Make CodiMD role more generic

This commit is contained in:
Alexandre Iooss 2019-03-30 13:34:25 +01:00
parent 48d521fb00
commit 88b9356f7d
No known key found for this signature in database
GPG key ID: 6C79278F3FCDCC02
5 changed files with 59 additions and 53 deletions

View file

@ -0,0 +1,15 @@
---
# service_name is the name of the project on GitHub
service_name: codimd
# URL to clone
service_repo: https://github.com/hackmdio/codimd.git
# name of the service user
# It means that you will have to `sudo -u THISUSER zsh` to debug
service_user: "{{ service_name }}"
service_homedir: "/var/local/{{ service_name }}"
# service_path is where the project is cloned
# It can't be the home directory because of user hidden files.
service_path: "{{ service_homedir }}/{{ service_name }}"

View file

@ -1,26 +0,0 @@
---
# Security #1
- name: Create CodiMD system group
group:
name: codimd
system: true
state: present
# Security #2
- name: Create CodiMD user
user:
name: codimd
group: codimd
home: /var/local/codimd
comment: CodiMD
system: true
state: present
# Security #3
- name: Secure CodiMD home directory
file:
path: /var/local/codimd
state: directory
owner: codimd
group: codimd
mode: 0750

View file

@ -2,26 +2,25 @@
# Install APT dependencies # Install APT dependencies
- include_tasks: 0_apt_dependencies.yml - include_tasks: 0_apt_dependencies.yml
# Create CodiMD user and group # Create service user
- include_tasks: 1_user_group.yml - include_tasks: service_user.yml
# Download CodiMD - name: "Clone {{ service_name }} project"
- name: Clone CodiMD project
git: git:
repo: https://github.com/hackmdio/codimd.git repo: "{{ service_repo }}"
dest: /var/local/codimd/codimd dest: "{{ service_path }}"
version: 1.3.0 version: 1.3.0
become: true become: true
become_user: codimd become_user: "{{ service_user }}"
notify: Build front-end for CodiMD notify: Build front-end for CodiMD
# Setup dependencies and configs # Setup dependencies
- name: Install CodiMD dependencies - name: "Install {{ service_name }} dependencies"
yarn: yarn:
path: /var/local/codimd/codimd path: "{{ service_path }}"
production: true production: true
become: true become: true
become_user: codimd become_user: "{{ service_user }}"
register: yarn_result register: yarn_result
retries: 3 retries: 3
until: yarn_result is succeeded until: yarn_result is succeeded
@ -30,33 +29,32 @@
- name: Connect CodiMD to PostgreSQL db - name: Connect CodiMD to PostgreSQL db
template: template:
src: sequelizerc.j2 src: sequelizerc.j2
dest: /var/local/codimd/codimd/.sequelizerc dest: "{{ service_path }}/.sequelizerc"
owner: codimd owner: "{{ service_user }}"
group: codimd group: nogroup
mode: 0600 mode: 0600
# Configure - name: "Configure {{ service_name }}"
- name: Configure CodiMD
template: template:
src: config.json.j2 src: config.json.j2
dest: /var/local/codimd/codimd/config.json dest: "{{ service_path }}/config.json"
owner: codimd owner: "{{ service_user }}"
group: codimd group: nogroup
mode: 0600 mode: 0600
# Service file # Service file
- name: Install CodiMD systemd unit - name: "Install {{ service_name }} systemd unit"
template: template:
src: systemd/codimd.service.j2 src: systemd/codimd.service.j2
dest: /etc/systemd/system/codimd.service dest: "/etc/systemd/system/{{ service_name }}.service"
owner: root owner: root
group: root group: root
mode: 0644 mode: 0644
notify: Reload systemd daemons notify: Reload systemd daemons
# Run # Run
- name: Ensure that CodiMD is started - name: "Ensure that {{ service_name }} is started"
service: service:
name: codimd name: "{{ service_name }}"
state: started state: started
enabled: true enabled: true

View file

@ -0,0 +1,19 @@
---
# Having a custom group is useless so use nogroup
- name: "Create {{ service_user }} user"
user:
name: "{{ service_user }}"
group: nogroup
home: "{{ service_homedir }}"
system: true
shell: /bin/false
state: present
# Only service user should be able to go there
- name: "Secure {{ service_user }} home directory"
file:
path: "{{ service_homedir }}"
state: directory
owner: "{{ service_user }}"
group: nogroup
mode: 0700

View file

@ -7,12 +7,12 @@ Conflicts=shutdown.target
[Service] [Service]
Type=simple Type=simple
User=codimd User={{ service_user }}
Group=codimd WorkingDirectory={{ service_path }}
WorkingDirectory=/var/local/codimd/codimd
Environment="NODE_ENV=production" Environment="NODE_ENV=production"
ExecStart=/usr/bin/nodejs /var/local/codimd/codimd/app.js ExecStart=/usr/bin/nodejs ./app.js
Restart=always Restart=always
RestartSec=3
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target