chore: deprovision zammad

This commit is contained in:
Jan Christian Grünhage 2022-08-29 08:36:58 +02:00
parent d9201cac13
commit 0ff44e4e8c
No known key found for this signature in database
GPG key ID: EEC1170CE56FA2ED
18 changed files with 0 additions and 586 deletions

View file

@ -4,4 +4,3 @@ roles/hedgedoc/ @jcgruenhage
roles/matomo/ @jcgruenhage
roles/murmur/ @ratzupaltuff
roles/snipe-it/ @transcaffeine @jadyn.dev
roles/zammad/ @jadyn.dev @transcaffeine

View file

@ -20,7 +20,6 @@ with no direct relation to any customers.
- [`matomo`](roles/matomo/README.md): role for [matomo](https://matomo.org/) (formerly known as piwik), a web analytics tool
- [`murmur`](roles/murmur/README.md): deploys [murmur](https://www.mumble.info/downloads/), the mumble server software.
- [`snipe-it`](roles/snipe-it/README.md): used for deploying [SnipeIt](https://snipeitapp.com/), an open-source asset management.
- [`zammad`](roles/zammad/README.md): deploys [Zammad](https://zammad.org/), the open source user support and ticketing software.
## License

View file

@ -1,5 +0,0 @@
---
- hosts: [ zammad ]
become: true
roles:
- zammad

View file

@ -1,90 +0,0 @@
# Zammad-dockerized ansible role
This role is used to deploy the (experimental) version of [zammad](https://zammad.org) in docker containers.
The official repo uses docker-compose, the role skips docker-compose and interfaces with the docker daemon directly. It does pretty much the same thing docker-compose would do.
## Usage
Just execute the role as **root** (`become: yes`) and set at least these variables:
```yml
zammad_postgres_passwd: "super_secret_password"
zammad_host_network: "bridge" (Name of your hosts docker network, usually "bridge")
```
After running the role (which will take some time) you can access the Zammad-WebUi via port `8080` on the `zammad-nginx` container.
You may also use a reverse proxy or something similar. traefik for example.
## Containers
All containers are defined in `zammad_containers` by default these containers exist:
- zammad-postgresql
- zammad-memcached
- zammad-elasticsearch
- zammad-websocket
- zammad-railsserver
- zammad-scheduler
- zammad-backup
- zammad-init
- zammad-nginx
They are created/started in the same order as they are listed here. By default, all containers are added to the `zammad` docker-network.
## Additional configuration
### Container labels
You can modify the container labels with `zammad_labels.[container_name]`. For Example:
```yml
zammad_labels:
nginx:
traefik.enable: "true"
...
```
### Host network
You may allow certain containers access to you hosts default network:
```yml
zammad_allow_host_nework:
scheduler: yes
railsserver: yes
```
You have to set `zammad_host_network` accordingly:
```yml
zammad_host_network:
name: "bridge"
```
### Add containers to the host network
Only containers in the `zammad_allow_host_nework` list are added to the host-network. Set it up like this:
```yml
zammad_allow_host_nework:
scheduler: yes
railsserver: yes
```
### Zammad internal network
You can customize the internal network with `zammad_network`, these are the defaults:
```yml
zammad_network:
name: "zammad"
```
### http(s) port
The port can be set using `zammad_config_port`, default is `8080`
### Zammad user
The role creates a system use under which all zammad containers run. You can change the username with `zammad_user`
### Zammad paths
The following paths are used, these are the defaults:
```yml
zammad_base_path: /opt/zammad
zammad_command_dir: /usr/bin/
```
### `zammad-docker` command
This is a small command line utility that runs `sudo docker $1` for all zammad-containers.
You can disable this tool by setting `zammad_enable_command` to `no`.
### Postgres
Set the postgres user and password, you should use something like the ansible-vault for passwords:
```yml
zammad_postgres_user: "zammad" (by default same as zammad_user)
zammad_postgres_passwd: "super_secret_password"
```
#### Faked `/etc/passwd`
For security reasons the postgres container is not run as `root` (unless you run everything as `root` see Zammad user). Postgres requires access to `etc/passwd` (see https://hub.docker.com/_/postgres/). As it's unsecure to map the hosts passwd-file into the container, a fake `/etc/passwd` is created. This file only contains the necessary information for postgres to work.

