sn06.yml

---
- name: UseGalaxy.eu
  hosts: sn06
  become: true
  become_user: root
  vars:
    # The full internal name.
    hostname: sn06.galaxyproject.eu
    # The nginx user needed into the galaxyproject.nginx role
    nginx_conf_user: galaxy
    # This server has multiple CNAMEs that are important. Additionally it
    # provides proxying for many of the other services run by Galaxy Europe.
    # These server_names are passed to certbot. They generally should not need
    # to be updated unless you add a new domain. They *only* work with the
    # route53 provider, so if we want to do usegalaxy.xy, it may require
    # refactoring / multiple certbot runs.
    #
    #
    # The best way to expand them is to run the playbook, it will leave a message with the command it would have run (look for `skipped, since /etc/letsencrypt/renewal/usegalaxy.eu.conf exists`)
    #
    # Then take this command to the command line (root@sn04) and run it with `--expand`. E.g. (DO NOT COPY PASTE (in case the config changes))
    #
    # $ /opt/certbot/bin/certbot certonly --non-interactive --dns-route53 \
    #     -m security@usegalaxy.eu --agree-tos -d 'usegalaxy.eu,*.usegalaxy.eu,galaxyproject.eu,*.galaxyproject.eu,*.interactivetoolentrypoint.interactivetool.usegalaxy.eu,*.interactivetoolentrypoint.interactivetool.live.usegalaxy.eu,*.interactivetoolentrypoint.interactivetool.test.usegalaxy.eu' --expand
    # Saving debug log to /var/log/letsencrypt/letsencrypt.log
    # Credentials found in config file: ~/.aws/config
    # ....
    # IMPORTANT NOTES:
    #  - Congratulations! Your certificate and chain have been saved at:
    #
    # And you're done expanding the certs.
    #
    # The nginx user needed into the galaxyproject.nginx role
    server_names:
      - 'usegalaxy.eu'
      - '*.usegalaxy.eu'
      - 'galaxyproject.eu'
      - '*.galaxyproject.eu'
      - '*.interactivetoolentrypoint.interactivetool.usegalaxy.eu'
      - '*.interactivetoolentrypoint.interactivetool.live.usegalaxy.eu'
      - '*.interactivetoolentrypoint.interactivetool.test.usegalaxy.eu'
  vars_files:
    - group_vars/tiaas.yml                # All of the training infrastructure
    - group_vars/custom-sites.yml         # Subdomains are listed here
    - group_vars/gxconfig.yml             # The base galaxy configuration
    - group_vars/toolbox.yml              # User controlled toolbox
    - secret_group_vars/sentry.yml        # Sentry SDK init url
    - secret_group_vars/aws.yml           # AWS creds
    - secret_group_vars/pulsar.yml        # Pulsar + MQ Connections
    - secret_group_vars/oidc.yml          # OIDC credentials (ELIXIR, keycloak)
    - secret_group_vars/object_store.yml  # Object Store credentils (S3 etc ...)
    - secret_group_vars/db-main.yml       # DB URL + some postgres stuff
    - secret_group_vars/file_sources.yml  # file_sources_conf.yml creds
    - secret_group_vars/all.yml           # All of the other assorted secrets...
  handlers:
    - name: Restart Galaxy
      shell: |
        echo 'Manual zergling restart required' && cd /opt/galaxy/ && source /opt/galaxy/.bashrc  && sudo -u galaxy /usr/bin/galaxy-sync-to-nfs && systemctl restart galaxy-handler@* && systemctl restart galaxy-workflow-scheduler@*
  pre_tasks:
    - name: Install Dependencies
      package:
        name: ['git', 'postgresql', 'python3-psycopg2', 'python3-virtualenv', 'bc', 'python36']
      become: true
    - name: Set default version of Python
      alternatives:
        name: python
        path: /usr/bin/python3
    - name: Disable SELinux
      selinux:
        state: disabled
  post_tasks:
    - name: Append some users to the systemd-journal group
      user:
        name: "{{ item }}"
        groups: systemd-journal
        append: true
      loop:
        - "{{ galaxy_user.name }}"
        - "telegraf"
    - name: Set authorized SSH key
      ansible.posix.authorized_key:
        user: "{{ galaxy_user.name }}"
        state: present
        key: "{{ item }}"
      loop:
        - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFH54+qZEBeU5uwIeWWOViLcC509qxoRW6oN0VHRQr4r nate@treehouse"

  roles:
    ## Starting configuration of the operating system
    - role: usegalaxy_eu.handy.os_setup
      vars:
        enable_hostname: true
        enable_powertools: true        # geerlingguy.repo-epel role doesn't enable PowerTools repository
        enable_remap_user: true
        enable_exclude_packages: true
        enable_pam_limits: true        # Prevent out of control processes
        enable_install_software: true  # Some extra admin tools (*top, vim, etc)
    - geerlingguy.repo-epel     # Install EPEL repository

    - usegalaxy-eu.autoupdates  # keep all of our packages up to date
    - influxdata.chrony         # Keep our time in sync.

