Update to 2022-01-25 15:00

roles/elasticsearch/tasks/archive_post.yml

@@ -0,0 +1,10 @@
+---
+
+- name: Compress previous version
+  command: tar cf {{ es_root_dir }}/archives/{{ es_current_version }}.tar.zst ./ --use-compress-program=zstd
+  args:
+    chdir: "{{ es_root_dir }}/archives/{{ es_current_version }}"
+    warn: False
+  environment:
+    ZSTD_CLEVEL: 15
+  tags: es

roles/elasticsearch/tasks/archive_pre.yml

@@ -0,0 +1,15 @@
+---
+
+- name: Create the archive dir
+  file: path={{ es_root_dir }}/archives/{{ es_current_version }} state=directory
+  tags: es
+
+- name: Archive current version
+  synchronize:
+    src: "{{ es_root_dir }}/app"
+    dest: "{{ es_root_dir }}/archives/{{ es_current_version }}/"
+    compress: False
+    delete: True
+  delegate_to: "{{ inventory_hostname }}"
+  tags: es
+

roles/elasticsearch/tasks/backup.yml

@@ -8,11 +8,11 @@
       type: fs
       settings:
         compress: True
-        location: "{{ es_backup_dir }}"
+        location: "{{ es_root_dir }}/backup"
     body_format: json
   register: es_lbkp
   until: es_lbkp.failed == False
-  retries: 10
+  retries: 20
   delay: 10
   tags: es
 

roles/elasticsearch/tasks/cleanup.yml

@@ -0,0 +1,9 @@
+---
+
+- name: Remove tmp and obsolete files
+  file: path={{ item }} state=absent
+  loop:
+    - "{{ es_root_dir }}/tmp/elasticsearch-{{ es_version }}"
+    - "{{ es_root_dir }}/tmp/elasticsearch-{{ es_version }}-linux-x86_64.tar.gz"
+    - "{{ es_root_dir }}/archives/{{ es_current_version }}"
+  tags: es

roles/elasticsearch/tasks/conf.yml

@@ -1,9 +1,10 @@
 ---
 
 - name: Deploy configuration
-  template: src={{ item }}.j2 dest=/etc/elasticsearch/{{ item }} group=elasticsearch mode=660
+  template: src={{ item }}.j2 dest={{ es_root_dir }}/etc/{{ item }} group={{ es_user }} mode=660
   loop:
     - elasticsearch.yml
     - log4j2.properties
+    - jvm.options
   notify: restart elasticsearch
   tags: es

roles/elasticsearch/tasks/directories.yml

@@ -1,14 +1,37 @@
 ---
 
-- name: Ensure the data dir exists
-  file: path={{ es_data_dir }} state=directory
-  tags: es
-
-  # We do it in two steps, so that parent dirs aren't created with restrictive permissions
-- name: Restrict permissions on data dir
-  file: path={{ es_data_dir }} state=directory owner=elasticsearch group=elasticsearch mode=750
-  tags: es
-
-- name: Create backup dir
-  file: path={{ es_backup_dir }} state=directory owner=elasticsearch group=elasticsearch mode=700
+- name: Create directories
+  file: path={{ item.dir }} state=directory owner={{ item.owner | default(omit) }} group={{ item.group | default(omit) }} mode={{ item.mode | default(omit) }}
+  loop:
+    - dir: "{{ es_root_dir }}"
+      owner: "{{ es_user }}"
+      mode: 700
+    - dir: "{{ es_root_dir }}/backup"
+      owner: "{{ es_user }}"
+      group: "{{ es_user }}"
+      mode: 700
+    - dir: "{{ es_root_dir }}/archives"
+      owner: root
+      group: root
+      mode: 700
+    - dir: "{{ es_root_dir }}/meta"
+      owner: root
+      group: root
+      mode: 700
+    - dir: "{{ es_root_dir }}/data"
+      owner: "{{ es_user }}"
+      group: "{{ es_user }}"
+      mode: 700
+    - dir: "{{ es_root_dir }}/logs"
+      owner: "{{ es_user }}"
+      group: "{{ es_user }}"
+      mode: 700
+    - dir: "{{ es_root_dir }}/etc"
+      group: "{{ es_user }}"
+      mode: 770
+    - dir: "{{ es_root_dir }}/tmp"
+      owner: "{{ es_user }}"
+      group: "{{ es_user }}"
+      mode: 700
+    - dir: "{{ es_root_dir }}/app"
   tags: es

roles/elasticsearch/tasks/facts.yml

@@ -0,0 +1,21 @@
+---
+
+# Detect installed version (if any)
+- block:
+    - import_tasks: ../includes/webapps_set_install_mode.yml
+      vars:
+        - root_dir: "{{ es_root_dir }}"
+        - version: "{{ es_version }}"
+    - set_fact: es_install_mode={{ (install_mode == 'upgrade' and not es_manage_upgrade) | ternary('none',install_mode) }}
+    - set_fact: es_current_version={{ current_version | default('') }}
+  tags: es
+
+- name: Check if Seafile is installed
+  stat: path={{ seafile_root_dir | default('/opt/seafile') }}/seafile-server/pro/elasticsearch/
+  register: es_seafile_bundled_es
+  tags: es
+
+- name: Check if seafile is installed
+  stat: path=/etc/systemd/system/seafile.service
+  register: es_seafile_service
+  tags: es

