cloudfall 0.2.0__py3-none-any.whl

cloudfall_engine/_bundled/ansible/roles/cloudfall_postgresql/templates/backup.sh.j2

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Managed by Cloudfall. Local changes will be overwritten.
+set -euo pipefail
+
+backup_directory="{{ cloudfall_postgresql_service.backup.directory }}"
+port="{{ cloudfall_postgresql_service.bind.port }}"
+retention_days="{{ cloudfall_postgresql_service.backup.retentionDays }}"
+timestamp="$(date --utc +%Y%m%dT%H%M%SZ)"
+
+{% for database in cloudfall_postgresql_service.postgresql.databases %}
+pg_dump --port "${port}" --format=custom \
+  --file "${backup_directory}/{{ database.name }}-${timestamp}.dump" \
+  "{{ database.name }}"
+{% endfor %}
+
+find "${backup_directory}" -name '*.dump' -type f \
+  -mtime "+${retention_days}" -delete

cloudfall_engine/_bundled/ansible/roles/cloudfall_postgresql/templates/backup.timer.j2

@@ -0,0 +1,10 @@
+# Managed by Cloudfall. Local changes will be overwritten.
+[Unit]
+Description=Cloudfall PostgreSQL backup schedule for {{ cloudfall_postgresql_service.id }}
+
+[Timer]
+OnCalendar={{ cloudfall_postgresql_service.backup.onCalendar }}
+Persistent=true
+
+[Install]
+WantedBy=timers.target

cloudfall_engine/_bundled/ansible/roles/cloudfall_postgresql/templates/cloudfall.conf.j2

@@ -0,0 +1,3 @@
+# Managed by Cloudfall. Local changes will be overwritten.
+listen_addresses = '{{ cloudfall_postgresql_service.bind.address }}'
+port = {{ cloudfall_postgresql_service.bind.port }}

cloudfall_engine/_bundled/ansible/roles/cloudfall_postgresql/templates/restore-check.service.j2

@@ -0,0 +1,11 @@
+# Managed by Cloudfall. Local changes will be overwritten.
+[Unit]
+Description=Cloudfall PostgreSQL restore drill for {{ cloudfall_postgresql_service.id }}
+After=postgresql@{{ cloudfall_postgresql_service.postgresql.majorVersion }}-main.service
+Requires=postgresql@{{ cloudfall_postgresql_service.postgresql.majorVersion }}-main.service
+
+[Service]
+Type=oneshot
+User=postgres
+Group=postgres
+ExecStart=/usr/local/sbin/cloudfall-postgresql-restore-check

cloudfall_engine/_bundled/ansible/roles/cloudfall_postgresql/templates/restore-check.sh.j2

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Managed by Cloudfall. Local changes will be overwritten.
+# Restores the newest dump of every declared database into a scratch
+# database, counts catalog rows, and drops the scratch database again.
+set -euo pipefail
+
+backup_directory="{{ cloudfall_postgresql_service.backup.directory }}"
+port="{{ cloudfall_postgresql_service.bind.port }}"
+
+{% for database in cloudfall_postgresql_service.postgresql.databases %}
+latest="$(find "${backup_directory}" -name '{{ database.name }}-*.dump' \
+  -type f | sort | tail -n 1)"
+if [ -z "${latest}" ]; then
+  echo "no backup found for {{ database.name }}" >&2
+  exit 1
+fi
+scratch="{{ database.name }}_restore_check"
+dropdb --port "${port}" --if-exists "${scratch}"
+createdb --port "${port}" "${scratch}"
+pg_restore --port "${port}" --dbname "${scratch}" --no-owner \
+  --exit-on-error "${latest}"
+relations="$(psql --port "${port}" --tuples-only --no-align \
+  --command 'SELECT count(*) FROM pg_class' "${scratch}")"
+dropdb --port "${port}" "${scratch}"
+echo "restore check passed for {{ database.name }}:" \
+  "${latest} (${relations} catalog relations)"
+{% endfor %}

cloudfall_engine/_bundled/ansible/roles/cloudfall_postgresql/templates/restore-check.timer.j2

