main.yaml

---
- name: Pull the Foreman container image
  containers.podman.podman_image:
    name: "{{ foreman_container_image }}:{{ foreman_container_tag }}"
    state: present
  environment:
    REGISTRY_AUTH_FILE: "{{ foreman_registry_auth_file }}"

- name: Create secret for DATABASE_URL
  containers.podman.podman_secret:
    state: present
    name: foreman-database-url
    data: "postgresql://{{ foreman_database_user }}:{{ foreman_database_password }}@{{ foreman_database_host }}:{{ foreman_database_port }}/{{ foreman_database_name }}?pool={{ foreman_database_pool }}&sslmode={{ foreman_database_ssl_mode }}{% if foreman_database_ssl_ca is defined %}&sslrootcert={{ foreman_database_ssl_ca_path }}{% endif %}" # yamllint disable-line rule:line-length
  notify:
    - Restart foreman
    - Restart dynflow-sidekiq@

- name: Create secret for SEED_ADMIN_USER
  containers.podman.podman_secret:
    state: present
    name: foreman-seed-admin-user
    data: "{{ foreman_initial_admin_username }}"
  notify:
    - Restart foreman
    - Restart dynflow-sidekiq@

- name: Create secret for SEED_ADMIN_PASSWORD
  containers.podman.podman_secret:
    state: present
    name: foreman-seed-admin-password
    data: "{{ foreman_initial_admin_password }}"
  notify:
    - Restart foreman
    - Restart dynflow-sidekiq@

- name: Create settings config secret
  containers.podman.podman_secret:
    state: present
    name: foreman-settings-yaml
    data: "{{ lookup('ansible.builtin.template', 'settings.yaml.j2') }}"
  notify:
    - Restart foreman
    - Restart dynflow-sidekiq@

- name: Create katello config secret
  containers.podman.podman_secret:
    state: present
    name: foreman-katello-yaml
    data: "{{ lookup('ansible.builtin.template', 'katello.yaml.j2') }}"
  notify:
    - Restart foreman
    - Restart dynflow-sidekiq@

- name: Create dynflow hosts_queue worker config secret
  containers.podman.podman_secret:
    state: present
    name: foreman-dynflow-worker-hosts-queue-yaml
    data: "{{ lookup('ansible.builtin.template', 'dynflow-worker-hosts-queue.yml') }}"
  notify:
    - Restart dynflow-sidekiq@

- name: Create the podman secret for Foreman CA certificate
  containers.podman.podman_secret:
    name: foreman-ca-cert
    path: "{{ foreman_ca_certificate }}"
    state: present
  notify:
    - Restart foreman
    - Restart dynflow-sidekiq@

- name: Create the podman secret for Foreman client certificate
  containers.podman.podman_secret:
    state: present
    name: foreman-client-cert
    path: "{{ foreman_client_certificate }}"
  notify:
    - Restart foreman
    - Restart dynflow-sidekiq@

- name: Create the podman secret for Foreman client key
  containers.podman.podman_secret:
    state: present
    name: foreman-client-key
    path: "{{ foreman_client_key }}"
  notify:
    - Restart foreman
    - Restart dynflow-sidekiq@

- name: Create DB SSL cert
  containers.podman.podman_secret:
    state: present
    name: foreman-db-ca
    data: "{{ lookup('ansible.builtin.file', foreman_database_ssl_ca) if foreman_database_ssl_ca else 'empty' }}"
  notify:
    - Restart foreman
    - Restart dynflow-sidekiq@

