add rudimentary gpodder role

roles/gpodder/defaults/main.yml

@@ -0,0 +1,18 @@
+gpodder_subdomain: "gpodder"
+gpodder_domain: "{{ gpodder_subdomain }}.{{ domain }}"
+
+gpodder_version: "80c41dc0c9a58dc0e85f6ef56662cdfd0d6e3b16"
+gpodder_release: "https://github.com/gpodder/mygpo/archive/{{ gpodder_version }}.zip"
+
+gpodder_internal_port: '2873'
+
+gpodder_db_username: gpodderuser
+gpodder_db_password: "{{ lookup('password', secret + '/' + 'gpodder_db_password length=32') }}"
+gpodder_db_database: gpodder
+
+gpodder_secret: "{{ lookup('password', secret + '/' + 'gpodder_secret length=16') }}"
+gpodder_staff_token: "{{ lookup('password', secret + '/' + 'gpodder_staff_token length=8 chars=ascii_lowercase,ascii_uppercase,digits') }}"
+
+# must match values in roles/common
+db_admin_username: 'postgres'
+db_admin_password: "{{ lookup('password', secret + '/' + 'db_admin_password length=32') }}"

roles/gpodder/handlers/main.yml

@@ -0,0 +1,2 @@
+- name: restart apache
+  service: name=apache2 state=restarted

roles/gpodder/tasks/gpodder.yml

@@ -0,0 +1,131 @@
+- name: Install gpodder dependencies
+  apt:
+    name: "{{ packages }}"
+    state: present
+  vars:
+    packages:
+    - libpq-dev
+    - libjpeg-dev
+    - zlib1g-dev
+    - libwebp-dev
+    - build-essential
+    - python3-dev
+    - virtualenv
+    - libffi-dev
+  tags:
+    - dependencies
+
+- name: Add gpodder user
+  user:
+    name: gpodder
+    home: /home/gpodder
+    create_home: yes
+    shell: /bin/bash
+    password_lock: yes
+    state: present
+    system: yes
+
+- name: Add gpodder postgres user
+  postgresql_user:
+    login_host=localhost
+    login_user={{ db_admin_username }}
+    login_password="{{ db_admin_password }}"
+    name={{ gpodder_db_username }}
+    password="{{ gpodder_db_password }}"
+    encrypted=yes
+    state=present
+
+- name: Create gpodder database
+  postgresql_db:
+    login_host=localhost
+    login_user={{ db_admin_username }}
+    login_password="{{ db_admin_password }}"
+    name={{ gpodder_db_database }}
+    state=present
+    owner={{ gpodder_db_username }}
+
+- name: Download gpodder {{ gpodder_version }} release
+  get_url:
+    url="{{ gpodder_release }}"
+    dest=/home/gpodder/gpodder-{{ gpodder_version }}.zip
+
+- name: Stop old gpodder instance
+  service: name=gpodder state=stopped
+  ignore_errors: True
+
+- name: Remove old gpodder directory
+  shell: rm -rf /home/gpodder/gpodder
+
+- name: Create gpodder directory
+  file: state=directory path=/home/gpodder/gpodder
+
+- name: Extract gpodder sources
+  unarchive:
+    src: /home/gpodder/gpodder-{{ gpodder_version }}.zip
+    dest: /home/gpodder/gpodder
+    remote_src: yes
+
+- name: Move sources in correct place
+  shell: mv mygpo-{{ gpodder_version }}/* . chdir=/home/gpodder/gpodder
+
+- name: Remove empty directory
+  shell: rm -rf /home/gpodder/gpodder/mygpo-{{ gpodder_version }}
+
+- name: Create virtualenv
+  shell: virtualenv venv chdir=/home/gpodder/gpodder
+
+- name: Install generic dependencies in virtualenv
+  shell: bash -c 'source venv/bin/activate && pip install -r requirements.txt' chdir=/home/gpodder/gpodder
+
+- name: Install dependencies for production in virtualenv
+  shell: bash -c 'source venv/bin/activate && pip install -r requirements-setup.txt' chdir=/home/gpodder/gpodder
+
+- name: Create gpodder media directory
+  file:
+    state: directory
+    path: "/data/gpodder"
+    owner: gpodder
+    group: gpodder
+    mode: 0750
+
+# TODO put env somewhere so we can use it for systemd unit, migration and cron
+
+- name: Run database migration script
+  shell: bash -c 'source venv/bin/activate && DATABASE_URL=postgres://{{ gpodder_db_username }}:{{ gpodder_db_password }}@localhost:5432/{{ gpodder_db_database }}?sslmode=disable SECRET_KEY={{ gpodder_secret }} python manage.py migrate' chdir=/home/gpodder/gpodder
+
+- name: Add systemd service to start gpodder automatically
+  template:
+    src=etc_systemd_system_gpodder.j2
+    dest=/etc/systemd/system/gpodder.service
+    owner=root
+    group=root
+
+- name: Register new gpodder service
+  systemd: name=gpodder daemon_reload=yes enabled=yes
+
+- name: Start new gpodder instance
+  service: name=gpodder state=started
+
+# TODO cron jobs
+# envdir envs/dev python manage.py update-toplist
+# envdir envs/dev python manage.py update-episode-toplist
+
+# envdir envs/dev python manage.py feed-downloader
+# envdir envs/dev python manage.py feed-downloader <feed-url> [...]
+# envdir envs/dev python manage.py feed-downloader --max <max-updates>
+# envdir envs/dev python manage.py feed-downloader --random --max <max-updates>
+# envdir envs/dev python manage.py feed-downloader --toplist --max <max-updates>
+# envdir envs/dev python manage.py feed-downloader --update-new --max <max-updates>
+
+- name: Create the Apache gpodder sites config files
+  template:
+    src=etc_apache2_sites-available_gpodder.j2
+    dest=/etc/apache2/sites-available/gpodder_{{ item.name }}.conf
+    owner=root
+    group=root
+  with_items: "{{ virtual_domains }}"
+
+- name: Enable Apache sites (creates new sites-enabled symlinks)
+  command: a2ensite gpodder_{{ item }}.conf creates=/etc/apache2/sites-enabled/gpodder_{{ item }}.conf
+  notify: restart apache
+  with_items: "{{ virtual_domains | json_query('[*].name') }}"

