Update to 2022-04-29 11:00

roles/squash_tm/tasks/archive_post.yml

@@ -0,0 +1,15 @@
+---
+
+- name: Compress previous version
+  command: tar cf {{ squashtm_root_dir }}/archives/{{ squashtm_current_version }}.tar.zst --use-compress-program=zstd ./
+  args:
+    chdir: "{{ squashtm_root_dir }}/archives/{{ squashtm_current_version }}"
+    warn: False
+  environment:
+    ZSTD_CLEVEL: 10
+    ZSTD_NBTHREADS: 0
+  tags: squashtm
+
+- name: Remove archive dir
+  file: path={{ squashtm_root_dir }}/archives/{{ squashtm_current_version }} state=absent
+  tags: squashtm

roles/squash_tm/tasks/archive_pre.yml

@@ -0,0 +1,60 @@
+---
+
+- name: Create archive dir
+  file: path={{ squashtm_root_dir }}/archives/{{ squashtm_current_version }} state=directory
+  tags: squashtm
+
+- name: Stop service during upgrade
+  service: name={{ item }} state=stopped
+  loop:
+    - squash-tm
+  tags: squashtm
+
+- name: Archive current version
+  synchronize:
+    src: "{{ squashtm_root_dir }}/{{ item }}"
+    dest: "{{ squashtm_root_dir }}/archives/{{ squashtm_current_version }}/"
+    delete: True
+    compress: False
+  delegate_to: "{{ inventory_hostname }}"
+  loop:
+    - app
+  tags: squashtm
+
+- when: squashtm_db_engine == 'mysql'
+  block:
+    - name: Install mysqldump
+      package: name=mariadb
+
+    - name: Dump the database
+      mysql_db:
+        state: dump
+        name: "{{ squashtm_db_name }}"
+        target: "{{ squashtm_root_dir }}/archives/{{ squashtm_current_version }}/{{ squashtm_db_name }}.sql"
+        login_host: "{{ squashtm_db_server }}"
+        login_port: "{{ squashtm_db_port }}"
+        login_user: "{{ squashtm_db_user }}"
+        login_password: "{{ squashtm_db_pass }}"
+        quick: True
+        single_transaction: True
+
+  tags: squashtm
+
+- when: squashtm_db_engine == 'postgres'
+  block:
+    - name: Install pg_dump
+      package: name=postgresql14
+
+    - name: Dump the database
+      command: >
+        /usr/pgsql-14/bin/pg_dump
+          --clean
+          --create
+          --host={{ squashtm_db_server | quote }}
+          --port={{ squashtm_db_port | quote }}
+          --username={{ squashtm_db_user | quote }} {{ squashtm_db_name | quote }}
+          --file="{{ squashtm_root_dir }}/archives/{{ squashtm_current_version }}/{{ squashtm_db_name }}.sql"
+      environment:
+        - PGPASSWORD: "{{ squashtm_db_pass }}"
+  tags: squashtm
+

roles/squash_tm/tasks/cleanup.yml

@@ -0,0 +1,11 @@
+---
+
+- name: Remove tmp and obsolete files
+  file: path={{ item }} state=absent
+  loop:
+    - "{{ squashtm_root_dir }}/tmp/squash-tm-{{ squashtm_version }}.RELEASE.tar.gz"
+    - "{{ squashtm_root_dir }}/tmp/squash-tm"
+    - "{{ squashtm_root_dir }}/app/logs"
+    - "{{ squashtm_root_dir }}/app/conf"
+    - "{{ squashtm_root_dir }}/app/data"
+  tags: squashtm

roles/squash_tm/tasks/conf.yml

@@ -0,0 +1,11 @@
+---
+
+- name: Deploy Squash TM configuration
+  template: src={{ item }}.j2 dest={{ squashtm_root_dir }}/etc/{{ item }} owner=root group={{ squashtm_user }} mode=640
+  loop:
+    - env
+    - squash.tm.cfg.properties
+    - log4j2.xml
+  notify: restart squash-tm
+  tags: squashtm
+

