forked from usegalaxy-eu/infrastructure-playbook
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathsn07.yml
308 lines (283 loc) · 17.6 KB
/
sn07.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
---
- name: UseGalaxy.eu
hosts: sn07
become: true
become_user: root
vars:
# The full internal name.
hostname: sn07.galaxyproject.eu
# The nginx user needed into the galaxyproject.nginx role
nginx_conf_user: galaxy
# This server has multiple CNAMEs that are important. Additionally it
# provides proxying for many of the other services run by Galaxy Europe.
# These server_names are passed to certbot. They generally should not need
# to be updated unless you add a new domain. They *only* work with the
# route53 provider, so if we want to do usegalaxy.xy, it may require
# refactoring / multiple certbot runs.
#
#
# The best way to expand them is to run the playbook, it will leave a message with the command it would have run (look for `skipped, since /etc/letsencrypt/renewal/usegalaxy.eu.conf exists`)
#
# Then take this command to the command line (root@sn04) and run it with `--expand`. E.g. (DO NOT COPY PASTE (in case the config changes))
#
# $ /opt/certbot/bin/certbot certonly --non-interactive --dns-route53 \
# -m [email protected] --agree-tos -d 'usegalaxy.eu,*.usegalaxy.eu,galaxyproject.eu,*.galaxyproject.eu,*.interactivetoolentrypoint.interactivetool.usegalaxy.eu,*.interactivetoolentrypoint.interactivetool.live.usegalaxy.eu,*.interactivetoolentrypoint.interactivetool.test.usegalaxy.eu' --expand
# Saving debug log to /var/log/letsencrypt/letsencrypt.log
# Credentials found in config file: ~/.aws/config
# ....
# IMPORTANT NOTES:
# - Congratulations! Your certificate and chain have been saved at:
#
# And you're done expanding the certs.
#
# The nginx user needed into the galaxyproject.nginx role
server_names:
- "usegalaxy.eu"
- "*.usegalaxy.eu"
- "galaxyproject.eu"
- "*.galaxyproject.eu"
- "*.interactivetoolentrypoint.interactivetool.usegalaxy.eu"
- "*.interactivetoolentrypoint.interactivetool.live.usegalaxy.eu"
- "*.interactivetoolentrypoint.interactivetool.test.usegalaxy.eu"
vars_files:
- group_vars/tiaas.yml # All of the training infrastructure
- group_vars/custom-sites.yml # Subdomains are listed here
- group_vars/gxconfig.yml # The base galaxy configuration
- group_vars/toolbox.yml # User controlled toolbox
- secret_group_vars/sentry.yml # Sentry SDK init url
- secret_group_vars/aws.yml # AWS creds
- secret_group_vars/pulsar.yml # Pulsar + MQ Connections
- secret_group_vars/oidc.yml # OIDC credentials (ELIXIR, keycloak)
- secret_group_vars/object_store.yml # Object Store credentils (S3 etc ...)
- secret_group_vars/db-main.yml # DB URL + some postgres stuff
- secret_group_vars/file_sources.yml # file_sources_conf.yml creds
- secret_group_vars/all.yml # All of the other assorted secrets...
