From f722139ef2ed81d8fcaf74a2db2e20540fc4bf6a Mon Sep 17 00:00:00 2001
From: Aurélien Bompard <aurelien@bompard.org>
Date: Jan 25 2018 08:05:06 +0000
Subject: [PATCH 1/4] Improve on the Ansible role


---

diff --git a/ansible/roles/hubs/meta/main.yml b/ansible/roles/hubs/meta/main.yml
new file mode 100644
index 0000000..8784ce6
--- /dev/null
+++ b/ansible/roles/hubs/meta/main.yml
@@ -0,0 +1,2 @@
+dependencies:
+ - mongodb
diff --git a/ansible/roles/hubs/tasks/dev.yml b/ansible/roles/hubs/tasks/dev.yml
index 9b3133c..6b01c9b 100644
--- a/ansible/roles/hubs/tasks/dev.yml
+++ b/ansible/roles/hubs/tasks/dev.yml
@@ -21,3 +21,10 @@
 
 - name: Install Honcho's procfile
   template: src=honcho-procfile dest={{ hubs_base_dir }}/Procfile
+
+- name: Link to the FAS credentials file if any
+  file:
+    state: link
+    path: "/etc/fedmsg.d/fas_credentials.py"
+    src: "{{ hubs_code_dir }}/fedmsg.d/fas_credentials.py"
+  notify: "hubs configuration change"
diff --git a/ansible/roles/hubs/tasks/main.yml b/ansible/roles/hubs/tasks/main.yml
index 8ea311f..db877d2 100644
--- a/ansible/roles/hubs/tasks/main.yml
+++ b/ansible/roles/hubs/tasks/main.yml
@@ -10,7 +10,6 @@
   with_items:
     - npm
     - redis
-    - mongodb-server
     - fedmsg-hub
     - fedmsg-relay
     - python3-virtualenv
@@ -88,7 +87,7 @@
   become_user: "{{ main_user }}"
   command: "{{ hubs_venv_dir }}/bin/pip install -e {{ hubs_code_dir }}"
   args:
-    creates: "{{ hubs_venv_dir }}/lib/python3.5/site-packages/fedora-hubs.egg-link"
+    creates: "{{ hubs_venv_dir }}/lib/python3.6/site-packages/fedora-hubs.egg-link"
 
 - name: Set bin file context in the virtualenv
   become_user: "{{ main_user }}"
@@ -117,13 +116,6 @@
     - fedmsg_config
   notify: "hubs configuration change"
 
-- name: Link to the FAS credentials file if any
-  file:
-    state: link
-    path: "/etc/fedmsg.d/fas_credentials.py"
-    src: "{{ hubs_code_dir }}/fedmsg.d/fas_credentials.py"
-  notify: "hubs configuration change"
-
 - name: Configure application to authenticate with iddev.fedorainfracloud.org
   command:
     oidc-register
@@ -138,7 +130,6 @@
   service: name={{ item }} state=started enabled=yes
   with_items:
     - redis
-    - mongod
     - postfix
 
 # Set up, create, and populate the database.
diff --git a/ansible/roles/hubs/tasks/webserver.yml b/ansible/roles/hubs/tasks/webserver.yml
index 3359739..b846c34 100644
--- a/ansible/roles/hubs/tasks/webserver.yml
+++ b/ansible/roles/hubs/tasks/webserver.yml
@@ -8,17 +8,6 @@
     - libsemanage-python
 
 
-- name: Generate SSL certificate and key
-  shell:
-    echo -e "--\nSomeState\nSomeCity\nSomeOrganization\nSomeOrganizationalUnit\nlocalhost.localdomain\nroot@localhost.localdomain"
-    | openssl req -utf8 -newkey rsa:2048
-    -keyout /etc/pki/tls/private/localhost.key
-    -nodes -x509 -days 365
-    -out /etc/pki/tls/certs/localhost.crt
-  args:
-    creates: /etc/pki/tls/certs/localhost.crt
-
-
 - name: Gunicorn logging configuration
   copy:
     src: logging.ini
diff --git a/ansible/roles/mongodb/tasks/main.yml b/ansible/roles/mongodb/tasks/main.yml
new file mode 100644
index 0000000..220ffbe
--- /dev/null
+++ b/ansible/roles/mongodb/tasks/main.yml
@@ -0,0 +1,11 @@
+- name: install needed packages
+  package: name={{ item }} state=present
+  with_items:
+  - mongodb-server
+  tags: mongodb
+
+# mongod is the single daemon. mongos is a sharded cluster router,
+# but just plain mongod is good enough for now
+- name: start mongodb
+  service: name=mongod state=started enabled=yes
+  tags: mongodb

