cloudfall 0.2.0__py3-none-any.whl

cloudfall_engine/_bundled/ansible/ansible.cfg

@@ -0,0 +1,7 @@
+[defaults]
+roles_path = ./roles
+retry_files_enabled = False
+interpreter_python = auto_silent
+
+[ssh_connection]
+pipelining = True

cloudfall_engine/_bundled/ansible/playbooks/backup.yml

@@ -0,0 +1,86 @@
+---
+- name: Run one declared backup operation with a controller receipt
+  hosts: cloudfall_servers
+  become: true
+  gather_facts: true
+  any_errors_fatal: true
+  serial: 1
+  tasks:
+    - name: Select the requested service on this host
+      ansible.builtin.set_fact:
+        cloudfall_backup_matched: >-
+          {{
+            cloudfall_services | default([])
+            | selectattr('id', 'equalto', cloudfall_backup_service)
+            | list
+          }}
+
+    - name: Execute the requested backup action as the service user
+      ansible.builtin.command:
+        argv:
+          - >-
+            /usr/local/sbin/cloudfall-{{ cloudfall_backup_item.serviceKind
+            }}-{{
+              'backup'
+              if cloudfall_backup_action == 'backup'
+              else 'restore-check'
+            }}
+      become: true
+      become_user: >-
+        {{
+          'postgres'
+          if cloudfall_backup_item.serviceKind == 'postgresql'
+          else 'redis'
+        }}
+      loop: "{{ cloudfall_backup_matched }}"
+      loop_control:
+        loop_var: cloudfall_backup_item
+        label: "{{ cloudfall_backup_item.id }}"
+      register: cloudfall_backup_execution
+      changed_when: cloudfall_backup_action == 'backup'
+
+    - name: Ensure the controller receipt directory exists
+      ansible.builtin.file:
+        path: "{{ cloudfall_backup_receipt_directory }}"
+        state: directory
+        mode: "0755"
+      delegate_to: localhost
+      become: false
+      when: cloudfall_backup_matched | length > 0
+
+    - name: Write the backup receipt on the controller
+      ansible.builtin.copy:
+        content: >-
+          {{
+            {
+              'apiVersion': 'cloudfall/v1',
+              'kind': 'BackupReceipt',
+              'metadata': {
+                'id': cloudfall_backup_result.cloudfall_backup_item.id
+                  ~ '-' ~ cloudfall_backup_action,
+                'description':
+                  'Backup operation receipt written by backup.yml',
+              },
+              'spec': {
+                'service': cloudfall_backup_result.cloudfall_backup_item.id,
+                'server': cloudfall_server_id,
+                'action': cloudfall_backup_action,
+                'executedAt': ansible_facts['date_time']['iso8601'],
+                'summary': (
+                  (cloudfall_backup_result.stdout_lines | default([]))[-5:]
+                  | join(' | ')
+                )[:2000] or 'completed',
+              },
+            } | to_nice_json
+          }}
+        dest: >-
+          {{ cloudfall_backup_receipt_directory }}/{{
+            cloudfall_backup_result.cloudfall_backup_item.id
+          }}-{{ cloudfall_backup_action }}.json
+        mode: "0644"
+      delegate_to: localhost
+      become: false
+      loop: "{{ cloudfall_backup_execution.results | default([]) }}"
+      loop_control:
+        loop_var: cloudfall_backup_result
+        label: "{{ cloudfall_backup_result.cloudfall_backup_item.id }}"

cloudfall_engine/_bundled/ansible/playbooks/baseline.yml

@@ -0,0 +1,35 @@
+---
+- name: Converge Cloudfall servers to the managed baseline
+  hosts: cloudfall_servers
+  become: true
+  gather_facts: true
+  any_errors_fatal: true
+  serial: 1
+  vars:
+    cloudfall_bootstrap_component_keys:
+      - id
+      - install_root
+      - application
+      - application_user
+  roles:
+    - role: cloudfall_bootstrap
+      cloudfall_bootstrap_applications: "{{ cloudfall_applications }}"
+      cloudfall_bootstrap_components: >-
+        {{
+          cloudfall_components
+          | map('dict2items')
+          | map('selectattr', 'key', 'in', cloudfall_bootstrap_component_keys)
+          | map('items2dict')
+          | list
+        }}
+    - role: cloudfall_time
+    - role: cloudfall_access
+      cloudfall_access_ssh_public_keys: "{{ cloudfall_ssh_public_keys }}"
+    - role: cloudfall_unattended_upgrades
+  tasks:
+    - name: Enforce the declared firewall
+      ansible.builtin.include_role:
+        name: cloudfall_firewall
+      vars:
+        cloudfall_firewall_ruleset: "{{ cloudfall_firewall }}"
+      when: cloudfall_firewall is defined