- secret_group_vars/keys.yml # SSH keys
- templates/galaxy/config/job_conf.yml
- mounts/mountpoints.yml
- mounts/dest/all.yml
collections:
- devsec.hardening
handlers:
- name: Restart Galaxy
shell: |
echo 'Manual web handler restart required' && cd /opt/galaxy/ && source /opt/galaxy/.bashrc && systemctl restart galaxy-handler@* && systemctl restart galaxy-workflow-scheduler@*
pre_tasks:
- name: Install Dependencies
package:
name:
[
"git",
"postgresql",
"python3-psycopg2",
"python3-virtualenv",
"bc",
"python3",
"python3-devel",
]
become: true
post_tasks:
- name: Append some users to the systemd-journal group
user:
name: "{{ item }}"
groups: systemd-journal
append: true
loop:
- "{{ galaxy_user.name }}"
- "telegraf"
- "stats" # special account to retrieve statistics from the server in read-only mode
- name: Set authorized SSH key (galaxy user)
ansible.posix.authorized_key:
user: "{{ galaxy_user.name }}"
state: present
key: "{{ item }}"
loop:
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFH54+qZEBeU5uwIeWWOViLcC509qxoRW6oN0VHRQr4r nate@treehouse"
- "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOBINXdjILF6x3WuppXyq6J2a2oSLR6waZ6txgjYJogHdIKPbI0TdReCv4EVxxYRY/NqGpHbjkqfRTsf2VgoU3U= mk@galaxy-mira"
- "ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBACB5Q5blymkTIRSzVzXITOGvBuI7W0L9Ykwfz8LJGPraaGVPiezzFGvjhqwX+EyCqQPt7JprR5mimJRw/JN3nBXWAHjekvmB5FuILkk6m5fOiQJ5QhRMyQ5GfxODAvGbHpTuWHbYJLWD5fhcboKPxlXOWy4xY9kDZVuQvEKisNKYBsFLA== sanjay"
- "ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBABRaLHL8mgW86rbtdUh6TY4rs7/la8hAGeSQ3jBF7LMwYZnbS32YDMYvDq3KgNu5WqSMFvkxNm3vfTAbd8CXBfakwDBFBaD9kO0b2t4/p4VoFUsd3B2OvmTR7Bsg7OxTGJJ7aUP/SzTg+Z4NzsmHwQ9h31gfI7n/buZD4S1edQke19Y6w== [email protected]"
- https://github.com/wm75.keys
- https://github.com/gmauro.keys
- "{{ galaxy_user_public_key }}"
- name: Set authorized SSH key (stats user)
ansible.posix.authorized_key:
user: "stats"
state: present
key: "{{ item }}"
loop:
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDC6kanRFWmhjkV8pkwOYtHoCNDIP/nj2umigbSylMFmiXm2rwnqi1qhDeJqd53PTrT4RWynT7Gqg7/HSITPAZA4wdGNcDLHD7QvexBDhIhUJCERmMZa6EWPvOPgDACbJDjrwLxd8oF65UhQU+meVrkBmpod6YDSuVIfmZXHUheK7NuZfvfNx3ruQNU5MRbI3p6vuY++B4GYRXrxM68+GWYEOEa6zz142Nl1PNnvDMkiobro0k6P5bXv4LDYMW3YyDXu69okJgPqEKjE/IsI4/2JKfzduEZMQyPZDQswyuNQwMAfKQjvDQ0gvQiVE0eM2gdR7qi/jOqFXrzkOwYWQd00Cy9EtSWqhDlpu9KrIfs8T2HTn9p/XU+Bwg4anyMh//gb+EOctpvptqoBhjNxoRTX/bwNLFq/ARFAtFDn+qX8w9HWeB5/vNvdOkH7fSMTTFmFkDZ8U/Hrg5vhcwy2Hid2K7j9peixB/41d7/O08qL99qH9362L8ZmhyT9aNeOKQ0MUEEhAasYkKO7AQcChDpkgW635mkvI5EOZGsqCRPiX8P8iTH5neH6ZI4H21JoON5E0raMJlwznNq3D4as12kZBtw198DHFAMQXlfMR24NTcv0nFnS6JmxlwCKu+Uzyt3Xlyj/wEzKYnr71vfShb3/vUgYbzIEdDQmGV8DXEJBw== anup"
