523 iocage template ansible-repos

Use case 

Create a jail that provides git repos for ansible-pull. Create iocage template ansible-repos and configure git-daemon. Create jails from the template and clone repos to the base-path.

Tree 

shell > tree .
.
├── ansible.cfg
├── files
│   └── pkgs.json
├── group_vars
│   ├── all
│   │   ├── common.yml
│   │   ├── project-hosts.yml
│   │   └── project.yml
│   └── pull_repos
│       └── repos.yml
├── hosts
│   └── 06_iocage2.yml
├── host_vars
│   └── iocage_06
│       └── template.yml
├── iocage.ini
├── pb-iocage-template.yml
└── pb-repos.yml

Synopsis 

At a managed node:
- Use the role vbotka.freebsd.iocage_template to create the template ansible-repos
- In the playbook vbotka.freebsd.pb_iocage_project_create_from_templates.yml create jails from the template.
In the inventory group pull_repos clone the repos that will be used by ansible-pull.

Requirements 

Note

See the example 311 Configure and start git_daemon

ansible.cfg 

[defaults]
callback_result_format = yaml
deprecation_warnings = false
display_skipped_hosts = false
gathering = explicit
interpreter_python = auto_silent
log_path = /var/log/ansible.log

[connection]
pipelining = true

Inventory iocage.ini 

iocage_06

[iocage]
iocage_06

[iocage:vars]
ansible_user=admin
ansible_become=true
ansible_python_interpreter=auto_silent

hosts 

hosts/06_iocage2.yml

plugin: vbotka.freebsd.iocage2
host: iocage_06
user: admin
sudo: true
get_properties: true
inventory_hostname_tag: alias

compose:
  iocage_tags: dict(iocage_properties.notes | regex_findall('(\w+)=([\w\-]+)'))
  iocage_classes: iocage_properties.notes | regex_findall('(?<=class=)[\w\-]+|(?<=,)[\w\-]+')
# connection plugin vbotka.freebsd.jailexec
  ansible_connection: "'vbotka.freebsd.jailexec'"
  ansible_ssh_user: "'admin'"
  ansible_jail_host: dict(iocage_properties.notes | regex_findall('(\w+)=([\w\-]+)')).vmm | d('none')
  ansible_jail_name: iocage_jid
  ansible_jail_privilege_escalation: "'sudo'"
# ansible option
  ansible_python_interpreter: "'auto_silent'"

groups:
  pull_repos: iocage_classes is contains('repos')

keyed_groups:
  - prefix: state
    key: iocage_state
  - prefix: vmm
    key: iocage_tags.vmm

The repos are cloned from the local mirror at git_server. To reproduce this example, create your mirror and fit the IP to your needs. See 311 Configure and start git_daemon. Optionally, for testing, clone the repos from GitHub.

host_vars 

host_vars/iocage_06/template.yml

fit_templates:
  ansible-repos:
    release: 15.1-RELEASE
    pkglist: /tmp/ansible/ansible-repos/pkgs.json
    commands: "{{ fit_commands }}"
    rcconf: "{{ fit_rcconf | dict2items }}"
    properties:
      ip4: disable
      ip6: disable
      ip6_addr: none
      bpf: 1
      dhcp: 1
      vnet: 1
      notes: '"class=repos alias=ansible_repos"'

fit_rcconf:
  git_daemon_enable: "YES"
  git_daemon_directory: "/usr/local/git"
  git_daemon_flags: "--syslog --base-path=/usr/local/git --export-all --reuseaddr --detach"

fit_commands:
  - mkdir -p /usr/local/git
  - chown -R git_daemon:git_daemon /usr/local/git
  - chmod -R 755 /usr/local/git

Important

Running git daemon with these specific flags sets up a public, unauthenticated Git server. This configuration is highly efficient for local mirroring, but it completely bypasses authentication and authorization. Ensure the daemon is strictly read-only (which is the default).

