ansible/.gitlab-ci.yml

image: rehashedsalt/ansible-env:bleeding
variables:
  ANSIBLE_INVENTORY: inventories/production-no-auto
  ANSIBLE_STRATEGY: free
  ARA_API_CLIENT: http
  ARA_API_SERVER: "https://ara.desu.ltd"
stages:
  - lint
  - test
  - play-pre
  - play-main
  - play-post
before_script:
  # Dump our key
  - eval $(ssh-agent -s)
  - echo "$ANSIBLE_SSH_KEY" | tr -d '\r' | ssh-add -
  - mkdir -p ~/.ssh
  - chmod -R 0700 ~/.ssh
  # Dump the vault password
  - touch /vaultpw
  - chmod 0600 /vaultpw
  - echo "$ANSIBLE_VAULT_PASSWORD" > /vaultpw
  # Fix perms on the playbook root
  - chmod -R 0750 .
  # Join the Zerotier management network
  - |
    [ -n "$ZEROTIER_NETWORK_ID" ] && \
    service zerotier-one start && \
    sleep 5 && \
    zerotier-cli join "$ZEROTIER_NETWORK_ID" && \
    sleep 5 && \
    zerotier-cli info && \
    zerotier-cli listnetworks
  # Get ready for execution
  - ansible-galaxy install -r requirements.yml
  # Set up our callback plugins
  - source <(python3 -m ara.setup.env)
  # Run a quick test SSH connection to the bastion box
  - ssh -o StrictHostKeyChecking=no ansible@bastion1.dallas.mgmt.desu.ltd uptime
  # And a quick test SSH connection over proxy
  - ssh -o StrictHostKeyChecking=no -o ProxyCommand="ssh -W %h:%p -q ansible@bastion1.dallas.mgmt.desu.ltd" ansible@bastion1.dallas.mgmt.desu.ltd uptime
after_script:
  - |
    [ -n "$ZEROTIER_NETWORK_ID" ] && \
    zerotier-cli leave "$ZEROTIER_NETWORK_ID"

Lint:
  stage: lint
  interruptible: yes
  except:
    - pipelines
    - schedules
  script:
    - ansible-lint --version
    - ansible-lint site.yml

Test:
  stage: test
  retry: 1
  interruptible: yes
  except:
    - pipelines
  script:
    - ansible-playbook --skip-tags no-test,no-auto -C site.yml --ssh-common-args='-o ProxyCommand="ssh -W %h:%p -q ansible@bastion1.dallas.mgmt.desu.ltd"' --vault-password-file /vaultpw || error="$?"
    - if [ "$error" -eq 4 ]; then echo "Some hosts were unreachable; masking error"; unset error; fi
    - if [ -n "$error" ]; then echo "Return code $error"; false; fi

# PRE-MAIN CONFIGURATION
Local:
  stage: play-pre
  script:
    - ansible-playbook --skip-tags no-auto playbooks/site_local.yml --ssh-common-args='-o ProxyCommand="ssh -W %h:%p -q ansible@bastion1.dallas.mgmt.desu.ltd"' --vault-password-file /vaultpw
Pre:
  stage: play-pre
  script:
    - ansible-playbook --skip-tags no-auto playbooks/site_pre.yml --ssh-common-args='-o ProxyCommand="ssh -W %h:%p -q ansible@bastion1.dallas.mgmt.desu.ltd"' --vault-password-file /vaultpw

# MAIN CONFIGURATION
Main:
  stage: play-main
  script:
    - ansible-playbook --skip-tags no-auto playbooks/site_main.yml --ssh-common-args='-o ProxyCommand="ssh -W %h:%p -q ansible@bastion1.dallas.mgmt.desu.ltd"' --vault-password-file /vaultpw
Common:
  stage: play-main
  script:
    - ansible-playbook --skip-tags no-auto playbooks/site_common.yml --ssh-common-args='-o ProxyCommand="ssh -W %h:%p -q ansible@bastion1.dallas.mgmt.desu.ltd"' --vault-password-file /vaultpw
Nagios:
  stage: play-main
  retry: 1
  script:
    - ansible-playbook -l web3.dallas.mgmt.desu.ltd playbooks/prod_web.yml --tags nagios --ssh-common-args='-o ProxyCommand="ssh -W %h:%p -q ansible@bastion1.dallas.mgmt.desu.ltd"' --vault-password-file /vaultpw

# CLEANUP
Cleanup:
  stage: play-post
  script:
    - ansible-playbook --skip-tags no-auto playbooks/site_post.yml --ssh-common-args='-o ProxyCommand="ssh -W %h:%p -q ansible@bastion1.dallas.mgmt.desu.ltd"' --vault-password-file /vaultpw