- "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApcUIRRUHl0wVVXz5GX1QnHSq9+nThIKKH3fYM21LfW1n6gGvC7UiCCaDZQUbejJTq3EITbH3J6/Tji2jGAIJ6Xzn0Jf7sQ1yON/dO/75To32Jdo8YWS7XQeA7lU9heSc7FM5yKIBJN7PrpnYAveCsOE/1kkfUSsBZsqj9yyoFe/tquoVm5Y3nFZfKJv7/gszSVkzNxhHvn+0ccClRLpnFUHjqXgXHIQCm7P/9Lf7unSoYRd9Iefwgp52Lcm6AIncQvz5tdAFD2WciP4J15EFPMTKPdc6tfT5Tis/+/oNfYlsnaIGrbV5Hc2909KiYnvuvqKcrSFloXWzAdXJOxhszw== [email protected]"
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8/9GdD96Xfc0MavIJQEuNSIrOlaBSYkH4s5RyGhNnc8Al7x3hC7KXt/mcqyNoI1JTvrXp23aDpTr67e3Dnrp6Me7z8nyY9oIy5WHOgwG2ra1Ga8oi89MVgXPhtxvcYnk8hVfuPDmhWkgwS5ILH/7V/1hEKHcS0H7Q0pJp8EGCBDFWrxNfUWqJJuVcXb11CMnaSJX/VhD+S4g4rG01lMr696+k8eKs9y2sq9JpuUD1TNN16RYu1uVlVz8nhIPbEBsnFeKV+EYKLcSRQnjDTNjWqZHHM9NMWfK3wGvr5pfla158ZdsYQTmQtcchTsEoB+7eAQaER3XsEtuo8yQj4zbL videmp@work"
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDAAvfZPfHiI4YHXwqz5LMOnq5XY2UlM15CQXM/lSxmzYZtUxEt1TcoVcCAy1y7WTjcQtcNiwd6Zf59L3inG4EjMAzD1VNoaBZ0IPXloUEMLpgrNZUnB6uZHe6vbe7NWYVrlk/PsCW/Bu2hvPcLwMxlXl+/SQ9Y5wnj54h+q0Iu/vkZyRyEw+gB2ILm2Je5ebanXjCjHEr+FzLsReAI5yxCenlrtewA86DfJo26+CekYwaVwfEtNv+vM7vpbjeIazIjcU4tEfWdt3BAtyFY13GLWnnfZmVbl5Xf+YEdJsuEYRRqC6Xa3JRNpZ0C3NpehAvUvvJAhj41kiKoQmtmhW2KGltPShMFP8umBsbo8beUWp3K+rFW7OXQKypIhXhqJmfv5oXnDGOin/rZKiB+fLPvYt7X0O36g94ueibzNB7MV/GNGgChKwnz31M2ifMzkOD3AdVQD2PO8xUHVgr3J+/QuAK8q2AFQVvGtsHwsoS6+WQyHgzhqIlYtxnQhX+D7Yk ubuntu@pavan-dedicated-vm"
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCZnImSDzCCijMP+P0CRSuXJuJ3XPO00kKQIOgQO6iLljxPQBFLB/MNHWmt7lRSocnJqVvOwJzueU5vbmDMR+ixPmZ58jDMAoPWrhja8NjivflcN2/NQUI/bS1akfr/y4wJgFYNYP0vPejmCqL1CGACMe1O3yPlb5JA++1f78R4eHEuseaY/VnQpHMycbf8V21GOq9t2VJRQJNsMXt2mPkZEhg9z04JYPpzgATB6inMU8Ud+wlHjwmlO+KJzZWkfIYOS/Gr1wso8AWnnd5fr7osilGFHhxoqRSL8kcF0sMh05l2QRnq3pRSXFQcJd42kTOSqd4R8FFq3iiko+K7FCUITKdnxvc7ZADWDAe60TT9G8FrAuQsshYX6MMzsfBE7gtxltsBnyuCE/qhyMf29U2dGFZGvx9ozn3qbI2IhteD3ebym1MIO2dT5e2Ni0UHIh+7AQrlHm3WDFw4xszMQvTRQ8uCcvIO2siicf4yMx9n8d6DeLy2QI+c0XifKeYtLHE= laptop@freiburg"
