---
# tasklist for setting up Dist Git
#
# This is a bit complex, so I'm dividing it into sections.

# -- Common ----------------------------------------------
# This is very basic stuff that is needed by multiple of the next sections.
- name: install the needed packages
  package: name={{item}} state=present
  with_items:
  - git
  - httpd
  - mod_ssl
  - mod_auth_gssapi
  - python-fedmsg-genacls
  - /usr/sbin/semanage
  - mod_auth_openidc
  tags:
  - distgit

- name: install the mod_auth_openidc configuration
  template: src=auth_openidc.conf dest=/etc/httpd/conf.d/auth_openidc.conf
  notify:
  - reload httpd
  tags:
  - distgit

- name: install the http push configuration
  template: src=httppush.conf dest=/etc/httpd/conf.d/httpush.conf
  notify:
  - reload httpd
  tags:
  - distgit

- name: Create suexec wrapper directory
  file: path=/var/www/bin state=directory owner=pagure group=packager
  tags:
  - distgit

- name: Install suexec wrappers
  copy:
    src=suexec-{{item}}.sh
    dest=/var/www/bin/suexec-{{item}}.sh
    owner=pagure
    group=packager
    mode=0755
  with_items:
  - gitolite
  - upload
  tags:
  - distgit

- name: Put in git service config
  copy: src=git@.service dest=/etc/systemd/system/git@.service
  tags:
  - distgit

- name: install the mod_ssl configuration
  copy: src=ssl.conf dest=/etc/httpd/conf.d/ssl.conf
  notify:
  - reload httpd
  tags:
  - distgit

- name: install the keytab
  copy: src="{{ private }}/files/keytabs/{{env}}/pkgs"
        dest=/etc/httpd.keytab
        owner=apache
        group=apache
        mode=0600
  notify:
  - reload httpd
  tags:
  - distgit

- name: allow httpd to access the files on NFS
  seboolean: name=httpd_use_nfs state=yes persistent=yes
  tags:
  - distgit

- name: allow httpd to access git user content
  seboolean: name=httpd_read_user_content state=yes persistent=yes
  tags:
  - distgit

- name: Secure tmpfs read only
  mount: name=/dev/shm src=tmpfs fstype=tmpfs opts=defaults,size=40G state=present
  tags:
  - distgit

# -- Dist Git --------------------------------------------
# This is the Git setup itself: group, root directory, scripts,...
- name: install dist-git
  package: name={{item}} state=present
  with_items:
  - dist-git
  - dist-git-selinux
  tags:
  - distgit

- name: install the dist-git config
  copy: src=dist-git.conf dest=/etc/dist-git/dist-git.conf
  tags:
  - config
  - distgit

- name: create the distgit root directory (/srv/git)
  file: dest=/srv/git state=directory mode=0755
  tags:
  - distgit

- name: check the selinux context of the distgit root directory
  command: matchpathcon /srv/git
  register: distgitcontext
  check_mode: no
  changed_when: false
  tags:
  - config
  - distgit
  - selinux

- name: set the SELinux policy for the distgit root directory
  command: semanage fcontext -a -t git_content_t "/srv/git(/.*)?"
  when: distgitcontext.stdout.find('git_content_t') == -1
  tags:
  - config
  - distgit
  - selinux

- name: create the distgit root directory (/srv/git/repositories)
  file: dest=/srv/git/repositories state=directory mode=2775 group=packager
  tags:
  - distgit

# These should all map to pkgdb namespaces
- name: create our namespace directories inside there..
  file: dest=/srv/git/repositories/{{item}} state=directory mode=2775 group=packager
  with_items:
  - rpms
  - docker
  - modules
  # Except for these two.  These namespaces are artificially created in the
  # dist-git pkgdb sync scripts.
  - test-rpms
  - test-modules
  - test-docker
  tags:
  - distgit

- name: Install robots.txt files
  copy: src={{item}} dest=/var/www/{{item}}
  with_items:
  - robots-pkgs.txt
  - robots-src.txt
  tags:
  - distgit

- name: install the DistGit related httpd config
  copy: src=git-smart-http.conf dest=/etc/httpd/conf.d/dist-git/git-smart-http.conf
  notify:
  - reload httpd
  tags:
  - distgit

- name: Symlink pkgs-git-repos-list
  copy: src=repolist.conf dest=/etc/httpd/conf.d/dist-git/repolist.conf
  notify:
  - reload httpd
  tags:
  - distgit

- name: schedule the update hook check
  cron: >
    name="check-update-hooks" cron_file="ansible-check-update-hooks"
    minute=0 hour=0 weekday=3
    user=nobody
    job="/usr/local/bin/git-check-perms --check=update-hook /srv/git/repositories"
  tags:
  - distgit

- name: install the two scripts needed for mass-branching
  copy: src={{item}} dest=/usr/local/bin/{{item}} owner=root group=root mode=0755
  with_items:
    - mass-branching-git.py
    - mass-branching-gitolite.py
  tags:
  - config
  - distgit
  - mass-branching

