117 lines
3.8 KiB
YAML
117 lines
3.8 KiB
YAML
#SPDX-License-Identifier: MIT-0
|
|
---
|
|
# tasks file for opnform
|
|
|
|
# =====================================================================
|
|
# 0. VALIDATION
|
|
# =====================================================================
|
|
|
|
- name: Validate required secrets
|
|
ansible.builtin.assert:
|
|
that:
|
|
- opnform_app_key | length > 0
|
|
- opnform_app_key is match('^base64:[A-Za-z0-9+/=]+$')
|
|
- opnform_jwt_secret | length > 0
|
|
- opnform_front_api_secret | length > 0
|
|
- opnform_db_password | length > 0
|
|
fail_msg: >-
|
|
OpnForm requires opnform_app_key (prefix 'base64:'), opnform_jwt_secret,
|
|
opnform_front_api_secret and opnform_db_password.
|
|
Generate with: openssl rand -base64 32
|
|
The app_key MUST be prefixed with "base64:"
|
|
Provide via OpenBao, Ansible Vault or extra-vars.
|
|
success_msg: Secrets validation passed
|
|
|
|
- name: Validate OIDC configuration when enabled
|
|
ansible.builtin.assert:
|
|
that:
|
|
- opnform_oidc_client_secret | length > 0
|
|
fail_msg: >-
|
|
opnform_oidc_client_secret must be set when opnform_oidc_enabled is true.
|
|
when: opnform_oidc_enabled | bool
|
|
|
|
# =====================================================================
|
|
# 1. PREPARATION
|
|
# =====================================================================
|
|
|
|
- name: Ensure required packages are installed
|
|
ansible.builtin.package:
|
|
name:
|
|
- python3-docker
|
|
state: present
|
|
|
|
- name: Create docker compose directory
|
|
ansible.builtin.file:
|
|
path: "{{ opnform_docker_compose_dir }}"
|
|
state: directory
|
|
mode: '0755'
|
|
|
|
- name: Create OpnForm data directories
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
mode: "0755"
|
|
loop:
|
|
- "{{ opnform_docker_volume_dir }}"
|
|
- "{{ opnform_storage_dir }}"
|
|
- "{{ opnform_db_data_dir }}"
|
|
- "{{ opnform_redis_data_dir }}"
|
|
|
|
# =====================================================================
|
|
# 2. CONFIGURATION FILES
|
|
# =====================================================================
|
|
|
|
- name: Deploy nginx ingress configuration
|
|
ansible.builtin.template:
|
|
src: nginx.conf.j2
|
|
dest: "{{ opnform_docker_compose_dir }}/nginx.conf"
|
|
mode: '0644'
|
|
notify: restart opnform
|
|
|
|
- name: Deploy docker-compose file
|
|
ansible.builtin.template:
|
|
src: docker-compose.yml.j2
|
|
dest: "{{ opnform_docker_compose_dir }}/docker-compose.yml"
|
|
mode: '0644'
|
|
notify: restart opnform
|
|
|
|
# =====================================================================
|
|
# 3. CONTAINER STARTUP
|
|
# =====================================================================
|
|
|
|
- name: Start opnform containers
|
|
community.docker.docker_compose_v2:
|
|
project_src: "{{ opnform_docker_compose_dir }}"
|
|
state: present
|
|
wait: true
|
|
wait_timeout: 180
|
|
|
|
# =====================================================================
|
|
# 4. WAIT FOR API READINESS
|
|
# =====================================================================
|
|
|
|
- name: Wait for API container to be healthy
|
|
ansible.builtin.command:
|
|
cmd: docker inspect --format='{% raw %}{{.State.Health.Status}}{% endraw %}' opnform-api
|
|
register: api_health
|
|
until: api_health.stdout == "healthy"
|
|
retries: 30
|
|
delay: 10
|
|
changed_when: false
|
|
|
|
- name: Display deployment info
|
|
ansible.builtin.debug:
|
|
msg: |-
|
|
OpnForm deployed at {{ opnform_base_url }}
|
|
|
|
Default credentials (from API container logs on first start):
|
|
Email: admin@opnform.com
|
|
Password: password
|
|
|
|
On first login you will be prompted to change email and password.
|
|
|
|
If login does not respond, the DB seed may have failed. Run:
|
|
docker compose -f {{ opnform_docker_compose_dir }}/docker-compose.yml exec api php artisan migrate:refresh --seed
|
|
docker compose -f {{ opnform_docker_compose_dir }}/docker-compose.yml exec api php artisan app:init-project
|
|
|
|
OIDC: {% if opnform_oidc_enabled %}enabled (configure via Admin UI){% else %}disabled{% endif %}
|