bk node and refactor

ansible/roles/common/tasks/services/set_alloy.yaml

@@ -1,5 +1,5 @@
 ---
-- name: Gather ystem facts (hardware)
+- name: Gather system facts (hardware)
   ansible.builtin.setup:
     gather_subset:
       - hardware
@@ -78,7 +78,7 @@
     - "{{ node['home_path'] }}"
     - "{{ node['home_path'] }}/data"
   become: true
-  when: node['name'] == "app"
+  when: node['name'] in ["bk", "app"]
 
 - name: Enable alloy service
   ansible.builtin.systemd:
@@ -88,9 +88,16 @@
     daemon_reload: true
   become: true
 
+- name: Check alloy.deb on console
+  delegate_to: "console"
+  ansible.builtin.stat:
+    path: "{{ hostvars['console']['node']['data_path'] }}/bin/alloy-{{ version['packages']['alloy'] }}.deb"
+  register: is_console_alloy_deb
+
 - name: Fetch deb bin file
   ansible.builtin.fetch:
     src: "/var/cache/apt/archives/alloy-{{ version['packages']['alloy'] }}.deb"
     dest: "{{ hostvars['console']['node']['data_path'] }}/bin/"
     flat: true
+  when: not is_console_alloy_deb.stat.exists
   become: true

ansible/roles/common/tasks/services/set_caddy.yaml

@@ -1,5 +1,48 @@
 ---
+- name: Initialize Caddy services list
+  ansible.builtin.set_fact:
+    caddy_services: []
+
 # infra, auth, app (vmm, fw has no podman in it)
+- name: Set Caddy infra services list
+  ansible.builtin.set_fact:
+    caddy_services: >-
+      {{
+        services
+        | dict2items
+        | selectattr('value.dependency.web', 'defined')
+        | selectattr('value.dependency.web', 'in', ['infra-internal', 'infra-public'])
+        | map(attribute='key')
+        | list
+      }}
+  when: node['name'] == 'infra'
+
+- name: Set Caddy auth services list
+  ansible.builtin.set_fact:
+    caddy_services: >-
+      {{
+        services
+        | dict2items
+        | selectattr('value.dependency.web', 'defined')
+        | selectattr('value.dependency.web', 'in', ['auth-public', 'infra-public', 'app-public'])
+        | map(attribute='key')
+        | list
+      }}
+  when: node['name'] == 'auth'
+
+- name: Set Caddy app services list
+  ansible.builtin.set_fact:
+    caddy_services: >-
+      {{
+        services
+        | dict2items
+        | selectattr('value.dependency.web', 'defined')
+        | selectattr('value.dependency.web', 'in', ['app-internal', 'app-public'])
+        | map(attribute='key')
+        | list
+      }}
+  when: node['name'] == 'app'
+
 - name: Create caddy directory
   ansible.builtin.file:
     path: "{{ node['home_path'] }}/containers/{{ item }}"
@@ -50,6 +93,8 @@
     owner: "{{ ansible_user }}"
     group: "{{ node['group'] }}"
     mode: "0640"
+  register: "is_caddy_containerfile"
+  notify: "notification_restart_caddy"
 
 - name: Deploy root crt for build
   ansible.builtin.copy:
@@ -58,6 +103,8 @@
     owner: "{{ ansible_user }}"
     group: "{{ node['group'] }}"
     mode: "0640"
+  register: "is_caddy_root_crt"
+  notify: "notification_restart_caddy"
   no_log: true
 
 - name: Build caddy container image
@@ -67,6 +114,7 @@
     tag: "{{ version['containers']['caddy'] }}"
     state: "build"
     path: "{{ node['home_path'] }}/containers/caddy/build"
+    force: "{{ is_caddy_root_crt.changed or is_caddy_containerfile.changed }}"
 
 - name: Prune caddy dangling images
   containers.podman.podman_prune:
@@ -74,7 +122,7 @@
 
 - name: Deploy caddyfile
   ansible.builtin.template:
-    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/common/caddy/etc/{{ node['name'] }}/Caddyfile.j2"
+    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/common/caddy/etc/Caddyfile.j2"
     dest: "{{ node['home_path'] }}/containers/caddy/etc/Caddyfile"
     owner: "{{ ansible_user }}"
     group: "{{ node['group'] }}"
@@ -109,8 +157,8 @@
       - "{{ domain['internal'] }}/{{ node['name'] }}/caddy:{{ version['containers']['caddy'] }}"
     dest: "{{ node['home_path'] }}/archives/containers/{{ domain['internal'] }}_{{ node['name'] }}_caddy_{{ version['containers']['caddy'] }}.tar"
     format: "oci-archive"
-    force: false
-  when: not container_archive_images.stat.exists
+    force: "{{ is_caddy_root_crt.changed or is_caddy_containerfile.changed }}"
+  when: not container_archive_images.stat.exists or is_caddy_root_crt.changed or is_caddy_containerfile.changed
 