roles/squash_tm/tasks/directories.yml

@@ -0,0 +1,40 @@
+---
+
+- name: Create directories
+  file: path={{ item.dir }} state=directory owner={{ item.owner | default(omit) }} group={{ item.group | default(omit) }} mode={{ item.mode | default(omit) }}
+  loop:
+    - dir: "{{ squashtm_root_dir }}/archives"
+      owner: root
+      group: root
+      mode: 700
+    - dir: "{{ squashtm_root_dir }}/meta"
+      owner: root
+      group: root
+      mode: 700
+    - dir: "{{ squashtm_root_dir }}/backup"
+      owner: root
+      group: root
+      mode: 700
+    - dir: "{{ squashtm_root_dir }}/app"
+      mode: 755
+    - dir: "{{ squashtm_root_dir }}/logs"
+      owner: "{{ squashtm_user }}"
+      group: "{{ squashtm_user }}"
+      mode: 755
+    - dir: "{{ squashtm_root_dir }}/etc"
+      owner: "{{ squashtm_user }}"
+      group: "{{ squashtm_user }}"
+      mode: 755
+    - dir: "{{ squashtm_root_dir }}/tmp"
+      owner: root
+      group: "{{ squashtm_user }}"
+      mode: 770
+    - dir: "{{ squashtm_root_dir }}/data"
+      owner: "{{ squashtm_user }}"
+      group: "{{ squashtm_user }}"
+      mode: 700
+    - dir: "{{ squashtm_root_dir }}/data/tomcat"
+      owner: "{{ squashtm_user }}"
+      group: "{{ squashtm_user }}"
+      mode: 700
+  tags: squashtm

roles/squash_tm/tasks/facts.yml

@@ -0,0 +1,39 @@
+---
+
+# Load distribution specific variables
+- include_vars: "{{ item }}"
+  with_first_found:
+    - "{{ role_path }}/vars/{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml"
+    - "{{ role_path }}/vars/{{ ansible_os_family }}-{{ ansible_distribution_major_version }}.yml"
+    - "{{ role_path }}/vars/{{ ansible_distribution }}.yml"
+    - "{{ role_path }}/vars/{{ ansible_os_family }}.yml"
+  tags: squashtm
+
+# Detect installed version (if any)
+- block:
+    - import_tasks: ../includes/webapps_set_install_mode.yml
+      vars:
+        - root_dir: "{{ squashtm_root_dir }}"
+        - version: "{{ squashtm_version }}"
+    - set_fact: squashtm_install_mode={{ (install_mode == 'upgrade' and not squashtm_manage_upgrade) | ternary('none',install_mode) }}
+    - set_fact: squashtm_current_version={{ current_version | default('') }}
+  tags: squashtm
+
+# Create a random pass for the DB if needed
+- block:
+    - import_tasks: ../includes/get_rand_pass.yml
+      vars:
+        - pass_file: "{{ squashtm_root_dir }}/meta/ansible_dbpass"
+    - set_fact: squashtm_db_pass={{ rand_pass }}
+  when: squashtm_db_pass is not defined
+  tags: squashtm
+
+# Create a random pass to encrypt credentials in the database
+- block:
+    - import_tasks: ../includes/get_rand_pass.yml
+      vars:
+        - pass_file: "{{ squashtm_root_dir }}/meta/ansible_secret"
+    - set_fact: squashtm_secret={{ rand_pass }}
+  when: squashtm_secret is not defined
+  tags: squashtm
+

