From c014a0b76ef096c0f51977f72f60d94fc9fe7549 Mon Sep 17 00:00:00 2001 From: ytshih Date: Fri, 20 Dec 2024 22:34:05 +0800 Subject: [PATCH] Fix: aws --- .gitignore | 1 + ansible.cfg | 7 +++- hosts | 6 ++- playbooks/install.yml | 1 + playbooks/test.yml | 14 +++++++ roles/cms_preparation/tasks/main.yml | 13 +++++-- roles/configure_haproxy/tasks/main.yml | 2 +- .../templates/haproxy.cfg.jinja | 21 +++++++--- roles/install_packages/tasks/archlinux.yml | 36 +++++++++++++++++ roles/install_packages/tasks/debian.yml | 38 ++++++++++++++++++ roles/install_packages/tasks/main.yml | 39 +++---------------- roles/setup_cgroupsv1/handlers/main.yml | 5 +++ roles/setup_cgroupsv1/tasks/grub.yml | 12 ++++++ roles/setup_cgroupsv1/tasks/main.yml | 31 +++++++++------ roles/setup_cgroupsv1/tasks/systemd-boot.yml | 13 +++++++ roles/setup_database/handlers/main.yml | 9 +++++ roles/setup_database/tasks/main.yml | 19 ++++----- 17 files changed, 199 insertions(+), 68 deletions(-) create mode 100644 playbooks/test.yml create mode 100644 roles/install_packages/tasks/archlinux.yml create mode 100644 roles/install_packages/tasks/debian.yml create mode 100644 roles/setup_cgroupsv1/tasks/grub.yml create mode 100644 roles/setup_cgroupsv1/tasks/systemd-boot.yml create mode 100644 roles/setup_database/handlers/main.yml diff --git a/.gitignore b/.gitignore index c3d2f84..4668267 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ group_vars/*/secret.yml +private.pem diff --git a/ansible.cfg b/ansible.cfg index 98ff67c..959c6d0 100644 --- a/ansible.cfg +++ b/ansible.cfg @@ -1,4 +1,9 @@ [defaults] roles_path=./roles/ inventory=./hosts -remote_user=root +remote_user=arch +remote_tmp=/tmp/ansible-$USER + +[privilege_escalation] +become=True +become_method=sudo diff --git a/hosts b/hosts index 27ebdc1..7c2d9bc 100644 --- a/hosts +++ b/hosts @@ -2,7 +2,9 @@ localhost ansible_connection=local [cms] -test3.konchin.com +aws.konchin.com +#test7.konchin.com +#test3.konchin.com [all:vars] -ansible_python_interpreter=/usr/bin/python +ansible_python_interpreter=/usr/bin/python3 diff --git a/playbooks/install.yml b/playbooks/install.yml index 9419a93..badd9e8 100644 --- a/playbooks/install.yml +++ b/playbooks/install.yml @@ -7,4 +7,5 @@ - role: cms_preparation - role: setup_database - role: configure_cms + - role: configure_haproxy - role: add_helper_scripts diff --git a/playbooks/test.yml b/playbooks/test.yml new file mode 100644 index 0000000..b41f2f1 --- /dev/null +++ b/playbooks/test.yml @@ -0,0 +1,14 @@ +--- +- name: Test + hosts: cms + tasks: + - name: Test + ansible.builtin.file: + path: /poop + check_mode: true + ignore_errors: true + register: poop + - name: Debug + ansible.builtin.debug: + var: poop + when: ! poop.failed diff --git a/roles/cms_preparation/tasks/main.yml b/roles/cms_preparation/tasks/main.yml index 637aa4b..57d888f 100644 --- a/roles/cms_preparation/tasks/main.yml +++ b/roles/cms_preparation/tasks/main.yml @@ -1,19 +1,24 @@ --- -- name: Clone repository +- name: Clone CMS repository ansible.builtin.git: repo: 'https://github.com/cms-dev/cms.git' dest: /srv/cms version: b77c87b4d60fbe7df60dc5e03d2be632a25992fe single_branch: true - track_submodules: true + update: false +- name: Clone isolate repository + ansible.builtin.git: + repo: 'https://github.com/ioi/isolate.git' + dest: /srv/cms/isolate + version: v1.8.1 + single_branch: true update: false - name: Run prerequisites ansible.builtin.command: | python prerequisites.py -y --as-root install args: chdir: /srv/cms - register: ret - changed_when: ret.rc != 0 + creates: /usr/local/etc/cms.conf - name: Modify cmsuser ansible.builtin.user: name: cmsuser diff --git a/roles/configure_haproxy/tasks/main.yml b/roles/configure_haproxy/tasks/main.yml index 40f568c..fb22ce5 100644 --- a/roles/configure_haproxy/tasks/main.yml +++ b/roles/configure_haproxy/tasks/main.yml @@ -1,6 +1,6 @@ --- - name: Copy haproxy.cfg - ansible.builtin.copy: + ansible.builtin.template: src: haproxy.cfg.jinja dest: /etc/haproxy/haproxy.cfg mode: '0600' diff --git a/roles/configure_haproxy/templates/haproxy.cfg.jinja b/roles/configure_haproxy/templates/haproxy.cfg.jinja index 5f999b9..83fa2de 100644 --- a/roles/configure_haproxy/templates/haproxy.cfg.jinja +++ b/roles/configure_haproxy/templates/haproxy.cfg.jinja @@ -15,7 +15,7 @@ global userlist creds user {{ username }} insecure-password {{ password }} -frontend secure +frontend auth bind :8080 http-request auth unless { http_auth(creds) } mode http @@ -26,12 +26,13 @@ frontend secure maxconn 8000 timeout client 30s + use_backend contest if { hdr(host) -i {{ dns_prefix }}.{{ dns_suffix }} } use_backend rank if { hdr(host) -i {{ dns_prefix }}-ranking.{{ dns_suffix }} } use_backend admin if { hdr(host) -i {{ dns_prefix }}-admin.{{ dns_suffix }} } - default_backend contest frontend main - bind :80 +# bind :80 + bind :443 ssl crt /etc/haproxy/cert.pem mode http log global option httplog @@ -40,9 +41,17 @@ frontend main maxconn 8000 timeout client 30s - use_backend rank if { hdr(host) -i {{ dns_prefix }}-ranking.{{ dns_suffix }} } - use_backend admin if { hdr(host) -i {{ dns_prefix }}-admin.{{ dns_suffix }} } - default_backend contest + use_backend secure if { hdr(host) -i {{ dns_prefix }}.{{ dns_suffix }} } + use_backend secure if { hdr(host) -i {{ dns_prefix }}-ranking.{{ dns_suffix }} } + use_backend secure if { hdr(host) -i {{ dns_prefix }}-admin.{{ dns_suffix }} } + +backend secure + mode http + balance roundrobin + timeout connect 5s + timeout server 30s + timeout queue 30s + server secure1 127.0.0.1:8080 check backend contest mode http diff --git a/roles/install_packages/tasks/archlinux.yml b/roles/install_packages/tasks/archlinux.yml new file mode 100644 index 0000000..82d9560 --- /dev/null +++ b/roles/install_packages/tasks/archlinux.yml @@ -0,0 +1,36 @@ +--- +- name: Update package cache + community.general.pacman: + update_cache: true + +- name: Install cms dependencies + community.general.pacman: + pkg: + - base-devel + - jdk8-openjdk + - fpc + - postgresql + - python + - libcap + - git + notify: Upgrade packages + +- name: Install cms optional dependencies + community.general.pacman: + pkg: + - postgresql-libs + - libcups + - libyaml + - python-virtualenv + - python-pip + - rust + notify: Upgrade packages + +- name: Install additional packages + community.general.pacman: + pkg: + - pyenv + - haproxy + - python-psycopg2 + - unzip + notify: Upgrade packages diff --git a/roles/install_packages/tasks/debian.yml b/roles/install_packages/tasks/debian.yml new file mode 100644 index 0000000..b122ec8 --- /dev/null +++ b/roles/install_packages/tasks/debian.yml @@ -0,0 +1,38 @@ +--- +- name: Install cms dependencies + ansible.builtin.apt: + pkg: + - build-essential + - openjdk-8-headless + - fp-compiler + - postgresql + - postgresql-client + - python3 + - cppreference-doc-en-html + - cgroup-lite + - libcap-dev + - zip + + + - jdk8-openjdk + - fpc + - postgresql + - python + - libcap + - git + +- name: Install cms optional dependencies + ansible.builtin.apt: + pkg: + - postgresql-libs + - libcups + - libyaml + - python-virtualenv + - rust + +- name: Install additional packages + ansible.builtin.apt: + pkg: + - pyenv + - haproxy + - python-psycopg2 diff --git a/roles/install_packages/tasks/main.yml b/roles/install_packages/tasks/main.yml index 262561a..43dc56c 100644 --- a/roles/install_packages/tasks/main.yml +++ b/roles/install_packages/tasks/main.yml @@ -1,34 +1,7 @@ --- -- name: Update package cache - community.general.pacman: - update_cache: true - -- name: Install cms dependencies - community.general.pacman: - pkg: - - base-devel - - jdk8-openjdk - - fpc - - postgresql - - python - - libcap - - git - notify: Upgrade packages - -- name: Install cms optional dependencies - community.general.pacman: - pkg: - - postgresql-libs - - libcups - - libyaml - - python-virtualenv - - rust - notify: Upgrade packages - -- name: Install additional packages - community.general.pacman: - pkg: - - pyenv - - haproxy - - python-psycopg2 - notify: Upgrade packages +- name: Install packages on ArchLinux + ansible.builtin.import_tasks: archlinux.yml + when: ansible_distribution == 'Archlinux' +- name: Install packages on Debian + ansible.builtin.import_tasks: debian.yml + when: ansible_distribution == 'Debian' diff --git a/roles/setup_cgroupsv1/handlers/main.yml b/roles/setup_cgroupsv1/handlers/main.yml index a8f18bd..0b8f3ae 100644 --- a/roles/setup_cgroupsv1/handlers/main.yml +++ b/roles/setup_cgroupsv1/handlers/main.yml @@ -1,3 +1,8 @@ --- +- name: GRUB mkconfig + ansible.builtin.command: | + grub-mkconfig -o /boot/grub/grub.cfg + register: ret + changed_when: ret.rc != 0 - name: Reboot ansible.builtin.reboot: diff --git a/roles/setup_cgroupsv1/tasks/grub.yml b/roles/setup_cgroupsv1/tasks/grub.yml new file mode 100644 index 0000000..9833ebb --- /dev/null +++ b/roles/setup_cgroupsv1/tasks/grub.yml @@ -0,0 +1,12 @@ +--- +- name: Append cgroupsv1 boot option + ansible.builtin.lineinfile: + path: /etc/default/grub + regexp: '^(GRUB_CMDLINE_LINUX_DEFAULT)="(.*)"$' + line: '\1="\2 SYSTEMD_CGROUP_ENABLE_LEGACY_FORCE=1 systemd.unified_cgroup_hierarchy=0"' + backrefs: true + notify: + - GRUB mkconfig + - Reboot +- name: Flush handlers + ansible.builtin.meta: flush_handlers diff --git a/roles/setup_cgroupsv1/tasks/main.yml b/roles/setup_cgroupsv1/tasks/main.yml index 64773cc..6c13e4e 100644 --- a/roles/setup_cgroupsv1/tasks/main.yml +++ b/roles/setup_cgroupsv1/tasks/main.yml @@ -1,13 +1,20 @@ --- -- name: Setup boot entry facts - ansible.builtin.set_fact: - bootconf: "{{ setup_cgroupsv1_bootconf | default('/boot/loader/entries/arch.conf') }}" -- name: Append cgroupsv1 boot option - ansible.builtin.lineinfile: - path: "{{ bootconf }}" - regexp: '^(options.*rw)' - line: '\1 SYSTEMD_CGROUP_ENABLE_LEGACY_FORCE=1 systemd.unified_cgroup_hierarchy=0' - backrefs: true - notify: Reboot -- name: Flush handlers - ansible.builtin.meta: flush_handlers +- name: Check systemd-boot + ansible.builtin.file: + path: /boot/loader + check_mode: true + ignore_errors: true + register: ret +- name: Import systemd-boot + ansible.builtin.import_tasks: systemd-boot.yml + when: not ret.failed + +- name: Check grub + ansible.builtin.file: + path: /boot/grub + check_mode: true + ignore_errors: true + register: ret +- name: Import grub + ansible.builtin.import_tasks: grub.yml + when: not ret.failed diff --git a/roles/setup_cgroupsv1/tasks/systemd-boot.yml b/roles/setup_cgroupsv1/tasks/systemd-boot.yml new file mode 100644 index 0000000..64773cc --- /dev/null +++ b/roles/setup_cgroupsv1/tasks/systemd-boot.yml @@ -0,0 +1,13 @@ +--- +- name: Setup boot entry facts + ansible.builtin.set_fact: + bootconf: "{{ setup_cgroupsv1_bootconf | default('/boot/loader/entries/arch.conf') }}" +- name: Append cgroupsv1 boot option + ansible.builtin.lineinfile: + path: "{{ bootconf }}" + regexp: '^(options.*rw)' + line: '\1 SYSTEMD_CGROUP_ENABLE_LEGACY_FORCE=1 systemd.unified_cgroup_hierarchy=0' + backrefs: true + notify: Reboot +- name: Flush handlers + ansible.builtin.meta: flush_handlers diff --git a/roles/setup_database/handlers/main.yml b/roles/setup_database/handlers/main.yml new file mode 100644 index 0000000..66e07db --- /dev/null +++ b/roles/setup_database/handlers/main.yml @@ -0,0 +1,9 @@ +- name: CMS init DB + ansible.builtin.shell: | + sudo -iu cmsuser <