xos/synchronizers/vcpe/steps/sync_vcpetenant_vtn.yaml

---
- hosts: {{ instance_name }}
  #gather_facts: False
  connection: ssh
  user: ubuntu
  sudo: yes
  vars:
      container_name: {{ container_name }}
      cdn_enable: {{ cdn_enable }}
      dnsdemux_ip: {{ dnsdemux_ip }}
      firewall_enable: {{ firewall_enable }}
      url_filter_enable: {{ url_filter_enable }}
      vlan_ids:
        {% for vlan_id in vlan_ids %}
        - {{ vlan_id }}
        {% endfor %}
      c_tags:
        {% for c_tag in c_tags %}
        - {{ c_tag }}
        {% endfor %}
      s_tags:
        {% for s_tag in s_tags %}
        - {{ s_tag }}
        {% endfor %}
      firewall_rules:
        {% for firewall_rule in firewall_rules.split("\n") %}
        - {{ firewall_rule }}
        {% endfor %}
      cdn_prefixes:
        {% for prefix in cdn_prefixes %}
        - {{ prefix }}
        {% endfor %}
      bbs_addrs:
        {% for bbs_addr in bbs_addrs %}
        - {{ bbs_addr }}
        {% endfor %}
      dns_servers:
        {% for dns_server in dns_servers %}
        - {{ dns_server }}
        {% endfor %}
      nat_ip: {{ nat_ip }}
      nat_mac: {{ nat_mac }}
      lan_ip: {{ lan_ip }}
      lan_mac: {{ lan_mac }}
      wan_ip: {{ wan_ip }}
      wan_mac: {{ wan_mac }}
      wan_container_ip: {{ wan_container_ip }}
      wan_container_netbits: {{ wan_container_netbits }}
      wan_container_mac: {{ wan_container_mac }}
      wan_container_gateway_ip: {{ wan_container_gateway_ip }}
      wan_vm_ip: {{ wan_vm_ip }}
      wan_vm_mac: {{ wan_vm_mac }}
      wan_next_hop: 10.0.1.253   # FIX ME
      private_ip: {{ private_ip }}
      private_mac: {{ private_mac }}
      hpc_client_ip: {{ hpc_client_ip }}
      hpc_client_mac: {{ hpc_client_mac }}
      keystone_tenant_id: {{ keystone_tenant_id }}
      keystone_user_id: {{ keystone_user_id }}
      rabbit_user: {{ rabbit_user }}
      rabbit_password: {{ rabbit_password }}
      rabbit_host: {{ rabbit_host }}
      safe_browsing:
        {% for mac in safe_browsing_macs %}
        - {{ mac }}
        {% endfor %}
      uplink_speed: {{ uplink_speed }}
      downlink_speed: {{ downlink_speed }}
      status: {{ status }}
      enable_uverse: {{ enable_uverse }}


  tasks:
  - name: Add hostname to /etc/hosts
    lineinfile: dest=/etc/hosts
      regexp='^127\.0\.0\.1'
      line="127.0.0.1 localhost {{ '{{' }} ansible_hostname {{ '}}' }}"
      owner=root group=root mode=0644

  - name: Check to see if network is setup
    stat: path=/root/network_is_setup
    register: network_is_setup

  - name: Add eth0.500
    shell: "{{ '{{' }} item {{ '}}' }}"
    with_items:
      - ifconfig br-wan down || true
      - brctl delbr br-wan || true
      - ip link del link eth0 eth0.500 || true
      - ip link add link eth0 eth0.500 type vlan id 500
      - ifconfig eth0.500 up
      - ifconfig eth0.500 0.0.0.0
      - ifconfig eth0.500 hw ether {{ wan_vm_mac }}
      - ip addr add {{ wan_vm_ip }}/{{ wan_container_netbits }} dev eth0.500
      - ip link set eth0.500 up
      - ip route del default || true
      - ip route add default via {{ wan_container_gateway_ip }}
    when: network_is_setup.stat.exists == False