cloudfall_engine/_bundled/ansible/playbooks/bootstrap.yml

@@ -0,0 +1,24 @@
+---
+- name: Bootstrap Cloudfall application servers
+  hosts: cloudfall_servers
+  become: true
+  gather_facts: true
+  any_errors_fatal: true
+  serial: 1
+  vars:
+    cloudfall_bootstrap_component_keys:
+      - id
+      - install_root
+      - application
+      - application_user
+  roles:
+    - role: cloudfall_bootstrap
+      cloudfall_bootstrap_applications: "{{ cloudfall_applications }}"
+      cloudfall_bootstrap_components: >-
+        {{
+          cloudfall_components
+          | map('dict2items')
+          | map('selectattr', 'key', 'in', cloudfall_bootstrap_component_keys)
+          | map('items2dict')
+          | list
+        }}

cloudfall_engine/_bundled/ansible/playbooks/data.yml

@@ -0,0 +1,28 @@
+---
+- name: Migrate external data into declared Cloudfall services
+  hosts: cloudfall_servers
+  become: true
+  gather_facts: true
+  any_errors_fatal: true
+  serial: 1
+  tasks:
+    - name: Migrate data into the selected PostgreSQL service
+      ansible.builtin.include_role:
+        name: cloudfall_data_migration
+      vars:
+        cloudfall_data_migration_service: "{{ cloudfall_data_service_item }}"
+        cloudfall_data_migration_database: "{{ cloudfall_data_database }}"
+        cloudfall_data_migration_source_url_file: >-
+          {{ cloudfall_data_source_url_file }}
+        cloudfall_data_migration_receipt_directory: >-
+          {{ cloudfall_data_receipt_directory | default("") }}
+      loop: >-
+        {{
+          cloudfall_services | default([])
+          | selectattr('serviceKind', 'equalto', 'postgresql')
+          | selectattr('id', 'equalto', cloudfall_data_service_id)
+          | list
+        }}
+      loop_control:
+        loop_var: cloudfall_data_service_item
+        label: "{{ cloudfall_data_service_item.id }}"

cloudfall_engine/_bundled/ansible/playbooks/deploy.yml

@@ -0,0 +1,35 @@
+---
+- name: Deploy one Cloudfall component release
+  hosts: cloudfall_servers
+  become: true
+  gather_facts: true
+  any_errors_fatal: true
+  serial: 1
+  pre_tasks:
+    - name: Require an explicit component and release selection
+      ansible.builtin.assert:
+        that:
+          - cloudfall_deploy_component_id is defined
+          - cloudfall_deploy_release is defined
+          - cloudfall_deploy_artifact_archive is defined
+          - cloudfall_deploy_artifact_sha256 is defined
+        fail_msg: >-
+          Deployment requires cloudfall_deploy_component_id,
+          cloudfall_deploy_release, cloudfall_deploy_artifact_archive, and
+          cloudfall_deploy_artifact_sha256 extra variables
+      run_once: true
+  tasks:
+    - name: Deploy the selected component on its declared servers
+      ansible.builtin.include_role:
+        name: cloudfall_deploy
+      vars:
+        cloudfall_deploy_component: "{{ cloudfall_component_item }}"
+      loop: >-
+        {{
+          cloudfall_components | default([])
+          | selectattr('id', 'equalto', cloudfall_deploy_component_id)
+          | list
+        }}
+      loop_control:
+        loop_var: cloudfall_component_item
+        label: "{{ cloudfall_component_item.id }}"

cloudfall_engine/_bundled/ansible/playbooks/domains.yml

@@ -0,0 +1,21 @@
+---
+- name: Deploy declared Cloudfall public domain routes
+  hosts: cloudfall_servers
+  become: true
+  gather_facts: true
+  any_errors_fatal: true
+  serial: 1
+  tasks:
+    - name: Render declared domains as managed virtual hosts
+      ansible.builtin.include_role:
+        name: cloudfall_nginx_site
+      vars:
+        cloudfall_nginx_site_domain: "{{ cloudfall_domain_item }}"
+        cloudfall_nginx_site_issue_certificate: >-
+          {{ cloudfall_domains_issue_certificates | default(false) | bool }}
+        cloudfall_nginx_site_receipt_directory: >-
+          {{ cloudfall_domains_receipt_directory | default("") }}
+      loop: "{{ cloudfall_domains | default([]) }}"
+      loop_control:
+        loop_var: cloudfall_domain_item
+        label: "{{ cloudfall_domain_item.id }}"

