Skip to content

Commit 2b9797d

Browse files
richardlaurichardlau
authored
ansible: update gh-bot server (#3803)
Create a new Debian 12 server to replace the Debian 8 `gh-bot` server. Update the `ansible/playbooks/create-github-bot.yml` playbook to automate setup, including: - Fetching of deployment secrets from the secrets repository. - Generating the allowlist of `jenkins-workspace` IP addresses from the inventory. - Restarting the services if required. Fixes: #3214
1 parent 0325f2a commit 2b9797d

File tree

8 files changed

+103
-39
lines changed

8 files changed

+103
-39
lines changed

‎ansible/inventory.yml

+9-3
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ hosts:
2626
ubuntu1604-x64-1: {ip: 147.28.162.105, alias: unencrypted}
2727

2828
- rackspace:
29-
debian8-x64-1: {ip: 23.253.100.79, alias: gh-bot}
29+
debian12-x64-1: {ip: 104.239.144.144, alias: gh-bot}
3030

3131
- softlayer:
3232
debian8-x64-1: {ip: 184.172.29.199, alias: registry-mirror}
@@ -130,8 +130,10 @@ hosts:
130130
- equinix:
131131
ubuntu2004_docker-arm64-1: {ip: 145.40.81.219}
132132
ubuntu2004_docker-arm64-3: {ip: 145.40.99.31}
133-
# when adding, removing or changing the IPs below,
134-
# remember to update Jenkins worker IP whitelist in github-bot
133+
# when adding, removing or changing the IPs for any
134+
# `jenkins-workspace-*` machine, remember to rerun
135+
# the `ansible/playbooks/create-github-bot.yml` playbook
136+
# to update the Jenkins worker IP allowlist in github-bot
135137
ubuntu2204-x64-1: {ip: 147.75.72.255, alias: jenkins-workspace-7}
136138
ubuntu2204-x64-2: {ip: 145.40.96.123, alias: jenkins-workspace-8}
137139

@@ -167,6 +169,10 @@ hosts:
167169
rhel9-x64-1: {ip: 169.60.150.92, swap_file_size_mb: 2048}
168170
ubuntu2204-x64-1: {ip: 169.60.150.82}
169171
ubuntu2204-x64-2: {ip: 169.44.168.2}
172+
# when adding, removing or changing the IPs for any
173+
# `jenkins-workspace-*` machine, remember to rerun
174+
# the `ansible/playbooks/create-github-bot.yml` playbook
175+
# to update the Jenkins worker IP allowlist in github-bot
170176
ubuntu2204-x64-3: {ip: 52.117.26.14, alias: jenkins-workspace-6}
171177
ubuntu2204_docker-x64-1: {ip: 52.117.26.9}
172178

‎ansible/playbooks/create-github-bot.yml

+1-19
Original file line numberDiff line numberDiff line change
@@ -8,26 +8,8 @@
88
# `ansible/host_vars/infra-rackspace-debian8-x64-1` in this repo (nodejs/build)
99
#
1010

11-
- hosts: infra-rackspace-debian8-x64-1
11+
- hosts: infra-rackspace-debian12-x64-1
1212
roles:
1313
- bootstrap
1414
- package-upgrade
1515
- github-bot
16-
pre_tasks:
17-
- name: check if secrets are properly set
18-
fail:
19-
failed_when: not {{ secret }}
20-
loop_control:
21-
loop_var: secret
22-
with_items:
23-
- envs.port
24-
- envs.travis_token
25-
- envs.github_token
26-
- envs.github_webhook_secret
27-
- envs.login_credentials
28-
- envs.jenkins_api_credentials
29-
- envs.jenkins_job_citgm
30-
- envs.jenkins_build_token_citgm
31-
- envs.jenkins_job_node
32-
- envs.jenkins_build_token_node
33-
- conf.github_deploy_webhook_secret

‎ansible/roles/github-bot/handlers/main.yml

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
3+
#
4+
# generic handlers for github-bot
5+
#
6+
7+
- name: restart github-bot
8+
ansible.builtin.service:
9+
name: github-bot
10+
state: restarted
11+
12+
- name: restart github-bot-deploy-webhook
13+
ansible.builtin.service:
14+
name: github-bot-deploy-webhook
15+
state: restarted

