Skip to content

Commit

Permalink
Drop devture_ prefix from all variable names
Browse files Browse the repository at this point in the history
  • Loading branch information
spantaleev committed Sep 27, 2024
1 parent f3238e6 commit 2084252
Show file tree
Hide file tree
Showing 13 changed files with 377 additions and 377 deletions.
14 changes: 7 additions & 7 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,18 +13,18 @@ Example playbook:
roles:
- role: galaxy/com.devture.ansible.role.systemd_docker_base

- role: galaxy/com.devture.ansible.role.traefik
- role: galaxy/traefik

- role: another_role
```
Example playbook configuration (`group_vars/servers` or other):

```yaml
devture_traefik_container_network: "{{ my_container_network }}"
traefik_container_network: "{{ my_container_network }}"
devture_traefik_uid: "{{ my_uid }}"
devture_traefik_gid: "{{ my_gid }}"
traefik_uid: "{{ my_uid }}"
traefik_gid: "{{ my_gid }}"
```

## Security hardening
Expand Down Expand Up @@ -53,14 +53,14 @@ devture_container_socket_proxy_api_containers_enabled: true
# Base Traefik configuration here (see above).
devture_traefik_config_providers_docker_endpoint: "{{ devture_container_socket_proxy_endpoint if devture_container_socket_proxy_enabled else 'unix:///var/run/docker.sock' }}"
traefik_config_providers_docker_endpoint: "{{ devture_container_socket_proxy_endpoint if devture_container_socket_proxy_enabled else 'unix:///var/run/docker.sock' }}"
devture_traefik_container_additional_networks: |
traefik_container_additional_networks: |
{{
([devture_container_socket_proxy_container_network] if devture_container_socket_proxy_enabled else [])
}}
devture_traefik_systemd_required_services_list: |
traefik_systemd_required_services_list: |
{{
(['docker.service'])
+
Expand Down
294 changes: 147 additions & 147 deletions defaults/main.yml

Large diffs are not rendered by default.

92 changes: 46 additions & 46 deletions tasks/install.yml
Original file line number Diff line number Diff line change
Expand Up @@ -5,108 +5,108 @@
path: "{{ item.path }}"
state: directory
mode: "0750"
owner: "{{ devture_traefik_uid }}"
group: "{{ devture_traefik_gid }}"
owner: "{{ traefik_uid }}"
group: "{{ traefik_gid }}"
when: item.when | bool
with_items:
- path: "{{ devture_traefik_base_path }}"
- path: "{{ traefik_base_path }}"
when: true
- path: "{{ devture_traefik_config_dir_path }}"
- path: "{{ traefik_config_dir_path }}"
when: true
- path: "{{ devture_traefik_ssl_dir_path }}"
when: "{{ devture_traefik_ssl_dir_enabled }}"
- path: "{{ devture_traefik_plugins_dir_path }}"
when: "{{ devture_traefik_plugin_support_enabled }}"
- path: "{{ traefik_ssl_dir_path }}"
when: "{{ traefik_ssl_dir_enabled }}"
- path: "{{ traefik_plugins_dir_path }}"
when: "{{ traefik_plugin_support_enabled }}"

- when: devture_traefik_dashboard_basicauth_enabled | bool
- when: traefik_dashboard_basicauth_enabled | bool
block:
# We do this locally, so that we won't need passlib to be installed on the server.
- name: Generate basic auth file locally
community.general.htpasswd:
path: "{{ devture_traefik_dashboard_basicauth_file_tmp }}"
name: "{{ devture_traefik_dashboard_basicauth_user }}"
password: "{{ devture_traefik_dashboard_basicauth_password }}"
path: "{{ traefik_dashboard_basicauth_file_tmp }}"
name: "{{ traefik_dashboard_basicauth_user }}"
password: "{{ traefik_dashboard_basicauth_password }}"
mode: 0640
become: false
delegate_to: 127.0.0.1

- name: Load basic auth file contents
ansible.builtin.slurp:
src: "{{ devture_traefik_dashboard_basicauth_file_tmp }}"
src: "{{ traefik_dashboard_basicauth_file_tmp }}"
become: false
delegate_to: 127.0.0.1
register: devture_traefik_dashboard_basicauth_file_contents_raw
register: traefik_dashboard_basicauth_file_contents_raw

- name: Load basic auth file contents
ansible.builtin.set_fact:
devture_traefik_dashboard_basicauth_file_contents: "{{ devture_traefik_dashboard_basicauth_file_contents_raw['content'] | b64decode }}"
traefik_dashboard_basicauth_file_contents: "{{ traefik_dashboard_basicauth_file_contents_raw['content'] | b64decode }}"

- name: Ensure local temporary basic auth file is removed
ansible.builtin.file:
path: "{{ devture_traefik_dashboard_basicauth_file_tmp }}"
path: "{{ traefik_dashboard_basicauth_file_tmp }}"
state: absent
become: false
delegate_to: 127.0.0.1

- name: Ensure Traefik environment variables installed
ansible.builtin.copy:
content: "{{ devture_traefik_environment_variables }}"
dest: "{{ devture_traefik_config_dir_path }}/env"
owner: "{{ devture_traefik_uid }}"
group: "{{ devture_traefik_gid }}"
content: "{{ traefik_environment_variables }}"
dest: "{{ traefik_config_dir_path }}/env"
owner: "{{ traefik_uid }}"
group: "{{ traefik_gid }}"
mode: 0640

- name: Ensure Traefik support files installed
ansible.builtin.template:
src: "{{ role_path }}/templates/{{ item }}.j2"
dest: "{{ devture_traefik_config_dir_path }}/{{ item }}"
owner: "{{ devture_traefik_uid }}"
group: "{{ devture_traefik_gid }}"
dest: "{{ traefik_config_dir_path }}/{{ item }}"
owner: "{{ traefik_uid }}"
group: "{{ traefik_gid }}"
mode: 0640
with_items:
- env
- labels

- name: Ensure traefik.yml installed
ansible.builtin.copy:
content: "{{ devture_traefik_configuration | to_nice_yaml(indent=2, width=999999) }}"
dest: "{{ devture_traefik_config_dir_path }}/traefik.yml"
owner: "{{ devture_traefik_uid }}"
group: "{{ devture_traefik_gid }}"
content: "{{ traefik_configuration | to_nice_yaml(indent=2, width=999999) }}"
dest: "{{ traefik_config_dir_path }}/traefik.yml"
owner: "{{ traefik_uid }}"
group: "{{ traefik_gid }}"
mode: 0640

- name: Ensure provider.yml installed
ansible.builtin.copy:
content: "{{ devture_traefik_provider_configuration | to_nice_yaml(indent=2, width=999999) }}"
dest: "{{ devture_traefik_config_dir_path }}/provider.yml"
owner: "{{ devture_traefik_uid }}"
group: "{{ devture_traefik_gid }}"
content: "{{ traefik_provider_configuration | to_nice_yaml(indent=2, width=999999) }}"
dest: "{{ traefik_config_dir_path }}/provider.yml"
owner: "{{ traefik_uid }}"
group: "{{ traefik_gid }}"
mode: 0640

# If the Docker API is accessed through a UNIX socket (like we do by default), the container is run as root,
# which means that the acme.json file is also created as root. For such a privilege container, this root-owned file is OK.
