forked from ISTI-ansible-roles/ansible-roles
rimosso library/roles/ghn-gcore/gcore-authorization/ che è un duplicato di un ruolo già esistente
This commit is contained in:
daniele.pavia
parent
550254e96a
commit
0e9ff4633b
|
|
@ -1,32 +0,0 @@
|
||||||
---
|
|
||||||
#authorization_service_install: False
|
|
||||||
#authorization_service_upgrade: False
|
|
||||||
authorization_service_name: authorization-service
|
|
||||||
#authorization_service_file: '{{ authorization_service_name }}-2.0.0-20160927.120833-1.war'
|
|
||||||
#authorization_service_url: 'http://maven.research-infrastructures.eu/nexus/content/repositories/gcube-snapshots/org/gcube/common/authorization-service/2.0.0-SNAPSHOT/{{ authorization_service_file }}'
|
|
||||||
#
|
|
||||||
#authorization_version: "2.0.1-4.2.0-134808"
|
|
||||||
authorization_service_version: "2.0.1-4.2.0-134808"
|
|
||||||
|
|
||||||
repo: "gcube-staging"
|
|
||||||
authorization_service_file: '{{ authorization_service_name }}-{{ authorization_service_version }}.war'
|
|
||||||
authorization_service_url: 'http://maven.research-infrastructures.eu/nexus/content/repositories/{{ repo }}/org/gcube/common/authorization-service/{{ authorization_service_version }}/{{ authorization_service_file }}'
|
|
||||||
authorization_service_persistence_dest: WEB-INF/classes/META-INF/persistence.xml
|
|
||||||
authorization_service_config_dest: WEB-INF/AuthorizationConfiguration.xml
|
|
||||||
#auth_user: '{{ d4science_user }}'
|
|
||||||
tomcat_user: "tomcat"
|
|
||||||
tomcat_document_root: "/usr/share/tomcat/"
|
|
||||||
authorization_service_loglevel: INFO
|
|
||||||
authorization_service_root_loglevel: WARN
|
|
||||||
#authorization_service_http_port: 8080
|
|
||||||
authorization_service_http_port: 80
|
|
||||||
authorized_ips:
|
|
||||||
# - 127.0.0.1
|
|
||||||
- 0.0.0.0
|
|
||||||
|
|
||||||
auth_postgresql_host: "localhost"
|
|
||||||
psql_db_name: "gcoreauthz"
|
|
||||||
psql_db_user: "gcoreauthz"
|
|
||||||
authorization_db_pwd: "gcore-authz"
|
|
||||||
postgres_port: "5431"
|
|
||||||
pgpool_port: "5432"
|
|
||||||
|
|
@ -1,4 +0,0 @@
|
||||||
dependencies:
|
|
||||||
- role: tomcat
|
|
||||||
- role: postgresql
|
|
||||||
- role: pgpool
|
|
||||||
|
|
@ -1,75 +0,0 @@
|
||||||
---
|
|
||||||
- block:
|
|
||||||
- name: Ensure that postgres is running
|
|
||||||
service: name=postgresql state=started
|
|
||||||
|
|
||||||
- name: Create postgres database {{ psql_db_name }} and user {{ psql_db_user }}
|
|
||||||
shell: sudo -u postgres createdb {{ psql_db_name }} && sudo -u postgres createuser -s {{ psql_db_user }}
|
|
||||||
ignore_errors: True
|
|
||||||
|
|
||||||
- name: Set password for user {{ psql_db_user }} and grant all privileges on database {{ psql_db_name }}
|
|
||||||
shell: sudo -u postgres psql -c "ALTER USER {{ psql_db_user }} WITH PASSWORD '{{ authorization_db_pwd }}';" && sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE {{ psql_db_name }} TO {{ psql_db_user }}";
|
|
||||||
ignore_errors: True
|
|
||||||
|
|
||||||
- name: Change postgres authentication method to password for localhost
|
|
||||||
lineinfile: dest=/var/lib/pgsql/data/pg_hba.conf state=present regexp='^host all all 127.0.0.1/32' line='host all all 127.0.0.1/32 password'
|
|
||||||
|
|
||||||
- name: Change postgres authentication method to password for localhost ipv6
|
|
||||||
lineinfile: dest=/var/lib/pgsql/data/pg_hba.conf state=present regexp='^host all all ::1/128' line='host all all ::1/128 password'
|
|
||||||
|
|
||||||
- name: Change postgres port to {{ postgres_port }}
|
|
||||||
lineinfile: dest="/usr/lib/systemd/system/postgresql.service" state=present regexp='^Environment=PGPORT=' line='Environment=PGPORT={{ postgres_port }}'
|
|
||||||
|
|
||||||
- name: Change pgpool port to {{ pgpool_port }}
|
|
||||||