‎ansible/roles/github-bot/tasks/main.yml

+51-4
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,30 @@
11
---
22

3+
- name: check if secrets are properly set
4+
fail:
5+
failed_when: not {{ secret }}
6+
loop_control:
7+
loop_var: secret
8+
with_items:
9+
- gh_bot_secrets.envs.port
10+
- gh_bot_secrets.envs.travis_token
11+
- gh_bot_secrets.envs.github_token
12+
- gh_bot_secrets.envs.github_webhook_secret
13+
- gh_bot_secrets.envs.login_credentials
14+
- gh_bot_secrets.envs.jenkins_api_credentials
15+
- gh_bot_secrets.envs.jenkins_job_citgm
16+
- gh_bot_secrets.envs.jenkins_build_token_citgm
17+
- gh_bot_secrets.envs.jenkins_job_node
18+
- gh_bot_secrets.envs.jenkins_build_token_node
19+
- gh_bot_secrets.conf.github_deploy_webhook_secret
20+
21+
- name: Get IP addresses of jenkins-workspace machines
22+
no_log: true
23+
set_fact:
24+
jenkins_workspace_ips: "{{ jenkins_workspace_ips | default([]) + [item.value.ansible_host | string] }}"
25+
when: "item.value.alias is defined and item.value.alias is match('jenkins-workspace.*')"
26+
with_dict: "{{ hostvars }}"
27+
328
- name: Bootstrap | Install baseline packages
429
package:
530
name: "{{ package }}"
@@ -9,13 +34,13 @@
934
with_items: "{{ base_packages }}"
1035

1136
- name: Bootstrap | Add nodesource signing key
12-
apt_key:
13-
url: https://deb.nodesource.com/gpgkey/nodesource.gpg.key
14-
state: present
37+
ansible.builtin.get_url:
38+
dest: /etc/apt/keyrings/nodesource-repo.gpg.asc
39+
url: https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key
1540

1641
- name: Bootstrap | Add nodesource repo
1742
apt_repository:
18-
repo: deb https://deb.nodesource.com/node_14.x jessie main
43+
repo: deb [arch=amd64 signed-by=/etc/apt/keyrings/nodesource-repo.gpg.asc] https://deb.nodesource.com/node_20.x nodistro main
1944
state: present
2045

2146
- name: Bootstrap | APT Update and upgrade
@@ -30,6 +55,9 @@
3055
loop_control:
3156
loop_var: package
3257
with_items: "{{ packages }}"
58+
notify:
59+
- restart github-bot-deploy-webhook
60+
- restart github-bot
3361

3462
- name: Bootstrap | Enable time syncing
3563
service:
@@ -53,25 +81,34 @@
5381
template:
5482
src: "{{ role_path }}/templates/github-bot.service.j2"
5583
dest: /lib/systemd/system/github-bot.service
84+
notify:
85+
- restart github-bot
5686

5787
- name: Init | Generate and copy systemd EnvironmentFile
5888
template:
5989
src: "{{ role_path }}/templates/environment-file.j2"
6090
dest: "/home/{{ server_user }}/environment/github-bot"
91+
notify:
92+
- restart github-bot-deploy-webhook
93+
- restart github-bot
6194

6295
- name: Init | Clone github-bot repo
6396
become: yes
6497
become_user: "{{ server_user }}"
6598
git:
6699
repo: https://github.com/nodejs/github-bot.git
67100
dest: "/home/{{ server_user }}/github-bot"
101+
notify:
102+
- restart github-bot
68103

69104
- name: Init | Install npm dependencies
70105
become: yes
71106
become_user: "{{ server_user }}"
72107
npm:
73108
path: "/home/{{ server_user }}/github-bot"
74109
production: yes
110+
notify:
111+
- restart github-bot
75112

76113
- name: Init | Start github-bot
77114
service:
@@ -83,29 +120,39 @@
83120
npm:
84121
name: github-webhook
85122
global: yes
123+
notify:
124+
- restart github-bot-deploy-webhook
86125

87126
- name: Deploy Webhook | Copy config
88127
template:
89128
src: "{{ role_path }}/templates/github-bot-deploy-webhook.json.j2"
90129
dest: "/home/{{ server_user }}/config/github-bot-deploy-webhook.json"
130+
notify:
131+
- restart github-bot-deploy-webhook
91132

92133
- name: Deploy Webhook | Copy deploy script
93134
template:
94135
src: "{{ role_path }}/templates/deploy-github-bot.sh.j2"
95136
dest: "/home/{{ server_user }}/bin/deploy-github-bot.sh"
96137
mode: 0755
97138
owner: "{{ server_user }}"
139+
notify:
140+
- restart github-bot-deploy-webhook
98141