#
# When switching to accessing the Docker API via TCP, we run the container with a regular user.
# An already existing acme.json (owned by root:root) won't be accessible and needs to be fixed up.
- when: not devture_traefik_config_providers_docker_endpoint_is_unix_socket
- when: not traefik_config_providers_docker_endpoint_is_unix_socket
name: Ensure acme.json file ownership is correct
block:
- name: Check existence of acme.json file
ansible.builtin.stat:
path: "{{ devture_traefik_ssl_dir_path }}/acme.json"
register: devture_traefik_ssl_acme_json_stat
path: "{{ traefik_ssl_dir_path }}/acme.json"
register: traefik_ssl_acme_json_stat

- when: devture_traefik_ssl_acme_json_stat.stat.exists | bool
- when: traefik_ssl_acme_json_stat.stat.exists | bool
name: Ensure acme.json file ownership set correctly
ansible.builtin.file:
path: "{{ devture_traefik_ssl_dir_path }}/acme.json"
owner: "{{ devture_traefik_uid }}"
group: "{{ devture_traefik_gid }}"
path: "{{ traefik_ssl_dir_path }}/acme.json"
owner: "{{ traefik_uid }}"
group: "{{ traefik_gid }}"

- name: Ensure Traefik container image is pulled via community.docker.docker_image
when: devture_systemd_docker_base_container_image_pull_method == 'ansible-module'
community.docker.docker_image:
name: "{{ devture_traefik_container_image }}"
name: "{{ traefik_container_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}" # noqa args
register: result
retries: "{{ devture_playbook_help_container_retries_count }}"
Expand All @@ -116,28 +116,28 @@
- name: Ensure Traefik container image is pulled via command
when: devture_systemd_docker_base_container_image_pull_method == 'command'
ansible.builtin.command:
cmd: "{{ devture_systemd_docker_base_host_command_docker }} pull {{ devture_traefik_container_image }}"
cmd: "{{ devture_systemd_docker_base_host_command_docker }} pull {{ traefik_container_image }}"
register: result
retries: "{{ devture_playbook_help_container_retries_count }}"
delay: "{{ devture_playbook_help_container_retries_delay }}"
until: result is not failed

- name: Ensure Traefik container network exists via community.docker.docker_network
when: devture_systemd_docker_base_container_network_creation_method == 'ansible-module' and devture_traefik_container_network != 'host'
when: devture_systemd_docker_base_container_network_creation_method == 'ansible-module' and traefik_container_network != 'host'
community.docker.docker_network:
name: "{{ devture_traefik_container_network }}"
name: "{{ traefik_container_network }}"
driver: bridge
driver_options: "{{ devture_systemd_docker_base_container_networks_driver_options }}"

- name: Ensure Traefik container network exists via command
when: devture_systemd_docker_base_container_network_creation_method == 'command' and devture_traefik_container_network != 'host'
when: devture_systemd_docker_base_container_network_creation_method == 'command' and traefik_container_network != 'host'
ansible.builtin.command:
cmd: "{{ devture_systemd_docker_base_host_command_docker }} network create {% for k, v in devture_systemd_docker_base_container_networks_driver_options %} --opt {{ k }}={{ v }}{% endfor %} {{ devture_traefik_container_network }}"
cmd: "{{ devture_systemd_docker_base_host_command_docker }} network create {% for k, v in devture_systemd_docker_base_container_networks_driver_options %} --opt {{ k }}={{ v }}{% endfor %} {{ traefik_container_network }}"
register: network_creation_result
failed_when: network_creation_result.rc != 0 and 'already exists' not in network_creation_result.stderr

- name: Ensure Traefik systemd service installed
ansible.builtin.template:
src: "{{ role_path }}/templates/devture-traefik.service.j2"
dest: "{{ devture_systemd_docker_base_systemd_path }}/{{ devture_traefik_identifier }}.service"
src: "{{ role_path }}/templates/traefik.service.j2"
dest: "{{ devture_systemd_docker_base_systemd_path }}/{{ traefik_identifier }}.service"
mode: 0644
6 changes: 3 additions & 3 deletions tasks/main.yml
Original file line number Diff line number Diff line change
Expand Up @@ -6,15 +6,15 @@
- install-all
- install-traefik
block:
- when: devture_traefik_enabled | bool
- when: traefik_enabled | bool
ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"

- when: devture_traefik_enabled | bool
- when: traefik_enabled | bool
ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml"

- tags:
- setup-all
- setup-traefik
block:
- when: not devture_traefik_enabled | bool
- when: not traefik_enabled | bool
ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml"
12 changes: 6 additions & 6 deletions tasks/uninstall.yml
Original file line number Diff line number Diff line change
Expand Up @@ -2,23 +2,23 @@

- name: Check existence of Traefik systemd service
ansible.builtin.stat:
path: "{{ devture_systemd_docker_base_systemd_path }}/{{ devture_traefik_identifier }}.service"
register: devture_traefik_service_stat
path: "{{ devture_systemd_docker_base_systemd_path }}/{{ traefik_identifier }}.service"
register: traefik_service_stat

- when: devture_traefik_service_stat.stat.exists | bool
- when: traefik_service_stat.stat.exists | bool
block:
- name: Ensure Traefik systemd service is stopped
ansible.builtin.systemd:
name: "{{ devture_traefik_identifier }}"
name: "{{ traefik_identifier }}"
state: stopped
daemon_reload: true

- name: Ensure Traefik systemd service doesn't exist
ansible.builtin.file:
path: "{{ devture_systemd_docker_base_systemd_path }}/{{ devture_traefik_identifier }}.service"
path: "{{ devture_systemd_docker_base_systemd_path }}/{{ traefik_identifier }}.service"
state: absent

- name: Remove Traefik directory is removed
ansible.builtin.file:
path: "{{ devture_traefik_base_path }}"
path: "{{ traefik_base_path }}"
state: absent
36 changes: 18 additions & 18 deletions tasks/validate_config.yml
Original file line number Diff line number Diff line change
Expand Up @@ -7,50 +7,50 @@
Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`).
