helm__release_values:
         kind: '*'
       orphanedResources:
         warn: false
-    - name: kube-system
+    additionalApplications:
+    -
+      name: awx-operator
       namespace: '{{ k8s_argocd_helm__release_namespace }}'
-      additionalLabels: {}
+      destination:
-      additionalAnnotations: {}
+        namespace: awx
-      description: applications for kube-system namespace
-      sourceRepos:
-      - '*'
-      destinations:
-      - namespace: kube-system
         server: https://kubernetes.default.svc
-      clusterResourceWhitelist:
+      project: infrastructure
-      - group: '*'
+      source:
-        kind: '*'
+        path: config/default
-      orphanedResources:
+        repoURL: https://{{ shared_service_gitea_hostname }}/argocd/awx-operator.git
-        warn: false
+        targetRevision: '{{ awx_operator_revision | default(stage) }}'
-    - name: infrastructure
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true
+        syncOptions:
+        - CreateNamespace=true
+    -
+      name: awx-smardigo
       namespace: '{{ k8s_argocd_helm__release_namespace }}'
-      additionalLabels: {}
+      destination:
-      additionalAnnotations: {}
+        namespace: awx
-      description: infrastructure applications
-      sourceRepos:
-      - '*'
-      destinations:
-      - namespace: '*'
         server: https://kubernetes.default.svc
-      clusterResourceWhitelist:
+      project: infrastructure
-      - group: '*'
+      source:
-        kind: '*'
+        path: apps/{{ stage }}/awx
-      orphanedResources:
+        repoURL: https://{{ shared_service_gitea_hostname }}/argocd/argocd.git
-        warn: false
+        targetRevision: '{{ awx_smardigo_revision | default(stage) }}'
-    additionalApplications:
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true
+        syncOptions:
+        - CreateNamespace=true
     -
-      name: bootstrap
+      name: jaeger-operator
       namespace: '{{ k8s_argocd_helm__release_namespace }}'
       destination:
-        namespace: bootstrap
+        namespace: observability
         server: https://kubernetes.default.svc
-      project: bootstrap
+      project: infrastructure
       source:
         path: config/default
+        repoURL: https://{{ shared_service_gitea_hostname }}/argocd/jaeger-operator.git
+        targetRevision: '{{ jaeger_operator_revision | default(stage) }}'
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true
+        syncOptions:
+        - CreateNamespace=true
+    -
+      name: jaeger
+      namespace: '{{ k8s_argocd_helm__release_namespace }}'
+      destination:
+        namespace: jaeger
+        server: https://kubernetes.default.svc
+      project: infrastructure
+      source:
+        path: apps/{{ stage }}/jaeger
         repoURL: https://{{ shared_service_gitea_hostname }}/argocd/argocd.git
-        targetRevision: '{{ awx_smardigo_revision | default(stage) }}'
+        targetRevision: '{{ jaeger_smardigo_revision | default(stage) }}'
       syncPolicy:
         automated:
           prune: true
           selfHeal: true
         syncOptions:
         - CreateNamespace=true
+  dex:
+    enabled: false
   redis:
     metrics:
       enabled: true
@@ -227,10 +242,8 @@ k8s_argocd_helm__release_values:
         namespace: "{{ k8s_argocd_helm__release_namespace }}"
         additionalLabels:
           release: "{{ k8s_prometheus_helm__name }}"
-  dex:
-    enabled: false
-  applicationSet:
-    enabled: false
   configs:
     secret:
       argocdServerAdminPassword: '{{ argocd_server_admin_password | password_hash("bcrypt") }}'
+
+k8s_argocd__crd_applicationset_version: v0.4.0