View file

@ -1,162 +0,0 @@
---
zammad_user: zammad
zammad_base_path: /opt/zammad
zammad_command_dir: /usr/bin/
zammad_enable_command: yes
zammad_config_port: 8080
zammad_postgres_user: "{{ zammad_user }}"
zammad_postgres_passwd: ~
zammad_container_repo: zammad/zammad-docker-compose
zammad_container_version: 5.1.1-6
zammad_memcached_version: 1.6.15-alpine
zammad_network:
name: zammad
zammad_host_network: ~
zammad_allow_host_nework: ~
zammad_elastic_max_mem_in_mb: 512
zammad_elastic_min_mem_in_mb: 256
# The container order is *very* important!
zammad_containers:
- name: "zammad-postgresql"
image_name: "{{ zammad_container_repo }}"
image_tag: "zammad-postgresql-{{ zammad_container_version }}"
labels: "{{ zammad_labels.postgresql | default({}) }}"
env:
POSTGRES_USER: "{{ zammad_postgres_user }}"
POSTGRES_PASSWORD: "{{ zammad_postgres_passwd }}"
restart_policy: "unless-stopped"
volumes:
- "{{ zammad_base_path }}/postgresql-data:/var/lib/postgresql/data:rw"
- "{{ zammad_base_path }}/postgresql-run:/var/run/postgresql:rw"
- "{{ zammad_postgres_passwd_path }}:/etc/passwd:ro"
networks:
- name: "{{ zammad_network.name }}"
add_host_network: "{{ zammad_allow_host_nework.postgresql | default(False) }}"
- name: "zammad-memcached"
image_name: "memcached"
image_tag: "{{ zammad_memcached_version }}"
labels: "{{ zammad_labels.memcached | default({}) }}"
restart_policy: "unless-stopped"
command: "memcached -m 256M"
volumes:
- "{{ zammad_base_path }}/zammad-data:/opt/zammad:rw"
networks:
- name: "{{ zammad_network.name }}"
add_host_network: "{{ zammad_allow_host_nework.memcached | default(False) }}"
- name: "zammad-elasticsearch"
image_name: "{{ zammad_container_repo }}"
image_tag: "zammad-elasticsearch-{{ zammad_container_version }}"
labels: "{{ zammad_labels.elasticsearch | default({}) }}"
restart_policy: "unless-stopped"
volumes:
- "{{ zammad_base_path }}/elasticsearch-data:/usr/share/elasticsearch/data:rw"
- "{{ zammad_base_path }}/elasticsearch-config:/usr/share/elasticsearch/config:rw"
- "{{ zammad_base_path }}/elasticsearch-logs:/usr/share/elasticsearch/logs:rw"
networks:
- name: "{{ zammad_network.name }}"
add_host_network: "{{ zammad_allow_host_nework.elasticsearch | default(False) }}"
memory_limit: "{{ zammad_elastic_max_mem_in_mb }}M"
env:
ES_JAVA_OPTS: "-Xms{{ zammad_elastic_min_mem_in_mb }}m -Xmx{{ zammad_elastic_max_mem_in_mb }}m"
- name: "zammad-websocket"
image_name: "{{ zammad_container_repo }}"
image_tag: "zammad-{{ zammad_container_version }}"
labels: "{{ zammad_labels.websocket | default({}) }}"
restart_policy: "unless-stopped"
command: "zammad-websocket"
volumes:
- "{{ zammad_base_path }}/zammad-data:/opt/zammad:rw"
networks:
- name: "{{ zammad_network.name }}"
add_host_network: "{{ zammad_allow_host_nework.websocket | default(False) }}"