cloudfall_engine/_bundled/ansible/playbooks/health.yml

@@ -0,0 +1,31 @@
+---
+- name: Probe one Cloudfall component's declared health check
+  hosts: cloudfall_servers
+  become: false
+  gather_facts: false
+  any_errors_fatal: true
+  pre_tasks:
+    - name: Require an explicit component selection
+      ansible.builtin.assert:
+        that:
+          - cloudfall_deploy_component_id is defined
+        fail_msg: >-
+          Health probing requires the cloudfall_deploy_component_id extra
+          variable
+      run_once: true
+  tasks:
+    - name: Probe the selected component on its declared servers
+      ansible.builtin.include_role:
+        name: cloudfall_deploy
+        tasks_from: health
+      vars:
+        cloudfall_deploy_component: "{{ cloudfall_component_item }}"
+      loop: >-
+        {{
+          cloudfall_components | default([])
+          | selectattr('id', 'equalto', cloudfall_deploy_component_id)
+          | list
+        }}
+      loop_control:
+        loop_var: cloudfall_component_item
+        label: "{{ cloudfall_component_item.id }}"

cloudfall_engine/_bundled/ansible/playbooks/inspect.yml

@@ -0,0 +1,15 @@
+---
+- name: Inspect Cloudfall servers without changing remote state
+  hosts: cloudfall_servers
+  become: true
+  gather_facts: true
+  any_errors_fatal: true
+  serial: 1
+  roles:
+    - role: cloudfall_inspect
+      cloudfall_inspect_server_id: "{{ cloudfall_server_id }}"
+      cloudfall_inspect_server_type: "{{ cloudfall_server_type }}"
+      cloudfall_inspect_logging_backend: >-
+        {{ cloudfall_logging_backend | default({}) }}
+      cloudfall_inspect_components: >-
+        {{ cloudfall_components | default([]) }}

cloudfall_engine/_bundled/ansible/playbooks/logging.yml

@@ -0,0 +1,35 @@
+---
+- name: Validate Cloudfall logging deployment inventory
+  hosts: localhost
+  gather_facts: false
+  tasks:
+    - name: Require one declared logging backend and at least one collector
+      ansible.builtin.assert:
+        that:
+          - groups["cloudfall_logging_backends"] | length == 1
+          - groups["cloudfall_logging_collectors"] | length > 0
+        fail_msg: >-
+          Validated state must declare exactly one logging backend and at least
+          one collector before deployment
+
+- name: Deploy Cloudfall logging backend
+  hosts: cloudfall_logging_backends
+  become: true
+  gather_facts: true
+  any_errors_fatal: true
+  serial: 1
+  roles:
+    - role: cloudfall_logging_backend
+      cloudfall_logging_backend_stack: >-
+        {{ hostvars[inventory_hostname].cloudfall_logging_backend }}
+
+- name: Deploy Cloudfall logging collectors
+  hosts: cloudfall_logging_collectors
+  become: true
+  gather_facts: true
+  any_errors_fatal: true
+  serial: 1
+  roles:
+    - role: cloudfall_logging_collector
+      cloudfall_logging_collector_stack: >-
+        {{ hostvars[inventory_hostname].cloudfall_logging_collector }}

cloudfall_engine/_bundled/ansible/playbooks/restart.yml

@@ -0,0 +1,31 @@
+---
+- name: Restart one Cloudfall component behind its health check
+  hosts: cloudfall_servers
+  become: true
+  gather_facts: true
+  any_errors_fatal: true
+  serial: 1
+  pre_tasks:
+    - name: Require an explicit component selection
+      ansible.builtin.assert:
+        that:
+          - cloudfall_deploy_component_id is defined
+        fail_msg: >-
+          Restart requires the cloudfall_deploy_component_id extra variable
+      run_once: true
+  tasks:
+    - name: Restart the selected component on its declared servers
+      ansible.builtin.include_role:
+        name: cloudfall_deploy
+        tasks_from: restart
+      vars:
+        cloudfall_deploy_component: "{{ cloudfall_component_item }}"
+      loop: >-
+        {{
+          cloudfall_components | default([])
+          | selectattr('id', 'equalto', cloudfall_deploy_component_id)
+          | list
+        }}
+      loop_control:
+        loop_var: cloudfall_component_item
+        label: "{{ cloudfall_component_item.id }}"

