From 75815cf9b3f9f424b844d495f83f6e127a077c1b Mon Sep 17 00:00:00 2001 From: "M.A. Matienzo" Date: Wed, 27 Apr 2022 14:12:32 -0700 Subject: [PATCH 1/3] Recover from failed tasks when download fails on VM This provides a workaround for cases when fetching the rights app release fails given Conostix firewall issues. It fetches the requested release locally and then uploads the release's ZIP file to the expected location using scp. --- .gitignore | 1 + app_deploy.yml | 8 ++++++++ local_app_download.yml | 10 ++++++++++ tmp/.keep | 0 4 files changed, 19 insertions(+) create mode 100644 .gitignore create mode 100644 local_app_download.yml create mode 100644 tmp/.keep diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..3fec32c --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +tmp/ diff --git a/app_deploy.yml b/app_deploy.yml index d9da633..0ae1fa0 100644 --- a/app_deploy.yml +++ b/app_deploy.yml @@ -25,6 +25,14 @@ sudo: yes sudo_user: "{{ deployment_user }}" environment: "{{ proxy_env }}" + register: download_result + ignore_errors: true + + - name: Fall back on downloading rights-app locally and uploading via scp + include: local_app_download.yml + vars: + rights_app_release_local: "{{ rights_app_release }}" + when: download_result.failed - stat: path="{{ rights_app_dest }}/rights-app-dist.zip" register: download diff --git a/local_app_download.yml b/local_app_download.yml new file mode 100644 index 0000000..55f1943 --- /dev/null +++ b/local_app_download.yml @@ -0,0 +1,10 @@ +- name: Clear local download + local_action: file path="tmp/rights-app-dist.zip" state=absent + +- name: Download rights-app release locally + local_action: get_url url="{{ rights_app_repo_url }}/releases/download/{{ rights_app_release_local }}/rights-app-dist.zip" dest="tmp/rights-app-dist.zip" + +- name: Upload local rights-app download to server + copy: src=tmp/rights-app-dist.zip dest="{{ rights_app_dest }}/rights-app-dist.zip" + sudo: yes + sudo_user: "{{ deployment_user }}" \ No newline at end of file diff --git a/tmp/.keep b/tmp/.keep new file mode 100644 index 0000000..e69de29 From a661675e8c68bb42f9a0b476d2831fe4ab9cc500 Mon Sep 17 00:00:00 2001 From: "M.A. Matienzo" Date: Wed, 27 Apr 2022 14:35:19 -0700 Subject: [PATCH 2/3] Add CI workflow --- .github/workflows/ci.yml | 14 ++++++++++++++ app_deploy.yml | 2 +- .../app/tasks/local_app_download.yml | 0 3 files changed, 15 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/ci.yml rename local_app_download.yml => roles/app/tasks/local_app_download.yml (100%) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..572e29f --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,14 @@ +name: Run continuous integration + +on: [push, pull_request] + +jobs: + build: + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v2 + + - name: Lint Ansible playbooks + uses: ansible/ansible-lint-action@v6 \ No newline at end of file diff --git a/app_deploy.yml b/app_deploy.yml index 0ae1fa0..2a394ba 100644 --- a/app_deploy.yml +++ b/app_deploy.yml @@ -29,7 +29,7 @@ ignore_errors: true - name: Fall back on downloading rights-app locally and uploading via scp - include: local_app_download.yml + include: roles/app/tasks/local_app_download.yml vars: rights_app_release_local: "{{ rights_app_release }}" when: download_result.failed diff --git a/local_app_download.yml b/roles/app/tasks/local_app_download.yml similarity index 100% rename from local_app_download.yml rename to roles/app/tasks/local_app_download.yml From 094833b1ce95ca8e99d4a14b53949f92347e4a5f Mon Sep 17 00:00:00 2001 From: "M.A. Matienzo" Date: Thu, 28 Apr 2022 10:54:16 -0700 Subject: [PATCH 3/3] Fix deploy script handling of download failure; add placeholder virtualenv --- .gitignore | 1 + README.md | 19 +++++++++++++++++++ app_deploy.yml | 3 ++- requirements.txt | 14 ++++++++++++++ venv/.keep | 0 5 files changed, 36 insertions(+), 1 deletion(-) create mode 100644 requirements.txt create mode 100644 venv/.keep diff --git a/.gitignore b/.gitignore index 3fec32c..d779e4c 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ tmp/ +venv/ diff --git a/README.md b/README.md index 67a077f..7293d78 100644 --- a/README.md +++ b/README.md @@ -25,3 +25,22 @@ To configure HTTPS, copy certificate, key and chain file to the server and provi $ ansible-playbook -i staging proxy.yml --extra-vars "proxy_ssl_cert=/path/to/cert proxy_ssl_key=/path/to/key proxy_ssl_chain=/path/to/chain" This will create an Apache virtual host that listens on port 443 and proxies as described above. Additionally, non-HTTPS URLs will be rewritten to HTTPS. + + +## Caveats + +These playbooks currently require Ansible 1.9, which is older and less supported. You may want to use an optional virtual environment for use that will also allow you to install its dependencies. + + $ virtualenv venv + $ source venv/bin/activate + $ pip install -r requirements.txt + +If you are still using Python 2.7, you may need to install `virtualenv` first: + + $ pip install virtualenv + +To exit out of the virtual environment: + + $ deactivate + +There is an [open issue](https://github.com/rightsstatements/rights-deploy/issues/24) to upgrade Ansible to a more recent release. \ No newline at end of file diff --git a/app_deploy.yml b/app_deploy.yml index 2a394ba..6ed844e 100644 --- a/app_deploy.yml +++ b/app_deploy.yml @@ -3,6 +3,7 @@ roles: - common #- java + tasks: - name: Install unzip @@ -32,7 +33,7 @@ include: roles/app/tasks/local_app_download.yml vars: rights_app_release_local: "{{ rights_app_release }}" - when: download_result.failed + when: download_result.state == "absent" - stat: path="{{ rights_app_dest }}/rights-app-dist.zip" register: download diff --git a/requirements.txt b/requirements.txt new file mode 100644 index 0000000..896fdfc --- /dev/null +++ b/requirements.txt @@ -0,0 +1,14 @@ +ansible==1.9.6 +bcrypt==3.1.7 +cffi==1.15.0 +cryptography==3.3.2 +enum34==1.1.10 +ipaddress==1.0.23 +Jinja2==2.11.3 +MarkupSafe==1.1.1 +paramiko==2.10.4 +pycparser==2.21 +pycrypto==2.6.1 +PyNaCl==1.4.0 +PyYAML==5.4.1 +six==1.16.0 diff --git a/venv/.keep b/venv/.keep new file mode 100644 index 0000000..e69de29