 - name: Fetch container archive images
   ansible.builtin.fetch:

ansible/roles/common/tasks/services/set_crowdsec.yaml

@@ -120,8 +120,8 @@
       no_log: true
 
     - name: Get existing machines list
-      ansible.builtin.command:
-        cmd: "cscli machines list -o json"
+      ansible.builtin.command: |
+        cscli machines list -o json
       become: true
       changed_when: false
       register: "existing_crowdsec_machines_list"
@@ -132,27 +132,27 @@
 
     - name: Set goal machines' name
       ansible.builtin.set_fact:
-        machines_name: ["fw", "vmm", "infra", "auth", "app"]
+        machines_name: ["fw", "vmm", "bk", "infra", "auth", "app"]
       no_log: true
 
     - name: Prune unknown (random) machines
-      ansible.builtin.command:
-        cmd: "cscli machines delete {{ item }}"
+      ansible.builtin.command: |
+        cscli machines delete {{ item }}
       loop: "{{ existing_machines_name | difference(machines_name) }}"
       become: true
       changed_when: true
 
     - name: Register crowdsec machines to LAPI server
-      ansible.builtin.command:
-        cmd: "cscli machines add {{ item }} --password {{ hostvars['console']['crowdsec']['machine'][item] }} --force -f /dev/null"
+      ansible.builtin.command: |
+        cscli machines add {{ item }} --password {{ hostvars['console']['crowdsec']['machine'][item] }} --force -f /dev/null
       loop: "{{ machines_name }}"
       become: true
       changed_when: false
       no_log: true
 
     - name: Get existing bouncers list
-      ansible.builtin.command:
-        cmd: "cscli bouncers list -o json"
+      ansible.builtin.command: |
+        cscli bouncers list -o json
       become: true
       register: "existing_crowdsec_bouncers_list"
       changed_when: false
@@ -162,8 +162,8 @@
         existing_bouncers_name: "{{ existing_crowdsec_bouncers_list.stdout | from_json | map(attribute='name') | list }}"
 
     - name: Flush bouncers
-      ansible.builtin.command:
-        cmd: "cscli bouncers delete {{ item }}"
+      ansible.builtin.command: |
+        cscli bouncers delete {{ item }}
       loop: "{{ existing_bouncers_name }}"
       become: true
       changed_when: true
@@ -173,8 +173,8 @@
         bouncers_name: ["fw", "caddy"]
 
     - name: Register Firewall Bouncer to LAPI
-      ansible.builtin.command:
-        cmd: "cscli bouncers add {{ item }}-bouncer -k {{ hostvars['console']['crowdsec']['bouncer'][item] }}"
+      ansible.builtin.command: |
+        cscli bouncers add {{ item }}-bouncer -k {{ hostvars['console']['crowdsec']['bouncer'][item] }}
       loop: "{{ bouncers_name }}"
       become: true
       changed_when: true
@@ -185,8 +185,8 @@
   when: node['name'] in acquisd_list
   block:
     - name: Install crowdsec collection
-      ansible.builtin.command:
-        cmd: "cscli collections install {{ item }}"
+      ansible.builtin.command: |
+        cscli collections install {{ item }}
       loop: "{{ acquisd_list[node['name']]['collection'] }}"
       become: true
       changed_when: "'overwrite' not in is_collection_installed.stderr"
@@ -196,8 +196,8 @@
       register: "is_collection_installed"
 
     - name: Install crowdsec parser
-      ansible.builtin.command:
-        cmd: "cscli parsers install {{ item }}"
+      ansible.builtin.command: |
+        cscli parsers install {{ item }}
       loop: "{{ acquisd_list[node['name']]['parser'] }}"
       become: true
       changed_when: "'overwrite' not in is_parser_installed.stderr"

