opendev/system-config
Code Issues Proposed changes
system-config/playbooks/roles/letsencrypt-create-certs/handlers/main.yaml
Ian Wienand 368466730c Migrate codesearch site to container 
The hound project has undergone a small re-birth and moved to

 https://github.com/hound-search/hound

which has broken our deployment.  We've talked about leaving
codesearch up to gitea, but it's not quite there yet.  There seems to
be no point working on the puppet now.

This builds a container than runs houndd.  It's an opendev specific
container; the config is pulled from project-config directly.

There's some custom scripts that drive things.  Some points for
reviewers:

 - update-hound-config.sh uses "create-hound-config" (which is in
   jeepyb for historical reasons) to generate the config file.  It
   grabs the latest projects.yaml from project-config and exits with a
   return code to indicate if things changed.

 - when the container starts, it runs update-hound-config.sh to
   populate the initial config.  There is a testing environment flag
   and small config so it doesn't have to clone the entire opendev for
   functional testing.

 - it runs under supervisord so we can restart the daemon when
   projects are updated.  Unlike earlier versions that didn't start
   listening till indexing was done, this version now puts up a "Hound
   is not ready yet" message when while it is working; so we can drop
   all the magic we were doing to probe if hound is listening via
   netstat and making Apache redirect to a status page.

 - resync-hound.sh is run from an external cron job daily, and does
   this update and restart check.  Since it only reloads if changes
   are made, this should be relatively rare anyway.

 - There is a PR to monitor the config file
   (https://github.com/hound-search/hound/pull/357) which would mean
   the restart is unnecessary.  This would be good in the near and we
   could remove the cron job.

 - playbooks/roles/codesearch is unexciting and deploys the container,
   certificates and an apache proxy back to localhost:6080 where hound
   is listening.

I've combined removal of the old puppet bits here as the "-codesearch"
namespace was already being used.

Change-Id: I8c773b5ea6b87e8f7dfd8db2556626f7b2500473
2020-11-20 07:41:12 +11:00

246 lines
10 KiB
YAML
Raw Blame History

# Handlers for "letsencrypt update {{ key }}" events
#
# Note that because Ansible requires every called handler to have a
# listener, every host will need to provide a handler somehow.
#
# NOTE(ianw): as at 04/2019 it seems that something like
# listen: letsencrypt updated letsencrypt01-main-service
# doesn't actually register the handler.
#
# NOTE: import_tasks or include can not be used in handlers
# ("include_tasks" is okay).
# https://docs.ansible.com/ansible/latest/porting_guides/porting_guide_2.8.html#imports-as-handlers
- name: letsencrypt updated graphite02-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_graphite.yaml
- name: letsencrypt updated tarballs-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated zuul-ci-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated zuul-ci-git
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated zuul-opendev-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated logs-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated insecure-ci-registry01-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_zuul_registry.yaml
- name: letsencrypt updated meetpad01-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_jitsi_meet.yaml
# Static
- name: letsencrypt updated static01-opendev-org-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated static01-docs-airshipit-org
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated static01-ci-openstack-org
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated static01-cinder-openstack-org
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated static01-developer-openstack-org
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated static01-devstack-org
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated static01-docs-opendev-org
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated static01-docs-openstack-org
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated static01-docs-starlingx-io
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated static01-glance-openstack-org
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated static01-git-airshipit-org
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated static01-git-starlingx-io
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated static01-git-openstack-org
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated static01-git-zuul-ci-org
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated static01-governance-openstack-org
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated static01-horizon-openstack-org
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated static01-keystone-openstack-org
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated static01-nova-openstack-org
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated static01-service-types-openstack-org
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated static01-specs-openstack-org
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated static01-security-openstack-org
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated static01-summit-openstack-org
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated static01-swift-openstack-org
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated static01-releases-openstack-org
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated static01-tarballs-opendev-org
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated static01-tarballs-openstack-org
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated static01-zuul-ci-org
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated grafana01-opendev-org-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated codesearch01-opendev-org-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
# nodepool
- name: letsencrypt updated nb01-opendev-org-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated nb02-opendev-org-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated nb03-opendev-org-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
# review-dev
- name: letsencrypt updated review-dev01-opendev-org-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
# review
- name: letsencrypt updated review01-opendev-org-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
# review-test
- name: letsencrypt updated review-test-opendev-org-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
# Mirrors
- name: letsencrypt updated mirror01-dfw-rax-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated mirror01-iad-rax-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated mirror01-ord-rax-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated mirror01-bhs1-ovh-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated mirror02-gra1-ovh-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated mirror02-regionone-linaro-us-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated mirror02-mtl01-inap-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated mirror01-kna1-airship-citycloud-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated mirror01-us-east-openedge-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated mirror01-sjc1-vexxhost-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yam
- name: letsencrypt updated mirror01-ca-ymq-1-vexxhost-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated mirror01-regionone-limestone-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
# Gate testing hosts:
- name: letsencrypt updated letsencrypt01-main-service
include_tasks: roles/letsencrypt-create-certs/handlers/touch_file.yaml
vars:
touch_file: '/tmp/letsencrypt01-main-service.stamp'
- name: letsencrypt updated letsencrypt01-other-service
include_tasks: roles/letsencrypt-create-certs/handlers/touch_file.yaml
vars:
touch_file: '/tmp/letsencrypt01-other-service.stamp'
- name: letsencrypt updated letsencrypt02-main-service
include_tasks: roles/letsencrypt-create-certs/handlers/touch_file.yaml
vars:
touch_file: '/tmp/letsencrypt02-main-service.stamp'
- name: letsencrypt updated mirror01-openafs-provider-opendev-org-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated mirror02-openafs-provider-opendev-org-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated gitea99-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_gitea.yaml
- name: letsencrypt updated nb01-test-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
- name: letsencrypt updated etherpad01-opendev-org-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
# We split out handlers for each gitea host as handlers should be run in order
# This allows us to do a rolling restart of the gitea backends.
- name: letsencrypt updated gitea01-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_gitea.yaml
- name: letsencrypt updated gitea02-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_gitea.yaml
- name: letsencrypt updated gitea03-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_gitea.yaml
- name: letsencrypt updated gitea04-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_gitea.yaml
- name: letsencrypt updated gitea05-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_gitea.yaml
- name: letsencrypt updated gitea06-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_gitea.yaml
- name: letsencrypt updated gitea07-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_gitea.yaml
- name: letsencrypt updated gitea08-main
include_tasks: roles/letsencrypt-create-certs/handlers/restart_gitea.yaml
View Git Blame Copy Permalink