roles/squash_tm/tasks/install.yml

@@ -0,0 +1,154 @@
+---
+
+- name: Install dependencies
+  package: name={{ squashtm_packages }}
+  tags: squashtm
+
+- name: Detect exact JRE version
+  block:
+    - command: rpm -q java-11-openjdk
+      args:
+        warn: False
+      changed_when: False
+      register: squashtm_jre11_version
+    - set_fact: squashtm_jre11_version={{ squashtm_jre11_version.stdout | trim }}
+  tags: squashtm
+
+- when: squashtm_install_mode != 'none'
+  block:
+
+    - name: Download Squash TM
+      get_url:
+        url: "{{ squashtm_archive_url }}"
+        dest: "{{ squashtm_root_dir }}/tmp/"
+        checksum: sha256:{{ squashtm_archive_sha256 }}
+
+    - name: Extract Squash TM archive
+      unarchive:
+        src: "{{ squashtm_root_dir }}/tmp/squash-tm-{{ squashtm_version }}.RELEASE.tar.gz"
+        dest: "{{ squashtm_root_dir }}/tmp/"
+        remote_src: True
+
+    - name: Move Squash TM to the app dir
+      synchronize:
+        src: "{{ squashtm_root_dir }}/tmp/squash-tm/"
+        dest: "{{ squashtm_root_dir }}/app/"
+        delete: True
+        compress: False
+      delegate_to: "{{ inventory_hostname }}"
+
+  tags: squashtm
+
+- name: Install the permission script
+  template: src=perms.sh.j2 dest={{ squashtm_root_dir }}/perms.sh mode=755
+  register: squashtm_perm_script
+  tags: squashtm
+
+- name: Fix permissions
+  command: "{{ squashtm_root_dir }}/perms.sh"
+  when: squashtm_install_mode != none or squashtm_perm_script.changed
+  tags: squashtm
+
+- name: Install backup hooks
+  template: src={{ item }}-backup.j2 dest=/etc/backup/{{ item }}.d/squashtm owner=root group=root mode=700
+  loop:
+    - pre
+    - post
+  tags: squashtm
+
+- name: Install service unit
+  template: src=squash-tm.service.j2 dest=/etc/systemd/system/squash-tm.service
+  notify: restart squash-tm
+  register: squashtm_unit
+  tags: squashtm
+
+- name: Reload systemd
+  systemd: daemon_reload=True
+  when: squashtm_unit.changed
+  tags: squashtm
+
+- when: squashtm_db_engine == 'postgres'
+  block:
+    - name: Create the PostgreSQL role
+      postgresql_user:
+        db: postgres
+        name: "{{ squashtm_db_user }}"
+        password: "{{ squashtm_db_pass }}"
+        login_host: "{{ squashtm_db_server }}"
+        login_port: "{{ squashtm_db_port }}"
+        login_user: sqladmin
+        login_password: "{{ pg_admin_pass }}"
+
+    - name: Create the PostgreSQL database
+      postgresql_db:
+        name: "{{ squashtm_db_name }}"
+        encoding: UTF-8
+        template: template0
+        owner: "{{ squashtm_db_user }}"
+        login_host: "{{ squashtm_db_server }}"
+        login_port: "{{ squashtm_db_port }}"
+        login_user: sqladmin
+        login_password: "{{ pg_admin_pass }}"
+
+  tags: squashtm
+
+- when: squashtm_db_engine == 'mysql'
+  import_tasks: ../includes/webapps_create_mysql_db.yml
+  vars:
+    - db_name: "{{ squashtm_db_name }}"
+    - db_user: "{{ squashtm_db_user }}"
+    - db_server: "{{ squashtm_db_server }}"
+    - db_port: "{{ squashtm_db_port }}"
+    - db_pass: "{{ squashtm_db_pass }}"
+  tags: squashtm
+
+- name: Import initial DB structure (postgresql)
+  postgresql_db:
+    db: "{{ squashtm_db_name }}"
+    state: restore
+    target: "{{ squashtm_root_dir }}/app/database-scripts/postgresql-full-install-version-{{ squashtm_version }}.RELEASE.sql"
+    login_host: "{{ squashtm_db_server }}"
+    login_port: "{{ squashtm_db_port }}"
+    login_user: "{{ squashtm_db_user }}"
+    login_password: "{{ squashtm_db_pass }}"
+  when: squashtm_install_mode == 'install' and squashtm_db_engine == 'postgres'
+  tags: squashtm
+
+- name: Import the initial DB structure (mysql)
+  mysql_db:
+    db: "{{ squashtm_db_name }}"
+    state: import
+    target: "{{ squashtm_root_dir }}/app/database-scripts/mysql-full-install-version-{{ squashtm_version }}.RELEASE.sql"
+    login_host: "{{ squashtm_db_server }}"
+    login_port: "{{ squashtm_db_port }}"
+    login_user: "{{ squashtm_db_user }}"
+    login_password: "{{ squashtm_db_pass }}"
+  when: squashtm_install_mode == 'install' and squashtm_db_engine == 'mysql'
+  tags: squashtm
+
+- name: List database upgrade scripts
+  shell: >
+    ls /opt/squash_tm/app/database-scripts/{{ (squashtm_db_engine == 'postgres') | ternary('postgresql', 'mysql') }}-* |
+      grep 'upgrade-to' |
+      perl -pe 's/.*upgrade\-to\-(\d+(\.\d+)+).*/$1/' |
+      sort --version-sort
+  register: squashtm_db_upgrade_scripts
+  changed_when: False
+  tags: squashtm
+
+- name: Upgrade the database
+  mysql_db:
+    db: "{{ squashtm_db_name }}"
+    state: import
+    target: "{{ squashtm_root_dir }}/app/database-scripts/{{ (squashtm_db_engine == 'postgres') | ternary('postgresql', 'mysql') }}-upgrade-to-{{ item }}.sql"
+    login_host: "{{ squashtm_db_server }}"
+    login_port: "{{ squashtm_db_port }}"
+    login_user: "{{ squashtm_db_user }}"
+    login_password: "{{ squashtm_db_pass }}"
+  when:
+    - squashtm_install_mode == 'upgrade'             # Only apply scripts when upgrading Squash TM
+    - squashtm_current_version is version(item, '<') # Apply DB scripts if they are for a more recent version than currently installed
+    - squashtm_version is version(item, '>=')        # Do not apply scripts for more recent version than the one being installed
+  ignore_errors: True
+  loop: "{{ squashtm_db_upgrade_scripts.stdout_lines }}"
+  tags: squashtm