From d54dcdaf628076a3bfb584f01be216f1d584bb8b Mon Sep 17 00:00:00 2001
From: Aurélien Bompard <aurelien@bompard.org>
Date: Jan 25 2018 08:05:06 +0000
Subject: [PATCH 2/4] Don't rely on become being set globally


---

diff --git a/ansible/roles/hubs/tasks/db-postgresql.yml b/ansible/roles/hubs/tasks/db-postgresql.yml
index 2a9eec9..017674c 100644
--- a/ansible/roles/hubs/tasks/db-postgresql.yml
+++ b/ansible/roles/hubs/tasks/db-postgresql.yml
@@ -28,6 +28,7 @@
       name: hubs
       password: "{{ hubs_db_password }}"
       role_attr_flags: NOSUPERUSER,NOCREATEROLE,NOCREATEDB
+  become: true
   become_user: postgres
 
 - name: Create the database
@@ -35,6 +36,7 @@
       name: hubs
       owner: hubs
   register: db_creation
+  become: true
   become_user: postgres
 
 - name: Ease local access to the database
@@ -51,6 +53,7 @@
     chdir: "{{ hubs_code_dir }}"
   environment:
     HUBS_CONFIG: "{{ hubs_conf_dir }}/hubs_config.py"
+  become: true
   become_user: "{{ main_user }}"
   when: db_creation|succeeded and db_creation|changed
 
diff --git a/ansible/roles/hubs/tasks/main.yml b/ansible/roles/hubs/tasks/main.yml
index db877d2..534c13f 100644
--- a/ansible/roles/hubs/tasks/main.yml
+++ b/ansible/roles/hubs/tasks/main.yml
@@ -58,6 +58,7 @@
 
 # Set up the Python development environment
 - name: Install Fedora Hubs requirements.txt into hubs virtualenv
+  become: true
   become_user: "{{ main_user }}"
   pip:
     requirements: "{{ hubs_code_dir }}/requirements.txt"
@@ -66,6 +67,7 @@
     virtualenv_command: virtualenv-3
 
 - name: Install Fedora Hubs test-requirements.txt into hubs virtualenv
+  become: true
   become_user: "{{ main_user }}"
   pip:
     requirements: "{{ hubs_code_dir }}/test-requirements.txt"
@@ -74,6 +76,7 @@
     virtualenv_command: virtualenv-3
 
 - name: Install other packages into hubs virtualenv
+  become: true
   become_user: "{{ main_user }}"
   pip:
     name: "{{ item }}"
@@ -84,12 +87,14 @@
     - bleach
 
 - name: Install Fedora Hubs into the virtualenv
+  become: true
   become_user: "{{ main_user }}"
   command: "{{ hubs_venv_dir }}/bin/pip install -e {{ hubs_code_dir }}"
   args:
     creates: "{{ hubs_venv_dir }}/lib/python3.6/site-packages/fedora-hubs.egg-link"
 
 - name: Set bin file context in the virtualenv
+  become: true
   become_user: "{{ main_user }}"
   file:
     path: "{{ hubs_venv_dir }}/bin"
@@ -104,6 +109,7 @@
   with_first_found:
     - hubs_config.{{ ansible_hostname }}
     - hubs_config
+  become: true
   become_user: "{{ main_user }}"
   notify: "hubs configuration change"
 
@@ -121,6 +127,7 @@
     oidc-register
     --output-file {{ hubs_conf_dir }}/client_secrets.json
     https://iddev.fedorainfracloud.org/ {{ hubs_url }}
+  become: true
   become_user: "{{ main_user }}"
   args:
     creates: "{{ hubs_conf_dir }}/client_secrets.json"
@@ -139,6 +146,7 @@
 # Set up JavaScript requirements
 - name: Install npm packages
   command: npm install
+  become: true
   become_user: "{{ main_user }}"
   args:
     creates: node_modules
@@ -146,6 +154,7 @@
 