    ## Filesystems
    - usegalaxy-eu.autofs  # Setup the mount points which will be needed later
    - galaxyproject.cvmfs  # Galaxy datasets

    ## Monitoring
    - hxr.monitor-cluster
    - hxr.monitor-email
    - hxr.monitor-uwsgi
    - hxr.monitor-galaxy-journalctl
    # - usegalaxy-eu.monitor-disk-access-time
    - usegalaxy-eu.monitoring

    # Setup Galaxy user
    - role: galaxyproject.galaxy
      vars:
        galaxy_create_user: true
        galaxy_manage_clone: false
        galaxy_manage_download: false
        galaxy_manage_existing: true
        galaxy_manage_paths: true
        galaxy_manage_static_setup: false
        galaxy_manage_mutable_setup: false
        galaxy_manage_database: false
        galaxy_fetch_dependencies: false
        galaxy_build_client: false
    # The bashrc needs to be created for several later features.
    - usegalaxy-eu.bashrc

    ## Setup docker
    - geerlingguy.docker

    # HTCondor Cluster setup
    - usegalaxy-eu.htcondor

    # Misc.
    - role: hxr.galaxy-nonreproducible-tools
      become: true
      become_user: galaxy
    - usegalaxy-eu.dynmotd       # nicer MOTD/welcome message
    - usegalaxy-eu.rsync-to-nfs  # sync codebase to NFS
    - role: usegalaxy-eu.webhooks     # Clone webhook repository
      become: true
      become_user: galaxy
    - role: usegalaxy-eu.tours        # Clone tour repository
      become: true
      become_user: galaxy

    ## SSL / Security
    # https://en.wikipedia.org/wiki/Trust_on_first_use
    - ssh-host-sign  # Sign the server host key to prevent TOFU for SSH
    - hxr.aws-cli    # Setup the AWS client that will be needed for route53 authentication of certbot. MUST come before nginx role

    ## GALAXY
    - hxr.postgres-connection
    - galaxyproject.gxadmin
    - usegalaxy-eu.nginx
    # TODO move under monitoring + telegraf.
    - usegalaxy-eu.galaxy-slurp
    - usegalaxy_eu.tiaas2
    - usegalaxy-eu.gapars-galaxy
    # The REAL galaxy role
    - role: galaxyproject.galaxy
      vars:
        galaxy_create_user: true
        galaxy_manage_clone: true
        galaxy_manage_download: false
        galaxy_manage_existing: false
        galaxy_manage_static_setup: true
        galaxy_manage_mutable_setup: true
        galaxy_manage_database: true
        galaxy_fetch_dependencies: true
        galaxy_build_client: true

    ## Extras!
    - usegalaxy-eu.fix-galaxy-server-dir  # Fix details into the galaxy server dirs
    - hxr.install-to-venv                 # Some extra packages our site needs.
    - usegalaxy-eu.galaxy-systemd         # Manage the Galaxy processes with SystemD
    - usegalaxy-eu.update-hosts           # Update hosts list
    - usegalaxy_eu.gie_proxy              # Setup the NodeJS proxy for GxIT
    - usegalaxy-eu.subdomain-themes       # Custom subdomain themes
    - usegalaxy_eu.fs_maintenance         # Filesystems maintenance
    - usegalaxy-eu.logrotate              # Rotate logs
    - usegalaxy-eu.error-pages            # Copy the NGINX error pages
    - usegalaxy-eu.htcondor_release       # Condor release held jobs increasing memory
    # Various ugly fixes
    - usegalaxy-eu.fix-unscheduled-jobs       # Workaround for ???
    - usegalaxy-eu.fix-unscheduled-workflows  # Workaround for https://github.com/galaxyproject/galaxy/issues/8209
    - usegalaxy-eu.fix-stuck-handlers         # Restart handlers to prevent several classes of issues
    - usegalaxy-eu.log-cleaner                # do not retain journalctl logs, they are unnecessary/risky under GDPR
    - usegalaxy-eu.fix-ancient-ftp-data       # Remove FTP data older than 3 months, create FTP user directories
    - usegalaxy-eu.galaxy-procstat            # Some custom telegraf monitoring that's templated
    - usegalaxy-eu.fix-missing-api-keys       # Workaround for IE users not have a key set.
    - usegalaxy-eu.fix-user-quotas            # Automatically recalculate user quotas and attribute ELIXIR quota to ELIXIR AAI user on a regular basis

    # Some of our 'cleanups' also generate telegraf format so this goes at end.
    - dj-wasabi.telegraf
    # - dev-sec.os-hardening
    - dev-sec.ssh-hardening