roles/squash_tm/tasks/iptables.yml

@@ -0,0 +1,8 @@
+---
+
+- name: Handle Squash TM port
+  iptables_raw:
+    name: squashtm_port
+    state: "{{ (squashtm_src_ip | length > 0) | ternary('present','absent') }}"
+    rules: "-A INPUT -m state --state NEW -p tcp --dport {{ squashtm_port }} -s {{ squashtm_src_ip | join(',') }} -j ACCEPT"
+  tags: squashtm

roles/squash_tm/tasks/main.yml

@@ -0,0 +1,37 @@
+---
+
+- include_tasks: user.yml
+  tags: always
+
+- include_tasks: directories.yml
+  tags: always
+
+- include_tasks: facts.yml
+  tags: always
+
+- include_tasks: archive_pre.yml
+  when: squashtm_install_mode | default('none') == 'upgrade'
+  tags: always
+
+- include_tasks: install.yml
+  tags: always
+
+- include_tasks: conf.yml
+  tags: always
+
+- include_tasks: iptables.yml
+  when: iptables_manage | default(True)
+  tags: always
+
+- include_tasks: services.yml
+  tags: always
+
+- include_tasks: write_version.yml
+  tags: always
+
+- include_tasks: archive_post.yml
+  when: squashtm_install_mode | default('none') == 'upgrade'
+  tags: always
+
+- include_tasks: cleanup.yml
+  tags: always

roles/squash_tm/tasks/services.yml

@@ -0,0 +1,6 @@
+---
+
+- name: Start and enable Squash TM service
+  service: name=squash-tm state=started enabled=True
+  register: squashtm_service
+  tags: squashtm

roles/squash_tm/tasks/user.yml

@@ -0,0 +1,9 @@
+---
+
+- name: Create user account
+  user:
+    name: "{{ squashtm_user }}"
+    system: True
+    home: "{{ squashtm_root_dir }}"
+    shell: /sbin/nologin
+  tags: squashtm

roles/squash_tm/tasks/write_version.yml

@@ -0,0 +1,5 @@
+---
+
+- name: Write installed version
+  copy: content={{ squashtm_version }} dest={{ squashtm_root_dir }}/meta/ansible_version
+  tags: squashtm