Use xmpp-server role from ansible-roles repoHEADmaster

Now that the role has been migrated, we can remove the manual steps and just
use it here.

1 files changed, 1 insertions, 425 deletions

diff --git a/playbook.yaml b/playbook.yaml
index 5b6231a..d1aae6a 100644
--- a/playbook.yaml
+++ b/playbook.yaml
@@ -10,432 +10,8 @@
   roles:
    - bootstrap
    - unattended-upgrades
+   - xmpp-server
    - role: munin-node
      vars:
       extra_profiles:
        - prosody
-  tasks:
-
-   - name: Retrieve DANE hash
-     ansible.builtin.shell:
-      cmd: >
-       set -o pipefail && openssl x509 -in
-       ~/.lego/certificates/{{ virtual_host }}.crt -noout -pubkey | openssl
-       pkey -pubin -outform DER | openssl dgst -sha256 -binary | hexdump -ve
-       '/1 "%02x"'
-     register: dane_result
-     changed_when: false
-     delegate_to: localhost
-
-   - name: Take note of DANE hash
-     ansible.builtin.set_fact:
-      dane_hash: "{{ dane_result.stdout }}"
-     tags:
-      - dns
-
-   - name: Ensure common records exist
-     ansible.builtin.uri:
-      url: "https://api.mythic-beasts.com/dns/v2/zones/{{ domain }}/records\
-       ?select=host%3Dchat{{ env_suffix }}%26type%3DA\
-       &select=host%3Dchat{{ env_suffix }}%26type%3DAAAA\
-       &select=host%3Dconference{{ env_suffix }}%26type%3DCNAME\
-       &select=host%3Dupload{{ env_suffix }}%26type%3DCNAME\
-       &select=host%3D_xmpp-client._tcp{{ env_suffix }}%26type%3DSRV\
-       &select=host%3D_xmpps-client._tcp{{ env_suffix }}%26type%3DSRV\
-       &select=host%3D_5222._tcp.chat{{ env_suffix }}%26type%3DTLSA\
-        %26data%3D{{ dane_hash }}\
-       &select=host%3D_5223._tcp.chat{{ env_suffix }}%26type%3DTLSA\
-        %26data%3D{{ dane_hash }}"
-      method: PUT
-      body_format: json
-      body:
-       records:
-        - host: "chat{{ env_suffix }}"
-          type: "A"
-          data: "{{ ipv4 }}"
-        - host: "chat{{ env_suffix }}"
-          type: "AAAA"
-          data: "{{ ipv6 }}"
-        - host: "conference{{ env_suffix }}"
-          type: "CNAME"
-          data: "chat{{ env_suffix }}.{{ domain }}."
-        - host: "upload{{ env_suffix }}"
-          type: "CNAME"
-          data: "chat{{ env_suffix }}.{{ domain }}."
-        - host: "_xmpp-client._tcp{{ env_suffix }}"
-          type: "SRV"
-          data: "chat{{ env_suffix }}.{{ domain }}."
-          srv_priority: 0
-          srv_weight: 5
-          srv_port: 5222
-        - host: "_xmpps-client._tcp{{ env_suffix }}"
-          type: "SRV"
-          data: "chat{{ env_suffix }}.{{ domain }}."
-          srv_priority: "0"
-          srv_weight: "5"
-          srv_port: "5223"
-        - host: "_5222._tcp.chat{{ env_suffix }}"
-          type: "TLSA"
-          data: "{{ dane_hash }}"
-          tlsa_usage: "3"
-          tlsa_selector: "1"
-          tlsa_matching: "1"
-        - host: "_5223._tcp.chat{{ env_suffix }}"
-          type: "TLSA"
-          data: "{{ dane_hash }}"
-          tlsa_usage: "3"
-          tlsa_selector: "1"
-          tlsa_matching: "1"
-     delegate_to: localhost
-     tags:
-      - dns
-
-   - name: Ensure non-transport records exist
-     ansible.builtin.uri:
-      url: "https://api.mythic-beasts.com/dns/v2/zones/{{ domain }}/records\
-       ?select=host%3D_xmpp-server._tcp{{ env_suffix }}%26type%3DSRV\
-       &select=host%3D_xmpps-server._tcp{{ env_suffix }}%26type%3DSRV\
-       &select=host%3D_xmpps-server._tcp.conference{{ env_suffix }}\
-        %26type%3DSRV\
-       &select=host%3D_xmpps-server._tcp.upload{{ env_suffix }}%26type%3DSRV\
-       &select=host%3D_5269._tcp.chat{{ env_suffix }}%26type%3DTLSA\
-        %26data%3D{{ dane_hash }}\
-       &select=host%3D_5270._tcp.chat{{ env_suffix }}%26type%3DTLSA\
-        %26data%3D{{ dane_hash }}"
-      method: PUT
-      body_format: json
-      body:
-       records:
-        - host: "_xmpp-server._tcp{{ env_suffix }}"
-          type: "SRV"
-          data: "chat{{ env_suffix }}.{{ domain }}."
