cloudfall 0.2.0__py3-none-any.whl

cloudfall_engine/_bundled/ansible/roles/cloudfall_nginx_site/tasks/main.yml

@@ -0,0 +1,212 @@
+---
+- name: Validate domain target and declaration
+  ansible.builtin.assert:
+    that:
+      - ansible_facts["distribution"] == "Debian"
+      - ansible_facts["service_mgr"] == "systemd"
+      - cloudfall_nginx_site_domain.proxy.server == cloudfall_server_id
+      - cloudfall_nginx_site_domain.proxy.upstream is defined
+      - cloudfall_nginx_site_domain.tls.mode in ["disabled", "required"]
+    fail_msg: >-
+      Domain deployment requires its declared Debian proxy server and a
+      declared upstream endpoint
+
+- name: Install Nginx and Certbot
+  ansible.builtin.apt:
+    name:
+      - nginx
+      - certbot
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+
+- name: Create the ACME challenge webroot
+  ansible.builtin.file:
+    path: "{{ cloudfall_nginx_site_acme_webroot }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Inspect existing certificate material
+  ansible.builtin.stat:
+    path: >-
+      /etc/letsencrypt/live/{{
+        cloudfall_nginx_site_domain.primaryName
+      }}/fullchain.pem
+    follow: true
+    get_checksum: false
+  register: cloudfall_nginx_site_certificate
+
+# The TLS server block references certificate files, so on a host without
+# them the vhost first goes live HTTP-only. That serves the ACME challenge
+# location, which is exactly what webroot issuance needs; the vhost is
+# re-rendered with TLS after the certificate exists.
+- name: Determine whether TLS can be enabled before issuance
+  ansible.builtin.set_fact:
+    cloudfall_nginx_site_tls_active: >-
+      {{
+        cloudfall_nginx_site_domain.tls.mode == "required"
+        and cloudfall_nginx_site_certificate.stat.exists
+      }}
+
+- name: Render the managed virtual host
+  ansible.builtin.template:
+    src: domain-site.conf.j2
+    dest: "{{ cloudfall_nginx_site_domain.proxy.configurationPath }}"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Reload Nginx
+
+- name: Enable the managed virtual host
+  ansible.builtin.file:
+    src: "{{ cloudfall_nginx_site_domain.proxy.configurationPath }}"
+    dest: >-
+      /etc/nginx/sites-enabled/{{
+        cloudfall_nginx_site_domain.proxy.configurationPath | basename
+      }}
+    state: link
+  notify: Reload Nginx
+  when: >-
+    cloudfall_nginx_site_domain.proxy.configurationPath.startswith(
+      '/etc/nginx/sites-available/'
+    )
+
+- name: Enable Nginx
+  ansible.builtin.systemd_service:
+    name: nginx.service
+    enabled: true
+    state: started
+
+- name: Validate the Nginx configuration before issuance
+  ansible.builtin.command:
+    argv:
+      - /usr/sbin/nginx
+      - -t
+  changed_when: false
+  when: not ansible_check_mode
+
+- name: Serve the ACME challenge location before issuance
+  ansible.builtin.meta: flush_handlers
+
+- name: Issue the declared certificate
+  ansible.builtin.command:
+    argv: >-
+      {{
+        [
+          '/usr/bin/certbot', 'certonly', '--webroot',
+          '--webroot-path', cloudfall_nginx_site_acme_webroot,
+          '--non-interactive', '--agree-tos',
+          '--register-unsafely-without-email',
+          '--cert-name', cloudfall_nginx_site_domain.primaryName,
+        ]
+        + (
+          [cloudfall_nginx_site_domain.primaryName]
+          + cloudfall_nginx_site_domain.aliases
+        )
+        | map('regex_replace', '^', '--domain=')
+        | list
+      }}
+  changed_when: true
+  when:
+    - not ansible_check_mode
+    - cloudfall_nginx_site_domain.tls.mode == "required"
+    - cloudfall_nginx_site_issue_certificate
+    - not cloudfall_nginx_site_certificate.stat.exists
+
+- name: Re-inspect certificate material after issuance
+  ansible.builtin.stat:
+    path: >-
+      /etc/letsencrypt/live/{{
+        cloudfall_nginx_site_domain.primaryName
+      }}/fullchain.pem
+    follow: true
+    get_checksum: false
+  register: cloudfall_nginx_site_certificate
+
+- name: Determine whether TLS can be enabled
+  ansible.builtin.set_fact:
+    cloudfall_nginx_site_tls_active: >-
+      {{
+        cloudfall_nginx_site_domain.tls.mode == "required"
+        and cloudfall_nginx_site_certificate.stat.exists
+      }}
+
+- name: Render the managed virtual host with issued material
+  ansible.builtin.template:
+    src: domain-site.conf.j2
+    dest: "{{ cloudfall_nginx_site_domain.proxy.configurationPath }}"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Reload Nginx
+
+- name: Enable the certificate renewal timer
+  ansible.builtin.systemd_service:
+    name: certbot.timer
+    enabled: true
+    state: started
+  when: cloudfall_nginx_site_domain.tls.mode == "required"
+
+- name: Validate the complete Nginx configuration
+  ansible.builtin.command:
+    argv:
+      - /usr/sbin/nginx
+      - -t
+  changed_when: false
+  when: not ansible_check_mode
+
+- name: Apply the validated virtual host
+  ansible.builtin.meta: flush_handlers
+
+- name: Hash the applied configuration for the receipt
+  ansible.builtin.stat:
+    path: "{{ cloudfall_nginx_site_domain.proxy.configurationPath }}"
+    checksum_algorithm: sha256
+  register: cloudfall_nginx_site_applied
+  when:
+    - not ansible_check_mode
+    - cloudfall_nginx_site_receipt_directory | length > 0
+
+- name: Ensure the controller receipt directory exists
+  ansible.builtin.file:
+    path: "{{ cloudfall_nginx_site_receipt_directory }}"
+    state: directory
+    mode: "0755"
+  delegate_to: localhost
+  become: false
+  when: cloudfall_nginx_site_receipt_directory | length > 0
+
+- name: Write the deployment receipt on the controller
+  ansible.builtin.copy:
+    content: >-
+      {{
+        {
+          'apiVersion': 'cloudfall/v1',
+          'kind': 'DeploymentReceipt',
+          'metadata': {
+            'id': cloudfall_nginx_site_domain.id,
+            'description': 'Deployment receipt written by cloudfall_nginx_site',
+          },
+          'spec': {
+            'domain': cloudfall_nginx_site_domain.id,
+            'server': cloudfall_server_id,
+            'deployedAt': ansible_facts['date_time']['iso8601'],
+            'configurationPath':
+              cloudfall_nginx_site_domain.proxy.configurationPath,
+            'configurationSha256':
+              cloudfall_nginx_site_applied.stat.checksum,
+          },
+        } | to_nice_json
+      }}
+    dest: >-
+      {{ cloudfall_nginx_site_receipt_directory }}/{{
+        cloudfall_nginx_site_domain.id
+      }}.json
+    mode: "0644"
+  delegate_to: localhost
+  become: false
+  when:
+    - not ansible_check_mode
+    - cloudfall_nginx_site_receipt_directory | length > 0

