pleiades.yml

---
- name: Include NYU security playbook
  ansible.builtin.import_playbook: nyu-security.yml

- name: Include anubis playbook
  ansible.builtin.import_playbook: anubis.yml

- hosts: all
  become: true
  become_user: root
  become_method: sudo
  gather_facts: yes
  environment:
    CXX: "g++ -std=c++98"  # Needed to compile libgeos in vaytrou buildout

  pre_tasks:
    - name: Update apt cache
      apt: update_cache=yes cache_valid_time=3600

    - name: Update packages
      apt: upgrade=safe update_cache=yes

    - name: Install default python tools
      apt:
        state: latest
        pkg:
          - python2-dev
          - python-setuptools
          - virtualenv

    - name: Install required packages
      apt:
        pkg:
          - build-essential
          - libzip-dev
          - libsqlite3-dev
          - libreadline-dev
          - libz-dev
          - libssl-dev
          - libjpeg-dev
          - libfreetype6-dev
          - libxslt1-dev
          - libxml2-dev
          - python3-selinux
          - python3-semanage
          - poppler-utils
          - lynx
          - unzip
          - git
          - wv
          - iotop
          - supervisor
          - sysstat
          - joe
          - zip

    - name: Install pleiades dependencies
      apt:
        pkg:
          - libgeos-dev
          - libspatialindex-dev
          - slapd-contrib
          - slapd
          - libsasl2-dev
          - libldap-dev
          - libffi-dev
          - autoconf
          - patch

    - name: Superlance installed
      pip:
        name: superlance
        version: "0.11"
        extra_args: "--index-url=https://pypi.python.org/simple/"
        virtualenv: /srv/python27-apps
        virtualenv_python: /usr/bin/python2.7

    - name: Ensure plone_group
      group: name=plone_group

    - name: Ensure plone_daemon
      user:
        name=plone_daemon
        group=plone_group
        shell=/bin/bash
        createhome=yes
        generate_ssh_key=yes

    - name: Ensure plone_buildout
      user:
        name=plone_buildout
        group=plone_group

    - set_fact:
        instance_task:
          name: pleiades-instance{{ item }}
          command: /srv/python27-apps/pleiades4/bin/instance{{ item }} console
          directory: /srv/python27-apps/pleiades4
          user: plone_daemon
          redirect_stderr: true
          stopwaitsecs: 30
          autostart: true
          autorestart: true
      with_sequence: start=1 end={{ plone_client_count }}
      register: instance_task_results
      tags: ['supervisor']

    - set_fact:
        supervisor_tasks: "{{instance_task_results.results | map(attribute='ansible_facts.instance_task') | list + supervisor_tasks}}"
      tags: ['supervisor']

    - set_fact:
        balancer_client:
          name: plone_{{ item }}
          port: 840{{ item }}
      with_sequence: start=2 end={{ plone_client_count >= 2 and plone_client_count or 2 }}
      register: balancer_client_results
      when: plone_client_count >= 2

    - set_fact:
        balancer_clients: "{{balancer_client_results.results | map(attribute='balancer_client') | list}}"

    - name: Install virtualenv
      pip:
        virtualenv: /srv/python27-apps
        virtualenv_python: /usr/bin/python2.7
        name: setuptools
        version: 42.0.2

    - name: Install Pillow
      pip:
        virtualenv: /srv/python27-apps
        name: Pillow
        version: 3.3.3

    - name: Check whether certificate exists
      stat: "path={{ pleiades_cert_file }}"
      register: ssl_certificate
      tags:
        - apache-install
        - apacheconf

  roles:

    - geerlingguy.postfix

    - {role: 'buildout',
        base_dir: '/srv/python27-apps',
        buildout_python: '/srv/python27-apps/bin/python2.7',
        instance_name: 'vaytrou',
        buildout_repo: 'https://github.com/isawnyu/vaytrou.git',
        buildout_version: "{{ vaytrou_branch }}",
        tags: ['vaytrou', 'buildout'],
      }

