Subscription Manager#

---
- name: Registration SBEL, install nginx and start crawling
  hosts: crawler
  become: true
  vars:
    key: "{{ activation_key }}"
    org_name: "{{ organization_name }}"
    crawling_time: "{{ time | default('00:00') }}"
    start_crawling_now: false
    mirror_dir: "{{ dir | default('/mnt/mirror') }}"
    major_version: "{{ ansible_distribution_major_version }}"
    basearch: "{{ ansible_architecture }}"
    custom_satellite: "{{ satellite }}"
    repos:
    # === The appstream-rpms and baseos-rpms repositories are required for Nginx installation ===
      - "SBERTECH_JSC_SberLinux_sberlinux-{{ major_version }}-for-{{ basearch }}-appstream-rpms"
      - "SBERTECH_JSC_SberLinux_sberlinux-{{ major_version }}-for-{{ basearch }}-baseos-rpms"
      # - "sbertech_sberlinux-{{ major_version }}_sberlinux-{{ major_version }}-for-{{ basearch }}-appstream-rpms"
      # - "sbertech_sberlinux-{{ major_version }}_sberlinux-{{ major_version }}-for-{{ basearch }}-baseos-rpms"
    mirror_repos:
      - "SBERTECH_JSC_SberLinux_sberlinux-8-for-x86_64-highavailability-rpms"
      - "SBERTECH_JSC_SberLinux_sberlinux-8-for-x86_64-resilientstorage-rpms"
      # - "SBERTECH_JSC_SberLinux_sberlinux-9-for-x86_64-highavailability-rpms"
      # - "SBERTECH_JSC_SberLinux_sberlinux-9-for-x86_64-resilientstorage-rpms"
      # - "sbertech_sberlinux-8_sberlinux-8-for-x86_64-highavailability-rpms"
      # - "sbertech_sberlinux-8_sberlinux-8-for-x86_64-resilientstorage-rpms"
  tasks:
    - name: Registration
      when:
        - key is defined
      block:
        - name: Configure custom satellite
          when: custom_satellite is defined
          block:
            - name: Custom slsm config
              ansible.builtin.replace:
                path: /etc/slsm/slsm.conf
                regexp: "slsm.sbertech.ru"
                replace: "{{ custom_satellite }}"

            - name: Custom ca path
              ansible.builtin.replace:
                path: /etc/slsm/slsm.conf
                regexp: "sberlinux-uep"
                replace: "{{ custom_satellite }}"

            - name: Add CA certificate
              ansible.builtin.shell: |
                openssl s_client -connect "{{ custom_satellite }}":443 -servername "{{ custom_satellite }}" -showcerts 2>/dev/null < /dev/null | \
                sed -ne "/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p" | \
                tee /etc/pki/ca-trust/source/anchors/"{{ custom_satellite }}".pem /etc/slsm/ca/"{{ custom_satellite }}".pem

        - name: Register with subscription manager
          ansible.builtin.command: subscription-manager register --org "{{ org_name }}" --activationkey "{{ key }}"
          register: registration_result
          failed_when: "'system is already registered' not in registration_result.stderr and registration_result.rc != 0 and 'system has been registered' not in registration_result.stdout"
          changed_when: "'system is already registered' not in registration_result.stderr or 'system has been registered' in registration_result.stdout"

    - name: Enable repositories
      when: repos is defined
      block:
        - name: Checking registration before connecting repositories
          ansible.builtin.command: subscription-manager identity
          register: subscription_status
          changed_when: false
          failed_when: subscription_status.rc != 0

        - name: Enable specified repositories
          when: subscription_status.rc == 0
          community.general.rhsm_repository:
            name: "{{ item }}"
            state: enabled
          loop: "{{ repos }}"
          register: enable_repos
          ignore_errors: true

        - name: The result of enabling repositories
          ansible.builtin.debug:
            msg: >
              "Результат включения репозиториев:
              {% for result in enable_repos.results %}
                {{ result.results }}
              {% endfor %}"
            
    - name: Install and configure Nginx
      when: major_version is defined
      block:
        - name: Install Nginx
          ansible.builtin.dnf:
            name: nginx
            state: present

        - name: Start Nginx service
          ansible.builtin.service:
            name: nginx
            state: started
            enabled: true

