install-ci.yml

---
- name: Common task for all nodes
  hosts: all
  become: yes
  tags: ['common']
  roles:
    - role: admin-user
      when: bonnyci_lockdown_ssh | default(False)

    - role: common
      common_hostname: "{{ bonnyci_hostname | default('') }}"

    - role: sshd
      tags:
        - sshd

    - role: dd-agent
      tags:
        - monitoring

    - role: letsencrypt-apache
      tags:
        - letsencrypt
      when:
        - letsencrypt_csr_cn | default(False)
        - bonnyci_use_apache

    - role: letsencrypt-nginx
      tags:
        - letsencrypt
      when:
        - letsencrypt_csr_cn | default(False)
        - bonnyci_use_nginx

    - role: backup-client

- name: Install ELK
  hosts: monitoring
  become: yes
  tags: ['elk']
  roles:
    - role: elasticsearch
      tags: ['elasticsearch']
      elasticsearch_index_settings:
        number_of_replicas: 0

    - role: dd-elasticsearch
      tags:
        - monitoring

    - role: logstash
      tags: ['logstash']
    - role: kibana
      tags: ['kibana']

    - role: apache
      apache_mods_enabled: "{{ bonnyci_kibana_apache_mods_enabled }}"
      apache_vhosts: "{{ bonnyci_kibana_apache_vhosts }}"
      when: bonnyci_use_apache

    - role: dd-apache
      tags:
        - monitoring
      when: bonnyci_use_apache

    - role: nginx
      nginx_sites: "{{ bonnyci_kibana_nginx_sites }}"
      when: bonnyci_use_nginx

    - role: dd-nginx
      tags:
        - monitoring
      when: bonnyci_use_nginx


- name: Install mysql
  hosts: mysql
  become: yes
  tags: ['mysql']
  roles:
    - role: mysql
      mysql_root_password: "{{ secrets.db_password }}"

    - role: dd-mysql
      dd_mysql_password: "{{ secrets.datadog.mysql_password }}"
      tags:
        - monitoring

    - role: databases


- name: Install zookeeper
  hosts: zookeeper
  become: yes
  tags: ['zookeeper']
  roles:
    - role: zookeeper
    - role: dd-zookeeper
      tags:
        - monitoring


- name: Install zuul server (v2)
  hosts: zuul-server
  become: yes
  tags:
    - zuul
    - zuul-server
  roles:
    - role: zuul-server

    - role: dd-gearman
      tags:
        - monitoring

    - role: dd-zuul-server
      tags:
        - monitoring

    - role: apache
      apache_mods_enabled: "{{ bonnyci_zuul_webapp_apache_mods_enabled }}"
      apache_vhosts: "{{ bonnyci_zuul_webapp_apache_vhosts }}"
      when: bonnyci_use_apache

    - role: dd-apache
      tags:
        - monitoring
      when: bonnyci_use_apache

    - role: nginx
      nginx_sites: "{{ bonnyci_zuul_webapp_nginx_sites }}"
      when: bonnyci_use_nginx

    - role: dd-nginx
      tags:
        - monitoring
      when: bonnyci_use_nginx

    - role: logrotate
      logrotate_configs:
        - name: zuul-server
          path: /var/log/zuul/zuul-server*.log
          options:
            - compress
            - missingok
            - rotate 30
            - daily
            - notifempty

        - name: zuul-gearman
          path: /var/log/zuul/gearman*.log
          options:
            - compress
            - missingok
            - rotate 30
            - daily
            - notifempty

    - role: filebeat
      filebeat_prospectors:
        - name: zuul-server
          prospectors:
            - input_type: log
              document_type: python-logging
              tags:
                - zuul
                - zuul-server
              paths:
                - /var/log/zuul/zuul-server-debug.log
              multiline:
                match: after
                negate: true
                pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'


