<commit_before>---
- name: Add nginx stable PPA repository
  apt_repository: repo='ppa:nginx/stable'
  when: ansible_lsb.id == "Ubuntu"
  tags:
    - install
    - deps
    - web-server

- name: Install nginx
  apt:  pkg={{ item }}
        state=latest
        update_cache=yes
  with_items:
    - nginx
    - nginx-extras
  tags:
    - web-server
    - deps

- name: Install default nginx configuration
  template: src=nginx-default.conf
            dest=/etc/nginx/nginx.conf
            owner=root
            group=root
            mode=0644
  notify:
    - reload-nginx
  tags:
    - web-server

- name: Disable default website
  file: state=absent
        dest=/etc/nginx/sites-enabled/default
  notify:
    - reload-nginx
  tags:
    - web-server

- name: Create www root directory
  file: state=directory
        dest={{ web_root }}/{{ hostname }}
        owner={{ web_user }}
        group={{ web_user }}
        mode=0755
  tags:
    - web-server

- name: Install backend nginx configuration
  template: src=backend-nginx.conf
            dest=/etc/nginx/sites-available/{{ hostname }}
            owner=root
            group=root
            mode=0644
  notify:
    - reload-nginx
  tags:
    - web-server

- name: Enable backend website
  file: state=link
        src=/etc/nginx/sites-available/{{ hostname }}
        dest=/etc/nginx/sites-enabled/{{ hostname }}
        owner=root
        group=root
  tags:
    - web-server

- name: Install local nginx configuration
  copy: src=nginx-local.conf
        dest=/etc/nginx/conf.d/nginx-local.conf
        owner=root
        group=root
        mode=0644
  notify:
    - reload-nginx
  tags:
    - web-server

- name: Install backend special nginx configuration
  copy: src=nginx-backend.conf
        dest=/etc/nginx/conf.d/nginx-backend.conf
        owner=root
        group=root
        mode=0644
  notify:
    - reload-nginx
  tags:
    - web-server

- name: Install nginx upstream definitions
  template: src=backend-upstreams.conf
            dest=/etc/nginx/conf.d/backend-upstreams.conf
            mode=0644
            owner=root
            group=root
  notify:
    - reload-nginx
  tags:
    - web-server

- name: Does the nginx custom directory exists?
  file: path=/etc/nginx/custom/
        state=directory
        owner=root
        group=root
  notify:
    - reload-nginx
  tags:
    - web-server

- name: Copy backend maintenance configuration
  copy: src=backend-maintenance.conf
        dest=/etc/nginx/custom/backend-maintenance.conf
        owner=root
        group=root
        mode=0644
  notify:
    - reload-nginx
  tags:
    - web-server

- name: Copy backend proxy cache configuration
  copy: src=backend-proxy-cache.conf
        dest=/etc/nginx/custom/backend-proxy-cache.conf
        owner=root
        group=root
        mode=0644
  notify:
    - reload-nginx
  tags:
    - web-server

- name: Copy backend proxy configuration
  copy: src=backend-proxy.conf
        dest=/etc/nginx/custom/backend-proxy.conf
        owner=root
        group=root
        mode=0644
  notify:
    - reload-nginx
  tags:
    - web-server

- name: Copy maintenance page
  copy: src=maintenance.html
        dest={{ web_root }}/{{ hostname }}/maintenance.html.not
        owner={{ app_user }}
        group={{ app_user }}
        mode=0644
  tags:
      - web-server

- name: Copy maintenance page art
  copy: src=kernelci-maintenance.svg
        dest={{ web_root }}/{{ hostname }}/kernelci-maintenance.svg
        owner={{ app_user }}
        group={{ app_user }}
        mode=0644
  tags:
      - web-server

- name: Clone letsencrypt repo
  when: role == "production"
  git:  repo=https://github.com/letsencrypt/letsencrypt.git
        dest={{ install_base }}/letsencrypt
        update=yes
  tags:
    - web-server
    - https