99142
- name: Deploy Webhook | Generate and copy service script
100143
template:
101144
src: "{{ role_path }}/templates/github-bot-deploy-webhook.service.j2"
102145
dest: /lib/systemd/system/github-bot-deploy-webhook.service
146+
notify:
147+
- restart github-bot-deploy-webhook
103148

104149
- name: Deploy Webhook | Start service
105150
service:
106151
name: github-bot-deploy-webhook
107152
state: started
108153
enabled: yes
154+
notify:
155+
- restart github-bot-deploy-webhook
109156

110157
- name: Deploy Webhook | Allow user to restart github-bot
111158
lineinfile:

‎ansible/roles/github-bot/templates/environment-file.j2

+11-11
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
NODE_ENV=production
2-
PORT={{ envs.port }}
3-
TRAVIS_TOKEN={{ envs.travis_token }}
4-
GITHUB_TOKEN={{ envs.github_token }}
5-
GITHUB_WEBHOOK_SECRET={{ envs.github_webhook_secret }}
6-
LOGIN_CREDENTIALS={{ envs.login_credentials }}
2+
PORT={{ gh_bot_secrets.envs.port }}
3+
TRAVIS_TOKEN={{ gh_bot_secrets.envs.travis_token }}
4+
GITHUB_TOKEN={{ gh_bot_secrets.envs.github_token }}
5+
GITHUB_WEBHOOK_SECRET={{ gh_bot_secrets.envs.github_webhook_secret }}
6+
LOGIN_CREDENTIALS={{ gh_bot_secrets.envs.login_credentials }}
77
NODE_REPO_DIR=/home/{{ server_user }}/repos/node
88
LOGS_DIR=/home/{{ server_user }}/logs
9-
JENKINS_API_CREDENTIALS={{ envs.jenkins_api_credentials }}
10-
JENKINS_JOB_CITGM={{ envs.jenkins_job_citgm }}
11-
JENKINS_BUILD_TOKEN_CITGM={{ envs.jenkins_build_token_citgm }}
12-
JENKINS_JOB_NODE={{ envs.jenkins_job_node }}
13-
JENKINS_BUILD_TOKEN_NODE={{ envs.jenkins_build_token_node }}
14-
JENKINS_WORKER_IPS=147.75.70.237,51.15.200.62,51.15.218.201,163.172.186.154,147.75.66.203,147.75.81.67,52.117.26.14,147.75.72.255,145.40.96.123
9+
JENKINS_API_CREDENTIALS={{ gh_bot_secrets.envs.jenkins_api_credentials }}
10+
JENKINS_JOB_CITGM={{ gh_bot_secrets.envs.jenkins_job_citgm }}
11+
JENKINS_BUILD_TOKEN_CITGM={{ gh_bot_secrets.envs.jenkins_build_token_citgm }}
12+
JENKINS_JOB_NODE={{ gh_bot_secrets.envs.jenkins_job_node }}
13+
JENKINS_BUILD_TOKEN_NODE={{ gh_bot_secrets.envs.jenkins_build_token_node }}
14+
JENKINS_WORKER_IPS={{ jenkins_workspace_ips | join(',') }}

‎ansible/roles/github-bot/templates/github-bot-deploy-webhook.json.j2

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"port": 9999,
33
"path": "/deploy-webhook",
4-
"secret": "{{ conf.github_deploy_webhook_secret }}",
4+
"secret": "{{ gh_bot_secrets.conf.github_deploy_webhook_secret }}",
55
"log": "/home/{{ server_user }}/logs/github-bot-webhook.log",
66
"rules": [
77
{

‎ansible/roles/github-bot/vars/main.yml

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
---
22
base_packages:
33
- aptitude
4-
- python-apt
4+
- python3-apt
5+
- systemd-timesyncd
56

67
packages:
78
- nodejs

‎ansible/roles/read-secrets/tasks/partials/infra.yml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
3+
- name: Read github-bot secrets
4+
ansible.builtin.set_fact:
5+
gh_bot_secrets: "{{ lookup('pipe', 'gpg -d ' + group_vars | quote) | from_yaml }}"
6+
no_log: yes
7+
loop_control:
8+
loop_var: group_vars
9+
with_first_found:
10+
- files:
11+
- "{{ secrets_repo_root }}/build/github-bot/deployment_secrets.yml"
12+
skip: true
13+
when: alias is defined and alias == 'gh-bot'

0 commit comments

Comments
 (0)