cloudfall_engine/_bundled/ansible/playbooks/rollback.yml

@@ -0,0 +1,33 @@
+---
+- name: Roll back one Cloudfall component release
+  hosts: cloudfall_servers
+  become: true
+  gather_facts: true
+  any_errors_fatal: true
+  serial: 1
+  pre_tasks:
+    - name: Require an explicit component and release selection
+      ansible.builtin.assert:
+        that:
+          - cloudfall_deploy_component_id is defined
+          - cloudfall_deploy_release is defined
+        fail_msg: >-
+          Rollback requires cloudfall_deploy_component_id and
+          cloudfall_deploy_release extra variables
+      run_once: true
+  tasks:
+    - name: Roll the selected component back on its declared servers
+      ansible.builtin.include_role:
+        name: cloudfall_deploy
+        tasks_from: rollback
+      vars:
+        cloudfall_deploy_component: "{{ cloudfall_component_item }}"
+      loop: >-
+        {{
+          cloudfall_components | default([])
+          | selectattr('id', 'equalto', cloudfall_deploy_component_id)
+          | list
+        }}
+      loop_control:
+        loop_var: cloudfall_component_item
+        label: "{{ cloudfall_component_item.id }}"

cloudfall_engine/_bundled/ansible/playbooks/services.yml

@@ -0,0 +1,37 @@
+---
+- name: Deploy declared Cloudfall infrastructure services
+  hosts: cloudfall_servers
+  become: true
+  gather_facts: true
+  any_errors_fatal: true
+  serial: 1
+  tasks:
+    - name: Deploy declared PostgreSQL services
+      ansible.builtin.include_role:
+        name: cloudfall_postgresql
+      vars:
+        cloudfall_postgresql_service: "{{ cloudfall_service_item }}"
+      loop: >-
+        {{
+          cloudfall_services | default([])
+          | selectattr('serviceKind', 'equalto', 'postgresql')
+          | list
+        }}
+      loop_control:
+        loop_var: cloudfall_service_item
+        label: "{{ cloudfall_service_item.id }}"
+
+    - name: Deploy declared Redis services
+      ansible.builtin.include_role:
+        name: cloudfall_redis
+      vars:
+        cloudfall_redis_service: "{{ cloudfall_service_item }}"
+      loop: >-
+        {{
+          cloudfall_services | default([])
+          | selectattr('serviceKind', 'equalto', 'redis')
+          | list
+        }}
+      loop_control:
+        loop_var: cloudfall_service_item
+        label: "{{ cloudfall_service_item.id }}"

cloudfall_engine/_bundled/ansible/playbooks/time.yml

@@ -0,0 +1,9 @@
+---
+- name: Enforce the Cloudfall UTC time baseline
+  hosts: cloudfall_servers
+  become: true
+  gather_facts: true
+  any_errors_fatal: true
+  serial: 1
+  roles:
+    - role: cloudfall_time

cloudfall_engine/_bundled/ansible/roles/cloudfall_access/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+cloudfall_access_sshd_drop_in: /etc/ssh/sshd_config.d/00-cloudfall-key-only.conf

cloudfall_engine/_bundled/ansible/roles/cloudfall_access/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: Reload OpenSSH
+  ansible.builtin.systemd_service:
+    name: ssh.service
+    state: reloaded

cloudfall_engine/_bundled/ansible/roles/cloudfall_access/meta/argument_specs.yml

@@ -0,0 +1,34 @@
+---
+argument_specs:
+  main:
+    short_description: Enforce declared key-only SSH access for root
+    options:
+      cloudfall_access_ssh_public_keys:
+        type: list
+        elements: dict
+        required: true
+        options:
+          id:
+            type: str
+            required: true
+          owner:
+            type: str
+            required: true
+          environment:
+            type: str
+            required: true
+          algorithm:
+            type: str
+            required: true
+          publicKey:
+            type: str
+            required: true
+          lifecycle:
+            type: str
+            choices:
+              - active
+              - revoked
+            required: true
+      cloudfall_access_sshd_drop_in:
+        type: path
+        default: /etc/ssh/sshd_config.d/00-cloudfall-key-only.conf

