ansible-role-ejabberd/tasks/main.yml

#SPDX-License-Identifier: MIT-0
---
# tasks file for ansible-role-ejabberd
- name: namespace
  k8s:
    state: present
    definition:
      apiVersion: v1
      kind: Namespace
      metadata:
        name: ejabberd

- name: repo
  kubernetes.core.helm_repository:
    name: ejabberd
    repo_url: https://sando38.github.io/helm-ejabberd
  register: repo_update

- name: update
  command: helm repo update
  when: repo_update.changed

- name: pvc for mariadb
  k8s:
    state: present
    definition:
      apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: db
        namespace: "{{ ejabberd_namespace }}"
      spec:
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: "{{ ejabberd_pvc_size_db }}"

- name: deployment for mariadb
  k8s:
    definition:
      apiVersion: v1
      kind: Deployment
      metadata:
        name: mariadb
        namespace: "{{ ejabberd_namespace }}"
      spec:
        replicas: 1
        selector:
          matchLabels:
            app: mariadb
        template:
          metadata:
            labels:
              app: mariadb
          spec:
            containers:
              - name: mariadb
                image: mariadb
                env:
                  - name: MYSQL_ROOT_PASSWORD
                    value: "{{ ejabberd_mariadb_root_password }}"
                  - name: MYSQL_USER
                    value: "ejabberd"
                  - name: MYSQL_PASSWORD
                    value: "{{ ejabberd_mariadb_password }}"
                  - name: MYSQL_DATABASE
                    value: "ejabberd"
                volumeMounts:
                  - name: data
                    mountPath: /var/lib/mysql
                ports:
                  - containerPort: 3306
            volumes:
              - name: data
                persistentVolumeClaim:
                  claimName: db

- name: service for mariadb
  k8s:
    definition:
      apiVersion: v1
      kind: Service
      metadata:
        name: mariadb
        namespace: "{{ ejabberd_namespace }}"
      spec:
        selector:
          app: mariadb
        ports:
          - port: 3306
            name: mariadb
        type: ClusterIP

- name: certificate
  k8s:
    state: present
    definition:
      apiVersion: cert-manager.io/v1
      kind: Certificate
      metadata:
        name: le-cert-eomdev
        namespace: ejabberd
      spec:
        secretName: le-cert-eomdev
        privateKey:
          rotationPolicy: Always
        commonName: "eom.dev"
        dnsNames:
        - "eom.dev"
        - "conference.eom.dev"
        - "proxy.eom.dev"
        - "upload.eom.dev"
        - "vjud.eom.dev"
        additionalOutputFormats:
        - type: CombinedPEM
        - type: DER
        secretTemplate:
          annotations:
            k8s-sidecar-target-directory: "certs/le-cert-eomdev"
          labels:
            helm-ejabberd/watcher: "true"
        issuerRef:
          name: ca-issuer
          kind: ClusterIssuer

- name: deploy
  kubernetes.core.helm:
    name: ejabberd
    chart_ref: ejabberd/ejabberd
    release_namespace: ejabberd
    create_namespace: true
    values:
      hosts:
        - eom.dev
      certFiles:
        secretName:
          - le-cert-eomdev
        sideCar:
          enabled: true
      listen:
        c2s:
          options:
            tls: true
      modules:
        mod_vcard:
          db_type: ldap
          ldap_rootdn: "cn=readonly,dc=eom,dc=dev"
          ldap_password: "{{ openldap_readonly_password }}"
          ldap_base: "ou=People,dc=eom,dc=dev"
          ldap_uids:
            uid: "%u@eom.dev"
          ldap_filter: "(&(objectClass=posixAccount)(memberOf=cn=ejabberd users,ou=ejabberd,ou=Services,dc=eom,dc=dev))"
          ldap_vcard_map:
           NICKNAME: {"%u": [uid]}
           GIVEN: {"%s": [givenName]}
           FAMILY: {"%s": [sn]}
           FN: {"%s, %s": [sn, givenName]}
           EMAIL: {"%s": [mail]}
           BDAY: {"%s": [birthDay]}
          ldap_search_fields:
            User: "%u"
            Name: givenName
            "Family Name": sn
            Email: mail
            Birthday: birthDay
          ldap_search_reported:
            "Full Name": FN
            Nickname: NICKNAME
            Birthday: BDAY
            authentification:
              - ldap
      ldap:
        ldap_servers:
          - openldap.openldap.svc.cluster.local
        ldap_port: 389
        ldap_rootdn: "cn=readonly,dc=eom,dc=dev"
        ldap_base: "dc=eom,dc=dev"
        ldap_password: "{{ openldap_readonly_password }}"
        ldap_filter: "(&(objectClass=posixAccount)(memberOf=cn=ejabberd Users,ou=ejabberd,ou=Services,dc=eom,dc=dev))"
        ldap_uids: 
          uid: "%u@eom.dev"
      sqlDatabase:
        enabled: false
      redis:
        enabled: false
      persistence:
        enabled: true
        size: 2Ti

- name: onionservice
  k8s:
    definition:
      apiVersion: tor.k8s.torproject.org/v1alpha2
      kind: OnionService
      metadata:
        name: ejabberd
        namespace: "{{ ejabberd_namespace }}"
      spec:
        version: 3
        rules:
          - port:
              number: 5222
            backend:
              service:
                name: ejabberd
                port:
                  number: 5222