galaxy-test.yml

---
- name: Test.UseGalaxy.eu
  hosts: galaxy-test
  become: true
  become_user: root
  vars:
    # The full internal name.
    hostname: test.internal.usegalaxy.eu
  vars_files:
    - group_vars/tiaas-test.yml # All of the training infrastructure
    - group_vars/gxconfig-test.yml # The base galaxy configuration
    - group_vars/toolbox.yml # User controlled toolbox
    - group_vars/cron-test.yml # Cron configuration for handlers restart
    - secret_group_vars/sentry.yml # Sentry SDK init url
    - secret_group_vars/aws.yml # AWS creds
    - secret_group_vars/pulsar.yml # Pulsar + MQ Connections
    - secret_group_vars/oidc.yml # AAI private key
    - secret_group_vars/db-test.yml # DB URL + some postgres stuff
    - secret_group_vars/all.yml # All of the other assorted secrets...
    - mounts/mountpoints.yml
    - mounts/dest/all.yml
  handlers:
    - name: Restart Galaxy
      shell: |
        echo 'Manual zergling restart required' && cd /opt/galaxy/ && source /opt/galaxy/.bashrc  && sudo -u galaxy /usr/bin/galaxy-sync-to-nfs && systemctl restart galaxy-handler@* && systemctl restart galaxy-workflow-scheduler@* && systemctl restart galaxy-zergling@*
  pre_tasks:
    - name: Install Dependencies
      package:
        name:
          [
            "git",
            "postgresql",
            "python3-psycopg2",
            "python3-virtualenv",
            "bc",
            "python36",
            "python38",
            "make",
          ]
      become: true
    - name: Set default version of Python
      alternatives:
        name: python
        path: /usr/bin/python3
    - name: Put SELinux in permissive mode, logging actions that would be blocked.
      selinux:
        policy: targeted
        state: permissive
  roles:
    ## Dependencies
    - geerlingguy.repo-epel # Install EPEL

    ## Starting configuration of the operating system
    - role: usegalaxy_eu.handy.os_setup
      vars:
        enable_hostname: true
        enable_powertools: true # geerlingguy.repo-epel role doesn't enable PowerTools repository
        enable_remap_user: true
        enable_exclude_packages: true
        enable_pam_limits: true # Prevent out of control processes
        enable_install_software: true # Some extra admin tools (*top, vim, etc)
        enable_kernel_5: true

    - usegalaxy-eu.autoupdates # keep all of our packages up to date
    - influxdata.chrony # Keep our time in sync.

    ## Filesystems
    - usegalaxy-eu.autofs # Setup the mount points which will be needed later
    - galaxyproject.cvmfs # Galaxy datasets

    ## Monitoring
    - hxr.monitor-cluster
    - hxr.monitor-email
    - hxr.monitor-galaxy-journalctl
    - usegalaxy-eu.monitoring

    # Setup Galaxy user
    - role: galaxyproject.galaxy
      vars:
        galaxy_create_user: true
        galaxy_manage_clone: false
        galaxy_manage_download: false
        galaxy_manage_existing: true
        galaxy_manage_paths: false
        galaxy_manage_static_setup: false
        galaxy_manage_mutable_setup: false
        galaxy_manage_database: false
        galaxy_fetch_dependencies: false
        galaxy_build_client: false
    # The bashrc needs to be created for several later features.
    #    - usegalaxy-eu.bashrc

    ## Setup docker
    - geerlingguy.docker

    # HTCondor Cluster setup
    - usegalaxy_eu.htcondor

    # Misc.
    - role: hxr.galaxy-nonreproducible-tools
      become: true
      become_user: galaxy
    # - hxr.galaxy-misc
    - usegalaxy-eu.dynmotd # nicer MOTD/welcome message
    - usegalaxy-eu.rsync-to-nfs # sync codebase to NFS
    - usegalaxy-eu.webhooks # Clone webhook repository
    - usegalaxy-eu.tours # Clone tour repository

    ## SSL / Security
    - ssh-host-sign # Sign the server host key to prevent TOFU for SSH

    ## GALAXY
    - hxr.postgres-connection
    - galaxyproject.gxadmin
    # TODO move under monitoring + telegraf.
    - usegalaxy-eu.galaxy-slurp

    #    - usegalaxy-eu.google-verification
    - galaxyproject.nginx
    # The REAL galaxy role
    - role: galaxyproject.galaxy
      vars:
        galaxy_create_user: true
        galaxy_manage_clone: true
        galaxy_manage_download: false
        galaxy_manage_existing: false
        galaxy_manage_static_setup: true
        galaxy_manage_mutable_setup: true
        galaxy_manage_database: true
        galaxy_fetch_dependencies: true
        galaxy_build_client: true

    # Extras!
    - usegalaxy-eu.fix-galaxy-server-dir # Fix details into the galaxy server dir
    - hxr.install-to-venv # Some extra packages our site needs.
    - usegalaxy_eu.galaxy_systemd # Manage the Galaxy processes with SystemD
    - usegalaxy_eu.gie_proxy # Setup the NodeJS proxy for GxIT
    - usegalaxy-eu.subdomain-themes # Custom subdomain themes
    # - usegalaxy-eu.limits              # Prevent out of control processes
    - usegalaxy-eu.galaxy-cleanup # Cleanup purged datasets/histories/etc >60 days old
    # Various ugly fixes
    - usegalaxy-eu.fix-unscheduled-jobs # Workaround for ???
    - usegalaxy-eu.fix-oidc # Workaround for https://github.com/galaxyproject/galaxy/issues/8244
    - usegalaxy-eu.fix-unscheduled-workflows # Workaround for https://github.com/galaxyproject/galaxy/issues/8209
    - usegalaxy-eu.fix-failing-to-fail-jobs # Workaround for https://github.com/galaxyproject/galaxy/issues/8171, maybe can be removed in 19.09?
    - usegalaxy-eu.fix-stuck-handlers # Restart handlers to prevent several classes of issues
    - usegalaxy-eu.log-cleaner # do not retain logs, they are unnecessary/risky under GDPR

    # Some of our 'cleanups' also generate telegraf format so this goes at end.
    - dj-wasabi.telegraf
    #- dev-sec.os-hardening
    - dev-sec.ssh-hardening