- name: "zammad-railsserver"
image_name: "{{ zammad_container_repo }}"
image_tag: "zammad-{{ zammad_container_version }}"
labels: "{{ zammad_labels.railsserver | default({}) }}"
restart_policy: "unless-stopped"
command: "zammad-railsserver"
volumes:
- "{{ zammad_base_path }}/zammad-data:/opt/zammad:rw"
networks:
- name: "{{ zammad_network.name }}"
add_host_network: "{{ zammad_allow_host_nework.railsserver | default(False) }}"
- name: "zammad-scheduler"
image_name: "{{ zammad_container_repo }}"
image_tag: "zammad-{{ zammad_container_version }}"
labels: "{{ zammad_labels.scheduler | default({}) }}"
restart_policy: "unless-stopped"
command: "zammad-scheduler"
volumes:
- "{{ zammad_base_path }}/zammad-data:/opt/zammad:rw"
networks:
- name: "{{ zammad_network.name }}"
add_host_network: "{{ zammad_allow_host_nework.scheduler | default(False) }}"
- name: "zammad-backup"
image_name: "{{ zammad_container_repo }}"
image_tag: "zammad-postgresql-{{ zammad_container_version }}"
labels: "{{ zammad_labels.backup | default({}) }}"
env:
BACKUP_SLEEP: "86400"
HOLD_DAYS: "10"
POSTGRESQL_USER: "{{ zammad_postgres_user }}"
POSTGRESQL_PASS: "{{ zammad_postgres_passwd }}"
POSTGRESQL_DB: "{{ zammad_postgres_user }}"
restart_policy: "unless-stopped"
entrypoint: /usr/local/bin/backup.sh
command: "zammad-backup"
volumes:
- "{{ zammad_base_path }}/zammad-backup:/var/tmp/zammad:rw"
- "{{ zammad_base_path }}/zammad-data:/opt/zammad:rw"
networks:
- name: "{{ zammad_network.name }}"
add_host_network: "{{ zammad_allow_host_nework.backup | default(False) }}"
- name: "zammad-init"
image_name: "{{ zammad_container_repo }}"
image_tag: "zammad-{{ zammad_container_version }}"
labels: "{{ zammad_labels.init | default({}) }}"
env:
POSTGRESQL_USER: "{{ zammad_postgres_user }}"
POSTGRESQL_PASS: "{{ zammad_postgres_passwd }}"
POSTGRESQL_DB: "{{ zammad_postgres_user }}"
restart_policy: "on-failure"
command: "zammad-init"
state: "present"
volumes:
- "{{ zammad_base_path }}/zammad-data:/opt/zammad:rw"
networks:
- name: "{{ zammad_network.name }}"
add_host_network: "{{ zammad_allow_host_nework.init | default(False) }}"
- name: "zammad-nginx"
image_name: "{{ zammad_container_repo }}"
image_tag: "zammad-{{ zammad_container_version }}"
ports: "{{ zammad_config_port }}"
labels: "{{ zammad_labels.nginx | default({}) }}"
env:
NGINX_SERVER_SCHEME: https
restart_policy: "unless-stopped"
command: "zammad-nginx"
volumes:
- "{{ zammad_base_path }}/zammad-data:/opt/zammad:rw"
- "{{ zammad_base_path }}/zammad-tmp:/tmp:rw"
- "{{ zammad_base_path }}/nginx-config:/etc/nginx/sites-enabled/:rw"
- "{{ zammad_base_path }}/nginx-logs:/var/log/nginx/:rw"
- "{{ zammad_base_path }}/nginx-tmp:/var/lib/nginx:rw"
networks:
- name: "{{ zammad_network.name }}"
add_host_network: "{{ zammad_allow_host_nework.nginx | default(False) }}"