cloudfall_engine/_bundled/ansible/roles/cloudfall_nginx_site/templates/domain-site.conf.j2

@@ -0,0 +1,54 @@
+# Managed by Cloudfall. Local changes will be overwritten.
+{% set names = (
+    [cloudfall_nginx_site_domain.primaryName]
+    + cloudfall_nginx_site_domain.aliases
+  ) | join(' ') %}
+{% set upstream_address = cloudfall_nginx_site_domain.proxy.upstream.address %}
+{% set upstream_host = '[' ~ upstream_address ~ ']'
+    if ':' in upstream_address else upstream_address %}
+{% macro proxy_location() %}
+    location / {
+        proxy_http_version 1.1;
+        proxy_pass http://{{ upstream_host }}:{{ cloudfall_nginx_site_domain.proxy.upstream.port }};
+        proxy_pass_request_headers on;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Port $server_port;
+    }
+{% endmacro %}
+server {
+    listen 80;
+    listen [::]:80;
+    server_name {{ names }};
+
+    location /.well-known/acme-challenge/ {
+        root {{ cloudfall_nginx_site_acme_webroot }};
+    }
+
+{% if cloudfall_nginx_site_tls_active %}
+    location / {
+        return 301 https://$host$request_uri;
+    }
+{% else %}
+{{ proxy_location() -}}
+{% endif %}
+}
+{% if cloudfall_nginx_site_tls_active %}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_name {{ names }};
+
+    ssl_certificate /etc/letsencrypt/live/{{ cloudfall_nginx_site_domain.primaryName }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ cloudfall_nginx_site_domain.primaryName }}/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_session_tickets off;
+
+{{ proxy_location() -}}
+}
+{% endif %}

