playbook-galaxy-stack.yaml

---

- name: Galaxy DB Servers
  hosts: galaxy_db_servers
  roles:
    # FIXME: bootstrap does users now
    # postgresql before users so that the postgres user exists for the group mod in users
    - role: galaxyproject.postgresql
    - role: galaxyproject.general.systemd
    - role: galaxyproject.general.users
    - role: galaxyproject.gxadmin
      tags: gxadmin
    - role: galaxyproject.postgresql_objects
      become: true
      become_user: postgres
  post_tasks:
    - name: Install PostgreSQL contrib package for pgcrypto
      ansible.builtin.dnf:
        name: "postgresql{{ __postgresql_version_dotless }}-contrib"
    - name: Install pgcrypto on Galaxy database
      community.postgresql.postgresql_ext:
        name: pgcrypto
        db: "galaxy_{{ galaxy_instance_codename }}"
      become: true
      become_user: postgres
  tags: postgres

- name: Galaxy Redis Servers
  hosts: galaxy_redis_servers
  roles:
    - geerlingguy.redis
  tags: redis

# TODO: some of these probably make sense as local roles

- name: Galaxy Servers Web Tasks
  hosts: galaxy_servers:galaxy_main_load_balancers
  #vars_files:
  #  # for tiaas_nginx_routes used by templates
  #  - "{{ playbook_dir }}/roles/galaxyproject.tiaas2/defaults/main.yml"
  pre_tasks:
    # Because loading the defaults above clears the tiaas_* vars in group_vars. set as a fact because vars is lower
    # precedence than vars_files
    - ansible.builtin.set_fact:
        tiaas_dir: "/srv/tiaas/{{ galaxy_instance_codename }}"
      when: galaxy_instance_codename is defined
    # Done before nginx is installed because it will fail to start if the module doesn't exist
    - name: Install NGINX upload module
      ansible.builtin.dnf:
        name: "{{ nginx_upload_module_url }}"
        disable_gpg_check: true
      when: nginx_upload_module_url is defined and nginx_upload_module_url
    - name: Install NGINX zip module
      ansible.builtin.get_url:
        url: "{{ nginx_mod_zip_url }}"
        dest: /usr/lib64/nginx/modules/ngx_http_zip_module.so
        mode: 0755
      when: nginx_mod_zip_url is defined
    # This should not be necessary - it is /var/lib/nginx/tmp/proxy, and even setting proxy_temp_path doesn't fix it. I
    # think this is harcoded in the upload module somewhere since it was built from pkg-oss?
    - name: Create /var/cache/nginx/proxy_temp
      file:
        path: /var/cache/nginx/proxy_temp
        owner: "{{ galaxy_user }}"
        mode: "0755"
        state: directory
      when: nginx_upload_module_url is defined
    - name: Grant necessary access to NGINX in SELinux
      ansible.posix.seboolean:
        name: "{{ item }}"
        state: true
        persistent: true
      loop:
        - httpd_can_network_connect
        - httpd_use_fusefs
    # TODO: Lots of silliness with Galaxy being on FUSE, and other things that require a custom module
    - name: Mask setroubleshootd
      ansible.builtin.systemd_service:
        name: setroubleshootd.service
        masked: true
  roles:
    - role: galaxyproject.nginx
  post_tasks:
    # This allows changing the role of galaxy-main* VMs
    - name: Collect list of usegalaxy* NGINX servers
      ansible.builtin.find:
        paths: /etc/nginx/sites-enabled
        patterns: 'usegalaxy*'
        file_type: "link"
        recurse: false
      register: __usegalaxy_servers
    - name: Remove any undefined usegalaxy* NGINX servers
      ansible.builtin.file:
        path: "/etc/nginx/sites-enabled/{{ item | basename }}"
        state: absent
      when: "(item | basename) not in nginx_ssl_servers"
      loop: "{{ __usegalaxy_servers.files | map(attribute='path') }}"
  tags: nginx