roles/elasticsearch/tasks/install.yml

@@ -1,10 +1,64 @@
 ---
 
-- name: Install needed packages
-  yum:
-    name:
-      - elasticsearch-oss
-      - java-1.8.0-openjdk-headless
+- name: Stop the service during upgrades
+  service: name=elasticsearch state=stopped
+  when: es_install_mode == 'upgrade'
+  tags: es
+
+- name: Stop seafile to free elasticsearch port
+  service: name=seafile state=stopped
+  when: es_seafile_bundled_es.stat.exists and es_seafile_service.stat.exists
+  tags: es
+
+- when: es_install_mode != 'none'
+  block:
+    - name: Download Elasticsearch {{ es_version }}
+      get_url:
+        url: "{{ es_archive_url }}"
+        dest: "{{ es_root_dir }}/tmp"
+        checksum: sha512:{{ es_archive_sha512 }}
+
+    - name: Extract the archive
+      unarchive:
+        src: "{{ es_root_dir }}/tmp/elasticsearch-{{ es_version }}-linux-x86_64.tar.gz"
+        dest: "{{ es_root_dir }}/tmp"
+        remote_src: True
+
+    - name: Move Elasticsearch to its final dir
+      synchronize:
+        src: "{{ es_root_dir }}/tmp/elasticsearch-{{ es_version }}/"
+        dest: "{{ es_root_dir }}/app/"
+        delete: True
+        compress: False
+      delegate_to: "{{ inventory_hostname }}"
+
+    - name: Populate config dir
+      synchronize:
+        src: "{{ es_root_dir }}/tmp/elasticsearch-{{ es_version }}/config/"
+        dest: "{{ es_root_dir }}/etc/"
+        delete: True
+        compress: False
+      delegate_to: "{{ inventory_hostname }}"
+
+    - name: Set permissions
+      shell: |
+        {% if ansible_selinux.status == 'enabled' %}
+        restorecon -R {{ es_root_dir }}
+        {% endif %}
+        chown -R root:root {{ es_root_dir }}/app
+        chown -R :{{ es_user }} {{ es_root_dir }}/etc
+        chown -R {{ es_user }}:{{ es_user }} {{ es_root_dir }}/data/*
+        find {{ es_root_dir }}/etc -type d -exec chmod 770 "{}" \;
+        find {{ es_root_dir }}/etc -type f -exec chmod 660 "{}" \;
+        find {{ es_root_dir }}/app -type d -exec chmod 755 "{}" \;
+        find {{ es_root_dir }}/app -type f -exec chmod 644 "{}" \;
+        find {{ es_root_dir }}/app/jdk/bin -type f -exec chmod 755 "{}" \;
+        chmod 755 {{ es_root_dir }}/app/jdk/lib/jspawnhelper
+        find {{ es_root_dir }}/app/bin -type f -exec chmod 755 "{}" \;
+        find {{ es_root_dir }}/app/modules/x-pack-ml/platform/linux-x86_64/bin/ -type f -exec chmod 755 "{}" \;
+      args:
+        warn: False
+
   tags: es
 
 - name: Deploy pre and post backup script
@@ -14,29 +68,30 @@
     - post
   tags: es
 
-- name: Create systemd unit snippet dir
-  file: path=/etc/systemd/system/elasticsearch.service.d state=directory
+- name: Deploy tmpfile fragment
+  template: src=tmpfiles.conf.j2 dest=/etc/tmpfiles.d/elasticsearch.conf
+  register: es_tmpfiles
   tags: es
 
-- name: Customize systemd unit
-  copy:
-    content: |
-      [Service]
-      ProtectSystem=full
-      PrivateDevices=yes
-      ProtectHome=yes
-      NoNewPrivileges=yes
-      SyslogIdentifier=elasticsearch
-      Restart=on-failure
-      ExecStart=
-      ExecStart=/usr/share/elasticsearch/bin/elasticsearch -p ${PID_DIR}/elasticsearch.pid
-    dest: /etc/systemd/system/elasticsearch.service.d/ansible.conf
+- name: Create tmpfiles
+  command: systemd-tmpfiles --create
+  when: es_tmpfiles.changed
+  tags: es
+
+- name: Deploy systemd unit
+  template: src=elasticsearch.service.j2 dest=/etc/systemd/system/elasticsearch.service
   register: es_unit
   notify: restart elasticsearch
   tags: es
 
+- name: Remove previous systemd unit snippet
+  file: path=/etc/systemd/system/elasticsearch.service.d/ansible.conf state=absent
+  register: es_unit_snip
+  notify: restart elasticsearch
+  tags: es
+
 - name: Reload systemd
   systemd: daemon_reload=True
-  when: es_unit.changed
+  when: es_unit.changed or es_unit_snip.changed
   tags: es
 

roles/elasticsearch/tasks/main.yml

@@ -1,10 +1,18 @@
 ---
 
-- include: install.yml
+- include: remove_pkg.yml
+- include: user.yml
 - include: directories.yml
+- include: facts.yml
+- include: archive_pre.yml
+  when: es_install_mode == 'upgrade'
+- include: install.yml
 - include: conf.yml
 - include: iptables.yml
   when: iptables_manage | default(True)
 - include: services.yml
 - include: backup.yml
-
+- include: write_version.yml
+- include: archive_post.yml
+  when: es_install_mode == 'upgrade'
+- include: cleanup.yml

roles/elasticsearch/tasks/remove_pkg.yml

@@ -0,0 +1,9 @@
+---
+
+- name: Remove ES package
+  package:
+    name:
+      - elasticsearch-oss
+      - elasticsearch
+    state: absent
+  tags: es

roles/elasticsearch/tasks/user.yml

@@ -0,0 +1,9 @@
+---
+
+- name: Create elasticsearch user
+  user:
+    name: "{{ es_user }}"
+    home: "{{ es_root_dir }}"
+    system: True
+    shell: /bin/nologin
+  tags: es

roles/elasticsearch/tasks/write_version.yml

@@ -0,0 +1,5 @@
+---
+
+- name: Write installed version
+  copy: content={{ es_version }} dest={{ es_root_dir }}/meta/ansible_version
+  tags: es