files 

files/pkgs.json

{
    "pkgs": [
        "git"
        ]
}

Playbook pb-iocage-template.yml 

---
- name: Create iocage templates.
  hosts: iocage

  roles:

    - vbotka.freebsd.iocage_template

Playbook output - Create iocage templates 

(env) > ansible-playbook -i iocage.ini pb-iocage-template.yml

PLAY [Create iocage templates.] ************************************************

TASK [vbotka.freebsd.iocage_template : Setup: Get iocage list of templates.] ***
ok: [iocage_06]

TASK [vbotka.freebsd.iocage_template : Setup: Get activated pool.] *************
ok: [iocage_06]

TASK [vbotka.freebsd.iocage_template : Pkglist: Create directories for pkglist files.] ***
ok: [iocage_06] => (item=ansible-repos /tmp/ansible/ansible-repos)

TASK [vbotka.freebsd.iocage_template : Pkglist: Copy pkglist files.] ***********
ok: [iocage_06] => (item=ansible-repos /tmp/ansible/ansible-repos/pkgs.json)

TASK [vbotka.freebsd.iocage_template : Create: Get iocage list of jails.] ******
ok: [iocage_06]

TASK [vbotka.freebsd.iocage_template : Create: Create jails.] ******************
ok: [iocage_06] => (item=ansible-repos 15.1-RELEASE)

TASK [vbotka.freebsd.iocage_template : Start: Get iocage list of jails.] *******
ok: [iocage_06]

TASK [vbotka.freebsd.iocage_template : Start: Start jails.] ********************
ok: [iocage_06]

TASK [vbotka.freebsd.iocage_template : Rcconf: Configure /etc/rc.conf] *********
changed: [iocage_06] => (item=ansible-repos git_daemon_enable YES)
changed: [iocage_06] => (item=ansible-repos git_daemon_directory /usr/local/git)
changed: [iocage_06] => (item=ansible-repos git_daemon_flags --syslog --base-path=/usr/local/git --export-all --reuseaddr --detach)

TASK [vbotka.freebsd.iocage_template : Commands: Execute commands.] ************
ok: [iocage_06] => (item=ansible-repos > mkdir -p /usr/local/git)
ok: [iocage_06] => (item=ansible-repos > chown -R git_daemon:git_daemon /usr/local/git)
ok: [iocage_06] => (item=ansible-repos > chmod -R 755 /usr/local/git)

TASK [vbotka.freebsd.iocage_template : Stop: Get iocage list of jails.] ********
ok: [iocage_06]

TASK [vbotka.freebsd.iocage_template : Stop: Stop jails.] **********************
ok: [iocage_06]

TASK [vbotka.freebsd.iocage_template : Template: Set template.] ****************
ok: [iocage_06] => (item=ansible-repos)

PLAY RECAP *********************************************************************
iocage_06                  : ok=13   changed=1    unreachable=0    failed=0    skipped=37   rescued=0    ignored=0   