# -- repoSpanner certs ---....etc...
- name: Install the certificates for repoSpanner access
  copy: src="{{private}}/files/repoSpanner/{{env}}/ca/{{item}}"
        dest="/etc/pagure/{{item}}"
        owner=pagure group=pagure mode=0600
  with_items:
  - ca.crt
  - fedora_rpms_admin.crt
  - fedora_rpms_admin.key
  - fedora_rpms_push.crt
  - fedora_rpms_push.key
  when: env == "staging"
  tags:
  - config
  - distgit

- name: Deploy configuration
  template: src=repospanner-admin.yml
            dest=/etc/pagure/repospanner-admin.yml
  when: env == "staging"
  tags:
  - config
  - distgit

- name: dumps the state of the repos in JSON
  cron:
    name: "dumps the state of the repos in JSON"
    job: "repospanner --config /etc/pagure/repospanner-admin.yml admin repo list --json |  python -m json.tool > /srv/cache/extras/repoinfo.json"
    hour: "*/2"
    minute: "5"
    state: present
    user: "root"
    cron_file: "repospanner_repoinfo_dump"
  when: env == "staging"
  tags:
  - config
  - distgit

# -- Gitolite --------------------------------------------
# This is the permission management for package maintainers, using Gitolite.
- name: create the /var/log/gitolite directory
  file: path=/var/log/gitolite owner=root group=packager state=directory mode=2775
  tags:
  - distgit

- name: create the gen-acls group
  group: name=gen-acls gid=417 state=present
  tags:
  - distgit

- name: create the gen-acls user
  user: >
        name=gen-acls
        comment="dummy system account for the gen-acls fedmsg job"
        uid=417
        group=gen-acls
        shell=/bin/bash
        home=/srv/git
  tags:
  - distgit

- name: create the /etc/gitolite/conf directory
  file: path=/etc/gitolite/conf owner=pagure group=pagure
        state=directory mode=0755
  tags:
  - distgit

- name: create the /etc/gitolite/logs directory
  file: path=/etc/gitolite/logs owner=pagure group=packager
        state=directory mode=0775
  tags:
  - distgit

- name: create the /etc/gitolite/local/VREF directory
  file: path=/etc/gitolite/local/VREF owner=pagure group=packager
        state=directory mode=0775
  tags:
  - distgit

- name: create /etc/gitolite/gitolite.rc
  template: src=gitolite.rc dest=/etc/gitolite/gitolite.rc
            owner=root group=root mode=0755
  tags:
  - distgit

- name: Create the rpms symlink (should not be needed, might still be used by some old scripts)
  command: ln -s /srv/git/repositories/ /srv/git/rpms
           creates=/srv/git/rpms
  tags:
  - config
  - distgit

- name: Create the gitolite.rc symlink
  command: ln -s /etc/gitolite/gitolite.rc /srv/git/.gitolite.rc
           creates=/srv/git/.gitolite.rc
  tags:
  - config
  - distgit

- name: Create the gitolite configuration symlink
  command: ln -s /etc/gitolite/ /srv/git/.gitolite
           creates=/srv/git/.gitolite
  tags:
  - config
  - distgit

- name: Copy in RepoAliases.header
  copy: src=RepoAliases.header dest=/etc/gitolite/RepoAliases.header
        owner=root group=root mode=0755

- name: Create the update-block-push-origin symlink
  command: ln -s /usr/share/git-core/update-block-push-origin /etc/gitolite/local/VREF/update-block-push-origin
           creates=/etc/gitolite/local/VREF/update-block-push-origin
  tags:
  - config
  - distgit

- name: install the fedmsg configuration
  template: src=fedmsg-genacls-config.py dest=/etc/fedmsg.d/genacls.py
            owner=root group=root mode=0644
  tags:
  - distgit

- name: remove file pre-dating pagure over dist-git
  file: path={{ item }} state=absent
  with_items:
    - /usr/local/bin/genacls.sh
    - /etc/cron.d/genacls.cron
  tags:
  - config
  - distgit

- name: Get admin users
  command: "/srv/web/infra/ansible/scripts/users-from-fas @sysadmin-main {{ admin_groups }}"
  register: admin_user_list
  check_mode: no
  changed_when: "1 != 1"
  run_once: True
  delegate_to: localhost
  tags:
  - config
  - distgit

- name: Save the list the users having a shell access
  template: src=gitolite_admins dest=/etc/gitolite/admins
            owner=gen-acls group=packager mode=660
  tags:
  - config
  - distgit

- name: Fix permissions on the Gitolite stuff
  file: dest={{ item.name }} group=packager mode={{ item.mode }} state={{ item.state }}
  with_items:
    - {name: /etc/gitolite/hooks, mode: 770, state: directory}
    - {name: /etc/gitolite/hooks/common, mode: 770, state: directory}