- name: Deploy Foreman Container
  containers.podman.podman_container:
    name: "foreman"
    image: "{{ foreman_container_image }}:{{ foreman_container_tag }}"
    state: quadlet
    sdnotify: true
    network: host
    hostname: "{{ ansible_facts['fqdn'] }}"
    volume:
      - 'foreman-data-run:/var/run/foreman:z'
    secrets:
      - 'foreman-database-url,type=env,target=DATABASE_URL'
      - 'foreman-seed-admin-user,type=env,target=SEED_ADMIN_USER'
      - 'foreman-seed-admin-password,type=env,target=SEED_ADMIN_PASSWORD'
      - 'foreman-settings-yaml,type=mount,target=/etc/foreman/settings.yaml'
      - 'foreman-katello-yaml,type=mount,target=/etc/foreman/plugins/katello.yaml'
      - 'foreman-ca-cert,type=mount,target=/etc/foreman/katello-default-ca.crt'
      - 'foreman-client-cert,type=mount,target=/etc/foreman/client_cert.pem'
      - 'foreman-client-key,type=mount,target=/etc/foreman/client_key.pem'
      - 'foreman-db-ca,type=mount,target={{ foreman_database_ssl_ca_path }}'
    env:
      FOREMAN_PUMA_THREADS_MIN: "{{ foreman_puma_threads_min }}"
      FOREMAN_PUMA_THREADS_MAX: "{{ foreman_puma_threads_max }}"
      FOREMAN_PUMA_WORKERS: "{{ foreman_puma_workers }}"
      FOREMAN_ENABLED_PLUGINS: "{{ foreman_plugins | join(' ') }}"
    quadlet_options:
      - |
        [Install]
        WantedBy=default.target foreman.target
        [Unit]
        PartOf=foreman.target
        Wants=redis.service postgresql.service candlepin.service
        After=foreman.target redis.service postgresql.service candlepin.service
  notify: Restart foreman

- name: Deploy Dynflow Container
  containers.podman.podman_container:
    name: "dynflow-sidekiq-%i"
    quadlet_filename: "dynflow-sidekiq@"
    image: "{{ foreman_container_image }}:{{ foreman_container_tag }}"
    state: quadlet
    sdnotify: true
    network: host
    hostname: "{{ ansible_facts['fqdn'] }}"
    volume:
      - 'foreman-data-run:/var/run/foreman:z'
    secrets:
      - 'foreman-database-url,type=env,target=DATABASE_URL'
      - 'foreman-settings-yaml,type=mount,target=/etc/foreman/settings.yaml'
      - 'foreman-katello-yaml,type=mount,target=/etc/foreman/plugins/katello.yaml'
      - 'foreman-ca-cert,type=mount,target=/etc/foreman/katello-default-ca.crt'
      - 'foreman-client-cert,type=mount,target=/etc/foreman/client_cert.pem'
      - 'foreman-client-key,type=mount,target=/etc/foreman/client_key.pem'
      - 'foreman-dynflow-worker-hosts-queue-yaml,type=mount,target=/etc/foreman/dynflow/worker-hosts-queue.yml'
      - 'foreman-db-ca,type=mount,target={{ foreman_database_ssl_ca_path }}'
    env:
      DYNFLOW_REDIS_URL: "redis://localhost:6379/6"
      REDIS_PROVIDER: "DYNFLOW_REDIS_URL"
      FOREMAN_ENABLED_PLUGINS: "{{ foreman_plugins | join(' ') }}"
    command: "/usr/libexec/foreman/sidekiq-selinux -e production -r ./extras/dynflow-sidekiq.rb -C /etc/foreman/dynflow/%i.yml"
    quadlet_options:
      - |
        [Install]
        WantedBy=default.target foreman.target
        [Unit]
        PartOf=foreman.target
        Wants=redis.service postgresql.service
        After=foreman.target redis.service postgresql.service
      - |
        [Service]
        Restart=on-failure
        RestartSec=1

- name: Create Dynflow Container instances
  ansible.builtin.file:
    state: link
    src: "/etc/containers/systemd/dynflow-sidekiq@.container"
    dest: "/etc/containers/systemd/dynflow-sidekiq@{{ item }}.container"
  loop:
    - orchestrator
    - worker
    - worker-hosts-queue