    - {role: 'buildout',
        base_dir: '/srv/python27-apps',
        buildout_python: '/srv/python27-apps/bin/python2.7',
        instance_name: 'pleiades4',
        buildout_repo: 'https://github.com/isawnyu/pleiades3-buildout.git',
        buildout_version: "{{ pleiades_buildout_branch }}",
        buildout_file: "{{ pleiades_buildout_file }}",
        tags: ['plone4', 'buildout'],
      }

    - role: haproxy
      listen_port: "{{ haproxy_port }}"
      clients: "{{ balancer_clients }}"
      tags: ['haproxy']

    - role: varnish
      tags:
        - varnish

    - role: geerlingguy.apache
      apache_state: stopped
      tags:
        - apache-install
        - apacheconf

    - role: jnv.unattended-upgrades
      when: enable_unattended_upgrades
      tags:
        - os-updates

    - role: christiangda.amazon_cloudwatch_agent
      when: enable_cloudwatch_agent
      tags:
        - cloudwatch

    - role: Oefenweb.fail2ban
      tags:
        - fail2ban
      when: install_fail2ban|default(True)

  tasks:

    - name: Newrelic Python config
      template: src=templates/newrelic.ini.j2 dest=/srv/python27-apps/pleiades4/newrelic.ini owner=plone_daemon group=plone_group mode=0644
      when: newrelic_license_key is defined
      notify: Restart buildout pleiades4

    - name: Apache pleiades include config
      template: src=templates/pleiades-server.conf.j2 dest=/etc/apache2/conf-available/pleiades-server.conf owner=root group=root mode=0644
      notify: restart apache
      tags:
        - apacheconf

    - name: Apache pleiades site config
      template: src=templates/pleiades.stoa.org.j2 dest=/etc/apache2/sites-available/pleiades.stoa.org.conf owner=root group=root mode=0644
      notify: restart apache
      tags:
        - apacheconf

    - name: Apache pleiades-api config
      template: src=templates/api.pleiades.stoa.org.j2 dest=/etc/apache2/sites-available/api.pleiades.stoa.org.conf owner=root group=root mode=0644
      notify: restart apache
      tags:
        - apacheconf

    - name: Apache atlantides config
      template: src=templates/atlantides.org.j2 dest=/etc/apache2/sites-available/atlantides.org.conf owner=root group=root mode=0644
      notify: restart apache
      tags:
        - apacheconf

    - name: Apache pleiades symlink
      file: src=/etc/apache2/sites-available/pleiades.stoa.org.conf dest=/etc/apache2/sites-enabled/00-pleiades.stoa.org.conf state=link
      notify: restart apache
      tags:
        - apacheconf

    - name: Apache pleiades-api symlink
      file: src=/etc/apache2/sites-available/api.pleiades.stoa.org.conf dest=/etc/apache2/sites-enabled/02-api.pleiades.stoa.org.conf state=link
      notify: restart apache
      tags:
        - apacheconf

    - name: Apache atlantides symlink
      file: src=/etc/apache2/sites-available/atlantides.org.conf dest=/etc/apache2/sites-enabled/01-atlantides.org.conf state=link
      notify: restart apache
      tags:
        - apacheconf

    - name: Remove default vhost symlink
      file: path=/etc/apache2/sites-enabled/vhosts.conf state=absent
      notify: restart apache
      tags:
        - apacheconf

    - name: MPM events conf
      ansible.builtin.copy: src=files/mpm_event.conf dest=/etc/apache2/mods-enabled/mpm_event.conf owner=root group=root mode=0644
      notify: restart apache
      tags:
        - apacheconf

    - name: Mod evasive conf
      ansible.builtin.copy: src=files/evasive.conf dest=/etc/apache2/mods-available/evasive.conf owner=root group=root mode=0644
      notify: restart apache
      tags:
        - apacheconf

    - name: Create pleiades vhost dir
      file: path=/var/www/pleiades.stoa.org recurse=yes state=directory owner=www-data mode=0775

    - name: Create pleiades vhost dir
      file: path=/var/www/atlantides.org/downloads/pleiades recurse=yes state=directory owner=plone_daemon mode=0775

    - name: Create atlantides dump dir
      file: path=/var/www/atlantides.org/downloads/pleiades/dumps/ state=directory owner=plone_daemon mode=0775