        - name: Ensure nginx root directory exists
          ansible.builtin.file:
            path: "{{ mirror_dir }}"
            state: directory
            owner: nginx
            group: nginx
            mode: "0755"

        - name: Configure SElinux
          block:
            - name: Add SELinux file context for the directory
              ansible.builtin.sefcontext:
                target: "{{ mirror_dir }}(/.*)?"
                setype: httpd_sys_content_t
                state: present

            - name: Apply the new SELinux context to the directory
              ansible.builtin.command: restorecon -Rv "{{ mirror_dir }}"
              register: result_command
              changed_when: "'Relabeled' in result_command.stdout"

        - name: Configure nginx with custom conf
          ansible.builtin.copy:
            dest: /etc/nginx/nginx.conf
            content: |
                # Managed by Ansible. Do not edit manually!

                user nginx;
                worker_processes auto;
                worker_rlimit_nofile 8192;

                error_log /var/log/nginx/error.log;
                pid /run/nginx.pid;

                # Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
                include /usr/share/nginx/modules/*.conf;

                events {
                  worker_connections 8192;
                  use epoll;
                }

                http {
                    log_format extented  "$remote_addr - $remote_user [$time_local]  "
                                         "'$request' $status $body_bytes_sent "
                                         "'$http_referer' '$http_user_agent' [request_time:$request_time, upstream:$upstream_addr, upstream_response_time:$upstream_response_time]";

                    log_format post      "$remote_addr - $remote_user [$time_local]  "
                                         "'$request' $status $body_bytes_sent "
                                         "request_body:'$request_body'"
                                         "'$http_referer' '$http_user_agent' [request_time:$request_time, upstream:$upstream_addr]";

                    log_format cache     "$remote_addr - [cache_status:$upstream_cache_status] [$time_local] "
                                         "'$request' $status $body_bytes_sent "
                                         "'$http_referer' '$http_user_agent' [request_time:$request_time, upstream:$upstream_addr]";

                    log_format isotime  "$remote_addr - $remote_user [$time_iso8601]  "
                                        "'$request' $status $body_bytes_sent "
                                        "'$http_referer' '$http_user_agent' [request_time:$request_time, upstream:$upstream_addr]";

                    access_log  /var/log/nginx/access.log;

                    server_tokens         off;
                    sendfile              on;
                    tcp_nopush            on;
                    keepalive_timeout     65;
                    types_hash_max_size   4096;

                    client_body_timeout   20s;

                    send_timeout          20s;

                    server_names_hash_max_size 4096;
                    server_names_hash_bucket_size 512;

                    include             /etc/nginx/mime.types;
                    default_type        application/octet-stream;

                    charset UTF-8;

                    include /etc/nginx/conf.d/*.conf;
                }

        - name: Configure nginx mirror conf
          ansible.builtin.copy:
            dest: /etc/nginx/conf.d/mirror.conf
            content: |
                server {
                    listen    *:80;
                    root            "{{ mirror_dir }}";
                    autoindex       on;
                    access_log  /var/log/nginx/mirror-access.log;
                    error_log   /var/log/nginx/mirror-error.log;

                    location / {
                      try_files $uri $uri/ "{{ mirror_dir }}" =404;
                    }
                }
          notify:
            - Restart nginx

    - name: Configure crawling script
      when: mirror_repos is defined
      block:
        - name: Create a script file
          ansible.builtin.copy:
            dest: /usr/local/bin/crawl_repos.sh
            content: |
              #!/bin/bash
              REPOS=("{{ mirror_repos | join(' ') }}")
              for i in "${REPOS[@]}"; do
                dnf reposync -y \
                  --repoid="$i" \
                  --delete \
                  --download-metadata \
                  --downloadcomps \
                  --download-path="{{ mirror_dir }}"
              done
            mode: "0755"

        - name: Add cron job for crawling repos
          ansible.builtin.cron:
            name: "Crawl repositories"
            minute: "{{ crawling_time.split(':')[1] }}"
            hour: "{{ crawling_time.split(':')[0] }}"
            job: "/usr/local/bin/crawl_repos.sh"
            state: present

        - name: Start crawling now if required
          when:
            - start_crawling_now | bool
            - subscription_status.rc == 0
          ansible.builtin.command: "/usr/local/bin/crawl_repos.sh"

  handlers:
    - name: Restart nginx
      ansible.builtin.service:
        name: nginx
        state: restarted