cloudfall_engine/_bundled/ansible/roles/cloudfall_postgresql/defaults/main.yml

@@ -0,0 +1,6 @@
+---
+cloudfall_postgresql_metrics_role: alloy
+cloudfall_postgresql_repository_key_url: >-
+  https://www.postgresql.org/media/keys/ACCC4CF8.asc
+cloudfall_postgresql_repository_key_path: /etc/apt/keyrings/postgresql.asc
+cloudfall_postgresql_repository_url: https://apt.postgresql.org/pub/repos/apt

cloudfall_engine/_bundled/ansible/roles/cloudfall_postgresql/handlers/main.yml

@@ -0,0 +1,9 @@
+---
+- name: Restart PostgreSQL
+  ansible.builtin.systemd_service:
+    name: >-
+      postgresql@{{
+        cloudfall_postgresql_service.postgresql.majorVersion
+      }}-main.service
+    state: restarted
+    daemon_reload: true

cloudfall_engine/_bundled/ansible/roles/cloudfall_postgresql/meta/argument_specs.yml

@@ -0,0 +1,91 @@
+---
+argument_specs:
+  main:
+    short_description: Converge one declared PostgreSQL service
+    options:
+      cloudfall_postgresql_service:
+        type: dict
+        required: true
+        options:
+          id:
+            type: str
+            required: true
+          serviceKind:
+            type: str
+            choices:
+              - postgresql
+            required: true
+          environment:
+            type: str
+            required: true
+          server:
+            type: str
+            required: true
+          bind:
+            type: dict
+            required: true
+            options:
+              address:
+                type: str
+                choices:
+                  - 127.0.0.1
+                required: true
+              port:
+                type: int
+                required: true
+          postgresql:
+            type: dict
+            required: true
+            options:
+              majorVersion:
+                type: str
+                required: true
+              packageVersion:
+                type: str
+              databases:
+                type: list
+                elements: dict
+                required: true
+                options:
+                  name:
+                    type: str
+                    required: true
+                  application:
+                    type: str
+                    required: true
+                  owner:
+                    type: str
+                    required: true
+          backup:
+            type: dict
+            required: true
+            options:
+              directory:
+                type: path
+                required: true
+              onCalendar:
+                type: str
+                required: true
+              restoreCheckOnCalendar:
+                type: str
+              retentionDays:
+                type: int
+                required: true
+          metrics:
+            type: dict
+            options:
+              enabled:
+                type: bool
+                required: true
+      cloudfall_postgresql_metrics_role:
+        type: str
+        default: alloy
+      cloudfall_postgresql_repository_key_url:
+        type: str
+        default: https://www.postgresql.org/media/keys/ACCC4CF8.asc
+      cloudfall_postgresql_repository_key_path:
+        type: path
+        default: /etc/apt/keyrings/postgresql.asc
+      cloudfall_postgresql_repository_url:
+        type: str
+        default: https://apt.postgresql.org/pub/repos/apt

cloudfall_engine/_bundled/ansible/roles/cloudfall_postgresql/meta/main.yml

@@ -0,0 +1,13 @@
+---
+galaxy_info:
+  role_name: cloudfall_postgresql
+  author: Cloudfall
+  description: Install a declared loopback PostgreSQL service with backups
+  license: AGPL-3.0-or-later
+  min_ansible_version: "2.21"
+  platforms:
+    - name: Debian
+      versions:
+        - bookworm
+        - trixie
+dependencies: []