-          srv_priority: "0"
-          srv_weight: "5"
-          srv_port: "5269"
-        - host: "_xmpps-server._tcp{{ env_suffix }}"
-          type: "SRV"
-          data: "chat{{ env_suffix }}.{{ domain }}."
-          srv_priority: "0"
-          srv_weight: "5"
-          srv_port: "5270"
-        - host: "_xmpps-server._tcp.conference{{ env_suffix }}"
-          type: "SRV"
-          data: "chat{{ env_suffix }}.{{ domain }}."
-          srv_priority: "0"
-          srv_weight: "5"
-          srv_port: "5270"
-        - host: "_xmpps-server._tcp.upload{{ env_suffix }}"
-          type: "SRV"
-          data: "chat{{ env_suffix }}.{{ domain }}."
-          srv_priority: "0"
-          srv_weight: "5"
-          srv_port: "5270"
-        - host: "_5269._tcp.chat{{ env_suffix }}"
-          type: "TLSA"
-          data: "{{ dane_hash }}"
-          tlsa_usage: "3"
-          tlsa_selector: "1"
-          tlsa_matching: "1"
-        - host: "_5270._tcp.chat{{ env_suffix }}"
-          type: "TLSA"
-          data: "{{ dane_hash }}"
-          tlsa_usage: "3"
-          tlsa_selector: "1"
-          tlsa_matching: "1"
-     delegate_to: localhost
-     when: not is_transport_server
-     tags:
-      - dns
-
-   # We specifically use apt instead of the more general package module here,
-   # because we want to ensure the cache is updated before we try and install
-   # anything. This is needed because, on a freh Debian install on AWS
-   # Lightsail (as of 2024-02-08), nothing was returned after running apt
-   # search borgmatic. Updating the cache before running apt install solved
-   # this issue, but the package module does not support this functionality.
-   - name: Ensure required packages are installed
-     ansible.builtin.apt:
-      name:
-       - lua-dbi-postgresql  # Prosody postgres connection
-       - lua-unbound  # Prosody DNS resolution
-       - postgresql  # Database
-       - prosody  # XMPP server
-       - prosody-modules  # Extra addons
-       - python3-psycopg2  # Used by ansible postgres role
-      state: present
-      update_cache: true
-     become: true
-
-   - name: Ensure invite-specific packages are installed
-     ansible.builtin.apt:
-      name:
-       - libjs-bootstrap4  # Used by invite webpage
-       - libjs-jquery  # Used by invite webpage
-       - nginx  # Serve invite webpages
-      state: present
-      update_cache: true
-     become: true
-     when: not is_transport_server
-
-   - name: Ensure turn-specific packages are installed
-     ansible.builtin.apt:
-      name:
-       - coturn  # Audio / video calling server
-      state: present
-      update_cache: true
-     become: true
-     when: not is_transport_server
-
-   - name: Ensure required ports with ufw applications are open
-     community.general.ufw:
-      rule: allow
-      name: "{{ item }}"
-      state: enabled
-     loop:
-      - OpenSSH
-     become: true
-
-   - name: Ensure full XMPP ports are open
-     community.general.ufw:
-      rule: allow
-      name: "{{ item }}"
-      state: enabled
-     loop:
-      - XMPP
-     become: true
-     when: not is_transport_server
-
-   - name: Ensure only c2s ports are open
-     community.general.ufw:
-      rule: allow
-      port: "{{ item }}"
-      proto: tcp
-      state: enabled
-     loop:
-      - 5222
-     become: true
-     when: is_transport_server
-
-   - name: Ensure invite-specific ports with ufw applications are open
-     community.general.ufw:
-      rule: allow
-      name: "{{ item }}"
-      state: enabled
-     loop:
-      - WWW Full
-     become: true
-     when: not is_transport_server
-
-   - name: Ensure turn-specific ports with ufw applications are open
-     community.general.ufw:
-      rule: allow
-      name: "{{ item }}"
-      state: enabled
-     loop:
-      - Turnserver
-     become: true
-     when: not is_transport_server
-
-   - name: Ensure other required tcp ports are open
-     community.general.ufw:
-      rule: allow
-      port: "{{ item }}"
-      proto: tcp
-      state: enabled
-     loop:
-      - 5000  # XEP-0065
-      - 5223  # XEP-0368
-      - 5270  # XEP-0368
-      - 5280  # XEP-0363
-      - 5281  # XEP-0363
-      # - 5432  # Postgres
-     become: true
-
-   - name: Ensure other udp ports are open
-     community.general.ufw:
-      rule: allow
-      port: "{{ item }}"
-      proto: udp
-      state: enabled
-     loop:
-      - 5000  # XEP-0065
-      - 5280  # XEP-0363
-      - 5281  # XEP-0363
-     become: true
-
-   - name: Ensure default nginx config is removed
-     ansible.builtin.file:
-      path: "/etc/nginx/sites-enabled/default"
-      state: absent
-     become: true
