copy:

src: 000-default.conf

dest: /etc/apache2/sites-available/

notify:

- reload apache2

file:

path: /etc/letsencrypt/renewal-hooks/deploy

state: directory

tags:

- certbot

ufw:

rule: allow

proto: tcp

loop:

- "80" # HTTP

- "443" # HTTPS

copy:

src: ufw.conf

dest: /etc/fail2ban/action.d/

notify:

- restart fail2ban

tags:

copy:

src: sshd.conf

dest: /etc/fail2ban/jail.d/

notify:

- restart fail2ban

tags:

dependencies:

- docker

- name: set internal var for convey_filename

set_fact:

- name: set internal var for convey_url

set_fact:

- name: set install directory

set_fact:

convey_install_dir: "/usr/local/bin"

get_url:

mode: "0755"

---

- name: "update-grub"

notify:

- "reboot"

- name: "reboot"

state: "directory"

owner: "root"

group: "root"

- name: "extract coverity build tool"

unarchive:

src: "{{ coverity_archive }}"

copy:

src: 60-firewall.conf

dest: /etc/sysctl.d/

tags:

- firewall

- sysctl

state: "present"

- include_tasks: "source.yml"

- name: "run ldconfig"

---

- include_tasks: "source.yml"

- name: "run ldconfig"

src: "https://gitlab.gnome.org/GNOME/libhandy/-/archive/{{ libhandy_version }}/libhandy-{{ libhandy_version }}.tar.bz2"

dest: "/usr/src/"

remote_src: "yes"

shell: |

set -ex

rm -rf build

name: "gtar--"

state: "present"

- name: "run ldconfig"

src: "https://libnice.freedesktop.org/releases/libnice-{{ libnice_version }}.tar.gz"

dest: "/usr/src/"

remote_src: "yes"

shell: |

set -ex

meson build

ninja -C build install

args:

file:

path: "/etc/letsencrypt/renewal-hooks/deploy"

state: "directory"

- name: "install hooks for certbot"

copy:

src: "{{ item }}.certbot"

file:

path: /etc/mercurial

state: directory

- name: turn evolve on

copy:

dest: /etc/mercurial/hgrc

content: |

[extensions]

evolve =

name:

- meson

executable: pip3

when: meson_install_from_pip|bool

- name: install meson from apt

apt:

- name: install pip3 from pkg

openbsd_pkg:

name: py3-pip

- name: install meson from pip

pip:

name:

- meson

executable: pip3.8

template:

src: debian-backports.preferences.j2

dest: /etc/apt/preferences.d/debian-backports

notify:

- update apt cache

---

file:

state: directory

- name: download buildAgent.zip

get_url:

- name: extract buildAgent.zip

unarchive:

remote_src: yes

- name: check for agent configuration

stat:

register: build_agent_properties

- name: save authorizationToken

register: _build_agent_token

when: build_agent_properties.stat.exists

- name: set authorization token

when: _build_agent_token.changed

- name: configure agent

copy:

content: |

workDir=../work

tempDir=../temp

systemDir=../system

{% endfor %}

- hostname: "frs.sf.net"

ip: "216.105.38.21"

type: "ssh-rsa"

- hostname: "frs.sourceforge.net"

ip: "216.105.38.21"

type: "ssh-rsa"

- hostname: "web.sf.net"

ip: "216.105.38.21"

type: "ssh-rsa"

- hostname: "web.sourceforge.net"

ip: "216.105.38.21"

type: "ssh-rsa"

- hostname: "frs.sf.net"

ip: "216.105.38.21"

type: "ecdsa-sha2-nistp256"

pubkey: "AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCwsY6sZT4MTTkHfpRzYjxG7mnXrGL74RCT2cO/NFvRrZVNB5XNwKNn7G5fHbYLdJ6UzpURDRae1eMg92JG0+yo="

- hostname: "frs.sourceforge.net"

ip: "216.105.38.21"

type: "ecdsa-sha2-nistp256"

- hostname: "web.sf.net"

ip: "216.105.38.21"

type: "ecdsa-sha2-nistp256"

- hostname: "web.sourceforge.net"

ip: "216.105.38.21"

type: "ecdsa-sha2-nistp256"

- hostname: "frs.sf.net"

ip: "216.105.38.21"

type: "ssh-ed25519"

- hostname: "frs.sourceforge.net"

ip: "216.105.38.21"

type: "ssh-ed25519"

- hostname: "web.sf.net"

ip: "216.105.38.21"

type: "ssh-ed25519"

- hostname: "web.sourceforge.net"

ip: "216.105.38.21"

type: "ssh-ed25519"

loop_control:

label: "{{ item.hostname }}"

tags:

- name: delete old run script

file:

state: absent

- name: install run script

copy:

content: |

#!/bin/sh

# Wrapper script to get teamcity agent to run

export JAVA_HOME="/usr/local/jdk-11"

shift 0

mode: '0555'

- name: install init script

dest: /etc/rc.d/teamcity_agent

content: |

#!/bin/sh

deamon_user="teamcity"

. /etc/rc.d/rc.subr

- name: install systemd unit

copy:

dest: /etc/systemd/system/teamcity-agent.service

content: |

[Unit]

Description=TeamCity Build Agent

[Service]

Type=simple

Restart=always

RemainAfterExit=yes

---

group:

system: yes

when: ansible_system == "OpenBSD"

user:

shell: /bin/sh

system: yes

createhome: yes

when: ansible_system != "OpenBSD"

user:

shell: /bin/false

system: yes

createhome: yes

---

- name: set internal var for buildAgent.zip url

set_fact:

- name: set internal var for teamcity_agent_home

set_fact:

---

- name: update homebrew

tags:

- update

become: no

- name: update packages

tags:

- update

become: no

# https://github.com/fxlv/ansible/blob/master/tasks/freebsd-update.yml

---

- name: fetch updates

register: result_update

changed_when: "'No updates needed' not in result_update.stdout"

when: ansible_architecture != 'arm64'

- name: install updates

register: result_update_install

- name: reboot to updated system

when: result_update_install.changed

- name: update packages

- name: upgrade packages

---

- name: update packages

openbsd_pkg:

name: '*'

loop:

- "status.pidgin.im"

- "status.imfreedom.org"

tags:

- "apache"

- name: "enable apache configuration"

loop:

- "status.pidgin.im"

- "status.imfreedom.org"

notify:

- "reload apache2"

tags:

- "apache"

copy:

group: "{{ vigil_group }}"

owner: "{{ vigil_user }}"

dest: "{{ vigil_home }}/vigil/res/assets/images/branding/"

src: "branding/"

- hosts: teamcity_convey_agents

roles:

- role: update

- role: convey

- role: teamcity

teamcity_server: https://ci.imfreedom.org/

- hosts: teamcity_coverity_agents

roles:

- role: update

- role: coverity

- role: meson

- role: teamcity

teamcity_server: https://ci.imfreedom.org/

- hosts: teamcity_simple_agents

roles:

- role: update

- role: meson

- role: teamcity

teamcity_server: https://ci.imfreedom.org/