View file

@ -1,3 +0,0 @@
cluster.name: "docker-cluster"
network.host: 0.0.0.0
discovery.type: single-node

View file

@ -1,44 +0,0 @@
status = error
appender.rolling.type = Console
appender.rolling.name = rolling
appender.rolling.layout.type = ESJsonLayout
appender.rolling.layout.type_name = server
rootLogger.level = info
rootLogger.appenderRef.rolling.ref = rolling
appender.header_warning.type = HeaderWarningAppender
appender.header_warning.name = header_warning
appender.deprecation_rolling.type = Console
appender.deprecation_rolling.name = deprecation_rolling
appender.deprecation_rolling.layout.type = ESJsonLayout
appender.deprecation_rolling.layout.type_name = deprecation
appender.deprecation_rolling.filter.rate_limit.type = RateLimitingFilter
logger.deprecation.name = org.elasticsearch.deprecation
logger.deprecation.level = deprecation
logger.deprecation.appenderRef.deprecation_rolling.ref = deprecation_rolling
logger.deprecation.appenderRef.header_warning.ref = header_warning
logger.deprecation.additivity = false
appender.index_search_slowlog_rolling.type = Console
appender.index_search_slowlog_rolling.name = index_search_slowlog_rolling
appender.index_search_slowlog_rolling.layout.type = ESJsonLayout
appender.index_search_slowlog_rolling.layout.type_name = index_search_slowlog
logger.index_search_slowlog_rolling.name = index.search.slowlog
logger.index_search_slowlog_rolling.level = trace
logger.index_search_slowlog_rolling.appenderRef.index_search_slowlog_rolling.ref = index_search_slowlog_rolling
logger.index_search_slowlog_rolling.additivity = false
appender.index_indexing_slowlog_rolling.type = Console
appender.index_indexing_slowlog_rolling.name = index_indexing_slowlog_rolling
appender.index_indexing_slowlog_rolling.layout.type = ESJsonLayout
appender.index_indexing_slowlog_rolling.layout.type_name = index_indexing_slowlog
logger.index_indexing_slowlog.name = index.indexing.slowlog.index
logger.index_indexing_slowlog.level = trace
logger.index_indexing_slowlog.appenderRef.index_indexing_slowlog_rolling.ref = index_indexing_slowlog_rolling
logger.index_indexing_slowlog.additivity = false

View file

@ -1,25 +0,0 @@
- name: Restart elasticsearch
docker_container:
name: "zammad-elasticsearch"
state: started
restart: yes
- name: Restart postgresql
docker_container:
name: "zammad-postgresql"
state: started
restart: yes
- name: Restart zammad-stack
docker_container:
name: "{{ container.name }}"
state: started
restart: yes
loop: "{{ zammad_containers }}"
loop_control:
loop_var: container
- name: Initilize zammad
docker_container:
name: "zammad-init"
state: started

