<commit_before>---
- include_vars: /etc/puppet/hiera/sf/sfcreds.yaml
- include_vars: /etc/puppet/hiera/sf/_arch.yaml

- name: "sf: create basic directories"
  file: path={{ item }} state=directory mode=0755
  with_items:
    - /var/lib/software-factory
    - /etc/software-factory
    - /usr/share/software-factory
    - /usr/libexec/software-factory
    - /usr/share/software-factory

- name: "sf: create log directory"
  file: path=/var/log/software-factory state=directory mode=0700

- name: "system: manage /etc/hosts"
  template: src=/etc/ansible/templates/etc-hosts.j2 dest=/etc/hosts mode=0644

- name: "system: remove unused ip address if present"
  known_hosts: name='[192.168.135.101]:29418' state=absent

- name: "system: remove unused localhost entry if present"
  known_hosts: name='[localhost]:29418' state=absent

- name: "system: disable root password login"
  user: name=root password="*"

- name: "system: remove requiretty from sudoers"
  lineinfile: dest=/etc/sudoers state=absent regexp="^Defaults.*requiretty"

- name: "system: set /etc/ssh/ssh_known_hosts for all inventory"
  template:
    src=global_known_hosts.j2
    dest=/etc/ssh/ssh_known_hosts
    owner=root group=root mode=0644

- name: "system: allow install-server to connect"
  authorized_key:
    user: root
    key: "{{ service_rsa_pub }}"

- name: "system: allow apache to connect database"
  seboolean: name={{ item }} state=yes persistent=yes
  with_items: [httpd_can_network_connect, httpd_can_network_connect_db]
  when: selinuxenabled

- name: "system: install wait4 scripts"
  copy: src={{ item }} dest=/usr/libexec/{{ item }} mode=0555
  with_items: [wait4port, wait4mariadb, wait4gerrit]

- name: "rsyslog: configure ommail (mail output module)"
  template: src=mail-ssh-login.j2 dest=/etc/rsyslog.d/mail-ssh-login.conf
  register: rsyslog_config

- name: "rsyslog: manage service"
  service: name=rsyslog state=restarted
  when: rsyslog_config|changed

- name: "auth: create cauth_keys directory"
  file: path=/srv/cauth_keys state=directory mode=0755

- name: "auth: install pubkey.pem"
  copy:
      content: "{{ pubkey_pem }}"
      dest: "/srv/cauth_keys/pubkey.pem"
      mode: 0444
      setype: httpd_sys_content_t

- name: "auth: install tkt apache module configuration"
  copy:
      content: "LoadModule auth_pubtkt_module modules/mod_auth_pubtkt.so\n"
      dest: /etc/httpd/conf.modules.d/00-tkt.conf
      mode: 0444

- name: "auth: install tkt apache pubtkt configuration"
  copy:
      content: "TKTAuthPublicKey /srv/cauth_keys/pubkey.pem\n"
      dest: /etc/httpd/conf.d/auth_pubtkt.conf
      mode: 0444

- name: "Set edeploy server ip address"
  lineinfile:
      dest: /var/lib/edeploy/conf
      regexp: ^RSERV=
      line: "RSERV={{ edeploy_server }}"

- name: "Set edeploy server port"
  lineinfile:
      dest: /var/lib/edeploy/conf
      regexp: ^RSERV_PORT=
      line: "RSERV_PORT={{ edeploy_service_port }}"

- name: "Set ntp server"
  template: src=ntp.conf.j2 dest=/etc/ntp.conf
  register: ntp_config

- name: "ntpd: manage service"
  service:
      name: ntpd
      enabled: true
      state: restarted
  when: ntp_config|changed

- name: "Add localCA to pki trust"
  copy:
      content: "{{ localCA_pem }}"
      dest: "/etc/pki/ca-trust/source/anchors/localCA.pem"
      mode: 0644
      owner: root
      group: root
  register: new_crt

- name: "Trust crt"
  shell: update-ca-trust
  when: new_crt|changed

- name: "Update CA list for python-requests"
  copy:
      src: /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
      dest: "{{ item }}/cacert.pem"
      mode: 0444
      owner: root
      group: root
  when: new_crt|changed
  with_items:
    - /usr/lib/python2.7/site-packages/requests/
    - /var/www/managesf/lib/python2.7/site-packages/requests/<commit_msg>tls: install requests CA in all venv<commit_after>---
- include_vars: /etc/puppet/hiera/sf/sfcreds.yaml
- include_vars: /etc/puppet/hiera/sf/_arch.yaml

