ansible-roles/roles/nomad/tasks/conf.yml

---

- name: Generate self-signed certificate
  import_tasks: ../includes/create_selfsigned_cert.yml
  vars:
    cert_path: "{{ nomad_conf.tls.cert_file }}"
    cert_key_path: "{{ nomad_conf.tls.key_file }}"
    cert_key_group: "{{ nomad_user }}"
    cert_key_mode: 640
  tags: nomad

- name: Check if CA exists
  stat: path={{ nomad_conf.tls.ca_file }}
  register: nomad_ca_file
  tags: nomad

- name: Copy cert as CA
  copy: src={{ nomad_conf.tls.cert_file }} dest={{ nomad_conf.tls.ca_file }} remote_src=True
  when: not nomad_ca_file.stat.exists
  tags: nomad

- when: nomad_conf.consul.ca_file is defined
  block:
    - name: Generate self-signed certificate
      import_tasks: ../includes/create_selfsigned_cert.yml
      vars:
        cert_path: "{{ nomad_conf.consul.cert_file }}"
        cert_key_path: "{{ nomad_conf.consul.key_file }}"
        cert_key_group: "{{ nomad_user }}"
        cert_key_mode: 640
      tags: nomad

    - name: Check if CA exists
      stat: path={{ nomad_conf.tls.ca_file }}
      register: nomad_consul_ca_file
  tags: nomad

- name: Copy consul cert as consul CA
  copy: src={{ nomad_conf.consul.cert_file }} dest={{ nomad_conf.consul.ca_file }} remote_src=True
  when: nomad_conf.consul.ca_file is defined and not nomad_consul_ca_file.stat.exists
  tags: nomad

- name: Deploy nomad configuration
  block:
    - name: Deploy nomad configuration
      template:
        src: nomad.hcl.j2
        dest: "{{ nomad_root_dir }}/etc/nomad.hcl"
        owner: root
        group: "{{ nomad_user }}"
        mode: 0640
        backup: True
      register: nomad_main_conf
      notify: restart nomad

    - name: Deploy nomad reloadable configuration
      template:
        src: reload.hcl.j2
        dest: "{{ nomad_root_dir }}/etc/reload.hcl"
        owner: root
        group: "{{ nomad_user }}"
        mode: 0640
        backup: True
      register: nomad_reload_conf
      notify: reload nomad

    - name: Validate configuration
      command: nomad config validate {{ nomad_root_dir }}/etc/nomad.hcl {{ nomad_root_dir }}/etc/reload.hcl
      changed_when: False
      become_user: "{{ nomad_user }}"
      register: nomad_conf_validation

  rescue:
    - block:
        - name: Restore main configuration
          copy:
            src: "{{ nomad_main_conf.backup_file }}"
            dest: "{{ nomad_root_dir }}/etc/nomad.hcl"
            remote_src: True
            owner: root
            group: "{{ nomad_user }}"
            mode: 0640
          when: nomad_main_conf.backup_file is defined
  
        - name: Restore reloadable configuration
          copy:
            src: "{{ nomad_reload_conf.backup_file }}"
            dest: "{{ nomad_root_dir }}/etc/reload.hcl"
            remote_src: True
            owner: root
            group: "{{ nomad_user }}"
            mode: 0640
          when: nomad_reload_conf.backup_file is defined

  tags: nomad

- name: Fail if configuration validation failed
  fail:
    msg: "Failed to validate configuration: {{ nomad_conf_validation.stdout }}"
  when: nomad_conf_validation.rc != 0
  tags: nomad

# Now we remove the backup config to prevent nomad warning about invalid config files
- name: List backup conf
  shell: ls -1 {{ nomad_root_dir }}/etc/*.hcl.*
  failed_when: False
  changed_when: False
  register: nomad_backup_configs
  tags: nomad

- name: Remove backup configs
  file: path={{ item }} state=absent
  loop: "{{ nomad_backup_configs.stdout_lines }}"
  tags: nomad

- when: nomad_vault_tls.enabled
  block:

    - name: Deploy consul-template config
      template: src=consul-template.hcl.j2 dest={{ nomad_root_dir }}/consul-template/consul-template.hcl
      notify: restart consul-template-nomad

    - name: Deploy consul-template agent cert template
      template: src=agent_cert.tpl.j2 dest={{ nomad_root_dir }}/consul-template/{{ item.where }} owner=root group=root
      loop:
        - what: certificate
          where: agent.crt.tpl
        - what: private_key
          where: agent.key.tpl
        - what: issuing_ca
          where: ca.crt.tpl
      notify: restart consul-template-nomad

  tags: nomad

- when: nomad_vault_tls.enabled and nomad_conf.server.enabled
  block:

    - name: Deploy consul-template cli cert template
      template: src=cli_cert.tpl.j2 dest={{ nomad_root_dir }}/consul-template/{{ item.where }} owner=root group=root
      loop:
        - what: certificate
          where: cli.crt.tpl
        - what: private_key
          where: cli.key.tpl
      notify: restart consul-template-nomad

  tags: nomad

- name: Set ACL on the TLS dir
  shell: |
    setfacl -R -b -x {{ nomad_root_dir }}/tls
    {% if nomad_admin_groups | length > 0 %}
    setfacl -R -m {% for group in nomad_admin_groups %}g:{{ group }}:rX{{ ',' if not loop.last }}{% endfor %} {{ nomad_root_dir }}/tls
    setfacl -R -m {% for group in nomad_admin_groups %}d:g:{{ group }}:rX{{ ',' if not loop.last }}{% endfor %} {{ nomad_root_dir }}/tls
    {% endif %}
  changed_when: False
  failed_when: False # Do not fail if eg, the FS doesn't support ACL
  tags: nomad

- name: Deploy profile script
  template: src=profile.sh.j2 dest=/etc/profile.d/nomad.sh
  tags: nomad

- name: Deploy consul-template consul cert templates
  template: src=consul_cert.tpl.j2 dest={{ nomad_root_dir }}/consul-template/{{ item.where }} owner=root group=root
  loop:
    - what: certificate
      where: consul.crt.tpl
    - what: private_key
      where: consul.key.tpl
    - what: issuing_ca
      where: consul_ca.crt.tpl
  notify: restart consul-template-nomad
  when: nomad_conf.client.enabled and nomad_conf.consul.ssl
  tags: nomad