  - name: install bridge-utils
    apt: name=bridge-utils state=present

  - name: now redo everything using a bridge
    shell: "{{ '{{' }} item {{ '}}' }}"
    with_items:
       - ip link del link eth0 eth0.500
       - ip link add link eth0 eth0.500 type vlan id 500
       - ip link set eth0.500 up
       - ifconfig br-wan down || true
       - brctl delbr br-wan || true
       - brctl addbr br-wan
       - brctl addif br-wan eth0.500
       - ifconfig br-wan hw ether {{ wan_vm_mac }}
       - ip addr add {{ wan_vm_ip }}/{{ wan_container_netbits }} dev br-wan
       - ip link set br-wan up
       - ip route del default || true
       - ip route add default via {{ wan_container_gateway_ip }}
       - ip link set dev br-wan promisc on
    when: network_is_setup.stat.exists == False

  - name: Remember that the network is setup, so we never do the above again
    shell: touch /root/network_is_setup

{% if full_setup %}
  - name: Docker repository
    copy: src=/opt/xos/synchronizers/vcpe/files/docker.list
      dest=/etc/apt/sources.list.d/docker.list

  - name: Import the repository key
    apt_key: keyserver=keyserver.ubuntu.com id=36A1D7869245C8950F966E92D8576A8BA88D21E9

  - name: install Docker
    apt: name=lxc-docker state=present update_cache=yes

  - name: install python-setuptools
    apt: name=python-setuptools state=present

  - name: install pip
    easy_install: name=pip

  - name: install docker-py
    pip: name=docker-py version=0.5.3

  - name: install Pipework
    get_url: url=https://raw.githubusercontent.com/jpetazzo/pipework/master/pipework
       dest=/usr/local/bin/pipework
       mode=0755

  - name: make sure /etc/dnsmasq.d exists
    file: path=/etc/dnsmasq.d state=directory owner=root group=root

  - name: Disable resolvconf service
    shell: service resolvconf stop
    shell: echo manual > /etc/init/resolvconf.override
    shell: rm -f /etc/resolv.conf

  - name: Install resolv.conf
    copy: src=/opt/xos/synchronizers/vcpe/files/vm-resolv.conf
      dest=/etc/resolv.conf

  - name: Verify if vcpe_stats_notifier ([] is to avoid capturing the shell process) cron job is already running
    shell: pgrep -f [v]cpe_stats_notifier | wc -l
    register: cron_job_pids_count

#  - name: DEBUG
#    debug: var=cron_job_pids_count.stdout

#  - name: make sure ~/bin exists
#    file: path=~/bin state=directory owner=root group=root
#    when: cron_job_pids_count.stdout == "0"

#  - name: Copy cron job to destination
#    copy: src=/opt/xos/synchronizers/vcpe/vcpe_stats_notifier.py
#      dest=/usr/local/sbin/vcpe_stats_notifier.py
#    when: cron_job_pids_count.stdout == "0"

#  - name: install python-kombu
#    apt: name=python-kombu state=present
#    when: cron_job_pids_count.stdout == "0"

#  - name: Initiate vcpe_stats_notifier cron job
#    command: sudo python /usr/local/sbin/vcpe_stats_notifier.py --keystone_tenant_id={{ keystone_tenant_id }} --keystone_user_id={{ keystone_user_id }} --rabbit_user={{ rabbit_user }} --rabbit_password={{ rabbit_password }} --rabbit_host={{ rabbit_host }} --vcpeservice_rabbit_exchange='vcpeservice'
#    async: 9999999999999999
#    poll: 0
#    when: cron_job_pids_count.stdout == "0"
{% endif %}

  - name: vCPE upstart
    template: src=/opt/xos/synchronizers/vcpe/templates/vcpe.conf.j2 dest=/etc/init/{{ container_name }}.conf

  - name: vCPE startup script
    template: src=/opt/xos/synchronizers/vcpe/templates/start-vcpe-vtn.sh.j2 dest=/usr/local/sbin/start-{{ container_name }}.sh mode=0755
    notify:
#    - restart vcpe
     - stop vcpe
     - remove container
     - start vcpe

  - name: create /var/container_volumes/{{ container_name }}/etc/dnsmasq.d
    file: path=/var/container_volumes/{{ container_name }}/etc/dnsmasq.d state=directory owner=root group=root

  - name: vCPE basic dnsmasq config
    copy: src=/opt/xos/synchronizers/vcpe/files/vcpe.dnsmasq dest=/var/container_volumes/{{ container_name }}/etc/dnsmasq.d/vcpe.conf owner=root group=root
    notify:
    - restart dnsmasq