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCoWkk57x20iE5Wf0cDX3QvkJf/XxO4wqIeZIPIosK7rFcvy/SvDF/mwQk4iQrQ7qDam35NFHrFden+5zoE5HJoRVeHYhqNaItmiMNBY9CqgITCXsD2j9/6NdzIcR66uzLHDVvLlXr2hJmrNoeGTzg94+EVtQ0/BARwffAq//2WzgG4oClgYE4RqahQRXbmBygf4g4BAbEb5JnsLJ3qqnhsAgcUYyXg7/dz36QVsvoTwChMMCXDJpPyNb1+PqOKAgl7+yZQiPD0yI5zZG+iF6dsvc6Dhscpmt0nOjr4h+o97wQk3sbvq9ysXPlARqgL950H+0LtSiWnC+KEBK4KOgc83g6NynCE7zGZ9LJiKoT0mmt8BKaJKFRDVob3nlYR3/DDLEq2AkCoxYF0JFUNVta/wEF/likB61Yhsv01gNVMNcCfK9nzZVyTGNwdsFPdi4WL+KfkMgEcA0xrCtLXhkxnU8f3H8a7XcwJWr3fuSK1ndFwNxmfKlA+sRRKYBHouU8rpnC/HCxYsxF/palYxHv8KNcfGIRUBIgfgugsigzFcB5yz4lY73NiEyVEY9ZnBbbXllyX3ICoI/IboMQVUDyccRZiDAeHJ/v29pIsIihkmWIT2I1VqppXuVYgTydPM42CDBaKE7ko3p0CuZDyB2sZaS4XYUQlkRpX9ZARtcC/AQ== david"
- "ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAA6oD5Ps9h6pKokzaAcCI6R08CKm2aSVv86h/O2HTEQkzeJq/Uvu4gbrONAM0FK5R693mHggIwaROKf1Z1+q4YNtACtYjV1c+6a9lcrGMM31y5RzO6mAW+rHNEXgZ1n3wqDcBQhSXhSekSen0R2QKwvmB7xeP4XX9qE10azZuafIFU9hQ== sanjay"
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC9itwmMTgcRCrwjO3RCke/NWJsRb3N5lUTF5fubw/V0PlSbFDuv7IMKp5hhFfhiOuVRMoXQBHnnOWWu1xd9jDqZKXmNGHg06JtnddQ/OVprZ6Dpu2g9pZ6uc4r1As94mvpICLVK9lNHPNA60sIwTsTRVFSb1VbXALI4iuLOxPLzIxhrZ1LouK19VWetJIQ/Uq8UalfTDr1KOyQQ/ZgjBeWdD5InSOl3sbPJZhGQLqSHIi0MVxH527CMnh1PQIxiD/vqX8SK7HaKvUZIHHzz5TFrUgrw7BkfRd04UIgr1OhnMf1E413yZdeQzJQV7C1CL9MbAThXX6Ruvs0Rg3ylazpYfwDifMWvqLeRoTCDUbGx94ySO/wzer/kcjpJ27iydNo+en/hImMYz7kktf6A3BzOYxFmOQvnQ9cChP+iuk7fTiQZS7Qtkz+axNIvwCkm7Hmgt7vYizHc+OAtKmzZFTHecozjxCXs9RwynnWpToheP3ZPYgOpKc7pkUngRSjXyc= bebatut@bebatut-ThinkPad-T14-Gen-1"
- "ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBADKblzzPBc3+dEfFvhJQHsHGkFFN6ORjfXo71P1OutwcKEMCIcNkZKJHhYkLLrfTDN5JJ5tK2L5AaSxdwETofwm4AG1xv3LuoYsXC6e3sjKi09BVmzef520pIMW+rvL+hESwSazZaUAC0wDcH4aNDTonZYcAY87rpMX7pNMkNPJvWilUA== mira"
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFH54+qZEBeU5uwIeWWOViLcC509qxoRW6oN0VHRQr4r nate"
- "ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBABRaLHL8mgW86rbtdUh6TY4rs7/la8hAGeSQ3jBF7LMwYZnbS32YDMYvDq3KgNu5WqSMFvkxNm3vfTAbd8CXBfakwDBFBaD9kO0b2t4/p4VoFUsd3B2OvmTR7Bsg7OxTGJJ7aUP/SzTg+Z4NzsmHwQ9h31gfI7n/buZD4S1edQke19Y6w== [email protected]"
# Add SELinux policy for nginx to interact with the gunicorn socket
- name: Check if nginx-gunicorn selinux policy is installed
command: semodule --list=full | grep -q nginx_gunicorn_selinux
register: nginx_gunicorn_selinux_policy
failed_when: nginx_gunicorn_selinux_policy.rc > 1
- name: Add SELinux policy for nginx to interact with the gunicorn socket
when: nginx_gunicorn_selinux_policy.rc == 1
block:
- name: Copy nginx-gunicorn selinux type enforcement file
copy:
src: "files/galaxy/config/nginx_gunicorn_selinux.te"
dest: "/tmp/nginx_gunicorn_selinux.te"
- name: Compile nginx-gunicorn selinux module
command: "checkmodule -M -m -o /tmp/nginx_gunicorn_selinux.mod /tmp/nginx_gunicorn_selinux.te"
- name: Compile nginx-gunicorn selinux policy package
command: "semodule_package -o /tmp/nginx_gunicorn_selinux.pp -m /tmp/nginx_gunicorn_selinux.mod"
- name: Install nginx-gunicorn selinux policy package
command: "semodule -i /tmp/nginx_gunicorn_selinux.pp"
- name: Clean up nginx-gunicorn selinux policy files
file:
path: "{{ item }}"
state: absent
with_items:
- "/tmp/nginx_gunicorn_selinux.te"
- "/tmp/nginx_gunicorn_selinux.mod"
- "/tmp/nginx_gunicorn_selinux.pp"
# Add http and https to the current firewall zone
- name: Add http and https services to the current firewall zone
firewalld:
service: "{{ item }}"
immediate: true
permanent: true
state: enabled
with_items:
- http
- https
- name: Change compliance.log file ownership to the galaxy user
file:
path: "{{ galaxy_server_dir }}/compliance.log"
owner: galaxy
group: root
mode: 0644
roles:
## Starting configuration of the operating system
- role: usegalaxy_eu.handy.os_setup
vars:
enable_hostname: true
enable_powertools: true # geerlingguy.repo-epel role doesn't enable PowerTools repository
enable_remap_user: true
enable_exclude_packages: true
enable_pam_limits: true # Prevent out of control processes
enable_install_software: true # Some extra admin tools (*top, vim, etc)
- geerlingguy.repo-epel # Install EPEL repository
## Istall miniconda, create a _galaxy_ environment and install Packages
## Galaxy will use the virtualenv from this conda environment (see
## galaxy_virtualenv_command) in the group_vars/sn07.yml
- role: galaxyproject.miniconda
vars:
miniconda_prefix: "{{ conda_prefix }}"
galaxy_conda_create_env: true
galaxy_conda_env_packages:
- python=3.11
- pip
- usegalaxy-eu.autoupdates # keep all of our packages up to date
- influxdata.chrony # Keep our time in sync.
## Filesystems
- usegalaxy-eu.autofs # Setup the mount points which will be needed later
- galaxyproject.cvmfs # Galaxy datasets
## Monitoring
# this should be unique, because it sends data to about the cluster to influxDB
#- hxr.monitor-cluster
- hxr.monitor-email
- hxr.monitor-galaxy-journalctl
# - usegalaxy-eu.monitor-disk-access-time merged with usegalaxy-eu.monitoring
# uses the nfsstat command only
- usegalaxy-eu.monitoring
# Setup Galaxy user
- role: galaxyproject.galaxy
vars:
galaxy_create_user: true
galaxy_manage_clone: false
galaxy_manage_download: false
galaxy_manage_existing: true
galaxy_manage_paths: true
galaxy_manage_static_setup: false
galaxy_manage_mutable_setup: false
galaxy_manage_database: false
galaxy_fetch_dependencies: false
galaxy_build_client: false
# The bashrc needs to be created for several later features.
- usegalaxy-eu.bashrc
# HTCondor Cluster setup
# - usegalaxy_eu.htcondor
# Misc.
- role: hxr.galaxy-nonreproducible-tools
become: true
become_user: galaxy
- usegalaxy-eu.dynmotd # nicer MOTD/welcome message
# - usegalaxy-eu.rsync-to-nfs # sync codebase to NFS
- role: usegalaxy-eu.webhooks # Clone webhook repository
become: true
become_user: galaxy
- role: usegalaxy-eu.tours # Clone tour repository
become: true
become_user: galaxy
## SSL / Security
# https://en.wikipedia.org/wiki/Trust_on_first_use
- ssh-host-sign # Sign the server host key to prevent TOFU for SSH
- hxr.aws-cli # Setup the AWS client that will be needed for route53 authentication of certbot. MUST come before nginx role
## GALAXY
- hxr.postgres-connection
- galaxyproject.gxadmin
- usegalaxy_eu.ansible_nginx_upload_module
- usegalaxy-eu.nginx
# TODO move under monitoring + telegraf.
# Role that creates a cron to gather galaxy stats, neets to run only on one node
#- usegalaxy-eu.galaxy-slurp
- usegalaxy-eu.gapars-galaxy
# The REAL galaxy role
- role: galaxyproject.galaxy
vars:
galaxy_create_user: true
galaxy_manage_clone: true
galaxy_manage_download: false
galaxy_manage_existing: false
galaxy_manage_static_setup: true
galaxy_manage_mutable_setup: true
galaxy_manage_database: true
galaxy_fetch_dependencies: true
galaxy_build_client: true
- role: galaxyproject.tiaas2
vars:
tiaas_virtualenv_command: "{{ galaxy_virtualenv_command }}"
## Extras!
- usegalaxy-eu.fix-galaxy-server-dir # Fix details into the galaxy server dirs
- hxr.install-to-venv # Some extra packages our site needs.
- usegalaxy_eu.galaxy_systemd # Manage the Galaxy processes with SystemD
- usegalaxy-eu.update-hosts # Update hosts list
- usegalaxy_eu.gie_proxy # Setup the NodeJS proxy for GxIT
- usegalaxy-eu.subdomain-themes # Custom subdomain themes
# This is mixed: schedules cron to submit condor jobs that clean up dirs
# also cleans up docker and 'gxadmin cleanup 60'
#- usegalaxy_eu.fs_maintenance # Filesystems maintenance
- usegalaxy-eu.error-pages # Copy the NGINX error pages
# Needs to run only on one machine, and only if condor is actually available
#- usegalaxy-eu.htcondor_release # Condor release held jobs increasing memory
# Various ugly fixes
- usegalaxy-eu.fix-stuck-handlers # Restart handlers to prevent several classes of issues
# first one sets the logrotate.d config for galaxy, second vacuums galaxy-xxx@* at midnight
- usegalaxy-eu.logrotate # Rotate galaxy logs on headnodes
- usegalaxy-eu.log-cleaner # do not retain journalctl logs, they are unnecessary/risky under GDPR
#- usegalaxy-eu.fix-ancient-ftp-data # Remove FTP data older than 3 months, create FTP user directories
# Some of our 'cleanups' also generate telegraf format so this goes at end.
# 25.11.2022: Moved here becuase the galaxy-procstat role fails
# as it is not able to find the /etc/telegraf/telegraf.d/ directory
- dj-wasabi.telegraf
# This one creates telegraf plugins for the galaxy-xxxx@* services (now with gunicorn!)
- usegalaxy-eu.galaxy-procstat # Some custom telegraf monitoring that's templated
# This can be moved to maintenance machine (gxadmin mutate ...)
#- usegalaxy-eu.fix-user-quotas # Automatically attribute ELIXIR quota to ELIXIR AAI user on a regular basis
# - dev-sec.os-hardening
- ssh_hardening #dev-sec.hardening collection
## Setup docker commented on 11/30/2022, remove if everything works
#- geerlingguy.docker
- usegalaxy_eu.tpv_auto_lint