@@ -0,0 +1,10 @@
+# Managed by Cloudfall. Local changes will be overwritten.
+[Unit]
+Description=Cloudfall PostgreSQL restore-drill schedule for {{ cloudfall_postgresql_service.id }}
+
+[Timer]
+OnCalendar={{ cloudfall_postgresql_service.backup.restoreCheckOnCalendar }}
+Persistent=true
+
+[Install]
+WantedBy=timers.target

cloudfall_engine/_bundled/ansible/roles/cloudfall_redis/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+cloudfall_redis_service: {}

cloudfall_engine/_bundled/ansible/roles/cloudfall_redis/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Restart Redis
+  ansible.builtin.systemd_service:
+    name: redis-server.service
+    state: restarted
+    daemon_reload: true

cloudfall_engine/_bundled/ansible/roles/cloudfall_redis/meta/argument_specs.yml

@@ -0,0 +1,68 @@
+---
+argument_specs:
+  main:
+    short_description: Converge one declared Redis service
+    options:
+      cloudfall_redis_service:
+        type: dict
+        required: true
+        options:
+          id:
+            type: str
+            required: true
+          serviceKind:
+            type: str
+            choices:
+              - redis
+            required: true
+          environment:
+            type: str
+            required: true
+          server:
+            type: str
+            required: true
+          bind:
+            type: dict
+            required: true
+            options:
+              address:
+                type: str
+                choices:
+                  - 127.0.0.1
+                required: true
+              port:
+                type: int
+                required: true
+          redis:
+            type: dict
+            required: true
+            options:
+              packageVersion:
+                type: str
+              maxmemoryMb:
+                type: int
+                required: true
+              appendOnly:
+                type: bool
+                required: true
+          backup:
+            type: dict
+            required: true
+            options:
+              directory:
+                type: path
+                required: true
+              onCalendar:
+                type: str
+                required: true
+              restoreCheckOnCalendar:
+                type: str
+              retentionDays:
+                type: int
+                required: true
+          metrics:
+            type: dict
+            options:
+              enabled:
+                type: bool
+                required: true

cloudfall_engine/_bundled/ansible/roles/cloudfall_redis/meta/main.yml

@@ -0,0 +1,13 @@
+---
+galaxy_info:
+  role_name: cloudfall_redis
+  author: cloudfall
+  description: Converge one declared loopback Redis service
+  license: AGPL-3.0-or-later
+  min_ansible_version: "2.16"
+  platforms:
+    - name: Debian
+      versions:
+        - bookworm
+        - trixie
+dependencies: []

cloudfall_engine/_bundled/ansible/roles/cloudfall_redis/tasks/main.yml

@@ -0,0 +1,148 @@
+---
+- name: Validate Redis service target and declaration
+  ansible.builtin.assert:
+    that:
+      - ansible_facts["distribution"] == "Debian"
+      - ansible_facts["service_mgr"] == "systemd"
+      - cloudfall_redis_service.serviceKind == "redis"
+      - cloudfall_redis_service.server == cloudfall_server_id
+      - cloudfall_redis_service.bind.address == "127.0.0.1"
+    fail_msg: >-
+      Redis deployment requires its declared Debian server and a
+      loopback-only bind address
+
+- name: Validate the declared backup calendar expression
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/systemd-analyze
+      - calendar
+      - "{{ cloudfall_redis_service.backup.onCalendar }}"
+  changed_when: false
+
+- name: Install the pinned Redis server
+  ansible.builtin.apt:
+    name: >-
+      {{
+        'redis-server=' ~ cloudfall_redis_service.redis.packageVersion
+        if 'packageVersion' in cloudfall_redis_service.redis
+        else 'redis-server'
+      }}
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+    policy_rc_d: 101
+
+- name: Install the managed Redis configuration
+  ansible.builtin.template:
+    src: cloudfall.conf.j2
+    dest: /etc/redis/cloudfall.conf
+    owner: redis
+    group: redis
+    mode: "0640"
+  notify: Restart Redis
+
+- name: Include the managed configuration from the distribution config
+  ansible.builtin.blockinfile:
+    path: /etc/redis/redis.conf
+    marker: "# {mark} CLOUDFALL MANAGED"
+    append_newline: true
+    prepend_newline: true
+    block: include /etc/redis/cloudfall.conf
+  notify: Restart Redis
+
+- name: Enable and start the Redis server
+  ansible.builtin.systemd_service:
+    name: redis-server.service
+    enabled: true
+    state: started
+    daemon_reload: true
+
+- name: Apply the validated Redis configuration
+  ansible.builtin.meta: flush_handlers
+
+- name: Wait for Redis readiness
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/redis-cli
+      - -p
+      - "{{ cloudfall_redis_service.bind.port }}"
+      - ping
+  register: cloudfall_redis_readiness
+  changed_when: false
+  retries: 12
+  delay: 5
+  until: cloudfall_redis_readiness.stdout == "PONG"
+  when: not ansible_check_mode
+
+- name: Create the backup directory
+  ansible.builtin.file:
+    path: "{{ cloudfall_redis_service.backup.directory }}"
+    state: directory
+    owner: redis
+    group: redis
+    mode: "0700"
+
+- name: Install the backup script
+  ansible.builtin.template:
+    src: backup.sh.j2
+    dest: /usr/local/sbin/cloudfall-redis-backup
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Install the restore-check script
+  ansible.builtin.template:
+    src: restore-check.sh.j2
+    dest: /usr/local/sbin/cloudfall-redis-restore-check
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Install the backup service unit
+  ansible.builtin.template:
+    src: backup.service.j2
+    dest: /etc/systemd/system/cloudfall-redis-backup.service
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Install the backup timer unit
+  ansible.builtin.template:
+    src: backup.timer.j2
+    dest: /etc/systemd/system/cloudfall-redis-backup.timer
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Enable the backup timer
+  ansible.builtin.systemd_service:
+    name: cloudfall-redis-backup.timer
+    enabled: true
+    state: started
+    daemon_reload: true
+
+- name: Install the restore-drill service unit
+  ansible.builtin.template:
+    src: restore-check.service.j2
+    dest: /etc/systemd/system/cloudfall-redis-restore-check.service
+    owner: root
+    group: root
+    mode: "0644"
+  when: cloudfall_redis_service.backup.restoreCheckOnCalendar is defined
+
+- name: Install the restore-drill timer unit
+  ansible.builtin.template:
+    src: restore-check.timer.j2
+    dest: /etc/systemd/system/cloudfall-redis-restore-check.timer
+    owner: root
+    group: root
+    mode: "0644"
+  when: cloudfall_redis_service.backup.restoreCheckOnCalendar is defined
+
+- name: Enable the restore-drill timer
+  ansible.builtin.systemd_service:
+    name: cloudfall-redis-restore-check.timer
+    enabled: true
+    state: started
+    daemon_reload: true
+  when: cloudfall_redis_service.backup.restoreCheckOnCalendar is defined