  - name: dnsmasq config
    template: src=/opt/xos/synchronizers/vcpe/templates/dnsmasq_servers.j2 dest=/var/container_volumes/{{ container_name }}/etc/dnsmasq.d/servers.conf owner=root group=root
    notify:
    - restart dnsmasq

  - name: create directory for "safe" config
    file: path=/var/container_volumes/{{ container_name }}/etc/dnsmasq.d/safe state=directory

  - name: dnsmasq "safe" config
    template: src=/opt/xos/synchronizers/vcpe/templates/dnsmasq_safe_servers.j2 dest=/var/container_volumes/{{ container_name }}/etc/dnsmasq.d/safe/servers.conf owner=root group=root
    notify:
    - restart dnsmasq

  - name: copy base ufw files
    copy: src=/opt/xos/synchronizers/vcpe/files/etc/ufw/ dest=/var/container_volumes/{{ container_name }}/etc/ufw/
    notify:
    - reload ufw

  - name: redirection rules for safe DNS
    template: src=/opt/xos/synchronizers/vcpe/templates/before.rules.j2 dest=/var/container_volumes/{{ container_name }}/etc/ufw/before.rules owner=root group=root mode=0644
    notify:
    - reload ufw

  - name: base ufw setup uses /etc/rc.local
    template: src=/opt/xos/synchronizers/vcpe/templates/rc.local.j2 dest=/var/container_volumes/{{ container_name }}/etc/rc.local owner=root group=root mode=0755
    notify:
    - copy in /etc/rc.local
    - rerun /etc/rc.local

  - name: create directory for local programs
    file: path=/var/container_volumes/{{ container_name }}/usr/local/sbin state=directory

  - name: bandwidth limit script
    template: src=/opt/xos/synchronizers/vcpe/templates/bwlimit.sh.j2 dest=/var/container_volumes/{{ container_name }}/usr/local/sbin/bwlimit.sh owner=root group=root mode=0755
    notify:
    - reset bwlimits

  - name: copy simple webserver
    copy: src=/opt/xos/synchronizers/vcpe/files/etc/service/ dest=/var/container_volumes/{{ container_name }}/etc/service/ owner=root group=root
    when: status != "enabled"

  - name: make webserver script executable
    file: path=/var/container_volumes/{{ container_name }}/etc/service/message/run mode=0755
    when: status != "enabled"

  - name: generate the message page
    template: src=/opt/xos/synchronizers/vcpe/templates/message.html.j2 dest=/var/container_volumes/{{ container_name }}/etc/service/message/message.html owner=root group=root mode=0644
    when: status != "enabled"
    notify: restart vcpe

  - name: remove simple webserver
    file: path=/var/container_volumes/{{ container_name }}/etc/service/message state=absent
    when: status == "enabled"
    notify: restart vcpe

  - name: Make sure vCPE service is running
    service: name={{ container_name }} state=started

  handlers:
  # Use docker cp instead of single-file volume
  # The reason is that changes to external file volume don't show up inside the container
  # Probably Ansible deletes and then recreates the external file, and container has old version
  # Do this handler first, e.g., before restarting the container
  - name: copy in /etc/rc.local
    shell: docker cp /var/container_volumes/{{ container_name }}/etc/rc.local {{ container_name }}:/etc/

  # Dnsmasq is automatically restarted in the container
  - name: restart dnsmasq
    shell: docker exec {{ container_name }} killall dnsmasq

  - name: stop vcpe
    service: name={{ container_name }} state=stopped

  - name: remove container
    docker: name={{ container_name }} state=absent image=docker-vcpe

  - name: start vcpe
    service: name={{ container_name }} state=started

  - name: reload ufw
    shell: docker exec {{ container_name }} bash -c "/sbin/iptables -t nat -F PREROUTING; /usr/sbin/ufw reload"

  - name: rerun /etc/rc.local
    shell: docker exec {{ container_name }} bash -c "/etc/rc.local"

  - name: reset bwlimits
    shell: docker exec {{ container_name }} bash -c "/usr/local/sbin/bwlimit.sh restart"

  - name: restart vcpe
    shell: service {{ container_name }} stop; sleep 1; service {{ container_name }} start