Update to 2022-09-08 18:00

roles/consul/tasks/install.yml

@@ -40,7 +40,7 @@
     content: |
       complete -C {{ consul_root_dir }}/bin/consul consul
     dest: /etc/bash_completion.d/consul
-    mode: 755
+    mode: 0644
   tags: consul
 
 - name: Deploy systemd service unit

roles/consul/tasks/iptables.yml

@@ -6,10 +6,10 @@
     state: "{{ (('tcp' in consul_services[item].proto or 'udp' in consul_services[item].proto) and consul_services[item].src_ip | length > 0) | ternary('present', 'absent') }}"
     rules: |
       {% if 'tcp' in consul_services[item].proto %}
-      -A INPUT -m state --state NEW -p tcp --dport {{ consul_services[item].port }} -s {{ consul_services[item].src_ip | join(',') }} -j ACCEPT
+      -A INPUT -m state --state NEW -p tcp --dport {{ consul_services[item].port }} -s {{ consul_services[item].src_ip | flatten | join(',') }} -j ACCEPT
       {% endif %}
       {% if 'udp' in consul_services[item].proto %}
-      -A INPUT -m state --state NEW -p udp --dport {{ consul_services[item].port }} -s {{ consul_services[item].src_ip | join(',') }} -j ACCEPT
+      -A INPUT -m state --state NEW -p udp --dport {{ consul_services[item].port }} -s {{ consul_services[item].src_ip | flatten | join(',') }} -j ACCEPT
       {% endif %}
   loop: "{{ consul_services.keys() | list }}"
   tags: firewall,consul

roles/consul/templates/consul.service.j2

@@ -14,7 +14,8 @@ ExecStart={{ consul_root_dir }}/bin/consul agent -config-dir={{ consul_root_dir
 ExecReload=/bin/kill --signal HUP $MAINPID
 SuccessExitStatus=1
 Restart=on-failure
-RestartSec=2
+RestartSec=5
+StartLimitInterval=0
 LimitNOFILE=65536
 
 [Install]

roles/letsencrypt/templates/domains.txt.j2

@@ -71,3 +71,7 @@
 # mysql
 {{ mysql_letsencrypt_cert }}
 {% endif %}
+{% if 'vault' in ansible_role_names and vault_letsencrypt_cert is defined and vault_letsencrypt_cert is string and vault_letsencrypt_cert not in letsencrypt_certs | default([]) | map(attribute='common_name') %}
+# Vault
+{{ vault_letsencrypt_cert }}
+{% endif %}

roles/metabase/defaults/main.yml

@@ -1,15 +1,15 @@
 ---
 
 # Version to deploy
-metabase_version: 0.44.1
+metabase_version: 0.44.2
 # URL to fetch the jar
 metabase_jar_url: https://downloads.metabase.com/v{{ metabase_version }}/metabase.jar
 # Expected sha256 of the jar
-metabase_jar_sha256: 4c842b9b374b0ffa7031b7757722e1dddd9b6aebbb5afe82d82b6eb9730d3791
+metabase_jar_sha256: 23471284af7fdbd9088cbb4f0c6972cacca9a1f155f408b80dbaade08c13480f
 # When building from source
 metabase_archive_url: https://github.com/metabase/metabase/archive/refs/tags/v{{ metabase_version }}.tar.gz
 # Expected sha256 of the archive
-metabase_archive_sha256: 522fb5a92234fb6bc1ed46819523271c51d4e3d2c13fa5230430cff3802d0ff1
+metabase_archive_sha256: bdbfff6f2a7bd0434b8a9885e10f5b0d5c52d0e1918a4b9d091c596b5e5d06ca
 # Should ansible handle upgrades ? If set to false, only the initial install (and the config) will be handled
 metabase_manage_upgrade: True
 

roles/nomad/defaults/main.yml

@@ -180,7 +180,7 @@ nomad_base_conf:
     # address: http://localhost:8500
     # allow_unauthenticated: True
     # tags: []
-    ssl: "{{ (consul_conf is defined and consul_conf.tls is defined and consul_conf.tls.enabled is defined and consul_conf.tls.enabled) | ternary(True, False) }}"
+    ssl: False
     ca_file: "{{ nomad_root_dir }}/tls/consul_ca.crt"
     cert_file: "{{ nomad_root_dir }}/tls/consul.crt"
     key_file: "{{ nomad_root_dir }}/tls/consul.key"

roles/nomad/tasks/conf.yml

@@ -168,6 +168,6 @@
     - what: issuing_ca
       where: consul_ca.crt.tpl
   notify: restart consul-template-nomad
-  when: nomad_vault_secrets.consul_pki.enabled and nomad_conf.client.enabled and nomad_conf.consul.ssl
+  when: nomad_vault_secrets.consul_pki.enabled and nomad_conf.consul.ssl
   tags: nomad
 

roles/nomad/tasks/install.yml

@@ -49,6 +49,11 @@
     - name: Link in /usr/local/bin
       file: src={{ nomad_root_dir }}/bin/nomad dest=/usr/local/bin/nomad state=link force=True
 