cloudfall_engine/_bundled/ansible/roles/cloudfall_redis/templates/backup.service.j2

@@ -0,0 +1,11 @@
+# Managed by Cloudfall. Local changes will be overwritten.
+[Unit]
+Description=Cloudfall Redis backup for {{ cloudfall_redis_service.id }}
+After=redis-server.service
+Requires=redis-server.service
+
+[Service]
+Type=oneshot
+User=redis
+Group=redis
+ExecStart=/usr/local/sbin/cloudfall-redis-backup

cloudfall_engine/_bundled/ansible/roles/cloudfall_redis/templates/backup.sh.j2

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# Managed by Cloudfall. Local changes will be overwritten.
+set -euo pipefail
+
+backup_directory="{{ cloudfall_redis_service.backup.directory }}"
+port="{{ cloudfall_redis_service.bind.port }}"
+retention_days="{{ cloudfall_redis_service.backup.retentionDays }}"
+timestamp="$(date --utc +%Y%m%dT%H%M%SZ)"
+
+redis-cli -p "${port}" --rdb "${backup_directory}/redis-${timestamp}.rdb" \
+  > /dev/null
+
+find "${backup_directory}" -name 'redis-*.rdb' -type f \
+  -mtime "+${retention_days}" -delete

cloudfall_engine/_bundled/ansible/roles/cloudfall_redis/templates/backup.timer.j2

@@ -0,0 +1,10 @@
+# Managed by Cloudfall. Local changes will be overwritten.
+[Unit]
+Description=Cloudfall Redis backup schedule for {{ cloudfall_redis_service.id }}
+
+[Timer]
+OnCalendar={{ cloudfall_redis_service.backup.onCalendar }}
+Persistent=true
+
+[Install]
+WantedBy=timers.target

cloudfall_engine/_bundled/ansible/roles/cloudfall_redis/templates/cloudfall.conf.j2

@@ -0,0 +1,6 @@
+# Managed by Cloudfall. Local changes will be overwritten.
+bind {{ cloudfall_redis_service.bind.address }}
+port {{ cloudfall_redis_service.bind.port }}
+protected-mode yes
+maxmemory {{ cloudfall_redis_service.redis.maxmemoryMb }}mb
+appendonly {{ 'yes' if cloudfall_redis_service.redis.appendOnly else 'no' }}

cloudfall_engine/_bundled/ansible/roles/cloudfall_redis/templates/restore-check.service.j2