 - name: Build JavaScript assets
   command: npm run build
+  become: true
   become_user: "{{ main_user }}"
   args:
     chdir: "{{ hubs_code_dir }}/hubs/static/client"
diff --git a/ansible/vagrant-playbook.yml b/ansible/vagrant-playbook.yml
index b760bf3..41711e2 100644
--- a/ansible/vagrant-playbook.yml
+++ b/ansible/vagrant-playbook.yml
@@ -1,6 +1,5 @@
 ---
 - hosts: all
-  become: true
   become_method: sudo
   vars:
     main_user: vagrant

From ff6593c5360326fb8227891aa168a3721d87c98e Mon Sep 17 00:00:00 2001
From: Aurélien Bompard <aurelien@bompard.org>
Date: Jan 25 2018 08:05:06 +0000
Subject: [PATCH 3/4] Ansible: use the local relay on prod


---

diff --git a/ansible/roles/hubs/handlers/main.yml b/ansible/roles/hubs/handlers/main.yml
index f71ee8f..7f7235b 100644
--- a/ansible/roles/hubs/handlers/main.yml
+++ b/ansible/roles/hubs/handlers/main.yml
@@ -6,11 +6,6 @@
   listen: "hubs configuration change"
   when: not hubs_dev_mode
 
-- name: restart the hubs-specific fedmsg-relay
-  service: name=hubs-fedmsg-relay state=restarted
-  listen: "hubs configuration change"
-  when: not hubs_dev_mode
-
 - name: restart hubs triage
   service: name=hubs-triage@* state=restarted
   listen: "hubs configuration change"
diff --git a/ansible/roles/hubs/tasks/db-postgresql.yml b/ansible/roles/hubs/tasks/db-postgresql.yml
index 017674c..3c58d1e 100644
--- a/ansible/roles/hubs/tasks/db-postgresql.yml
+++ b/ansible/roles/hubs/tasks/db-postgresql.yml
@@ -4,6 +4,8 @@
   dnf: name={{ item }} state=present
   with_items:
     - postgresql-server
+    - python3-psycopg2
+    # For the ansible module
     - python-psycopg2
 
 - name: Set up postgresql database
diff --git a/ansible/roles/hubs/tasks/main.yml b/ansible/roles/hubs/tasks/main.yml
index 534c13f..bb7a79e 100644
--- a/ansible/roles/hubs/tasks/main.yml
+++ b/ansible/roles/hubs/tasks/main.yml
@@ -14,6 +14,7 @@
     - fedmsg-relay
     - python3-virtualenv
     - python3-flask-oidc
+    - python3-moksha-common
     - postfix
 
 - name: Install the distribution versions of requirements.txt
@@ -38,6 +39,7 @@
     - python3-pygments
     - python3-pygments-markdown-lexer
     - python3-retask
+    - python3-twisted
 
 
 # Create directory structure
@@ -166,7 +168,6 @@
   service: name={{ item }} state=stopped enabled=no
   with_items:
     - fedmsg-hub
-    - fedmsg-relay
 
 
 # Include mode-specific tasks
diff --git a/ansible/roles/hubs/tasks/prod.yml b/ansible/roles/hubs/tasks/prod.yml
index 0cc4894..e9393e8 100644
--- a/ansible/roles/hubs/tasks/prod.yml
+++ b/ansible/roles/hubs/tasks/prod.yml
@@ -7,7 +7,6 @@
     - hubs-worker@
     - hubs-sse
     - hubs-fedmsg-hub
-    - hubs-fedmsg-relay
   register: service_installed
 
 - name: reload systemd
@@ -17,12 +16,12 @@
 - name: Start and enable the services in prod mode
   service: name={{ item }} state=started enabled=yes
   with_items:
+    - fedmsg-relay
     - hubs-triage@1
     - hubs-triage@2
     - hubs-worker@1
     - hubs-worker@2
     - hubs-sse
     - hubs-fedmsg-hub
-    - hubs-fedmsg-relay
 