- name: "sf: create basic directories"
  file: path={{ item }} state=directory mode=0755
  with_items:
    - /var/lib/software-factory
    - /etc/software-factory
    - /usr/share/software-factory
    - /usr/libexec/software-factory
    - /usr/share/software-factory

- name: "sf: create log directory"
  file: path=/var/log/software-factory state=directory mode=0700

- name: "system: manage /etc/hosts"
  template: src=/etc/ansible/templates/etc-hosts.j2 dest=/etc/hosts mode=0644

- name: "system: remove unused ip address if present"
  known_hosts: name='[192.168.135.101]:29418' state=absent

- name: "system: remove unused localhost entry if present"
  known_hosts: name='[localhost]:29418' state=absent

- name: "system: disable root password login"
  user: name=root password="*"

- name: "system: remove requiretty from sudoers"
  lineinfile: dest=/etc/sudoers state=absent regexp="^Defaults.*requiretty"

- name: "system: set /etc/ssh/ssh_known_hosts for all inventory"
  template:
    src=global_known_hosts.j2
    dest=/etc/ssh/ssh_known_hosts
    owner=root group=root mode=0644

- name: "system: allow install-server to connect"
  authorized_key:
    user: root
    key: "{{ service_rsa_pub }}"

- name: "system: allow apache to connect database"
  seboolean: name={{ item }} state=yes persistent=yes
  with_items: [httpd_can_network_connect, httpd_can_network_connect_db]
  when: selinuxenabled

- name: "system: install wait4 scripts"
  copy: src={{ item }} dest=/usr/libexec/{{ item }} mode=0555
  with_items: [wait4port, wait4mariadb, wait4gerrit]

- name: "rsyslog: configure ommail (mail output module)"
  template: src=mail-ssh-login.j2 dest=/etc/rsyslog.d/mail-ssh-login.conf
  register: rsyslog_config

- name: "rsyslog: manage service"
  service: name=rsyslog state=restarted
  when: rsyslog_config|changed

- name: "auth: create cauth_keys directory"
  file: path=/srv/cauth_keys state=directory mode=0755

- name: "auth: install pubkey.pem"
  copy:
      content: "{{ pubkey_pem }}"
      dest: "/srv/cauth_keys/pubkey.pem"
      mode: 0444
      setype: httpd_sys_content_t

- name: "auth: install tkt apache module configuration"
  copy:
      content: "LoadModule auth_pubtkt_module modules/mod_auth_pubtkt.so\n"
      dest: /etc/httpd/conf.modules.d/00-tkt.conf
      mode: 0444

- name: "auth: install tkt apache pubtkt configuration"
  copy:
      content: "TKTAuthPublicKey /srv/cauth_keys/pubkey.pem\n"
      dest: /etc/httpd/conf.d/auth_pubtkt.conf
      mode: 0444

- name: "Set edeploy server ip address"
  lineinfile:
      dest: /var/lib/edeploy/conf
      regexp: ^RSERV=
      line: "RSERV={{ edeploy_server }}"

- name: "Set edeploy server port"
  lineinfile:
      dest: /var/lib/edeploy/conf
      regexp: ^RSERV_PORT=
      line: "RSERV_PORT={{ edeploy_service_port }}"

- name: "Set ntp server"
  template: src=ntp.conf.j2 dest=/etc/ntp.conf
  register: ntp_config

- name: "ntpd: manage service"
  service:
      name: ntpd
      enabled: true
      state: restarted
  when: ntp_config|changed

- name: "Add localCA to pki trust"
  copy:
      content: "{{ localCA_pem }}"
      dest: "/etc/pki/ca-trust/source/anchors/localCA.pem"
      mode: 0644
      owner: root
      group: root
  register: new_crt

- name: "Trust crt"
  shell: update-ca-trust
  when: new_crt|changed

- name: "Update CA list for python-requests"
  copy:
      src: /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
      dest: "{{ item }}/cacert.pem"
      mode: 0444
      owner: root
      group: root
  when: new_crt|changed
  with_items:
    - /usr/lib/python2.7/site-packages/requests/
    - /var/www/managesf/lib/python2.7/site-packages/requests/
    - /var/www/cauth/lib/python2.7/site-packages/requests/
    - /srv/sfmanager/lib/python2.7/site-packages/requests/
{'fraction_non_alphanumeric': 0.12833397758020873, 'fraction_numerical': 0.02113129751320706, 'mean_word_length': 3.4052213393870603, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 3, 'xml': 0}, 'pii_count': 2, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3423859', 'n_tokens_mistral': 2990, 'n_tokens_neox': 2815, 'n_words': 621}