cloudfall_engine/_bundled/ansible/roles/cloudfall_access/meta/main.yml

@@ -0,0 +1,13 @@
+---
+galaxy_info:
+  role_name: cloudfall_access
+  author: Cloudfall
+  description: Install declared SSH keys and enforce key-only root access
+  license: AGPL-3.0-or-later
+  min_ansible_version: "2.21"
+  platforms:
+    - name: Debian
+      versions:
+        - bookworm
+        - trixie
+dependencies: []

cloudfall_engine/_bundled/ansible/roles/cloudfall_access/tasks/main.yml

@@ -0,0 +1,59 @@
+---
+- name: Select active declared SSH keys
+  ansible.builtin.set_fact:
+    cloudfall_access_active_keys: >-
+      {{
+        cloudfall_access_ssh_public_keys
+        | selectattr('lifecycle', 'equalto', 'active')
+        | list
+      }}
+
+- name: Require at least one active declared SSH key
+  ansible.builtin.assert:
+    that:
+      - cloudfall_access_active_keys | length > 0
+    fail_msg: Refusing to disable password access without an active SSH key
+
+- name: Create root SSH configuration directory
+  ansible.builtin.file:
+    path: /root/.ssh
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
+
+- name: Install active root SSH keys
+  ansible.builtin.lineinfile:
+    path: /root/.ssh/authorized_keys
+    line: "{{ item.publicKey }}"
+    create: true
+    owner: root
+    group: root
+    mode: "0600"
+  loop: "{{ cloudfall_access_active_keys }}"
+  loop_control:
+    label: "{{ item.id }}"
+
+- name: Install key-only OpenSSH policy
+  ansible.builtin.copy:
+    dest: "{{ cloudfall_access_sshd_drop_in }}"
+    content: |-
+      # Managed by Cloudfall. Local changes will be overwritten.
+      PubkeyAuthentication yes
+      PasswordAuthentication no
+      KbdInteractiveAuthentication no
+      PermitRootLogin prohibit-password
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Reload OpenSSH
+
+- name: Validate complete OpenSSH configuration
+  ansible.builtin.command:
+    argv:
+      - /usr/sbin/sshd
+      - -t
+  changed_when: false
+
+- name: Apply validated OpenSSH policy
+  ansible.builtin.meta: flush_handlers

cloudfall_engine/_bundled/ansible/roles/cloudfall_bootstrap/defaults/main.yml

@@ -0,0 +1,11 @@
+---
+cloudfall_bootstrap_apps_root: /srv/apps
+cloudfall_bootstrap_packages:
+  - acl
+  - ca-certificates
+  - curl
+  - git
+  - rsync
+  - unzip
+cloudfall_bootstrap_applications: []
+cloudfall_bootstrap_components: []

cloudfall_engine/_bundled/ansible/roles/cloudfall_bootstrap/meta/argument_specs.yml

@@ -0,0 +1,52 @@
+---
+argument_specs:
+  main:
+    short_description: Prepare a Debian host for Cloudfall application deployments
+    options:
+      cloudfall_bootstrap_apps_root:
+        type: path
+        default: /srv/apps
+      cloudfall_bootstrap_packages:
+        type: list
+        elements: str
+        default:
+          - acl
+          - ca-certificates
+          - curl
+          - git
+          - rsync
+          - unzip
+      cloudfall_bootstrap_applications:
+        type: list
+        elements: dict
+        required: true
+        options:
+          id:
+            type: str
+            required: true
+          user:
+            type: str
+            required: true
+          approval:
+            type: str
+            choices:
+              - automatic
+              - manual
+            required: true
+      cloudfall_bootstrap_components:
+        type: list
+        elements: dict
+        required: true
+        options:
+          id:
+            type: str
+            required: true
+          application:
+            type: str
+            required: true
+          application_user:
+            type: str
+            required: true
+          install_root:
+            type: path
+            required: true

cloudfall_engine/_bundled/ansible/roles/cloudfall_bootstrap/meta/main.yml

@@ -0,0 +1,13 @@
+---
+galaxy_info:
+  role_name: cloudfall_bootstrap
+  author: Cloudfall
+  description: Prepare Debian application hosts for Cloudfall deployments
+  license: AGPL-3.0-or-later
+  min_ansible_version: "2.21"
+  platforms:
+    - name: Debian
+      versions:
+        - bookworm
+        - trixie
+dependencies: []