roles/gpodder/tasks/main.yml

@@ -0,0 +1 @@
+- include: gpodder.yml tags=gpodder

roles/gpodder/templates/etc_apache2_sites-available_gpodder.j2

@@ -0,0 +1,32 @@
+<VirtualHost *:80>
+    ServerName {{ gpodder_subdomain }}.{{ item.name }}
+
+    Redirect temp / https://{{ gpodder_subdomain }}.{{ item.name }}/
+</VirtualHost>
+
+<VirtualHost *:443>
+    ServerName {{ gpodder_subdomain }}.{{ item.name }}
+
+    SSLEngine               On
+    DocumentRoot            "{{ item.doc_root }}"
+    DirectoryIndex          index.html
+    Options                 -Indexes
+    HostnameLookups         Off
+    LogLevel                warn
+    ErrorLog                /var/log/apache2/gpodder.info-error_log
+    CustomLog               /var/log/apache2/gpodder.info-access_log common
+
+    ProxyRequests           Off
+    ProxyPreserveHost       On
+
+    <Directory /home/gpodder/gpodder/static>
+        AllowOverride None
+        Require all granted
+    </Directory>
+
+    Alias                   /static /home/gpodder/gpodder/static
+    ProxyPassMatch          ^/static !
+
+    ProxyPass               / http://localhost:{{ gpodder_internal_port }}/
+    ProxyPassReverse        / http://localhost:{{ gpodder_internal_port }}/
+</VirtualHost>