    - name: Symlink to pleiades.dump README
      file: src=/srv/python27-apps/pleiades4/src/pleiades.dump/docs/README.txt dest=/var/www/atlantides.org/downloads/pleiades/dumps/README.txt state=link force=yes

    - name: Create atlantides kml dir
      file: path=/var/www/atlantides.org/downloads/pleiades/kml/ state=directory owner=plone_daemon mode=0775

    - name: Create atlantides rdf dir
      file: path=/var/www/atlantides.org/downloads/pleiades/rdf/ state=directory owner=plone_daemon mode=0775

    - name: Create atlantides json dir
      file: path=/var/www/atlantides.org/downloads/pleiades/json/ state=directory owner=plone_daemon mode=0755

    - name: Pleiades frontpage git checkout
      git:
        repo=https://github.com/isawnyu/pleiades-frontpage.git
        update=yes
        dest=/var/www/pleiades.stoa.org/pleiades-frontpage
        version={{pleiades_static_branch}}
        force=yes
        accept_hostkey=yes
      become_user: "www-data"
      tags:
        - frontpage

    - name: Pleiades api git checkout
      git:
        repo=https://github.com/isawnyu/pleiades-api.git
        update=yes
        dest=/var/www/pleiades.stoa.org/pleiades-api
        version=master
        force=yes
        accept_hostkey=yes
      become_user: "www-data"

    - name: Create vaytrou log dir
      file: path=/srv/python27-apps/vaytrou/vtdata/pleiades3-three/log recurse=yes state=directory owner=plone_daemon

    - name: Set timezone
      file: src=/usr/share/zoneinfo/America/New_York dest=/etc/localtime state=link owner=root force=yes

    - name: Start supervisor
      service: name=supervisor state=started enabled=yes
      tags: ['supervisor']

    - name: Start apache
      service: name=apache2 state=started enabled=yes
      tags:
        - apache-install
        - apacheconf

    - name: Create ZODB var dir
      file: path=/srv/python27-apps/pleiades4/var recurse=yes state=directory owner=plone_daemon

    - name: Create ZODB backups dir
      file: path=/srv/python27-apps/pleiades4/var/backups recurse=yes state=directory owner=plone_daemon

    - name: Create supervisor tasks
      template: src=templates/supervisor_task.conf.j2 dest=/etc/supervisor/conf.d/pleiades.conf
      notify: Restart supervisor
      tags: ['supervisor']

  post_tasks:

    - name: Cron sitemap
      copy: src=files/pleiades-sitemap dest=/etc/cron.daily/pleiades-sitemap owner=root group=root mode=0755
      when: enable_sitemap

    - name: Cron kml
      copy: src=files/pleiades-kmz dest=/etc/cron.daily/pleiades-kmz owner=root group=root mode=0755

    - name: Cron rdf
      copy: src=files/pleiades-rdf dest=/etc/cron.weekly/pleiades-rdf owner=root group=root mode=0755

    - name: Cron dump all
      copy: src=files/pleiades-dump-all dest=/etc/cron.daily/pleiades-dump-all owner=root group=root mode=0755

    - name: cron backups
      cron: name="Nightly ZODB Backup" minute="0" user="plone_daemon" hour="2" job="/srv/python27-apps/pleiades4/bin/backup"
      when: enable_backups

    - name: cron pack
      cron: name="Weekly ZODB Pack" minute="30" user="plone_daemon" hour="3" weekday="0" job="/srv/python27-apps/pleiades4/bin/zeopack"

    - name: Set a hostname
      ansible.builtin.hostname:
        name: "{{ pleiades_ssl_vhost }}"


  handlers:

    - name: Restart supervisor
      service:
        name: supervisor
        state: restarted
      tags: ['supervisor']

    - name: Restart buildout pleiades4
      supervisorctl:
        name: pleiades-instance{{ item }}
        state: restarted
      with_sequence: start=1 end={{plone_client_count}}
      ignore_errors: yes

    - name: Restart buildout vaytrou
      supervisorctl:
        name: vtpleiades3
        state: restarted
      ignore_errors: yes