+  tags: nomad
+
+- when: nomad_install_mode != 'none' and nomad_conf.client.enabled
+  block:
+
     - name: Download plugins
       get_url:
         url: "{{ nomad_plugins[item].archive_url }}"
@@ -101,7 +106,7 @@
     content: |
       complete -C {{ nomad_root_dir }}/bin/nomad nomad
     dest: /etc/bash_completion.d/nomad
-    mode: 755
+    mode: 0644
   tags: nomad
 
 - name: Deploy systemd service unit

roles/nomad/tasks/iptables.yml

@@ -6,10 +6,10 @@
     state: "{{ (('tcp' in nomad_services[item].proto or 'udp' in nomad_services[item].proto) and nomad_services[item].src_ip | length > 0) | ternary('present', 'absent') }}"
     rules: |
       {% if 'tcp' in nomad_services[item].proto %}
-      -A INPUT -m state --state NEW -p tcp --dport {{ nomad_services[item].port }} -s {{  nomad_services[item].src_ip | join(',') }} -j ACCEPT
+      -A INPUT -m state --state NEW -p tcp --dport {{ nomad_services[item].port }} -s {{  nomad_services[item].src_ip | flatten | join(',') }} -j ACCEPT
       {% endif %}
       {% if 'udp' in nomad_services[item].proto %}
-      -A INPUT -m state --state NEW -p udp --dport {{ nomad_services[item].port }} -s {{  nomad_services[item].src_ip | join(',') }} -j ACCEPT
+      -A INPUT -m state --state NEW -p udp --dport {{ nomad_services[item].port }} -s {{  nomad_services[item].src_ip | flatten | join(',') }} -j ACCEPT
       {% endif %}
   loop: "{{ nomad_services.keys() | list }}"
   tags: firewall,nomad

roles/nomad/templates/consul-template.hcl.j2

@@ -59,7 +59,7 @@ template {
 {% endif %}
 
 
-{% if nomad_vault_secrets.consul_pki.enabled and nomad_conf.client.enabled and nomad_conf.consul.ssl %}
+{% if nomad_vault_secrets.consul_pki.enabled and nomad_conf.consul.ssl %}
 template {
   source          = "{{ nomad_root_dir }}/consul-template/consul.crt.tpl"
   left_delimiter  = "[["

roles/nomad/templates/nomad.service.j2

@@ -23,7 +23,8 @@ Restart=on-failure
 LimitNOFILE=65536
 LimitNPROC=infinity
 Restart=on-failure
-RestartSec=2
+RestartSec=5
+StartLimitInterval=0
 TasksMax=infinity
 OOMScoreAdjust=-1000
 

roles/vault/defaults/main.yml

@@ -95,8 +95,8 @@ vault_base_conf:
       # retry_join:
       #   - leader_api_addr: https://vault-1.example.org:8200
       #     leader_ca_cert: /opt/vault/tls/ca-vault-1.crt
-      #   - https://vault-2.example.org:8200
+      #   - leader_api_addr: https://vault-2.example.org:8200
-      #   - https://vault-3.example.org:8200
+      #   - leader_api_addr: https://vault-3.example.org:8200
       retry_join: []
 
   # Service registration on consul

roles/vault/handlers/main.yml

@@ -9,3 +9,4 @@
 
 - name: restart consul-template-vault
   service: name=consul-template-vault state=restarted
+  when: vault_secrets.nomad.enabled

roles/vault/tasks/install.yml

@@ -40,7 +40,7 @@
     content: |
       complete -C {{ vault_root_dir }}/bin/vault vault
     dest: /etc/bash_completion.d/vault
-    mode: 755
+    mode: 0644
   tags: vault
 
 - name: Deploy systemd service unit
@@ -52,13 +52,12 @@
 - name: Install consul-template unit
   template: src=consul-template-vault.service.j2 dest=/etc/systemd/system/consul-template-vault.service
   notify: restart consul-template-vault
-  when: vault_secrets.nomad.enabled
   register: vault_secrets_nomad_unit
   tags: vault
 
 - name: Reload systemd
   systemd: daemon_reload=True
-  when: vault_unit.changed or (vault_secrets_nomad_unit is defined and vault_secrets_nomad_unit.changed)
+  when: vault_unit.changed or vault_secrets_nomad_unit.changed
   tags: vault
 
 - name: Install dehydrated hook

roles/vault/tasks/iptables.yml

@@ -4,7 +4,6 @@
   iptables_raw:
     name: vault_port_{{ item }}
     state: "{{ (vault_services[item].src_ip | length > 0) | ternary('present', 'absent') }}"
-    rules: |
+    rules: "-A INPUT -m state --state NEW -p tcp --dport {{ vault_services[item].port }} -s {{ vault_services[item].src_ip | flatten | join(',') }} -j ACCEPT"
-      -A INPUT -m state --state NEW -p tcp --dport {{ vault_services[item].port }} -j ACCEPT
   loop: "{{ vault_services.keys() | list }}"
   tags: firewall,vault

roles/vault/templates/vault.service.j2

@@ -25,6 +25,7 @@ KillMode=process
 KillSignal=SIGINT
 Restart=on-failure
 RestartSec=5
+StartLimitInterval=0
 TimeoutStopSec=30
 LimitNOFILE=65536
 LimitMEMLOCK=infinity