View file

@ -1,113 +0,0 @@
---
- name: Create zammad system user
user:
name: "{{ zammad_user }}"
state: present
system: yes
register: zammad_user_res
tags: ['prepare', 'prepare-zammad']
- name: Ensure zammad base directory is present
file:
path: "{{ zammad_base_path }}"
state: directory
owner: "{{ zammad_user_res.uid }}"
group: "{{ zammad_user_res.group }}"
mode: "755"
tags: [ 'prepare', 'prepare-zammad' ]
notify: Initilize zammad
- name: Ensure zammad directories are present
file:
path: "{{ zammad_base_path }}/{{ item.dir }}"
state: directory
owner: "{{ zammad_user_res.uid }}"
group: "{{ zammad_user_res.group }}"
mode: "{{ item.mode | default('0755') }}"
tags: [ 'prepare', 'prepare-zammad' ]
notify: Restart zammad-stack
loop: "{{ zammad_directories }}"
- name: Copy elasticsearch configuration
copy:
src: "{{ item.src }}"
dest: "{{ zammad_base_path }}/elasticsearch-config/{{ item.src }}"
owner: "{{ zammad_user_res.uid }}"
group: "{{ zammad_user_res.group }}"
mode: "{{ item.mode | default('0755') }}"
tags: [ 'prepare', 'prepare-zammad' ]
notify: Restart elasticsearch
loop: "{{ zammad_elasticsearch_files }}"
- name: Template elasticsearch jvm options
template:
src: jvm.options.j2
dest: "{{ zammad_base_path }}/elasticsearch-config/jvm.options"
owner: "{{ zammad_user_res.uid }}"
group: "{{ zammad_user_res.group }}"
mode: "0660"
tags: [ 'prepare', 'prepare-zammad' ]
notify: Restart elasticsearch
- name: Template fake /etc/passwd for postgres
template:
src: postgres-passwd.j2
dest: "{{ zammad_postgres_passwd_path }}"
owner: "{{ zammad_user_res.uid }}"
group: "{{ zammad_user_res.group }}"
mode: "0755"
tags: ['prepare', 'prepare-zammad']
notify: Restart postgresql
- name: Template zammad-docker command
template:
src: zammad-docker.j2
dest: "{{ zammad_command_dir }}/zammad-docker"
owner: "root"
group: "root"
mode: "0755"
tags: ['prepare', 'prepare-zammad']
when: zammad_enable_command
- name: Ensure zammad container images are present
docker_image:
name: "{{ container.image_name }}:{{ container.image_tag }}"
source: pull
force_source: "{{ container.force_source | default(False) }}"
state: present
tags: ['prepare', 'prepare-zammad']
loop: "{{ zammad_containers }}"
loop_control:
loop_var: container
label: "{{ container.image_name }} ({{ container.name }})"
- name: Ensure zammad network is present
docker_network:
name: "{{ zammad_network.name }}"
tags: ['deploy', 'deploy-zammad']
notify: Restart zammad-stack
- name: Ensure zammad containers are started
docker_container:
name: "{{ container.name }}"
image: "{{ container.image_name }}:{{ container.image_tag }}"
env: "{{ container.env | default(omit) }}"
user: "{{ container.user | default(zammad_user_res.uid) }}:{{ container.group | default(zammad_user_res.group) }}"
entrypoint: "{{ container.entrypoint | default(omit) }}"
command: "{{ container.command | default(omit) }}"
network_mode: "{{ container.network_mode | default('default') }}"
networks: "{% if container.add_host_network | default(False) %}{{ container.networks | default([]) + [zammad_host_network] }}{% else %}{{ container.networks | default(omit) }}{% endif %}"
ports: "{{ container.ports | default(omit) }}"
labels: "{{ container.labels | default(omit) }}"
volumes: "{{ container.volumes | default(omit) }}"
restart_policy: "{{ container.restart_policy }}"
memory: "{{ container.memory_limit | default(omit) }}"
state: "{{ container.state | default('started') }}"
comparisons:
networks: strict
tags: ['deploy', 'deploy-zammad']
notify: Initilize zammad
loop: "{{ zammad_containers }}"
loop_control:
loop_var: container
label: "{{ container.name }}"

View file

@ -1,77 +0,0 @@
## JVM configuration
################################################################
## IMPORTANT: JVM heap size
################################################################
##
## You should always set the min and max JVM heap
## size to the same value. For example, to set
## the heap to 4 GB, set:
##
## -Xms4g
## -Xmx4g
##
## See https://www.elastic.co/guide/en/elasticsearch/reference/current/heap-size.html
## for more information
##
################################################################
# Xms represents the initial size of total heap space
# Xmx represents the maximum size of total heap space
-Xms{{ zammad_elastic_min_mem_in_mb }}m
-Xmx{{ zammad_elastic_max_mem_in_mb }}m
################################################################
## Expert settings
################################################################
##
## All settings below this section are considered
## expert settings. Don't tamper with them unless
## you understand what you are doing
##
################################################################
## GC configuration
8-13:-XX:+UseConcMarkSweepGC
8-13:-XX:CMSInitiatingOccupancyFraction=75
8-13:-XX:+UseCMSInitiatingOccupancyOnly
## G1GC Configuration
# NOTE: G1 GC is only supported on JDK version 10 or later
# to use G1GC, uncomment the next two lines and update the version on the
# following three lines to your version of the JDK
# 10-13:-XX:-UseConcMarkSweepGC
# 10-13:-XX:-UseCMSInitiatingOccupancyOnly
14-:-XX:+UseG1GC
14-:-XX:G1ReservePercent=25
14-:-XX:InitiatingHeapOccupancyPercent=30
## JVM temporary directory
-Djava.io.tmpdir=${ES_TMPDIR}
## heap dumps
# generate a heap dump when an allocation from the Java heap fails
# heap dumps are created in the working directory of the JVM
-XX:+HeapDumpOnOutOfMemoryError
# specify an alternative path for heap dumps; ensure the directory exists and
# has sufficient space
-XX:HeapDumpPath=data
# specify an alternative path for JVM fatal error logs
-XX:ErrorFile=logs/hs_err_pid%p.log
## JDK 8 GC logging
8:-XX:+PrintGCDetails
8:-XX:+PrintGCDateStamps
8:-XX:+PrintTenuringDistribution
8:-XX:+PrintGCApplicationStoppedTime
8:-Xloggc:logs/gc.log
8:-XX:+UseGCLogFileRotation
8:-XX:NumberOfGCLogFiles=32
8:-XX:GCLogFileSize=64m
# JDK 9+ GC logging
9-:-Xlog:gc*,gc+age=trace,safepoint:file=logs/gc.log:utctime,pid,tags:filecount=32,filesize=64m