-     notify: Restart nginx
-     when: not is_transport_server
-
-   - name: Ensure nginx config is installed
-     ansible.builtin.template:
-      src: "{{ playbook_dir }}/files/nginx_conf.j2"
-      dest: /etc/nginx/sites-available/{{ virtual_host }}
-      owner: root
-      group: root
-      mode: "0644"
-     become: true
-     notify: Restart nginx
-     when: not is_transport_server
-
-   - name: Ensure nginx config is enabled
-     ansible.builtin.file:
-      src: /etc/nginx/sites-available/{{ virtual_host }}
-      dest: /etc/nginx/sites-enabled/{{ virtual_host }}
-      owner: root
-      group: root
-      state: link
-     become: true
-     notify: Restart nginx
-     when: not is_transport_server
-
-   - name: Ensure turn is configured
-     ansible.builtin.template:
-      src: "{{ playbook_dir }}/files/turnserver.conf.j2"
-      dest: /etc/turnserver.conf
-      owner: root
-      group: prosody
-      mode: "0640"
-     become: true
-     notify: Restart coturn
-     when: not is_transport_server
-
-   - name: Ensure prosody database is created
-     community.postgresql.postgresql_db:
-      name: prosody
-     become: true
-     become_user: postgres
-
-   - name: Ensure prosody role is created
-     community.postgresql.postgresql_user:
-      login_db: prosody
-      name: prosody
-     become: true
-     become_user: postgres
-
-   - name: Ensure prosody schema is created
-     community.postgresql.postgresql_schema:
-      login_db: prosody
-      name: prosody
-      owner: prosody
-     become: true
-     become_user: postgres
-     register: my_result
-
-   - name: Ensure prosody user exists on database
-     community.postgresql.postgresql_user:
-      name: prosody
-     become: true
-     become_user: postgres
-
-   - name: Ensure prosody user has permissions on database
-     community.postgresql.postgresql_privs:
-      type: database
-      login_db: prosody
-      privs: ALL
-      roles: prosody
-     become: true
-     become_user: postgres
-
-   - name: Ensure prosody user has permissions on schema
-     community.postgresql.postgresql_privs:
-      type: table
-      login_db: prosody
-      objs: ALL_IN_SCHEMA
-      privs: ALL
-      roles: prosody
-     become: true
-     become_user: postgres
-
-   - name: Ensure top-level prosody configuration is installed
-     ansible.builtin.template:
-      src: "{{ playbook_dir }}/files/prosody.cfg.lua.j2"
-      dest: /etc/prosody/prosody.cfg.lua
-      owner: root
-      group: prosody
-      mode: "0640"
-     become: true
-     notify: Restart prosody
-
-   - name: Ensure host-specific prosody configuration is available
-     ansible.builtin.template:
-      src: "{{ playbook_dir }}/files/virtual_host.cfg.lua.j2"
-      dest: "/etc/prosody/conf.avail/{{ virtual_host }}.cfg.lua"
-      owner: root
-      group: prosody
-      mode: "0644"
-     become: true
-     notify: Restart prosody
-
-   - name: Ensure host-specific prosody configuration is set
-     ansible.builtin.file:
-      src: "/etc/prosody/conf.avail/{{ virtual_host }}.cfg.lua"
-      dest: "/etc/prosody/conf.d/{{ virtual_host }}.cfg.lua"
-      owner: root
-      group: prosody
-      state: link
-     become: true
-     notify: Restart prosody
-
-   - name: Ensure localhost prosody configuration is removed
-     ansible.builtin.file:
-      path: "/etc/prosody/conf.d/localhost.cfg.lua"
-      state: absent
-     become: true
-     notify: Restart prosody
-
-   - name: Ensure localhost prosody configuration is not available
-     ansible.builtin.file:
-      path: "/etc/prosody/conf.avail/localhost.cfg.lua"
-      state: absent
-     become: true
-
-   - name: Ensure example prosody configuration is not available
-     ansible.builtin.file:
-      path: "/etc/prosody/conf.avail/example.com.cfg.lua"
-      state: absent
-     become: true
-
-   - name: Ensure prosody is enabled
-     ansible.builtin.service:
-      name: prosody
-      enabled: true
-     become: true
-
-  handlers:
-
-   - name: Restart prosody
-     ansible.builtin.service:
-      name: prosody
-      state: restarted
-     become: true
-
-   - name: Restart coturn
-     ansible.builtin.service:
-      name: coturn
-      state: restarted
-     become: true
-
-   - name: Restart nginx
-     ansible.builtin.service:
-      name: nginx
-      state: restarted
-     become: true
-
-  vars:
-
-   env_prefix: >-
-    {{ "" if env == "" else env + "." }}
-
-   env_suffix: >-
-    {{ "" if env == "" else "." + env }}
-
-   virtual_host: "{{ env_prefix }}{{ domain }}"
-
-   turn_server: "chat.{{ env_prefix }}{{ turn_domain }}"
-
-   is_transport_server: "{{ transports | default([]) | length > 0 }}"