- name: Fix permissions on the Gitolite stuff (touch update if it does not exist)
  copy: content="" dest=/etc/gitolite/hooks/common/update force=no owner=root group=packager mode=0755
  tags:
  - distgit
  - config

# -- Lookaside Cache -------------------------------------
# This is the annex to Dist Git, where we host source tarballs.
- name: install the Lookaside Cache httpd configs
  template: src={{item}} dest=/etc/httpd/conf.d/dist-git/{{item}}
  with_items:
  - lookaside.conf
  - lookaside-upload.conf
  notify:
  - reload httpd
  tags:
  - distgit
  - sslciphers

- name: create the Lookaside Cache root directory
  file: dest=/srv/cache/lookaside/pkgs state=directory
        owner=apache group=apache
  tags:
  - distgit

- name: set the selinux boolean nis_enabled
  seboolean: name=nis_enabled persistent=yes state=yes
  tags:
  - distgit
  - config
  - selinux

- name: set the selinux boolean git_cgi_use_nfs
  seboolean: name=git_cgi_use_nfs persistent=yes state=yes
  tags:
  - distgit
  - config
  - selinux

# Not sure why, but fixes https://fedorahosted.org/fedora-infrastructure/ticket/4825
- name: set the selinux boolean git_system_enable_homedirs
  seboolean: name=git_system_enable_homedirs persistent=yes state=yes
  tags:
  - distgit
  - config
  - selinux

- name: check the selinux context of the Lookaside Cache root directory
  command: matchpathcon /srv/cache
  register: lcachecontext
  check_mode: no
  changed_when: false
  tags:
  - config
  - lookaside
  - selinux
  - distgit

- name: set the SELinux policy for the Lookaside Cache root directory
  command: semanage fcontext -a -t nfs_t "/srv/cache(/.*)?"
  when: lcachecontext.stdout.find('nfs_t') == -1 and env != "staging"
  tags:
  - config
  - lookaside
  - selinux
  - distgit

- name: install the fedora-ca.cert
  copy: src={{private}}/files/fedora-ca.cert dest=/etc/httpd/conf/cacert.pem
  tags:
  - distgit

- name: install the pkgs cert
  copy: src={{private}}/files/pkgs.fedoraproject.org_key_and_cert.pem
        dest=/etc/httpd/conf/pkgs.fedoraproject.org_key_and_cert.pem
        owner=apache mode=0400
  when: env != "staging"
  tags:
  - distgit

- name: install the pkgs.stg cert
  copy: src={{private}}/files/pkgs.stg.fedoraproject.org_key_and_cert.pem
        dest=/etc/httpd/conf/pkgs.fedoraproject.org_key_and_cert.pem
        owner=apache mode=0400
  when: env == "staging"
  tags:
  - distgit

# Three tasks for handling our selinux policy for upload.cgi
- name: ensure a directory exists for our SELinux policy
  file: dest=/usr/local/share/selinux/ state=directory
  tags: selinux

- name: copy over our custom selinux policy for pagure
  copy: src=pagure.pp dest=/usr/local/share/selinux/pagure.pp
  register: selinux_module
  tags: selinux
  when: env == "staging"

- name: install our custom selinux policy for pagure
  command: semodule -i /usr/local/share/selinux/pagure.pp
  when: selinux_module is changed and env == "staging"
  tags: selinux

- name: copy over our custom selinux policy
  copy: src=upload_cgi.pp dest=/usr/local/share/selinux/upload_cgi.pp
  register: selinux_module
  tags: selinux

- name: install our custom selinux policy
  command: semodule -i /usr/local/share/selinux/upload_cgi.pp
  when: selinux_module is changed
  tags: selinux

- name: copy over our custom nfs selinux policy
  copy: src=cgi-nfs.pp dest=/usr/local/share/selinux/cgi-nfs.pp
  register: nfs_selinux_module
  tags: selinux

- name: install our custom nfs selinux policy
  command: semodule -i /usr/local/share/selinux/cgi-nfs.pp
  when: nfs_selinux_module is changed
  tags: selinux

- name: setup grokmirror for repos
  package: name=python-grokmirror state=installed
  tags:
  - grokmirror
  - pkgs

- name: make dir for grokmirror manifest
  file: path=/srv/git/grokmirror state=directory owner=root group=packager mode=2775
  tags:
  - grokmirror
  - pkgs

- name: set acls for grokmirror
  acl:
    path: /srv/git/grokmirror
    etype: group
    permissions: rwx
    state: present
  tags:
  - grokmirror
  - pkgs

- name: run initial grokmirror run 
  command: /usr/bin/grok-manifest -m /srv/git/grokmirror/manifest.js.gz -t /srv/git/repositories/ creates=/srv/git/grokmirror/manifest.js.gz
  tags:
  - grokmirror
  - pkgs