@@ -0,0 +1,11 @@
+# Managed by Cloudfall. Local changes will be overwritten.
+[Unit]
+Description=Cloudfall Redis restore drill for {{ cloudfall_redis_service.id }}
+After=redis-server.service
+Requires=redis-server.service
+
+[Service]
+Type=oneshot
+User=redis
+Group=redis
+ExecStart=/usr/local/sbin/cloudfall-redis-restore-check

cloudfall_engine/_bundled/ansible/roles/cloudfall_redis/templates/restore-check.sh.j2

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Managed by Cloudfall. Local changes will be overwritten.
+# Verifies the newest RDB snapshot is structurally restorable.
+set -euo pipefail
+
+backup_directory="{{ cloudfall_redis_service.backup.directory }}"
+
+latest="$(find "${backup_directory}" -name 'redis-*.rdb' -type f \
+  | sort | tail -n 1)"
+if [ -z "${latest}" ]; then
+  echo "no backup found for {{ cloudfall_redis_service.id }}" >&2
+  exit 1
+fi
+redis-check-rdb "${latest}"
+echo "restore check passed for {{ cloudfall_redis_service.id }}: ${latest}"

cloudfall_engine/_bundled/ansible/roles/cloudfall_redis/templates/restore-check.timer.j2

@@ -0,0 +1,10 @@
+# Managed by Cloudfall. Local changes will be overwritten.
+[Unit]
+Description=Cloudfall Redis restore-drill schedule for {{ cloudfall_redis_service.id }}
+
+[Timer]
+OnCalendar={{ cloudfall_redis_service.backup.restoreCheckOnCalendar }}
+Persistent=true
+
+[Install]
+WantedBy=timers.target

cloudfall_engine/_bundled/ansible/roles/cloudfall_time/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+cloudfall_time_timezone: Etc/UTC

cloudfall_engine/_bundled/ansible/roles/cloudfall_time/meta/argument_specs.yml

@@ -0,0 +1,10 @@
+---
+argument_specs:
+  main:
+    short_description: Enforce the Cloudfall UTC time baseline
+    options:
+      cloudfall_time_timezone:
+        type: str
+        choices:
+          - Etc/UTC
+        default: Etc/UTC

cloudfall_engine/_bundled/ansible/roles/cloudfall_time/meta/main.yml

@@ -0,0 +1,13 @@
+---
+galaxy_info:
+  role_name: cloudfall_time
+  author: Cloudfall
+  description: Enforce UTC and synchronized system time on Debian hosts
+  license: AGPL-3.0-or-later
+  min_ansible_version: "2.21"
+  platforms:
+    - name: Debian
+      versions:
+        - bookworm
+        - trixie
+dependencies: []