ansible/roles/common/tasks/services/set_kopia.yaml

@@ -5,50 +5,288 @@
       - hardware
   become: true
 
-- name: Set console kopia
-  when: node['name'] == 'console'
+- name: Set backup kopia repository server
+  when: node['name'] == "bk"
   block:
-    - name: Download kopia
+    - name: Download kopia deb file (x86_64)
       ansible.builtin.get_url:
         url: "https://github.com/kopia/kopia/releases/download/v{{ version['packages']['kopia'] }}/\
-          kopia_{{ version['packages']['kopia'] }}_linux_{{ item }}.deb"
-        dest: "{{ node['data_path'] }}/bin/kopia-{{ version['packages']['kopia'] }}-{{ item }}.deb"
-        owner: "{{ ansible_user }}"
-        group: "{{ node['group'] }}"
-        mode: "0600"
-      loop:
-        - "amd64"
-        - "arm64"
-
-    - name: Install kopia (x86_64)
-      ansible.builtin.apt:
-        deb: "{{ node['data_path'] }}/bin/kopia-{{ version['packages']['kopia'] }}-amd64.deb"
-        state: "present"
+          kopia_{{ version['packages']['kopia'] }}_linux_amd64.deb"
+        dest: "/var/cache/apt/archives/kopia-{{ version['packages']['kopia'] }}.deb"
+        owner: "root"
+        group: "root"
+        mode: "0644"
       become: true
       when: ansible_facts['architecture'] == "x86_64"
 
-    - name: Install kopia (aarch64)
-      ansible.builtin.apt:
-        deb: "{{ node['data_path'] }}/bin/kopia-{{ version['packages']['kopia'] }}-arm64.deb"
-        state: "present"
+    - name: Download kopia deb file (aarch64)
+      ansible.builtin.get_url:
+        url: "https://github.com/kopia/kopia/releases/download/v{{ version['packages']['kopia'] }}/\
+          kopia_{{ version['packages']['kopia'] }}_linux_arm64.deb"
+        dest: "/var/cache/apt/archives/kopia-{{ version['packages']['kopia'] }}.deb"
+        owner: "root"
+        group: "root"
+        mode: "0644"
       become: true
       when: ansible_facts['architecture'] == "aarch64"
 
-    - name: Connect console kopia server
-      environment:
-        KOPIA_PASSWORD: "{{ hostvars['console']['kopia']['users']['console'] }}"
-      ansible.builtin.shell: |
-        /usr/bin/kopia repository connect server \
-        --url=https://{{ services['kopia']['domain'] }}.{{ domain['internal'] }}:{{ services['kopia']['ports']['https'] }} \
-        --override-username=console \
-        --override-hostname=console.{{ domain['internal'] }}
-      changed_when: false
-      failed_when: is_kopia_connected.rc != 0
-      register: "is_kopia_connected"
+    - name: Create kopia directory
+      ansible.builtin.file:
+        path: "{{ item.name }}"
+        state: "directory"
+        owner: "{{ ansible_user }}"
+        group: "root"
+        mode: "{{ item.mode }}"
+      loop:
+        - name: "/etc/kopia"
+          mode: "0700"
+        - name: "/etc/kopia/ssl"
+          mode: "0700"
+        - name: "/var/cache/kopia"
+          mode: "0700"
+      become: true
       no_log: true
 
