Security Update Apollo

apollo.yml

@@ -32,17 +32,19 @@
     - hxr.admin-tools
     - influxdata.chrony
     - hxr.monitor-email
-    - linuxhq.yum_cron
+    #- linuxhq.yum_cron # Deprecated
     - galaxyproject.nginx
     - hxr.autofs
     # BEGIN custom
     - hxr.remap-user
     # Now add custom tomcat user with hardcoded ID. The user info is in group_vars/apollo.yml
-    - hxr.replace-galaxy-user
+    # Tomcat had already ID 999
+    #- hxr.replace-galaxy-user
     - devops.tomcat7
-    # - hxr.gx-cookie-proxy # Currently PANICs, the old version deployed is fine tho
+    - hxr.gx-cookie-proxy # Currently PANICs, the old version deployed is fine tho
+    -                     # It started fine for now
     - hxr.apollo
     # END custom
-    - dj-wasabi.telegraf
+    #- dj-wasabi.telegraf # this role needs to be fixed
     # - dev-sec.os-hardening
     # - dev-sec.ssh-hardening

group_vars/apollo.yml

@@ -39,7 +39,7 @@ apollo_config_jbrowse: |
     jbrowse {
         git {
             url= "https://github.com/GMOD/jbrowse"
-            tag = "1.16.10-release"
+            tag = "1.16.12-release"
             alwaysPull = true
             alwaysRecheck = true
         }

roles/hxr.admin-tools/defaults/main.yml

@@ -15,7 +15,7 @@ admin_packages:
   - net-tools
   - unzip
   - mutt
-  - byobu
+  #- byobu
   - tmpwatch
   - rclone
   # centos specific

roles/hxr.apollo/defaults/main.yml

@@ -1,4 +1,4 @@
-apollo_version: 2.4.1
+apollo_version: 2.8.1
 apollo_tmp_file: "/tmp/apollo-{{ apollo_version }}.zip"
 # do NOT end this with a /
 tomcat_apollo_webapp_dir: /usr/share/tomcat/webapps/apollo

roles/hxr.apollo/tasks/main.yml

@@ -1,26 +1,39 @@
 ---
-#- name: "Fix weird tomcat bug"
-  #command: "yum reinstall -y tomcat-lib"
+- name: "Fix weird tomcat bug"
+  command: "yum reinstall -y tomcat-lib"
 
 - name: Download apollo
   get_url:
     url: "https://usegalaxy.eu/static/vgcn/apollo-{{ apollo_version }}.war"
     dest: "{{ apollo_tmp_file }}"
   register: download
 
+- name: Check if old apollo exists
+  stat:
+    path: "{{ tomcat_apollo_webapp_dir }}"
+  register: apollo_webapp_stat
+
+
+- name: Check if Apollo classes directory exists
+  stat:
+    path: "{{ tomcat_apollo_webapp_dir }}/WEB-INF/classes"
+  register: apollo_classes_stat
+
 - name: Backup old apollo
   copy:
     src: "{{ tomcat_apollo_webapp_dir }}"
     dest: "/tmp/apollo-backup-{{ ansible_date_time.epoch }}"
     remote_src: true
-  when: download.changed
+  when:
+    - apollo_webapp_stat.stat.exists
+    - (download.changed or not apollo_classes_stat.stat.exists)
   notify: 'restart tomcat'
 
 - name: Wipe out old apollo
   file:
     path: "{{ tomcat_apollo_webapp_dir }}"
     state: absent
-  when: download.changed
+  when: download.changed or not apollo_classes_stat.stat.exists
   notify: 'restart tomcat'
 
 - name: Make new root webapp
@@ -29,20 +42,20 @@
     state: directory
     owner: tomcat
     group: tomcat
-  when: download.changed
+  when: download.changed or not apollo_classes_stat.stat.exists
   notify: 'restart tomcat'
 
 - name: Extract new apollo into root webapp.
   unarchive:
     src: "{{ apollo_tmp_file }}"
     dest: "{{ tomcat_apollo_webapp_dir }}"
     remote_src: true
-  when: download.changed
+  when: download.changed or not apollo_classes_stat.stat.exists
   notify: 'restart tomcat'
 
 - name: Fix perms
   command: "chown tomcat:tomcat -R /usr/share/tomcat/webapps/apollo/"
-  when: download.changed
+  when: download.changed or not apollo_classes_stat.stat.exists
   notify: 'restart tomcat'
 
 - name: Deploy config file

roles/hxr.monitor-email/tasks/main.yml

@@ -26,5 +26,5 @@
           - data_format = "influx"
           - interval = "1h"
 
-- set_fact:
-    telegraf_plugins_extra: "{{ telegraf_plugins_extra | combine(plugin_config) }}"
+#- set_fact:
+#    telegraf_plugins_extra: "{{ telegraf_plugins_extra | combine(plugin_config) }}"

roles/hxr.remap-user/tasks/main.yml

@@ -25,7 +25,7 @@
     line: 'input:x:500:'
   when: check_input.rc == 0
 
-- command: "find / -gid 999 -exec chgrp 500 '{}' +"
+- command: "find / ( -path /proc -o -path /sys -o -path /dev -o -path /run ) -prune -o -gid 999 -exec chgrp 500 '{}' +"
   ignore_errors: yes
   when: check_input.rc == 0
 
@@ -41,6 +41,6 @@
     line: 'polkitd:x:500:998:User for polkitd:/:/sbin/nologin'
   when: check_polkitd.rc == 0
 
-- command: "find / -uid 999 -exec chown 500 '{}' +"
+- command: "find / ( -path /proc -o -path /sys -o -path /dev -o -path /run ) -prune -o -uid 999 -exec chown 500 '{}' +"
   ignore_errors: yes
   when: check_polkitd.rc == 0