 - include_tasks: webserver.yml
diff --git a/ansible/roles/hubs/tasks/webserver.yml b/ansible/roles/hubs/tasks/webserver.yml
index b846c34..5e42c57 100644
--- a/ansible/roles/hubs/tasks/webserver.yml
+++ b/ansible/roles/hubs/tasks/webserver.yml
@@ -3,7 +3,7 @@
 - name: Install the webserver packages
   dnf: name={{ item }} state=present
   with_items:
-    - python-gunicorn
+    - python3-gunicorn
     - nginx
     - libsemanage-python
 
diff --git a/ansible/roles/hubs/templates/hubs-fedmsg-relay.service b/ansible/roles/hubs/templates/hubs-fedmsg-relay.service
deleted file mode 100644
index d8fe0ca..0000000
--- a/ansible/roles/hubs/templates/hubs-fedmsg-relay.service
+++ /dev/null
@@ -1,14 +0,0 @@
-[Unit]
-Description=Hubs-specific fedmsg processing relay
-After=network.target
-Documentation=https://fedmsg.readthedocs.org/
-
-[Service]
-ExecStart={{ hubs_venv_dir }}/bin/python /usr/bin/fedmsg-relay
-Type=simple
-User=fedmsg
-Group=fedmsg
-Restart=on-failure
-
-[Install]
-WantedBy=multi-user.target

From 2898792a992c067f6649fa897e96100929326f00 Mon Sep 17 00:00:00 2001
From: Aurélien Bompard <aurelien@bompard.org>
Date: Jan 25 2018 08:05:06 +0000
Subject: [PATCH 4/4] Make the ansible role more inline with the infra


---

diff --git a/ansible/roles/hubs/tasks/db-sqlite.yml b/ansible/roles/hubs/tasks/db-sqlite.yml
index 624c726..9d15e81 100644
--- a/ansible/roles/hubs/tasks/db-sqlite.yml
+++ b/ansible/roles/hubs/tasks/db-sqlite.yml
@@ -5,4 +5,5 @@
     chdir: "{{ hubs_code_dir }}"
   environment:
     HUBS_CONFIG: "{{ hubs_conf_dir }}/hubs_config.py"
+  become: true
   become_user: "{{ main_user }}"
diff --git a/ansible/roles/hubs/tasks/webserver.yml b/ansible/roles/hubs/tasks/webserver.yml
index 5e42c57..23152c9 100644
--- a/ansible/roles/hubs/tasks/webserver.yml
+++ b/ansible/roles/hubs/tasks/webserver.yml
@@ -8,6 +8,17 @@
     - libsemanage-python
 
 
+- name: install python3-certbot-nginx
+  dnf: name=python3-certbot-nginx state=present
+
+- name: get the letencrypt cert
+  command: certbot certonly -n --standalone --pre-hook "systemctl stop nginx" --post-hook "systemctl start nginx" -d {{ ansible_fqdn }} --agree-tos --email admin@fedoraproject.org
+  args:
+    creates: /etc/letsencrypt/live/{{ ansible_fqdn }}/privkey.pem
+  notify:
+    - restart nginx
+
+
 - name: Gunicorn logging configuration
   copy:
     src: logging.ini
diff --git a/ansible/roles/hubs/templates/hubs-webapp.service b/ansible/roles/hubs/templates/hubs-webapp.service
index 59586d3..ae6d046 100644
--- a/ansible/roles/hubs/templates/hubs-webapp.service
+++ b/ansible/roles/hubs/templates/hubs-webapp.service
@@ -6,7 +6,7 @@ Documentation=https://pagure.io/fedora-hubs/
 [Service]
 ExecStart= \
     {{ hubs_venv_dir }}/bin/python \
-    /usr/bin/gunicorn -b 127.0.0.1:8000 --threads 12 \
+    /usr/bin/python3-gunicorn -b 127.0.0.1:8000 --threads 12 \
     --log-config {{ hubs_conf_dir }}/logging.ini \
     {% if hubs_dev_mode %}--reload{% endif %} \
     hubs.app:app
diff --git a/ansible/roles/hubs/templates/nginx_ssl_params b/ansible/roles/hubs/templates/nginx_ssl_params
index c8ab38d..9a411c4 100644
--- a/ansible/roles/hubs/templates/nginx_ssl_params
+++ b/ansible/roles/hubs/templates/nginx_ssl_params
@@ -1,3 +1,5 @@
 ssl                  on;
 ssl_certificate      {{ hubs_ssl_cert }};
 ssl_certificate_key  {{ hubs_ssl_key }};
+include /etc/letsencrypt/options-ssl-nginx.conf;
+ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;