- name: Install zuul launcher (v2)
  hosts: zuul-launcher
  become: yes
  tags:
    - zuul
    - zuul-launcher
  roles:
    - role: zuul-launcher

    - role: logrotate
      logrotate_configs:
        - name: zuul-launcher
          path: /var/log/zuul/zuul-launcher*.log
          options:
            - compress
            - missingok
            - rotate 30
            - daily
            - notifempty


- name: Install zuul scheduler (v3)
  hosts: zuul-scheduler
  become: yes
  tags:
    - zuul
    - zuul-scheduler
  roles:
    - role: zuul-scheduler
      zuul_tenant_src_file: "{{ bonnyci_zuul_tenant_template_file | default(omit) }}"
      zuul_tenant_dest_file: "{{ bonnyci_zuul_tenant_file | default(omit) }}"

    - role: integration-handler
      integration_handler_tenant_file: "{{ bonnyci_zuul_tenant_file | default(omit) }}"
      integration_handler_template_file: "{{ bonnyci_zuul_tenant_template_file | default(omit) }}"
      when:
        - bonnyci_use_app

    - role: apache
      apache_mods_enabled: "{{ bonnyci_zuul_webapp_apache_mods_enabled }}"
      apache_vhosts: "{{ bonnyci_zuul_webapp_apache_vhosts }}"
      when: bonnyci_use_apache

    - role: dd-apache
      tags:
        - monitoring
      when: bonnyci_use_apache

    - role: nginx
      nginx_sites: "{{ bonnyci_zuul_webapp_nginx_sites }}"
      when: bonnyci_use_nginx

    - role: dd-nginx
      tags:
        - monitoring
      when: bonnyci_use_nginx

    - role: logrotate
      logrotate_configs:
        - name: zuul-scheduler
          path: /var/log/zuul/zuul-scheduler*.log
          options:
            - compress
            - missingok
            - rotate 30
            - daily
            - notifempty

        - name: zuul-gearman
          path: /var/log/zuul/gearman*.log
          options:
            - compress
            - missingok
            - rotate 30
            - daily
            - notifempty

    - role: filebeat
      filebeat_prospectors:
        - name: zuul-scheduler
          prospectors:
            - input_type: log
              document_type: python-logging
              tags:
                - zuul
                - zuul-scheduler
              paths:
                - /var/log/zuul/zuul-scheduler-debug.log
              multiline:
                match: after
                negate: true
                pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'


- name: Install zuul executors (v3)
  hosts: zuul-executor
  become: yes
  tags:
    - zuul
    - zuul-executor
  roles:
    - role: zuul-executor

    - role: logrotate
      logrotate_configs:
        - name: zuul-executor
          path: /var/log/zuul/zuul-executor*.log
          options:
            - compress
            - missingok
            - rotate 30
            - daily
            - notifempty

    - role: filebeat
      filebeat_prospectors:
        - name: zuul-executor
          prospectors:
            - input_type: log
              document_type: python-logging
              tags:
                - zuul
                - zuul-executor
              paths:
                - /var/log/zuul/zuul-executor-debug.log
              multiline:
                match: after
                negate: true
                pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'


- name: Install zuul web (v3)
  hosts: zuul-web
  become: yes
  tags:
    - zuul
    - zuul-web
  roles:
    - role: zuul-web

    - role: logrotate
      logrotate_configs:
        - name: zuul-web
          path: /var/log/zuul/zuul-web*.log
          options:
            - compress
            - missingok
            - rotate 30
            - daily
            - notifempty

    - role: filebeat
      filebeat_prospectors:
        - name: zuul-web
          prospectors:
            - input_type: log
              document_type: python-logging
              tags:
                - zuul
                - zuul-web
              paths:
                - /var/log/zuul/zuul-web-debug.log
              multiline:
                match: after
                negate: true
                pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'


- name: Install zuul mergers
  hosts: zuul-merger
  become: yes
  tags:
    - zuul
    - zuul-merger
  roles:
    - role: zuul-merger
      zuul_merger_git_dir: "{{ bonnyci_zuul_merger_git_dir }}"