-- name: Set infra/app kopia
-  when: node['name'] in ['infra', 'app']
+    - name: Install kopia
+      ansible.builtin.apt:
+        deb: "/var/cache/apt/archives/kopia-{{ version['packages']['kopia'] }}.deb"
+        state: "present"
+      become: true
+
+    - name: Deploy kopia env
+      ansible.builtin.template:
+        src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/common/kopia/kopia.env.j2"
+        dest: "/etc/secrets/{{ node['uid'] }}/kopia.env"
+        owner: "{{ ansible_user }}"
+        group: "root"
+        mode: "0400"
+      become: true
+      notify: "notification_restart_kopia_server"
+      no_log: true
+
+    - name: Deploy kopia certificate and key
+      ansible.builtin.copy:
+        content: |
+          {{ item.value }}
+        dest: "/etc/kopia/ssl/{{ item.name }}"
+        owner: "{{ ansible_user }}"
+        group: "{{ node['group'] }}"
+        mode: "{{ item.mode }}"
+      loop:
+        - name: "kopia.crt"
+          value: |
+            {{ hostvars['console']['kopia']['crt'] | trim }}
+            {{ hostvars['console']['ca']['intermediate']['crt'] }}
+          mode: "0440"
+        - name: "kopia.key"
+          value: "{{ hostvars['console']['kopia']['key'] }}"
+          mode: "0400"
+      notify: "notification_restart_kopia_server"
+      no_log: true
+
+    - name: Check repository existance
+      ansible.builtin.stat:
+        path: "{{ node['home_path'] }}/data/kopia/repository"
+      register: "is_kopia_repository"
+
+    - name: Create repository directory
+      ansible.builtin.file:
+        path: "{{ node['home_path'] }}/data/kopia/repository"
+        state: "directory"
+        owner: "{{ ansible_user }}"
+        group: "{{ node['group'] }}"
+        mode: "0770"
+      when: not is_kopia_repository.stat.exists
+
+    - name: Create kopia repository
+      ansible.builtin.shell: |
+        set -a
+        . /etc/secrets/{{ node['uid'] }}/kopia.env
+        set +a
+        /usr/bin/kopia repository create filesystem \
+        --path="{{ node['home_path'] }}/data/kopia/repository" \
+        --description="ilnmors.internal kopia repository" \
+        --create-only
+      when: not is_kopia_repository.stat.exists
+      changed_when: true
+      register: "is_repository_created"
+      no_log: true
+
+    - name: Connect to kopia repository
+      ansible.builtin.shell: |
+        set -a
+        . /etc/secrets/{{ node['uid'] }}/kopia.env
+        set +a
+        /usr/bin/kopia repository connect filesystem \
+        --path="{{ node['home_path'] }}/data/kopia/repository" \
+        --override-username="il" \
+        --override-hostname="{{ node['name'] }}.{{ domain['internal'] }}" \
+      when:
+        - not is_kopia_repository.stat.exists
+        - is_repository_created.rc == 0
+      changed_when: true
+      register: "is_repository_connected"
+      no_log: true
+
+    - name: Create kopia user
+      ansible.builtin.shell: |
+        set -a
+        . /etc/secrets/{{ node['uid'] }}/kopia.env
+        set +a
+        /usr/bin/kopia server users add \
+        --user-password {{ item.password | quote }} \
+        {{ item.name }}
+      loop:
+        - name: "console@console.ilnmors.internal"
+          password: "{{ hostvars['console']['kopia']['users']['console'] }}"
+        - name: "infra@infra.ilnmors.internal"
+          password: "{{ hostvars['console']['kopia']['users']['infra'] }}"
+        - name: "app@app.ilnmors.internal"
+          password: "{{ hostvars['console']['kopia']['users']['app'] }}"
+      when:
+        - not is_kopia_repository.stat.exists
+        - is_repository_connected.rc == 0
+      changed_when: true
+      register: "is_user_created"
+      no_log: true
+
+    - name: Set kopia console ACL
+      ansible.builtin.shell: |
+        set -a
+        . /etc/secrets/{{ node['uid'] }}/kopia.env
+        set +a
+        /usr/bin/kopia server acl add \
+        --user console@console.ilnmors.internal \
+        --target {{ item }} \
+        --access FULL
+      loop:
+        - "type=snapshot"
+        - "type=policy"
+        - "type=user"
+        - "type=acl"
+        - "type=content"
+      when:
+        - not is_kopia_repository.stat.exists
+        - is_repository_connected.rc == 0
+      changed_when: true
+      no_log: true
+
+    - name: Set kopia infra ACL
+      ansible.builtin.shell: |
+        set -a
+        . /etc/secrets/{{ node['uid'] }}/kopia.env
+        set +a
+        /usr/bin/kopia server acl add \
+        --user infra@infra.ilnmors.internal \
+        --target {{ item.target }} \
+        --access {{ item.access }}
+      loop:
+        - target: "type=snapshot"
+          access: "FULL"
+        - target: "type=policy"
+          access: "READ"
+        - target: "type=policy,username=infra,hostname=infra.ilnmors.internal"
+          access: "FULL"
+        - target: "type=content"
+          access: "APPEND"
+      when:
+        - not is_kopia_repository.stat.exists
+        - is_repository_connected.rc == 0
+      changed_when: true
+      no_log: true
+
+    - name: Set kopia app ACL
+      ansible.builtin.shell: |
+        set -a
+        . /etc/secrets/{{ node['uid'] }}/kopia.env
+        set +a
+        /usr/bin/kopia server acl add \
+        --user app@app.ilnmors.internal \
+        --target {{ item.target }} \
+        --access {{ item.access }}
+      loop:
+        - target: "type=snapshot"
+          access: "FULL"
+        - target: "type=policy"
+          access: "READ"
+        - target: "type=policy,username=app,hostname=app.ilnmors.internal"
+          access: "FULL"
+        - target: "type=content"
+          access: "APPEND"
+      when:
+        - not is_kopia_repository.stat.exists
+        - is_repository_connected.rc == 0
+      changed_when: true
+      no_log: true
+
+    - name: Set kopia policy
+      ansible.builtin.shell: |
+        set -a
+        . /etc/secrets/{{ node['uid'] }}/kopia.env
+        set +a
+        /usr/bin/kopia policy set \
+        {{ item.content }}
+      loop:
+        - content: |
+            --global \
+            --compression=zstd
+        - content: |
+            infra@infra.ilnmors.internal \
+            --compression=zstd \
+            --keep-latest=10 \
+            --keep-hourly=0 \
+            --keep-daily=14 \
+            --keep-weekly=4 \
+            --keep-monthly=6 \
+            --keep-annual=1
+        - content: |
+            app@app.ilnmors.internal \
+            --compression=none \
+            --keep-latest=10 \
+            --keep-hourly=0 \
+            --keep-daily=14 \
+            --keep-weekly=4 \
+            --keep-monthly=6 \
+            --keep-annual=1
+      when:
+        - not is_kopia_repository.stat.exists
+        - is_repository_connected.rc == 0
+      changed_when: true
+      no_log: true
+
+    - name: Set kopia parameters
+      ansible.builtin.shell: |
+        set -a
+        . /etc/secrets/{{ node['uid'] }}/kopia.env
+        set +a
+        /usr/bin/kopia repository set-parameters \
+        --max-pack-size-mb=100
+      when:
+        - not is_kopia_repository.stat.exists
+        - is_repository_connected.rc == 0
+      changed_when: true
+      no_log: true
+
+    - name: Deploy kopia servcer service file
+      ansible.builtin.template:
+        src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/common/kopia/kopia-server.service.j2"
+        dest: "{{ node['home_path'] }}/.config/systemd/user/kopia-server.service"
+        owner: "{{ ansible_user }}"
+        group: "{{ node['group'] }}"
+        mode: "0644"
+        validate: "/usr/bin/systemd-analyze verify %s"
+      become: true
+
+    - name: Enable kopia server service
+      ansible.builtin.systemd:
+        name: "kopia-server.service"
+        state: "started"
+        enabled: true
+        scope: "user"
+        daemon_reload: true
+
+- name: Set infra/app backup kopia
+  when: node['name'] in ["infra", "app"]
   block:
     - name: Set kopia uid
       ansible.builtin.set_fact:
@@ -127,7 +365,7 @@
       become: true
       no_log: true
 