- name: Make sure letsencrypt config directory exists
  when: role == "production"
  file: path=/etc/letsencrypt
        state=directory
        owner=root
        group=root
        mode=0755
  tags:
    - web-server
    - https

- name: Copy letsencrypt config gile
  when: role == "production"
  template: src=cli.ini
            dest=/etc/letsencrypt/cli.ini
            owner=root
            group=root
            mode=0644
  tags:
    - web-server
    - https

- name: Set up cronjob for HTTPS certificates renewal
  when: role == "production"
  cron: name="Renew TLS certificates"
        user=root
        state=present
        job="{{ install_base }}/letsencrypt/letsencrypt-auto renew -c /etc/letsencrypt/cli.ini 1>/dev/null && systemctl reload nginx.service"
        cron_file=letsencrypt-tls-certs
        day=1,15
        hour=3
        minute=10
  tags:
    - web-server
    - cron
    - https

# This is a very loooong task.
# Better doing it directly on the server first.
# For the why: OpenSSL default Diffie-Helman Ephemeral key is only 1024 bits,
# but we use a 4096 bits certificate. That means that who uses DHE algo will
# get weaker keys than non-DH algo.
- name: Create Diffie-Helman key-exchange cert
  when: role == "production"
  shell: openssl dhparam -out /etc/ssl/certs/dhparam.pem 4096
         creates=/etc/ssl/certs/dhparam.pem
  tags:
      - web-server
      - https
  notify:
      - reload-nginx

- name: Check perms on key-exchange cert
  when: role == "production"
  file: path=/etc/ssl/certs/dhparam.pem
        owner=root
        group=root
        mode=0644
  tags:
      - web-server
      - https
<commit_msg>Explicitly set force to git operation in ansible<commit_after>---
- name: Add nginx stable PPA repository
  apt_repository: repo='ppa:nginx/stable'
  when: ansible_lsb.id == "Ubuntu"
  tags:
    - install
    - deps
    - web-server

- name: Install nginx
  apt:  pkg={{ item }}
        state=latest
        update_cache=yes
  with_items:
    - nginx
    - nginx-extras
  tags:
    - web-server
    - deps

- name: Install default nginx configuration
  template: src=nginx-default.conf
            dest=/etc/nginx/nginx.conf
            owner=root
            group=root
            mode=0644
  notify:
    - reload-nginx
  tags:
    - web-server

- name: Disable default website
  file: state=absent
        dest=/etc/nginx/sites-enabled/default
  notify:
    - reload-nginx
  tags:
    - web-server

- name: Create www root directory
  file: state=directory
        dest={{ web_root }}/{{ hostname }}
        owner={{ web_user }}
        group={{ web_user }}
        mode=0755
  tags:
    - web-server

- name: Install backend nginx configuration
  template: src=backend-nginx.conf
            dest=/etc/nginx/sites-available/{{ hostname }}
            owner=root
            group=root
            mode=0644
  notify:
    - reload-nginx
  tags:
    - web-server

- name: Enable backend website
  file: state=link
        src=/etc/nginx/sites-available/{{ hostname }}
        dest=/etc/nginx/sites-enabled/{{ hostname }}
        owner=root
        group=root
  tags:
    - web-server

- name: Install local nginx configuration
  copy: src=nginx-local.conf
        dest=/etc/nginx/conf.d/nginx-local.conf
        owner=root
        group=root
        mode=0644
  notify:
    - reload-nginx
  tags:
    - web-server

- name: Install backend special nginx configuration
  copy: src=nginx-backend.conf
        dest=/etc/nginx/conf.d/nginx-backend.conf
        owner=root
        group=root
        mode=0644
  notify:
    - reload-nginx
  tags:
    - web-server

