mirror of
https://github.com/fscotto/infra.git
synced 2026-10-03 13:29:58 +00:00
62 lines
2.2 KiB
YAML
62 lines
2.2 KiB
YAML
---
|
|
- name: Validate the Prometheus Gitea SSH cutover inputs
|
|
tags: [services, gitea_cutover]
|
|
ansible.builtin.assert:
|
|
that:
|
|
- server_gitea_cutover_tools_enabled | bool
|
|
- server_gitea_atlas_address is match('^[0-9]{1,3}(\.[0-9]{1,3}){3}$')
|
|
- server_gitea_ssh_public_port | int > 1024
|
|
- server_gitea_ssh_public_port | int < 65536
|
|
- server_gitea_ssh_target_port | int > 1024
|
|
- server_gitea_ssh_target_port | int < 65536
|
|
- server_gitea_ssh_public_port | int != 22
|
|
fail_msg: Keep administrative SSH on 22 and provide the Atlas rootless Gitea SSH endpoint.
|
|
when: server_gitea_on_atlas | bool
|
|
|
|
- name: Install the Gitea SSH socket proxy units without activating them
|
|
tags: [services, gitea_cutover]
|
|
ansible.builtin.template:
|
|
src: "{{ item }}.j2"
|
|
dest: "/etc/systemd/system/{{ item }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
loop:
|
|
- prometheus-gitea-ssh-proxy.socket
|
|
- prometheus-gitea-ssh-proxy.service
|
|
loop_control:
|
|
label: "{{ item }}"
|
|
register: server_gitea_ssh_proxy_units
|
|
when: server_gitea_cutover_tools_enabled | bool
|
|
|
|
- name: Reload systemd after Gitea SSH proxy unit changes
|
|
tags: [services, gitea_cutover]
|
|
ansible.builtin.systemd:
|
|
daemon_reload: true
|
|
when:
|
|
- server_gitea_cutover_tools_enabled | bool
|
|
- server_gitea_ssh_proxy_units is changed
|
|
- not ansible_check_mode
|
|
|
|
- name: Manage the public Gitea SSH socket separately from administrative SSH
|
|
tags: [services, gitea_cutover]
|
|
ansible.builtin.systemd:
|
|
name: prometheus-gitea-ssh-proxy.socket
|
|
state: "{{ 'started' if server_gitea_on_atlas | bool else 'stopped' }}"
|
|
enabled: "{{ server_gitea_on_atlas | bool }}"
|
|
when:
|
|
- server_gitea_cutover_tools_enabled | bool
|
|
- not ansible_check_mode
|
|
|
|
- name: Open only the public Gitea SSH port after cutover
|
|
tags: [services, gitea_cutover]
|
|
ansible.posix.firewalld:
|
|
port: "{{ server_gitea_ssh_public_port }}/tcp"
|
|
zone: "{{ server_firewalld_zone }}"
|
|
state: "{{ 'enabled' if server_gitea_on_atlas | bool else 'disabled' }}"
|
|
permanent: true
|
|
immediate: true
|
|
when:
|
|
- server_gitea_cutover_tools_enabled | bool
|
|
- server_firewall_backend == 'firewalld'
|