cloudfall_engine/_bundled/ansible/roles/cloudfall_time/tasks/main.yml

@@ -0,0 +1,119 @@
+---
+- name: Validate UTC time target
+  ansible.builtin.assert:
+    that:
+      - ansible_facts["distribution"] == "Debian"
+      - ansible_facts["service_mgr"] == "systemd"
+      - cloudfall_time_timezone == "Etc/UTC"
+    fail_msg: Cloudfall time management requires Debian, systemd, and Etc/UTC
+
+- name: Read current time configuration
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/timedatectl
+      - show
+      - --property=Timezone
+      - --property=LocalRTC
+      - --property=NTP
+      - --property=NTPSynchronized
+  changed_when: false
+  check_mode: false
+  register: cloudfall_time_before
+
+- name: Report timezone drift in check mode
+  ansible.builtin.debug:
+    msg: >-
+      Would change timezone from
+      {{ cloudfall_time_before.stdout_lines
+         | select('match', '^Timezone=')
+         | first
+         | default('Timezone=unknown') }}
+      to Timezone={{ cloudfall_time_timezone }}
+  changed_when: true
+  when:
+    - ansible_check_mode
+    - "'Timezone=' ~ cloudfall_time_timezone not in cloudfall_time_before.stdout_lines"
+
+- name: Set UTC timezone
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/timedatectl
+      - set-timezone
+      - "{{ cloudfall_time_timezone }}"
+  changed_when: true
+  when:
+    - not ansible_check_mode
+    - "'Timezone=' ~ cloudfall_time_timezone not in cloudfall_time_before.stdout_lines"
+
+- name: Report local hardware clock drift in check mode
+  ansible.builtin.debug:
+    msg: Would configure the hardware clock to use UTC
+  changed_when: true
+  when:
+    - ansible_check_mode
+    - "'LocalRTC=no' not in cloudfall_time_before.stdout_lines"
+
+- name: Configure hardware clock for UTC
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/timedatectl
+      - set-local-rtc
+      - "0"
+  changed_when: true
+  when:
+    - not ansible_check_mode
+    - "'LocalRTC=no' not in cloudfall_time_before.stdout_lines"
+
+- name: Report NTP drift in check mode
+  ansible.builtin.debug:
+    msg: Would enable network time synchronization
+  changed_when: true
+  when:
+    - ansible_check_mode
+    - "'NTP=yes' not in cloudfall_time_before.stdout_lines"
+
+- name: Enable network time synchronization
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/timedatectl
+      - set-ntp
+      - "true"
+  changed_when: true
+  when:
+    - not ansible_check_mode
+    - "'NTP=yes' not in cloudfall_time_before.stdout_lines"
+
+- name: Read applied time configuration
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/timedatectl
+      - show
+      - --property=Timezone
+      - --property=LocalRTC
+      - --property=NTP
+  changed_when: false
+  check_mode: false
+  register: cloudfall_time_after
+
+- name: Require applied UTC time configuration
+  ansible.builtin.assert:
+    that:
+      - ansible_check_mode or 'Timezone=' ~ cloudfall_time_timezone in cloudfall_time_after.stdout_lines
+      - ansible_check_mode or 'LocalRTC=no' in cloudfall_time_after.stdout_lines
+      - ansible_check_mode or 'NTP=yes' in cloudfall_time_after.stdout_lines
+    fail_msg: The host did not converge to the Cloudfall UTC time baseline
+
+- name: Wait for synchronized network time
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/timedatectl
+      - show
+      - --property=NTPSynchronized
+      - --value
+  changed_when: false
+  check_mode: false
+  register: cloudfall_time_synchronized
+  until: cloudfall_time_synchronized.stdout == "yes"
+  retries: 12
+  delay: 5
+  when: not ansible_check_mode

cloudfall_engine/_bundled/ansible/roles/cloudfall_unattended_upgrades/defaults/main.yml

@@ -0,0 +1,3 @@
+---
+cloudfall_unattended_upgrades_configuration_path: >-
+  /etc/apt/apt.conf.d/20auto-upgrades

cloudfall_engine/_bundled/ansible/roles/cloudfall_unattended_upgrades/meta/argument_specs.yml

@@ -0,0 +1,8 @@
+---
+argument_specs:
+  main:
+    short_description: Enable automatic Debian security upgrades
+    options:
+      cloudfall_unattended_upgrades_configuration_path:
+        type: path
+        default: /etc/apt/apt.conf.d/20auto-upgrades

cloudfall_engine/_bundled/ansible/roles/cloudfall_unattended_upgrades/meta/main.yml

@@ -0,0 +1,13 @@
+---
+galaxy_info:
+  role_name: cloudfall_unattended_upgrades
+  author: Cloudfall
+  description: Enable automatic Debian security upgrades
+  license: AGPL-3.0-or-later
+  min_ansible_version: "2.21"
+  platforms:
+    - name: Debian
+      versions:
+        - bookworm
+        - trixie
+dependencies: []

cloudfall_engine/_bundled/ansible/roles/cloudfall_unattended_upgrades/tasks/main.yml

@@ -0,0 +1,37 @@
+---
+- name: Validate unattended-upgrades target
+  ansible.builtin.assert:
+    that:
+      - ansible_facts["distribution"] == "Debian"
+      - ansible_facts["service_mgr"] == "systemd"
+    fail_msg: Cloudfall unattended upgrades require a Debian systemd host
+
+- name: Install unattended-upgrades
+  ansible.builtin.apt:
+    name: unattended-upgrades
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+
+- name: Enable periodic unattended security upgrades
+  ansible.builtin.copy:
+    dest: "{{ cloudfall_unattended_upgrades_configuration_path }}"
+    content: |
+      // Managed by Cloudfall. Local changes will be overwritten.
+      APT::Periodic::Update-Package-Lists "1";
+      APT::Periodic::Unattended-Upgrade "1";
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Enable the apt update timer
+  ansible.builtin.systemd_service:
+    name: apt-daily.timer
+    enabled: true
+    state: started
+
+- name: Enable the apt upgrade timer
+  ansible.builtin.systemd_service:
+    name: apt-daily-upgrade.timer
+    enabled: true
+    state: started