139 lines
6.1 KiB
YAML
139 lines
6.1 KiB
YAML
---
|
|
- name: Set up Supernote Private Cloud
|
|
hosts: supernote
|
|
become: yes
|
|
tasks:
|
|
- name: default_packages
|
|
ansible.builtin.include_tasks: ../../templates/default_packages.yml
|
|
|
|
- name: create_user
|
|
ansible.builtin.include_tasks: ../../templates/create_user.yml
|
|
vars:
|
|
username: nick
|
|
github_user: Chewbaccalakis
|
|
|
|
- name: Install Docker
|
|
ansible.builtin.include_tasks: ../../templates/install_docker.yml
|
|
|
|
- name: Add nick to docker group
|
|
ansible.builtin.user:
|
|
name: nick
|
|
groups:
|
|
- docker
|
|
append: true
|
|
|
|
- name: Deploy Supernote Private Cloud
|
|
vars:
|
|
supernote_dir: /opt/supernote
|
|
# Branch of AtlasHorizon/compose to deploy from; override with
|
|
# `-e compose_branch=main` to test unreleased changes.
|
|
compose_branch: stable
|
|
block:
|
|
- name: Create data persistence directories
|
|
ansible.builtin.file:
|
|
path: "{{ supernote_dir }}/{{ item }}"
|
|
state: directory
|
|
mode: "0755"
|
|
loop:
|
|
- sndata/db_data
|
|
- sndata/config/mysql/conf.d
|
|
- sndata/redis_data
|
|
- sndata/recycle
|
|
- sndata/logs/cloud
|
|
- sndata/logs/app
|
|
- sndata/logs/web
|
|
- sndata/convert
|
|
- supernote_data
|
|
|
|
# Downloaded fresh each run so upstream schema changes apply on
|
|
# reruns, per Supernote's own upgrade instructions. docker-compose.yml
|
|
# comes from AtlasHorizon/compose instead (see supernote/README.md
|
|
# there) - the upstream file is missing the initdb mounts this
|
|
# playbook needs.
|
|
- name: Download Supernote database init script
|
|
ansible.builtin.get_url:
|
|
url: https://supernote-private-cloud.supernote.com/cloud/supernotedb.sql
|
|
dest: "{{ supernote_dir }}/supernotedb.sql"
|
|
mode: "0644"
|
|
force: yes
|
|
|
|
# force: true so changes in the compose repo are picked up on reruns;
|
|
# it only reports changed when the content differs.
|
|
- name: Download docker-compose.yml
|
|
ansible.builtin.get_url:
|
|
url: "https://git.atlashorizon.net/AtlasHorizon/compose/raw/branch/{{ compose_branch }}/supernote/docker-compose.yml"
|
|
dest: "{{ supernote_dir }}/docker-compose.yml"
|
|
mode: "0644"
|
|
force: true
|
|
|
|
# Pulled from Infisical, not generated/persisted to disk. Run this
|
|
# playbook as `infisical run -- ansible-playbook -i inventory ...`
|
|
# with SUPERNOTE_MYSQL_ROOT_PASSWORD, SUPERNOTE_MYSQL_PASSWORD,
|
|
# SUPERNOTE_REDIS_PASSWORD, SUPERNOTE_SMTP_SERVER, SUPERNOTE_SMTP_USER,
|
|
# and SUPERNOTE_SMTP_PASSWORD secrets set in the workspace.
|
|
# SUPERNOTE_SMTP_PORT (default 465) and SUPERNOTE_SMTP_ENCRYPTION
|
|
# (default ssl) are optional.
|
|
- name: Read secrets from environment (populated by `infisical run`)
|
|
ansible.builtin.set_fact:
|
|
supernote_mysql_root_password: "{{ lookup('ansible.builtin.env', 'SUPERNOTE_MYSQL_ROOT_PASSWORD') }}"
|
|
supernote_mysql_password: "{{ lookup('ansible.builtin.env', 'SUPERNOTE_MYSQL_PASSWORD') }}"
|
|
supernote_redis_password: "{{ lookup('ansible.builtin.env', 'SUPERNOTE_REDIS_PASSWORD') }}"
|
|
supernote_smtp_server: "{{ lookup('ansible.builtin.env', 'SUPERNOTE_SMTP_SERVER') }}"
|
|
supernote_smtp_port: "{{ lookup('ansible.builtin.env', 'SUPERNOTE_SMTP_PORT') }}"
|
|
supernote_smtp_user: "{{ lookup('ansible.builtin.env', 'SUPERNOTE_SMTP_USER') }}"
|
|
supernote_smtp_password: "{{ lookup('ansible.builtin.env', 'SUPERNOTE_SMTP_PASSWORD') }}"
|
|
supernote_smtp_encryption: "{{ lookup('ansible.builtin.env', 'SUPERNOTE_SMTP_ENCRYPTION') }}"
|
|
no_log: true
|
|
|
|
- name: Verify required secrets were provided
|
|
ansible.builtin.assert:
|
|
that:
|
|
- supernote_mysql_root_password | length > 0
|
|
- supernote_mysql_password | length > 0
|
|
- supernote_redis_password | length > 0
|
|
- supernote_smtp_server | length > 0
|
|
- supernote_smtp_user | length > 0
|
|
- supernote_smtp_password | length > 0
|
|
fail_msg: >-
|
|
SUPERNOTE_MYSQL_ROOT_PASSWORD, SUPERNOTE_MYSQL_PASSWORD,
|
|
SUPERNOTE_REDIS_PASSWORD, SUPERNOTE_SMTP_SERVER,
|
|
SUPERNOTE_SMTP_USER, and SUPERNOTE_SMTP_PASSWORD must be set.
|
|
Run this playbook via `infisical run -- ansible-playbook -i
|
|
inventory ...` with those secrets defined in the workspace.
|
|
|
|
- name: Deploy .env file (docker compose variable substitution)
|
|
ansible.builtin.template:
|
|
src: templates/supernote.env.j2
|
|
dest: "{{ supernote_dir }}/.env"
|
|
mode: "0600"
|
|
|
|
- name: Deploy SMTP config init script
|
|
ansible.builtin.template:
|
|
src: templates/supernote-email-init.sql.j2
|
|
dest: "{{ supernote_dir }}/supernote-email-init.sql"
|
|
mode: "0600"
|
|
|
|
- name: Pull prebuilt Supernote images
|
|
ansible.builtin.command:
|
|
cmd: docker compose pull
|
|
chdir: "{{ supernote_dir }}"
|
|
changed_when: false
|
|
|
|
- name: Start Supernote Private Cloud via docker compose
|
|
ansible.builtin.command:
|
|
cmd: docker compose up -d
|
|
chdir: "{{ supernote_dir }}"
|
|
register: supernote_compose_up
|
|
changed_when: "'Started' in supernote_compose_up.stderr or 'Created' in supernote_compose_up.stderr"
|
|
|
|
# docker-entrypoint-initdb.d scripts only run once, against an empty
|
|
# database, so reruns wouldn't otherwise pick up SMTP changes made in
|
|
# Infisical. Re-applying here keeps Infisical the source of truth.
|
|
- name: Apply SMTP configuration to the database
|
|
ansible.builtin.shell:
|
|
cmd: >-
|
|
docker compose exec -T -e MYSQL_PWD="{{ supernote_mysql_root_password }}"
|
|
mariadb mysql -u root supernotedb < {{ supernote_dir }}/supernote-email-init.sql
|
|
chdir: "{{ supernote_dir }}"
|
|
changed_when: false
|
|
no_log: true |