lineinfile: dest="/etc/pgpool-II/pgpool.conf" state=present regexp='^port =' line='port = {{ pgpool_port }}'
|
|
||||||
|
|
||||||
- name: Tell pgpool to connect to postgreqsl on port {{ postgres_port }}
|
|
||||||
lineinfile: dest="/etc/pgpool-II/pgpool.conf" state=present regexp='^backend_port0 =' line='backend_port0 = {{ postgres_port }}'
|
|
||||||
|
|
||||||
- name: Tell pgpool to enable ssl
|
|
||||||
lineinfile: dest="/etc/pgpool-II/pgpool.conf" state=present regexp='^ssl = on' line='ssl = on'
|
|
||||||
|
|
||||||
- name: Running semanage to enable postgres to bind port {{ postgres_port }}
|
|
||||||
seport: ports={{ postgres_port }} proto=tcp setype=postgresql_port_t state=present reload=yes
|
|
||||||
|
|
||||||
- name: Running setsebool to allow tcp connections to the db
|
|
||||||
seboolean: name=httpd_can_network_connect_db state=yes persistent=yes
|
|
||||||
|
|
||||||
# - name: restart postgres
|
|
||||||
# service: name=postgresql state=restarted
|
|
||||||
|
|
||||||
#### on CentOS 7 we need to tell systemd to reload the service file since we made changes there
|
|
||||||
- name: restart postgresql
|
|
||||||
systemd: name=postgresql state=restarted enabled=yes daemon_reload=yes
|
|
||||||
|
|
||||||
- name: restart pgpool
|
|
||||||
service: name=pgpool state=restarted
|
|
||||||
|
|
||||||
- name: Stop tomcat when upgrading
|
|
||||||
service: name=tomcat state=stopped
|
|
||||||
|
|
||||||
- name: Create the authorization service webapp directory
|
|
||||||
file: dest={{ tomcat_document_root }}/webapps/authorization-service state=directory owner={{ tomcat_user }} group={{ tomcat_user }}
|
|
||||||
|
|
||||||
- name: Get and unpack the authorization war file
|
|
||||||
unarchive: copy=no src={{ authorization_service_url }} dest={{ tomcat_document_root }}/webapps/authorization-service owner={{ tomcat_user }} group={{ tomcat_user }}
|
|
||||||
args:
|
|
||||||
creates: '{{ tomcat_document_root }}/webapps/authorization-service/WEB-INF/AuthorizationConfiguration.xml'
|
|
||||||
|
|
||||||
- name: Install the authorization service AuthorizationConfiguration.xml template
|
|
||||||
template: src=AuthorizationConfiguration.xml.j2 dest={{ tomcat_document_root }}/webapps/authorization-service/{{ authorization_service_config_dest }} mode=0440 owner={{ tomcat_user }} group={{ tomcat_user }}
|
|
||||||
|
|
||||||
- name: Install the authorization service persistence.xml template
|
|
||||||
template: src=persistence.xml.j2 dest={{ tomcat_document_root }}/webapps/authorization-service/{{ authorization_service_persistence_dest }} mode=0440 owner={{ tomcat_user }} group={{ tomcat_user }}
|
|
||||||
|
|
||||||
- name: Install the logback configuration
|
|
||||||
template: src=logback.xml.j2 dest={{ tomcat_document_root }}/lib/logback.xml mode=0644 owner={{ tomcat_user }} group={{ tomcat_user }}
|
|
||||||
|
|
||||||
# - name: restore ownership
|
|
||||||
# file: dest={{ tomcat_document_root }} owner=root group=tomcat recurse=yes
|
|
||||||
|
|
||||||
- name: Start tomcat
|
|
||||||
service: name=tomcat state=started
|
|
||||||
|
|
||||||
become: true
|
|
||||||
become_user: root
|
|
||||||
|
|
@ -1,24 +0,0 @@
|
||||||
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
|
||||||
<Configuration>
|
|
||||||
<Rule path="/token/user" requiresToken="false">
|
|
||||||
{% for ip in authorized_ips %}
|
|
||||||
<Entity type="IP" value="{{ ip }}" />
|
|
||||||
{% endfor %}
|
|
||||||
</Rule>
|
|
||||||
|
|
||||||
<Rule path="/apikey" requiresToken="true" acceptedTokenTypes="USER"/>
|
|
||||||
<Rule path="/policyManager" requiresToken="true">
|
|
||||||
{% for ip in authorized_ips %}
|
|
||||||
<Entity type="IP" value="{{ ip }}" />
|
|
||||||
{% endfor %}
|
|
||||||
</Rule>
|
|
||||||
<Rule path="/token/external" requiresToken="true" acceptedTokenTypes="USER" />
|
|
||||||