when: "item.old in vars"
with_items:
- {'old': 'devture_traefik_ssl_email_address', 'new': 'devture_traefik_config_certificatesResolvers_acme_email'}
- {'old': 'devture_traefik_config_letsencrypt_resolver_caServer', 'new': 'devture_traefik_config_certificatesResolvers_acme_caServer'}
- {'old': 'devture_traefik_config_letsencrypt_use_staging', 'new': 'devture_traefik_config_certificatesResolvers_acme_use_staging'}
- {'old': 'devture_traefik_config_letsencrypt_httpChallenge_entrypoint', 'new': 'devture_traefik_config_certificatesResolvers_acme_httpChallenge_entrypoint'}
- {'old': 'traefik_ssl_email_address', 'new': 'traefik_config_certificatesResolvers_acme_email'}
- {'old': 'traefik_config_letsencrypt_resolver_caServer', 'new': 'traefik_config_certificatesResolvers_acme_caServer'}
- {'old': 'traefik_config_letsencrypt_use_staging', 'new': 'traefik_config_certificatesResolvers_acme_use_staging'}
- {'old': 'traefik_config_letsencrypt_httpChallenge_entrypoint', 'new': 'traefik_config_certificatesResolvers_acme_httpChallenge_entrypoint'}

- name: Fail if required Traefik settings not defined
ansible.builtin.fail:
msg: >-
You need to define a required configuration setting (`{{ item }}`) for using this role.
when: "vars[item] == ''"
with_items:
- devture_traefik_uid
- devture_traefik_gid
- devture_traefik_entrypoint_primary
- traefik_uid
- traefik_gid
- traefik_entrypoint_primary

- name: Fail if required Traefik ACME settings not defined
fail:
msg: >-
You need to define a required configuration setting (`{{ item }}`) when enabling ACME SSL certificate resolvers.
when: "devture_traefik_config_certificatesResolvers_acme_enabled | bool and vars[item] == ''"
when: "traefik_config_certificatesResolvers_acme_enabled | bool and vars[item] == ''"
with_items:
- devture_traefik_config_certificatesResolvers_acme_email
- devture_traefik_config_certificatesResolvers_acme_httpChallenge_entrypoint
- traefik_config_certificatesResolvers_acme_email
- traefik_config_certificatesResolvers_acme_httpChallenge_entrypoint

- name: Fail if Traefik docker endpoint syntax invalid
fail:
msg: >-
devture_traefik_config_providers_docker_endpoint must look like `unix:///var/run/docker.sock` or `tcp://host:2345`
when: "not (devture_traefik_config_providers_docker_endpoint.startswith('unix://') or devture_traefik_config_providers_docker_endpoint.startswith('tcp://'))"
traefik_config_providers_docker_endpoint must look like `unix:///var/run/docker.sock` or `tcp://host:2345`
when: "not (traefik_config_providers_docker_endpoint.startswith('unix://') or traefik_config_providers_docker_endpoint.startswith('tcp://'))"

- name: Fail if required Traefik Dashboard settings not defined
ansible.builtin.fail:
msg: >-
You need to define a required configuration setting (`{{ item }}`) for enabling the Traefik Dashboard.
when: "devture_traefik_dashboard_enabled | bool and vars[item] == ''"
when: "traefik_dashboard_enabled | bool and vars[item] == ''"
with_items:
- devture_traefik_dashboard_hostname
- devture_traefik_dashboard_entrypoints
- traefik_dashboard_hostname
- traefik_dashboard_entrypoints

- name: Fail if required Traefik Dashboard Basic Auth settings not defined
ansible.builtin.fail:
msg: >-
You need to define a required configuration setting (`{{ item }}`) for using Basic Auth.
when: "devture_traefik_dashboard_basicauth_enabled | bool and vars[item] == ''"
when: "traefik_dashboard_basicauth_enabled | bool and vars[item] == ''"
with_items:
- devture_traefik_dashboard_basicauth_user
- devture_traefik_dashboard_basicauth_password
- traefik_dashboard_basicauth_user
- traefik_dashboard_basicauth_password
Loading

0 comments on commit 2084252

Please sign in to comment.