Dustin C. Hatch
f9e8c78e5a
Because the various "webapp.*" users' home directories are under `/srv/www`, the default SELinux context type is `httpd_sys_content_t`. The SSH daemon is not allowed to read files with this label, so it cannot load the contents of these users' `authorized_keys` files. To address this, we have to explicitly set the SELinux type to `ssh_home_t`.
84 lines
1.9 KiB
YAML
84 lines
1.9 KiB
YAML
- name: ensure mod_wsgi is installed
|
|
package:
|
|
name=python3-mod_wsgi
|
|
state=present
|
|
notify: restart httpd
|
|
tags:
|
|
- install
|
|
|
|
- name: ensure rsync is installed
|
|
package:
|
|
name=rsync
|
|
state=present
|
|
tags:
|
|
- install
|
|
|
|
- name: ensure app group exists
|
|
group:
|
|
name=webapp.dcow
|
|
state=present
|
|
- name: ensure app user exists
|
|
user:
|
|
name=webapp.dcow
|
|
group=webapp.dcow
|
|
home=/srv/www/darkchestofwonders.us
|
|
createhome=yes
|
|
state=present
|
|
|
|
- name: ensure app home directory permissions are set
|
|
file:
|
|
path=/srv/www/darkchestofwonders.us
|
|
mode=0755
|
|
state=directory
|
|
|
|
- name: ensure publisher keys are trusted
|
|
authorized_key:
|
|
key: "{{ dcow_publisher_keys|join('\n') }}"
|
|
user: webapp.dcow
|
|
exclusive: true
|
|
|
|
- name: ensure authorized_keys file permissions are correct
|
|
file:
|
|
path: /srv/www/darkchestofwonders.us/.ssh/authorized_keys
|
|
mode: '0600'
|
|
owner: webapp.dcow
|
|
group: webapp.dcow
|
|
setype: ssh_home_t
|
|
|
|
- name: ensure virtualenv exists
|
|
become: true
|
|
become_user: webapp.dcow
|
|
pip:
|
|
name: pip
|
|
virtualenv: /srv/www/darkchestofwonders.us/venv
|
|
virtualenv_command: /usr/bin/python3 -m venv
|
|
|
|
- name: ensure dcow wsgi script is installed
|
|
copy:
|
|
src=dcow.wsgi
|
|
dest=/srv/www/darkchestofwonders.us/dcow.wsgi
|
|
mode=0644
|
|
|
|
- name: ensure dcow app is configured
|
|
copy:
|
|
src=production.ini
|
|
dest=/srv/www/darkchestofwonders.us/production.ini
|
|
mode=0644
|
|
- name: ensure screenshot storage directories exist
|
|
file:
|
|
path=/srv/www/darkchestofwonders.us/{{ item }}
|
|
owner=webapp.dcow
|
|
group=webapp.dcow
|
|
mode=0755
|
|
state=directory
|
|
with_items:
|
|
- screenshots
|
|
- thumbnails
|
|
|
|
- name: ensure apache is configured to serve darkchestofwonders.us
|
|
template:
|
|
src=darkchestofwonders.us.httpd.conf.j2
|
|
dest=/etc/httpd/conf.d/darkchestofwonders.us.conf
|
|
mode=0644
|
|
notify: reload httpd
|