<Rule path="/token/node" requiresToken="false" />
|
|
||||||
<Rule path="/token/service" requiresToken="true" acceptedTokenTypes="CONTAINER"/>
|
|
||||||
<Rule path="/token/resolve" requiresToken="false">
|
|
||||||
{% for ip in authorized_ips %}
|
|
||||||
<Entity type="IP" value="{{ ip }}" />
|
|
||||||
{% endfor %}
|
|
||||||
</Rule>
|
|
||||||
</Configuration>
|
|
||||||
|
|
||||||
|
|
@ -1,24 +0,0 @@
|
||||||
|
|
||||||
<configuration>
|
|
||||||
|
|
||||||
<appender name="FILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
|
|
||||||
<file>${catalina.base}/logs/ghn.log</file>
|
|
||||||
<append>true</append>
|
|
||||||
<encoder>
|
|
||||||
<pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{0}: %msg%n
|
|
||||||
</pattern>
|
|
||||||
</encoder>
|
|
||||||
<rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
|
|
||||||
<fileNamePattern>${catalina.base}/logs/ghn.%d{yyyy-MM-dd}.log</fileNamePattern>
|
|
||||||
<maxHistory>30</maxHistory>
|
|
||||||
</rollingPolicy>
|
|
||||||
</appender>
|
|
||||||
|
|
||||||
<logger name="org.gcube" level="{{ authorization_service_loglevel }}" />
|
|
||||||
<logger name="org.gcube.common.authorizationservice" level="{{ authorization_service_loglevel }}" />
|
|
||||||
<logger name="org.gcube.common" level="{{ authorization_service_loglevel }}" />
|
|
||||||
|
|
||||||
<root level="{{ authorization_service_root_loglevel }}">
|
|
||||||
<appender-ref ref="FILE" />
|
|
||||||
</root>
|
|
||||||
</configuration>
|
|
||||||
|
|
@ -1,33 +0,0 @@
|
||||||
<persistence xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
||||||
xsi:schemaLocation="http://java.sun.com/xml/ns/persistence http://java.sun.com/xml/ns/persistence/persistence_2_0.xsd"
|
|
||||||
version="2.0" xmlns="http://java.sun.com/xml/ns/persistence">
|
|
||||||
|
|
||||||
<!-- change here if you want name of unit different -->
|
|
||||||
<persistence-unit name="authorization" transaction-type="RESOURCE_LOCAL">
|
|
||||||
<provider>org.eclipse.persistence.jpa.PersistenceProvider</provider>
|
|
||||||
|
|
||||||
<!-- Converters -->
|
|
||||||
<class>org.gcube.common.authorizationservice.persistence.entities.converters.StringListConverter</class>
|
|
||||||
|
|
||||||
|
|
||||||
<!-- Entities -->
|
|
||||||
<class>org.gcube.common.authorizationservice.persistence.entities.AuthorizationEntity</class>
|
|
||||||
<class>org.gcube.common.authorizationservice.persistence.entities.ServiceAuthorizationEntity</class>
|
|
||||||
<class>org.gcube.common.authorizationservice.persistence.entities.UserAuthorizationEntity</class>
|
|
||||||
<class>org.gcube.common.authorizationservice.persistence.entities.ExternalServiceAuthorizationEntity</class>
|
|
||||||
<class>org.gcube.common.authorizationservice.persistence.entities.NodeAuthorizationEntity</class>
|
|
||||||
<class>org.gcube.common.authorizationservice.persistence.entities.PolicyEntity</class>
|
|
||||||
<class>org.gcube.common.authorizationservice.persistence.entities.ServicePolicyEntity</class>
|
|
||||||
<class>org.gcube.common.authorizationservice.persistence.entities.UserPolicyEntity</class>
|
|
||||||
<properties>
|
|
||||||
<property name="javax.persistence.jdbc.url"
|
|
||||||
value="jdbc:postgresql://{{ auth_postgresql_host }}/{{ psql_db_name }}" />
|
|
||||||
<property name="javax.persistence.jdbc.driver" value="org.postgresql.Driver" />
|
|
||||||
<property name="javax.persistence.jdbc.user" value="{{ psql_db_user }}" />
|
|
||||||
<property name="javax.persistence.jdbc.password" value="{{ authorization_db_pwd }}" />
|
|
||||||
<property name="eclipselink.ddl-generation" value="create-tables" />
|
|
||||||
<property name="eclipselink.ddl-generation.output-mode"
|
|
||||||
value="database" />
|
|
||||||
</properties>
|
|
||||||
</persistence-unit>
|
|
||||||
</persistence>
|
|
||||||
Loading…
Reference in New Issue