View file

@ -1,30 +0,0 @@
root:x:0:0:root:/root:/bin/ash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/mail:/sbin/nologin
news:x:9:13:news:/usr/lib/news:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucppublic:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
man:x:13:15:man:/usr/man:/sbin/nologin
postmaster:x:14:12:postmaster:/var/mail:/sbin/nologin
cron:x:16:16:cron:/var/spool/cron:/sbin/nologin
ftp:x:21:21::/var/lib/ftp:/sbin/nologin
sshd:x:22:22:sshd:/dev/null:/sbin/nologin
at:x:25:25:at:/var/spool/cron/atjobs:/sbin/nologin
squid:x:31:31:Squid:/var/cache/squid:/sbin/nologin
xfs:x:33:33:X Font Server:/etc/X11/fs:/sbin/nologin
games:x:35:35:games:/usr/games:/sbin/nologin
cyrus:x:85:12::/usr/cyrus:/sbin/nologin
vpopmail:x:89:89::/var/vpopmail:/sbin/nologin
ntp:x:123:123:NTP:/var/empty:/sbin/nologin
smmsp:x:209:209:smmsp:/var/spool/mqueue:/sbin/nologin
guest:x:405:100:guest:/dev/null:/sbin/nologin
nobody:x:65534:65534:nobody:/:/sbin/nologin
postgres:x:70:70:Linux User,,,:/var/lib/postgresql:/bin/sh
utmp:x:100:406:utmp:/home/utmp:/bin/false
{{ zammad_user_res.name }}:x:{{ zammad_user_res.uid }}:{{ zammad_user_res.group }}::{{ zammad_user_res.home }}:{{ zammad_user_res.shell }}

View file

@ -1,3 +0,0 @@
#! /bin/bash
echo "docker $1"
sudo docker $1 {% for container in zammad_containers%}{{ container.name }} {% endfor %}

View file

@ -1,23 +0,0 @@
zammad_directories:
- dir: zammad-backup
- dir: zammad-data
- dir: zammad-tmp
- dir: postgresql-data
mode: 700
- dir: postgresql-run
mode: 775
- dir: postgresql-passwd
- dir: elasticsearch-data
- dir: elasticsearch-config
- dir: elasticsearch-logs
- dir: nginx-config
- dir: nginx-logs
- dir: nginx-tmp
zammad_elasticsearch_files:
- src: elasticsearch.yml
mode: 660
- src: log4j2.properties
mode: 660
zammad_postgres_passwd_path: "{{ zammad_base_path }}/postgresql-passwd/passwd"

View file

@ -1,5 +0,0 @@
#!/usr/bin/env bash
cd ../../
while read -r line; do
find plugins -name "*.py" ! -path "plugins/module_utils/*" | xargs -I {} -n 1 printf "{} $line\n"
done <"tests/sanity/ignore.template"

View file

@ -1 +0,0 @@
roles/zammad/templates/zammad-docker.j2 shebang

View file

@ -1 +0,0 @@
roles/zammad/templates/zammad-docker.j2 shebang

View file

@ -1 +0,0 @@
roles/zammad/templates/zammad-docker.j2 shebang

View file

@ -1 +0,0 @@
validate-modules:missing-gplv3-license # ignore license check