    - role: apache
      apache_mods_enabled: "{{ bonnyci_zuul_merger_apache_mods_enabled }}"
      apache_vhosts: "{{ bonnyci_zuul_merger_apache_vhosts }}"
      when: bonnyci_use_apache

    - role: dd-apache
      tags:
        - monitoring
      when: bonnyci_use_apache

    - role: logrotate
      logrotate_configs:
        - name: zuul-merger
          path: /var/log/zuul/zuul-merger*.log
          options:
            - compress
            - missingok
            - rotate 30
            - daily
            - notifempty

    - role: filebeat
      filebeat_prospectors:
        - name: zuul-merger
          prospectors:
            - input_type: log
              document_type: python-logging
              tags:
                - zuul
                - zuul-merger
              paths:
                - /var/log/zuul/zuul-merger-debug.log
              multiline:
                match: after
                negate: true
                pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'


- name: Install nodepool
  hosts: nodepool
  become: yes
  tags: ['nodepool']
  roles:
    - role: nodepool
      nodepool_mysql_user: "{{ secrets.nodepool.db_user }}"
      nodepool_mysql_password: "{{ secrets.nodepool.db_password }}"

    - role: dd-nodepool
      tags:
        - monitoring

    - role: logrotate
      logrotate_configs:
        - name: nodepool
          path: /var/log/nodepool/*log
          options:
            - compress
            - missingok
            - rotate 10
            - size 50M
            - daily
            - notifempty

    - role: filebeat
      filebeat_prospectors:
        - name: nodepool
          prospectors:
            - input_type: log
              document_type: python-logging
              tags:
                - nodepool
              paths:
                - /var/log/nodepool/*debug.log
              multiline:
                match: after
                negate: true
                pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'

- name: Install logging
  hosts: log
  become: yes
  tags: ['logs']
  roles:
    - role: scp-log-receiver
      scp_log_receiver_user: "{{ bonnyci_logs_scp_user }}"
      scp_log_receiver_path:  "{{ bonnyci_logs_root_dir }}/logs"
      scp_log_receiver_authorized_key: "{{ bonnyci_logs_authorized_key }}"

    - role: os-loganalyze
      os_loganalyze_root_dir: "{{ bonnyci_logs_root_dir }}/logs"
      os_loganalyze_file_conditions: "{{ bonnyci_logs_loganalyze_file_conditions }}"

    - role: uwsgi
      uwsgi_apt_plugins:
        - uwsgi-plugin-python
      uwsgi_vassals:
        - name: os-loganalyze
          state: present
          config:
            uid: www-data
            gid: www-data
            wsgi-file: /etc/os_loganalyze/wsgi/os-loganalyze.py
            virtualenv: "{{ os_loganalyze_venv_path }}"
            plugin: python
            socket: localhost:3310
            lazy-apps: true

    - role: apache
      apache_apt_install: "{{ bonnyci_logs_apache_apt_install }}"
      apache_mods_enabled: "{{ bonnyci_logs_apache_mods_install }}"
      apache_vhosts: "{{ bonnyci_logs_apache_vhosts }}"
      when: bonnyci_use_apache

    - role: dd-apache
      tags:
        - monitoring
      when: bonnyci_use_apache

    - role: filebeat
      filebeat_prospectors:
        - name: apache
          prospectors:
            - input_type: log
              document_type: apache
              paths:
                - /var/log/apache/*.log
          when: bonnyci_use_apache

- name: Install backups
  hosts: backups
  become: yes
  tags: ['backups']
  roles:
    - role: backup-server

# This task needs to be done last because fail2ban will fail to start
# if the configured log files to scan do not exist yet.
- name: Enable fail2ban on all hosts
  hosts: all
  become: yes
  tags: ['common']
  roles:
    - role: fail2ban