List templates 

shell > ssh admin@iocage_06 sudo iocage list -lt

+------+-------------------------+------+-------+----------+-----------------+-----------------------+-----+----------+----------+
| JID  |          NAME           | BOOT | STATE |   TYPE   |     RELEASE     |          IP4          | IP6 | TEMPLATE | BASEJAIL |
+======+=========================+======+=======+==========+=================+=======================+=====+==========+==========+
| None | ansible-client          | off  | down  | template | 15.1-RELEASE-p1 | DHCP (not running)    | -   | -        | no       |
+------+-------------------------+------+-------+----------+-----------------+-----------------------+-----+----------+----------+
| None | ansible-client-apache   | off  | down  | template | 15.1-RELEASE-p1 | DHCP (not running)    | -   | -        | no       |
+------+-------------------------+------+-------+----------+-----------------+-----------------------+-----+----------+----------+
| None | ansible-client-pull     | off  | down  | template | 15.1-RELEASE-p1 | DHCP (not running)    | -   | -        | no       |
+------+-------------------------+------+-------+----------+-----------------+-----------------------+-----+----------+----------+
| None | ansible-init            | off  | down  | template | 15.1-RELEASE-p1 | DHCP (not running)    | -   | -        | no       |
+------+-------------------------+------+-------+----------+-----------------+-----------------------+-----+----------+----------+
| None | ansible-init-devel      | off  | down  | template | 15.1-RELEASE-p1 | DHCP (not running)    | -   | -        | no       |
+------+-------------------------+------+-------+----------+-----------------+-----------------------+-----+----------+----------+
| None | ansible-init-example    | off  | down  | template | 15.1-RELEASE-p1 | DHCP (not running)    | -   | -        | no       |
+------+-------------------------+------+-------+----------+-----------------+-----------------------+-----+----------+----------+
| None | ansible-nginx           | off  | down  | template | 15.1-RELEASE-p1 | DHCP (not running)    | -   | -        | no       |
+------+-------------------------+------+-------+----------+-----------------+-----------------------+-----+----------+----------+
| None | ansible-pkg-repo        | off  | down  | template | 15.1-RELEASE-p1 | DHCP (not running)    | -   | -        | no       |
+------+-------------------------+------+-------+----------+-----------------+-----------------------+-----+----------+----------+
| None | ansible-repos           | off  | down  | template | 15.1-RELEASE-p1 | DHCP (not running)    | -   | -        | no       |
+------+-------------------------+------+-------+----------+-----------------+-----------------------+-----+----------+----------+
| None | ansible-syslogng-client | off  | down  | template | 15.1-RELEASE-p1 | DHCP (not running)    | -   | -        | no       |
+------+-------------------------+------+-------+----------+-----------------+-----------------------+-----+----------+----------+
| None | ansible-syslogng-server | off  | down  | template | 15.1-RELEASE-p1 | vnet0|172.16.99.41/24 | -   | -        | no       |
+------+-------------------------+------+-------+----------+-----------------+-----------------------+-----+----------+----------+

Playbook output - Create project jails from iocage templates 

(env) > ansible-playbook -i iocage.ini -i hosts vbotka.freebsd.pb_iocage_project_create_from_templates.yml

PLAY [Create and start project jails from iocage templates.] *******************

TASK [Setup: Get activated pool.] **********************************************
ok: [iocage_06]

TASK [Create: Create jails.] ***************************************************
ok: [iocage_06] => (item=repos)
ok: [iocage_06] => (item=repos-devel)

TASK [Ai-vars-class: Create ansible init vars dirs.] ***************************
changed: [iocage_06] => (item=repos)
changed: [iocage_06] => (item=repos-devel)

TASK [Ai-vars-jail: Create ansible init vars dirs.] ****************************
ok: [iocage_06] => (item=repos)
ok: [iocage_06] => (item=repos-devel)

TASK [Properties: Set properties.] *********************************************
ok: [iocage_06] => (item=repos)
ok: [iocage_06] => (item=repos-devel)

TASK [Start: Start jails.] *****************************************************
ok: [iocage_06]

PLAY RECAP *********************************************************************
iocage_06                  : ok=6    changed=1    unreachable=0    failed=0    skipped=23   rescued=0    ignored=0   

Inventory graph 

shell > ansible-inventory -i hosts --graph

@all:
  |--@ungrouped:
  |--@pull_repos:
  |  |--repos
  |  |--repos_devel
  |--@state_up:
  |  |--repos
  |  |--test_153
  |  |--log_server
  |  |--repos_devel
  |  |--foo
  |  |--pkg_repo
  |  |--www_02
  |  |--bar
  |  |--test_152
  |  |--www_01
  |  |--test_151
  |--@vmm_iocage_06:
  |  |--repos
  |  |--test_153
  |  |--log_server
  |  |--db1
  |  |--repos_devel
  |  |--db2
  |  |--foo
  |  |--pkg_repo
  |  |--www_02
  |  |--bar
  |  |--test_152
  |  |--www_01
  |  |--test_151
  |--@state_down:
  |  |--db1
  |  |--db2