-    - name: Deploy kopia service files
+    - name: Deploy kopia backup service files
       ansible.builtin.template:
         src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/common/kopia/{{ item }}.j2"
         dest: "/etc/systemd/system/{{ item }}"
@@ -140,10 +378,52 @@
         - "kopia-backup.timer"
       become: true
 
-    - name: Enable auto kopia rules update
+    - name: Enable Kopia backup timer
       ansible.builtin.systemd:
         name: "kopia-backup.timer"
         state: "started"
         enabled: true
         daemon_reload: true
       become: true
+
+- name: Set console kopia
+  when: node['name'] == "console"
+  block:
+    - name: Download kopia
+      ansible.builtin.get_url:
+        url: "https://github.com/kopia/kopia/releases/download/v{{ version['packages']['kopia'] }}/\
+          kopia_{{ version['packages']['kopia'] }}_linux_{{ item }}.deb"
+        dest: "{{ node['data_path'] }}/bin/kopia-{{ version['packages']['kopia'] }}-{{ item }}.deb"
+        owner: "{{ ansible_user }}"
+        group: "{{ node['group'] }}"
+        mode: "0600"
+      loop:
+        - "amd64"
+        - "arm64"
+
+    - name: Install kopia (x86_64)
+      ansible.builtin.apt:
+        deb: "{{ node['data_path'] }}/bin/kopia-{{ version['packages']['kopia'] }}-amd64.deb"
+        state: "present"
+      become: true
+      when: ansible_facts['architecture'] == "x86_64"
+
+    - name: Install kopia (aarch64)
+      ansible.builtin.apt:
+        deb: "{{ node['data_path'] }}/bin/kopia-{{ version['packages']['kopia'] }}-arm64.deb"
+        state: "present"
+      become: true
+      when: ansible_facts['architecture'] == "aarch64"
+
+    - name: Connect console kopia server
+      environment:
+        KOPIA_PASSWORD: "{{ hostvars['console']['kopia']['users']['console'] }}"
+      ansible.builtin.shell: |
+        /usr/bin/kopia repository connect server \
+        --url=https://{{ services['kopia']['domain']['internal'] }}.{{ domain['internal'] }}:443 \
+        --override-username=console \
+        --override-hostname=console.{{ domain['internal'] }}
+      changed_when: false
+      failed_when: is_kopia_connected.rc != 0
+      register: "is_kopia_connected"
+      no_log: true