roles/gpodder/templates/etc_systemd_system_gpodder.j2

@@ -0,0 +1,30 @@
+[Unit]
+Description=Starts the gPodder server
+Requires=network.target
+After=network.target
+After=syslog.target
+
+[Service]
+Type=simple
+User=gpodder
+Restart=always
+RestartSec=3
+WorkingDirectory=/home/gpodder/gpodder
+ExecStart=bash -c 'source venv/bin/activate && python manage.py runserver 127.0.0.1:{{ gpodder_internal_port }}'
+Environment=DATABASE_URL=postgres://{{ gpodder_db_username }}:{{ gpodder_db_password }}@localhost:5432/{{ gpodder_db_database }}?sslmode=disable
+Environment=DEFAULT_BASE_URL=https://{{ gpodder_subdomain }}.{{ domain }}
+Environment=SECRET_KEY={{ gpodder_secret }}
+Environment=MEDIA_ROOT=/data/gpodder
+Environment=DEBUG=False
+Environment=MAINTENANCE=False
+Environment=STAFF_TOKEN={{ gpodder_staff_token }}
+Environment=DEFAULT_FROM_EMAIL=noreply@{{ domain }}
+Environment=EMAIL_BACKEND=django.core.mail.backends.smtp.EmailBackend
+Environment=EMAIL_HOST={{ domain }}
+Environment=EMAIL_PORT=587
+Environment=EMAIL_HOST_USER=noreply@{{ domain }}
+Environment=EMAIL_HOST_PASSWORD={{ lookup('password', secret + '/' + 'mail_noreply_password length=20 chars=ascii_lowercase,ascii_uppercase,digits') }}
+Environment=EMAIL_USE_TLS=True
+
+[Install]
+WantedBy=multi-user.target

roles/monitoring/files/etc_monit_conf.d_gpodder

@@ -0,0 +1,9 @@
+check process gpodder matching "python manage.py runserver"
+  group www
+  start program = "/bin/systemctl start gpodder"
+  stop program = "/bin/systemctl stop gpodder"
+  if failed port 2873 protocol http
+    with timeout 10 seconds
+    with retry 2
+    then restart
+  if 5 restarts within 5 cycles then timeout

roles/monitoring/tasks/monit.yml

@@ -145,6 +145,10 @@
   stat: path=/etc/tomcat9/server.xml
   register: tomcat10_config_file
 
+- name: Determine if gpodder is installed
+  stat: path=/home/gpodder/gpodder/manage.py
+  register: gpodder_config_file
+
 # ---------------------------------------
 
 - name: Copy ZNC monit service config files into place
@@ -287,6 +291,11 @@
   notify: restart monit
   when: pgsql11_config_file.stat.exists == True
 
+- name: Copy gpodder monit service config files into place
+  copy: src=etc_monit_conf.d_gpodder dest=/etc/monit/conf.d/gpodder
+  notify: restart monit
+  when: gpodder_config_file.stat.exists == True
+
 # ---------------------------------------
 
 # TODO add to fail2ban when monit_page_public == 1

roles/sslletsencrypt/defaults/main.yml

@@ -36,6 +36,7 @@ subdomains:
   - "chat"
   - "users"
   - "survey"
+  - "gpodder"
 
 # ntp
 ntp_servers:

roles/sslselfsigned/DESIGN.md

@@ -7,3 +7,8 @@ The CA cert is placed in the secret folder, you can install it eg. in Arch like
     sudo trust anchor --store secret/DOMAIN/sovereign-self-signed-cert/DOMAIN/etc/letsencrypt/live/DOMAIN/chain.pem
 
 It will then automatically be picked up by browsers like Firefox and Chrome.
+
+To trust the CA on the server itself (if you want to run some clients), do:
+
+    sudo cp /etc/letsencrypt/rootCA.crt /usr/local/share/ca-certificates/iot.fritz.box.crt
+    sudo update-ca-certificates

roles/sslselfsigned/tasks/selfsigned.yml

@@ -38,5 +38,10 @@
 
 - name: Retrieve the self signing CA to remove warning in users browser
   fetch: src=/etc/letsencrypt/live/{{ domain }}/chain.pem
-         dest="{{ secret }}/sovereign-self-signed-cert"
+         dest="{{ secret }}/sovereign-self-signed-ca"
+         fail_on_missing=yes
+
+- name: Retrieve the self signing CA and Cert to remove warning in users browser
+  fetch: src=/etc/letsencrypt/live/{{ domain }}/fullchain.pem
+         dest="{{ secret }}/sovereign-self-signed-chain"
          fail_on_missing=yes