- name: Galaxy Servers Additional Tasks
  hosts: galaxy_servers
  handlers:
    - name: Restart systemd-journald
      ansible.builtin.systemd:
        name: systemd-journald
        state: restarted
  tasks:
    - name: Install PolicyKit rule for gxsrc systemctl privileges
      ansible.builtin.template:
        src: polkit/99-galaxy-server.rules.j2
        dest: /etc/polkit-1/rules.d/99-galaxy-server.rules
        owner: root
        group: root
        mode: "0644"
    - name: Install slurm-drmaa
      ansible.builtin.dnf:
        name: "{{ slurm_drmaa_rpm_url }}"
        disable_gpg_check: true
    - name: Remove Galaxy cleanup script
      ansible.builtin.file:
        path: "/srv/galaxy/{{ galaxy_instance_codename }}/bin/cleanup_galaxy_all.sh"
        state: absent
      when: "inventory_hostname not in groups['galaxy_cleanup_servers']"
    - name: Install Galaxy cleanup script
      ansible.builtin.template:
        src: "cron/cleanup_galaxy_all.sh.j2"
        dest: "/srv/galaxy/{{ galaxy_instance_codename }}/bin/cleanup_galaxy_all.sh"
        owner: "{{ galaxy_privileged_user }}"
        group: "{{ galaxy_group }}"
        mode: "0755"
      when: "inventory_hostname in groups['galaxy_cleanup_servers']"
    - name: Set default ACL granting journal access
      ansible.posix.acl:
        path: /var/log/journal
        # This is the ACCESS group
        entity: G-815688
        etype: group
        permissions: rx
        default: true
        recalculate_mask: no_mask
        state: present
    - name: Set ACLs granting journal access
      ansible.posix.acl:
        path: /var/log/journal
        # This is the ACCESS group
        entity: G-815688
        etype: group
        permissions: rx
        default: true
        recalculate_mask: no_mask
        recursive: true
        state: present
    - name: Disable journald rate limits
      community.general.ini_file:
        path: /etc/systemd/journald.conf
        section: Journal
        option: RateLimitIntervalSec
        value: "0"
        no_extra_spaces: true
      notify:
        - Restart systemd-journald
  roles:
    - role: galaxyproject.tusd
    - role: galaxyproject.general.cron
    - role: galaxyproject.general.systemd  # for persistent journald
  post_tasks:
    - name: Collect list of ansible_cron_galaxy_* cron jobs
      ansible.builtin.find:
        paths: /etc/cron.d
        patterns: 'ansible_cron_galaxy_{{ galaxy_instance_codename }}_*'
        file_type: "file"
        recurse: false
      register: __galaxy_cron_jobs
    - name: Remove any undefined ansible_cron_galaxy_* cron jobs
      ansible.builtin.file:
        path: "/etc/cron.d/{{ item | basename }}"
        state: absent
      # flatten because ansible makes a single item response not a list? or a bug in inheritance_chain
      when: "(item | basename | regex_replace('^ansible_cron_', '')) not in ([lookup('galaxyproject.general.inheritance_chain', 'crontabs')] | flatten | map(attribute='id'))"
      loop: "{{ __galaxy_cron_jobs.files | map(attribute='path') }}"
  tags: galaxy

- name: Galaxy Load Balancers Additional Tasks
  hosts: galaxy_test_servers:galaxy_main_load_balancers
  tasks:
    - name: Create logflux venv
      ansible.builtin.pip:
        name:
          - pip
          - setuptools
          - wheel
        state: latest
        virtualenv: /opt/logflux
        virtualenv_command: python3 -m venv --system-site-packages
    - name: Install logflux
      ansible.builtin.pip:
        name: logflux
        version: "{{ logflux_version | default(omit) }}"
        virtualenv: /opt/logflux
    - name: Create logflux config
      ansible.builtin.copy:
        src: files/telegraf/logflux.yaml
        dest: /etc/telegraf/logflux.yaml
        mode: "0644"
        owner: telegraf
        group: telegraf
    - name: Set default ACL granting journal access
      ansible.posix.acl:
        path: /var/log/journal
        entity: "{{ item }}"
        etype: group
        permissions: rx
        default: true
        recalculate_mask: no_mask
        state: present
      loop:
        - telegraf
        - G-815688
    - name: Set ACLs granting journal access
      ansible.posix.acl:
        path: /var/log/journal
        entity: "{{ item }}"
        etype: group
        permissions: rx
        recalculate_mask: no_mask
        recursive: true
        state: present
      loop:
        - telegraf
        - G-815688
  roles:
    - role: galaxyproject.general.systemd  # for persistent journald
  tags: load_balancers

- name: Hashicorp Vault
  hosts: hashicorp_vault_servers
  roles:
    - role: usegalaxy_eu.certbot
    - role: hashicorp_vault
  tags:
    - galaxy
    - vault

- name: Gravity Tasks
  hosts: galaxy_servers
  tasks:
    - name: Create Gravity config dir
      ansible.builtin.file:
        path: /etc/galaxy/gravity.d
        state: directory
        mode: "0755"
        owner: root
        group: root
    - name: Install Gravity config
      ansible.builtin.copy:
        content: "{{ {'gravity': gravity_config} | to_nice_yaml(indent=4) }}"
        dest: "{{ gravity_config_file }}"
        mode: "0644"
        owner: root
        group: root
      notify:
        - galaxyctl update
    - name: Install Gravity
      ansible.builtin.pip:
        name:
          - "{{ gravity_package | default('gravity') }}"
        virtualenv: "{{ gravity_venv_dir }}"
        virtualenv_command: "{{ gravity_virtualenv_command | default(galaxy_virtualenv_command | default(pip_virtualenv_command | default(omit))) }}"
      when: gravity_venv_dir is defined
    - name: Deploy galaxyctl wrapper script
      ansible.builtin.copy:
        content: |
          #!/usr/bin/env sh
          export GRAVITY_CONFIG_FILE={{ gravity_config_file | quote }}
          exec {{ galaxy_gravity_command | quote }} "$@"
        dest: "/usr/sbin/galaxyctl-{{ galaxy_instance_codename }}"
        owner: root
        group: root
        mode: "0755"
  handlers:
    - name: galaxyctl update
      ansible.builtin.command: "{{ galaxy_gravity_command }} update"
      environment:
        GRAVITY_CONFIG_FILE: "{{ gravity_config_file }}"
  tags:
    - gravity

- name: Deploy TIaaS
  hosts: tiaas_servers
  roles:
    - galaxyproject.tiaas2
  tags: tiaas

- name: Galaxy Tailnet
  hosts: galaxy_tailnet_hosts
  roles:
    - role: artis3n.tailscale
  tags: tailscale