cloudfall_engine/_bundled/ansible/roles/cloudfall_postgresql/tasks/main.yml

@@ -0,0 +1,295 @@
+---
+- name: Validate PostgreSQL service target and declaration
+  ansible.builtin.assert:
+    that:
+      - ansible_facts["distribution"] == "Debian"
+      - ansible_facts["service_mgr"] == "systemd"
+      - cloudfall_postgresql_service.serviceKind == "postgresql"
+      - cloudfall_postgresql_service.server == cloudfall_server_id
+      - cloudfall_postgresql_service.bind.address == "127.0.0.1"
+      - cloudfall_postgresql_service.postgresql.databases | length > 0
+    fail_msg: >-
+      PostgreSQL deployment requires its declared Debian server and a
+      loopback-only bind address
+
+- name: Validate the declared backup calendar expression
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/systemd-analyze
+      - calendar
+      - "{{ cloudfall_postgresql_service.backup.onCalendar }}"
+  changed_when: false
+
+- name: Install PostgreSQL repository prerequisites
+  ansible.builtin.apt:
+    name:
+      - ca-certificates
+      - gnupg
+      - python3-debian
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+
+- name: Create APT keyring directory
+  ansible.builtin.file:
+    path: /etc/apt/keyrings
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Install PostgreSQL repository signing key
+  ansible.builtin.get_url:
+    url: "{{ cloudfall_postgresql_repository_key_url }}"
+    dest: "{{ cloudfall_postgresql_repository_key_path }}"
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Configure the PGDG package repository
+  ansible.builtin.deb822_repository:
+    name: postgresql
+    types:
+      - deb
+    uris:
+      - "{{ cloudfall_postgresql_repository_url }}"
+    suites:
+      - "{{ ansible_facts['distribution_release'] }}-pgdg"
+    components:
+      - main
+    signed_by: "{{ cloudfall_postgresql_repository_key_path }}"
+    state: present
+
+- name: Install the pinned PostgreSQL server
+  ansible.builtin.apt:
+    name: >-
+      {{
+        'postgresql-' ~ cloudfall_postgresql_service.postgresql.majorVersion
+        ~ '=' ~ cloudfall_postgresql_service.postgresql.packageVersion
+        if 'packageVersion' in cloudfall_postgresql_service.postgresql
+        else 'postgresql-'
+        ~ cloudfall_postgresql_service.postgresql.majorVersion
+      }}
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+    policy_rc_d: 101
+
+- name: Install the managed cluster configuration
+  ansible.builtin.template:
+    src: cloudfall.conf.j2
+    dest: >-
+      /etc/postgresql/{{
+        cloudfall_postgresql_service.postgresql.majorVersion
+      }}/main/conf.d/cloudfall.conf
+    owner: root
+    group: postgres
+    mode: "0640"
+  notify: Restart PostgreSQL
+
+- name: Enable and start the PostgreSQL cluster
+  ansible.builtin.systemd_service:
+    name: >-
+      postgresql@{{
+        cloudfall_postgresql_service.postgresql.majorVersion
+      }}-main.service
+    enabled: true
+    state: started
+    daemon_reload: true
+
+- name: Apply the validated cluster configuration
+  ansible.builtin.meta: flush_handlers
+
+- name: Wait for PostgreSQL readiness
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/pg_isready
+      - --quiet
+      - --host
+      - "{{ cloudfall_postgresql_service.bind.address }}"
+      - --port
+      - "{{ cloudfall_postgresql_service.bind.port }}"
+  register: cloudfall_postgresql_readiness
+  changed_when: false
+  retries: 12
+  delay: 5
+  until: cloudfall_postgresql_readiness.rc == 0
+  when: not ansible_check_mode
+
+- name: Read existing PostgreSQL roles
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/psql
+      - --port
+      - "{{ cloudfall_postgresql_service.bind.port }}"
+      - --tuples-only
+      - --no-align
+      - --command
+      - SELECT rolname FROM pg_roles
+  become: true
+  become_user: postgres
+  register: cloudfall_postgresql_existing_roles
+  changed_when: false
+  when: not ansible_check_mode
+
+- name: Create missing application login roles
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/psql
+      - --port
+      - "{{ cloudfall_postgresql_service.bind.port }}"
+      - --command
+      - CREATE ROLE "{{ item }}" LOGIN
+  become: true
+  become_user: postgres
+  loop: >-
+    {{
+      cloudfall_postgresql_service.postgresql.databases
+      | map(attribute='owner')
+      | unique
+      | list
+    }}
+  when:
+    - not ansible_check_mode
+    - item not in cloudfall_postgresql_existing_roles.stdout_lines
+  changed_when: true
+
+- name: Create the metrics monitoring role