- name: Define templated Quadlet for recurring Foreman rake tasks
  when: foreman_recurring_tasks_enabled
  loop: "{{ foreman_recurring_tasks }}"
  loop_control:
    label: "{{ item.instance }}"
  containers.podman.podman_container:
    name: "foreman-recurring-{{ item.instance }}"
    quadlet_filename: "foreman-recurring@{{ item.instance }}"
    state: quadlet
    image: "{{ foreman_container_image }}:{{ foreman_container_tag }}"
    sdnotify: false
    network: host
    hostname: "{{ ansible_facts['fqdn'] }}"
    command: "foreman-rake {{ item.rake }}"
    volume:
      - 'foreman-data-run:/var/run/foreman:z'
    secrets:
      - 'foreman-database-url,type=env,target=DATABASE_URL'
      - 'foreman-seed-admin-user,type=env,target=SEED_ADMIN_USER'
      - 'foreman-seed-admin-password,type=env,target=SEED_ADMIN_PASSWORD'
      - 'foreman-settings-yaml,type=mount,target=/etc/foreman/settings.yaml'
      - 'foreman-katello-yaml,type=mount,target=/etc/foreman/plugins/katello.yaml'
      - 'foreman-ca-cert,type=mount,target=/etc/foreman/katello-default-ca.crt'
      - 'foreman-client-cert,type=mount,target=/etc/foreman/client_cert.pem'
      - 'foreman-client-key,type=mount,target=/etc/foreman/client_key.pem'
    quadlet_options:
      - |
        [Unit]
        PartOf=foreman.target
        After=foreman.target
        StartLimitIntervalSec=0
      - |
        [Service]
        TimeoutStartSec=30m
        TimeoutStopSec=2m
        KillMode=mixed
        SyslogIdentifier=foreman-recurring-%i

- name: Render timers for recurring tasks
  when: foreman_recurring_tasks_enabled
  ansible.builtin.template:
    src: foreman-recurring@.timer.j2
    dest: "/etc/systemd/system/foreman-recurring@{{ item.instance }}.timer"
    mode: "0644"
  loop: "{{ foreman_recurring_tasks }}"
  loop_control:
    label: "{{ item.instance }}"

- name: Run daemon reload to make Quadlet create the service files
  ansible.builtin.systemd:
    daemon_reload: true

- name: Migrate and seed the Foreman database
  containers.podman.podman_container:
    name: foreman-db-migrate
    image: "{{ foreman_container_image }}:{{ foreman_container_tag }}"
    command:
      - bash
      - -c
      - bin/rails db:migrate && bin/rails db:seed
    detach: false
    rm: true
    network: host
    env:
      FOREMAN_ENABLED_PLUGINS: "{{ foreman_plugins | join(' ') }}"
    secrets:
      - 'foreman-database-url,type=env,target=DATABASE_URL'
      - 'foreman-seed-admin-user,type=env,target=SEED_ADMIN_USER'
      - 'foreman-seed-admin-password,type=env,target=SEED_ADMIN_PASSWORD'
      - 'foreman-settings-yaml,type=mount,target=/etc/foreman/settings.yaml'
      - 'foreman-db-ca,type=mount,target={{ foreman_database_ssl_ca_path }}'

- name: Flush handlers to restart services
  ansible.builtin.meta: flush_handlers

- name: Start services
  ansible.builtin.systemd:
    name: "{{ item }}"
    state: started
  async: 60
  poll: 0
  loop:
    - dynflow-sidekiq@orchestrator
    - dynflow-sidekiq@worker
    - dynflow-sidekiq@worker-hosts-queue
    - foreman

- name: Wait for Foreman service to be accessible
  ansible.builtin.uri:
    url: '{{ foreman_url }}/api/v2/ping'
    validate_certs: false
  until: foreman_status.status == 200
  retries: 60
  delay: 5
  register: foreman_status

- name: Enable & start recurring timers
  when: foreman_recurring_tasks_enabled
  ansible.builtin.systemd:
    name: "foreman-recurring@{{ item.instance }}.timer"
    enabled: true
    state: started
  loop: "{{ foreman_recurring_tasks }}"
  loop_control:
    label: "{{ item.instance }}"

- name: Wait for Foreman tasks to be ready
  ansible.builtin.uri:
    url: '{{ foreman_url }}/api/v2/ping'
    validate_certs: false
  until:
    - foreman_tasks_status.status == 200
    - foreman_tasks_status.json['results']['katello']['services']['foreman_tasks']['status'] == 'ok'
  retries: 60
  delay: 5
  register: foreman_tasks_status
  when:
    - "'katello' in foreman_status.json['results']"

- name: Configure Foreman Proxy
  theforeman.foreman.smart_proxy:
    name: "{{ ansible_facts['fqdn'] }}-pulp"
    url: "https://{{ ansible_facts['fqdn'] }}/pulp/api/v3/smart_proxy"
    server_url: "{{ foreman_url }}"
    username: "{{ foreman_initial_admin_username }}"
    password: "{{ foreman_initial_admin_password }}"
    validate_certs: false