List jails 

shell > ssh admin@iocage_06 sudo iocage list -l

+------+-------------+------+-------+------+-----------------+-----------------------+-----+-------------------------+----------+
| JID  |    NAME     | BOOT | STATE | TYPE |     RELEASE     |          IP4          | IP6 |        TEMPLATE         | BASEJAIL |
+======+=============+======+=======+======+=================+=======================+=====+=========================+==========+
| None | 09caf271    | off  | down  | jail | 15.1-RELEASE-p1 | DHCP (not running)    | -   | -                       | no       |
+------+-------------+------+-------+------+-----------------+-----------------------+-----+-------------------------+----------+
| None | 1718af82    | off  | down  | jail | 15.1-RELEASE-p1 | DHCP (not running)    | -   | -                       | no       |
+------+-------------+------+-------+------+-----------------+-----------------------+-----+-------------------------+----------+
| 30   | bar         | on   | up    | jail | 15.1-RELEASE-p1 | epair0b|172.16.99.143 | -   | ansible-syslogng-client | no       |
+------+-------------+------+-------+------+-----------------+-----------------------+-----+-------------------------+----------+
| 29   | foo         | on   | up    | jail | 15.1-RELEASE-p1 | epair0b|172.16.99.138 | -   | ansible-syslogng-client | no       |
+------+-------------+------+-------+------+-----------------+-----------------------+-----+-------------------------+----------+
| 31   | log-server  | on   | up    | jail | 15.1-RELEASE-p1 | vnet0|172.16.99.10/24 | -   | ansible-syslogng-server | no       |
+------+-------------+------+-------+------+-----------------+-----------------------+-----+-------------------------+----------+
| 21   | pkg-repo    | on   | up    | jail | 15.1-RELEASE-p1 | vnet0|172.16.99.23/24 | -   | ansible-pkg-repo        | no       |
+------+-------------+------+-------+------+-----------------+-----------------------+-----+-------------------------+----------+
| 34   | repos       | on   | up    | jail | 15.1-RELEASE-p1 | vnet0|172.16.99.21/24 | -   | ansible-repos           | no       |
+------+-------------+------+-------+------+-----------------+-----------------------+-----+-------------------------+----------+
| 35   | repos-devel | on   | up    | jail | 15.1-RELEASE-p1 | vnet0|172.16.99.22/24 | -   | ansible-repos           | no       |
+------+-------------+------+-------+------+-----------------+-----------------------+-----+-------------------------+----------+
| 28   | test-151    | off  | up    | jail | 15.1-RELEASE-p1 | epair0b|172.16.99.189 | -   | ansible-client          | no       |
+------+-------------+------+-------+------+-----------------+-----------------------+-----+-------------------------+----------+
| 27   | test-152    | off  | up    | jail | 15.1-RELEASE-p1 | epair0b|172.16.99.188 | -   | ansible-client          | no       |
+------+-------------+------+-------+------+-----------------+-----------------------+-----+-------------------------+----------+
| 26   | test-153    | off  | up    | jail | 15.1-RELEASE-p1 | epair0b|172.16.99.187 | -   | ansible-client          | no       |
+------+-------------+------+-------+------+-----------------+-----------------------+-----+-------------------------+----------+
| 23   | www-01      | on   | up    | jail | 15.1-RELEASE-p1 | epair0b|172.16.99.116 | -   | ansible-init            | no       |
+------+-------------+------+-------+------+-----------------+-----------------------+-----+-------------------------+----------+
| 24   | www-02      | on   | up    | jail | 15.1-RELEASE-p1 | epair0b|172.16.99.147 | -   | ansible-init            | no       |
+------+-------------+------+-------+------+-----------------+-----------------------+-----+-------------------------+----------+

Playbook pb-repos.yml 

---
- name: Clone repos.
  hosts: pull_repos

  tasks:

    - name: Clone repos.
      ansible.builtin.git:
        repo: "{{ item.value.repo }}"
        dest: "{{ git_daemon_directory }}/{{ item.key }}"
      loop: "{{ repos[inventory_hostname] | dict2items }}"

    - name: Git config safe.directory.
      ansible.builtin.shell:
        cmd: >
          cd {{ git_daemon_directory }}/{{ item.key }};
          git config --global --add safe.directory {{ git_daemon_directory }}/{{ item.key }}
      loop: "{{ repos[inventory_hostname] | dict2items }}"

    - name: Change ownership of repos.
      ansible.builtin.file:
        path: "{{ git_daemon_directory }}/{{ item.key }}"
        state: directory
        owner: git_daemon
        group: git_daemon
        recurse: true
      loop: "{{ repos[inventory_hostname] | dict2items }}"

Playbook output - Clone repos 

(env) > ansible-playbook -i hosts pb-repos.yml

PLAY [Clone repos.] ************************************************************

TASK [Clone repos.] ************************************************************
changed: [repos_devel] => (item={'key': 'ansible-conf-init', 'value': {'repo': 'git://172.16.97.3/ansible-conf-init'}})
changed: [repos] => (item={'key': 'ansible-conf-init', 'value': {'repo': 'git://172.16.97.3/ansible-conf-init'}})
changed: [repos] => (item={'key': 'ansible-conf-init-example', 'value': {'repo': 'git://172.16.97.3/ansible-conf-init-example'}})
changed: [repos_devel] => (item={'key': 'ansible-conf-init-example', 'value': {'repo': 'git://172.16.97.3/ansible-conf-init-example'}})
changed: [repos] => (item={'key': 'ansible-conf-roles', 'value': {'repo': 'git://172.16.97.3/ansible-conf-roles'}})
changed: [repos_devel] => (item={'key': 'ansible-conf-roles', 'value': {'repo': 'git://172.16.97.3/ansible-conf-roles'}})
changed: [repos_devel] => (item={'key': 'ansible-conf-syslogng-server', 'value': {'repo': 'git://172.16.97.3/ansible-conf-syslogng-server'}})
changed: [repos_devel] => (item={'key': 'ansible-conf-syslogng-client', 'value': {'repo': 'git://172.16.97.3/ansible-conf-syslogng-client'}})
changed: [repos] => (item={'key': 'ansible-conf-syslogng-server', 'value': {'repo': 'git://172.16.97.3/ansible-conf-syslogng-server'}})
changed: [repos] => (item={'key': 'ansible-conf-syslogng-client', 'value': {'repo': 'git://172.16.97.3/ansible-conf-syslogng-client'}})
changed: [repos_devel] => (item={'key': 'ansible-conf-test', 'value': {'repo': 'git://172.16.97.3/ansible-conf-test'}})
changed: [repos] => (item={'key': 'ansible-conf-test', 'value': {'repo': 'git://172.16.97.3/ansible-conf-test'}})

TASK [Git config safe.directory.] **********************************************
changed: [repos_devel] => (item={'key': 'ansible-conf-init', 'value': {'repo': 'git://172.16.97.3/ansible-conf-init'}})
changed: [repos] => (item={'key': 'ansible-conf-init', 'value': {'repo': 'git://172.16.97.3/ansible-conf-init'}})
changed: [repos_devel] => (item={'key': 'ansible-conf-init-example', 'value': {'repo': 'git://172.16.97.3/ansible-conf-init-example'}})
changed: [repos] => (item={'key': 'ansible-conf-init-example', 'value': {'repo': 'git://172.16.97.3/ansible-conf-init-example'}})
changed: [repos_devel] => (item={'key': 'ansible-conf-roles', 'value': {'repo': 'git://172.16.97.3/ansible-conf-roles'}})
changed: [repos] => (item={'key': 'ansible-conf-roles', 'value': {'repo': 'git://172.16.97.3/ansible-conf-roles'}})
changed: [repos_devel] => (item={'key': 'ansible-conf-syslogng-server', 'value': {'repo': 'git://172.16.97.3/ansible-conf-syslogng-server'}})
changed: [repos_devel] => (item={'key': 'ansible-conf-syslogng-client', 'value': {'repo': 'git://172.16.97.3/ansible-conf-syslogng-client'}})
changed: [repos_devel] => (item={'key': 'ansible-conf-test', 'value': {'repo': 'git://172.16.97.3/ansible-conf-test'}})
changed: [repos] => (item={'key': 'ansible-conf-syslogng-server', 'value': {'repo': 'git://172.16.97.3/ansible-conf-syslogng-server'}})
changed: [repos] => (item={'key': 'ansible-conf-syslogng-client', 'value': {'repo': 'git://172.16.97.3/ansible-conf-syslogng-client'}})
changed: [repos] => (item={'key': 'ansible-conf-test', 'value': {'repo': 'git://172.16.97.3/ansible-conf-test'}})