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/psql
+      - --port
+      - "{{ cloudfall_postgresql_service.bind.port }}"
+      - --command
+      - CREATE ROLE "{{ cloudfall_postgresql_metrics_role }}" LOGIN
+  become: true
+  become_user: postgres
+  when:
+    - not ansible_check_mode
+    - "'metrics' in cloudfall_postgresql_service"
+    - >-
+      cloudfall_postgresql_metrics_role
+      not in cloudfall_postgresql_existing_roles.stdout_lines
+  changed_when: true
+
+- name: Grant pg_monitor to the metrics monitoring role
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/psql
+      - --port
+      - "{{ cloudfall_postgresql_service.bind.port }}"
+      - --command
+      - GRANT pg_monitor TO "{{ cloudfall_postgresql_metrics_role }}"
+  become: true
+  become_user: postgres
+  when:
+    - not ansible_check_mode
+    - "'metrics' in cloudfall_postgresql_service"
+  changed_when: false
+
+- name: Read existing PostgreSQL databases
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/psql
+      - --port
+      - "{{ cloudfall_postgresql_service.bind.port }}"
+      - --tuples-only
+      - --no-align
+      - --command
+      - SELECT datname FROM pg_database
+  become: true
+  become_user: postgres
+  register: cloudfall_postgresql_existing_databases
+  changed_when: false
+  when: not ansible_check_mode
+
+- name: Create missing application databases
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/psql
+      - --port
+      - "{{ cloudfall_postgresql_service.bind.port }}"
+      - --command
+      - CREATE DATABASE "{{ item.name }}" OWNER "{{ item.owner }}"
+  become: true
+  become_user: postgres
+  loop: "{{ cloudfall_postgresql_service.postgresql.databases }}"
+  loop_control:
+    label: "{{ item.name }}"
+  when:
+    - not ansible_check_mode
+    - item.name not in cloudfall_postgresql_existing_databases.stdout_lines
+  changed_when: true
+
+- name: Create the backup directory
+  ansible.builtin.file:
+    path: "{{ cloudfall_postgresql_service.backup.directory }}"
+    state: directory
+    owner: postgres
+    group: postgres
+    mode: "0700"
+
+- name: Install the backup script
+  ansible.builtin.template:
+    src: backup.sh.j2
+    dest: /usr/local/sbin/cloudfall-postgresql-backup
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Install the restore-check script
+  ansible.builtin.template:
+    src: restore-check.sh.j2
+    dest: /usr/local/sbin/cloudfall-postgresql-restore-check
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Install the backup service unit
+  ansible.builtin.template:
+    src: backup.service.j2
+    dest: /etc/systemd/system/cloudfall-postgresql-backup.service
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Install the backup timer unit
+  ansible.builtin.template:
+    src: backup.timer.j2
+    dest: /etc/systemd/system/cloudfall-postgresql-backup.timer
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Enable the backup timer
+  ansible.builtin.systemd_service:
+    name: cloudfall-postgresql-backup.timer
+    enabled: true
+    state: started
+    daemon_reload: true
+
+- name: Install the restore-drill service unit
+  ansible.builtin.template:
+    src: restore-check.service.j2
+    dest: /etc/systemd/system/cloudfall-postgresql-restore-check.service
+    owner: root
+    group: root
+    mode: "0644"
+  when: cloudfall_postgresql_service.backup.restoreCheckOnCalendar is defined
+
+- name: Install the restore-drill timer unit
+  ansible.builtin.template:
+    src: restore-check.timer.j2
+    dest: /etc/systemd/system/cloudfall-postgresql-restore-check.timer
+    owner: root
+    group: root
+    mode: "0644"
+  when: cloudfall_postgresql_service.backup.restoreCheckOnCalendar is defined
+
+- name: Enable the restore-drill timer
+  ansible.builtin.systemd_service:
+    name: cloudfall-postgresql-restore-check.timer
+    enabled: true
+    state: started
+    daemon_reload: true
+  when: cloudfall_postgresql_service.backup.restoreCheckOnCalendar is defined

cloudfall_engine/_bundled/ansible/roles/cloudfall_postgresql/templates/backup.service.j2

@@ -0,0 +1,11 @@
+# Managed by Cloudfall. Local changes will be overwritten.
+[Unit]
+Description=Cloudfall PostgreSQL backup for {{ cloudfall_postgresql_service.id }}
+After=postgresql@{{ cloudfall_postgresql_service.postgresql.majorVersion }}-main.service
+Requires=postgresql@{{ cloudfall_postgresql_service.postgresql.majorVersion }}-main.service
+
+[Service]
+Type=oneshot
+User=postgres
+Group=postgres
+ExecStart=/usr/local/sbin/cloudfall-postgresql-backup