- name: Install nginx upstream definitions
  template: src=backend-upstreams.conf
            dest=/etc/nginx/conf.d/backend-upstreams.conf
            mode=0644
            owner=root
            group=root
  notify:
    - reload-nginx
  tags:
    - web-server

- name: Does the nginx custom directory exists?
  file: path=/etc/nginx/custom/
        state=directory
        owner=root
        group=root
  notify:
    - reload-nginx
  tags:
    - web-server

- name: Copy backend maintenance configuration
  copy: src=backend-maintenance.conf
        dest=/etc/nginx/custom/backend-maintenance.conf
        owner=root
        group=root
        mode=0644
  notify:
    - reload-nginx
  tags:
    - web-server

- name: Copy backend proxy cache configuration
  copy: src=backend-proxy-cache.conf
        dest=/etc/nginx/custom/backend-proxy-cache.conf
        owner=root
        group=root
        mode=0644
  notify:
    - reload-nginx
  tags:
    - web-server

- name: Copy backend proxy configuration
  copy: src=backend-proxy.conf
        dest=/etc/nginx/custom/backend-proxy.conf
        owner=root
        group=root
        mode=0644
  notify:
    - reload-nginx
  tags:
    - web-server

- name: Copy maintenance page
  copy: src=maintenance.html
        dest={{ web_root }}/{{ hostname }}/maintenance.html.not
        owner={{ app_user }}
        group={{ app_user }}
        mode=0644
  tags:
      - web-server

- name: Copy maintenance page art
  copy: src=kernelci-maintenance.svg
        dest={{ web_root }}/{{ hostname }}/kernelci-maintenance.svg
        owner={{ app_user }}
        group={{ app_user }}
        mode=0644
  tags:
      - web-server

- name: Clone letsencrypt repo
  when: role == "production"
  git:  repo=https://github.com/letsencrypt/letsencrypt.git
        dest={{ install_base }}/letsencrypt
        update=yes
        force=yes
  tags:
    - web-server
    - https

- name: Make sure letsencrypt config directory exists
  when: role == "production"
  file: path=/etc/letsencrypt
        state=directory
        owner=root
        group=root
        mode=0755
  tags:
    - web-server
    - https

- name: Copy letsencrypt config gile
  when: role == "production"
  template: src=cli.ini
            dest=/etc/letsencrypt/cli.ini
            owner=root
            group=root
            mode=0644
  tags:
    - web-server
    - https

- name: Set up cronjob for HTTPS certificates renewal
  when: role == "production"
  cron: name="Renew TLS certificates"
        user=root
        state=present
        job="{{ install_base }}/letsencrypt/letsencrypt-auto renew -c /etc/letsencrypt/cli.ini 1>/dev/null && systemctl reload nginx.service"
        cron_file=letsencrypt-tls-certs
        day=1,15
        hour=3
        minute=10
  tags:
    - web-server
    - cron
    - https

# This is a very loooong task.
# Better doing it directly on the server first.
# For the why: OpenSSL default Diffie-Helman Ephemeral key is only 1024 bits,
# but we use a 4096 bits certificate. That means that who uses DHE algo will
# get weaker keys than non-DH algo.
- name: Create Diffie-Helman key-exchange cert
  when: role == "production"
  shell: openssl dhparam -out /etc/ssl/certs/dhparam.pem 4096
         creates=/etc/ssl/certs/dhparam.pem
  tags:
      - web-server
      - https
  notify:
      - reload-nginx

- name: Check perms on key-exchange cert
  when: role == "production"
  file: path=/etc/ssl/certs/dhparam.pem
        owner=root
        group=root
        mode=0644
  tags:
      - web-server
      - https

{'fraction_non_alphanumeric': 0.10207060111283407, 'fraction_numerical': 0.013682386208154701, 'mean_word_length': 2.0754558204768583, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 5, 'https://': 2, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7579265', 'n_tokens_mistral': 3668, 'n_tokens_neox': 3485, 'n_words': 842}