TASK [Change ownership of repos.] **********************************************
changed: [repos] => (item={'key': 'ansible-conf-init', 'value': {'repo': 'git://172.16.97.3/ansible-conf-init'}})
changed: [repos_devel] => (item={'key': 'ansible-conf-init', 'value': {'repo': 'git://172.16.97.3/ansible-conf-init'}})
changed: [repos] => (item={'key': 'ansible-conf-init-example', 'value': {'repo': 'git://172.16.97.3/ansible-conf-init-example'}})
changed: [repos_devel] => (item={'key': 'ansible-conf-init-example', 'value': {'repo': 'git://172.16.97.3/ansible-conf-init-example'}})
changed: [repos] => (item={'key': 'ansible-conf-roles', 'value': {'repo': 'git://172.16.97.3/ansible-conf-roles'}})
changed: [repos_devel] => (item={'key': 'ansible-conf-roles', 'value': {'repo': 'git://172.16.97.3/ansible-conf-roles'}})
changed: [repos] => (item={'key': 'ansible-conf-syslogng-server', 'value': {'repo': 'git://172.16.97.3/ansible-conf-syslogng-server'}})
changed: [repos_devel] => (item={'key': 'ansible-conf-syslogng-server', 'value': {'repo': 'git://172.16.97.3/ansible-conf-syslogng-server'}})
changed: [repos] => (item={'key': 'ansible-conf-syslogng-client', 'value': {'repo': 'git://172.16.97.3/ansible-conf-syslogng-client'}})
changed: [repos_devel] => (item={'key': 'ansible-conf-syslogng-client', 'value': {'repo': 'git://172.16.97.3/ansible-conf-syslogng-client'}})
changed: [repos] => (item={'key': 'ansible-conf-test', 'value': {'repo': 'git://172.16.97.3/ansible-conf-test'}})
changed: [repos_devel] => (item={'key': 'ansible-conf-test', 'value': {'repo': 'git://172.16.97.3/ansible-conf-test'}})

PLAY RECAP *********************************************************************
repos                      : ok=3    changed=3    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   
repos_devel                : ok=3    changed=3    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   

List repos 

shell > ssh admin@iocage_06 sudo iocage exec repos ls -la /usr/local/git

total 12
drwxr-xr-x   8 git_daemon git_daemon  8 Aug 27 11:41 .
drwxr-xr-x  11 root       wheel      11 Aug 27 11:41 ..
drwxr-xr-x   5 git_daemon git_daemon 11 Aug 27 11:41 ansible-conf-init
drwxr-xr-x   3 git_daemon git_daemon  9 Aug 27 11:41 ansible-conf-init-example
drwxr-xr-x   4 git_daemon git_daemon 10 Aug 27 11:41 ansible-conf-roles
drwxr-xr-x   5 git_daemon git_daemon 11 Aug 27 11:41 ansible-conf-syslogng-client
drwxr-xr-x   5 git_daemon git_daemon 11 Aug 27 11:41 ansible-conf-syslogng-server
drwxr-xr-x   3 git_daemon git_daemon  9 Aug 27 11:41 ansible-conf-test